Unit I

Introduction to Cyber Crime

Unit Overview

This unit introduces the fundamental concepts of cybercrime and information security. It establishes the foundation for understanding how cybercrimes are defined, classified, and executed, along with the various actors involved in cybercriminal activities.

Topics Covered

  • Cybercrime Definition
  • Cybercriminal Categories
  • Crime Classifications
  • Attack Methodology
  • Social Engineering
  • Cyber Stalking
  • Botnets
  • Attack Vectors
  • Why Cybersecurity is Needed
  • Cybercrime vs Traditional Crime
  • Cybercrime Motivating Factors

1.1 Cybercrime: Definition and Origins

Definition of Cybercrime

Cybercrime refers to criminal activities carried out using computers, networks, or the internet as the primary tool or target. It encompasses any illegal activity that involves a computer system or network, including unauthorized access, data theft, fraud, and disruption of services.

Detailed Explanation: Cybercrime can be categorized into two main types:

  • Type I - Crimes where computers are the target: These include attacks on computer systems, networks, or data. Examples: hacking, malware attacks, DDoS attacks, and data breaches. The computer itself is the victim of the crime.
  • Type II - Crimes where computers are the tool: Here, computers facilitate traditional crimes. Examples: fraud, identity theft, cyberstalking, and intellectual property theft. The computer is used as an instrument to commit crimes against individuals or organizations.

Characteristics of Cybercrime:

  • Anonymity: Attackers can hide their identity using various techniques like VPNs, proxies, and the Tor network
  • Borderless Nature: Cybercrimes transcend geographical boundaries, making jurisdiction and law enforcement complex
  • Rapid Execution: Attacks can be executed in seconds or minutes, affecting thousands of victims simultaneously
  • Low Cost, High Impact: Minimal resources required to cause significant damage
  • Difficulty in Detection: Sophisticated techniques make detection and attribution challenging

Origin of the Term

The term "cybercrime" emerged in the late 20th century with the proliferation of computer networks and the internet. The prefix "cyber" derives from "cybernetics," coined by Norbert Wiener in 1948, referring to the science of communication and control systems. As computers became interconnected, criminal activities adapted to exploit these new digital environments.

Information Security

Information Security (InfoSec) is the practice of protecting information by mitigating information risks. It involves preventing or reducing the probability of unauthorized access, use, disclosure, disruption, modification, or destruction of information.

The CIA Triad - Core Principles of Information Security

  • Confidentiality: Ensuring that information is accessible only to authorized individuals
    • Definition: Preventing disclosure of information to unauthorized parties
    • Methods: Encryption, access controls, authentication, authorization
    • Example: Encrypting sensitive files, using passwords, implementing role-based access control (RBAC)
    • Violations: Data breaches, eavesdropping, unauthorized access, social engineering
  • Integrity: Maintaining the accuracy and completeness of data throughout its lifecycle
    • Definition: Ensuring data has not been altered or tampered with by unauthorized parties
    • Methods: Hashing (MD5, SHA-256), digital signatures, checksums, version control
    • Example: Using digital signatures for documents, maintaining audit logs, implementing data validation
    • Violations: Data manipulation, unauthorized modifications, malware infections, SQL injection
  • Availability: Ensuring that authorized users have reliable access to information when needed
    • Definition: Guaranteeing timely and reliable access to information systems and data
    • Methods: Redundancy, backups, disaster recovery, load balancing, DDoS protection
    • Example: Regular backups, redundant servers, uninterruptible power supply (UPS), failover systems
    • Violations: Denial of Service (DoS) attacks, hardware failures, natural disasters, ransomware

Extended Security Principles

  • Authentication: Verifying the identity of users or systems (e.g., passwords, biometrics, multi-factor authentication)
  • Authorization: Determining what resources an authenticated user can access (e.g., access control lists, permissions)
  • Non-repudiation: Ensuring that parties cannot deny their actions (e.g., digital signatures, audit logs)
  • Accountability: Tracking user actions for audit and compliance purposes (e.g., logging, monitoring)

Key Points for Examination

  • Cybercrime is any criminal activity involving computers or networks
  • The term originated from cybernetics and gained prominence in the 1990s
  • Information security focuses on the CIA triad
  • Cybercrimes can be against individuals, organizations, or governments

1.2 Who are Cybercriminals?

Definition

Cybercriminals are individuals or groups who use technology, computers, and networks to commit illegal activities for personal gain, ideological purposes, or to cause harm to individuals, organizations, or governments.

