Cybercrime: The Lawyers Are Coming

Part 2: Hacking and Viruses, Cyberstalking & Identity Theft

- Dyanna Culp

Hacking and Viruses

A Denial of service (DoS) attack disables part, or all, of the targeted system’s functions. In corporate America they call it a DoS attack, in the Internet jungle we call this hacking. DoS is a federal crime with stiff prison sentences and the kid gloves are off for the underage offenders. In 2000 teenagers brought down Amazon, Ebay, CNN, and Yahoo. Another DoS in 2000 shut down Army and Navy email systems within the Pentagon and a 2001 hacker brought down the Microsoft giant.

Hacking Warfare is claiming many victims. Practically every member of the Fortune 500 has been hacked, but particularly disconcerting is the news from Information warfare specialists at the Pentagon. They estimate that a well-coordinated attack by fewer than 30 strategically located hackers, with about $10 million at their disposal, could bring the United States to its knees. Everything from electric power grids, and all of the technology dependent upon them, to air traffic control centers could be incapacitated. “Good” hackers exploit system weaknesses to correct, not demolish, them. Case in point- many Microsoft security bugs have been brought to the light by conscientious hackers who pressed Microsoft to develop speedy patches.

There are two basic forms of DoS attacks. The first an Operating System attack targets software bugs in operating systems. The likihood of this type attack can be reduced by staying up to date on hardware and software “patches”. Microsoft is notorious for releasing programs filled with bugs. Check your PC operating system at http://windowsupdate.microsoft.com and your Office software at http://office.microsoft.com/Downloads/default.aspx to see if you’re missing any critical “updates” which means bug patches. Networking attacks  exploit inherent limitations of networking to disconnect you from your ISP or servers. Networking attacks can be reduced by utilizing firewall protection. Firewalls are especially critical for systems with a 24/7 online connection such as DSL or high speed cable.

It does not pay to ignore warnings against choosing common, easily hacked passwords. Last year, consumers reported 20,000 fraud complaints concerning online auctions to the FTC, second only to complaints on identity theft. Since January, the infamous giant Ebay has received numerous complaints from people whose accounts have been taken over and used to set up fraudulent auctions. How did they do this? Probably with a dictionary attack which uses an automated program, or "bot," to find passwords by drawing on a list of common passwords and a word dictionary.

McAfee estimates more than 58,000 virus threats are currently active and Symantec reports that 10 to 15 new viruses emerge each day. The security-services company TruSecure surveyed 200 organizations from January 2000 -August 2001 and found that roughly 1.2 million virus attack incidents occurred in a 20-month period. Although the study found that businesses are taking protection more seriously, 28 % were hit with a virus disaster, classified as a virus affecting 25 or more PCs or servers.

The basics for protection include antivirus programs - with automatic live updates, firewalls, and multi layered server security. No one should have to remind you about opening unexpected attachments or visiting Website urls sent through anonymous emails. Norton http://www.symantec.com/) is a long-standing reliable ant-virus corporation with an easy to navigate informative site. Trend Micro (http://www.trendmicro.com) provides an immense amount of data on the latest viruses and worms. Their products include the anti-virus program PC-cillin and InterScan software to scan incoming e-mails for viruses at the gateway. Entercept Security Technologies (http://www.entercept.com) has a server security program, Entercept that comes highly recommended. It was awarded the InfoWorld "Technology of the Year Business Impact Award". Make certain you possess a top of the line router/ firewall and please disable file sharing on all of your computers- unless you want to provide easy access to uninvited guests. Control Panel/ Network/ Configuration/ File and Print sharing- make certain both boxes are unchecked.

I know, you’re thinking I’m just a little guy of no interest to these hackers. Who do you think they practiced and honed their skills on?

Cyberstalking

The use of the Internet to harass or threaten can occur by email, in chat rooms, message boards, and discussion forums. If you are being harassed by a cyberstalker, document all contacts. Record the dates and times and save all postings, emails, etc. in hard copy and on disk. Contact the local police and file an official report. The states are cracking down on spam email and have an even bigger bite went it comes to stalking. States with Internet related stalking laws include Alabama, Alaska, Arizona, California, Connecticut, Hawaii, Illinois, New Hampshire, New York, Oklahoma, and Wyoming.

