DOCSLIB.ORG

Fraud Trends in 2010: Top Threats from a Growing Underground Economy

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Fraud Trends in 2010: Top Threats from a Growing Underground Economy A First Data White Paper April 2010 Fraud Trends in 2010: Top Threats From a Growing Underground Economy Fraud is big business, accounting for more than $200 billion in losses each year in the U.S. alone. Today’s criminals are not operating out of seedy boiler rooms. They are sophisticated and smart. Learning how they operate gives you a better chance of mitigating risks and avoiding fraud. By: Rick Van Luvender Director, First Data InfoSec Incident Response Center © 2010 First Data Corporation. All trademarks, service marks and trade names referenced in this material are the property of their respective owners. Fraud Trends in 2010: A First Data White Paper Top Threats From a Growing Underground Economy Introduction: The Thriving Underground Fraud Economy When Albert Gonzalez was arrested in May 2008, he owned a luxury condo in Miami, a BMW and had $1.65 million in cash.1 Surprisingly, his crime was not drug related. Rather, he was charged with orchestrating one of the most publicized cyberattacks of the time—hacking into the networks of major retailers such as TJ MAXX, Barnes and Noble, and Sports Authority, to name a few, and stealing 45 million credit and debit card numbers. Gonzalez didn’t work alone. Like many entrepreneurs, he had a big idea and then sought out experts and contractors who could help him execute his plan. Eleven other individuals from the U.S. and around the world were indicted for the crime, including Stephen Watt, the man responsible for providing Gonzalez with the “packet sniffing” application that was used to steal the data. The sniffing application was hosted on a remote server in Latvia, according to reports, where Gonzalez also set up bank accounts to hide the money garnered from selling the card information on the underground market. He and his crew were able to fraudulently initiate over $10 million in credit and debit card transactions before their arrests.2 While in jail on the TJ MAXX charges, Gonzalez was indicted in August 2009 for an even bigger attack that compromised Heartland Payment Systems, Citibank-branded 7-Eleven ATMs and Hannaford Brothers computer systems, resulting in another 140 million stolen card numbers.3 As illustrated by Gonzalez and his co-conspirators, today’s cybercriminals are more likely to be running high- stakes, organized and sophisticated businesses rather than operating out of seedy boiler rooms. The Internet has allowed the underground economy to gain momentum and become an efficient, global marketplace where it is relatively easy to buy and sell fraudulent goods and services online, hire contractors and exchange useful industry information. This increasingly mature underground marketplace is providing cybercriminals a profitable environment for buying and selling millions of dollars’ worth of stolen goods and fraud-related services. It is clear that today’s cybercriminals are more sophisticated than ever in their operations and their attacks, and that they are always on the lookout for ways to exploit vulnerabilities in the global payments system. According to the 2009 Verizon Business Data Breach Investigations Report, 285 million consumer records were compromised in 2008—more than the previous four years combined.4 The continued emergence of highly advanced fraud techniques means this number will only continue to grow. While it is impossible to anticipate or prevent every attack, one way to stay a step ahead of these criminals is to have a thorough understanding of how they operate their business, both on the frontlines and behind the scenes. Knowing how they attack, how they sell data and where the vulnerabilities are in the system gives those affected by fraud a better chance of mitigating the risks and stopping the criminals in their tracks. ©2010 First Data Corporation. All rights reserved. firstdata.com page 2 Fraud Trends in 2010: A First Data White Paper Top Threats From a Growing Underground Economy An Efficient System of Supply and Demand Primarily using Web-based forums and chat rooms, potential buyers and sellers of stolen data negotiate deals, contract for the services and share information. Yet even though it is “underground,” the fraud-based economy is subject to the same supply-and-demand pressures of any other economy. According to Report on the Underground Economy, a study from Symantec Corp., which followed a year in the life of the underground economy, between July 2007 and June 2008, the Credit cards top the list as value of the advertised goods on underground economy Web the underground economy’s servers was in excess of $276 million.5 Among the most popular most popular item: goods that cybercriminals routinely buy and sell are credit card data and bank account credentials. J Price for stolen credit card data: At the top of the list of most popular items for sale, as well as the from 10 cents to $25 per card most requested