Categories of Cybercriminals

Category Description Motivation
Script Kiddies Inexperienced individuals who use existing tools and scripts without deep technical understanding Curiosity, recognition
Hackers Skilled individuals who exploit system vulnerabilities; can be ethical (white hat) or malicious (black hat) Challenge, financial gain, ideology
Hacktivists Individuals who hack for political or social causes Political or social activism
Organized Cybercrime Groups Structured criminal organizations operating sophisticated cyber operations Financial profit
State-Sponsored Actors Hackers employed or supported by nation-states Espionage, sabotage, warfare
Insider Threats Employees or contractors with authorized access who misuse their privileges Revenge, financial gain

Key Points for Examination

  • Cybercriminals range from amateur script kiddies to sophisticated state-sponsored groups
  • Motivations include financial gain, ideology, revenge, and espionage
  • Insider threats are particularly dangerous due to their authorized access
  • The skill level and resources vary significantly across categories

1.3 Classifications of Cybercrimes

Cybercrimes can be classified based on the target, the nature of the offense, and the methodology employed. The following classification provides a comprehensive understanding:

A. Classification Based on Target

1. Crimes Against Individuals

  • Identity theft
  • Cyberstalking
  • Online harassment and bullying
  • Phishing and fraud
  • Defamation and character assassination

2. Crimes Against Property

  • Hacking and unauthorized access
  • Computer vandalism
  • Intellectual property theft
  • Software piracy
  • Data theft and manipulation

3. Crimes Against Organizations

  • Corporate espionage
  • Denial of Service attacks
  • Ransomware attacks
  • Website defacement
  • Financial fraud

4. Crimes Against Government

  • Cyber terrorism
  • Cyber warfare
  • Critical infrastructure attacks
  • Espionage and intelligence gathering

B. Classification Based on Nature of Offense

Type Examples
Financial Crimes Online fraud, credit card theft, money laundering
Data Crimes Data breaches, unauthorized access, data manipulation
Content Crimes Distribution of illegal content, copyright infringement
Access Crimes Hacking, password cracking, privilege escalation

Key Points for Examination:

  • Cybercrimes are classified by target, nature, and methodology
  • Targets include individuals, property, organizations, and governments
  • The same technique may be used across multiple crime categories
  • Classification helps in legal prosecution and policy formulation

1.4 A Global Perspective on Cybercrimes

Cybercrime is a transnational phenomenon that transcends geographical boundaries. Understanding the global perspective is essential for effective prevention and prosecution.

Global Impact of Cybercrime

International Cooperation

Challenges in Global Cybercrime Prevention

  1. Jurisdictional issues across national boundaries
  2. Varying legal frameworks and definitions
  3. Technical challenges in attribution
  4. Rapid evolution of attack methods
  5. Shortage of skilled cybersecurity professionals

Key Points for Examination:

  • Cybercrime is a global phenomenon requiring international cooperation
  • The Budapest Convention is the primary international framework
  • Jurisdictional challenges complicate prosecution
  • Economic impact runs into trillions of dollars globally

1.5 Cybercrime Era: Survival Mantra for Netizens

Netizen: A person who actively uses the Internet and is a citizen of the online community. The term combines "internet" and "citizen."

Essential Security Practices

Practice Description
Strong Password Management Use complex, unique passwords; implement multi-factor authentication
Regular Software Updates Keep operating systems and applications patched and updated
Antivirus Protection Install and maintain reputable security software
Email Vigilance Verify sender identity; avoid suspicious attachments and links
Secure Browsing Use HTTPS connections; avoid public Wi-Fi for sensitive transactions
Data Backup Maintain regular backups of important data
Privacy Settings Configure social media and application privacy settings appropriately

Awareness and Education

1.6 Cyber Offenses: How Criminals Plan Attacks

Attack Planning Methodology

Cybercriminals typically follow a systematic approach when planning and executing attacks:

1. Reconnaissance

The initial phase involves gathering information about the target. This includes:

2. Scanning and Enumeration

3. Gaining Access

4. Maintaining Access

5. Covering Tracks

Key Points for Examination:

  • Attack planning follows a systematic methodology
  • Reconnaissance is the critical first phase
  • Understanding attack methodology helps in defense planning
  • Each phase offers opportunities for detection and prevention

1.7 Social Engineering

Definition:

Social engineering is the psychological manipulation of individuals to divulge confidential information or perform actions that compromise security. It exploits human psychology rather than technical vulnerabilities.

