1. Cyber Crime – “Is the Internet the new “Wild Wild West?” Prepared for the Southern Massachusetts E-Commerce Network Nov 5 2004 by Suzanne Mello www.suzannemello.com

2. E-Commerce Network - Suzanne Mello - Nov 5 2004 In the News……. 1 out of 5 children received a sexual solicitation or approach over the Internet in a one-year period of time (www.missingchildren.com) www.missingchildren.com California warns of massive ID theft – personal data stolen from computers at University of California, Berkeley (Oct 21, 2004 IDG news service) Microsoft and Cisco announced a new initiative to work together to increase internet security (Oct 18, 2004 www.cnetnews.com) www.cnetnews.com

3. E-Commerce Network - Suzanne Mello - Nov 5 2004 The New Wild Wild West More cyber criminals than cyber cops Criminals feel “safe” committing crimes from the privacy of their own homes Brand new challenges facing law enforcement Most not trained in the technologies Most not trained in the technologies Internet crimes span multiple jurisdictions Internet crimes span multiple jurisdictions Need to retrofit new crimes to existing laws Need to retrofit new crimes to existing laws

4. E-Commerce Network - Suzanne Mello - Nov 5 2004 Computer Crime Computer used to commit a crime Child porn, threatening email, assuming someone’s identity, sexual harassment, defamation, spam, phishing Child porn, threatening email, assuming someone’s identity, sexual harassment, defamation, spam, phishing Computer as a target of a crime Viruses, worms, industrial espionage, software piracy, hacking Viruses, worms, industrial espionage, software piracy, hacking

5. E-Commerce Network - Suzanne Mello - Nov 5 2004 Computer Forensics What is it? an autopsy of a computer or network to uncover digital evidence of a crime an autopsy of a computer or network to uncover digital evidence of a crime Evidence must be preserved and hold up in a court of law Evidence must be preserved and hold up in a court of law Growing field – Many becoming computer forensic savvy FBI, State and Local Police, IRS, Homeland Security FBI, State and Local Police, IRS, Homeland Security Defense attorneys, judges and prosecutors Defense attorneys, judges and prosecutors Independent security agencies Independent security agencies White hat or Ethical Hackers White hat or Ethical Hackers Programs offered at major universities such as URI Programs offered at major universities such as URI http://homepage.cs.uri.edu/faculty/wolfe/cf

6. E-Commerce Network - Suzanne Mello - Nov 5 2004 Uncovering Digital Evidence Smart Criminals don’t use their own computers Floppy disks Zip/Jazz disks Tapes Digital cameras Memory sticks PrintersCDsPDAs Game boxes Networks Hard drives

7. E-Commerce Network - Suzanne Mello - Nov 5 2004 Digital Evidence Criminals Hide Evidence Delete their files and emails Hide their files by encryption, password protection, or embedding them in unrelated files (dll, os etc) Use Wi-Fi networks and cyber cafes to cover their tracks Forensics Uncover Evidence Restore deleted files and emails – they are still really there! Find the hidden files through complex password, encryption programs, and searching techniques Track them down through the digital trail - IP addresses to ISPs to the offender Not obvious…….it’s most likely hidden on purpose or needs to be unearthed by forensics experts

8. E-Commerce Network - Suzanne Mello - Nov 5 2004 The Crime Scene (with Computer Forensics) Similar to traditional crime scenes Must acquire the evidence while preserving the integrity of the evidence Must acquire the evidence while preserving the integrity of the evidence No damage during collection, transportation, or storage Document everything Collect everything the first time Establish a chain of custody Establish a chain of custody But also different……. Can perform analysis of evidence on exact copy! Can perform analysis of evidence on exact copy! Make many copies and investigate them without touching original Make many copies and investigate them without touching original Can use time stamping/hash code techniques to prove evidence hasn’t been compromised Can use time stamping/hash code techniques to prove evidence hasn’t been compromised

9. Top Cyber Crimes that Attack Business SpamViruses/Worms Industrial Espionage and Hackers Wi-Fi High Jacking

10. E-Commerce Network - Suzanne Mello - Nov 5 2004 Spam “Spam accounts for 9 out of every 10 emails in the United States.” MessageLabs, Inc., an email management and security company based in New York. “We do not object to the use of this slang term to describe UCE (unsolicited commercial email), although we do object to the use of the word “spam” as a trademark and the use of our product image in association with that term” www.hormel.com