for purchase, is credit card data, the Symantec J Discounts offered for bulk purchases study found. That’s because credit cards are inexpensive to buy and have the potential for high profit. With a wide variety of J Average stolen credit card has a ways to steal credit card information, such as phishing schemes, credit limit of $4,000 skimming magnetic stripes and breaking into databases, credit card data is plentiful and relatively easy to convert to cash. For example, stolen cards are easy to use for online shopping and may go undetected by merchants long enough for fraudsters to complete transactions and receive goods that can be resold for cash. The potential worth of all credit cards observed for sale during Symantec’s yearlong reporting period was estimated to be $5.3 billion. Stolen financial account information comes in second place on the list of most popular items for sales in the underground economy, selling for $10 to $1,000 per account (with an average account balance of nearly $40,000). Financial accounts include bank account credentials, online stock trading accounts and data from magnetic-stripe skimming devices. Financial accounts are attractive targets because the process of cashing out can be easier than retrieving cash from credit or debit cards via ATMs. Withdrawals from a bank account also have the advantage of an immediate payout, while stolen credit cards are often used for purchasing goods that must be sold later. The potential value of all bank accounts advertised on underground economy servers during the reporting period was $1.7 billion. Rank Item Percentage Range of prices 1 Credit card information 18% $1-$100 2 Bank account credentials 13% $2-$1000 3 E-mail accounts 9% $5-$12 4 E-mail addresses 9% $5/MB–$20/MB 5 R57 & C99 shells 6% $1-$13 6 Full identities 6% $0.50-$60 7 Credit card dumps 6% $11-$140 8 Mailers 5% $3-$17 9 Cash-out services 4% $200-$600 per account, plus 60% of total value 10 Scams 3% $1-$10 for hosting services Figure 1: Top 10 goods and services for sale on underground economy servers Source: Symantec ©2010 First Data Corporation. All rights reserved. firstdata.com page 3 Fraud Trends in 2010: A First Data White Paper Top Threats From a Growing Underground Economy Delivering Fraud as a Service (FaaS) Considering that the underground economy is subject to the same economic pressures as legitimate businesses, it is no wonder that fraudsters adopt and adapt practices from the real world to meet their underground needs. For example, just as corporate IT managers have come to rely on the Internet to satisfy on-demand software needs in the form of Software as a Service (SaaS), so has the underground economy developed a similar infrastructure for delivering Fraud as a Service (FaaS), according to fraud experts from the InfoSec Incident Response Center at First Data. SaaS gives users a fast and efficient way to gain access to a wide range of applications while offloading the need to have knowledge of, expertise in or control over the technology infrastructure that supports them. FaaS does the same for cybercriminals as illustrated in the following chart created by First Data. Technical Infrastructure Operational Infrastructure Malware/ Phishers/ Money Drop Botnets Carders Trojans Spam Mules Specialists Harvesters Fraud Cash-Out (IT Specialist) Forums (Personnel) Lower Risk/Lower RewardHigher Risk/Higher Reward At the center of FaaS are the online Fraud Forums, where individuals, groups and organizations active in the trade of fraudulent Fraud on Google Search goods and services gather to collaborate, offer their skills, and buy and sell stolen goods. A simple Google search using the term “credit card dumps” A popular means of trading stolen information, takes you to sites such as The Ethical Hacker Network Web-based forums post advertisements that (http://rahulhackingarticles.wetpaint.com/thread) and a are visible to anyone visiting and often only Google group set up for selling trading cards that includes require registration with a username. In order numerous posts selling stolen credit card data (http:// to attract visitors, many forums even offer groups.google.com/group/rec.games.trading-cards. marketplace.magic.sales). tutorials, how-to guides or even specialized venues for goods from specific countries or regions. ©2010 First Data Corporation. All rights reserved. firstdata.com page 4 Fraud Trends in 2010: A First Data White Paper Top Threats From a Growing Underground Economy In the FaaS model, the forums provide the opportunity for access to specialists who can help design methods for harvesting (or stealing) data such as malware, skimmers, botnets, and various other nefarious applications, depending on what the criminal is trying to accomplish. Figure 3: Malware for sale on now-defunct fraud forum DarkMarket Source: F-Secure.com Because no fraudulent act is finished until there is a cash-out on the stolen data, to help complete the transaction, “cashiers” and “money mules” are available for hire to act as intermediaries in converting information into true currency.
