Sarah Gordon, Richard Ford
Journal In Computer Virology vol. 2, no 1
ISSN 1772-9904
August 2006
Download PDF (117.31Kb) (You need to be registered on forum)Received: 13 January 2006 / Revised: 11 February 2006 / Accepted: 29 March 2006 / Published online: 25 July 2006
Sarah Gordon
Symantec Security Response, 2500 Broadway,
Santa Monica, CA 90494, USA
e-mail: sarah.gordon@symantec.com
Richard Ford
Department of Computer Sciences, Florida Tech.,
150 W. University Blvd, Melbourne, FL 32901, USA
e-mail: richard.ford@fit.edu
The idea of Cybercrime is not new, yet there is significant confusion amongst academics, computer security experts and users as to the extent of real Cybercrime. In this paper, we explore the breadth of computer-based crime, providing a definition of the emerging terms “Cybercrime” and “crimeware”. We thendivideCybercrimeintotwodistinct categories: Type I Cybercrime, which is mostly technological in nature, and Type II Cybercrime, which has a more pronounced human element. We then use two case studies to illustrate the role of crimeware in different types of Cybercrime, and offer some observations on the role of cognition in the process of Cybercrime. Finally we provide several suggestions for future work in the area of Cybercrime.
Discussions of Cybercrime can be found in diverse sources including academic journals, generalist computer magazines, newspaper articles and online; it has been the subject of movies, television programs and radio broadcasts. However, despite an apparent acceptance of and familiarity with the term, there exist dramatically varied views of what Cybercrime is. This lack of definitional clarity is problematic as it impacts every facet of prevention and remediation. In addition, research shows that the number of people and businesses impacted by various types of perceived cybercrime is growing with no signs of declining [2,12,21].
In this paper we examine various dimensions of Cybercrime; after examining some of these definitions, we offer a more inclusive definition before delineating these crimes into two subtypes. Further, we define the term “crimeware”, now in common usage but with varied and often context-based definition, and illustrate this definition’s breadth of similarities and differences with existing usages. Finally two case studies are provided, illustrating the varying effects of education and perception with respect to Cybercrime on home users.
Despite the fact that the word “Cybercrime” has entered into common usage, many people would find it hard to define the term precisely. Furthermore, there is no catchall term for the tools and software which are used in the commission of certain online crimes. In the next two sections, we will attempt to rigorously define Cybercrime and formalize an emerging term, crimeware, which is an inclusive term for the many different Trojans, Viruses, Bots, Spyware and Worms which are instrumental in facilitating certain Cybercrimes.
Like traditional crime, Cybercrime has many different facets and occurs in a wide variety of scenarios and environments. Current definitions of Cybercrime have evolved experientially. They differ depending on the perception of both observer/protector and victim, and are partly a function of computer-related crimes geographic evolution. For example, The Council of Europe’s Cybercrime Treaty uses the term “Cybercrime” to refer to offences ranging from criminal activity against data to content and copyright infringement [13]. However, Zeviar-Geese [22] suggest that the definition is broader, including activities such as fraud, unauthorized access, child pornography, and cyber stalking. The United Nations Manual on the Prevention and Control of Computer Related Crime includes fraud, forgery, and unauthorized access [19] in its cybercrime definition.
As you can see from these three definitions, Cybercrime can occur across a broad spectrum. In many ways, our argument regarding Cybercrime is similar to our previous argument concerning the utility of the word “cyberterrorism” [8]. In the case of cyberterrorism it is our belief that the term itself is misleading in that it tends to create a vertical representation of a problem that is inherently horizontal in nature. Similarly, a criminal will not care whether a crime is “cyber” in nature or not; instead, all methods available will be exploited.
Given this position, we believe there are significant benefits to deleting the word from the lexicon entirely! However, given that this is not likely to occur, the next best thing is to attempt to define the word as meaningfully as possible. Unfortunately, modelling cybercrime definition upon existing categories in work such as Parker [16] is problematic as existing work tends to be descriptive rather than based upon a theoretical framework. With this in mind, we define Cybercrime as: “any crime that is facilitated or committed using a computer, network, or hardware device”.
The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime; indeed, the crime can take place on the computer alone, or in other non-virtual locations. Given the breadth of this definition it is beneficial to subdivide cybercrime into two distinct types; thus we define operationally for the purpose of this research Type I and Type II Cybercrime. An additional advantage of this approach is that it is easy for researchers to define the topic too narrowly. By explicitly highlighting these two facets of Cybercrime, we hope to provide additional emphasis on the breadth of the issue.
