NESTA Crime Online - University of Brighton Repository
NESTA Crime Online - University of Brighton Repository
NESTA Crime Online - University of Brighton Repository
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
accelerating on a monthly basis. With Storm Worm, we can see the agility <strong>of</strong><br />
cybercriminals in releasing upgraded versions <strong>of</strong> malware and blended attacks. In other<br />
cases, malware acquires improved functions compared with its rivals and even<br />
substitutes itself for malware installed by competitors. Unlike hackers, such groups do<br />
not appear to compete with each other or protect against other types <strong>of</strong> groups where<br />
there would seem to be little rivalry given the abundance <strong>of</strong> ‘booty’ available.<br />
Consequently, there is no need to compete over resources since they are far from<br />
scarce. The rivals here are the law enforcement agents who seek to identify and shut<br />
down their operations.<br />
Another recent example <strong>of</strong> product upgrading can be seen in the Conflicker worm which<br />
emerged in late 2008 and sought to integrate millions <strong>of</strong> inflected computers to create a<br />
giant botnet. Computer experts worry that it could become a pr<strong>of</strong>itable platform for<br />
massive Internet fraud and theft. They also increasingly suspect that Conflicker will hold<br />
computers to ransom. According to IT experts, Conflicker’s s<strong>of</strong>tware developer(s) has<br />
repeatedly updated its s<strong>of</strong>tware in a cat and mouse game. Researchers who have been<br />
painstakingly disassembling the Conflicker code have found difficulty in determining<br />
where the author(s) is located, or the organisation underlying the development <strong>of</strong> the<br />
worm, or whether the programme is being maintained by one person or a group <strong>of</strong><br />
hackers. 166<br />
Functional upgrading. This refers to increasing value added by changing the mix <strong>of</strong><br />
activities conducted within the firm. This implies either integrating activities that were<br />
not performed in the firm before or outsourcing them (an example in a legitimate<br />
business would be outsourcing or taking responsibility for accounting or logistics). 167<br />
There are multiple examples <strong>of</strong> functional upgrading in the cybercrime business, where<br />
evidence suggests that certain gangs have expanded their core activities. In the Storm<br />
Worm example, functional upgrading is illustrated by their move from simply spreading<br />
malware to the actual exploitation <strong>of</strong> vulnerabilities. Tamil cybercriminals in London are<br />
thought to have subcontracted parts <strong>of</strong> their operation to South East Asia to enable<br />
them to maintain a low pr<strong>of</strong>ile on the streets and avoid the adverse attention <strong>of</strong> other<br />
gangs.<br />
166 John Mark<strong>of</strong>f, “Computer experts united to hunt worm”, New York Times, 18 th March 2009.<br />
167 Kaplinsky R, and Morris M., (2001).<br />
Page 57