Cyber Crime Investigation & Digital Forensic (CY-601) - Unit 4 Short Notes

UNIT 4: CYBER CRIME INVESTIGATION & DIGITAL FORENSIC

I. FOUNDATIONS OF CYBERCRIME

A. Definition, Nature, and Global Extent

Definition:

Cybercrime refers to any illegal activity involving a computer, network, or the internet. It encompasses crimes where the computer is the tool, target, or medium of the offense.

Nature of Cybercrime:

• Borderless: Can be committed from anywhere, affecting victims globally.

• Anonymous: Perpetrators can hide identities using encryption, proxies, and dark web.

• Evolving: Techniques constantly change with technology.

• Technology-Dependent: Requires digital infrastructure to execute and scale.

• Low Risk, High Reward: Often perceived as having a lower chance of getting caught compared to physical crime.

Global Extent & India's Position:

[!TIP] Exam Focus: Be ready to cite specific stats (like cost projections) and contrast India's threat landscape (volume of frauds) with that of the US/EU (sophisticated APTs).

B. Cybercrime vs. Conventional Crime

Example:

• Conventional Robbery: Physically entering a bank with a weapon.

• Cyber Robbery: Using credential stuffing (a form of automated attack) to log into online banking accounts from another country.

C. Classifications of Cybercrimes

1. Based on Target:

• Against Individuals: Cyberstalking, cyberbullying, identity theft, email spoofing.

• Against Property: Credit card fraud, intellectual property theft (software piracy), salami attacks, data diddling.

• Against Government: Cyberterrorism, hacking government websites, denial-of-service attacks on national infrastructure.

• Against Society: Pornography (child/obscene), trafficking, online gambling, spread of hate speech.

2. Based on Method:

• Malware-Based: Viruses, worms, trojans, ransomware.

• Fraud-Based: Phishing, vishing, smishing, e-commerce fraud, credit card skimming.

• Hacking-Based: Unauthorized access (cracking), web jacking, session hijacking.

• Harassment-Based: Cyberstalking, cyberbullying, trolling.

• Concealment-Based: Steganography, encryption for illicit communication.

II. CYBERCRIME TECHNIQUES AND ATTACK VECTORS

A. Malware Threats

1. Viruses, Worms, and Logic Bombs

2. Detection and Prevention of Malware

• Detection: Signature-based AV, Heuristic/Behavioral Analysis (sandboxing), anomaly detection (unusual network traffic).

• Prevention: Patch Management, Principle of Least Privilege, application whitelisting, email filtering, user security awareness training, network segmentation.

B. Financial and Fraudulent Crimes

1. Credit Card Frauds

• Modus Operandi:

  • Skimming: Physical device on ATMs/POS terminals to capture magstripe data.

  • Phishing/Pharming: Tricking users into entering details on fake sites.

  • Data Breaches: Hacking databases to steal stored card details (PANs).

• Preventive Measures: Tokenization (replaces PAN with token), EMV chips, dynamic CVV, AI/ML transaction monitoring for anomaly detection.

2. E-commerce Frauds

• Challenges: Fake websites, triangulation fraud (fake seller, real product), delivery fraud (false "not received" claims), payment gateway compromise.

• Countermeasures: Secure payment gateways (PCI-DSS compliant), 3D Secure (additional auth step), buyer/seller verification, robust review systems.

3. Cloud-based Frauds

• Methods: Account takeover (credential stuffing), exploiting misconfigured storage buckets (S3), API abuse (excessive calls, data exfiltration), cryptojacking.

• Prevention: Cloud Security Posture Management (CSPM), strict IAM policies, encryption (at rest & transit), API rate limiting, continuous monitoring.

4. Online Frauds (General)

• Types: Lottery scams, job frauds (fake offers), investment scams ( Ponzi/crypto), romance scams.

• Prevention: Public awareness campaigns, verification of entities (on MCA/ROC for companies), "Too good to be true" skepticism, secure communication channels for transactions.

C. Common Attack Methods

1. Phishing

• Concept: Sending fraudulent communications (email, SMS, call) to trick victims into revealing sensitive data or installing malware.

• Variants:

  • Spear Phishing: Targeted, personalized (uses victim's name/role).

  • Whaling: Spear phishing aimed at senior executives ("CEO fraud").

