Cyber crime is not in isolation

You may find that in many cases the Hacker, Cyber Criminal or whatever you want to call them is not just acting via the web they are very often involved in 'real world' crimes too without sometimes realising it, or the information they gained is involved in other crimes i.e. ID fraud will be carried out over the web sometimes but the same ID will be sold to another and that person may well use it for buying physical items on the web which then are sold in Bars etc.

Card cloning is another problem and then the information is transferred from one magnetic strip to another. I have seen staff in organisations transfer money electronically to fund terrorism, to facilitate the purchase of properties to house people who were trafficked illegally.

Cyber crime is popular with organised crime as those who carry out the crimes do it and view it as a victimless crime so it is easy to recruit people to do it or blackmail normally honest people into comitting the cyber crime, which I have seen. A cyber criminal most of the time would not break into a house to steal anything or mug an old lady because they would have to encounter the victim, but via computer they will empty that same old ladies bank account without a second thought or facilitate the illegal purchase of a house to be used as a brothel for trafficked women. The only difference is the cyber criminal does not have to face the victim so their conscience is clear, all they did was sit behind a computer and tap a few keys.

How to hack important things

I once heard of a guy who succeeded in hacking the computers of the pentagon. He had hacked the computer of a university, which was doing research for a company that was doing something for something else and so one. But al they all worked on a project which was ordered by the pentagon so the guy managed to break in in the computers of the pentagon via the companies that worked on that project.

Self-advertising vulnerable machines, passive scanning

When a machine has a vulnerable service exposed to the Net, it can be (and usually is) scanned for that and then infected. The worm then usually uses the machine as an attack base for scanning more machines and spreading itself exponentially.

By doing the probes, it advertises its presence - and also its vulnerability. Merely by listening to the probes on my firewall, I can make myself an up to date database of easy-to-compromise hosts for case of need. Then, when a proxy or other service needs to be used, look up the logs and pick a suitable victim for a temporary hijack. Passive way, minimizing chance of being detected.

Passive methods are the best for routine use. No broadcasting what you're doing, just listening. And knowing.

Deactivation of your Email Address

Should I reply?

from Administrator <admin@mailsupport.com>
reply-to activate-emailonline@aggies.com
to
date 29 October 2009 14:13
subject Deactivation of your Email Address

THIS MESSAGE IS FROM OUR TECHNICAL SUPPORT TEAM This message is sent
automatically by the computer.
If you are receiving this message it means that your email address has
been queued for deactivation; this was as a result of a continuous error
script (code:505)received from this email address. To resolve this problem
you must reset your email address. In order to reset this email address,
you must reply to this e-mail by providing us the following Information
for confirmation.

Current Email User Name : { }
Current Email Password : { }
Re-confirm Password: { }

Note: Providing a wrong information or ignoring this message will resolve
to the deactivation of This Email Address.

You will continue to receive this warning message periodically till your
email address is been reset or deactivated.resolve

Tracking down an anonymous email

Some time ago, a coworker got a problem. Her SO was getting anonymous emails from a webmail account, intended to make him question their relationship. He told her. She had a suspicion at her office colleague. And called me to investigate.

The webmail conserved the sender IP in the mail headers. Good. We traced the IP down to another place, a wireless ISP in a mid-sized town. The colleague was proved innocent.

It turned out that the place was her hometown. That led to a hypothesis that the sender is somebody she knows; underlined by what the sender knew and wrote to the mails.

We took her personal mail account, and went through the mail headers, one by one, looking for the IP to match. And after a while, we found a mail from her friend, another woman from that town, with a matching sender IP.

She openly confronted her. The other lady denied involvement. Emails stopped and never appeared again.

I did a similar thing before, on a mailinglist. There was a war between two of the list members. An email appeared, accusing one of something, attempting to ruin his reputation. As he was my friend, I took a look at the mailbox, attempted to match the IP address. And, found. The other listmember's posts from last couple days matched. (Beware of dynamic IPs on cable modems and DSL lines; they are quasi-persistent and can stay the same for days or even months.) Posted the findings on the list, attacks ceased.