Further, our goal is not to legally define Cybercrime – such a definition is beyond the scope of this paper. Instead, we attempt to create a conceptual framework which lawmakers can use in order to create legal definitions which are meaningful from a technical and societal perspective. We recognize that current legal definitions of Cybercrime vary drastically between jurisdictions; however, if technicians in the field worldwide can adequately grasp the nuances of electronic crime, more cohesive legal definitions may result.
Under our proposed scheme, Type I cybercrime has the following characteristics:
A single event or discrete instance, from the user’s perspective, might look something like this:
This type of Cybercrime requires that data be protected from traditional threats such as viruses and worms, but also that users be cognizant of the concept of “vulnerabilities”. This is a huge “thought change” required in the user population.
Vulnerabilities are often found in COTS software; for example, in 2005, Microsoft documented several key vulnerabilities in its popular Internet Explorer application. Criminals controlling a web site may use computer code capable of exploiting such a vulnerability in a Web Browser to place a back-door program on the computer of a visiting user.
Examples of this type of cybercrime include but are not limited to phishing attempts, theft or manipulation of data or services via hacking or viruses, identity theft, and bank or e-commerce fraud based upon stolen credentials.
Type II cybercrime, at the other end of the spectrum, includes, but is not limited to activities such as cyberstalking and harassment, child predation, extortion, blackmail, stock market manipulation, complex corporate espionage, and planning or carrying out terrorist activities online. The characteristics of Type II cybercrime are that:
A series of events in the lifecycle of a Type II Cybercrime might look something like this:
While such an exchange may seem far-fetched, cyberstalking is a very real problem in today’s online community [1]. As such, it clearly is related to – but different from – Type I Cybercrimes which are more technical in nature.
Understanding Cyberstalking’s role in our cybercrime classification is important, as it illustrates the utility of the scheme. Consider, for example, the case of Amy Boyer, who was murdered after being stalked online. The perpetrator ultimately used several online tools and websites to harass his victim, culminating in Boyer’s murder on October 15, 1999. While some have questioned whether this was a genuine computer crime (for a good discussion of this issue and an overview of this and other similar cases, see [9], our belief is that such crimes are by necessity a form of Cybercrime, as the computing element fundamentally changes the scope of the crime. However, the cyber element of the crime can be quite weak.
Fig. 1 The Continuum of Cybercrime. Areas defined as Cybercrime are very broad in nature – some crimes have only a peripheral cyber element, whereas others exist only in the virtual world
Thus, Cybercrime really presents a continuum ranging from crime which is almost entirely technological in nature and crime which is really, at its core, entirely people-related (see Fig. 1). Consider, for example, a fraud carried out via e-mail where the user is directly and simply asked to send money to a particular physical address in return for some service which never materializes. At its core, this fraud would work via regular paper mail or telephone. As such, it is really not a technological issue, though the perpetrator can (and frequently does) use certain attributes of technology to his or her advantage. At the other end of the scale, the user whose machine is penetrated but suffers no financial loss has not really participated in the Cybercrime – the crime is purely technological in nature.
| Example | Type | Software | Crimeware |
|---|---|---|---|
| Phishing | I | Mail client | No |
| Identity Theft | I | Keylogger, Trojan | Yes |
| Cyberstalking | II | Email Client, Messenger Clients | No |
| DDoS | I | Bots | Yes |
| Cyberterrorism (communication) | II | Steganography, Encryption, Chat Software | No |
Table 1 Cybercrime by type. Examples of different cybercrime by type, examining the software used in each case
Similarly, there are likely to be very few events which are purely Type I or Type II; these types represent either end of a continuum. The important fact is to recognize the breadth of the scale; it is all too easy to ignore the end of the scale which one is least accustomed to. For example, a traditional investigator may be more capable of investigating crimes that are more people-centric than technological; similarly, computer security experts are more likely to focus their efforts on issues they see as technological, when simple technological countermeasures could provide significant protection from more people-centric crimes.
Another important aspect to consider is the cost-benefit issue for the cybercriminal. As pointed out in Kshetri [14], the motivators can be either financial, psychological, or a combination of the two. Offsetting this are the expectation of a penalty (that is, the likelihood and consequences of getting caught) and the financial return. This fits our model well in that it treats Cybercrime very broadly, and includes crimes that have no financial motivation.
