The University of Hull Centre For Internet Computing Spam ‘n’ chips A discussion of internet crime Angus M. Marshall BSc CEng MBCS FRSA

The University of Hull Centre For Internet Computing Topics Context Cybercrime & Classifications Non-internet crime Internet crimes Challenges Intelligence Aspects Conclusion

The University of Hull Centre For Internet Computing Context Growth in –Computer use –Internet use New opportunities for use and abuse

The University of Hull Centre For Internet Computing Cybercrime Broad categories Computer crime Internet “crime” Excludes –Crimes involving technology where the technology is incidental e.g. theft of computer systems for parts etc.

The University of Hull Centre For Internet Computing Classification Examples

The University of Hull Centre For Internet Computing Case study - Computer Assisted Blackmail evidence recovery –evidence on hard disk of suspect’s PC –forensic examination using approved tools yielded partial copies of deleted files –analysis of printed material linked it to suspect’s printer

The University of Hull Centre For Internet Computing Internet crimes “those which involve the use of the Internet to commission crime, or directly affect the performance of some service on the Internet”

The University of Hull Centre For Internet Computing Why internet crime ? Internet is a tool –communications channel –service delivery channel Cheap Mostly reliable Worldwide

The University of Hull Centre For Internet Computing Case study - Internet Assisted Manual web page defacement –‘hacker’ changes content of a WWW site –could be achieved by breaking into the site and using the host computer

The University of Hull Centre For Internet Computing Case study - Internet enabled –Money laundering (Credit Card) ‘adult oriented’ material provider operates franchise & referrer scheme criminal obtains credit card numbers criminal purchases licenses for material uses WWW to resell material and refer customers to original provider additional - not all referred customers are human!

The University of Hull Centre For Internet Computing Internet only crime - a challenge Define “crime” for the Internet. –Legislation lags technology –Locality of offence Current definitions –“frontier law” based on AUP/ToS and “gentlemen’s agreements”

The University of Hull Centre For Internet Computing Internet Intelligence Source –Search engines, directories, WWW pages, newsgroup archives etc. Generator –Transmission information, server logging, ARP tables, routing tables

The University of Hull Centre For Internet Computing Challenge Transient data –may only exist for a few minutes Distributed data –worldwide, multiple nodes Volumes –1 WWW page request = –150+ characters logged

The University of Hull Centre For Internet Computing Case study - Internet only Automated WWW page defacement –“Code Red” / “Nimda” –virus infects server –searches for other servers to infect –attacks at random –replicates itself to the new target and starts again

The University of Hull Centre For Internet Computing Evidence generated As the virus probes across the network it leaves –semi-permanent entries in server logs –transient entries in routers –transient entries in other tables

The University of Hull Centre For Internet Computing Intelligence Aspect Combining this information can tell us –where the infestation is –where it may strike next –what it is.

The University of Hull Centre For Internet Computing Conclusion Internet is valuable as both source and generator BUT there is too much generated information we need better tools to automate the analysis and provide better intelligence.

The University of Hull Centre For Internet Computing Why “Spam ‘n’ Chips ?” Spam is flooding the Internet with many copies of the same message, in an attempt to force the message on people who would not otherwise choose to receive it. Spam costs the sender very little to send -- most of the costs are paid for by the recipient or the carriers rather than by the sendersender.