Hunting Cybercrooks
The cybersleuths who helped smoke out some of the biggest crooks online can be as reclusive as their prey.
Tucked inside an inconspicuous office in a business park on the banks of the Monongahela River, two dozen employees of the National Cyber-Forensics & Training Alliance quietly peck away at PCs in small cubicles. Here, the nation's cyberequivalent of CSI relies on a computer lab that simulates Internet attacks and diagnostic tools that extract clues from tainted PCs and suspicious Web sites. Yet few people are aware of the non-profit group.
"I chuckle whenever people complain nothing is being done to stop cybercrime," says investigator Sarah Patrick, who -- like a dozen other college students -- monitors Web sites and chat rooms from a desktop computer in a small, unadorned cubicle. "What have I been doing the past nine months?"
That was abundantly clear in August, when a Justice Department sting led to 160 arrests, including dozens of spammers and online fraudsters. Key evidence came from NCFTA, whose discoveries could fetch more arrests. "We're at the start -- not the end -- of a major crackdown on digital crime," FBI Special Agent Tom Grasso says. As consumer losses to online fraud mount, the FBI has identified cybercrime as one of its top priorities, behind terrorism and counterintelligence.
Lab work
The rugged mountains of western Pennsylvania seem more suited for deer hunting than for hunting the Internet's most-wanted criminals.
But Pittsburgh is considered a digital epicenter by federal officials. It is also home to Carnegie Mellon University's CERT Coordination Center and near the FBI's Internet Crime Complaint Center (IC3) and finger-printing facility, both in West Virginia.
NCFTA was established in 2002 as an extension of the Pittsburgh High Tech Crimes Task Force, a team of federal, state and local law enforcement officials. The federal government, private industry and academia underwrite NCFTA's annual budget of about $750,000. Microsoft recently donated $46,000 in software and lent an analyst, Liz Christopher.
Security experts compare NCFTA to a teaching hospital, where cases are treated and employees share research and training. NCFTA, they say, could be the template for how tech companies work with government agencies to tackle cybercrime. "It's a spectacular idea to have the learning take place in the context of real-world cases," says Alan Paller, director of SANS Institute, an Internet security think tank and training center.
The NCFTA's deathly quiet office resembles a college study hall or a library more than it does a bustling hospital. Analysts methodically peck away at PCs, looking for leads in areas in which they specialize. What they find they share with other analysts and law enforcement officials who also work in the office.
Patrick, for example, scours Russian Web sites to follow the exploits of organized crime groups. She routinely engages in online chats for clues.
She says online misdeeds are soaring there because the post-Soviet Union lacks civil and criminal code, the area is economically depressed, and there is a high degree of engineering talent among the young, who view the Internet as an ideal vehicle for stealing.
"There is a cultural mind-set that it's OK to gouge rich Americans," says Patrick, a University of Pittsburgh graduate student who in August presented a paper on Internet crime in Russia.
Behind Patrick, a private room with five workstations is home to a lab, where another investigator sifts through the computer hard drives and disks of a suspected spammer. Special software lets investigators view files, e-mail and Web searches -- including those deleted -- on a hard drive. The cybersleuths also sift through criminal files and the IC3 database of criminal activity to spot links between suspected spammers and crooks.
Digital evidence is shared among a coterie of NCFTA partners -- the FBI, the National White Collar Crime Center, Carnegie Mellon, West Virginia University, Microsoft and others -- to understand who is behind digital attacks and track them down. "As much as we've been trained in cybercrime, the reality is we need the tech industry's expertise to target the bad guys," says Dan Larkin, unit chief of IC3 and founder of NCFTA. Larkin recently barnstormed Silicon Valley to recruit tech companies as partners.
"We have a lot of resources law enforcement doesn't. We're on the front line," says Stirling McBride, senior investigator in Microsoft's digital-integrity group, which shares information with NCFTA. "We have trap (e-mail) accounts set up to identify spammers. We collect data (spam) they need to present a case."
When Microsoft, America Online and others develop cases, rather than try to find law-enforcement interested in them -- as they sometimes did before -- they hand information to NCFTA. It, in turn, goes to the proper law-enforcement agency to build a case and pursue charges.
During Justice's recent investigation, the NCFTA discovered through industry experts that hundreds of powerful computers at the Defense Department and U.S. Senate were hijacked by hackers, who used them to send spam e-mail. It is unclear how long the computers were compromised or how much spam was sent, investigators say. Authorities are in the process of repairing the computers.
Investigators also came across new spam and phishing schemes that incorporate digital images to deceive consumers and elude computer defenses. Phishing scams use e-mail to trick consumers into surrendering personal information on bogus Web sites.
Christopher, the Microsoft investigator lent to the NCFTA, concentrates on passing phishing-related data from Microsoft. "We see her as a conduit to get information from Microsoft," Grasso says.
A tough task
Although federal authorities have made strides in digital gumshoeing, they are more accustomed to chasing bank robbers than computer nerds. Hunting high-tech high jinks requires extensive training and a new crime-fighting approach, admits Bruce Townsend, who coordinates cybercrime investigations for the U.S. Secret Service.
Complicating matters, the few computer crime laws on the books are poorly written and a Bush administration strategy on cybersecurity lacks government regulations and funding, critics say. Historically, private sector-government partnerships sputter and have little impact. There can be jurisdictional snags with foreign governments when trying to extradite suspects, many of whom strike with impunity from Europe and Asia. Spammers, for example, increasingly are establishing operations in China and South Korea, security experts say.
The challenge can be as daunting as getting President Bush and Sen. John Kerry to share a podium in Ohio to swap Vietnam War stories. Tech companies are loath to share sensitive information with anyone, and investigators are reluctant to have companies wade into law-enforcement matters. "Many companies don't have the know-how or resources to investigate, and the cops don't have the expertise," says John Frazzini, a former Secret Service agent who now is a computer-security consultant.
By necessity, authorities often rely on old-fashioned crime-fighting methods besides cyberforensics. Private investigators at Microsoft and AOL supply information to cops.
And, if all else fails, authorities offer cash rewards. Microsoft last year created a $5 million reward fund for information leading to the arrest and conviction of writers of viruses and worms. A $250,000 slice of the fund led to the May arrest of Sven Jaschan, a German teenager who confessed to writing the Sasser and Netsky worms, which infected millions of computers worldwide this year.
Still, the crime-busting exploits of NCFTA and others are an encouraging start, says Howard Schmidt, chief information security officer at eBay, which has shared information with NCFTA.
"The problem is nearly overwhelming," says U.S. Rep. Mac Thornberry, R-Texas, chairman of the cybersecurity subcommittee of the Select Committee on Homeland Security. But groups such as NCFTA are "good and reasonable efforts."
Article By: Jon Swartz, USA TODAY
http://www.usatoday.com/educate/college/careers/news15.htm
File a complaint today:
http://www.ic3.gov/complaint/
means to this end, and we focus on the standards that will help actual, real-world interoperability the most. As a consumer and a developer, I expect stuff to just work, and I also expect backwards compatibility. When I get a new version of my current browser, I expect all the sites that worked before will still work.