Social Networks and Prosecuting the Cybercrime Mafia

Credit: Drexel University
 
 
This social network graph which was generated from messages sent
between members of a cybercrime forum called Carders, was created
by researchers from Drexel's Privacy, Security and Automation Lab.
It illustrates the "gang-like" structure that exists in cybercrime forums.
The larger dots are the "most connected" members of each group, but
the group sizes appear to be limited to just over 100 members and
there is little interconnection between groups.

Notorious gangsters Al Capone and Carlo Gambino were famously done in by tax evasion charges. John Gotti, the "Teflon Don" was given up by a confidant. While the criminal masterminds of today are conducting their nefarious business online, the key to taking them down depends on understanding how they organize and where to squeeze them. Researchers from Drexel University's Privacy, Security and Automation Lab are searching for that pressure point by studying the activity of cybercrime forums -- information that could guide the next generation of "Untouchables."

As part of National Science Foundation-funded research, Rachel Greenstadt, PhD, an associate professor in the College of Computing & Informatics and director of the lab; Vaibhav Garg, PhD, a former postdoctoral researcher at PSAL, Rebekah Overdorf a doctoral researcher in the lab; and their associate Sadia Afroz from the University of California -- Berkeley; broke down several years-worth of conversations between members of four cybercrime forums that were anonymously made public a few years ago.

What does organized crime really mean in cyberspace?
"We tried to answer the question 'what does organized crime really mean in cyberspace?'" said Garg. "To understand how criminals are 'organized' with people halfway around the world."

Using six centrality-finding formulas, whose variations are part of the algorithms running Google's search engine, Klout's ranking system and Facebook's analytics, the team produced visual representations of the forums' organization.

The formulas measure the relative connectedness of any one member in a network to other members. On the Internet a higher score in these analyses might mean a higher page ranking in a Google search. Among social networks, it could equate to a better Klout score.

Six Degrees of Kevin Bacon
In a cybercrime forum it could point out the leaders. The calculation tallies the number of people a person is directly linked to via a conversation or a transaction -- with some stretching of the imagination, the exercise is not unlike a cybercrime version of the parlor game "Six Degrees of Kevin Bacon."

More connected cybercriminals hold a great deal of power in cybercrime forums because they are able to interact directly with a number of other members without going through an intermediary. Adding another person to an interaction begins to erode trust -- and in a forum where people are operating anonymously trust is a commodity in short supply.

"The main challenge to cybercriminal organization is the lack of trust among peers," Overdorf said. "It limits group size and the efficiency of transactions."

By generating maps of the connections within the forums, the team found that online criminal operatives organize in two distinct communities -- both of which will look familiar to any criminologist.

Identifying a cybercrime gang
"We see these members arranging into groups that resemble gangs and mobs," Overdorf said. "This description has to do with their size, the distribution of their leadership and how they conduct business in the forum." Gangs in cyberspace sound a lot like the ones operating in cities for generations. They have one central leader who makes all the decisions for the gang. As a unit, they tend not to have a fixed goal, but will shift their operation to take advantage of the opportunities at hand.

"Gangs seem to go after whatever they can get their hands on," Garg said. "One day it could be stolen credit cards, the next, its bot nets. It's a more quick-and-dirty operation relatively speaking."

Because of their two-tier hierarchy, gangs are limited in size. The team observed that a central leader could only maintain functional, trusted connections with about 150 members. This number is significant among cyber scholars and sociologists, who call it the Dunbar Number. It's shown to be the maximum number of meaningful relationships one person can actively maintain -- a theory that informs everything from Facebook's news feed to the size of corporate offices.

Identifying a cybercrime mob
By contrast, the cybercrime "mobs" that the team observed had hundreds or even thousands of members divided into multiple sub-groups each operating within a particular illegal revenue stream. For example a group of 800 members of the forum called "Carders" primarily discussed drugs. A mob that included 1,447 members in the "L33tCrew" forum handled stolen Apple devices. Instead of having just one central leader, like a gang, several members of the mob share relatively equal centrality rankings.

To get from Dunbar's 150 to the thousand-member mobs that the Drexel researchers observed, it requires this broad distribution of leadership. And for this to occur there must be a system in place for earning trust and punishing those who violate it.

Howdunit:
How Crimes Are
Committed and Solved
by John Boertlein

Click on image to order
The trope of becoming a "made man," or earning trust by performing a task to show loyalty, is central to the existence of organized crime. Joining the "family" in the parlance of organized crime, means the person is trusted.

In organized cybercrime, members earn trust by having positive transactions; meaning they deliver the goods they've promised. When they don't deliver or deliver bad or faulty products, they can be banned from the group. Members can also be banned if it is discovered that they have duplicate accounts, in an attempt to manipulate the market for their goods or otherwise deceive members of the forum.

Being kicked out of the group isn't as final a penalty in organized cybercrime as the, often fatal, recourse doled out to the mafia's "moles," "rats" and "stoolies." Cyber operators can simply rejoin or use an undetected duplicate account to gain admittance.

The challenge that this fickle formulation of trust poses for law enforcement is that while it might be relatively easy to gain admittance to a forum, it wouldn't be efficient to attempt to identify perpetrators. Few forum members would trust another member's identity, even within the context of the forum duplicate accounts are quite common. Trust is based on transactions, so that's where the team's research would advise law enforcement to make its move.

