Module 1
Introduction to Cybercrime
[04 hours]
10-12 marks
● Cybercrime definition and origins of the world
● Cybercrime and information security
● Classifications of cybercrime
● Cybercrime and the Indian ITA 2000
● A global Perspective on cybercrimes.
Book: Ch. 1, Introduction to Cybercrime; Nina Godbole, Sunit Belapure - "Cyber
Security", Wiley India, New Delhi, 2012
1
Cyber Crime Definition
2
3
Definition
● “Cybercrime (computer crime) is any illegal behavior, directed by means of
electronic operations, that targets the security of computer systems and the data
processed by them.”
● Cybercrime, or computer-oriented crime, is a crime that involves a computer and
a network. ---------------------- Wikipedia
4
Definition
● Alternately Cyber crime can be defined as:
○ Any illegal act where a special knowledge of computer technology is
essential for its perpetration, investigation or prosecution
○ Any traditional crime that has acquired a new dimension or order of
magnitude through the aid of a computer, and abuses that have come into
being because of computers
○ Any financial dishonesty that takes place in a computer environment.
○ Any threats to the computer itself, such as theft of hardware or software,
sabotage and demands for ransom
5
Where does
cyber crime
come from
???????
6
Origin of Cybercrime
7
Origin of Cybercrime
Captain Crunch & WozMan
1971 – John Draper was a former U.S. Air Force electronics technician, a part of an
underground culture of phone “phreaks.” They were early hackers who played certain
tones through their phones to bypass telephone systems and place free long-distance
phone calls.
8
Origin of Cybercrime
Captain Crunch & WozMan
● Before Apple existed, Wozniak and Jobs formed a business together
manufacturing and selling blue boxes.
● Each blue box was sold at around $150
9
Origin of Cybercrime
Captain Zap
1981 – Ian Murphy, known as Captain Zap to his fans, was the first person convicted of
a cyber crime. He hacked into the AT&T network and changed their internal clock.
People suddenly received late-night discounts in afternoon, while midnight users were
greeted with hefty bills. He received 1,000 hours of community service and 2.5 years of
probation, and was the inspiration for the movie Sneakers.
10
Origin of Cybercrime
Captain Zap
● Murphy has dressed up as a phone-company employee and cracked a bank's
security system, aided a murder investigation, and conducted studies in airline
terrorism.
● Murphy's great love is still hacking into company security systems - with their
permission - and helping them guard against potential break-ins.
● Today Murphy, like other hackers, runs his own security company - IAM Secure
Data Systems, Inc
11
Origin of Cybercrime
Kevin Poulsen
1990 – Kevin Poulsen took over all of the telephone lines for Los Angeles radio
station KIIS-FM, guaranteeing that he would be the 102nd caller and win the prize of a
Porsche 944 S2.
● He was sentenced to 5 years, as well as banned from using computers or the
internet for 3 years after his release.
● Poulsen, Aaron Swartz, and James Dolan designed and developed SecureDrop, an
open-source software platform for secure communication between journalists and
sources.
12
Origin of Cybercrime
Kevin Mitnick
1999, Mitnick confessed to four counts of wire fraud, two counts of
computer fraud and one count of illegally intercepting a wire
communication
● He was initially forbidden to use any communications technology other than a landline
telephone. Mitnick fought this decision in court, eventually winning a ruling in his favor
● Mitnick served 5 years in prison because, according to Mitnick, law enforcement
officials convinced a judge that he had the ability to “start a nuclear war by whistling
into a pay phone”
● Mitnick now runs Mitnick Security Consulting LLC, a computer security consultancy.
13
Origin of Cybercrime
c0mrade
● At the age of 15, James hacked into several companies back in
1999 including Bell South, the Miami-Dade school system and
a little organization called the United States Department of Defense.
● He didn’t really mess much up, but did read sensitive information, including the source
code that made the International Space Station work.
● After the intrusion was detected, NASA shut down their computers for 3 weeks to
investigate
14
Origin of Cybercrime
MafiaBoy
Michael Calce launched a series of highly publicized DOS attacks
in February 2000 against large commercial websites,
including Yahoo!, [Link], [Link], Dell, eBay, and CNN.
