Halting the Hacker: A Practical Guide to Computer Security (2nd Edition)

I l @ ve RuBoard

Computers are an essential component of most businesses, and criminals have also taken up computers as their tool of choice. Criminals are using computers in all sorts of ways. Illegal drug manufacturers have used computers to keep track of their inventories and their transactions with customers. Computers have been used to create fake IDs and counterfeit money. Computerized communications are used by criminals to communicate with other criminals or to manipulate their victims.

Financial Fraud

The computer and the communications it provides have been used often to commit fraud. The Internet is inundated with financial scams and get-rich-quick schemes. Other schemes which use a more direct attempt to deceive people for financial gain are also abundant. There have been many cases of attempting to manipulate stocks using the Internet. Some schemes have posted false news stories, and others have faked e-mail from company executives about earnings. Below is an account of one of the most successful.

A California man was indicted on charges that he fabricated a press release that led a publicly traded company to temporarily lose more then $2 billion in market value.

A former employee of Internet Wire, Mark Jakob, sent out a bogus press release which Internet Wire distributed and a number of news organizations, including CBS Market Watch, Bloomberg, and CNBC, reported as "news." As a result of the inaccurate reports , the stock price of Emulex plummeted from more than $110 a share to about $43 a share in less than an hour .

Jakob himself traded in the stock, through which he realized approximately $240,000 in profits. The SEC obtained records which showed that an account in the name of Mark Jakob was used to trade Emulex stock for the five months preceding the hoax and that there had been a series of suspicious transactions involving the stock starting about one week prior to the hoax. Specifically , the record showed that the account was used to execute short sale purchases; short sales involve selling shares of stock that a trader does not own, usually in anticipation that the price of the stock will decline. After Emulex's stock dropped, Jakob covered his short sale position and realized tens of thousands in profits. He also purchased shares while the stock was at $50 a share, after the false press release, and sold them when the stock had recovered most of its value. [58]

[58] "Emulex Hoaxer Indicted for Using Bogus Press Release and Internet Service to Drive Down Price of Stock," Department of Justice Press Release , 28 September 2000.

Credit Card Theft

The theft of credit card information has become a major practice on the Internet and among hackers. Credit card numbers are easily acquired from e-commerce sites which have not provided adequate security. Trafficking , the transmission of the stolen numbers from the hacker who stole them to the individuals who want to use them, has grown into a large business. The high rewards, ease of handling, and low expectations of being caught have brought traditional crime organizations into this arena.

Organized crime has become a major player in the trafficking of stolen credit card numbers. The ease of sending credit card numbers over the Internet to anywhere in the world has attracted international crime syndicates, who use stolen credit cards and the profits of selling these numbers to finance their other activities.

More than one million credit card numbers have been stolen by several organized hacker groups from Eastern Europe, specifically Russia and the Ukraine, that have penetrated U.S. e-commerce computer systems by exploiting vulnerabilities in unpatched Microsoft Windows NT operating systems. In some instances the credit card information is being sold to organized crime groups.

Once the hackers gain access, they download proprietary information, customer databases, and credit card information, then subsequently contact the victim company notifying them of the intrusion and theft of information. The hackers attempt to extort the victims by offering services to patch the system against other hackers. [69]

[69] "NIPC Advisory 01-003," FBI Press Office , 8 March 2001.

Hundreds of thousands of credit card numbers are stolen and sold annually. Only the largest of these thefts make their way to the newspapers.

Identity Theft

Identity theft is the malicious misuse of someone's identity. Someone can steal your name and social security number or gather enough of your identity information to be able to gain access to your financial resources. Incidents of these types of identity theft are on the rise.

Generally , this is an attempt to use the victim's good credit history to secure a line of credit that is then run up to the limit and the perpetrator disappears. Much of the information needed to steal someone's identity is often available through electronic methods : name, social security number, driver's license number, mother's maiden name, bank information, etc.

Donald McNeese was arrested on identity theft, credit card fraud, and money laundering charges stemming from his theft of a computer database containing personnel records for as many as 60,000 employees of the Prudential Insurance Company. He worked at Prudential's Jacksonville, Florida, office until June 2000, as the administrator of a database that contained personnel records for approximately 60,000 Prudential employees throughout the United States. After stealing the database, McNeese solicited bids for the sale of that information over the Internet.

Using an undercover identity, a detective from the Nassau County Police Department assigned to the New York Electronic Crimes Task Force engaged in a series of communications with McNeese, who sent the detective approximately 20 of the employees' identities via the Internet as "samples." He urged the detective to obtain credit cards in the names of the employees and send a portion of the proceeds from the fraudulent use of those cards to him in Florida. McNeese stated his intention to sell all the stolen identities he possessed to the highest bidder.

Using e-mail screen names that were stolen from his victims, he posted personal information and credit card numbers belonging to Prudential employees so that the readers could use the information to obtain fraudulent credit cards in the employees' names. He also engaged in a scheme to obtain money from fraudulent credit cards through a money-remitting businesses.

He allegedly sent e- mails to the victims of his credit card fraud scheme, falsely incriminating his former boss as the perpetrator of the fraud. At the time of his arrest, McNeese admitted to downloading Prudential's database. [60]

[60] "New York Electronic Crimes Task Force Arrests Defendant for One of the Largest Identity Theft Cases in U.S. History," U.S. Department of Justice Press Release , 1 March 2001.

Simple "identity theft" is generally no more than someone misrepresenting himself or herself as you in order to gain a financial return by forging a check or passing a credit card. Your identification may be stolen by physically taking your wallet or purse, or by misusing the information that comprises your identification. Most law enforcement professionals would not even consider this as identity theft, especially if the use of the identity is a one-time or very short-lived occurrence. To be classified as identity theft they would require that the theft of the identity be more in-depth or that the misrepresentation continues over a longer period of time.

In any case, most cases are short-lived, thirty to ninety days, and are performed for financial gain. However, there have been a few cases where identities have been stolen and used for years .

But the practice is far from uncommon. The real problem for consumers isn't monetary losses, but trying to repair a wrecked credit record. And as more information becomes available through the Internet, either for free or a low price, identity theft is expected to grow.

Consumers should try to keep personal information private, but there's little one can do to ward off a determined thief ” sometimes the theft isn't detected until it complicates the life of the victim.

Attorney General John Ashcroft announced 500,000 to 700,000 Americans have their identity stolen each year; yet only 86,000 complaints of identity theft were reported to the Federal Trade Commission's Identity Theft Data Clearinghouse.

In Indianapolis, two men were convicted of identity theft. Olasegun O. Ojomo, a 28-year-old Nigerian, was sentenced to 37 months in prison for stealing $224,000 by applying for student loans, purchasing telephone services, and credit card charges.

Michael A. Lee, 18, was sentenced to 10 months in a community correction center for helping an older friend steal mail from 240 homes in Marion and Hamilton counties. While Lee insisted he didn't know what he was doing, Judge David F. Hamilton noted the potential harm that could have resulted from identity theft. [61]

[61] Horne, Terry, "Erasing ID Theft Takes Time, Effort," The Indianapolis Star/News , 6 June 2002.

I l @ ve RuBoard
Related

Категории