NESTA Crime Online - University of Brighton Repository

tool is used by security and networks administrators to manage their systems, as well as
by hackers to exploit vulnerabilities. Security firms (gamekeepers) often hire reformed
crackers to write their security programmes.
Other software, however, is undoubtedly malicious as well as invasive, combining the
motivations and skills of both the cybercriminal and the white-hat hacker. For instance,
MPack has become one of the most popular software exploitation tools in the
underground markets. Mpack is malware kit produced by Russian crackers in 2006 that
not only finds vulnerabilities but also exploits them by automatically storing relevant
data for its later use. Our interviews with IT specialists suggested that there is there is a
fine line between legitimate software and crimeware, since it is its use that generally
turns it into a criminal activity. 131
‘Dual-use’ technology
Recent research identified a criminal gang using software tools normally reserved for
computer network administrators to infect thousands of PCs in corporate and
government networks with programmes that steal passwords and other information.
Security experts say that although attacks against network administrators are not new,
the systematic use of administrative software to spread malware had not previously
been widespread.
The gang was identified publicly in May 2008. SecureWorks, a computer security firm in
Atlanta, determined that the Russian-based gang was able to put in place a central
programme controlling as many as 100,000 infected computers across the Internet. The
program was running at a commercial Internet hosting computer centre in Wisconsin.
After law enforcement agencies were alerted, the original command programme was
shut down. However, the gang immediately reconstituted the system, moving the
control programme to another computer in the Ukraine, beyond the reach of law
enforcement in the United States.
Source: John Markoff, (2008), “Russian Gang Hijacking PCs in Vast Scheme”, The New
York Times, 6 August 2008.
131 Interview with Brian Moore, IT specialist, 17 th November 2008.
Page 45