TUTORIAL 3
SOLUTIONS
[Link] cybercrime-as-a-service.
ANS: Cybercrime-as-a-service refers to a business model where cybercriminals offer
tools, infrastructure, or services (such as malware, phishing kits, or botnets) to others
for a fee, lowering the technical skill required to carry out cyberattacks.
[Link] how cybercriminals typically monetize their attacks.
ANS: Cybercriminals monetize attacks by converting stolen data, access, or disruption
into financial gain—commonly through ransom payments, selling stolen information,
committing fraud, or exploiting compromised systems for further attacks.
[Link] the concept of cybercrime-as-a-service to illustrate common monetization
models used by cybercriminals.
ANS: In a CaaS model, developers create ransomware and lease it to affiliates, who
launch attacks and share ransom profits (ransomware-as-a-service). Similarly,
phishing-as-a-service providers sell ready-made phishing kits, earning money from
subscriptions, while buyers profit by stealing credentials and selling them on
underground markets. Botnet operators may rent infected machines to others for spam
campaigns or DDoS attacks, generating income through service fees.
2a List different methods used by cybercriminals to gain unauthorized access to
systems.
ANS: Phishing and social engineering
• Password cracking / credential theft
• Malware (trojans, spyware, keyloggers)
• Exploiting software vulnerabilities
• Brute-force attacks
b. Explain various tools and techniques used for unauthorized access in cyber attacks.
ANS: Cybercriminals use tools like password crackers (e.g., brute-force tools), keyloggers
to capture credentials, malware to create backdoors, and vulnerability scanners to identify
weaknesses. Techniques such as phishing trick users into revealing login details, while
exploit kits take advantage of unpatched software.
c. Apply suitable access techniques to demonstrate how attackers compromise a
vulnerable network.
ANS: An attacker may first scan a network using vulnerability-scanning tools to identify
open ports and outdated services. Next, they exploit a known vulnerability (such as an
unpatched server) to gain initial access. Once inside, the attacker may use stolen
credentials or privilege-escalation techniques to gain higher-level access and control the
network.
3a. a. List common types of malware used in cybercrime.
ANS: Virus
• Worm
• Trojan horse
• Ransomware
• Spyware
• Adware
b. Explain the differences between various types of malware and their purposes.
ANS: Different malware types serve different goals: viruses attach to legitimate files to
spread and damage data, worms self-propagate across networks, trojans disguise
themselves as legitimate software to create backdoors, ransomware encrypts data to
demand payment, and spyware secretly collects user information.
c. Analyze how different malware types impact systems and networks.
ANS: Viruses and trojans can corrupt files, degrade system performance, and allow
unauthorized access, leading to data loss and system instability. Worms spread rapidly
across networks, consuming bandwidth and causing large-scale outages. Ransomware
disrupts business operations by locking critical data and services, often causing financial
and reputational damage. Spyware compromises confidentiality by leaking sensitive
information, which can then be exploited for identity theft or further cyberattacks.
4a. List methods used by law enforcement agencies to track cybercriminals.
ANS: Digital forensics and log analysis
• IP address and network traffic tracing
• Monitoring online forums and dark web markets
• Undercover cyber operations
• International information sharing
b. Explain techniques used to disrupt cybercriminal activities.
ANS: Law enforcement disrupts cybercriminal activities by taking down malicious servers
and websites, seizing command-and-control infrastructure, freezing illicit financial
accounts, arresting key operators, and collaborating with ISPs and cybersecurity firms to
block or dismantle criminal networks.
c. Apply law enforcement strategies to handle a cybercrime investigation scenario.
ANS: In a cybercrime investigation, law enforcement first preserves digital evidence
through forensic imaging of affected systems. They analyze logs and network traffic to trace
the source of the attack, often identifying servers or accounts used by the attacker.
Authorities then coordinate with ISPs and international agencies to seize infrastructure,
track financial transactions, and identify suspects, leading to arrests and prosecution.
5a. List preventive measures against cybercrime.
ANS: Strong passwords and multi-factor authentication
• Regular software updates and patching
• Use of antivirus and firewalls
• User awareness and training
• Regular data backups
b. Explain legal remedies available to cybercrime victims in India.
ANS: In India, cybercrime victims can seek legal remedies under the Information
Technology (IT) Act, 2000, which provides penalties for offenses such as hacking, identity
theft, and data theft. Victims can file complaints with cybercrime cells, report incidents on
the national cybercrime portal, and seek compensation through adjudicating authorities or
courts.
c. Apply basic cyber safety measures to protect individuals or organizations from
common cyber threats.
ANS: Individuals and organizations can protect themselves by using strong, unique
passwords and enabling multi-factor authentication to prevent unauthorized access.
Installing updated antivirus software and firewalls helps detect and block malware, while
regular data backups ensure recovery from ransomware attacks. Training users to identify
phishing emails further reduces the risk of social engineering attacks.
6a Define international cooperation in cybercrime investigation.
ANS: International cooperation in cybercrime investigation refers to collaboration between
countries to share information, evidence, expertise, and legal assistance in order to detect,
investigate, and prosecute cybercrimes that cross national borders.
b. Explain the role of Indian government and legal system in international cybercrime
cases.
ANS: The Indian government and legal system address international cybercrime through
laws such as the Information Technology Act, 2000, mutual legal assistance treaties
(MLATs), and cooperation with international agencies like INTERPOL. Indian cybercrime
cells coordinate with foreign law-enforcement agencies to exchange evidence, trace
offenders, and support extradition or prosecution processes.
c. Analyze the importance of global collaboration in controlling cybercrime.
ANS: Cybercrime is inherently borderless, with attackers, victims, and infrastructure often
located in different countries. Global collaboration enables timely sharing of intelligence,
faster evidence collection, and coordinated takedown of criminal networks. It also helps
harmonize laws, reduce safe havens for cybercriminals, and strengthen collective cyber
defenses, making international cooperation essential for effectively controlling and
reducing cybercrime worldwide.
B22CN054