Although the term cybercrime is usually restricted to describing criminal activity in which the computer or network is an essential part of the crime, this term is also used to include traditional crimes in which computers or networks are used to enable the illicit activity.
- Examples of cybercrime in which the computer or network is a tool of the criminal activity include spamming and criminal copyright crimes, particularly those facilitated through peer-to-peer networks.
- Examples of cybercrime in which the computer or network is a target of criminal activity include unauthorized access (i.e, defeating access controls), malicious code, and denial-of-service attacks.
- Examples of cybercrime in which the computer or network is a place of criminal activity include theft of service (in particular, telecom fraud) and certain financial frauds.
- Finally, examples of traditional crimes facilitated through the use of computers or networks include Nigerian 419 or other gullibility or social engineering frauds (e.g.,[ hacking ] “phishing“), identity theft, child pornography, online gambling, securities fraud, etc. Cyberstalking is an example of a traditional crime — harassment — that has taken a new form when facilitated through computer networks.
Additionally, certain other information crimes, including trade secret theft and industrial or economic espionage, are sometimes considered cybercrimes when computers or networks are involved.
Cybercrime in the context of national security may involve hacktivism (online activity intended to influence policy), traditional espionage, or information warfare and related activities.
Another way to define cybercrime is simply as criminal activity involving the information technology infrastructure, including illegal access (unauthorized access), illegal interception (by technical means of non-public transmissions of computer data to, from or within a computer system), data interference (unauthorized damaging, deletion, deterioration, alteration or suppression of computer data), systems interference (interfering with the functioning of a computer system by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing computer data), misuse of devices, forgery (ID theft), and electronic fraud
Introduction to Cyber Crime
The first recorded cyber crime took place in the year 1820! That is not surprising considering the fact that the abacus, which is thought to be the earliest form of a computer, has been around since 3500 B.C. in India, Japan and China. The era of modern computers, however, began with the analytical engine of Charles Babbage. In 1820, Joseph-Marie Jacquard, a textile manufacturer in France, produced the loom. This device allowed the repetition of a series of steps in the weaving of special fabrics. This resulted in a fear amongst Jacquard’s employees that their traditional employment and livelihood were being threatened. They committed acts of sabotage to discourage Jacquard from further use of the new technology. This is the first recorded cyber crime!
Viruses
A computer virus is a computer program that can infect other computer programs by modifying them in such a way as to include a (possibly evolved) copy of it. Note that a program does not have to perform outright damage (such as deleting or corrupting files) in order to be called a “virus”.
Many people use the term loosely to cover any sort of program that tries to hide its (malicious) function and tries to spread onto as many computers as possible. Viruses are very dangerous; they are spreading faster than they are being stopped, and even the least harmful of viruses could be fatal. For example, a virus that stops a computer and displays a message, in the context of a hospital life-support computer, could be fatal. Even the creator of a virus cannot stop it once it is “in the wild”.
The main types of PC viruses
Generally, there are two main classes of viruses. The first class consists of the file infectors, which attach themselves to ordinary program files. These usually infect arbitrary .COM and/or .EXE programs, though some can infect any program for which execution is requested, such as .SYS, .OVL, .PRG, & .MNU files. File infectors can be either direct action or resident. A direct-action virus selects one or more other programs to infect each time the program that contains it is executed. A resident virus hides itself somewhere in memory the first time an infected program is executed, and thereafter infects other programs when they are executed (as in the case of the Jerusalem 185 virus) or when certain other conditions are fulfilled. The Vienna virus is an example of a direct-action virus. Most other viruses are resident. The second category is system or boot-record infectors: those viruses that infect executable code found in certain system areas on a disk, which are not ordinary files. On DOS systems, there are ordinary boot-sector viruses, which infect only the DOS boot sector, and MBR viruses which infect the Master Boot Record on fixed disks and the DOS boot sector on diskettes. Examples include Brain, Stoned, Empire, Azusa, and Michelangelo. Such viruses are always resident viruses. Finally, a few viruses are able to infect both (the Tequila virus is one example). These are often called “multi-partite” viruses, though there has been criticism of this name; another name is “boot-and-file” virus.
