MODULE 6.

INVESTIGATION OF CYBERCRIME

Learning Objectives and Outcomes:

After the completion of the chapter, students will be able to:
1. identify the different modes of detecting cybercrimes;
2. explain how to prevent cybercrimes; and
3. analyze the countermeasures against cybercrimes

I. CYBER ORGANIZED CRIME

Cyber organized criminals have engaged in a variety of cybercrimes, including fraud,
hacking, malware creation and distribution, DDoS attacks, blackmail, and intellectual
property crime, such as the sale of counterfeit or falsified trademarked products
(e.g., apparel, accessories, shoes, electronics, medical products, automobile parts,
etc.) and the labels, packages, and any other identifying designs of these products
(Albanese, 2018; Europol, 2018; Broadhurst et al., 2018; Maras, 2016). These types of
cybercrimes cause financial, psychological, economic, and even physical harm
(especially counterfeit electronics and automobile parts, as well as falsified medical
products, defined by the World Health Organization as "deliberately/fraudulently
misrepresent their identity, composition or source," see WHO, 2017), and have been
used to fund other forms of serious crime, such as terrorism (Binder, 2016).

Criminal groups that engage in cyber organized crime also provide services that
facilitate crimes and cybercrimes (crime as a service), such as data and identity
documents (e.g., financial and health data, passports, voter registration
identifications); malware (i.e., made to order or known malware - e.g., Zeus, a
banking Trojan, designed to surreptitiously capture users' banking details and other
information needed to log in to online accounts); distributed denial of service (DDoS)
attacks and botnet services; keyloggers; phishing/spearphishing tools; hacking
tutorials; and information about vulnerabilities and exploits and instructions on how
to take advantage of these (Broadhurst et al., 2018; Maras, 2016). For instance, the
Shadowcrew, "an international organization of approximately 4,000 members
promoted and facilitated a wide variety of criminal activities [online] including,
among others, electronic theft of personal identifying information, credit card and
debit card fraud, and the production and sale of false identification documents"
(United States v. Mantovani et al., criminal indictment, 2014).

Organized criminal groups have also profited and/or otherwise benefited from illicit
products and services offered online. For example, the creator of the Butterfly Bot
advertised this malware online as capable of taking control of Windows and Linux
computers (BBC News, 2013). The creator of the Butterfly Bot also sold plug-ins that
modified the functions of the malware, and also offered to create customized
 versions of the malware for paying customers (FBI, 2010). Various online criminal
networks deployed the Butterfly Bot, the largest application of this malware resulted
in the Mariposa botnet, which infected 12.7 million computers around the world (BBC
News, 2013).
II. MODES OF DETECTION
1. Penetration Testing is used to find any security weaknesses in a system. It is the process
of attempting to gain access to resources without knowledge of usernames, passwords
and other normal means of access.

Penetration testing is also called pen testing or ethical hacking, is the practice of
testing a computer system, network or web application to find security vulnerabilities
that a hacker could exploit.
Penetration testing can be automated with software applications or performed
manually.

The strategy is to:

a) Gather information about the target of possible attacks.
b) Identify possible entry points.
c) Attempt to break in.
d) Report back the findings.

2. Black-box Penetration Test

 The aim of black-box penetration testing is to simulate an external hacking or
cyber warfare attack.
 Testers are given very little or no information about the network prior to the
test. The test could target email servers, web servers or firewalls.
The objective is to find out:
a) Whether a hacker can get in.
b) How far they can get.
c) What they can do on the system.

3. White-box Penetration Test

 The aim of white-box penetration testing is to simulate a malicious insider
who has knowledge of and possibly basic credentials for the target system.
 Testers are given basic information about the network in advance of the
testing. This could include IP addresses, network protocols and even
passwords.
 It puts the tester in the position of an insider, to determine how much damage
a disgruntled or dishonest employee could cause.
III. DIGITAL FORENSIC
 Digital forensic science is a branch of forensic science that focuses on the recovery
and investigation of material found in digital devices related to cybercrime. The term
digital forensics was first used as a synonym for computer forensics. Since then, it has
expanded to cover the investigation of any devices that can store digital data.
Digital forensics is the process of identifying, preserving, analyzing, and documenting
digital evidence. This is done in order to present evidence in a court of law when
required.
IV. DIGITAL EVIDENCE; COLLECTION AND PRESERVATION
Steps of Digital Forensics

1. Identification
First, find the evidence, noting where it is stored.
2. Collection, in which digital evidence is acquired. This often involves seizing physical
assets, like computers, phones or hard drives; care must be taken to ensure that no
data is damaged or lost. Storage media may be copied or imaged at this stage in
order to keep the original in a pristine state for reference.
3. Preservation
Next, isolate, secure, and preserve the data. This includes preventing people from
possibly tampering with the evidence.
4. Examination, in which various methods are used to identify and extract data. This
step can be divided into preparation, extraction and identification. Important
decisions to make at this stage are whether to deal with a system that's live (for
instance, to power up a seized laptop) or dead (for instance, connecting a seized
hard drive to a lab computer). Identification means determining whether individual
pieces of data are relevant to the case at hand — particularly when warrants are
involved, the information examiners are allowed to learn may be limited.
5. Analysis, in which the data that's been gathered is used to prove (or disprove) the
case being built by examiners. For each relevant data item, examiners will answer the
basic questions about it — who created it? who edited it? how was it created? when
did this all happen? — and attempt to determine how it relates to the case.
This is to reconstruct fragments of data and draw conclusions based on the evidence
found.
6. Documentation
Following that, create a record of all the data to recreate the crime scene.
7. Reporting, in which the data and analysis are synthesized into a format that can be
understood by laypeople. Being able to create such reports is an absolutely crucial
skill for anyone interested in digital forensics.
8. Presentation
Lastly, summarize and draw a conclusion.
Digital Forensic Video
[Link]