April 30, 2013: Criminal computer hacking is going mainstream. This can be seen from a recent incident, where a Facebook page advertising hacker software used to steal money from other people’s accounts was discovered by some bank security company employees. Facebook took down the page as soon as they were notified, but the page had been up for several months and apparently sold hundreds of the Zeus Trojan program, along with instructions on how to use it to obtain the bank IDs and passwords. If you are careful, stealing money using something like Zeus makes the crime pretty low-risk. This is especially true if you live in a country that does not extradite a lot of people for bank fraud.

You use the Zeus Trojan by renaming this program file as a document and attaching it to a phony email addressed to specific individual. Using whatever story you can come up with you try and convince the recipient to try and open the attachment. When that is done, the Zeus program is secretly installed and waits for the user to access their bank online. When that happens Zeus eventually sends the user ID and password for the victim’s bank account to the hacker. At that point you have to use some other procedures to send money from the victims account to another bank account you control and then eventually withdraw the cash. This is where a lot of people get caught, as you have to do this in a way that makes it difficult for the police to trace the stolen money to the thief.

This process of sending out the phony email with the Trojan program attached is known in the trade as "spear fishing" (or "phishing"). This is also used by Internet based spies and is now a popular Cyber War technique that sends official looking email to specific individuals, with an attachment which, if opened, secretly installs a program that sends files from the email recipient's PC to the spear fisher's computer. In the past few years an increasing number of military, government, and contractor personnel have received these official looking emails, with a PDF document attached and asking for prompt attention. Despite being widely known, spear fishing still works and intelligence gathering organizations use it more and more. But the biggest users are people out to loot someone else’s bank account.

In the past you had to know your way around the Internet underground to find these tools and instruction on how to use them. Now, with the tools being sold openly, more people have access. At the same time the police and corporate security staff have become more effective at catching thieves using stuff like the Zeus Trojan. If you are very careful you can still avoid getting caught but you will probably encounter more instances where police or bank security activity blocks you from getting your stolen loot. At the same time more rank amateurs are using these tools for espionage, usually of the commercial (not government) variety. Cyber crime is becoming a much more common and more of the practitioners are very new to this sort of thing. This gives the police more Internet based crooks they have a good chance of catching. The pros are still very difficult to nail.