Load more

Recommended publications
  • Cyber Security Practices and Challenges at Selected Critical Infrastructures in Ethiopia: Towards Tailoring Cyber Security Framework
    ADDIS ABABA UNIVERSITY COLLEGE OF NATURAL AND COMPUTATIONAL SCIENCES SCHOOL OF INFORMATION SCIENCE CYBER SECURITY PRACTICES AND CHALLENGES AT SELECTED CRITICAL INFRASTRUCTURES IN ETHIOPIA: TOWARDS TAILORING CYBER SECURITY FRAMEWORK By TEWODROS GETANEH JUNE, 2018 ADDIS ABABA, ETHIOPIA ADDIS ABABA UNIVERSITY COLLEGE OF NATURAL AND COMPUTATIONAL SCIENCES SCHOOL OF INFORMATION SCIENCE CYBER SECURITY PRACTICES AND CHALLENGES AT SELECTED CRITICAL INFRASTRUCTURES IN ETHIOPIA: TOWARDS TAILORING CYBER SECURITY FRAMEWORK A Thesis Submitted to School of Graduate Studies of Addis Ababa University in Partial Fulfillment of the Requirements for the Degree of Master of Science in Information Science By: TEWODROS GETANEH Advisor: Tebebe Beshah (PhD) JUNE, 2018 Addis Ababa, Ethiopia ADDIS ABABA UNIVERSITY COLLEGE OF NATURAL AND COMPUTATIONAL SCIENCE SCHOOL OF INFORMATION SCIENCE CYBER SECURITY PRACTICES AND CHALLENGES AT SELECTED CRITICAL INFRASTRUCTURES IN ETHIOPIA: TOWARDS TAILORING CYBER SECURITY FRAMEWORK By: Tewodros Getaneh Name and signature of Members of the Examining Board Tebebe Beshah (PhD) __________ _________ Advisor Signature Date Lemma Lenssa (PhD) ___________ __________ Examiner Signature Date Dereje Teferi (PhD) __________ _________ Examiner Signature Date Declaration This thesis has not previously been accepted for any degree and is not being concurrently submitted in candidature for any degree in any university. I declare that the thesis is a result of my own investigation, except where otherwise stated. I have undertaken the study independently with the guidance and support of my research advisor. Other sources are acknowledged by citations giving explicit references. A list of references is appended. Signature: ________________________ Tewodros Getaneh This thesis has been submitted for examination with my approval as university advisor. Advisor’s Signature: ________________________ Tebebe Beshah (PhD) i | P a g e Dedication This work is dedicated to my beloved sister Eleni Getaneh.
    [Show full text]
  • Money Mule Recruitment Among University Students in Malaysia: Awareness Perspective
    PUPIL: International Journal of Teaching, Education and Learning ISSN 2457-0648 Vedamanikam & Chethiyar, 2020 Volume 4 Issue 1, pp. 19-37 Date of Publication: 25th June 2020 DOI- https://doi.org/10.20319/pijtel.2020.41.1937 This paper can be cited as: Vedamanikam, M., Chethiyar, S. D. M. (2020). Money Mule Recruitment among University Students in Malaysia: Awareness Perspective. PUPIL: International Journal of Teaching, Education and Learning, 4(1),19-37. This work is licensed under the Creative Commons Attribution-Non Commercial 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc/4.0/ or send a letter to Creative Commons, PO Box 1866, Mountain View, CA 94042, USA. MONEY MULE RECRUITMENT AMONG UNIVERSITY STUDENTS IN MALAYSIA: AWARENESS PERSPECTIVE Mohanamerry Vedamanikam Manager, AML Compliance, Western Union Payments (Malaysia) Sdn Bhd (970512P) Level 22.03, The Gardens North Tower, Mid Valley City, Lingkaran Syed Putra, 59200 Kuala Lumpur, Malaysia [email protected] Saralah Devi Mariamdaran Chethiyar Senior Lecturer, Psychology & Counselling Program, School of Applied Psychology, Social Work and Policy, College of Arts and Sciences, University Utara Malaysia, Malaysia [email protected] Abstract Money laundering is perceived as a global threat with funds sourced from illegal and fraudulent activities. Money mules are recruited by criminal networks in money laundering chain, positioned between actual criminal and the illicit funds, enabling the criminals to be anonymous and non-visible to the detection of law enforcement. Job vacancy with various positions are offered with attractive financial rewards and work flexibility and the criminal elements are hidden behind the job criteria.
