1 / 38

Technology and Method behind Cross-border Fraud Investigation in Telecom and Internet

Technology and Method behind Cross-border Fraud Investigation in Telecom and Internet. How to Combat Cyber Crime Effectively. Outlines. Fraud Crime Cases through Telecom and Internet. Challenges. Trace Communication Route and Obtain Related Data.

anevay
Download Presentation

Technology and Method behind Cross-border Fraud Investigation in Telecom and Internet

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Technology and Method behind Cross-border Fraud Investigation in Telecom and Internet How to Combat Cyber Crime Effectively

  2. Outlines Fraud Crime Cases through Telecom and Internet Challenges Trace Communication Route and Obtain Related Data Case Study of the Recent Investigation on Cyber Crime Conclusion

  3. Fraud Crime Cases through Telecom and Internet Nature of Cyber Crimes

  4. Crime globalization Traditional crime with the cutting edge technology Emerging type of fraud crime cases through telecom and Internet and its associated features Hard to analyze large volume of complicated data during investigation Crime toward seamless processes and delicate organization

  5. Traditional Crime with Cutting Edge Technology Traditional Crime Emerging type of Crime Advanced Technology With mobile, Internet, IP phone, mobile Internet access or other value-added telecom services, swindlers commit more crimes easily; However, by whatever advanced technology and tool they use, the nature of their crimes always stays all the same. We still need to profile such crimes by the analysis on conditions, mindset, and behavior of crime.

  6. Crime Globalization As applications and services of telecom technology and Internet are developing rapidly and pervasively, people are also familiar with those services. Fraud crimes through telecom and Internet, which are just like contagious diseases, may widespread globally by networks.

  7. Globalized Crime Issue Borderless Internet makes crime behavior more globalized. Through the Internet and cloud computing, communication in swindler group can be enhanced and anonymous. Because of limitation of state authority and anonymity, it is really hard for state prosecutors and police to take investigation on the entire crime activities. Thailand Taiwan Swindlers North America South Korea China/HK Vietnam Japan Cloud Computing = Network Computing Through Internet, computers can cooperate with each other, or services are available more far-reaching

  8. Hard to analyze large volume of complicated data There is often large volume of data or information (such as phone multiple transfers) produced by telecom and Internet fraud crimes because of converged IT network and telecom routes. In reality, such huge amount of data is acquired from multiple service providers. Investigators must apply multiple orders from court in advance to connect with data from those service providers. (for example: If there is phone transfer between 2 operators, investigator must request both to provide CDR information and call content by 2 orders from court ahead of time, and integrate all information for further analysis.) Therefore,it is no way to cope with such telecom and Internet fraud crime only by tradition way of comparing, claiming or tracing targets manually.It is the best way for investigator to adopt several effective software tools to analyze such huge amount of data.

  9. Converged ICT Communication Routes Internet D Cross Border Telecom Network A Telecom Network IT Network Fixed Network B Illegal ISP Internet E Illegal DMT by ISP Mobile C Illegal Transfer Domestic

  10. Crime toward seamless processes and delicate organization Telecom Telecom It is a nature trend that group crime is toward seamless process and delicate organization. There is very clear hierarchy of role and responsibility (R&R) for leader, telecom engineer and service staff in crime group. They never mix the use of phones for crime and private, and adopt one-way contact in order not to be cracked with whole group. Such crime model can be easily duplicated. Fraud crime group often splits into small ones, forms new gang, commits more crimes, and exchanges information and new techniques of fraud. contact Private collection Internet Jump board Swindler Group Cash flow Finance ATM Operation New crime R & D Recruiting Monitor Police

  11. Common Features Telephone as primary communication during crime commitment Converged ICT technologies in daily life and not far above police head Telephone Skillful at all services Converged ICT Technologies Criminals (Group) Skillful at all Internet and telecom services but not familiar with operations behind and LI by police Faults can be tracked from human behavior Faults by human

  12. Challenges

  13. ● By new technologies (like IP phones), it is hard to intercept their calls with existing equipment. We need professionals and suppliers to find the way out Hard to Identify Criminal Hard to Track Cross-border Phone ● Looking for cross border cooperation or other related clues if no cooperation Hard to Find Foreign Proxy or Router as Jump Board ● VPN, Foreign Proxy as Jump Board for criminals may be hidden behind deeper in Internet

  14. Large Volume of CDR, and Hard to Take Analysis ● Analyze data and find the key information by text mining and data warehousing Wrong CDR or Missing Partial Data ● CDR is for billing management of ISP, and we must find how it is happening and analyze the reason Hard to Track Calls with Dummy Accounts ● Find source and links, and know the key point by technical assistance and help from ISPs

  15. Trace Communication Route and Obtain Related Data Methodology and Guidelines of Cyber Crime Investigation

  16. Check Post Tracking Deployment Lawful Intercept Archive Look-up Warrant & Confiscation Tenant Interview e-Positioning The way of investigation on fraud crimes behind telecom and Internet is the same with the one on traditional crimes. All the techniques are not for specific case, but can be used flexibly by need.

