Social Networks and Prosecuting the Cybercrime Mafia

Credit: Drexel University
 
 
This social network graph which was generated from messages sent
between members of a cybercrime forum called Carders, was created
by researchers from Drexel's Privacy, Security and Automation Lab.
It illustrates the "gang-like" structure that exists in cybercrime forums.
The larger dots are the "most connected" members of each group, but
the group sizes appear to be limited to just over 100 members and
there is little interconnection between groups.

Notorious gangsters Al Capone and Carlo Gambino were famously done in by tax evasion charges. John Gotti, the "Teflon Don" was given up by a confidant. While the criminal masterminds of today are conducting their nefarious business online, the key to taking them down depends on understanding how they organize and where to squeeze them. Researchers from Drexel University's Privacy, Security and Automation Lab are searching for that pressure point by studying the activity of cybercrime forums -- information that could guide the next generation of "Untouchables."

As part of National Science Foundation-funded research, Rachel Greenstadt, PhD, an associate professor in the College of Computing & Informatics and director of the lab; Vaibhav Garg, PhD, a former postdoctoral researcher at PSAL, Rebekah Overdorf a doctoral researcher in the lab; and their associate Sadia Afroz from the University of California -- Berkeley; broke down several years-worth of conversations between members of four cybercrime forums that were anonymously made public a few years ago.

What does organized crime really mean in cyberspace?
"We tried to answer the question 'what does organized crime really mean in cyberspace?'" said Garg. "To understand how criminals are 'organized' with people halfway around the world."

Using six centrality-finding formulas, whose variations are part of the algorithms running Google's search engine, Klout's ranking system and Facebook's analytics, the team produced visual representations of the forums' organization.

The formulas measure the relative connectedness of any one member in a network to other members. On the Internet a higher score in these analyses might mean a higher page ranking in a Google search. Among social networks, it could equate to a better Klout score.

Six Degrees of Kevin Bacon
In a cybercrime forum it could point out the leaders. The calculation tallies the number of people a person is directly linked to via a conversation or a transaction -- with some stretching of the imagination, the exercise is not unlike a cybercrime version of the parlor game "Six Degrees of Kevin Bacon."

More connected cybercriminals hold a great deal of power in cybercrime forums because they are able to interact directly with a number of other members without going through an intermediary. Adding another person to an interaction begins to erode trust -- and in a forum where people are operating anonymously trust is a commodity in short supply.

"The main challenge to cybercriminal organization is the lack of trust among peers," Overdorf said. "It limits group size and the efficiency of transactions."

By generating maps of the connections within the forums, the team found that online criminal operatives organize in two distinct communities -- both of which will look familiar to any criminologist.

Identifying a cybercrime gang
"We see these members arranging into groups that resemble gangs and mobs," Overdorf said. "This description has to do with their size, the distribution of their leadership and how they conduct business in the forum." Gangs in cyberspace sound a lot like the ones operating in cities for generations. They have one central leader who makes all the decisions for the gang. As a unit, they tend not to have a fixed goal, but will shift their operation to take advantage of the opportunities at hand.

"Gangs seem to go after whatever they can get their hands on," Garg said. "One day it could be stolen credit cards, the next, its bot nets. It's a more quick-and-dirty operation relatively speaking."

Because of their two-tier hierarchy, gangs are limited in size. The team observed that a central leader could only maintain functional, trusted connections with about 150 members. This number is significant among cyber scholars and sociologists, who call it the Dunbar Number. It's shown to be the maximum number of meaningful relationships one person can actively maintain -- a theory that informs everything from Facebook's news feed to the size of corporate offices.

Identifying a cybercrime mob
By contrast, the cybercrime "mobs" that the team observed had hundreds or even thousands of members divided into multiple sub-groups each operating within a particular illegal revenue stream. For example a group of 800 members of the forum called "Carders" primarily discussed drugs. A mob that included 1,447 members in the "L33tCrew" forum handled stolen Apple devices. Instead of having just one central leader, like a gang, several members of the mob share relatively equal centrality rankings.

To get from Dunbar's 150 to the thousand-member mobs that the Drexel researchers observed, it requires this broad distribution of leadership. And for this to occur there must be a system in place for earning trust and punishing those who violate it.

Howdunit:
How Crimes Are
Committed and Solved
by John Boertlein

Click on image to order
The trope of becoming a "made man," or earning trust by performing a task to show loyalty, is central to the existence of organized crime. Joining the "family" in the parlance of organized crime, means the person is trusted.

In organized cybercrime, members earn trust by having positive transactions; meaning they deliver the goods they've promised. When they don't deliver or deliver bad or faulty products, they can be banned from the group. Members can also be banned if it is discovered that they have duplicate accounts, in an attempt to manipulate the market for their goods or otherwise deceive members of the forum.

Being kicked out of the group isn't as final a penalty in organized cybercrime as the, often fatal, recourse doled out to the mafia's "moles," "rats" and "stoolies." Cyber operators can simply rejoin or use an undetected duplicate account to gain admittance.

The challenge that this fickle formulation of trust poses for law enforcement is that while it might be relatively easy to gain admittance to a forum, it wouldn't be efficient to attempt to identify perpetrators. Few forum members would trust another member's identity, even within the context of the forum duplicate accounts are quite common. Trust is based on transactions, so that's where the team's research would advise law enforcement to make its move.