11. E-Commerce Network - Suzanne Mello - Nov 5 2004 Can-Spam Act of 2003 Controlling the Assault of Non-Solicited Pornography and Marketing Act (Can-Spam) Signed into law by President Bush on Dec 16, 2003 Took effect Jan 1, 2004 Took effect Jan 1, 2004 Unsolicited commercial email must: Be labeled Be labeled Include Opt-Out instructions Include Opt-Out instructions No false headers No false headers FTC is authorized (but not required) to establish a “do-not-email” registry www.spamlaws.comwww.spamlaws.com –lists all the latest in federal, state, and international laws www.spamlaws.com

12. Suzanne Mello - Nov 5 2004 Spam is Hostile You pay for Spam, not Spammers Email costs are paid by email recipients Email costs are paid by email recipients Spam can be dangerous Never click on the opt-out link! Never click on the opt-out link! May take you to hostile web site where mouse-over downloads an.exe Tells spammers they found a working address Tells spammers they found a working address They won’t take you off the list anyway They won’t take you off the list anyway What should you do? Filter it out whenever possible Filter it out whenever possible Keep filters up to date Keep filters up to date If you get it, just delete the email If you get it, just delete the email

13. E-Commerce Network - Suzanne Mello - Nov 5 2004 Viruses and Worms Different types of “ailments” Viruses software that piggybacks on other software and runs when you run something else software that piggybacks on other software and runs when you run something else Macro in excel, word Macro in excel, word Transmitted through sharing programs on bulletin boards Passing around floppy disks An.exe,.com file in your email An.exe,.com file in your emailWorms software that uses computer networks to find security holes to get in to your computer – usually in Microsoft OS!! But worm for MAC was recently written software that uses computer networks to find security holes to get in to your computer – usually in Microsoft OS!! But worm for MAC was recently written

14. E-Commerce Network - Suzanne Mello - Nov 5 2004 Hackers are Everywhere Stealing data Industrial Espionage Industrial Espionage Identity theft Identity theft Defamation Defamation Deleting data for fun A lot of bored 16 year olds late at night A lot of bored 16 year olds late at night Turning computers into zombies To commit crimes To commit crimes Take down networks Take down networks Distribute porn Distribute porn Harass someone Harass someone Ethical/white hat hackers exist too Help break into networks to prevent crimes Help break into networks to prevent crimes Mafia Boy

15. E-Commerce Network - Suzanne Mello - Nov 5 2004 Wireless Fidelity (Wi-Fi) Using antennas to create “hot spots” Hotspots – Internet Access (sometimes free) Newport Harbor - All the boats in Harbor have internet access Newport Harbor - All the boats in Harbor have internet access San Francisco Giants Stadium – Surf the web while catching a game San Francisco Giants Stadium – Surf the web while catching a game UMass (need to register, but it’s free) UMass (need to register, but it’s free) Cambridge, MA Cambridge, MA Philadelphia, PA – just announced – entire city by 2006 Philadelphia, PA – just announced – entire city by 2006

16. E-Commerce Network - Suzanne Mello - Nov 5 2004 Wi-Fi High Jacking 60-70% wireless networks are wide open Why are the Wi-Fi networks unprotected? Most people say “Our data is boring” Most people say “Our data is boring” But… criminals look for wireless networks to commit their crimes But… criminals look for wireless networks to commit their crimes And… the authorities will come knocking on your door….. And… the authorities will come knocking on your door…..

17. E-Commerce Network - Suzanne Mello - Nov 5 2004 Protect your Computers! Use anti-virus software and firewalls - keep them up to date Keep your operating system up to date with critical security updates and patches Don't open emails or attachments from unknown sources Use hard-to-guess passwords. Don’t use words found in a dictionary. Remember that password cracking tools exist Back-up your computer data on disks or CDs often Don't share access to your computers with strangers If you have a wi-fi network, password protect it Disconnect from the Internet when not in use Reevaluate your security on a regular basis Make sure your employees and family members know this info too!

18. Thank you!

19. E-Commerce Network - Suzanne Mello - Nov 5 2004 Web sites of Interest http://homepage.cs.uri.edu/faculty/wolfe/cf www.missingchildren.com www.spamlaws.com www.netsmartz.org http://www.ifccfbi.govhttp://www.ifccfbi.gov - operation web snare – latest cyber crimes to be aware of http://www.ifccfbi.gov http://www.dcfl.gov/dc3/home.htm http://www.cops.org/