● He also launched a series of failed simultaneous attacks against 9 of the 13 root name
servers.
● On February 7, 2000, Calce targeted Yahoo! with a project he named Rivolta, meaning
"rebellion" in Italian and shut down Yahoo! for almost an hour.
● Brought down eBay, CNN, and Amazon via DDoS
● He wrote a book, Mafiaboy: How I Cracked the Internet and Why It's Still Broken.
15
Origin of Cybercrime
Ge0H0t
George Francis Hotz , alias geohot,, is an American hacker known for
unlocking the iPhone, allowing the phone to be used with other
wireless carriers, contrary to AT&T and Apple’s intent.
● He is also noted for hacking the PlayStation 3 and subsequently
being sued by and settling with Sony.
● On October 13, 2009, at 3:20AM Hotz released blackra1n, a
jailbreak* for all iPhones and iPod Touches.
*Jailbreaking is the privilege escalation of an Apple device for the
purpose of removing software restrictions imposed by Apple on
iOS, iPadOS, tvOS, watchOS, and bridgeOS operating systems.
16
Origin of Cybercrime
Th3 Я00tk!d
The Rootkid is an ethical hacker who came to attention in Feb 2011
after attacking the websites of the Egyptian Ministry of Information
and the ruling National Democratic Party while the Egyptian revolution.
● The Rootkid shut down those websites and their local networks as a
kind of support to the Egyptian protesters and as a reply to the Egyptian government that
cut off all Internet service in country to prevent protesters to communicate.
● Penetrating more than 17000 strongly protected computers with various servers and local
networks and keeping them offline until President Hosni Mubarak stepped down.
● The Rootkid real name is still unknown, he is one of the Egyptian protesters who
participated in the Egyptian uprising, he calls himself “The artist of system
penetration“
17
C T S
FA UT
ABO RIME
E R C
CYB
18
Facts and figures
19
Facts and figures 43%
e s t i m ated of cyber
The 1 9 for rget Data br
i n 2 0 attacks ta eac
losses thcare expose hes
th e h e a l small d 4.1
s t ry w as $25 business
billion
rec
indu in the f ords
billion irst half
e rage of 2019
Th e a v
92% of
e i sa time to malwar
r
The attack ya Since
identif 019 e is
deliver COVID
c k er Apreparochx in 2 ed 19 the U
h a y 39 b i aotnetlhys
e
ev ndsr trillionas 7 m m $
by ema
il reporte S FBI
w is expec 6 increas d 300%
seco be spen ted to e in rep
t global orted
cyberse ly on cybercr
curity b imes
y 2021
20
Facts and figures
★ The cybercrime industry generated at least $1.5 trillion in revenue in 2018
★ Social media-enabled cybercrimes generate $3.25+ billion in global revenue per
year
★ Social media contributes to the sale of stolen personal data in an underground
economy that’s now worth about $630 million per year
○ This includes 45% to 50% of personal data
★ $76 billion of the cybercrime economy involve Bitcoin
○ 46% of bitcoin transactions
★ 85% of organizations reported experiencing phishing and social engineering attacks
★ Malware ranks as the most costly type of attack for organizations
[Link]
21
Facts and figures
★ An average of 300,000 cybercrime-related complaints are received each year by the
FBI IC3
22
Facts and figures
R
CYBE
IN
CRIME
INDIA
[Link]
23
Facts and figures
R
CYBE
IN
CRIME
INDIA
[Link]
24
Facts and figures
R
CYBE
IN
CRIME
INDIA
[Link]
25
Facts and figures
R
CYBE
IN
CRIME
INDIA
[Link]
26
Facts and figures
R
CYBE
IN
CRIME
INDIA
[Link]
27
Facts and figures
R
CYBE
IN
CRIME
INDIA
[Link]
28
[Link]
29
Information Security
● Cyber security means protecting information, equipment, devices, computer resource,
communication device and information stored therein from unauthorized access, use, disclosure,
disruption, modification or destruction.
● The term incorporates both the physical security of devices as well as the information stored
therein.
● Financial Losses due to insider crimes
● Corporate data get stolen/lost.