Detailed Explanation: Social engineering is based on the principle that humans are often the weakest link in security. Rather than attempting to break through technical defenses like firewalls or encryption, attackers manipulate people into voluntarily providing access or information. This form of attack is particularly dangerous because:

  • It bypasses technical security controls entirely
  • It's difficult to defend against with technology alone
  • Employees may not recognize they're being attacked
  • It requires minimal technical skills from the attacker
  • Success rates are often higher than technical attacks

Common Targets: Receptionists, help desk personnel, system administrators, employees with access to sensitive data, executives, and new employees who may be less security-aware.

Types of Social Engineering Attacks

Type Description Example
Phishing Fraudulent communications that appear legitimate to steal sensitive data Fake bank emails requesting login credentials
Pretexting Creating a fabricated scenario to extract information Impersonating IT support to obtain passwords
Baiting Offering something enticing to lure victims Infected USB drives left in public areas
Quid Pro Quo Offering a service in exchange for information Free technical support in exchange for login credentials
Tailgating Physically following authorized personnel into restricted areas Following an employee through a secure door
Vishing Voice-based phishing using phone calls Fraudulent calls claiming to be from banks

Psychological Principles Exploited

Key Points for Examination:

  • Social engineering targets human psychology, not technology
  • Phishing is the most common form of social engineering
  • Training and awareness are the primary defenses
  • Multiple psychological principles are exploited simultaneously

1.8 Cyber Stalking

Definition:

Cyber stalking is the use of electronic communications to harass, intimidate, or threaten an individual repeatedly. It involves persistent unwanted contact that causes the victim to fear for their safety.

Detailed Explanation: Cyber stalking is a serious crime that leverages digital technologies to repeatedly target and harass victims. Unlike traditional stalking, cyber stalking can occur 24/7 from any location, making it particularly invasive and difficult to escape. Key aspects include:

  • Pattern of Behavior: Not a single incident, but repeated actions over time
  • Emotional Impact: Causes significant distress, fear, anxiety, or emotional trauma to victims
  • Multiple Channels: Can occur across various platforms (email, social media, messaging apps, forums)
  • Escalation Risk: Often escalates from online harassment to offline stalking or physical threats
  • Anonymous Nature: Perpetrators can hide their identity using fake profiles and anonymous communication tools

Impact on Victims:

  • Psychological trauma, anxiety, depression, and PTSD
  • Disruption of daily life and work
  • Loss of privacy and sense of safety
  • Damage to reputation through defamation
  • Social isolation and relationship problems

Characteristics of Cyber Stalking

Methods Used by Cyber Stalkers

  1. Sending threatening or harassing emails and messages
  2. Posting defamatory content on social media
  3. Creating fake profiles to monitor or contact victims
  4. Tracking victim's location through spyware
  5. Hacking into victim's accounts
  6. Doxing (publishing private information)

Legal Provisions

In India, cyber stalking is addressed under:

Key Points for Examination:

  • Cyber stalking involves repeated electronic harassment
  • It can escalate to physical stalking
  • Victims should document all incidents
  • Legal remedies are available under IT Act and IPC

1.8A Identity Theft

Definition:

Identity Theft is the fraudulent acquisition and use of someone's personal information without their consent for financial gain or other criminal purposes.

Detailed Explanation: Identity theft occurs when a criminal obtains and uses another person's personal identifying information (such as name, social security number, credit card details, or bank account information) to commit fraud or other crimes. The victim may suffer financial loss, damaged credit, and emotional distress.

Types of Identity Theft

Type Description Example
Financial Identity Theft Using stolen credentials for financial transactions Opening credit cards or bank accounts in victim's name
Medical Identity Theft Using someone's identity to obtain medical services or drugs Filing false health insurance claims
Criminal Identity Theft Impersonating someone when arrested or investigated Providing victim's details during a traffic stop
Child Identity Theft Using a minor's personal information for fraud Opening accounts using child's SSN
Synthetic Identity Theft Creating a new identity using a combination of real and fake information Combining real SSN with fake name and address

Methods Used for Identity Theft

Impact on Victims

Prevention Measures

Legal Provisions

In India, identity theft is addressed under:

Key Points for Examination:

  • Identity theft involves using someone's personal information without consent
  • Types include financial, medical, criminal, child, and synthetic identity theft
  • Common methods: phishing, data breaches, social engineering, skimming
  • Punishable under IT Act Section 66C (up to 3 years + Rs. 1 lakh fine)

1.8B Cyber Espionage

Definition:

Cyber Espionage is the use of computer networks to gain unauthorized access to confidential information held by governments, organizations, or individuals for strategic, political, economic, or competitive advantage.