"We saw sub groups that specialized in everything from stolen credit card numbers, to drugs, to stolen hardware," Garg said. "But each forum shares a common characteristic: the e-currency it used. Some accepted payment on Paypal, other used WMZ or PSC for transactions, but every cybercriminal needs a way to get their money."

This situation could be a point of vulnerability for organized cybercriminals -- and one that could be exploited by law enforcement, according to the researchers.

A bottleneck in currencies
"There is a bottleneck with the currencies -- even cyber criminals need to have a way to clean their money," Garg said. "E-currency companies already have the ability to collect information on who is using their product, if they are made to enforce laws or divulge criminal activities to authorities, it could be a way to catch cybercriminals or at least limit their activity."

Garg notes that this method could also clarify the murkiness of international laws regarding cybercrime. If a cybercriminal is tracked to another country, it may be difficult to extradite them in order to prosecute. But if law enforcement follows the money trail -- much like the federal agents reeling in Capone in 1920s -- it might be possible to bring even the cagiest of organized cybercriminals to justice.

Related stories:

*  *  *  *  *
Story Source:  Materials provided by Drexel University.  "Formulas that drive social networks help illuminate organized cybercrime." ScienceDaily, 13 April 2015.

Comments

Post a Comment

Popular posts from this blog

Workout supplements: An emerging eating disorder in men?

Image
therewontbeanydoves.wordpress.com When developing a fictional character, you may not think about the character using large amounts of over-the-counter dietary supplements.  Especially a man who uses large amounts of workout supplements. While there has been widespread publicity on the dangers of the non-prescribed use of anabolic steroids, not much is said about legal, over-the-counter supplements.  Are there risks?  And if so, what are they?  There are several things the writer should consider. Supplement use is becoming an eating disorder with many men who use them to prepare for and recover from a workout. There is growing evidence of a link between muscle-building supplements and testicular cancer. There is evidence that over-the counter medications and supplements are the most common causes of drug-induced liver failure (a rare event, but still a risk.)  There is even evidence that, “certain popular herbal and dietary supplements can also ...
Read more

Remember faces but not names? You got it wrong.

Image
Source:   Daily Excelsior So, you think you're good at remembering faces, but terrible with names? New research has revealed we are actually better at remembering names than faces The cringe-worthy experience of not being able to remember an acquaintance's name leads many of us to believe we are terrible with names. However, new research has revealed this intuition is misleading; we are actually better at remembering names than faces. With the Christmas party season fast approaching, there will be plenty of opportunity to re-live the familiar, and excruciatingly-awkward, social situation of not being able to remember an acquaintance's name. This cringe-worthy experience leads many of us to believe we are terrible at remembering names. However, new research has revealed this intuition is misleading; we are actually better at remembering names than faces. The authors of the study, from the University of York, suggest that when we castigate ourselves f...
Read more

Children's drawings during abuse investigations

Image
Source:  rutherfordcountytn.gov I llustrations by children can be a critical tool in forensic investigations of child abuse. A recent study compared the results when child abuse victims were offered the opportunity to draw during questioning with results when victims were not offered this opportunity. "The act of drawing was not only an empowering experience for these children," said Dr. Katz. "We also found it to be forensically more effective in eliciting richer testimonies in child abuse cases. We had no idea the gap would be so great between those who drew and those who weren't given this option." A chance to express themselves Some 125 alleged child victims of sexual abuse were randomly selected for the field study. The children, aged 5-14, were questioned by nine well-trained forensic interviewers about a single occurrence of alleged sexual abuse. The children were divided into two sets -- a control group, questioned and allowed to rest during t...
Read more

Unhappy in a relationship? Why do you stay?

Image
Source:   Power of Positivity A story that may effect the development of your romantic comedies.  Why do people stay in unhappy relationships?  Simply put, it's concern for the partner of the unhappy person. This research doesn't offer solutions to this situation, but does help our understanding of why people behave the way they do. NOTE:  Within five minutes this post had 16 hits, the fastest hit rate of any story I've posted.  Might say something of how people feel. Here's the story: *  *  *  *  * When you are unhappy in a relationship, why do you stay?  The answer may surprise you. Study that finds it's not just the investment of time, resources and emotion Why do people stay in unsatisfying romantic relationships? A new study suggests it may be because they view leaving as bad for their partner. The study, being published in the November 2018 issue of the Journal of Personality and Social Psychology, e...
Read more

M.I.T. Research Explains How Will Rogers Observation Works

Image
Finally it appears that MIT has gotten involved in proving Will's syllogism, "There are three kinds of men. The one that learns by reading. The few who learn by observation. The rest of them have to pee on the electric fence for themselves." Read his statement carefully.   ONE learns by reading.   A FEW who learn by observation. Then there's the rest of us. The reason for this, it turns out, is a special circuit in the brain that you or I need to have a functioning version of to actually learn by observing others.  Based on how we all behave, it is a circuit most of us must be missing.   Or perhaps it shorted out the first time we peed on an electric fence and it has yet to grow back.   *  *  *  *  * Brain circuit helps us learn by watching others Scientists pinpoint neural interactions that are necessary for observational learning Researchers have identified a brain circuit requir...
Read more