The law enforcement community closely associates cyberstalking with child pornography. This perception is based upon FBI research indicating cyberstalking was rapidly becoming one of the most prevalent techniques by which some sex offenders recruited children into sexually illicit relationships. Adult men and women, and children, with little online experience are more susceptible to falling victim to cyberstalkers.

Child Pornography Online “1995, the Federal Bureau of Investigation launched an undercover initiative, Innocent Images (http://www.fbi.gov/hq/cid/cac/innocent.htm), to combat the exploitation of children via commercial online services. Based in Calverton, Maryland, "Innocent Images" is the central operation and case management system for FBI undercover online child pornography and child sexual exploitation investigations. Since their inception in 1995, Innocent Images task forces have initiated over 5,700 investigations and have arrested and convicted over 3,000 individuals.

Practice common sense to avoid cyberstalking. If you must hang out on chat rooms and message boards don’t give out your personal email. Get a “disposable” hotmail account for those purposes. Utilize encryption methods such as Quanta Mail Encryption http://www.quantamail.com to keep your personal emails private. If you have children educate them to both the joys and the dangers of the Internet, and monitor their activity online.

Identity Theft

A New Yorker was recently selling Prudential employees’ identities online, including credit card numbers.  Arrested by an Electronic Crimes Task Force for massive identity theft, he had possession of a personnel records computer database for about 60,000 Prudential Insurance Company employees.  If convicted, he faces a maximum sentence of 45 years in prison and a $750,000 fine, and restitution to his victims. – data collected from February 28, 2002 release of the U.S. Department of Justice.

According to the F.B.I., identity theft is the fastest growing white-collar crime in the United States. And in 2001 the FTC received more than 85,000 complaints from people whose identities had been pirated away. We must be vigilant!

Don’t use debit cards online or keep their account numbers on your computer. If your credit card number is stolen built in protection typically limits your loss to $50, but with a debit card, your bank account could be completely wiped out. Some debit counts do offer additional protection, usually at a price. Check with your bank.

Never send your social security or credit card numbers in an email. Don’t fall for one of the latest scams- email requests that appear to be from your ISP stating "your account information needs to be updated" or "your credit card is invalid or expired” and they need you to reply with your card information. Call up your ISP to check it out, if they really do need the information provide it over the phone.

Never, ever give out your social security number except to your employer, banker, and of course government entities. Once an identity thief has access to your social security number then bank statements, birth certificates, credit history, addresses, your whole life on paper is easily theirs.

For additional privacy strategies visit the FTC Web site www.consumer.gov to learn how to prohibit companies from using your credit card records for direct marketing, remove your name from direct mailing and telemarketing lists, and a host of other items, which you are sure to find quite irritating.

Additional Cybercrime Resources

Computer Crime and Intellectual Property Section (CCIPS) of the criminal division of the U.S Justice Department http://www.cybercrime.gov

The Internet Fraud Complaint Center (IFCC) is a partnership between the FBI and the National White Collar Crime Center (NW3C). http://www1.ifccfbi.gov/index.asp

Internet Firewalls FAQs http://www.interhack.net/pubs/fwfaq

Macintosh Hacking http://www.secureroot.com/category/hacking/macintosh

Hangout for non-destructive hackers http://www.hackers.com

The Hacker Quarterly http://www.hackers.com

FTC Identity Theft information and resources http://www.consumer.gov/idtheft

Identity Theft help from the Social Security Administration http://www.ssa.gov/pubs/idtheft.htm

Preventing Identity Theft http://www.privacyrights.org/fs/fs17-it.htm

Cyberstalking Law http://www.safetyed.org/help/stalking/stalkusa.html

International Trademark Association http://www.inta.org

Legal Issues for Site Designers and Owners http://www.ivanhoffman.com/web.html