Detailed Explanation: Cyber espionage involves covert cyber operations aimed at stealing sensitive information without the knowledge of the target. Unlike cybercrime motivated by immediate financial gain, cyber espionage focuses on long-term intelligence gathering. It is often state-sponsored but can also be conducted by corporate entities or organized groups.

Key Actors in Cyber Espionage

Actor Type Description Primary Targets
Nation-State Actors Government-backed hackers conducting intelligence operations Government agencies, military, critical infrastructure
Advanced Persistent Threat (APT) Groups Highly sophisticated, often state-sponsored groups using advanced techniques Defense contractors, technology companies, research institutions
Corporate Spies Individuals or groups stealing trade secrets for business advantage Competitors, intellectual property, R&D data

Common Targets of Cyber Espionage

Techniques Used in Cyber Espionage

Notable Cyber Espionage Examples

Difference from Cyber Warfare

Cyber Espionage Cyber Warfare
Focus on gathering intelligence covertly Focus on causing damage or disruption
Goal is to remain undetected Attacks may be overt to demonstrate capability
Non-destructive (data theft) Destructive (sabotage, disruption)
Ongoing intelligence operation Act of aggression between states

Key Points for Examination:

  • Cyber espionage involves covert intelligence gathering through computer networks
  • Often state-sponsored, targeting governments, military, and corporations
  • Uses sophisticated techniques like APTs, zero-day exploits, and spear phishing
  • Different from cyber warfare: espionage is covert and non-destructive
  • Examples: Stuxnet, APT28, Operation Aurora, SolarWinds

1.8C Hackers vs Crackers

Definition:

While often used interchangeably in media, the terms hacker and cracker have distinct meanings in the cybersecurity community.

Detailed Definitions

Hacker

A hacker is a skilled individual who explores computer systems and networks to understand how they work, identify vulnerabilities, and potentially improve security. Hackers can work ethically (with authorization) or maliciously.

Types of Hackers:
  • White Hat Hackers (Ethical Hackers): Security professionals who find vulnerabilities to help organizations improve their defenses. They work with permission and follow legal guidelines.
  • Black Hat Hackers: Malicious hackers who exploit vulnerabilities for personal gain, to steal data, or cause damage without authorization.
  • Grey Hat Hackers: Operate between ethical and malicious, may find vulnerabilities without permission but often report them rather than exploit them.

Cracker

A cracker is an individual who specifically aims to break into systems with malicious intent. The term emphasizes the unauthorized and destructive nature of their activities.

  • Always operates without authorization
  • Intent is malicious: stealing data, causing damage, or personal gain
  • May crack software protection (software piracy)
  • No ethical component to their work

Comparison Table: Hackers vs Crackers

Aspect Hackers Crackers
Intent Can be ethical (to improve security) or malicious Always malicious - to exploit, steal, or damage
Authorization May work with permission (white hat) or without (black hat) Never authorized - always illegal access
Goal Identify vulnerabilities, improve security, or explore systems Personal gain, cause damage, steal data
Skills Deep technical knowledge and understanding May use existing tools without deep understanding
Ethics Ethical hackers follow professional codes No ethical considerations
Legal Status White hats work legally; black hats are criminals Always illegal activity
Employment May be employed as security professionals Work independently or in criminal groups
Output White hats help fix vulnerabilities Exploit vulnerabilities for personal gain

Key Points for Examination:

  • Hacker: Skilled individual exploring systems; can be ethical (white hat) or malicious (black hat)
  • Cracker: Always malicious individual who breaks security for personal gain
  • White hat hackers help organizations improve security legally
  • Crackers never work with authorization and always have harmful intent
  • The distinction emphasizes intent and authorization, not just skill level

1.9 Cybercafe and Cybercrimes

Cybercafe as Crime Venues

Cybercafes present unique security challenges as they provide anonymous access to the internet. They are often exploited for:

Security Concerns in Cybercafes

Concern Description
Keyloggers Hardware or software installed to capture keystrokes
Session Hijacking Previous user sessions not properly terminated
Shoulder Surfing Physical observation of user activities
Malware Infected systems spreading malware to users
Anonymity Lack of user identification enables criminal activities

Regulatory Measures

Various regulations require cybercafes to:

1.10 Botnets: The Fuel for Cybercrime

Definition: A botnet is a network of compromised computers (bots or zombies) controlled remotely by an attacker (botmaster) through a command and control (C&C) server. These networks are used to carry out large-scale malicious activities.