• Threats: Credential theft, malware delivery, financial fraud.

• Detection/Prevention: Email filtering (DMARC, SPF, DKIM), user education, URL scanning, MFA.

2. Steganography

• Concept: Hiding malicious data within benign carrier files (images, audio, video, text).

• Threats: Covert C2 communication, data exfiltration bypassing DLP, hiding malware.

• Detection: Statistical analysis (file size anomalies), forensic tools (Stegdetect, binwalk), checksum comparison.

3. Data Diddling

• Concept: Altering data before/during entry into a system (e.g., changing salary amounts in payroll file before processing).

• Detection: Input validation, audit trails (who changed what/when), checksums/hashing for data integrity verification.

• Prevention: Segregation of duties, access controls, version control for critical files.

4. Salami Attacks

• Concept: Making very small, undetectable financial deductions from a large number of accounts (e.g., rounding down interest, $0.01 per transaction).

• Detection: Anomaly detection in transaction volumes/patterns, regular reconciliation processes.

• Prevention: Setting minimum transaction thresholds, segregation of duties, automated alerts for rounding discrepancies.

5. Web Jacking

• Concept: Hijacking a website or user session. Includes DNS hijacking, session hijacking (stealing session cookies), or taking control of a domain.

• Prevention: Strong authentication (MFA), secure session management (use HTTPS, regenerate session IDs), DNSSEC, regular security audits.

6. Cross-Site Scripting (XSS)

• Concept: Injecting malicious scripts into trusted web pages viewed by other users.

• Types: Stored (persistent), Reflected (non-persistent), DOM-based.

• Prevention: Input sanitization/validation, Output encoding, Content Security Policy (CSP) headers.

7. Social Engineering

• Role: The human element is the weakest link. Primary vector for initial compromise.

• Techniques: Pretexting (creating false scenario), Baiting (leaving infected USB), Quid Pro Quo (offering help for info), Tailgating.

• Countermeasures: Security awareness training, phishing simulations, verification protocols (call back), principle of least privilege.

8. Hacking vs. Cracking

9. Crimes on Social Networking Sites

• Types: Fake profiles/identity theft, cyberbullying/harassment, spreading rumors/defamation, catfishing, privacy violations, grooming.

• Preventive Measures: Strong privacy settings, reporting mechanisms, user education on oversharing, platform-level content moderation.

D. Cyber Harassment and Defamation

1. Cyberstalking and Cyberbullying

• Effects on Mental Health: Anxiety, depression, fear, trauma, social withdrawal, in extreme cases, suicide.

• Measures to Combat:

  • Legal: IT Act, 2000 (Section 66A - now struck down, but other sections apply), IPC (Section 354D for stalking), POCSO Act for child victims.

  • Support: Counseling, helplines (e.g., 1090 for women), cybercrime reporting portals.

  • Platform: Strict policies, rapid takedown of abusive content, blocking features.

2. Cyber Defamation

• Concept: Publishing false statements online that harm a person's reputation.

• Legal Implications:

  • IPC: Sections 499 (defamation), 500 (punishment), 501 (printing defamatory matter).

  • IT Act: Section 66A (now limited applicability), Section 79 (intermediary liability - safe harbor if due diligence followed).

  • Remedies: Civil suit for damages, criminal complaint, temporary injunctions for content removal.

III. IMPACTS OF CYBERCRIME

A. Psychological Impact

• On Individuals: Trauma, persistent fear, loss of trust in technology, anxiety, PTSD (from cyberbullying/stalking), sense of violation.

• On Organizations: Employee stress and burnout after a breach, decline in morale, fear of making errors, loss of productivity during incident response.

B. Sociological Impact

• On Society: Erosion of social trust, normalization of online abuse, polarization, behavioral changes (self-censorship, isolation), weakening of social cohesion.

• On Corporations: Reputational damage leading to customer attrition, loss of investor confidence, operational disruption, increased scrutiny from regulators.

• On Governments: Loss of public confidence in digital initiatives, pressure to enact stricter laws, national security concerns (critical infrastructure attacks), shift in policy priorities.

C. Economic Impact

• On Businesses: Direct financial loss (fraud, ransom), recovery costs (forensics, legal, PR), regulatory fines (GDPR, PDPB), increased insurance premiums, lost revenue during downtime.