Another email-related lookup was about a long-lost friend who resurfaced again. Her webmail account shown an IP address. The IP address geolocated to a large US city, the WHOIS shown a large ISP from that city. Reverse DNS lookup yielded no domain set for the IP. According to the coarse location and the zone time, the mail was likely sent from a work computer. Quick lookup with a script written for the purpose of assisting with identifying spam (an oneliner that tries a reverse lookup at the entire C-class, x.x.x.0 to x.x.x.255), and voila - in the sea of empty responses there was one mx.companyname.tld - a mailserver, just a few numbers from that one IP. (Mailservers have to have their reverse domain name set. Not doing so leads to a lot of spamfiltering.) Hypothesis: company having leased a small block of addresses, running own mailserver. A quick look at the company website, and from its parts not indexed by a search engine a list of employees was accessed - and she was there.

Cybercrime as censorship

I used to run my own websites about various topics but there were so many hacking incidents and security holes no matter what CMS I tried that I just gave up on running a site of my own. I just couldn't stand all the backing up and fixing and worrying, so I shut my sites down.

Although they probably didn't intend it, the hackers in effect censored my sites.

This could produce some interesting storylines for a cybercrime series, if it featured hack attacks where the censorship WAS intended. It would provide a motivation for cybercrime other than money.

Hacking laptop (and BIOS in general) passwords

Sometimes a laptop appears that gets bought cheaply or acquired in a similar way that has a BIOS password set, which needs to be removed.

The BIOS configuration data are usually hidden in a small EEPROM chip. Which usually looks like a 8-pin SMD part, with 24C... or 93C... labeling. Common part, with available datasheets. Usually with I2C bus.

The clock and data lines can be tapped by soldering thin wires on the chip's pins. The activity on them can be sensed by a 'scope, an I2C bus analyzer, or even a plain old LED. By grounding the lines, the reading of the chip can be disabled at the right moment. Depending on the BIOS, it is possible to force it to think the machine just went down from the assembly line and should initialize to defaults, or just force zeros to the bus when reading the password, making the BIOS think it has zero length. The bus behavior can be observed and further guessed by trial and error while watching the bus activity; a scope is useful here, a LED can be sufficient.

Alternatively, the chip can be desoldered, read, written, soldered back. Or just the traffic from the chip can be monitored, and the password decoded from it.

When only the BIOS setup password is set, it is possible to use debug.exe (or linux eeprom tools) to directly set some bytes in the EEPROM to wrong values. At next boot, the BIOS checksum fails and defaults are set.

This applies generally to many things using I2C bus and configuration EEPROMs. Closeup shots at a technician deftly soldering thin shiny wires on tiny chip pins could look nice in a movie. Other attractive-looking things may be waveforms on an oscilloscope, or some sort of color-highlighted scrolling logs or decoded bus traffic. Chipping of devices, from game consoles to DVD players, also often requires direct access to the hardware on component level.

For a sample of oscilloscope screenshots with videosignal, check out this:
http://en.wikipedia.org/wiki/Analogue_television_synchronization
(Especially with CRT-based scopes, adjusting the brightness and ambient light to look good on camera may take a while of experimenting.)

A young, unemployed technician who desperately needs money often won't ask many questions before whipping out the soldering iron.

...after gaining access, said technician may poke around the hard drive, find something of value (confidential data, or saved access passwords to websites or a VPN...), attempt to extract the value, and set off an unexpected avalanche of events. (The same can be done with data found on a purchased non-wiped or poorly-wiped secondhand disk/machine, or as a breach of trust when said technician is hired to do data recovery.)

Worms knowing the passwords

I got one of the sites in my care hacked. The index page was changed, an iframe linking to a third party server hosting some exploits was inserted.

Examination of the logs shown a login via FTP, download of the file and immediate reupload. That was done couple more times, from vastly different locations, over a period of few weeks. There were no signs of bruteforcing, and the password was reasonably strong.

The hypothesis is that the computer of the person responsible for the site content was wormed, the worm took hold of the site/username/password saved there, and then told its brothers in the botnet.

Worm

Once, the network on my company got infected by a kind of worm that somehow transmitting and downloading something (likely virus or spyware) from the net. The only way we can be sure that it will not transmit confidential data is by unplugging the modem cable. Takes about two weeks before there are tutorials on how to remove it.