Science & Technology Committee: Written evidence Malware and Cyber-crime This volume contains the written evidence accepted by the Science & Technology Committee for the Malware and Cyber-crime inquiry. No. Author No. Author 00 Home Office 00a Supplementary 01 Professor Peter Sommer 02 Dr Huma Shah 03 David Emm and Professor Steven Furnell 04 Intellect 05 StopBadware 06 Fenmeccanica Cyber Solutions 07 MAAWG 08 McAfee 09 Symantec 10 Dr Richard Clayton 11 BCS (the Chartered Institute for IT), IET (The Institution of Engineering and Technology), and The Royal Academy of Engineering 12 Amit Bhagwat 13 SOCA 14 Police Central e-Crime Unit 15 Raytheon UK 16 Dellsecureworks 17 Microsoft 18 Nominet UK 19 Australian Institute of Criminology 20 PhonepayPlus 21 Research in Motion 22 23 24 25 26 27 28 As at 1 December 2011 Written evidence submitted by the Home Office (Malware 00) Prepared by the Home Office in consultation with other Government departments. Introduction 1. This paper sets out the Government evidence to the Science and Technology Committee inquiry into malicious software (malware) and cyber crime. It has been prepared by the Home Office in consultation with officials from other Government departments including the Office of Cyber Security and Information Assurance at the Cabinet Office, the Cyber Security Operations Centre and the Department for Business, Innovation and Skills. 2. The paper outlines what the Government believes to be the situation regarding malware and cyber crime and makes references to current and future actions which are tackling these issues. Separate evidence will be submitted by the Serious and Organised Crime Agency (SOCA) and by the Metropolitan Police Service’s Police Central e-Crime Unit. The papers from these organisations will provide more information on current operational activity to tackle cyber crime. 3. We define the term ‘malware’ to denote software designed with malicious intent containing features or capabilities that can potentially cause harm directly or indirectly to the user and/or the user's computer system. 4. Malware allows criminals to compromise and control computers. This is achieved through a variety of means, including spam e-mails that encourage a user to click on a link that downloads the malware, or through placing malicious code in an otherwise legitimate website that will cause the user's computer to be infected when the website is viewed. 5. Malware is used for a variety of criminal purposes, in particular data theft. This might include credit card or bank account details, or industrial or government information, to be sold on for profit. Often the criminal and the purchaser of the information will be in different countries, with the victim in a third country. 6. We assess that the threat from malware is growing, with a huge rise in the amount of it being created and used – in 2010 more than 286m unique malware variants were identified1. Some of these are relatively simple but many are highly sophisticated. 7. Of the various types of malware, Trojans have become the most prevalent - making up nearly 70% of attacks according to some anti-virus 1 Symantec Internet Security Threat Report 2010 1 companies - as they are the most flexible in allowing the instigators of an attack access to the target computer. They can be seen as an enabler for all the other types of malware. What proportion of cyber-crime is associated with malware? 8. Cyber crime falls into a number of categories, within the general principle that what is illegal offline is illegal online. Some crimes can only be carried out using the internet, including attacks on computer systems to disrupt IT infrastructure, and the stealing of data over a network using malware, often to enable further crime. 9. Other crimes have been transformed in scale or form by their use of the internet; for example credit card fraud can now take place on an industrial scale. Although crimes such as fraud and theft have always existed, the growth of the internet has opened up a new market, allowed for a degree of anonymity and has created new opportunities for organised criminal groups to finance their activities. 10. A third type of crime, which uses the internet but is not dependent on it, is that which is facilitated by the internet. Networks are used for communication, organisation, or to try to evade law enforcement, in the same way as older technologies such as telephones. The internet may be used to organise more effectively a range of ‘traditional’ crime types such as drug dealing, people smuggling, and child exploitation and to conceal them more easily from law enforcement agencies. Mobile internet technology was used by rioters to co-ordinate looting and disorder in August of this year. 11. Determining the proportion of cyber crime which involves malware would therefore depend on which level of cyber crime was under consideration. Moreover, there is no easy measure of the levels of the different types of cyber crime or of how they operate. It is also difficult to gather and assess information on cyber crime as it occurs. 