VAST 200-02 Computers and Society

Lecture 11 - Computer Crime

Spring 2005

Prof. John Nestor

ECE Department
Lafayette College
Easton, Pennsylvania 18042
nestorj@lafayette.edu
Some of these slides are derived from slides created by Sherry Clark for the book A Gift of Fire by Sarah Baase 2003 Prentice-Hall

Overview - Computer Crime

Introduction
Hacking
Online Scams
Fraud
Embezzlement and Sabotage
Information Theft, and Forgery
Crime Fighting Versus Privacy and Civil Liberties

VAST 200 Spr. '05

Lecture 11 - Computer Crime

Introduction
Computers are tools for:

Business and finance (personal and corporate)

Calculation and record keeping
Communication
Entertainment

Criminals are Tool Users

As the public starts to use a technology, so do criminals.
Criminal uses of a technology are often unanticipated.
Preventing, detecting, and prosecuting computer crime is
a challenge.

VAST 200 Spr. '05

Lecture 11 - Computer Crime

Hacking
The Phases of Hacking
Phase One: The early years
1960s and 1970s.
Originally, hacker referred to a creative programmer wrote
clever code.
The first operating systems and computer games were written
by hackers.
The term hacking was a positive term.
Hackers were usually high-school and college students.

Q: Describe a modern-day version of clever hacks.

VAST 200 Spr. '05

Lecture 11 - Computer Crime

Hacking
The Phases of Hacking (contd)
Phase Two: Hacking takes on a more negative meaning.
1970s through 1990s.
Authors and the media used the term hacker to describe
someone who used computers, without authorization,
sometimes to commit crimes.
Early computer crimes were launched against business and
government computers.
Adult criminals began using computers to commit their
crimes.

Q: Distinguish between the hacking done by Kevin Mitnick and Robert T. Morris.
VAST 200 Spr. '05

Lecture 11 - Computer Crime

Hacking
The Phases of Hacking
Phase Three: The Web Era
Beginning in the mid-1990s.
The increased use of the Internet for school, work, business
transactions, and recreation makes it attractive to criminals
with basic computer skills.
Crimes include the release of malicious code (viruses and
worms).
Unprotected computers can be used, unsuspectingly, to
accomplish network disruption or commit fraud.
Hackers with minimal computer skills can create havoc by
using malicious code written by others.

Q: Why are denial-of-service attacks difficult to prevent?

VAST 200 Spr. '05

Lecture 11 - Computer Crime

Hacking
Hactivism
is the use of hacking expertise to promote a political
cause.
This kind of hacking can range from mild to destructive
activities.
Some consider hactivism as modern-age civil disobedience.
Others believe hactivism denies others their freedom of
speech and violates property rights.

Q: Argue the case that hactivism is ethical.

VAST 200 Spr. '05

Lecture 11 - Computer Crime

Hacking
The Law
Computer Fraud and Abuse Act (CFAA, 1986)
It is a crime to access, alter, damage, or destroy information
on a computer without authorization.
Computers protected under this law include:

government computers,
financial systems,
medical systems,
interstate commerce, and
any computer on the Internet.

Q: Is your personal computer protected under this law?

VAST 200 Spr. '05

Lecture 11 - Computer Crime

Hacking
The Law (contd)
USA Patriot Act (USAPA, 2001)
Amends the CFAA.
Allows for recovery of losses due to responding to a hacker
attack, assessing damages, and restoring systems.
Higher penalties can be levied against anyone hacking into
computers belonging to criminal justice system or the
military.
The government can monitor online activity without a court
order.

Q: Are anti-hacking laws adequate?

VAST 200 Spr. '05

Lecture 11 - Computer Crime

Hacking
Catching Hackers
requires law enforcement to recognize and respond to
myriad hacking attacks.
Computer forensics tools may include:

Undercover agents,
Honey pots (sting operations in cyberspace),
Archives of online message boards,
Tools for recovering deleted or coded information.

Computer forensics agencies and services include:

Computer Emergency Response Team (CERT),
National Infrastructure Protection Center (NIPC),
Private companies specializing in recovering deleted files and
e-mail, tracking hackers via Web site and telephone logs, etc..

Q: What computer forensics tools or agencies have been in the news lately?
VAST 200 Spr. '05

Lecture 11 - Computer Crime

10

Hacking
Questions About Penalties
Intent
Should hackers who did not intend to do damage or harm be
punished differently than those with criminal intentions?

Age
Should underage hackers receive a different penalty than
adult hackers?

Damage Done
Should the penalty correspond to the actual damage done or
the potential for damage?

VAST 200 Spr. '05

Lecture 11 - Computer Crime

11

Hacking
Security
Security weaknesses can be found in the computer
systems used by:
businesses,
government (classified and unclassified), and
personal computers.

