Translator: Ulla Vainio Reviewer: Sami Andberg
Internet. Of course TEDx, and the whole TED owes a lot to the Internet.
TED would hardly exist as it is today without the web.
In fact we are all here thanks to the Internet.
We all heard about TEDxHelsinki on the web.
We signed up on the Internet.
TED was born in the real world,
but it gained its reputation through videos on TED.com,
which probably is how we all got to know about this phenomenon.
And, of course, we have discussed about this day in advance
on Twitter and Facebook.
Facebook, Facebook indeed.
Facebook, which has
soon two million Finns, 500 million people in total.
Facebook, which
is a rather interesting phenomenon if we think about
a modern day teenager. If he is not on Facebook,
he will not meet girls, because all the girls are there.
If he does not meet girls, he will not reproduce.
So even the damn evolution is driving us
to join Facebook. (Laughter)
Quite a phenomenon.
Which makes it even more embarrassing
to admit that I am not on Facebook.
Or actually I am. I've reserved my name and face,
so that no one else could take my identity
and appear as me -- and of course in this profession
you become and have to become paranoid.
But the real reason why
I am not using Facebook
is not that I would be particularly worried about
data security on Facebook or that I would be against Facebook.
It's just common sense.
Based on my profession.
My job is to track criminals. Organized criminal groups.
And professional online criminals,
who make a decent profit from their Internet crimes,
collect millions on the Internet,
and their most concrete threat are the security companies.
And they know who we are, where we are and what do we do.
So I am, of course, not interested in sharing information --
about my family or friends, or where I live,
or anything else like that.
I've never talked about my family anywhere,
but now, in the spirit of TED, I'd like to make an exception
and talk about an incident where my own son
did a phishing attack on me.
(Laughter)
I've got this teenager at home,
(Applause)
and he, like every teen nowadays,
is a nerd, a big nerd, maybe he has inherited that.
(Laughter)
Of course as a responsible father,
I have taken care of the computer security
and put up firewalls and filters of all kind.
Including this filter that blocks --
well it tries to block violent pages and Goatse pages,
but also, most importantly, it shuts down the computer at night.
When it's 9pm, the computer shuts down.
You can imagine it sucks, when the computer shuts down at 9 pm.
And when this filter hits, it locks up the computer,
you can't access the web, and the only way to unblock it
is to give the administrator password.
Well, daytime one weekend,
my son shouts from upstairs,
"Dad, come and see this." For some reason the filter,
which our company had made,
blocked his own website. He has his own website, of course.
Every kid must have one.
And indeed, it had blocked his site,
and I was wondering,
why on earth does it do that,
it should not block it
under any circumstances.
I go like, "let me have a look", and type in the administrator password
and -- (Laughter)
(Applause)
And the moment I hit enter, I got it,
oh, right -- (Laughter)
"I see, I see" (Laughter)
And you can imagine
how proud a father is --
(Laughter) (Applause)
Yes, I let him keep the administrator password.
I somehow felt he deserved it. (Laughter)
This is the next generation.
The generation which lived all their lives
with Google. They had Wikipedia.
They've had all these other services.
Awesome times.
I think computerization and the web phenomenon,
the creation of the web, which happened in our lifetime,
will go down in history as one of the big turning points.
This next generation will take it as given.
We can give pretty great things to this next generation.
And if we stop and think of all the things
we got from the web and what we are giving forward,
it is full of these services
we all use every day.
It is probably quite a big change historically, too.
But it also carries some threats.
If we think about what is threatening the web,
what could threaten
this triumphal march of the web in the future --
There are certain threats.
There is, of course, Internet censorship,
and discussions about network neutrality filtering.
There are technical limitations,
threats that some countries
will filter the web traffic of others.
And there is cyber warfare,
Internet sabotage, cyber espionage,
and simply Internet crime.
Yes, Internet crime.
Yes.
Facebook.
How many of you noticed that this 'Facebook page'
did not originate from facebook.com?
The domain is com-00987676.info,
which has nothing to do with Facebook.
Why are these pages and such attacks
on the web?
Because when somebody's Facebook account and password are taken,
messages are sent to his Facebook friends in his name.
Messages with links to webpages,
which have exploits
that typically via some flaw in Java,
Flash or PDF Reader - plugin,
take control of your friend's computer
and install a keylogger which records their credit card number
the next time they do some online shopping and type in their number.
Almost everybody knows somebody whose credit card number has been snatched.
And whenever it happens, people often think,
damn it, Master or Visa number was stolen,
it must have been during the last holiday trip,
somebody has swiped the card twice at a bar,
or maybe somebody put a skimmer on an ATM.
Immediately you think it was in the real world.
And, of course, it also happens in the real world,
but I'd say that most of the time,
it's stolen from the victims' own computers
with keyloggers or malicious software.
The downside is that when you notice it,
you call the bank, complain,
ask and get a new card, and then you go and use
the new card again at your computer
and it is stolen again.
These online crimes are somewhat complex,
and it is a challenge
to explain it to normal web users.
These attacks have changed so wildly.
When I started studying viruses in the beginning of the 90s,
this is how they were.
This is a virus called Joshi.
