Anatomy of Electronic Theft

All forms of electronic theft share one significant detail: the hacked computer(s) must communicate with the hackers’ command-and-control servers via the internet. This communication may take any number of forms, but this critical element will always be present.

The most successful hack attacks are not “smash and grab” incidents, but rather long, drawn out operations that may stretch over months or even years (take the example of Nortel, which in the years prior to going out of business was the victim of a years-long breach).

Network breaches tend to follow the same general sequence, once the hacker(s) have broken in:

1. The hacker looks around the network and downloads file names from the networked computers. He or she will likely also install a small “sniffer” program to capture login names, passwords and other credentials and periodically send them to the command-and-control server.
2. The hacker reviews the list of file names, to get an idea of which ones would be of interest and steal them a few at a time, likely along with email contact lists.
3. Over the next weeks and month, the hacker will continue to download files and look for additional lucrative data, a little at a time to avoid attracting notice by bogging down the network or internet connection.
4. At a certain point, the hacker may begin to peruse the network less often, but leave a backdoor into the network (probably on several of the network’s computers) so that they can easily return later to search for more data or install spamware, spyware and other types of malware. Hacker’s also have use for any computer’s raw computing power, so they may also install botnet malware to use the network’s computers to mount attacks against other networks or perpetrate click fraud (read more about botnet click fraud and its dangers in our report: Marketing Cybercrime to Infect America).

An important thing to realize about electronic theft is that 99% of hack attacks are random. Oftentimes cyber-criminals simply put out a widespread probe for vulnerabilities, just to see what they can find. They generally don’t target specific individuals or organizations, but rather get in where they can, take what they can and use it, sell it or exploit it.

The Business of Cybercrime

Though the idea of a “cyber-mafia” may sound laughable, electronic theft has become an organized criminal business, employing full-time hackers (usually overseas, often in places like China, Russia, India and Eastern Europe) to develop and execute new techniques for overcoming firewall security and get at sensitive information. Every computer connected to the internet is a target and potentially useful not only for the data it contains, but also for its raw computing power, regardless of ownership, location or operating system.

The most coveted data are an individual or organization’s financial details (including banking credentials, account numbers, credit cards and billing addresses) and identification (such as social security numbers and drivers license numbers). Another area of growing interest to hackers are medical records, not so much for the information on symptoms and diagnoses, but for the medical insurance and billing data. This stolen information is quite lucrative for the hacker, while creating headaches and liability for the organization from which it was stolen.

In an environment where firewall and antivirus technologies are reactionary, always a step behind the newest hacking techniques and malware, perimeter security has become inadequate to stop the tide of intrusions. No firewall, IDS, IPS or antivirus out there is up to the task of preventing all malware and breach techniques from getting into networks, therefore a strategy beyond a bigger and better firewall is necessary to defeat electronic theft.

Strategies

While physical theft is easy to detect (i.e. something tangible is missing), electronic theft is another matter entirely. Herein lies the difficulty in defeating electronic theft. When cybercriminals steal data from a computer, that data is not missing – it is still there on the hard drive, as if nothing had happened.

The main obstacle to combating data theft is detection. It is very common for electronic theft to be suspected only several months or years after the fact, sometimes only by accident, and even then it is usually difficult to know exactly what happened, unless the IT / network administrator was forward-thinking and implemented a continuous packet capture solution on the network.

The best, most reliable and economical way to detect and gather evidence of hack attacks, breaches and electronic theft is to monitor and record internet and network activity. With this packet capture evidence, investigators and network administrators can see the hacker’s illicit communications between the infected machines and the command-and-control server. All internet-based data theft requires this “umbilical cord” of communications back to the hacker and with continuous packet capture one can ferret them out and identify the when, what and how’s of electronic theft, including which particular data was stolen or compromised.

IPCopper packet capture appliances provide exactly the visibility into network activity to detect and combat electronic theft. The captured network data provides the knowledge necessary to take appropriate and effective action to mitigate intrusions and improve cybersecurity practices. Further, nothing can bypass IPCopper – the appliances provide reliable, uninterrupted, continuous packet capture for network monitoring and surveillance, allowing you to catch hostile transmissions, detect attempted intrusions, monitor general network activity and formulate incident response plans and cybersecurity protocols based on the actual, current threats to your network. Additionally IPCopper packet capture provides a way to check the success and thoroughness of malware removal processes and test firewall security performance.