"We saw sub groups that specialized in everything from stolen credit card numbers, to drugs, to stolen hardware," Garg said. "But each forum shares a common characteristic: the e-currency it used. Some accepted payment on Paypal, other used WMZ or PSC for transactions, but every cybercriminal needs a way to get their money."

This situation could be a point of vulnerability for organized cybercriminals -- and one that could be exploited by law enforcement, according to the researchers.

A bottleneck in currencies
"There is a bottleneck with the currencies -- even cyber criminals need to have a way to clean their money," Garg said. "E-currency companies already have the ability to collect information on who is using their product, if they are made to enforce laws or divulge criminal activities to authorities, it could be a way to catch cybercriminals or at least limit their activity."

Garg notes that this method could also clarify the murkiness of international laws regarding cybercrime. If a cybercriminal is tracked to another country, it may be difficult to extradite them in order to prosecute. But if law enforcement follows the money trail -- much like the federal agents reeling in Capone in 1920s -- it might be possible to bring even the cagiest of organized cybercriminals to justice.

Related stories:

*  *  *  *  *
Story Source:  Materials provided by Drexel University.  "Formulas that drive social networks help illuminate organized cybercrime." ScienceDaily, 13 April 2015.

Comments

Post a Comment

Popular posts from this blog

Greek Bronze Age ended 100 years earlier than thought

Image
Source: www.shef.ac.uk The charred remains of Assiros Toumba in Greece. Writing historical fiction set in the Greek Bronze Age?  Or simply enjoy reading this genre'?  Here's a study you may find interesting. C onventional estimates for the collapse of the Aegean civilization may be incorrect by up to a century, according to new radiocarbon analyses. While historical chronologies traditionally place the end of the Greek Bronze Age at around 1025 BCE, this latest research suggests a date 70 to 100 years earlier. www.weather-forecast.com Archaeologists from the University of Birmingham selected 60 samples of animal bones, plant remains and building timbers, excavated at Assiros in northern Greece, to be radiocarbon dated and correlated with 95.4% accuracy using Bayesian statistical methodology at the University of Oxford and the Akademie der Wissenschaften Heidelberg, Germany. Researcher Dr Ken Wardle says, 'These new results tell a story that is totall
Read more

How the lives of Georgian gaolbirds and highwaymen shaped modern Britain

Image
Writing historical fiction requires solid research of available materials and databases.  The key word here is available.   So news of a new publicly accessible database that allows an author to research a very interesting past era is priceless almost beyond words.   I expect some exciting fiction to come out of this announcement. Here's the story, with a link to the source in the attribution. *  *  *  *  * London Lives, a landmark project led by Professor Bob Shoemaker from the University of Sheffield and Professor Tim Hitchcock from the University of Sussex, has uncovered a mass of extraordinary new evidence which reveals how the lives of thousands of 18th-century poor and criminal Londoners helped shape modern Britain. Based on evidence made available in a publicly available database, the study sheds new light on the everyday lives of thieves, prostitutes, vagrants, highwaymen, con-men, paupers and jailbirds, revealing how their daily fight for survival led to t
Read more

Mood Instability and Your Characters

Image
You're putting together a character who's mood simply bounces all over the place, happy one moment, in a fit of rage the next.  Researchers at King's College London note that this sort of mood instability is part of a number of mental health disorders.  So how do you structure the personality and behavior of a character like this?  Below is the King's College report, along with a brief description from mentalhealth.com, of typical behavior, sometimes in the extreme, of a person who is very emotionally unstable.  This is offered strictly as a guide for crafting character in fiction - and NOT for the amateur diagnosis of the state of someone's mental health.  That is always best left to trained professionals. Another note about emotionally unstable behavior:  as any parent will tell you, this is how adolescents and teen-agers often behave.  It's a normal part of growing up - but it is a matter of degree .  In the extreme, however, this behavior can be diag
Read more

Remember faces but not names? You got it wrong.

Image
Source:   Daily Excelsior So, you think you're good at remembering faces, but terrible with names? New research has revealed we are actually better at remembering names than faces The cringe-worthy experience of not being able to remember an acquaintance's name leads many of us to believe we are terrible with names. However, new research has revealed this intuition is misleading; we are actually better at remembering names than faces. With the Christmas party season fast approaching, there will be plenty of opportunity to re-live the familiar, and excruciatingly-awkward, social situation of not being able to remember an acquaintance's name. This cringe-worthy experience leads many of us to believe we are terrible at remembering names. However, new research has revealed this intuition is misleading; we are actually better at remembering names than faces. The authors of the study, from the University of York, suggest that when we castigate ourselves f
Read more

Poor Mental Health, Casual Sex Reinforce Each Other

Image
Self-loathing and disgust are all too often the result of a one night stand - for both men and women. Now study suggests that poor mental health and casual sex actually feed off each other in teens and young adults, with each one contributing to the other over time. Researchers found that teens who showed depressive symptoms were more likely than others to engage in casual sex as young adults. In addition, those who engaged in casual sex were more likely to later seriously consider suicide. “Several studies have found a link between poor mental health and casual sex, but the nature of that association has been unclear,” said Sara Sandberg-Thoma, lead author of the study at The Ohio State University. “There’s always been a question about which one is the cause and which is the effect. This study provides evidence that poor mental health can lead to casual sex, but also that casual sex leads to additional declines in mental health.” Poor mental health and casual sex  linked
Read more