    [Show full text]
  • Behind the “From” Lines: Email Fraud on a Global Scale Ten Cybercriminal Organizations Unmasked
    AGARI CYBER INTELLIGENCE DIVISION REPORT Behind the “From” Lines: Email Fraud on a Global Scale Ten Cybercriminal Organizations Unmasked © Copyright 2019 AGARI Data, Inc. Executive Summary Nigerian Scammers Target American Businesses Over the course of the past 10 months, using responsible active defense “ Since I can't send techniques, Agari captured 78 criminal email accounts, belonging to 10 criminal more money, maybe organizations, and containing 59,652 unique email messages. Agari analyzed the I'm of no use to you contents of these email accounts to investigate the tactics, targets and identities now. I certainly feel of the criminals. And now, that analysis enables stronger defensive strategies and like that could be measures. the deal here...A realtor is coming over What’s more, Agari has used this analysis to warn financial institutions about tomorrow to help accounts being used for criminal activity, and to provide evidence to law me list my house for enforcement. Agari has also warned victims, and in at least once case, quick action sale. I'm talking to an helped a company recover its money. attorney now about how to keep the One of the more interesting findings from this analysis was that while much of the collection agencies high-profile cybersecurity news of the past year has involved state sponsors like away and protect my Russia and North Korea, American businesses and individuals are far more likely to kids. All this time, I'm be targeted by Nigerian scam artists. wondering if I've heard Nigerian scam artists, traditionally associated with implausible get-rich-quick from you for the last schemes and other scams of individuals, have become more sophisticated and time.
    [Show full text]
  • Is the Mafia Taking Over Cybercrime?*
    Is the Mafia Taking Over Cybercrime?* Jonathan Lusthaus Director of the Human Cybercriminal Project Department of Sociology University of Oxford * This paper is adapted from Jonathan Lusthaus, Industry of Anonymity: Inside the Business of Cybercrime (Cambridge, Mass. & London: Harvard University Press, 2018). 1. Introduction Claims abound that the Mafia is not only getting involved in cybercrime, but taking a leading role in the enterprise. One can find such arguments regularly in media articles and on blogs, with a number of broad quotes on this subject, including that: the “Mafia, which has been using the internet as a communication vehicle for some time, is using it increasingly as a resource for carrying out mass identity theft and financial fraud”.1 Others prescribe a central role to the Russian mafia in particular: “The Russian Mafia are the most prolific cybercriminals in the world”.2 Discussions and interviews with members of the information security industry suggest such views are commonly held. But strong empirical evidence is rarely provided on these points. Unfortunately, the issue is not dealt with in a much better fashion by the academic literature with a distinct lack of data.3 In some sense, the view that mafias and organised crime groups (OCGs) play an important role in cybercrime has become a relatively mainstream position. But what evidence actually exists to support such claims? Drawing on a broader 7-year study into the organisation of cybercrime, this paper evaluates whether the Mafia is in fact taking over cybercrime, or whether the structure of the cybercriminal underground is something new. It brings serious empirical rigor to a question where such evidence is often lacking.
    [Show full text]
  • Cybercrime-As-A-Service: Identifying Control Points to Disrupt Keman Huang Michael Siegel Stuart Madnick
    Cybercrime-as-a-Service: Identifying Control Points to Disrupt Keman Huang Michael Siegel Stuart Madnick Working Paper CISL# 2017-17 November 2017 Cybersecurity Interdisciplinary Systems Laboratory (CISL) Sloan School of Management, Room E62-422 Massachusetts Institute of Technology Cambridge, MA 02142 Cybercrime-as-a-Service: Identifying Control Points to Disrupt KEMAN HUANG, MICHAEL SIEGEL, and STUART MADNICK, Massachusetts Institute of Technology Cyber attacks are increasingly menacing businesses. Based on literature review and publicly available reports, this paper analyses the growing cybercrime business and some of the reasons for its rapid growth. A value chain model is constructed and used to describe 25 key value-added activities, which can be offered on the Dark Web as a service, i.e., “cybercrime-as-a-service,” for use in a cyber attack. Understanding the specialization, commercialization, and cooperation of these services for cyber attacks helps to anticipate emerging cyber attack services. Finally, this paper identifies cybercrime control-points that could be disrupted and strategies for assigning defense responsibilities to encourage collaboration. CCS Concepts: • General and reference Surveys and overviews; • Social and professional topics Computing and business; Socio-technical systems; Computer crime; • Security and privacy Social aspects of security and privacy; → → → Additional Key Words and Phrases: Cyber Attack Business; Value Chain Model; Cyber-crime-as-a-Service; Hacking Innovation; Control Point; Sharing Responsibility 1 INTRODUCTION “Where there is commerce, there is also the risk for cybercrime”[139]. Cybercrime is a tremendous threat to today’s digital society. It is extimated that the cost of cybercrime will grow from an annual sum of $3 trillion in 2015 to $6 trillion by the year 2021 [115].