  17. Gap between Physical and Cyber Crimes Physical Crimes Evidence collection & investigation •Finance Record •Interview(Video) •CDR, LI •Informers •others •human:apprehend arrest •place:warrant, confiscate Clues Enforcement Different sources dealt by police: hard to get clue (don’t know how to do it), and no way to trace! Cyber Crimes •Crime side (web or tool) •non-Crime side (Social network) •human:apprehend, arrest •place:warrant, confiscate •others excluded (Useless) •Lock activities (by Account) Evidence collection & investigation Sourcing clues •IP tracking •Finance Record • CDR, LI Analysis & highlight Enforcement

  18. Quest for Investigation on Cyber Crimes CDR Tenant List Car Plate Credit card、Insurance Car Meter Record Cable TV、Broadband Resident Information Internet googling Relatives Cross Check Find Links Crime Record 165voice signature Finance Transaction Co-prisoners Shipping List Property Tax Labor Insurance Immigrant

  19. There is no difference between cyber crime and traditional crime in nature. With the advantages of convenience, anonymity and mobility of telecom and Internet, criminals are able to disguise their command center and disrupt the direction of investigation. Lawful enforcement officers need to make more effort in studying crime model and finding the way out to combat criminals. 1、Set up dedicated database for information collection and analysis 3、data organization and link analysis by software 2、clear about crime tool and method, and find the key point

  20. Process Flow for Investigation Primary data sourcing and collection Follow-up Primary data study and further collection & sourcing Suspect arrest and evidence collect Further Investigation

  21. Primary data sourcing and collection ● A1clue、informer、case claim、daily crime information collection and integration, sourcing Primary data study and further collection & sourcing ● Study primary data, cross check databases in Police Department, googling in Internet and confirm crime type in order to prepare investigation ● Phone record, check post、lawful intercept, tracking, location positioning, knowledge of crime organization and members Further Investigation Suspects arrest and evidence collection ● Arrest all suspects, confiscate all evidence, check all computers, telephone record, booking record…etc. ● follow-up investigation on related targets & evidence and hunting for clues from other members to combat all gangsters Follow-up

  22. VoIP Tactic Server in Investigation into Cyber Crimes • VoIP based Interception and data interception of other 150 Internet services • Flexible implementation in multiple telecom operators • Intercept all VoIP routes from different sources simultaneously • Collect original pcap as well as reconstructed voice data for evidence in court • Support all common VoIP protocols such as G.711a-law, G,711µ-law, G.726, G.729, iLBC • Meet the requirement of state LI Law, ESTI standards

  23. E-Detective Tactic Server LAN Internet Monitoring, Data Retention, Data Leakage Protection & IP Network Forensics Analysis Solution Solution for: • Route of Internet Monitoring/Network Behavior Recording • Auditing and Record Keeping • Forensics Analysis and Investigation, • Legal and Lawful Interception (LI) • VoIP Tactic Server & Mediation Platform E-Detective Standard System Models and Series (Appliance based) FX-06 FX-30N FX-100 FX-120

  24. E-Detective Lawful Interception Solutions Telco/ISP Lawful Interception

  25. Sample: VoIP Calls (with Play Back) Caller Phone # Date & Time Duration Callee Phone # IP Address Play back of reconstructed VoIP audio file using Media Player

  26. Data from E-Detective VoIP Tactic Server • Source IP Address • Telephone number of caller • Telephone number of receivers/victims • Date & time of calls • Duration of calls • Call content

  27. Case Study of the Recent Investigation on Cyber Crimes Lessons and Experience

  28. Real Case on VOIP Investigation Problem Here: The most common tool by swindler group is telephone. While arriving the telecom room of criminal, sometimes police can’t do anything because they know nothing about these equipments and can’t track IP phone source from Internet.

  29. What to Check from Swindler Computers • Group and Billing Systems • Account information in SIP Gateway or IP-PBX Servers • Detail CDR from SIP Gateway or IP-PBX Servers

  30. VOIPTracking from Swindler Group – Group and Billing System Group System-Random to Call Billing System-Call CDR

  31. VOIP Gateway Investigation from Swindler group-Track SIP Server Server IP Account Password

  32. VOIP Tracking from Operator – CDR of SIP Server Callee ID and CDR of IP phone from ISP VAD Srvc- Redial Callee VOIP ID Caller Callee Initial Time Ans Time End time Interval IP of VOIP ID

  33. Key Points of Investigation Aggressively hunting for intelligence Don’t give up any follow-up opportunities,and carefully analyze any useful information Active Lawful Intercept:tap into suspected lines, intercept phone number and IMEI, phones in China, interview resident houses, and clarify criminal organization, identity and location

  34. Experience familiar with law and regulations,understand what the target is and what the key evidence is. For example: find Chinese victim information and testimony through cooperation with Chinese Police after breaking cross-strait swindler group in Taiwan. Otherwise, these criminal will be non-prosecuted or non-guilty sentence by court. Telecom equipment supplier, telecom shop, network engineer, telecom engineer, telecom sales …network and telecom professionals usually are aware of information and location of suspects. 34

  35. Experience (continue…) Understand calling flow, and accounts of swindler group from operators side in order to find more background information from CRM and billing systems Active Lawful Intercept:Tap into suspected lines, intercept phone numbers to China Carefully Trail down: Prepare information (Time, place, behavior) in advance, trail by segment (not to expose self), identify criminal from different sides Use confiscated computers for investigation to find more strong evidence

  36. Conclusion Follow-up…

  37. It is quite nature for criminal to use advanced ICT technologies. Human is the key of every crime act. Although there may not be fault in technology itself, human may make mistakes by using it. Investigators are able to find the way out and combat these criminals Enhanced on-job technical training for police to promote capability of investigation and understanding of criminal law From viewpoint of investigation, more horizontal coordination among all units in order not to waste resources. From tactical viewpoint, more international, cross-strait cooperation to combat cross-border swindler group God will help those who work hard for justice

  38. Thank you for your Patience Q & A

More Related