Social Networks, Virtual Worlds, and the Shadow Internet : The Explosion of Virtual Identity and the Anonymous Economy Scott Dueweke 0 The Comprehensive National Cybersecurity Initiative (CNCI) Goals: To establish a front line of defense against today’s immediate threats by creating or enhancing shared situational awareness of network vulnerabilities, threats, and events within the Federal Government—and ultimately with state, local, and tribal governments and private sector partners—and the ability to act qu ickly to red uce o ur c urrent vu lnerabilities and prev ent intru sions. To defend against the full spectrum of threats by enhancing U.S. counterintelligence capabilities and increasing the security of the supply chain for keyyg information technologies. To strengthen the future cybersecurity environment by expanding cyber education; coordinating and redirecting research and development efforts across the Federal Government; and working to define and develop strategies to deter hostile or malicious activity in cyberspace. 1 CyberCyber--environmentsenvironments are changing rapidly Yesterday Today yy chnolog ee T Mainframe PCs Computers Web 1.0 Web 2.0 Mobile Government scientists Bu siness u sers of Pre-teens all industries Trained technicians Seniors Educators and Machine language Non-expert users administration People developers Casual users Researchers Expert Users Business, Education, The World Research Users Spectators Participants 2 These environments depend on Virtual Identities Social Networks Virtual Worlds Games (MMOGs) •Profiles •Profiles •AIs and Bots •Searches •Searches •GlGoals •Friends •Friends •Rules •Groups/Communities •Groups/Communities •Groups/Communities •User Generated Content •User Generated Content •Characters •Posts/Blogs •Characters •Advancement measure •Chat/I ns tan t Messages •3-D Worlds •VOIP •Chat/Instant Messages •3-D Worlds •VOIP •Economy •Few Rules 3 What is a Virtual Identity? A Virtual Identity (VI) is the manifestation of one’s self in the digital world of e-commerce, e-mail, social networking, and virtual worlds. – A virtual identity is composed of the aggregate of identity elements found online tied to a persona – These identity elements can be intentionally or unintentionally propagated – VI elements could include your: • GilYhGmail, Yahoo, or corpora te ema ilddil address • Your Classmates.com login ID, old classmates, etc.. • Your Second Life avatar’s name • Your Facebook friends list • Personal information yypou posted, then deleted, from your personal website in 1996 • Your PayPal account information • Your credit card number • Your online banking login and password • Reviews of a toaster that you posted on Amazon. com • Etc….. You leave a trail of information about who you are, what/who you like, and where y ou ’v e been all ov er the Internet 4 But there is a dark side………. Video courtesy of the ACLU 5 Virtual worlds blur the lines of identity. 6 Tying Virtual Identity to True Identity can be Difficult Physical Person’s Attributes Virtual Identity Attributes Location IP address Biometric Visual Representation Finger prints Avatar Height/ weight Pictures Financial Financial Credit cards Credit cards Bank accounts Bank accounts Transaction History Transaction History Social Social Personality Personality Habits Reputation/Credibility Network Contacts Biographic Biographic Name Pseudonym Race Type of virtual identit y Gender Gender Age Age Hobbies Interests Virtual communities across the Internet are redefining “identity” Filename/RPS Number 7 Identifying the physical identity behind online virtual identities is a major problem with the web and online social networks •Username: John Doe •DoB: 2/29/1970 •First Name: John •Last Name: Doe •Email: johndoe@hotmail. com •Username: DownWithAmerica123 •DoB: 7/9/1965 •First Name: Evil •Last Name: Man •Email: [email protected] REAL WORLD •Username: MiamiVixen •Username: Joe Criminal •DoB: 6/2/1984 •DoB: 5/5/1980 •First Name : Janet •First Name: Joe •Last Name: Smith •Last Name: Criminal •Email: [email protected] •Email: [email protected] Online identityyy characteristics do not necessarily correlate with real-world identity characteristics Filename/RPS Number 8 And all are not friends…. Video courtesy of the Government of British Columbia 9 Virtual identities, combined with anonymous services and networks, provide fertile ground in which a variety of threats can grow Most fraud involves falsely portraying virtual identity, or stealing true identities – Fraudsters Target Facebook With Phishing Scam "A lot of phishing is moving out of financial services and going to online web sites that have not installed stronger authentication, sites that are not as close to the money“ ‐ Marc Gaffan, RSA's Identity and Access Assurance Group Product Marketing Lead Internet users cloaked in apparent anony mity are u sing many pu blicly av ailable serv ices to commit, coordinate, and brag about crimes Filename/RPS Number 10 What is Second Life? • Second Life is the first major Virtual World, launched by US-base d Lin den La b in 2003. • Not a game in the traditional sense (no points and levels, no winners or losers). • A virtual 3-D world entirely created by its users, with little regulation. 