Current situation of cyber crime in china
Download
1 / 24

Current situation of cyber crime in China - PowerPoint PPT Presentation


  • 372 Views
  • Uploaded on

Current situation of cyber crime in China. Cybercrime Investigation Division Information Security Supervision Bureau Ministry of public Security of P.R.C Xu Jianzhuo. The development of Internet.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'Current situation of cyber crime in China' - nora


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
Current situation of cyber crime in china

Current situation of cyber crime in China

Cybercrime Investigation Division

Information Security Supervision Bureau

Ministry of public Security of P.R.C

Xu Jianzhuo


The development of internet
The development of Internet

A cow was lost in Jan 14th 2003. If you know where it is, please contact with me. My QQ number is 87881405.

QQ is one of the most popular IM in China.





Major categories of cyber facilitated crime
Major categories of cyber facilitated crime


Hacking case: HOW?Major categories of intrusion technology used by hackers in the cases we investigated


Hacking case how
Hacking case: HOW?

  • The following intrusion methods increased rapidly in recent year and became one of the major intrusion technology

    • Large-scale intrusion by exploiting vulnerability of client software

    • Large-scale intrusion by decoying users to install malicious code through P2P, IM, Email network


Case example

A virus on QQ (a most popular IM) were created to spread malware in order to creat an IRC botnet: 60,000 hosts were infected.

Case example

Wi.ourmid.com

“Please visit wi.ourmidi.com”


How did the criminal hackers occupy the victim hosts
How did the criminal (“hackers”) occupy the victim hosts?

Those who don’t know a lot about technology make profit by damage the network security directly.

Those who know technology make profit by selling technology.


Hacking without knowledge of technology case example netbank accounts stealing
“Hacking” without knowledge of technology hosts?Case example: Netbank accounts stealing

  • Case outline:

    • In August, a malicious code were widely distributed and more than 300 Netbank accounts were stolen.

    • The suspect intruded into a website and put malicious code on the main webpage.

    • When users browsing the website, the malicious code will be installed automatically onto the user’s hosts.

    • The malicious code will steal all kind of Netbank accounts and post onto another website hacked by the suspect.

  • However:

    • The suspect know nothing about hacking technology.

    • The suspect bought the malicious code and victim websites totally from other hackers.

    • The suspect only working step by step according to the manual provided by other hackers.



Hacking cases where how did they connected to internet
Hacking cases: WHERE? hosts?How did they connected to Internet?

Mobile/Wireless crime increased at the same time.


Hacking cases target
Hacking cases: TARGET? hosts?

  • Personal computers become the major part of victim in computer crime in recent year.


Preference of hackers
“Preference” of hackers hosts?

Damage to Internet Security

Profit


Why did they become criminal
Why did they become criminal? hosts?

  • They think:

    • It’s not a crime, it’s just a game.

    • A lot of people do it on Internet, so I can do it.

    • I know it’s a crime, but I need money.

    • I can hide myself very well.

    • No one will investigate it.


What we learn from these data
What we learn from these data hosts?

  • Computer crime and traditional crime are intermingle with each other.

    • XSS vulnerability with phishing

    • DDOS/IRC botnet with extortion

  • Current protection technology have not successfully protect against following attack yet.

    • Sql injection

    • XSS

    • Distribute malware over P2P/IM network

    • Social engineering


What we learn from these data1
What we learn from these data hosts?

  • Those who don’t know a lot of technology cause most of the damage to Internet directly.

    • Their major aim is to make profit by stealing identity, Netbank account, online stock account, online game account etc.

    • Most of them don’t realized that there activity cause severe damage to Internet security.


What we learn from these data2
What we learn from these data hosts?

  • Exploit/Malicious code seller is one of the most big threat to cyber security.

    • Investigation of exploit and malicious code should be emphasized by cyber police.

  • Personal computer is becoming the major target of computer crime.

    • Antivirus software will play a more important role in cyber protection.


How can anti virus industry help cyber police
How can anti-virus industry help cyber police? hosts?

  • Report to police authority before publishing the detail information about the malcode/virus

    • We have investigate the source of several virus this year.

    • However, the detail information about the virus were published and the suspect never access the related network resource anymore.

    • If you reporting to us beforehand, the source of most identity stealing malicious code can be revealed.


How can anti virus industry help cyber police1
How can anti-virus industry help cyber police? hosts?

  • Save the trail of virus.

    • When we try to investigate a Botnet in 2003, we try to trace the source of the malicious code.

    • However, malicious codes on a lot of victim hosts were killed by the anti-virus software.

  • For example, save the following information

    • Time stamp

    • Hash value.

    • Etc.


How can anti virus industry help cyber police2
How can anti-virus industry help cyber police? hosts?

  • Compare the character of different kinds of virus in order to find out the virus produced by the same author.

    • A criminal is not grown up in one day.

    • They always create more than one kind of virus.


How can anti virus industry help cyber police3
How can anti-virus industry help cyber police. hosts?

  • Integrate basic forensic analysis function into antivirus software.

    • For example, extract the automatic running program list, there time stamp and hash value.

    • When the user report an incident to anti-virus company, you will get more chance to collect the malicious code.

  • Integrate antivirus technology into popular P2P, IM, Email and WEB server.

    • Just kill the malicious code on personal computer fail to throttle the spread of malicious code.

    • The malicious code distributed through P2P, IM, Email and WEB server can hardly be monitored and throttled.


Game over

Game Over hosts?

Bye bye!


ad