The software used in Cybercrime is sometimes referred to as crimeware (see, for example, [20] for a common usage definition). We define crimeware as software that is:
The reasoning behind this definition is that it explicitly excludes legitimate programs which may be leveraged by an attacker. For example, a browser which has a vulnerability in it is not meaningfully crimeware – it is simply flawed software. In addition, note that the type of crime carried out is not specified. This is an important distinction from other definitions of crimeware, which frequently limit crimeware’s scope to just that software used for financial crime. This is an artificial distinction, as it defines a program based upon how it is used, not on its content. These issues are further discussed below.
Like Cybercrime itself, the term crimeware covers a broad spectrum. However, it is important to remember that not all software used in the commission of a computer-based or computer-facilitated crime can be legitimately termed crimeware. For example, while an IM client may be used in the commission of a Cybercrime, the IM application software itself is not considered crimeware. FTP clients may be used in the commission of crimes; however, they are not considered crimeware. Crimeware does, however, include programs which may be classified as bots, keystroke loggers, spyware, backdoors and Trojan horses. Additionally, some cybercrime may involve both crimeware and legitimate programs.
The classification of crimeware is important in that it effects the evaluation of security software. If, for example, we classify software contextually – that is, depending on its role – the identification of software is essentially undecidable; detection is entirely arbitrary, making certification and measurement of efficacy impossible.
Our definition is not simply based upon the niceties of evaluation, however. Classifying software contextually makes little sense in terms of risk management. Consider the Instant Messaging example from above. Instead of simply classifying the IM client as “bad” it is better to recognize that it introduces a particular risk into the environment. This risk may or not be acceptable; it does not mean that IM clients are undesirable – just that the changes they introduce to the environment should be managed (Table 1).
Kobe,2 a middle school instructor, recently fell victim to a phishing attack. He was using e-Bay to sell one of his vehicles, and he found a suitable buyer within several days. The buyer paid for the vehicle, Kobe received payment and removed the listing from e-Bay.
He was somewhat puzzled when he logged into his e-Bay account and was informed he had “one item for sale.” He looked at the page, and sure enough, there was the vehicle – the same one he had just sold – for sale. Then he noticed something else wrong – very wrong. The e-mail address that was listed for his contact information was not his. It was very similar, so much so that most people would not notice the change. Kobe e-mailed the “seller” and offered to buy the vehicle, just to see what the response would be. The “seller” thought Kobe was just another buyer, and when Kobe offered to buy the vehicle, the seller made arrangements for the money to be sent. As it turned out, the “seller” was located in Chicago. Kobe gave the FBI the information, and they tracked down the fraudsters.
How did the fraudsters gain access to Kobe’s account in the first place? A phishing e-mail stating his account had been compromised asked him to click on a URL to go to his e-Bay account and validate his ID. He clicked on the URL and was taken to a page that looked identical to his e-Bay login page, and he was asked to type in his account information. The criminals used that information to log into his legitimate account and change the contact phone number.
The software used to commit and enable this crime consists of both non-crimeware and crimeware. The non-crimeware programs are those which are used daily by many people in the course of doing business on the Internet: e-mail and a browser. The crimeware program used in this case was executable code that took Kobe to the look-a-like WWW site. The result of the use of the crimeware was the obtaining of Kobe’s confidential information, and the resultant placement of a “copycat” for sale ad, designed to lure users into repeatedly purchasing non-existent goods. While the criminals attacked many people using the look-a-like site phishing scam, from the perspective of each user, this crime was a “one time event”3. And, while from the perspective of e-Bay, the cybercrime represented multiple frauds, from the perspective of the other victims – those who sent money to the fraudsters, this was also a one-time event.
In some cases, determining whether or not actions are “cybercrime” requires determining if the actions are objectionable. This can depend on the cognitions of the potential victim, or may be clearly recognized according to law or statute.
Consider the case of Roger and Hannah. Several months after the end of their relationship Roger received an e-mail from Hannah. It seemed to be harmless, stating simply that she had been thinking about him and missed him. Roger did not respond to the e-mail, as he did not wish to appear interested in resuming the relationship. Over the next several months, Hannah continued to e-mail Roger from time to time, saying that she knew she should leave him alone, but couldn’t. Initially, Roger was not too concerned about Hannah’s behaviour; however, when the e-mails persisted the entire year, he became concerned and sent Hannah a strongly worded e-mail telling her he did not want any further contact with her, and after an initial refusal to comply, Hannah did stop all contact.