30
Information Security in Cybercrime
★ Network protection
○ Detecting and protecting against outside attacks
★ Up-to-date information
○ Staying informed on how attackers and hackers are improving their efforts
★ Intelligence
○ Identifying sources of outside attacks and protecting against them
★ Applications
○ Monitoring the use of applications using anti-virus
★ Maintain Privacy
○ Keep your social media data private from strangers
31
Information Security in Cybercrime
Network Security is worried about what is going on within the castle walls, cyber
security is watching who is trying to pass through the gate.
Cybersecurity is much more concerned with threats from outside world.
32
Information Security in Cybercrime
Data
Reply
33
Information Security in Cybercrime
Data Reply
Data
Reply
Man In the Middle attack (MITM)
34
⚫ [Link]
ca_esv=c50aef8422a1bcf8&sca_upv=1&biw=1360&bih=607&tbm=v
id&sxsrf=ADLYWIKLwSLCUBFszbO7ftANZ3bvgIaklw%3A172179
4151080&ei=Z36gZqLKBNaNseMP3fqhuA4&oq=cyber+crime+ani
&gs_lp=Eg1nd3Mtd2l6LXZpZGVvIg9jeWJlciBjcmltZSBhbmkqAggB
MgsQABiABBiRAhiKBTIFEAAYgAQyBhAAGBYYHjILEAAYgAQYh
gMYigUyCxAAGIAEGIYDGIoFMgsQABiABBiGAxiKBTILEAAYgA
QYhgMYigUyCBAAGIAEGKIESKMyUJUIWPYicAB4AJABAJgBlwGg
AYcFqgEDMC41uAEByAEA-AEBmAIFoALPBcICBBAjGCfCAgoQA
BiABBgCGMsBwgILEAAYgAQYsQMYgwHCAg4QABiABBixAxiDA
RiKBcICCBAAGIAEGMsBmAMAiAYBkgcDMC41oAf_Iw&sclient=g
ws-wiz-video#fpstate=ive&vld=cid:68c3b5c4,vid:R6swtAUKzws,st:0
35
Module 1
Introduction to Cybercrime
[04 hours]
10-12 marks
● Cybercrime definition and origins of the world
● Cybercrime and information security
● Classifications of cybercrime
● Cybercrime and the Indian ITA 2000
● A global Perspective on cybercrimes.
Book: Ch. 1, Introduction to Cybercrime; Nina Godbole, Sunit Belapure - "Cyber
Security", Wiley India, New Delhi, 2012
36
Case Study
37
Case Study
● A military graded spyware licenced by ISARELI NSO group is used
● Forbidden stories and Amnestry international accessed a database containing 50000
smartphone numbers and shared with other news agencies
● This investigation is known as ‘Pegasus Project’
● Verified 67 smartphones
○ 23 attack confirm
○ 14 attempted penetration
○ 30 inconclusive
38
Case Study
● Indian scenario
○ 300 phone numbers of Indian journalist and political leaders
■ 40 journalists,
■ 3 major opposition figures
■ 1 constitutional authority
■ 2 serving ministers in current central ruling government
■ Current and former heads and officials of security organizations
■ Scores of business persons
○ Forensic test concluded that out of 37 phones clearly targeted, 10 belonged to
India
39
Classification
Of
Cybercrime
40
Classification Cybercrime
Individuals
Cybercrime
Property
against
Society
Organization
41
Classification Cybercrime Individuals
● Electronic mail spoofing and other online frauds
● Phishing Cybercrime
● Spamming against
● Cyberdefamation
● Cyberstalking and harassment
● Computer sabotage
● Pornographic offenses
● Password sniffing
42
43
Phishing
● Phishing is a cyberthreat in which scammers try to lure
sensitive information or data from you by disguising
themselves as a trustworthy source.
● They do this using a variety of communication methods,
including email, Google Chat, text messages, phone
calls, and more.
● No matter which method scammers use, they want your
personal information so that they can use it to access
your bank accounts or credit cards.
44
45
Spamming
⚫ Sending a large amount of restricted
electronic messages is illegal.
⚫ People who create or send electronic
spam are called spammers.
⚫ Spamming is an abuse of electronic
messaging systems for sending restricted
bulk messages using a computer or a
cellular phone.
⚫ The most popular form of spam is E-mail
Spam. Email spam is annoying and
dangerous to email users depending on
the intention of the sender.