• On Governments: Cost of infrastructure repair, law enforcement & CERT expenses, economic espionage losses, reduced foreign investment due to perceived insecurity.

• Global Burden: Estimated $10.5 trillion annual cost by 2025. Includes data loss, business disruption, reputational harm, and theft of intellectual property.

[!TIP] Exam Tip: Link impacts directly to examples. E.g., "A ransomware attack on a hospital (sociological impact: risk to patient lives) leads to operational disruption (economic impact: lost revenue, recovery cost) and patient/employee trauma (psychological impact)."

IV. INVESTIGATION AND ANALYSIS IN CYBERCRIME

A. Intrusion Analysis

1. Concept and Importance

• Concept: The process of examining digital evidence to determine the who, what, when, where, why, and how of a security incident.

• Importance: Identifies active threats, understands adversary Tactics, Techniques, and Procedures (TTPs), scopes the breach, collects evidence for legal action, improves future defenses.

2. Methods for Identifying Intrusion Patterns

• Log Analysis: Primary source. Correlate system logs (event logs), network logs (firewall, IDS/IPS), application logs.

• Indicators of Intrusion (IoIs): Unusual outbound traffic, failed login spikes (brute force), anomalous process execution, new admin accounts, presence of known malware hashes.

• Pattern Recognition:

  • Signature-Based: Matches known attack patterns (less effective for zero-days).

  • Anomaly-Based: Establishes a baseline of normal activity and flags deviations (requires tuning).

3. Intrusion Kill Chain (Lockheed Martin)

A model to describe the stages of a cyber attack:

Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control (C2) → Actions on Objectives

Role in Delaying/Degrading Adversary: By placing detection and disruption controls at each stage (e.g., email filtering at Delivery, patching at Exploitation, network segmentation at C2), the attack can be stopped before reaching the final objective.

[!DIAGRAM: CANVAS] Draw the Intrusion Kill Chain as a linear diagram with 7 stages. Annotate each stage with a brief example (e.g., Reconnaissance: scanning; Delivery: phishing email).

B. Fraud Detection and Prevention Frameworks

1. Fraud Triangle Theory (Cressey)

Proposes three elements that must converge for fraud to occur:

• Pressure: Financial need, greed, addiction, personal problems.

• Opportunity: Weak internal controls, lack of oversight, ability to override controls.

• Rationalization: "I deserve this," "I'll pay it back," "They cheat too."

• Application: Helps investigators identify control weaknesses (Opportunity) and behavioral red flags (Pressure, Rationalization) to design preventive controls (e.g., mandatory vacations to detect fraud, segregation of duties to remove Opportunity).

2. Fraud Detection Techniques

• Data Analytics: Transaction monitoring (thresholds, velocity checks), outlier detection (Benford's Law for financial data), link analysis to find collusion.

• AI/ML Approaches: Predictive modeling (risk scoring), behavioral analytics (baseline user/entity behavior), natural language processing (NLP) to analyze communications for fraud intent.

C. Psychological Aspects and Profiling of Cybercriminals

1. Psychological Traits and Motivations

• Motivations: Financial gain, ideology/hacktivism, thrill/ego ("challenge"), revenge, curiosity, espionage (state-sponsored).

• Psychological Theories:

  • Routine Activity Theory: Crime occurs when a motivated offender, suitable target, and absence of capable guardian converge in time/space. (Applies to phishing: attacker + vulnerable user + no training).

  • Rational Choice Theory: Offenders weigh costs vs. benefits. Cybercrime's low perceived risk of capture increases its attractiveness.

2. Criminal Profiling

• Concepts:

  • Deductive Profiling: Based on physical evidence from the specific crime scene (less common in cyber).

  • Inductive Profiling: Based on statistical data from known offenders (more common). Analyzes TTPs, malware code style, language, target selection.

• Significance:

  • Links incidents to a single actor/group (attribution).

  • Prioritizes suspects for investigation.

  • Predicts future targets based on MO.

  • Informs defensive strategies (e.g., if profiler notes attacker uses specific tools, block those IOCs).

D. Analytical Techniques in Investigation

1. Log Analysis

• Importance: Creates timeline of events, identifies attack vector, scopes compromise, provides admissible evidence.

• Process:

  1. Collection & Preservation: Secure logs (syslog, Windows Event logs, firewall logs) with chain of custody. Use write-blockers if on disk.

