Digital mafia: into the cybercrime world July 2010 Cybercrime is today a lucrative business that generates more than one trillion dollars profits every year. According to analysts, cybercrime is reaching the turnover spawn by drug traffic ing. !"igital mafia: into the cybercrime world! is the new en$uiry published by %right enitrely &ocused on computer crime. 'he en$uiry is based on the contribution o& leading specialists in the field o& cybercrime and security. 'han s to# (aoul Chiesa, )enry *elto angas, + sana *ry hod o, ,nternews - raine, .rancesca %osco and -/,C(,. Preface by 0ianmaria 1ernetti Information Technology is one of the fastest evolving industries ever. The mass widespread of electronic devices, from computers to mobile phones, has radically changed the way people work, communicate and interact it has changed as well the way organised crime gangs work, communicate and interact. Cybercrime is today a lucrative business, generating more than one trillion dollars profits every year# according to several analysts, cybercrime is reaching the turnover spawn by drug traffic ing. Data available are impressive# in 2002, about 132,425 phishing attac s 6identity the&t7 were recorded worldwide. ,t is worth to note that 258 o& all the attac s were launched by eight main criminal groups9 during the second semester o& 2002, a gang called Avalanche was responsible &or the ::8 o& the phishing assaults. 'he rise o& cybercrime as a massive phenomenon has been made possible by several &actors. 'he e;ponential growth o& the world wide web has given birth to new models o& scale economies which are the ideal terrain &or illegal activities. 'he rise o& social interaction websites, such as social networ s, has increased the di<usion o& private data users that can be potentially and o&ten easily stolen. .inally, the e;treme =e;ibility o& digital in&rastructures such as servers and providers allows gangs to launch attac s without being obstacled by physical boundaries or geographical limits. 'han s to these elements, organised gangs dispose o& a power&ul tool to e;ert political pressure too# the (ussian %usiness /etwor represents the ideal case history to understand the role cybercrime can play on diplomacy and global affairs. 'his is particularly true &or specific geographical areas# >astern >urope, the %al ans, Caucasus, (ussia and &ormer soviet countries are the most important hub o& illegal digital activities. A mi; o& high ,' education level and corruption has made possible the creation o& multi-national cybercrime gangs such as the (%/# power&ul, =e;ible, with strong ties with the political establishment and able to operate on a truly global perspective. Considering this, what are and what can be the measures to prevent and struggle the cybercrime phenomenon@ +n a juridical level, several initiatives have been carried on in the last ten years by international organisations and national institutions. ,n 2001, the >uropean -nion adopted the Convention on Cybercrime, the first treaty committed to fight computer crimes and internet &rauds. 'he Convention, signed by Canada, Japan, -BA and Bouth Africa too, has been en&orced in the last years, but has not represented yet a concrete countermeasure. As &ar as social contrast is concerned, currently it seems to be difficult to set up pragmatic obAectives. 'he point C hard to e;plode C is that cybercrimes are publicly perceived less dangerously than crimes as drug or human traffic ing. Dhereas is somewhat easier to per&orm an e<ective awareness-raising communication &or the latter topics, how does one deal with the tas o& raising awareness on cybercrime issues? ,n this perspective, one o& the main obstacles is communication# contrary to drug traffic ing-related matters, cybercrime attac s and operations rarely appear on newspapers and magazine, being isolated in technical magazines &or insiders. 'he lac o& proper communication and in&ormation impede consumers to set up a real approach to counterfight cybercrime. 'he goal o& our en$uiry is to underline that today cybercrime poses a big threat &or the international civil society, no less than drug traffic ing or money laundering# underestimating this &act would mean losing an important step in the social struggle against transnational organised crime. 'o understand trends and technologies, to communicate and in&orm is, in our opinion, the best way to raise awareness on a growing phenomenon that affects the way people wor , communicate and interact. !ybercrime: reasons, evolution of the players and an analysis of their modus operandi by (aoul Chiesa This article aims to run a first analysis of the roots of cybercrime, while applying a sort of profiling to the attackers from the past and nowadays, analysing the historical evolution of cybercriminals and their behaviour. 