Cybercrime What is it, what does it cost, & how is it regulated?

What is Cybercrime? Uses Computer & Internet to get between organizations/people & their money Estimates of 69% of all Internet activity involves criminal intent Low Risk Low Cost Online Communities sharing tips & tools

Costs of Cybercrime Estimates of FBI value damages to US at $400 billion in 2004 Virus attacks still the source of the greatest financial loss – 32% of all cybercrime losses reported

Net Fraud Users give up resources to online criminal Typically, the result of greed or unwariness on victim’s part Include bank fraud, online auctions, sales of goods purchased with stolen resources “Phishing” - fraudulent s appear to come from a familiar service provider wanting sensitive personal information

Unauthorized Access 4 Traditional Methods of Access Modem Attack – Unauthorized Modems Installed Software Bugs – Port Scanning Trusted Server – Zone Transfer (periodic updates) /IP Spoofing Social Engineering – Deceive Employee

Denial of Service Explicit attempt by attackers to prevent legitimate users of a service from using that service 3 Modes of Attack Consumption of scarce, limited, or non- renewable resources Destruction or alteration of configuration information Physical destruction or alteration of network components

Virus Attacks A program that runs on your computer system without your permission 3 Purposes for Virus Infection  Using your computer’s resources or information  Destroying your files  Disclosing files to others who aren't otherwise allowed to see them

Additional Cybercriminal Acts Spoofing – Misappropriation of another’s identity Bot (Computer Robot) Usage for searching without authorization Chaffing – Sending hidden messages across the internet Steganography – Hidden files inside digital photos or.wav files

International Law Currently no International Laws in place governing the world’s information technology 3 Options proposed by the United Nations seminar Self-regulating Market Market guided by National Authorities International Regime Regulation

Federal Regulation Federal Statute Title of CodeFocus of StatuteLoss Criteria 18 U.S.C Fraud and Related Activity in Connection With Access Devices Prevent use of counterfeit access devices to get account numbers, mobile ID, card, or PIN to steal funds or make fund transfers The theft must be for $1,000 or more during any one-year period. The loss includes the cost of responding to an offense, doing a damage assessment, restoring the system, revenue losses, cost incurred, or other damages because of an interruption of service 18 U.S.C Fraud and Related Activity in Connection With Computers Under the statute a “protected computer” is any PC attached to the Internet that is used to access files at financial institutions, the U.S. government, or a PC used in interstate commerce. A criminal act against a “protected computer” is the sending of code that causes damage, trafficking in passwords, threatening with the intent to commit extortion and/or accessing files without authorization or without proper authorization. Slight variation with the criminal activity, but is generally considered to be at $5,000 per year. The law also allows victims to bring civil actions against a perpetrator. 18 U.S.C Unlawful Access to Stored Communications Unauthorized access to an electronic communication service and the alternation of stored files. None listed Source: Journal of Forensic Accounting ©R.T. Edwards, Inc.

State Statutes Each state has enacted some legislation regarding computer related crime Most states added to existing property offense or criminal statutes. Legislation not limited to the cybercrime covered in this presentation Some additional crimes covered: cyber-stalking, crimes against children, spam

Knowledge, Skills, Abilities Build an Internet audit trail Collect “usable” courtroom electronic evidence Trace an unauthorized system user Ability to recommend or review security policies Current computer fraud techniques in use Ability to place valuation on incurred losses

More KSAs Understanding of information collectable from various computer logs Technical familiarity with the Internet, web servers, firewalls, attack methodology, security procedures & penetration testing Organizational & legal protocols for incident handling Established relationship with law enforcement

Additional Resources Invesigating and Prosecuting Network Intrusions, Smith, John Forensic Computing: A look at evidence And how to handle it, McCrone, John Computer Crime, Justice, Law and Society Computer Crime Research Center Free Data Recovery Tools