  2. Analysis: Use tools (SIEM, ELK Stack, Splunk, PowerShell). Look for IoIs (failed logins, unusual ports, process creation).

  3. Interpretation: Correlate events across sources to build narrative. E.g., [Firewall: Port 4444 inbound] → [IDS: Malware signature match] → [System: New process 'svchost.exe' from temp folder].

• Example: Detecting a brute-force attack by analyzing authentication logs for a high volume of failed login attempts from a single IP within a short time window.

2. Modus Operandi (MO) Analysis

• Definition: The characteristic pattern of methods used by an offender to commit a crime.

• Importance:

  • Crime Linking: Determines if separate incidents are by the same actor (e.g., same phishing kit, same malware variant, same command & control server).

  • Pattern Recognition: Identifies preferred targets, tools, and tactics.

  • Predictive Policing: Anticipates next likely targets based on MO.

  • Example: An attacker consistently uses a specific type of exploit kit, targets financial sector, and deploys ransomware with a unique ransom note format. This MO links multiple attacks to the same group.

V. GLOBAL TRENDS, POLICIES, AND COUNTERMEASURES

A. Global and Regional Trends in Cybercrime

• Recent Trends:

  • Ransomware-as-a-Service (RaaS): Lower barrier to entry; affiliate models.

  • State-Sponsored Attacks: Espionage, sabotage (e.g., supply chain attacks like SolarWinds).

  • Supply Chain Attacks: Compromising trusted software/vendor to reach multiple victims.

  • AI-Powered Attacks: Automated phishing (deepfake audio/video), vulnerability discovery, evasion of detection.

  • IoT-Based Attacks: Botnets (Mirai), attacks on critical infrastructure (hospitals, grids).

• Geographical Variation: Developed nations face advanced persistent threats (APTs) and large-scale data breaches. Developing nations face high-volume financial frauds and social engineering due to rapid digitization without proportional security awareness.

B. Influence on Cybersecurity Policies

• International Cooperation: Budapest Convention (first international treaty on cybercrime) promotes harmonization of laws & extradition. UN Resolutions encourage national frameworks.

• National Legislative Updates: India's IT Act amendments (proposed), Personal Data Protection Bill (PDPB), GDPR in EU imposing strict breach notification and fines.

• Framework Evolution: NIST Cybersecurity Framework (CSF) and ISO 27001 now emphasize continuous monitoring, threat intelligence, and supply chain risk management.

C. Countermeasures and Prevention Strategies

1. Access Denial and Defensive Measures

• Firewalls & Network Segmentation: Limit lateral movement.

• Zero-Trust Architecture: "Never trust, always verify." MFA, least privilege, micro-segmentation.

• Principle of Least Privilege: Users/apps have minimum access needed.

• Multi-Factor Authentication (MFA): Critical defense against credential theft.

2. Threat Detection and Future Threat Countering

• Proactive Methods:

  • Threat Hunting: Proactively searching networks for hidden threats based on hypotheses.

  • Deception Technology: Decoys/honeypots to lure and study attackers.

  • Threat Intelligence Feeds: Subscribing to IOCs and TTPs from reputable sources.

• Predictive Analytics: Using AI/ML models to forecast attack vectors based on global threat trends and internal anomaly patterns.

3. Education and Awareness

• Security Awareness Training: Regular, engaging training on phishing, social engineering, password hygiene.

• Phishing Simulations: Test and train employees with controlled mock attacks.

• Public Campaigns: Government-led initiatives on cyber hygiene (e.g., "Stay Safe Online").

4. Legal and Regulatory Measures

• Mandatory Breach Reporting: Laws requiring notification to authorities and affected individuals within a timeframe (GDPR, PDPB).

• Data Localization: Storing certain data within national borders (controversial, impacts cloud).

• Cyber Insurance Mandates: For critical infrastructure or as a regulatory requirement.

• International Cooperation: MLATs (Mutual Legal Assistance Treaties) for evidence gathering across borders. Extradition treaties for prosecution.

[!TIP] Exam Focus: Be prepared to connect trends to specific countermeasures. E.g., "The rise of RaaS necessitates threat intelligence sharing and proactive threat hunting." "State-sponsored attacks drive the need for international legal frameworks like the Budapest Convention."