Crime and Cyber-crime

Download Crime and Cyber-crime

Post on 22-Feb-2016




0 download

Embed Size (px)


Crime and Cyber-crime. Pieter Hartel. Crime. Acts or missions forbidden by law that can be punished [] , against: persons (e.g. rape, assault, murder, suicide) property (e.g. fraud, arson, theft, vandalism) the state (e.g. riot, treason, sabotage, terrorism) - PowerPoint PPT Presentation


Distributed and Embedded Systems (DIES)

Crime and Cyber-crimePieter HartelFocus on targets and routine activity1Cyber-crime Science2CrimeActs or missions forbidden by law that can be punished [], against:persons (e.g. rape, assault, murder, suicide)property (e.g. fraud, arson, theft, vandalism)the state (e.g. riot, treason, sabotage, terrorism)morality (e.g. gambling, drugs, obscenity)Disorder is broader than crime, e.g.Littering, graffiti, loitering, etc.[Wil98] J. Q. Wilson and R. J. Herrnstein. Crime & Human Nature: The Definitive Study of the Causes of Crime. Free Press, Jan 1998.Cyber-crime Science3Example

Problem: no backup3Cyber-crime Science4Cyber-crimeCrime where computers are used as a tool, target or place:Computer assisted crime(e.g. Advance fee fraud)Computer integrity crime(e.g. DDoS attack)Computer content crime(e.g. Software piracy)[New09] G. R. Newman. Cybercrime. In M. D. Krohn, et al, editors, Handbook on Crime and Deviance. Springer, Nov 2009.

Technology mediated crime is old, especially weaponsAdvance fee fraud with letters attack with mail order catalogs etcSoftware piracy see Dickens4Technology and crimeCyber-crime Science5Which of these are virtual?Which of these promote anonymity?TechnologyProblemSolutionWhenSailing shipsPrivateeringTreaties1856Paper moneyCounterfeitingLaws, Technology17th 20thRevolverGenocide??CarsTheftLocks20thPhoneNuisance callsCaller-ID20thInternetFraud, Theft?? US constitution authorised Congress to issue letters of Marque in 1787 Ended by the treaty of Paris 1856 Watermark & Thread technology Invented 1836 Invented 1968

Virtual : Paper money, Phone, InternetThese also promote anonymity5Cyber space vs meat spacevirtual but thats nothing new (why?)More easily automated (why?)Harder to police (why?)Cyber-crime Science6Money is equally virtualComputersGlobal issues, anonymity6Cyber-crime Science7Some examples

Cyber-crime Science8Computer assisted crimeMurder13-year old US girl bullied into suicide in 20063-month old Korean child dies from neglect in 2010ExtortionVirginia DHP ransom demand 10 M $ in 2009BetCris hacker sentenced to 8 years in 2006(New business )

8 Drew, mother of friend invented Joshon social network lost pound since birth because of neglegt, parents went to PC Bang in Balokovo (RU) tracked down by Barrett Lyon who founded ProlexicZmbie hunters: Science9Computer integrity crimeDistributed denial of service (DDoS) Estonian Cyber war in 2007Operation Payback end 2010 mid 2011HackingComcast hackers sentenced to 18 months in 2008Sarah Palin email hacker sentenced to 1 year in 2010

9 began April 2007 relocated in April 2007DDoS between proponents and opponents of online piracy;Bollywood hired Aiplex to take out sites. Retaliation too late, deflected to IFPI, MPAA etc engineering of Comcast staff, access to DNS servers, routed traffic Comcast customers to hacker sites Kernell, son of Memphis Senator used account recovery of yahoo to gain access to Palins mail Science10Computer content crimePiracyPirate Bay four sentenced to 1 year in 2009US Software pirate sentenced to 2 years in 2011Data base theftSony Play station network hack in 2011 exposed 77M accounts, cost 171M$ exposed 1M passwordsTJX Hacker sentenced to 20 years in 2011

10 Swedes who ran the site and a business partner sentenced, appeal refused in 2012Damages claimed to be $6.8M with flowers for the wife of an expert witness for the defense Jones made $400,000 from selling pirated software text passwords seinfeld, password, 123456, winner Gonzalez comnducted war driving against TJX stores, stole magstripe info, sold this via Ukranian national Yastremskiy to carders. Yastremskiy sentences in 2007 to 30 years in princion in Turkey. Gozalez hired by secret service at $75,000 a year and continued his criminal careerCyber-crime Science11CertificateSigned bindingof a public keyand an identity

11 Science12How does a certificate work?ServerGenerates key pair and keeps private key secretSends public key to CA

Encrypt message with private key

CACA signs & publishes public key

UserObtain certificateCheck CA signature Check revocation list

Decrypt message with public keyUser knows that it is talking to the server.Operation Black Tulip Cyber-crime Science13Certificate fraud2001 VerisignOffender claimed to be from Microsoft2 rogue certificatesDiscovered by Verisign2011 DigiNotarOffender(s) hacked the server, No anti virus and weak passwordsHundreds of rogue certificatesDiscovered by Iranian Gmail user2011 Comodo13 Science14Additional problemsDigiNotar had been hacked before (2009)Microsoft delayed patches for NL by week to prevent blackoutNo backup certificatesThere are hundreds of companies like DiginotarFalse certificates still accepted by older browsers that have not been patched...

Cyber-crime Science15DifferencesOld CrimeSerialLabour intensiveLocalGeographical placeCyber-crimeCan be SimultaneousCan be automatedGlobalEffort?Requires conversion to meat spaceCyber-crime Science16SimilaritiesMost Cyber-crime a variant of old crimeAdvance fee fraud via email vs lettersClick fraud vs Replying to junk mail with bricksTechnology used for new crime beforePrinting press for counterfeitingTelegraph for books by Charles Dickens16Click fraud by fraudulent web masters who host pay per click adverts 1891 only copyright for US citizensSocial cost cyber crimeEstimate (B$)YearAnti-virus3.42012Patching12010ISP clean-up0.042010User clean-up102012Defence firms102010Law enforcement0.42010Cyber-crime Science17[And12] R. Anderson, C. Barton, R. Bhme, R. Clayton, M. J. G. van Eeten, M. Levi, T. Moore, and S. Savage. Measuring the cost of cybercrime. In 11th Workshop on the Economics of Information Security (WEIS), Berlin, Germany, Jun 2012. 17Cyber-crime Science18Cyber-crime triangleA motivated offender attacks a suitable target in the absence of a capable guardian:Attacks via vulnerabilities of the usersAttacks via vulnerabilities of the systemsPropagating attacksExploiting attacks

Cyber-crime Science19Attack vulnerable userSocial engineer a user2001 SPAM with AnnaKournikova.jpg.vbsPhishing (More later)Hacking into serverPassword crackerIntelligence from OSN as in the Palin email hack

19 de Wit from Sneek created the virus in a few hours and turned himself in when he realised what he had done of Jack the Ripper

Cyber-crime Science20Attack vulnerable systemExploit known vulnerability and install malware on a clientTrojan like Zeus for key loggingPhysical access via USB sticks and autorunFind & exploit vulnerable systemVulnerability scanner like AcunetixSQL injection20

Cyber-crime Science21Propagating attacksChange the web site on the serverCreate a drive by download to infect a clientCreate a botnet out of infected clients to:Send spamPerpetrate a DDoS attackEvade detecti