網(wǎng)路犯罪案例 cyber crime case

1Cybercrime

DecisionGroup/CEOCasperKanChang2TwoMajorcategoriesofCybercrimeReconstructablenetworkPacket

Non-ReconstructableNetworkPacketTraditionalcrimescommittedviaInternet.Examples:InternetAuctionfraud,traffickingincontrabandgoods,Internetsexualassault,internet-advertisingbankloansfraudCrimescommittedviainternetExamples:SpreadingVirus,Hacking,IllegalAccess,Illegalinterception,DataInterferenceandcommunicationInterference.Evidencefrom…Crimeoperationmethods…NetworkPacket3CybercrimeInvestigationStepsTaskForceTeamTechnicalsupportisrequestedandthelevelisdeterminedaccordingtothecasecontentsAninitialcomplaintisreceivedandbackgroundintelligenceinformation

checksarecompleted4CaseStudyofCybercrimeCrimeTimeCrimelocationCorpusdelictiCrimemethodPerpetratorAnalysisCriminaldamageCriminalchargesSearchEvidenceCollectionInternetInterception

Seizure

CompleteForensicanalysisandinterprettheevidencefoundforlegal/courtroomsetting5CollectionofCyberCrimeInformationComputerAuditRecordCollection:TocollecttheloginauditrecordsofthevictimincludingDNS,IP,Accountdetails,MACandlocaltimesetc..UserLogincredentialauthentication:Tocheckuser’slogincredentialsincludinguseraccount,name,address,phoneetc..

Toobtainthecomputercommunicationrecordandcontents:includingE-mail,IMchat,webbrowsingandfiletransfersetc..Suspectsstatements:criminaloffenceetcTheseizureofthesuspect’scomputerauditrecords:Web,IP,account,MACandtimeetcEmailMSNFTPURLTimeIPMacAccount6Internetadvertisingbankloanfraudcase-1

InMay2021KCGPB(KaohsiungCityGovernmentPoliceBureau)announcedthattheyhadreceivedanumberofbankreportsallegingforgeddocumentsfraudulentlyrepresentingbidsforcredit.Thisresultedinbankloanfraudswithhugefinanciallosses.Anin-depthinvestigationrevealedthattheoffendersfloodedxxshareswithotherstoformthefraudgroup.TheyusedadomesticportalwebsiteforfreewebspacetofalselypostorstickeradvertisingpublishedintheOfficeofcreditandinformation.Thiswasdonetoattractthemuch-neededcashflowoftheheadcustomer.ThemembersoftheGroupforgedtax,payrollandotherdocumentstofalselystrengthenthelender'sfinancialresourcesandcreateddocumentstomisleadtheheadbankcustomerwhosecreditbidtofinancialinstitutionswascaughtinanerroroftheapprovedloan,thegroupchargedthecustomerexorbitantfeestogainlargeprofitsoffinancialfraud.7Internetadvertisingbankloanfraudcase

8InternetSexualAssaultcases!

Internetsexualassaultcasesin2007:Daily1.5case,morethan60%are12-18yearsold.

June10,2021AppleDailyTaipeiTaiwanTwosuspects9IstrulypatheticandinferiortoanimalsJuly2021Taipei;twosuspectsusetheInternettoinviteFemalenetfriendstoparticipateinaparty.TheFemalenetfriendisusedtomeetawomanataMotel,andinturnrequireasexualrelationship.Thevictimrefusestocooperateandisphysicallyabusedandraped.Thepolicearrestedthetwosuspectsandfurtherinvestigationsrevealedthatasmanyasadozenotherpeoplehadbeeninjured.Thevictimsareunwillingtoreporttothepoliceduetohumiliation.Thepolicemonitorthenetworkaddressofthemotelaccesstonumberandareabletoobtainenoughevidencetoarresttowsuspects.ThepolicelinkedthetwooffenderstoothercrimescommittedinJuly2021.QuestioningoftheoffendersrevealedvariousnicknameswereusedbyyahoomessengerandPeaschatroomsandvariousotherwebsites.Thesuspectsrevealedthatanother5or6offendershadassistedinthecrimes.Policearecontinuingtheirinvestigationsandtracingtheotheraccomplices.10HackerDataTheft–1