The definition of Cybercrime and the differentiation of types of Cybercrime are extremely important for several reasons. Definitions provide researchers with a common language, necessary for sound collaboration (or even meaningful discussion). Furthermore, definitions help determine the scope of the problem to be addressed, and are necessary for clear communication about a subject. The lack of clear definitions is exemplar of immature and unscientific approach to the problem. This is not surprising, given the relative immaturity of the security and in particular antivirus industries [6,15].
Unfortunately, the definitions of crimeware currently in use by both generalist and specialist populations adds to the confusion by failing to delineate correctly between legitimate software which is used to facilitate a crime and by software whose primary purpose is to execute a crime. It is worth noting at this juncture that software does not have “intent”; instead, we can only attempt to make a best guess as to the intent of the programmer of the software [7]. Consider these two definitions:
(a1) Software designed to steal personal information or perform some other illegal operation. It is malicious software that causes a crime to be committed. See warez and malware.
(a2) Software that helps someone perform an unwanted or illegal act via the computer. Programs and documentation that enable less technical people to set up their own spam, virus or phishing attacks are crimeware, essentially a software development kit for scoundrels. The good news is that the documentation is probably as horrid as that of most popular commercial software [17].
And:
[b] Crimeware is a relatively new term that is used to describe software used to commit crime [11].
We have already shown that software that helps people to perform an illegal act via the computer is not necessarily bad. The claim that software defined as crimeware causes a crime to be committed is unsupported; clearly, it is the cybercriminal who makes the decision to commit the crime. However, it is the opening sentence of a2 that is more cause for concern, stating “software that helps someone perform” a crime. Definition [b] is problematic in that there are many types of software used to commit crime, as demonstrated by our Case Studies, and considering all of these programs “crimeware” would be inappropriate and counterproductive – essentially classifying almost any program as crimeware under certain circumstances. Thus, these types of definitions are of limited use as they tend to unrealistically broaden the range of programs that could operationally be considered crimeware, robbing the term of meaning.
Another type of definition, from Davis et al. [3] refers to another type of software to help define Crimeware, stating “Crimeware is similar to spyware in that it monitors a user’s online behaviour; however, crimeware programs have been modified for the purpose of stealing a user’s personal information.” This type of overgeneralization tends to limit the scope of the problem in that it considers only monitoring programs to be crimeware, and perhaps more problematically, it does not differentiate between programs that monitor legitimately versus those that monitor illegitimately.
At the very opposite end of this spectrum [18] limits crimeware to those programs used to commit financial crime, as opposed to other types of malware which may not aid in financial crime. “Crimeware is a term coined by Peter Cassidy, Secretary General of the Anti-Phishing Working Group, to distinguish computer programs (and coordinated, interlocking sets of programs) that are designed specifically to animate financial crime from other kinds of malevolent code packages.” This narrow definition limits the scope of the problem artificially, it does not even address the issue of programs which are shown to be behaviourally malware (such as a program designed to exploit a vulnerability and obtain root access remotely) and which could be used to commit financial or other cybercrime; rather, it excludes them!
In light of the issues introduced by the current span of operational definitions of “crimeware,” we consider first the Case Study of Roger and Hannah detailed in the previous section. Zona et al. [23,24] describe a typology of cyberstalking based on the relationship between the victim and offender that is consistent with the case of Roger and Hannah. Classified as “Simple Obsessional”, such cases “typically involve a victim and a perpetrator who have a prior relationship. This group comprises the largest of the categories (47 %), and also poses most threat to the victim. The motivation behind this may be coercion to re-enter a relationship, or revenge aimed at making the life of the former intimate uncomfortable through the inducement of fear.”
Additionally, this type of behaviour has the potential to develop into something far more serious. According to the [4] “while some conduct involving annoying or menacing behaviour might fall short of illegal stalking, such behaviour may be a prelude to stalking and violence and should be treated seriously.” Helpguide [10] concurs: “Stalking is unpredictable and should always be considered dangerous.”
