Photos: James Duncan Davidson

Cybersecurity specialist James Lyne takes the TED2013 stage to show us some of the newest and nastiest creations that cybercriminals have designed to steal data, make off with billions of dollars, watch people through their webcams and target power and utility companies. Every day, he says, about 250,000 new pieces of malware are created and 30,000 websites infected.

“People think that, if you get a computer virus, you’ve been on a porn site,” says Lyne, of the security firm Sophos. “Actually, statistically speaking, if you only visit porn sites you’re safer.” Shockingly, 80% of infecting sites are actually small businesses or other legitimate enterprises that have themselves been infected.

The world of malware is becoming commercialized. Cybercriminals now advertise online, offering their services for $10 to $50 per hour. Lyne shows this video as an example.

http://www.youtube.com/watch?v=c9MuuW0HfSA

There are sites where you can test a virus to make sure it works before unleashing on the world, and sophisticated services for tracking your malware. Some of these services even offer customer support.

So what are some ways to infect a computer with malware? In addition to the old “Hello, I’m a Nigerian banker,” you could, perhaps, walk into a corporate lobby with a copy of your resume soaked in coffee, and make a sad face and ask the receptionist to plug in a USB key and print you a new copy. Or perhaps you can target a website that has an insecure comments section; anyone who visits the page will then be infected. And there’s a new tactic that Lyne has noticed — creating a virus that pops open a fake anti-virus protection software window on a person’s screen. By clicking the button, not only does a person give a hacker access to their computer, but might even pay for the privilege.

So many stories about cybercrime are terrifying. But Lyne has a success story to share — a time he was able to track the group of cybercriminals behind the Koobface malware. This group didn’t protect their malicious code, which was written to send each of them a text message daily to show them how much money they’d accumulated. In other words, Lyne’s team had their phone numbers. From there, he could tell they were located in Russia.

Because many smartphones embed GPS data about where photo is taken, Lyne was able to find the hackers’ exact location through photos they uploaded to Flickr. From there, Lyne’s team generated a 27-page report filled with information about this group — including an ad one of them had posted for the sale of kittens, shots from a fishing trip, a photo of their office on the third floor of a building and images from the office Christmas party. He eventually even found their bank accounts.

Sadly, Lyne reveals that this report wasn’t enough to bring these hackers to justice. Most laws pertaining to cybercrime are national, and because there is no common definition between countries, this group is still at large.

Lyne stresses that, for the time being, the onus is on individuals to protect themselves by creating different passwords for different websites and using basic internet safety protocols. For example, don’t upload smartphone photos to an online dating site — Lyne has found that 60% of photos there contain location data. But vulnerabilites can be even more subtle than that. As you move through the world, using your phone to connect to wireless networks Lyne warns that you are “beaming a list of the wireless networks you’ve previously connected to.”

Lyne collected data on the TED2013 audience by tracing these signals:

• 23% had been to Starbucks recently
• 46% could be linked to a specific business
• 761 could be traced to a specific hotel
• And 234 could be traced to coordinates of their homes

“As we play with these shiny new toys, how much are we trading off convenience over privacy and security?” asks Lyne. “The internet is a fantastic resource for business, art and learning. Help me and the security community make life much more difficult for cybercriminals.”

James Lyne’s talk is now available for viewing. Watch it on TED.com »