11 In Second Life, residents own their creations • Residents retain the intellectual property rights to their creations. • Property is bought and sold, buildings erected, construction outsourced, and millionaire realtors are made. • Clo thes (s kins ), furn iture, bo dy par ts, and other accessories are created and sold by users. 12 Anshe Chung – Second Life Entrepreneur 13 Countries, companies and other organizations have established a presence Embassy of Sweden Embassy of Estonia Al Andalus Caliphate French National Front 14 Second Life has its own currency, the Linden Lindens are created by converting USD through credit cards, account transfer, and PayPal. The Lindex,,yg, the Second Life currency exchange, manages conversion of USD to Lindens. – Representative of the new generation of micropayments, built on the ashes of Digicash, Cybercoin, Millicent and others – E-Gold, CashU and other instruments can be converted to Lindens through various online currency exchanges – Current size of the Second Life economy is @ $275m/yr US $ Exchanged on the LindeX™ Exchange (in Millions) 15 Money can made inin--world,world, and exchanged or transferred, sometimes for real $$ Real currency is transferred out of game; game currency is transferred in game. An equal transaction. Gold farmers generate in world gold to transfer to players for real money. 16 Alternative Internet Currencies are Flourishing These currencies are: • Unregulated and uncontrolled systems • Anonymous and record- less • Allows anonymous interaction with traditional financial systems • International anonymous transfers • Leverages anonymity provided by the Internet 17 Instead of a Second Life, there will be solar systems of virtual worlds Interconnected, with the ability to transfer funds and avatars 18 There are easier, more anonymous ways to covertly communicate and send funds The Onion Router (TOR) Network – The Shadow Internet – A network of virtual tunnels (onions) that allows people and groups to improve their privacy and security on the Internet – Enables the use of highly anonymous services for communications and payment. (web, IRC, other TCP-based communication) – Allows users to visit internet websites anonymously, but also allows users to publish ‘hidden services’ How does it work? IPRTS Hop C Hop B Hop A *Source: http://torproject.org 19 TOR nodes are found Worldwide 20 The Shadow Internet (TOR) Usage Example: .onion Weed http://624eb2rznzhtq2cz.onion 21 Money laundering and virtual economies Criminals are abusing the inherent anonymity of transactions services to carry out illegal activities Current online services allow for large scale anonymous money transfer: – 2% of the world’s GDP lddlaundered every year – Minimum of $500 billion/year online Transactions can take place online such that miiinimal personally identifiable information is transferred or collected 22 Money laundering and virtual economies: Across multiple virtual and real currencies $$$ £££ ………… 23 Money laundering and virtual economies: Developing tools to understand and mitigate the risk PATH ANALYSIS TOOL 24 Examples of virtual currency being used in criminal activities Facebook social gaming currency (used in various games such as Farmville) being used to persuade political campaigning concerning health care reform. (Source: http://www.businessinsider.com/health-insures-caught-paying-facebook-users-virtual-currency-to- send-letters-to-congress-opposing-reform-bill-2009-12) A Japanese investor ran a pyramid scheme in which he promised more than 30% return to investors. However, after collecting initial investments, he announced that he would be converting the money to a virtual currency called Enten (translated as “divine yen”). He was arrested in February 2009. (Source: http://blog.foreignpolicy.com/posts/2009/02/05/japans_bernie_madoff, and http://www. timesonline. co. uk/tol/uk/tol/news/world/asia/article5665281news/world/asia/article5665281. ece) An embezzlement event in Eve Online took place last year involving the virtual currency called ISK (think of it as WoW gold). There are various sites that sell ISK for USD much like WoW gold. (Source: http://www.virtualgoodsnews.com/2009/06/virtual-currency-embezzling-scandal-rocks-eve-online- .html) An interesting story about how a teenager stole virtual