242 lines
16 KiB
Plaintext
242 lines
16 KiB
Plaintext
|
|
|||
|
|
|
|||
|
|
=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
|
|||
|
|
* (CHN) Connecticut Hacker Newsgroup (CHN) *
|
|||
|
|
= CHN News File #3 =
|
|||
|
|
* an I.I.R.G. affiliate *
|
|||
|
|
= -=>Present<=- =
|
|||
|
|
* Fundamental Truths About High-Tech Crime *
|
|||
|
|
=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
|
|||
|
|
|
|||
|
|
|
|||
|
|
FUNDAMENTAL TRUTHS ABOUT HIGH TECHNOLOGY CRIME
|
|||
|
|
By: Ron Hale
|
|||
|
|
|
|||
|
|
Some members of our society are greatly benefiting from
|
|||
|
|
new technology and are exploiting it in ways never imagined.
|
|||
|
|
Unfortunately, they re employing high technology to further
|
|||
|
|
criminal enterprises. High-technology crime was born almost
|
|||
|
|
simultaneously with legitimate uses Of computers, and continues
|
|||
|
|
to thrive as new, attractive technologies become available.
|
|||
|
|
And it will continue to grow as new user-empowering technologies
|
|||
|
|
are introduced and as more businesses and individuals have access
|
|||
|
|
to information systems.
|
|||
|
|
To understand high-technology crime, and to appreciate its
|
|||
|
|
significance and potential, we must understand some fundamental
|
|||
|
|
truths, about crime and how these relate to high technology.
|
|||
|
|
|
|||
|
|
Truth 1: Crime, like water, follows the path of least resistance
|
|||
|
|
|
|||
|
|
To understand crime you must realize that if an opportunity
|
|||
|
|
exists it will be exploited. Just as cars and the superhighway
|
|||
|
|
systems gave rise to bank robbery rates in the '5Os, the
|
|||
|
|
availability of computer and communications technologies will
|
|||
|
|
increase the incidence of technology-related crimes today.
|
|||
|
|
Computers and communication systems will be instrumental in
|
|||
|
|
completing criminal acts that under other circumstances would be
|
|||
|
|
completed traditionally. Like businesses, criminals in most
|
|||
|
|
cases look to technology for the benefits provided. As our
|
|||
|
|
society becomes more dependent on technology, and as more
|
|||
|
|
individuals, have access to information and communication
|
|||
|
|
systems, criminal exploits naturally will become more technology
|
|||
|
|
intensive.
|
|||
|
|
|
|||
|
|
Truth 2: Highly complex technical crimes are the exception
|
|||
|
|
rather than the rule.
|
|||
|
|
|
|||
|
|
Since the first computer crime was reported, we have been led
|
|||
|
|
to believe that the nature of technology crime was primarily
|
|||
|
|
technical. To gain from a criminal enterprise, offenders needed
|
|||
|
|
to have a significant understanding of inforation system
|
|||
|
|
architectures, system Software, specific applications and network
|
|||
|
|
technologies. This focus led us to believe that system cracking,
|
|||
|
|
infections through viruses and other malicious code, and breaking
|
|||
|
|
application security represented the most significant opportunities,
|
|||
|
|
for crime. Studies predicted potential annual losses in the billions.
|
|||
|
|
In reality, however, although there are spectacular highly technical
|
|||
|
|
crimes resulting in very significant losses, the majority of
|
|||
|
|
technology crime may be less technical than we suspected.
|
|||
|
|
The largest single wire transfer fraud in this country was
|
|||
|
|
possible because of collusion and weaknesses in control procedures.
|
|||
|
|
The mechanism was technical but the means was traditional.
|
|||
|
|
Although spectactir highly technical crime will occur, the greatest
|
|||
|
|
incidence of crime will be less technical in nature.
|
|||
|
|
We must understand that criminals will exploit technology to the
|
|||
|
|
extent necessary to facilitate crime.
|
|||
|
|
Since technology is an effective facilitator, we can expect
|
|||
|
|
technology to be increasingly used as an element of more traditional
|
|||
|
|
crimes. We also must understand, from a national policy standpoint,
|
|||
|
|
that to the extent that crime pervades the information highway,
|
|||
|
|
travelers increasingly will be at risk.
|
|||
|
|
|
|||
|
|
Truth 3: Old crimes take on new meaning with increased technology.
|
|||
|
|
|
|||
|
|
The availability and advantages of high technology may change the
|
|||
|
|
mix of criminal activities. In some cases, crimes that had not been
|
|||
|
|
well practiced may increase as tecnology replaces the need for skill.
|
|||
|
|
With forgery, due to the availability of scanners, color printers,
|
|||
|
|
and special software, an unskilled operator can mimic a master
|
|||
|
|
engraver. The result: document forgery can be practiced by
|
|||
|
|
anyone.
