NESTA Crime Online - University of Brighton Repository
NESTA Crime Online - University of Brighton Repository
NESTA Crime Online - University of Brighton Repository
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
tool is used by security and networks administrators to manage their systems, as well as<br />
by hackers to exploit vulnerabilities. Security firms (gamekeepers) <strong>of</strong>ten hire reformed<br />
crackers to write their security programmes.<br />
Other s<strong>of</strong>tware, however, is undoubtedly malicious as well as invasive, combining the<br />
motivations and skills <strong>of</strong> both the cybercriminal and the white-hat hacker. For instance,<br />
MPack has become one <strong>of</strong> the most popular s<strong>of</strong>tware exploitation tools in the<br />
underground markets. Mpack is malware kit produced by Russian crackers in 2006 that<br />
not only finds vulnerabilities but also exploits them by automatically storing relevant<br />
data for its later use. Our interviews with IT specialists suggested that there is there is a<br />
fine line between legitimate s<strong>of</strong>tware and crimeware, since it is its use that generally<br />
turns it into a criminal activity. 131<br />
‘Dual-use’ technology<br />
Recent research identified a criminal gang using s<strong>of</strong>tware tools normally reserved for<br />
computer network administrators to infect thousands <strong>of</strong> PCs in corporate and<br />
government networks with programmes that steal passwords and other information.<br />
Security experts say that although attacks against network administrators are not new,<br />
the systematic use <strong>of</strong> administrative s<strong>of</strong>tware to spread malware had not previously<br />
been widespread.<br />
The gang was identified publicly in May 2008. SecureWorks, a computer security firm in<br />
Atlanta, determined that the Russian-based gang was able to put in place a central<br />
programme controlling as many as 100,000 infected computers across the Internet. The<br />
program was running at a commercial Internet hosting computer centre in Wisconsin.<br />
After law enforcement agencies were alerted, the original command programme was<br />
shut down. However, the gang immediately reconstituted the system, moving the<br />
control programme to another computer in the Ukraine, beyond the reach <strong>of</strong> law<br />
enforcement in the United States.<br />
Source: John Mark<strong>of</strong>f, (2008), “Russian Gang Hijacking PCs in Vast Scheme”, The New<br />
York Times, 6 August 2008.<br />
131 Interview with Brian Moore, IT specialist, 17 th November 2008.<br />
Page 45