Cyber Crime EMERGING CYBER CRIME TRENDS March 17

Cyber Crime EMERGING CYBER CRIME TRENDS March 17, 2006 by Kenneth G. Mc. Guire Supv. Special Agent FBI

Topic Overview 1. Current Security Threats & Cases 2. Cyber Crime Incident Handling 3. Working With Law Enforcement

Security Threats & Cases 1. TYPES OF PERPETRATORS 2. INTERNET FRAUD - Identity Theft, Phishing Schemes, Remailer Schemes 3. COMPUTER INTRUSIONS & DISRUPTIONS – 1. RATs (Remote Access Trojans), 2. Extortion by DDo. S (distributed denial of service), 3. “Hacker for Hire” Investigation, 4. Wireless Networks Concerns 4. INTELLECTUAL PROPERTY RIGHTS CRIMES – Warez/Movie Servers, P 2 P

How Severe is the Threat? T H R E A T • Professional Cyber Criminals & Terrorists (hard to detect) • Disgruntled Employees • Competitors • Hacktivists • Script Kiddies (Advertises Actions)

Identity Theft • Growing sophistication of phishing emails • Exploitation of Banking System • Keystroke Loggers deployed by worms • Exploding International Market for Stolen Credit Card Databases and Identity Data • FTC - $50 B lost in Identity Theft in 2003 • 300 M manhours devoted to repairing damage caused by this theft

Phishing Examples

Phishing Examples MIRRORED WEB SITE

Growing Trends • Overall increase in sophistication by a geographically diverse criminal element • Virus/Worm Payloads Used to Facilitate Intrusion/Fraud Schemes • Mercenary Distributed Denial Of Service Attacks • Extortion Schemes Fueled by DDOS and Intrusion • Spamming used to spread malicious payloads, phish, and pay using adware/malware, spyware • Identity Theft Underpins Most Computer Crime

Example of a Carder Site

Banking and Brokerage Account Compromise • Internet Worms propagate keystroke logger in payload to steal account usernames & passwords • U. S. citizens recruited to wire proceeds cashed counterfeit checks for 30% fee • Internet purchase funds first transmitted to other U. S. accounts, then to the Eastern bloc.

Remailer Schemes

World’s Largest Computer Equipment Supplier • A union of computer intrusion and wire fraud • Subjects have placed at least $10 M in fraudulent orders • Subjects use work-from-home web sites to recruit unwitting U. S. participants • 11 convictions to date in the U. S. , at least a dozen to follow

REMOTE ACCESS TROJANS (RATs) • HACKER versions – Subseven, Backorifice, Netbus • Sometimes contained in email or programs downloads, i. e. P 2 P programs like Kazaa • COMMERCIAL PROGRAMS – Gotomy. PC, PC Anywhere, Laplink • OPERATING SYSTEMS PROGRAMS – Telnet, ftp, Secure Shell (SSH), rlogin

Trojans and RAT’s Sub-Seven Screen Capture (1999 version)

Trojans and RAT’s Sub-7 v 2. 2 Gold Below is a partial list of what Sub 7 can do. • Monitor ALL of your online activity (purchases, chat, mail) • Open Web Browser to specified location • Restart Windows • Reverse Mouse buttons • Delete ANY of your files • Put ANY file on your computer • Record your passwords • Record your Keystrokes (on and off-line) • Open/Close your CD-ROM drive • Print Documents Change screen resolution • Change Windows colors • Change Volume • Change Desktop wallpaper • Play sounds files • Play voice (using a Text to Speech engine) • Turn off the speakers • Change time/date • Update itself with a newer version

Trojans and RAT’s Sub-Seven Screen Capture When run, the backdoor copies itself to the Windows directory with the original name of the file it was run from or as SERVER. EXE, KERNEL 16. DL, RUNDLL 16. COM, SYSTEMTRAYICON!. EXE or WINDOW. EXE (names are different in different versions of Sub. Seven). Then it unpacks a single DLL file to the Windows System directory - WATCHING. DLL (some versions don't do this).

Walter Wiggs • Former USMC Scout Sniper Instructor • Violent Criminal History • Georgia Resident • Software Engineer for a Manhattan Beach Telecommunications Company

Walter Wiggs • Employment Terminated • Disabled telecommunication systems across the country • Caused a disruption in the Los Angeles County Child Protective Service Hotline over July 4, 2003 • Arrested in August 2003

Extortion By DDOS • Hiring hackers to create distributed denial of service (DDOS) attacks • Look for use of P 2 P instead of IRCds

ECHOUAFNI CYBERSLAM WALKER

Victims

Jeanson James Ancheta, aka Resi. Li 3 nt • Hacker pleads guilty to building, renting attack network • FBI report estimates viruses, worms & Trojan programs cost U. S. organizations $11. 9 billion each year. • 20 -year-old hacker living w/ Using a botnet to send spam. 1. A botnet operator sends out viruses or worms, mother in Downey infecting ordinary users' Windows PCs. 2. The PCs log into an IRC server or other • Prev. Criminal larceny communications medium. 3. A spammer purchases access to the botnet from the operator. conviction 4. The spammer sends instructions via the IRC server 5. to the infected PCs. . . . causing them to send out spam messages to mail servers.

