Japan Leads in Cyberattacks

[Invisible]

What Japan lacks in geographic size, it more than makes up for in Internet attack traffic.

Japan accounted for 30% of all attack traffic monitored worldwide for the second quarter of 2008, according to a new study issued by content delivery network provider Akamai. The study, which was conducted by monitoring Akamai's global network of more than 30,000 servers, measured distributed denial-of-service attacks, Web site hacking attempts and DNS hijackings for 139 countries around the world. The United States had the second-highest percentage of attack traffic for the second quarter, at 21.5%, while China came in third at 16.8%.

Japan's high percentage of global attack traffic marks a big jump from the country's percentage of attack traffic in the first quarter, which accounted for only 3.6% of traffic worldwide. Akamai says it is unsure why so much attack traffic originated from Japan this quarter, and noted that "there does not appear to be a clear and obvious link between the high-speed connectivity and the likelihood that a country is a leading source of attack traffic." Japan ranks third in high-broadband IP connections per capita, Akamai reports, trailing only South Korea and Sweden.

In addition to reporting on global attack traffic, the study also found that:
-- Scandinavian countries continue to lead the world in unique IP addresses per capita, with Sweden, Norway and Finland accounting for three of the top four countries in IP connectivity worldwide. The United States, with 0.34 unique IPs per capita, placed seventh in the world.

-- 26% of U.S. Internet connections achieve speeds of 5Mbps or greater, placing the United States sixth in the world for the highest percentage of high-speed Web connections. The top country is South Korea, where 64% of all connections are at speeds of 5Mbps or higher, followed by Japan with 52% and Hong Kong with 39%. The United States also ranked fifth in per-capita high broadband connections, with 0.09 connections of 5Mbps or greater per capita.

-- The United States currently ranks 15th worldwide in broadband density, with an average of 23.3 broadband subscribers per 100 residents. Denmark ranks first in the world with 35.1 broadband subscribers per 100 residents.

Cybercrime 'Major Business Risk'

Cybercrime is more than a buzzword, it's a critical business concern, say 1,387 IT professionals surveyed by security firm Finjan.

Ninety-one percent of respondents call cybercrime a "major business risk," and 73% say they are more concerned about data theft than about downtime and loss of productivity from malware. In addition, 25% of respondents admit to data breaches in their organizations, according to the survey that Finjan conducted in July and released today.

Cybercrime's impact is no surprise to those on the front lines.

"Fraud today is highly sophisticated, and the people doing it get smarter and smarter, so we have to, also," says Gilbert Fiorentino, CEO at TigerDirect. The computer and electronics equipment retailer is a subsidiary of Systemax, which also owns CompUSA.

When credit cards are stolen in volume in big heists like the one perpetrated against TJX, those stolen cards are put to use by fraudsters who try to rip off stores like TigerDirect, Fiorentino says.

TigerDirect has 30 retail stores as well as an online Web sales operation for businesses and consumers. According to Fiorentino, the majority of the unrelenting attempts to hoodwink TigerDirect with stolen credit- and debit-cards will occur online in consumer sales.

A retailer like TigerDirect is an attractive target for those trying to use a stolen card because computer and electronics merchandise is easy to sell on the black market, Fiorentino points out.

One common ploy these days is for a fraudster to watch the home of a person whose credit-card information has been stolen, to determine if the person is out of the house most of the day, says Fiorentino. Fraudsters know retailers are more suspicious if a credit-card order requests delivery to a different address than the billing address of the credit card. So a fraudster might place orders to have equipment sent to the victim's home, and then intercept it, pretending to live there.

TigerDirect's home-grown antifraud system, developed over many years, seeks to raise a red flag on any manner of suspicious sales.

Red flags would be raised, for instance, for payment card data submitted from any IP address in Eastern Europe, or card numbers that have traversed through so-called anonymizer sites that hide the originating IP address. But there's plenty of U.S. domestic online fraud attempts to worry about, too, Fiorentino adds.

TigerDirect handles 20,000 to 40,000 orders for its goods each day, depending on the time of year, and most are shipped the same day the order is received. But online fraud attempts slow things down and place a burden on productivity.

"In our automated system, 83% of our orders require no manual review," says Fiorentino. But the remaining 17% of orders get a red flag that requires human intervention. Possible actions might include calling a customer, a bank or other steps to ensure credit-card fraud won't occur.

In spite of caution and preemptive actions, TigerDirect will still get hit by costly card-related fraud each year through a small percentage of bad sales -- which the retailer absorbs, not the victim of the stolen card. "It costs us millions and it costs the industry billions," Fiorentino says.

One step the company has recently taken is to use a service from fraud-management service provider Ethoca that provides a secure way for businesses accepting payment cards to share information about fraudulent card use instantly with each other. This is done in an anonymous way, so merchants can check to see if specific card fraud is occurring with another merchant.

The idea is that retailers collaborating together to discretely share fraud data will result in a better defense than each one of them on their own, Fiorentino says.

Credits to: PC World