RealTime IT News

Security Firms Warn: Data Thieves Love Tax Time

Valentine's Day is a the season for social engineering, as many people hope for a note from a mysterious and fascinating someone and are therefore more willing to open suspicious messages and attachments than at any other time.

Unfortunately, it is now the season for data theft. It's at tax time that the highest quantity of valuable data crosses the Internet and data thieves are surely hoping for a feast. Tax data is valuable not just because it contains financial information but also for the personal information it contains.

"Cisco IronPort expects to see more targeted attacks emulating local tax authorities over the coming weeks and months," wrote Nilesh Bandhari, product manager at Cisco's security appliance subsidiary IronPort Systems to InternetNews.com. The company reported a sophisticated attack from Canada, where phishers are pretending to be the Canadian Revenue Agency (CRA).

There's plenty of personal data online at tax time in the U.S. alone, without adding in the volume the rest of the world generates. The IRS said that more than 87 million returns were filed electronically in 2008 via e-file, the system for filing tax returns over the Internet, representing about 60 percent of the total filings for the year.

The IRS' goal for e-file is set in statute: the Internal Revenue Service Restructuring and Reform Act of 1998 (RRA98) stated that 80 percent of all returns should have been filed online by 2007, and the report explains why this goal was not achieved.

The IRS finally came to the conclusion that more than 20 percent of the U.S. population either did not have access to or did not adopt the technology necessary to achieve 80 percent electronic filing. It reset the goal, hoping now to achieve 80 percent e-file by 2012.

There's gold in them thar names

Security experts who monitor the online marketplaces where stolen data changes hands say that it's personal information, rather than just credit cards, that the bad guys are after.

"So many credit cards are for sale," said David Perry, global director of education for Trend Micro, "that credit card data is not worth as much as it used to be. Personal data like a pet's name or a mother's maiden name can be worth more."

Those who sell to organized crime are learning to package stolen data in new ways in order to make it more attractive. Criminals are looking for complete data sets that will allow them to steal someone's identity or conduct other profitable criminal activities.

Next page: Improving their malicious skills.