File system or cluster viruses (e.g. Dir-II) are those that modify directory table entries so that the virus is loaded and executed before the desired program is. Note that the program itself is not physically altered; only the directory entry is. Some consider these infectors to be a third category of viruses, while others consider them to be a sub-category of the file infectors.
Stealth virus
A stealth virus is one that hides the modifications it has made in the file or boot record, usually by monitoring the system functions used by programs to read files or physical blocks from storage media, and forging the results of such system functions so that programs which try to read these areas see the original uninfected form of the file instead of the actual infected form. Thus the viral modifications go undetected by anti-viral programs. However, in order to do this, the virus must be resident in memory when the anti-viral program is executed.
The very first DOS virus, Brain, a boot-sector infector, monitors physical disk I/O and redirects any attempt to read a Brain-infected boot sector to the disk area where the original boot sector is stored. The next viruses to use this technique were the file infectors Number of the Beast and Frodo.
Polymorphic virus
A polymorphic virus is one that produces varied (yet fully operational) copies of itself, in the hope that virus scanners will not be able to detect all instances of the virus. The most sophisticated form of polymorphism discovered so far is the MtE “Mutation Engine” written by the Bulgarian virus writer who calls himself the “Dark Avenger”.
Fast and slow infectors
A typical file infector (such as the Jerusalem) copies itself to memory when a program infected by it is executed, and then infects other programs when they are executed. A fast infector is a virus which, when it is active in memory, infects not only programs which are executed, but also those which are merely opened. The result is that if such a virus is in memory, running a scanner or integrity checker can result in all (or at least many) programs becoming infected all at once.
The term “slow infector” is sometimes used for a virus that, if it is active in memory, infects only files as they are modified (or created). The purpose is to fool people who use integrity checkers into thinking that the modification reported by the integrity checker is due solely to legitimate reasons. An example is the Darth Vader virus
Computer’s Vulnerability
Computers, despite being such high technology devices, are extremely vulnerable. In fact it may be easier to steal national secrets from military computers than to steal “laddoos” from a “mithai” shop. Let us examine the reasons for the vulnerability of computers.
Computers store huge amounts of data in small spaces
Lakhs of pages of written matter can be stored in a CD ROM. Walking out of a godown with one lakh pages would be exceedingly difficult, but walking out of a secure location with a CD ROM containing a lakh of pages would be much simpler.
Ease of access
A bank’s vault, which usually contains a few lakh rupees is well guarded from unauthorized persons. The vault itself is made of very strong materials, located in a reinforced room, guarded by gun toting security personnel. Trusted employees jealously guard the keys and / or access codes. The bank’s servers, on the other hand, which ‘virtually’ control hundreds of crores of rupees, are far easier to break into. The strongest of firewalls and biometric authentication systems have been cracked in the past and will probably continue to be cracked in the future. A secretly implanted logic bomb, key loggers that can steal access codes, advanced voice recorders, retina imagers etc. that can fool biometric systems can be utilized to get past many a security system.
Complexity
Operating systems are composed of millions of lines of code and no single individual can claim to understand the security implications of every bit of these computer instructions. Hackers easily exploit the numerous weaknesses in operating systems and security products. When one weakness is exposed and exploited openly by the ‘black hat’ community, the operating system (OS) manufacturer patches it up. The hackers then find another weakness to exploit and the cycle goes on and on. It is far easier to find weaknesses in existing operating systems rather than designing and developing a secure operating system.
Human error
People who guard confidential papers with their lives would not think twice about using simple passwords. Most people don’t realize the security implications and ramifications of a simple ‘guessable’ password.
Application Security and Application Networks
Would your organization benefit from application security and the Application Network?
Consider your answer to the following hypothetical question from a line of business or the CIO:
“Our business demands that we use [insert any application here]; can we allow our [remote or internal] users access to it?”
“No, those users aren’t trusted.” “No, traffic is not encrypted.” “No, we can’t extend a VPN because of security.” “No, we don’t want to put that database server in the DMZ.” “No, we can’t route the traffic because of NAT and private IP addresses.” “No, we’d have to open non-standard ports and we can’t do that.” “No, that application is not webified.” “No, our firewall can’t handle dynamic port requests.” “No, we don’t allow any direct touch between networks.” “No…”
If any of these answers sound familiar, then application security and the Application Network can help.