HackerSux-jungworkfortheunderworldtostealdata

2007/09/22ChinaTimes/Taipei/ChoiMin-YueCIBHigh-TechnologyCrimePreventionCenterandTechnologyhavefoundthattheInternetnickname〞Odin"aLin,high-schoolsophomore,andthenickname〞CB〞Sux-jung,usedanacademicdepartmentasthebackbonenetworkspringboardwithahosthiddenwithinaTaiwanAcademicNetwork.TheuseofTrojanhorseprograms,togetherwithwebsitevulnerabilitiesagainstwell-knownWebsiteswereusedtoharvestintrusiveinformationandthen,tocircumventtracing,storedthisdataonaforeignhostedwebsite.Xxtelecomcompaniesuseraccountsandpasswordwerecompromisedwithmorethan2.4millionpinsstolen.Somewebsiteshavebeendamagedbyhavingtheirprogramsremoved.HackerSux-jung

11HackerDataTheft–2

HackerSux-jungworksfortheunderworldtostealdata

12ForensicstoolsToassistintheforensicacquisitionofdigitalevidence,itisessentialthateverycomputercrimeinvestigatorhasaccesstothecorrectforensichardwareandsoftwaretools.Thisplaysacriticalroleinthedetectionofcomputerrelatedcrimesaswellasthecollectionandanalysisofevidence.13NetworkPacketForensicsClassificationNon-ReconstructableNetworkPacketViruses&Worms,Hacking&Trojans......……ReconstructableNetworkPacketEmail,WebMail,IM,FTP,P2P,VoIP,VideoStreaming,HTTP,OnlineGames,Telnet

，1.2.14Cyber-crimeForensicsToolsForensicstools1Wired,HTTPS/SSLandVoIPWireless“Catch-it-while-you-can”forensicssystems

2Off-Linepacketreconstructionsoftware“Stop,lookandlisten”O(jiān)ff-LineForensicssoftware3Providingamobileand10GbasecyberforensicsinassistingHomelandSecuritycapabilities15FunctionofForensicsToolCapturingnetworkpacketstoreconstructEmail,WebMail,IM,FTP,P2P,VoIP,VideoStreaming,HTTP,OnlineGame,Telnet…InternetInterceptionForensicstoolsByusingForensicTools,wecanobtainsupportingevidencelikelog,filesandrecordsfrombothvictimandsuspectcomputers.16NetworkPacketForensicsToolByUsingOff-LinepacketreconstructionsoftwaretoreconstructtherecordedtrafficdataNetworkPacketOff-Linepacketreconstructionsoftware17ToproduceforensicresultsForensicAnalysisForensicReportsCourtDigitalEvidence18TotalSolutionsforCyberForensicsWiredpacketreconstructionWireless(802.11a/b/g/n)packetreconstructionHTTPS/SSLinterceptorVOIPpacketreconstructionOff-linepacketreconstructionsoftwareNetworkpacketforensicsanalysistraining19NetworkPacketForensicsAnalysisTrainingTheknowledgeofnetworkpacketanalysisisimportantforForensicInvestigatorsandLawfulEnforcementAgency(LEA)tocarryouttheirdailyduty.NetworkPacketForensicsAnalysisTraining(NPFAT)providesusefulandsufficientknowledgerequiredtoanalyzenetworkpackets.ParticipantswillbeabletoidentifydifferentpackettypesaccordingtovariousInternetProtocols.TheseincludeEmail(POP3,SMTPandIMAP),WebMail(YahooMail,Gmail,Hotmail),InstantMessaging(WindowsLiveMessenger,Yahoo,ICQetc.),FTP,Telnet,HTTPandVOIP.Forensicinvestigationisaskillfultechnique,scienceandanart.GustavoPresm