Day: June 9, 2018

Over the last few years, cybercrimes have become more intense, sophisticated, and potentially debilitating for individuals, organizations and nations. Law enforcement agencies are finding it difficult to check and prevent the crimes in the cyber space because the perpetrators are faceless and incur very low cost to execute a cybercrime whereas the cost of prevention is extremely high. Targets have increased exponentially due to the increasing reliance of people on the internet. Cybercrimes which were restricted to computer hacking till some time ago, have diversified into data theft, ransomware, child pornography, attacks on critical information infrastructure (CII) and so on. “Cyber related risks are a global threat of bloodless war. India can work towards giving the world a shield from the threat of cyber warfare” Narendra Modi Prime Minister of India India is becoming increasingly vulnerable to this menace because of rapid digitization and proliferation of mobile data without matching pace of cyber security and cyber hygiene. At present, India is ranked at 3% in terms of cybercrime incidents as per data shared by a leading security vendor, which compiled data of bot-infected systems controlled by cyber criminals in different countries. As per CERT-In, one cybercrime was reported every 10 minutes in India during 2017. These statistics are quite alarming and therefore, merit focused and collective attention from law enforcement agencies (LEAs).   Expansion of cyber ecosystem and its impact The increase in technology convergence has created an extremely complex ICT ecosystem of interdependencies within and among critical sectors. This leads to an increased number of stakeholders and a larger attack surface which can be easily exploited by cyber criminals. There is no silver bullet technology which can identify or predict which element of the system (people, process or technology) is more susceptible to cybercrime, though empirically it is observed that the people are the weakest component of the cyber ecosystem. Inherent anonymity and closed nature of the dark web has turned it into a safe haven for cyber criminals and their wares. The dark web hosts a wide range of illegal online markets of cyber exploit kits, drugs, counterfeit documents, stolen credit cards, bank account credentials, human trafficking, illegal immigration etc. It has thousands of forums which operate in a tightly controlled environment. Crypto-currencies are used for transactions so that these transactions cannot be traced to individuals or organizations. Ransomware continues to be a major threat the world over. In 2017, WannaCry, Petya, NotPetya etc., caused major disruptions in the connected cyber ecosystem of the world. India was also affected. CERT-In confirmed 37 incidents of WannaCry and Petya attacks in India between May and June last year. Petya caused extensive disruption of services in India. One terminal of JNPT (Jawaharlal Nehru Port), Mumbai had to switch over to manual operations due to this attack. India was the worst affected country in Asia and seventh overall, due to Petya attack. Apart from ransomware, another area of significant concern is theft of personal identifiable information (PII) and financial credentials of individuals. In another incident of cybercrime, criminals stole personal data of over 2.74 lakh Indian users of the Ashley Madison website. Hackers, who stole 300GB of personal information of the users, put it up on sale over the dark web. Also, Cryptojacking is another lucrative method adopted by attackers to deploy a malware forcefully and unknowingly into a victim’s computer to use their hardware for generating crypto-currency. It is becoming yet another tool of choice for cyber criminals because it cannot be classically categorized as a crime. Figure 2: Top cybercrimes in 2017 “The advent of Digital India and Smart City initiatives has brought about a paradigm shift in terms of connectivity, services and threats for both urban and rural eco-systems. While greater connectivity promises wider deliverables, it also paves the way for the emergence of new vulnerabilities. Leading companies in energy, telecommunications, finance, transportation and other sectors are targeted by new-age cyber criminals. The ‘Make in India’ initiative has identified 25 core sectors as part of its effort to give a special thrust. While cyber security is not one of the sectors, it could be embedded in certain sectors like defence manufacturing, electronic systems, and IT & BPM. It is crucial for ‘Make-in-India’ to focus on cyber security as well as promote development of indigenous solutions to combat cyber-crime.” – Dilip Chenoy Secretary General, FICCI Figure 3: Rise in cyber crime Cybercrimes in the connected world One reason why cybercrimes are becoming more sophisticated, better orchestrated and increasingly ambitious is because many of the perpetrators operate outside the jurisdiction of the victim’s country. As per industry estimates, 32% of the threat vectors originate from Eastern Europe and Russia, and social engineering is the preferred mode of launch for most perpetrators. A report indicates that there are four distinct groups of cyber-criminals – traditional gangs, state-sponsored attackers, ideological hackers and hackers-for-hire. The report also states that the entrance of new participants has transformed cybercrime from isolated and individualized acts into pervasive, savage practices run by distinct groups of individuals. Outsourcing is also possible for execution of these crimes on the dark web where cybercrime is offered as a service. “Cybercrime is the biggest challenge these days with development and access to technology across the globe. Cyber space is increasingly being used to radicalize young minds” Rajnath Singh Union Home Minister of India Cybercrime-as-a-service not only allows malicious actors to leverage other cybercriminals’ resources to conduct attacks but also provides a cheap and easy option to others who are willing to enter the world of cybercrime at a very low entry cost. Netizens have increasingly become more active in leveraging these services, which is driving a surge in activities like illicit drug sale, trafficking of human beings, terrorism, child pornography and other crimes. Illustrative rates of some of the services offered are given next page. Cybercrime-as-a-service model has led to the emergence of a complex and multi-layered cybercrime economy where overt acts of crime have been replaced by a covert criminal…