NESTA Crime Online - University of Brighton Repository

writers do not necessarily know how to exploit the vulnerabilities they identify; in other
cases they are simply not willing to cross the safe line of legality. 136 Therefore, they
need to distribute and sell their products to the next agents in the value chain. The
products from hackers and malware writers are generally used by script kiddies
(unskilled hackers) and botnet owners/botnet herders (those who run collections of
compromised computers).
'Script kiddies’ usually describes those who use scripts or programmes developed by
others to attack computer systems and networks. They are named ‘kiddies’ as they are
generally assumed to be juveniles lacking the ability to write sophisticated hacking
programmes on their own. They often use hacking manuals, free malware or do-it-
yourself virus kits to search for vulnerabilities and exploit security breaches. Their
participation in organised networks or gangs is supposedly limited, so we will not focus
on their activities here. However, they are still considered dangerous because of their
irresponsible use of sophisticated software.
Much less is known about the dynamics of botnets. Bots are malware programmes that
are installed silently without the consent of the user. A botnet is a network of computers
on which a bot has been installed, and is usually managed remotely from a command &
control (C&C) server. The main purpose of botnets is to use the computers they have
hijacked (also named ‘zombies’) for fraudulent online activities. They can be created by
an individual (a hacker or a malware writer) but are generally managed by a group of
criminals or an organised crime syndicate. 137 Botnets can be exploited directly for
identity theft or to spread mass campaigns of unsolicited e-mails (spamming) or scams.
But evidence suggests that operators of botnets frequently sell their services to
spammers, mailing out spam runs over thousands of infected computers that cannot be
linked to the source. 138 These aspects are followed up below.
136 Note that in the UK, as in many other countries, misappropriation of data or writing malicious software does
not constitute a civil crime but only its exploitation.
137 Barroso, D. (2007), ENISA Position Paper No. 3; Botnets – The Silent Threat.
138 Terrence Berg, (2007): Cybercrime new internet threats create challenges to law enforcement, Computer
Law Journal, June 2007.
Page 47