UAB Open Source Intelligence Project against Cybercrime (OSIPACC)

When someone places hostile computer code on a computer and causes it to perform actions unauthorized by the owner of that computer, they are violating the federal laws of the United States.  In general, this activity is referred to as a Computer Intrusion.  Some of the Federal Laws that might apply in the case of a Computer Intrusion would include:

• 18 U.S.C. § 1029.  Fraud and Related Activity in Connection with Access Devices
• 18 U.S.C. § 1030.  Fraud and Related Activity in Connection with Computers
• 18 U.S.C. § 1362.  Communication Lines, Stations, or Systems
• 18 U.S.C. § 2510 et seq.  Wire and Electronic Communications Interception and Interception of Oral Communications
• 18 U.S.C. § 2701 et seq.  Stored Wire and Electronic Communications and Transactional Records Access
• 18 U.S.C. § 3121 et seq. Recording of Dialing, Routing, Addressing, and Signaling Information

The sentencing on several of these laws specific to botnet activity was increased by the "Identity Theft Enforcement and Restitution Act of 2007" sponsored by the Cyber Senator from Vermont, Patrick Leahy.  Gary Warner wrote about some of these enhancements in his "CyberCrime & Doing Time" blog back when the bill was being considered.  (See: the Identity Theft Enforcement and Restitution Act of 2007.   Some of the key improvements are that:

    - there is no financial threshold to be crossed when planting "spyware" or malicious software used for identity theft.  Any occurence makes it a Federal crime.

     - if at least ten computers are controlled by one criminal for the purpose of stealing identity, the crime is classified as a FELONY.

     - prison terms under Section 1030 (a)(5) would be increased to up to five years for a first offense of such a felony.

Given all of the above, why are bad guys not being sent to jail more regularly for these types of crimes?

1. There is an enormous deficit in the resources applied to Cybercrime investigation and enforcement.

2. There is a lack of capability to understand and investigate complex cyber crimes.

3. The public is not helping in a useful and practical way.

The focus of the "UAB Open Source Intelligence Project against Cybercrime" is to address all three of these points.  In order to be successful, we need partners who are willing to change their business practices with regards to malware and phishing.  Overwhelmingly, the corrective action applied when malware is discovered in a business environment is to isolate and clean the infected computer, often by formatting the hard drive and reinstalling all software.  When a phishing email is discovered, the recipient is often advised to "just hit delete."  In the Criminal Justice world, this would be referred to as "Destruction of Evidence".

Malware

As we have illustrated through many presentations, including Gary's recent presentations at IT-360 in Canada and GovSec in Washington DC, many malware infections are being used to steal not only passwords and personal banking information, but deep intelligence about the victim, and the company in which the victim's computer is located.  By destroying the malware without a proper investigation, corporate networks have in many cases allowed a deep intrusion into their network to go undetected for months or in some cases years.

Although it is true that a crime has been committed, it is also unlikely that you will get an appreciable law enforcement response by calling your local FBI office and saying "one of my computers has a virus."  Deeper analysis is required, which is often not possible in small businesses or businesses with limited security staff.

To support the Malware portion of this project, UAB researchers are asking for help from the owners of malware-infected computers.  Our current focus is to help identify the 'hosting infrastructure' of some current botnets.  One of the largest of these botnets is known as Koobface.  This malware, infects more than 3 million American computers, and causes several types of mischief, including causing your Google Search results to be altered to point you to affiliate advertisement sites controlled by the computer, allowing other malware families (especially fake anti-virus) to be placed on the infected computer, and causing you to send messages to other Facebook, Twitter, Bebo, and Hi-5 and other users trying to get them to infect themselves as well.

When a webmaster becomes infected with Koobface, his userid and password for his website may be sent to the criminals, who then log in and add a new subdirectory on their webserver which can be used as a Command & Control point.  If you receive an email from UAB asking for your help in documenting this type of attack, please consider responding.

When the victims can share information and produce a quality intelligence report, it does three things:
 
   -   It establishes the validity of the case.

   -   It reduces the manpower required by law enforcement to understand and successfully investigate the case.

   -   It helps make the case understandable to grand juries, prosecutors, attorneys, or judges who may need to help with the investigative process.

We hope that you will respond affirmatively to our research team if you are asked to share log files with us.

Thanks for your cooperation!

Gary Warner
Director of Research in Computer Forensics
The University of Alabama at Birmingham

 

Koobface Distribution domains:

The following domains were compromised by the Koobface malware and used to spread the malware in a secret subdirectory named "/.sys/":

The following domains were compromised by Koobface and used to spread malware in directories with random names, all beginning with a "."