Once a year, when you start the computer,
it won't start, but the author of the virus, called Joshi,
stops the computer with the virus and asks the user to type in
birthday wishes before the booting is completed.
These viruses from the good old times --
the users knew they had a malicious software,
because the software told about itself.
You got stick figures,
music, you are asked to type something,
CD-ROM drive starts opening and closing,
all kinds of funny stuff.
Today's malicious software does not play music,
shows no stick figures, does nothing
from which it could be noticed.
They also don't spread nearly as aggressively,
because the authors are interested in money.
They make money with these attacks.
They do it professionally.
If they write a malicious software that spreads too fast,
it will end up on the front pages.
And these guys don't want that.
It gives you the illusion that
since you no longer see viruses being reported in magazines,
people think that the situation is better.
That we used to have a lot of viruses,
and now there are less.
The fact is, we've never had a worse situation.
The professional attacks are invisible.
I would like to show an example
of how complicated it can be.
An example of how difficult it is to explain them.
Phenomena like the Partnerka attacks.
Partnerka, basically Russian and Ukrainian
affiliate networks, criminal ones,
such as this Ya!Bucks.
You can find hundreds of similar networks.
Anybody can sign up for such a network
and become a reseller of products.
When you resell products in affiliate networks,
the seller gets part of the commission.
In this particular network, the sold product is
a software, Windows program called DataDoctor 2010,
which is a program for repairing broken files.
For example if your JPG picture is broken
so that it won't open, this might be able to fix it.
Or if your Word document is corrupted,
this may be able to fix it. This is a real software,
and it works. It may not be the best one on the market, but it's no con.
It can really fix files that are broken in a certain way.
The strange thing is that the company
from Kiev, Ukraine,
the software company doing this,
does not sell or market its program at all.
All of the sales and marketing are done via the affiliate network,
and all their resellers are criminals.
They are entities, which with their malicious software
have contaminated and taken control
of tens of thousands, perhaps hundreds of thousands of computers.
They try to convert
these contaminated computers into cash.
They do it by
forcing the owners of the contaminated computers
to buy this software.
How do you force someone to buy a file repair program?
You do it by corrupting
the user's files.
From the user's point of view,
he is using the computer as usual,
and suddenly he gets an error message.
An error message where Windows says
that something has gone really wrong. And then Windows restarts.
It looks pretty real. But it's fake.
This message is not from Windows.
There is nothing wrong with the computer.
However, the bot on the user's computer
restarts the computer in Windows safe mode.
Then it shows a new message,
where it claims to have detected disk errors,
and at this point the user must be worried about his documents.
When the user now tries to open them,
not one of them works.
Not a single DOC or PPT opens,
no Excel sheet will open.
Same thing for text files, PDFs, JPGs. Nothing works.
Everything is broken.
In fact, these files are not corrupted.
They are encrypted. The malicious software
has gone through all the documents and encrypted them.
At this point the user --
most of us probably, would start to panic more or less.
All the important data is gone. I guarantee that at this point,
everyone clicks on the "Repair file" button.
And as you can imagine,
when you click, the DataDoctor product is downloaded and installed.
When clicking "File Fixer",
it goes through the disk and finds all the important broken files,
and if you click "Fix it!", yes,
it really fixes the broken files.
But it only fixes one,
because it's an unregistered version of the software.
If you want to fix them all, you need to register the product.
It costs $91.45, 50 % of which go to the Ukrainian firm,
which made the program,
and 50 % go to the net criminals,
which originally contaminated the computer
and broke the files.
So what they are doing is,
they're taking the user's data as hostage. Asking ransom for it.
But this is not how the user sees it.
The user thinks, "Oh no, the disk broke and I lost all my data."
"Luckily Microsoft recommended this excellent program, which fixed everything."
"I will recommend this software to all my friends."
These operations are remarkably widespread.
Maybe the biggest operation known
was called Innovative Marketing Ukraine, organization called IMU,
which had a turnover of about € 160 million through these operations,
and to give some measure, F-Secure has now a € 135 million turnover.
The head coders of IMU were all from Ukraine.
But the master brains behind the operation were not.
They were Shailesh Jain and Björn Sundin,
an Indian-American and a Swedish fellow,
which are both found at the moment
at the Wanted page of Interpol.
Their locations are currently unknown.
This as an example of what is going on on the web.
These are big challenges,
because if we think about the future of the Internet
and what is threatening it,
then yes,
I'm afraid that the whole existence of the Internet
and the net's credibility and people's trust for it
is being disturbed by Internet crime.
If we don't do something about it,
it will have significant consequences.
Whenever we talk about trusting the net,
we can also think about it the other way round.
Maybe it is good that the trust is taken away,
because now people trust too much.
Now folks are clicking every link, opening every EXE,
giving their credit card number on every forum.
Maybe it is good to break that trust
and to rebuild it.
But the most important thing,
that we should be able to do,
is to understand that there are criminals on the net,
not unlike those in the real world.
We have criminals in the real world.
The fact that we have criminals
does not make the real world unusable.
The fact that we have Internet criminals does not make the Internet unusable.
You can still be and trade there.
But we have to fight those criminals.
We need to understand that they're there.
And it's something for which we can work together.
Thanks.