|
|||
|
|
New opportunities for crime may become possible through the
|
|||
|
|
exploitation of technology. These may be variations on a theme in
|
|||
|
|
the sense that the opportunity will be new, but the nature of the
|
|||
|
|
crime will be the same, For example, theft of services has been a
|
|||
|
|
problem as long as services of value could be stolen. A modem
|
|||
|
|
example is communications fraud. When communication companies
|
|||
|
|
controlled long-distance, few were able to exploit the technology
|
|||
|
|
for financial gain. With deregulation, and the decision of
|
|||
|
|
business to manage long-distance and other communication
|
|||
|
|
services through their own Private Branch Exchanges (PBX), a new
|
|||
|
|
opportunity was created.
|
|||
|
|
Weaknesses in the way systems were installed and managed
|
|||
|
|
has given a tremendous opportunity to criminals who make millions
|
|||
|
|
for the effort. Although certain skill is required to gain access
|
|||
|
|
to PBX systems, almost no skill is needed to operate long-distance,
|
|||
|
|
call-sell operations. With annual losses conservatively estimated
|
|||
|
|
at between $3 and $5 billion, there is sufficient motivation for the
|
|||
|
|
technical few to find and compromise systems so that others can sell
|
|||
|
|
the service.
|
|||
|
|
As new technologies are introduced, they are as likely to be
|
|||
|
|
exploited for criminal as well as legitimate use. In some cases
|
|||
|
|
technically oriented individuals may be enlisted to support larger
|
|||
|
|
criminal enterprises. Otherwise law abiding citizens, because of
|
|||
|
|
potential gains, may be motivated to participate in crime. Yet,
|
|||
|
|
for the most part, new crimes will not be created. Old crimes
|
|||
|
|
will become more lucrative because they are easier and more prof-
|
|||
|
|
itable. Additional criminal opportunities may be created because
|
|||
|
|
a new niche will develop out of weaknesses in policy or practice.
|
|||
|
|
In this case technology may spawn opportunities for crime.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Truth 4: Geographic boundaries are meaningless in an electronic age.
|
|||
|
|
|
|||
|
|
Modem law enforcement must deal with the mobile criminal.
|
|||
|
|
Often, agencies cooperatively investigate crimes since sophisti-
|
|||
|
|
cated criminal understand that the risk of arrest increases
|
|||
|
|
with the length of time in any geographic area. Property crimes
|
|||
|
|
are only solved because the offenders have been in an area too
|
|||
|
|
long.
|
|||
|
|
With technology, crime geography is meaningless. With the
|
|||
|
|
speed of an electron you can be around the world. Connections
|
|||
|
|
that require access through successive systems hide both identity
|
|||
|
|
and location. As physical presence becomes less significant,
|
|||
|
|
opportunities for detecting criminal activities and for apprehend-
|
|||
|
|
ing offenders become less frequent.
|
|||
|
|
Without geography, jurisdiction is difficult to determine.
|
|||
|
|
Cooperation among government agencies becomes almost impossible
|
|||
|
|
under the traditional police agency model. A victim may report a
|
|||
|
|
crime, but the agency responsible for investigation will not have
|
|||
|
|
the ability to share information or develop leads indicating a
|
|||
|
|
larger conspiracy. If an offender is caught, the odds of
|
|||
|
|
finding the full extent of the crime are virtually nil. Without
|
|||
|
|
information from the offender, or evidence retrieved from computer
|
|||
|
|
and commmication system records, it may not be possible to
|
|||
|
|
identify other victims. Without such information it is difficult
|
|||
|
|
to get the attention of prosecutors and judges.
|
|||
|
|
To be effective in a technical world, law enforcement agencies
|
|||
|
|
must establish contacts with other investigators, share information
|
|||
|
|
and support prosecutions for crimes committed without regard to
|
|||
|
|
geography. Although criminals have been eager to
|
|||
|
|
accept new opportunities presented through advanced technology,
|
|||
|
|
law enforcement has been hesitant. As violent crimes gain more
|
|||
|
|
attention and resources, nonviolent crimes, in particular
|
|||
|
|
technical crimes, are sometimes forgotten. Few departments have
|
|||
|
|
the trained personnel or resources to dedicate to technical
|
|||
|
|
crimes.
|
|||
|
|
|
|||
|
|
Truth 5: Society is hesitant to impose the controls necessary to
|
|||
|
|
deter or detect electronic criminals.
|
|||
|
|
|
|||
|
|
With the promotion of an electronic frontier available
|
|||
|
|
through an information superhighway, there is little
|
|||
|
|
consideration given to crime or criminal opportunity.
|
|||
|
|
In the days of the wild west, pioneers took risks and brought order
|
|||
|
|
to what had been an unsettled environment. As more people were
|
|||
|
|
attracted to an area, social conventions that had the, force of
|
|||
|
|
law developed through mutual consensus. As the population grew,
|
|||
|
|
elements were attracted that soon required more formalized laws and
|
|||
|
|
a structure for detecting and punishing transgressions.
|
|||
|
|
Our electronic frontier has currently developed conventions. With
|
|||
|
|
the rapid increase in Internet Users, many conventions are challenged
|
|||
|
|
or openly disregarded. The punishment of "flaming" will not be as
|
|||
|
|
effective as the number of new users outnumbers the old-time
|
|||
|
|
pioneers.