    [Show full text]
  • Climate Change Adaptation in the Arab States Best Practices and Lessons Learned
    Climate Change Adaptation in the Arab States Best practices and lessons learned United Nations Development Programme 2018 | 1 UNDP partners with people at all levels of society to help build nations that can withstand crisis, and drive and sustain the kind of growth that improves the quality of life for everyone. On the ground in nearly 170 countries and territories, we offer global perspective and local insight to help empower lives and build resilient nations. www.undp.org The Global Environment Facility (GEF) was established on the eve of the 1992 Rio Earth Summit to help tackle our planet’s most pressing environmental problems. Since then, the GEF has provided over $17 billion in grants and mobilized an additional $88 billion in financing for more than 4000 projects in 170 countries. Today, the GEF is an international partnership of 183 countries, international institutions, civil society organizations and the private sector that addresses global environmental issues. www.thegef.org United Nations Development Programme July 2018 Copyright © UNDP 2018 Manufactured in Bangkok Bangkok Regional Hub (BRH) United Nations Development Programme 3rd Floor United Nations Service Building Rajdamnern Nok Avenue, Bangkok, 10200, Thailand www.adaptation-undp.org Authors: The report preparation was led by Tom Twining-Ward in close collaboration with Kishan Khoday, with Cara Tobin as lead author and Fadhel Baccar, Janine Twyman Mills, Walid Ali and Zubair Murshed as contributing authors. The publication was professionally reviewed by fellow UNDP colleagues, Amal Aldababseh, Greg Benchwick, Hanan Mutwaki, Mohamed Bayoumi, and Walid Ali. Valuable external expert review, comments, and suggestions were provided by Hussein El-Atfy (Arab Water Council), Ibrahim Abdel Gelil (Arabian Gulf University), and William Dougherty (Climate Change Research Group).
    [Show full text]
  • Significant Cyber Incidents Since 2006 This List Is a Work in Progress That We Update As New Incidents Come to Light. If You H
    Significant Cyber Incidents Since 2006 This list is a work in progress that we update as new incidents come to light. If you have suggestions for additions, send them to [email protected]. Significance is in the eye of the beholder, but we focus on successful attacks on government agencies, defense and high tech companies, or economic crimes with losses of more than a million dollars. 1. May 2006. The Department of State’s networks were hacked, and unknown foreign intruders downloaded terabytes of information. If Chinese or Russian spies backed a truck up to the State Department, smashed the glass doors, tied up the guards and spend the night carting off file cabinets it would be an act of war, but when it happens in cyberspace we barely notice. 2. August 2006. A senior Air Force Officer stated publicly that, “China has downloaded 10 to 20 terabytes of data from the NIPRNet (the unclassified military network).” 3. November 2006. Hackers attempted to penetrate U.S. military War College networks, resulting in a two week shutdown at one institution while infected machines are restored. 4. December 2006. NASA was forced to block emails with attachments before shuttle launches out of fear they would be hacked. Business Week reported that the plans for the latest U.S. space launch vehicles were obtained by unknown foreign intruders. 5. 2006. Chinese hackers were thought to be responsible for shutting down the House of Commons computer system. 6. April 2007. The Department of Commerce had to take the Bureau of Industrial Security’s networks offline for several months because its networks were hacked by unknown foreign intruders.