Causes of security weakness:

characteristics of the Internet and Web,
human nature,
inherent complexity of computer systems.

Q: How secure is your computer at home? At work?

VAST 200 Spr. '05

Lecture 11 - Computer Crime

12

Hacking
Security can be improved by:

Ongoing education and training to recognize the risks.

Better system design.
Use of security tools and systems.
Challenging others to find flaws in systems.
Writing and enforcing laws that dont stymie research and
advancement.

Q: Does weak security justify intrusion?

VAST 200 Spr. '05

Lecture 11 - Computer Crime

13

Online Scams
Auctions
Selling and buying goods online has become popular.
Problems:

sellers dont send the goods,

sellers send inferior goods,
price is driven up by shill bidding, and
illegal goods sold.

Solutions:

educate customers,
read seller reviews,
use third-party escrow, and
more

VAST 200 Spr. '05

Lecture 11 - Computer Crime

14

Fraud
Some Causes of Fraud
Credit-Card
Stolen receipts, mailed notices, and cards.
Interception of online transaction or weak e-commerce
security.
Careless handling by card-owner.
Phishing

ATM
Stolen account numbers and PINs.
Insider knowledge.
A counterfeit ATM.

Telecommunications
Stolen long-distance PINs.
Cloned phones.

Q: Have you been a victim (or intended victim) of a fraud?

VAST 200 Spr. '05

Lecture 11 - Computer Crime

15

Fraud
Some Defenses Against Fraud
Credit-Card

Instant credit-card check.

Analysis of buying patterns.
Analysis of credit card applications (to detect identity theft).
Verify user with Caller ID.

ATM
Redesigned ATMs.
Limited withdrawal.

Telecommunications
match phone signature with serial number.
identify phone without broadcasting serial number.

Q: Identify a business defense against fraud that you have witnessed.

VAST 200 Spr. '05

Lecture 11 - Computer Crime

16

Embezzlement and Sabotage

Some Causes

Insider information.
Poor security.
Complex financial transactions.
Anonymity of computer users.

Some Defenses

Rotate employee responsibility.

Require use of employee ID and password .
Implement audit trails.
Careful screening and background checks of employees.

VAST 200 Spr. '05

Lecture 11 - Computer Crime

17

Identity Theft
Some Causes of Identity Theft
Insecure and inappropriate use of Social Security
numbers.
Careless handling of personally identifiable information.
Weak security of stored records.
Insufficient assistance to identity theft victims.

Some Defenses for Identity Theft

Limit use of personally identifiable information.
Increase security of information stored by businesses
and government agencies.
Improve methods to accurately identify a person.
Educate consumers.

Q: What measures do you take to reduce the risk of theft of your identity?
VAST 200 Spr. '05

Lecture 11 - Computer Crime

18

Forgery
Some Causes
Powerful computers and digital manipulation software.
High-quality printers, copiers, and scanners.

Some Defenses

Educate consumers and employees.

Use anti-counterfeiting techniques during production.
Use counterfeit detection methods.
Create legal and procedural incentives to improve security.

Q: How would you educate your peers about the risks of digital forgery? A
parent? A child?
VAST 200 Spr. '05

Lecture 11 - Computer Crime

19

Crime Fighting vs
Privacy and Civil Liberties
Scams
Crime Fighting
Automated surveillance software to look for suspicious Web
activity.

Privacy and Civil Liberties

No search warrant nor proof of probable cause.

Biometrics
Crime Fighting
Exact match of biological characteristics to a unique person.

Privacy and Civil Liberties

Easy to build complete dossier on people.

Q: How much of your privacy and civil liberties are you willing to give up
in order to allow law enforcement to better fight computer crime?
VAST 200 Spr. '05

Lecture 11 - Computer Crime

20

Crime Fighting vs
Privacy and Civil Liberties
Search and Seizure of Computers
Crime Fighting
Obtain evidence of a crime.

Privacy and Civil Liberties

Day-to-day business ceases; non-criminal contact with others
ends.

The Cybercrime Treaty

Crime Fighting
U.S. and European governments agree to cooperate with
investigations.

Privacy and Civil Liberties

Potential for government spying is great.

Q: Might there be incriminating data stored about you in the logs of your ISP?
VAST 200 Spr. '05

Lecture 11 - Computer Crime

21

Roadmap for the Term: Major Topics

Course Introduction
Computer Systems Overview
Computer History
Technology Trends
Current Issues

Faults and Failures

Privacy & Personal Information
Encryption & Interception
Free Speech and Censorship
Intellectual Property
Computer Crime
Computers and Work
\

Looking to the Future

VAST 200 Spr. '05

Lecture 11 - Computer Crime

22