NWA-PCUG Newsletter Article, April 2005
Legal Bytes: Cyber Criminals - Who and Why?
by John Brewer, Oklahoma City Computer Club

Why do some individuals have the need to engage in cyber crime? I refer specifically to those people who write code that damages networks and the computers connected to those networks.

According to a recent article in Internet News: “Tracking virus writers -- and more importantly, gathering evidence against them -- is a thorny problem for law enforcement agencies worldwide. While the number of arrests made and sentences handed down make 2004 the best year yet for catching cyber criminals, it won't have a noticeable effect on eliminating virus writers, according to the Finnish security firm F-Secure.“

F-Secure states there were three “primary security-related trends in 2004: a massive increase in phishing attacks; the introduction of open-source botnets and for-profit virus writing.”

Phishing is the term used for fraudulent emails that seek to obtain information from the recipient. This information is used for nefarious purposes including identity theft. An article on MSNBC.com states that consumers are susceptible to phishing. The anti-spam firm MailFrontier Inc. showed 1,000 consumers examples of so-called "phishing" e-mail as well as legitimate e-mail from companies such as eBay and PayPal. About 28 percent of the time, the consumers incorrectly identified the phishing messages as legitimate. Now that is a frightening statistic, as 28% is a high rate.

A botnet is generally a trojan that has penetrated security safeguards and is resident on a computer. When that computer connects to the Internet, the botnet will connect to an IRC channel. Then other infected computers connect to the channel and a botnet is formed. The person who created the botnet, often called a “botmaster” or “botherder,” can then control the computers that are connected to the botnet. For example, the botnet could be used to launch a denial of service attack on an innocent Website or computer.

The major viruses in 2004 consisted of Bagle, MyDoom, Netsky, Sasser, Korgo and Sober. Three of these were designed for specific crimes according to F-Secure.

The intent of MyDoom and Bagle and its many variants was to create spam proxies. These viruses caused damages in the millions of dollars and created denial-of-service attacks on Microsoft.com and SCO.com.

According to F-Secure, at one point MyDoom. A was responsible for 10 percent of all e-mail traffic. Both viruses used the Mitglieder proxy trojan. Officials at F-Secure suspect the two viruses may have been written by one group of writers. Bagle.A downloaded the Trojan from a Web site, and it was installed through a backdoor in MyDoom.A-infected machines.

The Korgo virus was designed to grab credit card and banking information, according to F-Secure. Similar to the Sasser worm, the virus targeted Windows 2000 and XP machines, scanning random IP addresses for PCs with a vulnerable, unpatched Local Security Authority Subsystem Service (LSASS).

Internet News reports it is difficult to trace and apprehend the cyber criminals. "If there's an increase [in arrests and indictments], it's very, very slight," said Paul Bresson, a spokesperson for the FBI, about his agency's efforts to combat virus writers. "We tend to devote our resources depending on the volume and scope of what's out there, and if there's a lot out there, we devote more resources."

The international nature of the Internet means many criminals can leave a long, convoluted trail that crosses national boundaries with ease, even if law enforcement agencies cannot. Despite actions by the Federal Trade Commission to promote cross-border communications and aid, there are still blind spots where virus writers can flourish.

Mikko Hypponen of F-Secure says that whenever he speaks with law enforcement contacts about tracking spammers or virus writers and it leads to places like Romania or Belarussia or Lithuania, "you hear this sigh from the investigators, because they know it became that much harder to gain local cooperation.”

"The bad guys know how to re-route their spam and their viruses and their hacking through six, seven, eight different countries and go through places like China and South Korea and some obscure island in the South Pacific just to make it hard for the authorities to track them," Hypponen says.

As an example, he points to a recent case where a Russian factory was hit with a virus by a hacker group operating out of Kuwait. The virus, after gaining access to the machines, started downloading more code from a Web site registered in a small island off the coast of Africa. The actual Web server, however, wasn't there; it was registered through Sweden to Jordan. From Jordan, the infected machines in Russia downloaded code that connected them with an IRC chat system operated in chat.cnn.com -- CNN's chat server in the U.S.

Hypponen said it was a relatively easy matter for his company to call CNN and the ISPs in charge of the Web server to blunt the effects of the outbreak, but it's something police would have had a tougher time accomplishing.

"If the Russian factory would have called the cops," he said, "how likely would it have been for the Russian police to first of all successfully track the virus around the globe and how likely is it that they would have been able to prosecute the Kuwaiti offenders?"

Sarah Gordon, a security expert at Symantec, has engaged in extensive investigation of the personalities of cyber criminals. “All those years of research and contact have revealed that many myths about virus writers are just that. The stereotype that virus writers are all young teenage boys with no social life, hiding in their basement is not accurate," she said. In contrast, she said, most virus creators are typical for their age, are on good terms with friends and family and are often contributors to their local community.

“Whatever the reason for writing a virus, all these groups share a common blindspot, says Ms. Gordon, which is that they have no conception that what they are doing can affect the wider world. “They do not connect the impact of what they do on the computer with the impact on another person," she says.

"But, once they realize that it can have an impact on other people, they age out of it and stop."

Her research has shown Ms. Gordon that there is a real difference between virus writers and hackers. While virus writers are usually socially adept, many hackers are not. "When you see a complex virus," she says, "it's come out of the hacking community." In her experience many malicious hackers have a borderline criminal view of the world and do not share mainstream ethical norms. Their judgment processes might be different," she says, "as well as their perception of risk and reward."

In my humble opinion, I find it difficult to excuse this sort of behavior, regardless of the reason.

John Brewer practices law in Oklahoma City, is a member of the Governor’s and Legislative Task Force for E-Commerce, and enjoys issues relating to eBusiness and cyberspace. Comments and questions are welcome and can be emailed to Johnb@jnbrewer.com.

There is no restriction against any non-profit group using this article as long as it is kept in context with proper credit given the author. The Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member, brings this article to you.

Click here to return to top