    [Show full text]
  • Online Money Laundering Operations to Take Place
    Laundering Money Online: a review of cybercriminals’ methods Jean-Loup Richet Tools and Resources for Anti-Corruption Knowledge – June, 01, 2013 - United Nations Office on Drugs and Crime (UNODC). Executive Summary Money laundering is a critical step in the cyber crime process which is experiencing some changes as hackers and their criminal colleagues continually alter and optimize payment mechanisms. Conducting quantitative research on underground laundering activity poses an inherent challenge: Bad guys and their banks don’t share information on criminal pursuits. However, by analyzing forums, we have identified two growth areas in money laundering: Online gaming—Online role playing games provide an easy way for criminals to launder money. This frequently involves the opening of numerous different accounts on various online games to move money. Micro laundering—Cyber criminals are increasingly looking at micro laundering via sites like PayPal or, interestingly, using job advertising sites, to avoid detection. Moreover, as online and mobile micro-payment are interconnected with traditional payment services, funds can now be moved to or from a variety of payment methods, increasing the difficulty to apprehend money launderers. Micro laundering makes it possible to launder a large amount of money in small amounts through thousands of electronic transactions. One growing scenario: using virtual credit cards as an alternative to prepaid mobile cards; they could be funded with a scammed bank account – with instant transaction – and used as a foundation of a PayPal account that would be laundered through a micro-laundering scheme. Laundering Money Online: a review of cybercriminals’ methods Millions of transactions take place over the internet each day, and criminal organizations are taking advantage of this fact to launder illegally acquired funds through covert, anonymous online transactions.
    [Show full text]
  • Zerohack Zer0pwn Youranonnews Yevgeniy Anikin Yes Men
    Zerohack Zer0Pwn YourAnonNews Yevgeniy Anikin Yes Men YamaTough Xtreme x-Leader xenu xen0nymous www.oem.com.mx www.nytimes.com/pages/world/asia/index.html www.informador.com.mx www.futuregov.asia www.cronica.com.mx www.asiapacificsecuritymagazine.com Worm Wolfy Withdrawal* WillyFoReal Wikileaks IRC 88.80.16.13/9999 IRC Channel WikiLeaks WiiSpellWhy whitekidney Wells Fargo weed WallRoad w0rmware Vulnerability Vladislav Khorokhorin Visa Inc. Virus Virgin Islands "Viewpointe Archive Services, LLC" Versability Verizon Venezuela Vegas Vatican City USB US Trust US Bankcorp Uruguay Uran0n unusedcrayon United Kingdom UnicormCr3w unfittoprint unelected.org UndisclosedAnon Ukraine UGNazi ua_musti_1905 U.S. Bankcorp TYLER Turkey trosec113 Trojan Horse Trojan Trivette TriCk Tribalzer0 Transnistria transaction Traitor traffic court Tradecraft Trade Secrets "Total System Services, Inc." Topiary Top Secret Tom Stracener TibitXimer Thumb Drive Thomson Reuters TheWikiBoat thepeoplescause the_infecti0n The Unknowns The UnderTaker The Syrian electronic army The Jokerhack Thailand ThaCosmo th3j35t3r testeux1 TEST Telecomix TehWongZ Teddy Bigglesworth TeaMp0isoN TeamHav0k Team Ghost Shell Team Digi7al tdl4 taxes TARP tango down Tampa Tammy Shapiro Taiwan Tabu T0x1c t0wN T.A.R.P. Syrian Electronic Army syndiv Symantec Corporation Switzerland Swingers Club SWIFT Sweden Swan SwaggSec Swagg Security "SunGard Data Systems, Inc." Stuxnet Stringer Streamroller Stole* Sterlok SteelAnne st0rm SQLi Spyware Spying Spydevilz Spy Camera Sposed Spook Spoofing Splendide
    [Show full text]
  • An Analysis of the Nature of Groups Engaged in Cyber Crime
    International Journal of Cyber Criminology Vol 8 Issue 1 January - June 2014 Copyright © 2014 International Journal of Cyber Criminology (IJCC) ISSN: 0974 – 2891 January – June 2014, Vol 8 (1): 1–20. This is an Open Access paper distributed under the terms of the Creative Commons Attribution-Non- Commercial-Share Alike License, which permits unrestricted non-commercial use, distribution, and reproduction in any medium, provided the original work is properly cited. This license does not permit commercial exploitation or the creation of derivative works without specific permission. Organizations and Cyber crime: An Analysis of the Nature of Groups engaged in Cyber Crime Roderic Broadhurst,1 Peter Grabosky,2 Mamoun Alazab3 & Steve Chon4 ANU Cybercrime Observatory, Australian National University, Australia Abstract This paper explores the nature of groups engaged in cyber crime. It briefly outlines the definition and scope of cyber crime, theoretical and empirical challenges in addressing what is known about cyber offenders, and the likely role of organized crime groups. The paper gives examples of known cases that illustrate individual and group behaviour, and motivations of typical offenders, including state actors. Different types of cyber crime and different forms of criminal organization are described drawing on the typology suggested by McGuire (2012). It is apparent that a wide variety of organizational structures are involved in cyber crime. Enterprise or profit-oriented activities, and especially cyber crime committed by state actors, appear to require leadership, structure, and specialisation. By contrast, protest activity tends to be less organized, with weak (if any) chain of command. Keywords: Cybercrime, Organized Crime, Crime Groups; Internet Crime; Cyber Offenders; Online Offenders, State Crime.
