Download
1 / 15
210 likes | 459 Vues
Cyber Crime & Cyber Terrorism. Dr Richard Overill Department of Informatics King’s College London richard.overill@kcl.ac.uk www.inf.kcl.ac.uk/staff/richard/. Terminology. Cyber prefix – involving the Internet or other wide area digital networks and networked systems.
E N D
Cyber Crime & Cyber Terrorism Dr Richard Overill Department of Informatics King’s College London richard.overill@kcl.ac.uk www.inf.kcl.ac.uk/staff/richard/
Terminology Cyber prefix – involving the Internet or other wide area digital networks and networked systems. Cyber Crime – aims to make money, often using conventional scams transferred to cyber domain (e.g. financial fraud, extortion) Cyber Terrorism – aims to create public panic, usually in conjunction with conventional terrorism (e.g. a bomb blast, in conjunction with CCTV & mobile phone network outages)
Characteristics of Cyber Crime • Technologically driven: • digital economy is critically dependent on databases, websites and networks • e-commerce; e-business; e-banking; • critical national infrastructure (CNI) • Cost: • estimated at £2.2bn − £27bn pa in the UK • estimated at £1.8bn − £21bn pa to UK business • estimated at £33bn − £643bn pa worldwide • ‘guesstimates’ since around 85% goes unreported • Frequency: • businesses are being targeted by cyber malware attacks once every three minutes on average
“The Perfect Crime”? • Crime Scene Investigators (CSIs) gather physical or biological evidence at the crime scene • This relies on Locard’s principle (1910): • “every contact leaves a trace”, because it leads to a physical exchange of material • But in the case of a computer attached to the Internet, what bounds the crime scene? And what if any digital traces will be recoverable? Digital forensics (MPS DEFS, FSA DEU)
FSA Digital Evidence Unit • Six sentenced for insider dealing (27 Jul.12) • “The defendants were convicted of making a combined profit of £732,044.59 on trading between 1 May 2006 and 31 May 2008. It was a sophisticated and complex attempt to deal on inside information over a long period” • The investigation took the team 3 years’ work • http://www.fsa.gov.uk/library/communication/pr/2012/080.shtml
Occupations & Motivations • unemployed individual: technical challenge / information discovery (e.g. Gary Mckinnon); • commercial / financial organisation: financial gain via commercial espionage / IP exfiltration (e.g. PLA 61398 based in Shanghai) or financial fraud (e.g. a ‘planted’ / ’turned’ / greedy employee) • ‘for hire’ (cyber-mercenary): money laundering for Serious & Transnational Organised Crime; • ‘political’ (cyber-terrorist): supporting a sub-state group’s terrorist aims; • ‘hacktivist’ (e.g. Anonymous, LulzSec, TeaMP0isoN) for the ‘lulz’ or in support of a movement)
Types of Cyber Crime • Forgery (‘making a false instrument’) • Fraud (‘criminal deception’) • Embezzlement (financial) • Commercial espionage (intellectual property loss) • Digital Rights piracy (peer-to-peer networks) • Blackmail / Extortion • Theft (only of laptops, tablets, PDAs, mobiles, etc.) • Misuse / Abuse (incl. sabotage, subversion & DoS)
Computer & Network Attacks Four basic ‘external’ types: • active penetration by hackers or ‘malware’ (viruses, worms, Trojan horses, etc.) • cognitive hacking using deception scams (‘spear-phishing’, ‘drive-by’ downloads, misdirection attacks, etc.) • passive eavesdropping by means of specialized listening equipment (TEMPEST, van Eck, etc.) • flooding attacks which overwhelm the system (Electronic Siege / Denial of Service, DDoS)
Characterising Cyber Crime • A log-log plot of frequency vs value of all US reported cyber crimes produces a straight line with a discontinuity (‘kink’) at $2.8M: Overill & Silomon, J.Inf.War.10(3) 29-36 (2011) • This is interpreted to indicate that there are two modes of operation for cyber criminals: • Lower value cyber crime for individuals and small groups • Higher value cyber crime for serious organised (transnational) cyber criminals with a business model and an organisational infrastructure
Modern Malware • 403 million distinct malware variants by 2012-Q1 • 160,000 new malware variants every day • Stuxnet • July 2010: targeted Iran’s nuclear reprocessing ultracentrifuge controllers • Duqu • September 2011: gathers commercial / industrial intelligence; shares code with Stuxnet • Flame / Flamer / sKyWIper • May 2012: 20MB; digital reconnaissance tool
UK Computer Misuse Act 1990 • Basic Hacking Offence (BHO) • unauthorised access (attempted; mensrea) • penalty: 6 months and/or £2,000 fine • Ulterior Intent Offence (UIO) • intent to commit a further serious offence • penalty: 5 years and/or unlimited fine
UK CMA (cont’d) &PJA • Unauthorised Modification Offence (UMO) • unauthorised modification of computer contents (trans-border; mensrea) • penalty: 5 years and/or unlimited fine • UK Police and Justice Act (PJA), 2006 • covers DoS & DDoS ‘flood’ attacks • penalty: 5 years and/or unlimited fine
What you can do... • Timely software patch deployment • Timely anti-malware update deployment • Strictly enforce your BYOD policy • Enforce ‘clean’ / ‘dirty’ zones • Enforce full disk encryption • Fully vet all personnel on appointment • Regularly (annually) re-vet all personnel
The Myth of Total Security “The only truly secure computer system is one that is powered off, cast in a block of concrete, and sealed in a lead-lined room with armed guards ~ and even then I have my doubts!” Prof Gene Spafford (CERIAS, Purdue University) - analyst of the first Internet worm (1988)