Jeanson James Ancheta, aka Resi. Li 3 nt • Sold botnets of 100 to 500 computers for $150 to $500 • Infected >400, 000 computers installing toolbars for click fees , made $61, 000 as affiliates of Loudcash and Gammacash • Hacked China Lake Naval Weapons Center computer – Not Classified • 1/23/06 Pled Guilty to 4 of 17 counts in 11/05 indictment • Sentencing May 1, 2006

Brian Tinney • Professional Burglar • Created fictitious computer company in Las Vegas • Created fictitious escrow company in San Francisco • Order $600, 000 in high end computer equipment from suppliers around the U. S.

Steven-William: Sutcliffe • • • Global Crossing Employee Sovereign Citizen Adherent www. killercop. com Web Terror Campaign Posted all employee SSN’s Home addresses, telephone numbers, residence maps • Death Threats • Arrested in New Hampshire “UCC-207” “All Rights Reserved”

Countermeasures • • Practice good computer security Invest in a personal shredder Examine your credit report annually Scrutinize credit card statements • • 1 -888 -5 -OPTOUT (1 -888 -567 -8688) Use caution supplying wire transfer info Be alert to anomalous personal info requests http: //www. consumer. gov/idtheft/

Wireless Security Concerns 1) Availability of free WAP detection and logging tools like Netstumbler and Kismet 2) War Driving-where individuals drive (or walk) Around to find unprotected and accessible WAPs 3) Consumer and even system administrators fail to configure their systems adequately

Wireless Security Measures 1. Uses 128 -bit encryption Wireless Encryption Protocol or Wireless Equivalency Protection (WEP) 2. WEP’s poor implementation of the algorithm caused it to be broken which is available to hackers. 3. Replacement for WEP called Wi. Fi Protected Access (WPA) not widely implemented. 4. WEP is not configured out of the box and therefore, not protecting the system. 5. When WEP is configured by owner the default password is used -ADMIN

Preventing Disgruntled Employee Problems • Terminating System Access BEFORE TERMINATED EMPLOYEES ARE WALKING OUT THE DOOR • Well Documented and Proliferated Non. Disclosure and Authorized Activity Agreements/Notifications • Review Adequate Logging/Tracking • Enforce Your Rules • PRACTICE EXCERCISE – “RED TEAMING” • BANNER during Log-in of company computers

CYBER CRIME INCIDENT HANDLING 1. Continuing Operations v. Preservation of Evidence 2. Identify the Incident Manager and Team – usually department heads or officers 3. Assess Systems Impaired and Damages 4. Review Adequate Logging/Tracking 5. Note Unusual Activities By Employees or on Computer Network

WORKING WITH LAW ENFORCEMENT • Identify your LOSS, HARM, or DAMAGE – lost asset, revenues, expenses, repair cost • Identify Capture or Quarantine Electronic or Computerized Equipment, Logs and Files • Maintain a “Chain of Custody” for Evidence • Begin a written chronology of events • Who may have to testify • Identify one or two individuals to be your main point of contact with LEOs • Alert Your General Counsel or Attorney

WORKING WITH LAW ENFORCEMENT • CRIMINAL LAWS THAT APPLY: – ECPA (Electronic Communications and Privacy Act) – 4 th Amendment – Search & Seizure – Interception of Communications (Wiretapping) – Court Orders – FGJ Subpoenas, Search Warrants, Pen Registers, Trap & Trace Orders, 2703(d) Orders, Title 3 Orders

Prepare for Incident Response • Have A Disaster Plan for Humanmade and Natural Disasters – Need some ideas, try Risk Management Organizations - NIST. GOV, SANS. ORG • Practice The Plan! • Review The Plan Annually! – Include contacts with law enforcement or disaster officials

SANS Top 7 Management Errors • #7 Pretend the problem will go away if they ignore it. • #6 Authorize reactive, short-term fixes so problems re-emerge rapidly • #5 Fail to realize how much money their information and organizational reputations are worth. • #4 Rely primarily on a firewall. • #3 Fail to deal with the operational aspects of security: make a few fixes and then not allow the follow through necessary to ensure the problems stay fixed • #2 Fail to understand the relationship of information security to the business problem -- they understand physical security but do not see the consequences of poor information security. • #1 Assign untrained people to maintain security and provide neither the training nor the time to make it possible to do the job.

INFRAGARD PROGRAM

Contact Cyber Crime Supervisor Nakonechniy Maksim E-mail: m_a_x_i_m@i. ua