    [Show full text]
  • E-Commerce Security and Fraud Issues and Protections 10
    E-Commerce Security and Fraud Issues and Protections 10 C o n t e n t s Learning Objectives Opening Case: How State University of New York College at Old Westbury Upon completion of this chapter, you will be Controls Its Internet Use ...................................... 458 able to: 10.1 The Information Security Problem .......... 459 1. Understand the importance and scope of security of information systems for EC. 10.2 Basic E-Commerce Security Issues and Landscape ........................................... 465 2. Describe the major concepts and terminol- ogy of EC security. 10.3 Technical Malware Attack Methods: From Viruses to Denial of Service ............ 471 3. Understand about the major EC security threats, vulnerabilities, and technical attacks. 10.4 Nontechnical Methods: From Phishing to Spam and Fraud .................... 476 4. Understand Internet fraud, phishing, and spam. 10.5 The Information Assurance Model 5. Describe the information assurance security and Defense Strategy ................................. 484 principles. 10.6 The Defense I: Access Control, 6. Identify and assess major technologies Encryption, and PKI ................................. 488 and methods for securing EC access and 10.7 The Defense II: Securing communications. E-Commerce Networks ............................. 494 7. Describe the major technologies for protec- 10.8 The Defense III: General Controls, tion of EC networks. Spam, Pop Ups, Fraud, and Social 8. Describe various types of controls and special Engineering Controls................................. 497 defense mechanisms. 10.9 Implementing Enterprisewide 9. Describe consumer and seller protection from E-Commerce Security ............................... 500 fraud. Managerial Issues.................................................. 504 10. Discuss enterprisewide implementation issues Closing Case: How One Bank Stopped Scams, for EC security. Spams, and Cybercriminals ................................. 509 11. Understand why it is so diffi cult to stop computer crimes.
    [Show full text]
  • FINANCIAL CRIME DIGEST July 2020
    FINANCIAL CRIME DIGEST July 2020 Diligent analysis. Powering business.™ aperio-intelligence.com FINANCIAL CRIME DIGEST | JULY 2020 ISSN: 2632-8364 About Us Founded in 2014, Aperio Intelligence is a specialist, independent corporate intelligence frm, headquartered in London. Collectively our team has decades of experience in undertaking complex investigations and intelligence analysis. We speak over twenty languages in- house, including all major European languages, as well as Russian, Arabic, Farsi, Mandarin and Cantonese. We have completed more than 3,000 assignments over the last three years, involving some 150 territories. Our client base includes a broad range of leading international fnancial institutions, law frms and multinationals. Our role is to help identify and understand fnancial crime, contacts, cultivated over decades, who support us regularly integrity and reputational risks, which can arise from a lack in undertaking local enquiries on a confdential and discreet of knowledge of counterparties or local jurisdictions, basis. As a specialist provider of corporate intelligence, we enabling our clients to make better informed decisions. source information and undertake research to the highest legal and ethical standards. Our independence means we Our due diligence practice helps clients comply with anti- avoid potential conficts of interest that can affect larger bribery and corruption, anti-money laundering and other organisations. relevant fnancial crime legislation, such as sanctions compliance, or the evaluation of tax evasion or sanctions We work on a “Client First” basis, founded on a strong risks. Our services support the on-boarding, periodic or commitment to quality control, confdentiality and respect retrospective review of clients or third parties. for time constraints.
    [Show full text]