46
● Cyberstalking
Phishing
● Cyberdefamation Password sniffing
Pornographic offenses
47
Classification Cybercrime
● Credit card Frauds
● Intellectual property (IP) crimes Cybercrime Property
● Internet time theft against
48
Classification Cybercrime
● Unauthorized accessing of computer Cybercrime
against
● Password sniffing
● Denial-of-service attacks
● Virus attack/dissemination of viruses Organization
● E-Mail bombing/mail bombs
● Salami attack/ Salami technique
● Logic bomb
● Trojan Horse
● Data diddling
● Industrial spying/ industrial espionage
● Computer network intrusions
● Software piracy
49
Salami attacks
● A Cybercriminals steal money or
resources from financial accounts on a
system one at a time.
● This attack occurs when several minor
attacks combine to create a sturdy attack.
because of this sort of cybercrime, these
attacks frequently go undetected.
● Salami attacks are used for the
commission of economic crimes
50
Trojan Horse
● A Trojan Horse (Trojan) is a type ● Downloading pirated media, including music,
of malware that disguises itself as legitimate video games, movies, books, software or paid
code or software. content
● Once inside the network, attackers are able ● Downloading any unsolicited material, such as
to carry out any action that a legitimate user attachments, photos or documents, even from
could perform, such as exporting files, familiar sources
modifying data, deleting files or otherwise ● Accepting or allowing a pop-up notification
altering the contents of the device. without reading the message or understanding
● Trojans may be packaged in downloads for the content
games, tools, apps or even software patches. ● Failing to read the user agreement when
● Many Trojan attacks also leverage social downloading legitimate applications or
engineering tactics, as well software
as spoofing and phishing, to prompt the ● Failing to stay current with updates and
desired action in the user. patches for browsers, the OS, applications and
software
51
Denial-of-service attacks
● A Denial-of-Service (DoS) attack is an attack meant to shut down a
machine or network, making it inaccessible to its intended users. DoS
attacks accomplish this by flooding the target with traffic, or sending it
information that triggers a crash.
● target web servers of high-profile organizations such as banking,
commerce, and media companies, or government and trade organizations.
52
Software piracy
● Software piracy can be defined as the use of software that is not
properly licensed.
● That might include copying, modifying, distributing or selling
the software in ways that contravene copyright laws or license
terms.
53
Classification Cybercrime Cybercrime
● Forgery
against
● Cyberterrorism
● Web jacking
● Online Gambling Society
● Cyber trafficking
[Link]
true-story-abdul-karim-telgi-from-fruit-vendor-to-master
[Link]
54
Cyber terrorism
▪ cyber attack using or exploiting computer or
communication networks to cause sufficient
destruction or disruption to generate fear or to
intimidate a society into an ideological goal".
● It aims at seriously affecting information
systems of private companies and government
ministries and agencies by gaining illegal access
to their computer networks and destroying data.
55
Classification Cybercrime
● *Usenet groups may carry very offensive, Usenet
harmful, inaccurate material newsgroup
● Postings that have been mislabeled or are deceptive Cybercrime
in another way against
● Hence service at your own risk
*Usenet is collection of online discussions that are organized into
newsgroups.
56
India has the fourth highest number of Internet users in the world.
57
Indian IT act
★ Proposed by the Indian Parliament reported on 17th October 2000.
★ Based on the United Nations Model law on Electronic Commerce 1996
(UNCITRAL Model) which was suggested by the General Assembly of United
Nations by a resolution dated on 30th January, 1997
★ objective of this act is to carry lawful and trustworthy electronic, digital and online
transactions and alleviate or reduce cybercrimes
★ The IT Act has 13 chapters and 90 sections
★ The last four sections that starts from ‘section 91 – section 94’, deals with the
revisions to the Indian Penal Code 1860.
58
● The IT Act, 2000 has two schedules:
● First Schedule –
Deals with documents to which the Act shall
not apply.
● Second Schedule –
Deals with electronic signature or electronic
authentication method.
59
The offences and the punishments in IT Act 2000
:●● Tampering with the computer source documents.
Directions of Controller to a subscriber to extend facilities to decrypt information.
