Feeds

Everything you thought you knew about cybercrims is WRONG

Forget teen hackers, they're aging gangsters with off-the-shelf web weapons

SANS - Survey on application security programs

Assumptions about cyber-criminals are all wrong, according to a study that argues many fraudsters are middle aged and possess only rudimentary IT skills - contrary to the elite bedroom teen hackers portrayed in movies.

The research, led by criminologist Dr Michael McGuire of The John Grieve Centre for Policing and Security at London Metropolitan University, blames 80 per cent of cybercrime on your common-or-garden gangsters. Contrary to Hollywood film scripts, cybercrime is far from the preserve of tech-savvy youths - nearly half (43 per cent) of cyber-crooks are over 35 years old, and less than a third (29 per cent) are under 25.

More cyber-crooks (11 per cent) are over 50 than youngsters aged between 14 and 18, who make up only eight per cent of e-crims, according to the doctor and his team.

The study, sponsored by BAE Detica, is billed as the first comprehensive analysis of the nature of criminal organisations involved in e-crime. The document could help cops tackle banking fraud and other scams more effectively by challenging existing assumptions about the cyber-crook demographic.

The availability of crimeware, which can be easily distributed or purchased, means getting ready-made viruses that exploit the vulnerabilities of individual systems to running botnets of hijacked computers can be accomplished without any particular technical skills. Cyber-crooks are now just as likely to be street gangs, drug traffickers or established crime families as those traditionally associated with digital crime such as ID fraudsters or hacking syndicates.

The “deskilling” of cybercrime has allowed many traditional offline scams to be applied online. For example, money laundering has been extended to the creation of money mule networks to siphon funds from compromised web accounts, and the control of drugs markets has been applied in selling unlicensed medicines.

How many are in your gang?

Half the groups involved in cybercrime are made up of six individuals or more, with one quarter comprising 11 or more. However there's little or no correlation between group size and the impact or scope of offending.

A small group of cyber-crooks can inflict huge financial harm against targeted institutions. And many cybercrime crews have been operating for months rather than years. A quarter (25 per cent) of active groups have operated for less than six months, the Organised Crime in the Digital Age study concludes.

The report reveals that certain clusters of criminal activity exhibit more organisation or structure than others on a spectrum that extends from decentralised swarms through to highly organised hierarchies. In some cases classic crime families that have begun to move their offline activities into cyberspace - rubbing shoulders with extremist groups recruiting members online, and protesters coordinating riots using web tools.

Professor John Grieve, founder of policing centre, commented:

To tackle the problem of digital crime and intervene successfully, we need to move away from traditional models and embrace this new information about how organised criminals operate in a digital context.

The research found evidence of many cases where there has been real success in closing down digital criminal operations. Growth in the digital economy will inevitably cause an increase in organised digital crime, however this need not be seen as an insurmountable problem. Rather, it is a predictable problem that – by better understanding the perpetrators and their working methods – we can meet head on.

The team of researchers who carried out the study combined seeking out information by hand with advanced search tools - such as Detica’s NetReveal Analyzer, a bit of gear designed to turn large amounts of structured and unstructured data into intelligence. Stage one of the research involved a review of evidence made up of over 7,000 documentary sources, including public and private documentation to analyse the technologies, activities, group characteristics and miscreants involved in cybercrime.

Then the team performed a demographic analysis of initial organisational patterns found in these sources, and compared the results with evidence from interviews with expert practitioners. Finally, a network analysis of the organisational patterns and activities that emerged at the earlier stages of the research process was carried out to arrive at the study's final conclusions. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.