'he article will then Eoom on the modus operandi used by the actors, organised by macro areas, as well as the business model o& the criminal organisations dealing with cybercrime. ,t is e;tremely important to learn the details o& cybercrime i& we want to fight it. And, it is not about a new story, as the ne;t sentence states# "very new technology opens the doors to new criminal approaches F'his is a statement on the &ate o& the modern underground. 'here will be none o& the nostalgia, melodrama, blac hat rhetoric or white hat over-analysis that normally accompanies such writing. Bince the early si;ties there has been just one continuous hac ing scene. .rom phrea ing to hac ing, people came and have gone, e;plosions o& activity, various geographical shi&ts o& in=uence. %ut although the scene seemed to constantly redefine itsel& in the ebb and =ow o& technology, it always had a direct lineage to the past, with similar traditions, culture and spirit. ,n the past &ew years this connection has been completely severed. And so there is very little point in writing about what the underground used to be9 leave that to the historians. 1ery little point writing about what should be done to make everything good again9 leave that to the dreamers and idealists. ,nstead , am going to lay down some cold hard &acts about the way things are now, and more importantly, how they came to be this way. 'his is the story o& how the underground diedG. 6&rom H*hrac I, ,ssue J :K, article J 14, by HAnonymousI# 'he -nderground Lyth, April 11th, 20037 , have decided to start my contribution $uoting this very recent article &rom *hrac , the hac er’s magazine by decades now. Ly article in &act will not argue on the long-time debate on black#hat or white#hat, while it will try to supply a detailed overview o& the attac er’s evolutions and their techni$ues along the years. ,n order to begin with the hac ing roots, there is not a specific year when the hac ing phenomenon started# someone claims 12N2, others around 1230O1231. 'he truth is that, probably, a lot o& computer incidents 6break?ins7 happened well be&ore the first official and public cases, but in any case the first wave o& computer hac ers started bac after the movie Dargames was released, bac in 1234. 'eenagers &rom all over the world, mainly &rom -BA, Canada, Australia and >urope, began as ing their parents to buy them the very first home computers, toys li e the Commodore C?:K and the Binclair PQ Bpectrum, along with those weird Hmodem adaptersI. 'hose teens then began dialing into %%B 6%ulletin %oard Bystems7, learnt how to access Q.25 networ s and how to run wardialing scans all over the world. 'al ing about the used attac ’s techni$ues, at these times we were used to see stu< li e password guessing, wardialingOscanning 6both &or *Cs connected to modems, and systems connected to X.25 networ s worldwide7 and trying de&ault accounts. ,n this era those hac ers were, definitely, still matching the clichR o& the hac er as we mean today. /evertheless, they were curious guys, loo ing &or networ and computer accesses in order to learn. $%&'#$%%( , have split the decade 1230-1220 into two di<erent parts. 'his mainly happened because o& two, di<erent aspects. .irst o& all, the growing hac ing scene created its own press arm, meaning magazines 6e?Eines7 such as 2:00 Lagazine# the )ac er’s Suarterly and *hrac . 'his meant that now the hac ing underground have its own magazines and the ability to have a voice shouting out what is happening and what the hac ing scene is doing. As a secondary but pretty important aspect, those hac ers C located in di<erent parts o& the world, as wonder&ully detailed by Buelette "rey&uss in her boo H-nderground# 'ales o& )ac ing, Ladness and +bsession on the >lectronic .rontierI C had their very first chance to share together the results o& their attac s and learned nowledge. 'his is a real important issue, since it is in this second part o& the 30’s that those hac ers began to hac in groups, starting posting their findings on %%B and X.25?located public systems, such as Altos, *egasus, SB" and so on, as they will eep on doing &or a part o& ne;tMs decade 61221-12257. +n the attac ’s point o& view, nothing changed that much since the earlier period o& time# password guessing and systems scanning were still the mainly used approaches. ,t was e;actly by this approach that )agbard and *engo, two members &rom the CCC 6Chaos Computer Club, a German-based organisation and the oldest hac ing group in >urope7 began hac ing -B Lilitary and 0overnment computer systems, as e;plained by Cli<ord Btoll in its boo , H'he Cuc ooMs >gg# 'rac ing a Bpy 'hrough the Laze o& Computer >spionageI, published in 1232.