Cybercriminals kill for rewards

It’s exactly the same as the crimes that have been around for years in the traditional criminal world, said Dmitri Alperovitch, director, intelligence analysis at Secure Computing Corporation during a seminar at this month’s RSA Conference in San Francisco.

“There are clear cases to date of cybercriminal activity resulting in deaths of people,” he said. “This is not just bits and viruses; this is not just someone stealing a Word document from your computer; it’s financing other types of organised criminal activity such as drugs and terrorism and people are dying.”

There’s a lot of talk about ties to terrorism and organised crime, explained Alperovitch, pointing to a case last year in the UK where two men - alleged Al Qaeda operatives – were convicted for terrorist incitement activity.

“They were essentially acting as Al Qaeda’s Internet PR agency,” Alperovitch said. “They were posting videos of Osama Bin Laden on the Internet and a lot of the times they were using compromised machines.

“However, these individuals were actually participating on several cybercriminal forums and they were participating in phishing activities, carding activities and exchanging credit card [details] with Eastern European mafia the proceeds of which were financing terrorist equipment and expenses,” he claimed.

“It is also believed that the [two in question] were involved in the July 7 London bombing. It’s one of the clearest cases to date of cybercriminal activity actually resulting in deaths of people.”

Described as the 21st Century’s portal for organised crime, the Web is where the money is where millions upon millions of dollars are accessible to the criminals in compromised online transactions.

It’s now reached the point where the market has become saturated with so many credit card numbers and personal information that criminals have accumulated huge databases to share, said Alperovitch.

Furthermore, cybercriminal syndicates don’t even need to be technologically savvy. There’s now an entire industry that is providing criminals with ready and available toolkits that even a novice can pick up and operate successfully within a few hours, explained Alperovitch.

Despite the low entry cost and ease of availability for such toolkits, Alperovitch warns the biggest lure for online crime comes from the global anonymity it offers.

“What we’re starting to see and have been seeing for some years is a transnational operation all over Eastern Europe, all over South America and the Middle East, as well as Western countries that are working together exchanging stolen information and providing services to each other.

“[More so], if you’re participating in an online criminal activity there’s a pretty good possibility you won’t get caught; you won’t be identified and if you are identified you probably won’t be prosecuted because you’re probably operating out of a country where cybercrime prosecutions are non existent,” said Alperovitch.

Such was the case of the alleged cybercriminal and Ukrainian national, Dimitri Golubov. Considered a top cybercriminal boss by US authorities, he was allegedly the founder of the underground fraud ring, carderplanet.com, which launched in early 2000.According to Alperovitch, the organisation, which boasted 7000 members, was a clearing-house for trading stolen information, stolen credit cards and stolen botnets.

Golubov was arrested and charged with cyber-theft in 2005, but his detainment was short-lived.

“Members of the [Ukrainian] Parliament intervened on his [Golubov] behalf and he was let off,” Alperovitch said. "In fact Members of Parliament made a case that he was being unfairly prosecuted.”

After his charges were dismissed, Golubov started his own political party, the Internet Party of UKraine.

Last month, The Washington Post reported that Golubov denied involvement in any cybercriminal activity, claiming the FBI confused him with someone else. According to Golubov, he was the victim of identity theft.

Alperovitch also commented on the ongoing creation of laws and legislation in relation to cybercrime. He dismissed new regulations as misguided and insisted that the criminal legislation [in the US] that has existed for more than a century is sufficient to convict cybercriminals.

“Some of the laws that we currently see in the industry pass now and again are a little bit misguided,” he said. “These crimes - when you follow the money and look at what they [criminals] are actually trying to do - are already covered by laws that are hundreds of years old.

Fundamentally, cybercrime, just like traditional crime, is a people problem and not a technology problem Alperovitch said.

“Unless we look at individuals and the organisations that are responsible for it, and unless we target them aggressively, this problem is not going to go away,” he said.

cybercriminalrsaconfsecurityukraine