Crime on the Internet: A Network Service Provider’s View Presentation to InfraGard, Phoenix Chapter, April 19, 2004.

2 Crime on the Internet 1. Introduction 2. How Did We Get Into This Position? 3. What Are the Actual Threats, and Who Is Doing This? 4. What Are We Currently Doing? 5. What Else Can Be Done? AGENDA

3 Ajigaura Hong Kong Shima Singapore Legend Kuantan Tokyo Osaka Nagoya Tseung Kwan O Global Crossing Asia/Pacific – Dedicated Internet Access/IP Transit Landing Points Cities Connected Connecting Systems IP POP

4 Global Crossing Europe – Dedicated Internet Access/IP Transit Legend Landing Points Cities Connected Connecting Systems IP POP Marseilles Turin Milan Zurich Munich Nuremberg Dresden Berlin Sylt Stuttgart Lyon Paris Whitesands Hannover Dusseldorf Cologne Leipzig Barcelona Geneva Oslo Stockholm Madrid Bristol Rotterdam Brussels Bude Beverwijk London Strasbourg Amsterdam Frankfurt Antwerp Copenhagen Hamburg Aberdeen Edinburgh Glasgow Liverpool Dublin Wexford Kilmore Quay

5 Edinburgh Glasgow Carlisle Preston Sheffield Newcastle Amsterdam Liverpool Leeds Bristol Whitesands Plymouth Southampton Brighton Dover York Southend Nottingham Middlesbrough Manchester Peterborough Birmingham Reading London Exeter Norwich Derby Dublin Beverwijk Brussels Antwerp Rotterdam Bude Basingstoke Legend Landing Points Cities Connected Connecting Systems IP POP Aberdeen Wexford Kilmore Quay Global Crossing UK – Dedicated Internet Access/IP Transit

6 Global Crossing North America – Dedicated Internet Access/IP Transit Detroit Denver San Antonio Dallas Topeka St. Louis Tampa Miami Boston Seattle Los Angeles El Paso Houston Atlanta Portland Des Moines Minneapolis Indianapolis Salt Lake City Kansas City Chicago Milwaukee New York Montreal Phoenix Tucson Toronto Albuquerque Austin Cleveland Pittsburgh Green Bay Reno Colorado Springs Oakland Spokane Helena Billings Casper Omaha New Orleans Jacksonville Daytona Beach Orlando Melbourne Fort Lauderdale Lincoln Louisville Bowling Green Nashville Chattanooga Baton Rouge Baltimore Mobile Tallahassee Macon Fort Worth Oklahoma City Tulsa Syracuse Albany Greenville Greensboro Raleigh Rocky Mount Richmond Fredericksburg Buffalo Dayton Columbus Akron Toledo Anaheim San Diego Sunnyvale Eugene Medford Redding Chico Trenton Charlotte Cincinnati Washington DC Philadelphia Newark Altoona Erie Chesapeake San Francisco Sacramento San Jose Salinas San Luis Obispo Santa Barbara Monterrey Mexico City Guadalajara Mazatlan Tijuana Legend Landing Points Cities Connected (Switch Sites) Cities Connected Connecting Systems IP POP Rochester

7 Santiago Buenos Aires Las Toninas Lurin Puerto Viejo Ft. Amador Fortaleza Rio De Janeiro St. Croix Santos Valparaiso Lima São Paulo Landing Points Cities Connected Connecting Systems IP POP Legend Caracas Panama City Global Crossing South America – Dedicated Internet Access/IP Transit

8 Crime on the Internet 1. Nature of the Internet 2. Vulnerabilities in Network Software 3. A Large Number of Non-Power Users 4. People Out to Make a Quick Buck How Did We Get Into This Position?

9 Crime on the Internet 1. Spam 2. Viruses and Worms 3. Denial of Service Attacks 4. Convergence of Threats 5. Cast of Characters What Are the Actual Threats, and Who Is Doing This?

10 Crime on the Internet 1. Prevention: Contract/AUP, Screening, Blocking (cbl.abuseat.org), Filtering, uRPF. 2. Detection: Third party monitoring/aggregation, Netflow, Arbor. 3. Response: Termination, filtering, notification. What Are We Currently Doing?

11 Crime on the Internet 1. Fix the software. Secure coding practices. 2. Actions by those with direct relationship with owners of compromised systems (ISPs and software manufacturers). 3. Actions by those with indirect relationships (NSPs, security researchers). 4. Actions by law enforcement. What Else Can Be Done?

12 Crime on the Internet Composite Blocking List: ROKSO: Bot information: Jim Lippard Further Information