12. Work is being carried out to address this issue; for example, Action Fraud, which works closely with the National Fraud Intelligence Bureau, is to be expanded to become the single reporting point for financially-motivated cyber crime. 13. However, the threat posed by cyber crime is believed to be significant. The Cost Of Cyber Crime2, published by Detica and the Office of Cyber Security and Information Assurance in February 2011, estimates the cost to the UK of cyber crime to be up to £27bn per year, or around 2% of GDP. Industrialisation of cyber crime to enable high volume activity, such as mass data theft, is largely reliant on malware. 2 http://www.cabinetoffice.gov.uk/resource-library/cost-of-cyber-crime 2 14. It is therefore not possible to determine what percentage of cyber crime is facilitated by malware, but there is no doubt that it is a significant factor. As mentioned in the introduction, production of malware is increasing exponentially and it has transformed the ability of criminals to steal data over networks. Where does the malware come from? Who is creating it and why? 15. The major threat from cyber crime comes from increasingly technically- proficient individuals and organised crime groups. These groups, and the infrastructure used in the attack, are often outside the jurisdiction of the UK. The criminals may be in one country and their means of cyber attack in a second and their victims in a range of other countries, making evidence gathering and identification of the criminals difficult. They may not fit the traditional profile of organised crime groups, and may be more of an affiliation of individuals who never meet except online. 16. Most organised criminal activity is aimed, either directly or indirectly, at making money. Organised crime groups and individuals use cyber technology to support traditional criminal activities or to develop new criminal schemes that exploit emerging vulnerabilities in rapidly evolving cyber technologies and online systems. By focusing their activity on areas which afford the broadest opportunities, criminals increase their potential monetary returns. Criminal finances and profits are central to organised crime and they constantly seek the opportunity to increase their returns whilst reducing their risk exposure. 17. Although most criminal activity is financially motivated, a spate of recent attacks on company websites has been orchestrated by activists protesting against those associated with ideals they disapprove of. This has highlighted the disruption that organised groups can cause, in order to further their aims, through the use of malware and techniques initially developed for other criminal purposes. This type of activity could be used against any public or private sector organisation with a presence online and against which a group may hold a grievance. 18. While the creator of malicious software may not be the end-user criminal, the goals noted above create a market place for malware. As such most of the malware writers will expect to profit from their works and have an increasingly sophisticated business model, including maintenance and support for their software, hiring their expertise out directly and upgrading their products in light of changes in the market, to support this. Malicious software and access to other tools, such as pre-existing botnets, is freely available for purchase at a variety of ‘underground’ internet fora. This ‘underground’ infrastructure also requires protection, leading to secondary layers of required technical expertise. The profit motive is less prevalent amongst the activist community where more ideological goals may drive the malware writers. 19. Many IT security companies report the source of malware as the location where it is hosted as it is often difficult to identify the origin of the 3 software itself. This reporting of attack location rather than the source of the malware can badly skew statistics on where malware creators are based, however, the IT Security company BitDefender suggests in its H1 2011 report (http://www.bitdefender.com/files/Main/file/H1_2011_E- Threats_Landscape_Report.pdf ) that China (31%), Russia (22%) and Brazil (8%) are the largest producers of malware. What level of resources are associated with combating malware? 20. In October 2010 the National Security Strategy identified the cyber threat to the UK, which includes cyber crime, as a Tier 1 threat, on the same level as terrorism. £650m of new money has been allocated to a National Cyber Security Programme which will bolster our cyber capabilities in order to help protect the UK’s national security, its citizens and our growing economy in cyber space. At least £63m of this money will go towards enabling the UK to transform our response to cyber crime, of which countering malware is an important element.