Indeed, the question of whether or not unwanted (but otherwise benign) e-mail constitutes stalking is addressed clearly by ( [5]; see also the following statues: Michigan, (MSA Sect. 28.643(8)E,vi) , Oklahoma, (21 Okl. St.Sect. 1173, F 4f), Alaska (AK St. 11.41.270)), all of which place “unwanted e-mail contact” into the category of cyberstalking. Roger did not consider Hannah’s actions “cyberstalking”; however, the question remains, at what point does “unwanted contact” constitute “cyberstalking” or harassment? In any case, the resolution of situations involving unwanted contact is sometimes not benign; as evidenced by the following examples:
A San Diego college student’s actions reported in [4]: An honours student from the University of San Diego terrorized five female university students over the Internet for more than a year. The victims received hundreds of violent and threatening e-mails, sometimes receiving four or five messages a day. The graduate student, who has entered a guilty plea and faces up to 6 years in prison, told police he committed the crimes because he thought the women were laughing at him and causing others to ridicule him. In fact, the victims had never met him.”
While Cybercrime is only now gaining high visibility, these cases are not exceptions. There have been cases of the Internet being used to facilitate crime throughout the past decade. For example, in 1999, a 50-year-old man who had used the Internet to solicit the rape of a woman who had rejected his romantic advance pled guilty to one count of stalking and six counts of soliciting sexual assault. His actions included impersonating his 28-year-old victim in various Internet chat rooms and online bulletin boards, posting messages allegedly from her stating that she fantasized of being raped, and providing her address and telephone number. On at least six occasions, sometimes in the middle of the night, men knocked on the woman’s door saying they wanted to rape her [4]).
In all of these cases, the software used to commit or enable the Cybercrimes should not be classified as crimeware. In the case of Roger and Hannah, e-mail and instant messaging software was used to do what are normal everyday actions; the sending of e-mail. The student from San Diego crossed the line even further in the commission of his Cybercrime; however, he still did not use crimeware. Finally, the man eventually convicted for stalking and sexual assault used e-mail programs, bulletin board software, and chat clients to post messages, send e-mails and chat – something most of us do every day using the same types of legitimate software he used to commit crime.
Clearly the skill-set needed to investigate Type I Cybercrime differs greatly from the skill-set needed to investigateTypeII Cybercrime. Additionally, whilethere is some defense from Type II Cybercrime afforded by technology, the primary defense is currently more human-centric.
This work explores the naturally occurring division between the varied types of Cybercrime. Future research could build on this work by exploring other types of crime that fits, or that could fit, into these divisions. This might give us some insights into what the future of Cybercrime might entail, and by examining both the technical and “people” aspects, it would help us to approach the problem from a more holistic perspective. Compiling a list of program types that would fit under the definition of crimeware would be useful as well. It would be interesting to see how many Cybercrimes actually include crimeware. It is our suspicion that that there are fewer people committing Type I Cybercrimes than is often believed, but that the nature of the crime produces an artificially high estimation of the scope of the problem in terms of perpetrators. It would be interesting to know if similar division occurs in environments that are fully virtual; for example, Second Life.
In this paper, we have examined some of the existing definitions of Cybercrime and crimeware, and found there to be significant lack of clarity in their common usage. To address this, we have proposed a more concise definition of these terms, and have further subdivided the area of Cybercrime into two separate areas to facilitate an understanding of the crimes’s technological and human dynamic. This understanding is of critical importance, as organizations tasked with defending populations against Cybercrime must begin to at least consider all the crimes within this continuum, and designate appropriate resources to prevent, defend against, and investigate Cybercrime. This is especially important as new laws which address “Cybercrime” begin to take effect at a Federal and State level.
Our definition and separation of cybercrime according to its primary “human” or “not human” factors can be a first step in future research that begins to map these crimes according to a variety of factors. For example, development of a matrix similar to that proposed in earlier Cyberterrorism work could result in an even greater understanding of Cybercrime, possibly enabling researchers to accurately and precisely predict the direction of future Cybercrime. It is to be hoped that by studying Cybercrime with a more holistic perspective, novel solutions to both types of Cybercrime can be created.
Finally, we believe that the situation with Cybercrime and crimeware is rapidly evolving. By attempting to view the problem more inclusively, it should be possible to foresee new developments and take steps toward remediation rapidly. Narrowing or ignoring the problems will create the perfect environment for the Cybercriminal to flourish, undermining the perceived stability and reliability of electronic systems worldwide.
1 One clarifying point is needed. In cases of cyberstalking (see, for example, the case of Amy Boyer discussed elsewhere in this paper) the victim may not be aware of the underlying events. However, the causal events were ongoing – that is, there is not one single event as it pertains to the victim.
2 Names and places in this section have been changed in order to respect the privacy of the individuals involved.
3 A user may receive many “individual event” e-mails – but each is considered a discrete event.
[Back to index] [Comments (0)]