The Access and security trade-off
Today, extending access to applications for the users who need them is no longer a “nice to have” - but a key determinant of who will win and who will lose. Legacy applications and databases, for example, contain invaluable customer information and provide a great resource for partners and other trusted third parties; email and other messaging applications are indispensable for seemingly instantaneous communication; and ‘emerging’ applications, such as audio and video conferencing, are now the critical enabler of ‘real-time business,’ resulting in huge gains in both productivity and profitability. Facilitating the rollout and accessibility of these applications, IP networks - both private and public, wired and wireless - make access to applications possible for any user from any corner of the globe. Why, then, are CIOs constantly refereeing a tug-of-war between the lines of business who want to realize the value of their applications by extending them to the users who need them and the network administrators who want to insulate their network from attack by increasingly limiting access for untrusted third parties?
What is driving this zero sum game where any access gained by the business results in a corresponding decrease in network security? The answer lies in the use of network security to deploy applications. That is, network security, which by its design disrupts and limits connectivity between networks, is also used to enable connectivity. These products - while critical for protecting the physical network - were not intended to protect and extend applications and consequently using them to deploy applications inevitably results in the access and security trade off.
The solution, however, is not to increase the IT budget to buy more point solutions or deploy an army of network administrators to provide the highly-oxymoronic ‘brute force flexibility,’ but to deploy a new conceptual network called the Application Network. The Application Network is a logical network that overlays the physical IP network and leverages its communications infrastructure while not undermining its physical security. The Application Network also underlies the applications that need the physical network for connectivity, providing robust and extensible application-layer security. When deployed, the Application Networks allow enterprises to use the applications their businesses require and securely extend those to the users who need them - while taking advantage of, not compromising, the network security infrastructure.
A Little History
Thirty years have passed since the U.S. Defense Advanced Research Projects Agency (DARPA) initiated the project to determine a method of linking together many disparate packet networks to enable cross-network communication. According to history, the initiative was referred to as the Internetworking project and the resulting mesh of linked packet networks was called the Internet. The Internet at that time was an aggregation of packet networks funded and hosted by government and educational enterprises throughout the United States. Enabling this inter-communication was the development of the Internet Protocol (IP), which defined how data packets are routed across the various networks. Until the 1980’s the Internet was a combination of public networks that allowed primarily academic and government to communicate freely and openly. Applications utilizing the TCP/IP protocol suite could be extended to users with routable IP addresses, a requirement of the early Internet. Soon, however, and by design, the Internet and its obvious business benefits began to get the attention of commercial enterprises as well as foreign governments and soon these organizations began to adhere to the IP protocol and connect their local networks to this public communications infrastructure. Now, users were diverse, unknown and not necessarily trusted while the information accessible was no longer academic, but sensitive business and governmental intelligence. Network security was born.
The Purpose of Network Security
Necessity certainly bred invention with the advent of network security. At a very high level, organizations needed to protect their physical networks from this ‘untrusted’ Internet and were eager to find solutions that allowed them limited access to the public networks while insulating their networks from potential attack and information theft. Answering this demand, firewalls were developed to protect the physical network. Firewalls, often utilizing Network Address Translation (NAT) for non-routable addresses that are hidden from the outside,were designed to limit network access by breaking the two fundamental rules of IP routing - that is that all network nodes must know of other nodes and all addresses of devices must be known. From the outset, the purpose of basic network security was to protect the physical network from attack by limiting connectivity between the two networks.
Emergence of the Security and Access Trade Off
The unfortunate downside of physical security that limits connectivity for untrusted users is that it also limits connectivity for trusted users. To provide access for trusted users,network administrators were forced to start ‘fixing’ the networking rules broken by the physical security as required by the users and the access they required. Opening holes in the perimeter security, however, to allow ingress and egress is exactly that: opening holes. Network administrators quickly realized that the amount of access granted to users was inversely proportional to the security of their network. A seemingly zero sum game, this network security and application access trade off is now a common dilemma within organizations large and small, domestic and international.