● Publishing of information which is obscene in electronic form.
● Penalty for breach of confidentiality and privacy.
● Hacking for malicious purposes.
● Penalty for publishing Digital Signature Certificate false in certain particulars.
● Penalty for misrepresentation.
● Confiscation.
● Power to investigate offences.
● Protected System.
● Penalties for confiscation not to interfere with other punishments.
● Act to apply for offence or contravention committed outside India.
● Publication for fraud purposes.
● Power of Controller to give directions.
60
Indian IT act
● Tampering with the computer source documents.
● Directions of Controller to a subscriber to extend facilities to decrypt information.
● Publishing of information which is obscene in electronic form.
● Penalty for breach of confidentiality and privacy.
● Hacking for malicious purposes.
● Penalty for publishing Digital Signature Certificate false in certain particulars.
● Penalty for misrepresentation.
61
Indian IT act
● Confiscation.
● Power to investigate offences.
● Protected System.
● Penalties for confiscation not to interfere with other punishments.
● Act to apply for offence or contravention committed outside India.
● Publication for fraud purposes.
● Power of Controller to give directions.
62
SECTION PUNISHMENT
● Section 43 ● This section of IT Act, 2000 states that any act of destroying,
altering or stealing computer system/network or deleting
data with malicious intentions without authorization from
owner of the computer is liable for the payment to be made
to owner as compensation for damages
● Section 43A ● This section of IT Act, 2000 states that any corporate body
dealing with sensitive information that fails to implement
reasonable security practices causing loss of other person will
also liable as convict for compensation to the affected party.
63
● Section 66 ● Hacking of a Computer System with malicious intentions like fraud will
be punished with 3 years imprisonment or the fine of Rs.5,00,000 or
both.
● Section 66
B, C, D ● Fraud or dishonesty using or transmitting information or identity theft
is punishable with 3 years imprisonment or Rs. 1,00,000 fine or both
● Section 66 E ● This Section is for Violation of privacy by transmitting image of private
area is punishable with 3 years imprisonment or 2,00,000 fine or both
● Section 66 F
● This Section is on Cyber Terrorism affecting unity, integrity, security,
sovereignty of India through digital medium is liable for life
imprisonment.
64
A global Perspective on cybercrimes
● Cyber security constitutes one of the top five risks of most
firms, especially in Big Tech and Banking & Financial
Services
● Global cybercrime damage costs this year are expected to
breach US $6 trillion an annum. That is almost one-fourth of
the US GDP or twice the GDP of India. This is expected to
scale up to US $10.5 trillion an annum by 2025
● While digital transformation, move to cashless transactions
and zero contact communication supported with
proliferation in internet and mobile phone usage, cyber risks
in India have risen exponentially during the pandemic
65
● According to the annual IBM X-Force Threat Intelligence Index,
India reported the second-highest number of cyber-attacks after
Japan in the Asia-Pacific region in 2020, accounting for 7 percent of
all cyber-attacks observed in Asia in 2020.
● German cybersecurity firm, Greenbone Sustainable Resilience,
reported that medical records of over 120 million Indian
patients (mostly from Maharashtra and Karnataka) were leaked on
the Internet. The leaked records included pictures of the patients,
X-rays, CT scans and MRIs.
66
● Maximum number of cyber-attacks on official Indian
websites are from China, US and Russia.
● Cybercrime accounts for more than 50% of all crimes in
the UK (National Crime Agency).
● Malicious hackers are now attacking computers and
networks at a rate of one attack every 39 seconds
(University of Maryland).
● 78% of the surveyed organization's were affected by a
successful cyberattack in 2018.
67
● American companies are targeted for trade
secrets and other sensitive corporate data, and
universities for their cutting-edge research and
development.
● Cybercrime is on the rise in America with
more than 143 million Americans affected by
cybercrime in 2017
68
Fact
The seal gifted by school children
in 1946
to the then US ambassador
Averell Harriman
actually was a bug
and
was used by Soviet to spy
the activities of US
for
7 years
69
Summary:
● Cybercrime definition
● origins of the world
● A global Perspective on cybercrimes.
● Cybercrime and information security
● Classifications of cybercrime
● Cybercrime and the Indian ITA 2000
70