|
|||
|
|
Imposing rules and structure over behavior is easier and more
|
|||
|
|
acceptable than limiting personal expressions or electronic access.
|
|||
|
|
Requiring citizens to purchase and display a vehicle license can
|
|||
|
|
be effectively accomplished without creating public outcry.
|
|||
|
|
Requiring licensiiig to identify users across an open network
|
|||
|
|
will be impossible, if driven by the government. Such requirements
|
|||
|
|
appear to impose restrictions that limit what we feel are our
|
|||
|
|
fundamental rights.
|
|||
|
|
Without the ability to ID parties to a communication across an
|
|||
|
|
endless network of systems, electronic commerce cannot be
|
|||
|
|
implemented.
|
|||
|
|
Commercial conventions similar to a signature, cannot be developed.
|
|||
|
|
Unless the users mutually agree to impose and accept certain
|
|||
|
|
limitations, controls cannot be imposed. Without the ability to
|
|||
|
|
positively identify communicating parties, criminal clements will
|
|||
|
|
flourish. They will have free unrestricted access with the
|
|||
|
|
ability to take on any identity required to attract or gain the
|
|||
|
|
confidence of their intended victims.
|
|||
|
|
Unfortunately, users across bullletin boards or information
|
|||
|
|
services tend to tyrust other users and information received because
|
|||
|
|
both they and the party to the communication are part of the
|
|||
|
|
fraternity of users. Crime can flourish in such an environment.
|
|||
|
|
These simple truths lead us to draw cxertain conclusions about the
|
|||
|
|
nature of controls within a technical environment.
|
|||
|
|
Controls. including manual and automated procedures, must be
|
|||
|
|
comprehensive. reliance on a technical control such as access
|
|||
|
|
control systems may not be sufficient when criminals are
|
|||
|
|
attacking from all directions. We know that system crackers rely
|
|||
|
|
on social engineering and dumpster diving to gain information
|
|||
|
|
that facilitates system penetrations. We have seen that criminals
|
|||
|
|
will use technical means for financial gain in ways that mimic
|
|||
|
|
traditional crimes. To develop a reliable and effective control
|
|||
|
|
structure we must blend manual and automated procedures with
|
|||
|
|
technical controls in a way that enables prevention as well as
|
|||
|
|
detection capabilities.
|
|||
|
|
There is a need to accept technologies that ensure correct
|
|||
|
|
identification of communicating parties. The government has been
|
|||
|
|
reluctant to bless current technologies such as public key
|
|||
|
|
cryptography. In an electronic age there are no easy ways to verify
|
|||
|
|
identity without using measures such as public key encryption.
|
|||
|
|
Users may need to trade some of the freedom currently available in
|
|||
|
|
the electronic world to help ensure their own safety and security.
|
|||
|
|
In some commercial cases, positive verification of identity should
|
|||
|
|
be considered a contractual requirement. When identity can be
|
|||
|
|
established, and it can be known positively that messages have not
|
|||
|
|
been compromised, then electronic commerce will be more secure.
|
|||
|
|
Ethical computing needs to be taught at an early age.
|
|||
|
|
Criminologists believe that when rules have not been formalized and
|
|||
|
|
accepted within the population, it is difficult to define ethical
|
|||
|
|
behavior or make individuals accountable. We must accept basic
|
|||
|
|
rules of the road before being admitted to the information super-
|
|||
|
|
highway. Currently there is little agreement as to what is proper
|
|||
|
|
behavior in a computing environment. Some expect rigid controls
|
|||
|
|
while others with equal personal conviction believe that systems
|
|||
|
|
should be open and that cracking is a legitimate intellectual
|
|||
|
|
pursuit.
|
|||
|
|
Most people will find an acceptable position somewhere between
|
|||
|
|
the two stances.
|
|||
|
|
Electronic travelers must be made aware of the dangers.
|
|||
|
|
As long as there are criminals seeking opportunities for fraud,
|
|||
|
|
theft and even child molestation on our networks, we must
|
|||
|
|
encourage vigilance. Users must be aware that electronic travels
|
|||
|
|
require the same degree of vigilance and awareness as do travels
|
|||
|
|
through the physical city. Bulletins should be made generally
|
|||
|
|
available, perhaps in an electronic town square, that warn
|
|||
|
|
about recent criminal activities or post the identity of those
|
|||
|
|
who violate the security of the network or its users. Being aware
|
|||
|
|
is being prepared.
|
|||
|
|
Security and law enforcement personnel must be aware of
|
|||
|
|
opportunities for crime, and must have the skills and equipment
|
|||
|
|
to be able to prosecute technical crimes. Some have predicted
|
|||
|
|
that, as this century closes, public concerns about violent crime
|
|||
|
|
will increase and police attention and involvement with
|
|||
|
|
property crimes will decrease. They have suggested that
|
|||
|
|
private agenecies will be required to take on more
|
|||
|
|
responsibility. Security Officers will increasingly need
|
|||
|
|
to be aware of corporate and individual network connections, how
|
|||
|
|
they are used and what the risks are for their organizations.
|