Botnet Architecture

Uses of Botnets

Application Description
DDoS Attacks Overwhelming targets with traffic from multiple sources
Spam Distribution Sending massive volumes of spam emails
Click Fraud Generating fraudulent clicks on advertisements
Cryptocurrency Mining Using victim's computing resources for mining
Data Theft Stealing sensitive information from infected systems
Malware Distribution Spreading additional malware to other systems

Notable Botnets

Botnet Detection Methods

Detection Method Description Tools/Techniques
Network Traffic Analysis Monitoring for unusual C&C communication patterns, suspicious DNS requests, or abnormal traffic volumes Wireshark, Zeek (Bro), NetFlow analysis
Behavioral Analysis Detecting abnormal system behavior such as unexpected processes, high CPU usage, or unusual network connections EDR solutions, SIEM systems
DNS Monitoring Tracking DNS queries to known malicious domains or detecting domain generation algorithm (DGA) patterns DNS firewalls, passive DNS monitoring
Signature-Based Detection Matching known botnet signatures in network traffic or system files Antivirus, IDS/IPS systems
Honeypots and Honeynets Deploying decoy systems to attract and study botnet behavior Dionaea, Cowrie, Honeyd

Botnet Disruption Strategies

Disruption Method Description
Sinkholing Redirecting C&C domain traffic to controlled servers, effectively cutting bot communication with the botmaster
C&C Server Takedown Law enforcement coordination to seize or shut down command and control infrastructure
Bot Disinfection Cleaning infected machines through antivirus updates, removal tools, or ISP notifications to users
Legal Takedowns Court orders to domain registrars and hosting providers to suspend botnet infrastructure
Industry Collaboration Information sharing between security vendors, ISPs, and law enforcement (e.g., Microsoft's DCU operations)

Key Points for Examination:

  • Botnets consist of compromised computers controlled remotely
  • Primary uses include DDoS attacks, spam, and data theft
  • C&C infrastructure is essential for botnet operation
  • Botnets can include millions of infected devices
  • Detection requires both network monitoring and behavioral analysis
  • Disruption often requires collaboration between industry and law enforcement

1.11 Attack Vectors

Definition: An attack vector is the path or method used by an attacker to gain unauthorized access to a target system or network. Understanding attack vectors is essential for implementing effective security measures.

Common Attack Vectors

Attack Vector Description Mitigation
Email Phishing, malicious attachments, links to malware Email filtering, user training, sandboxing
Web Applications SQL injection, XSS, CSRF attacks Input validation, WAF, secure coding
Network Man-in-the-middle, packet sniffing Encryption, VPN, network segmentation
Removable Media Infected USB drives, external storage Device control policies, scanning
Social Engineering Manipulation to obtain credentials or access Security awareness training
Insider Threats Malicious or negligent employees Access controls, monitoring, DLP
Supply Chain Compromised software or hardware vendors Vendor assessment, code signing

Attack Surface

The attack surface is the sum of all potential attack vectors. Organizations should aim to minimize their attack surface by:

Key Points for Examination

  • Attack vectors are paths used by attackers to access systems
  • Email and web applications are common attack vectors
  • Defense requires addressing multiple vectors simultaneously
  • Attack surface reduction is a key security strategy

1.12 Why is Cyber Security Needed?

Cyber Security

Cyber security is the practice of protecting computers, servers, mobile devices, electronic systems, networks, and data from digital attacks, damage, or unauthorized access.

Key Reasons Cyber Security is Essential

Reason Explanation Example
Data Protection Safeguards sensitive personal, financial, and organizational data from theft or exposure Protecting Aadhaar, PAN, credit card data
Business Continuity Prevents disruption of critical operations and services Protecting hospitals, banks from ransomware
Financial Safety Defends against online fraud, identity theft, and financial crimes Preventing UPI fraud, banking trojans
National Security Defends critical infrastructure — power grids, defense systems, transportation Stuxnet attack on Iranian nuclear facility
Privacy Protection Ensures individuals retain control over their personal information DPDP Act compliance, GDPR
Trust in Digital Economy E-commerce and digital services depend on user trust for adoption Secure payment gateways enable online shopping
Protecting Intellectual Property Prevents theft of trade secrets, patents, and creative works Corporate espionage through cyberattacks

Growing Need for Cyber Security

Key Points for Examination:

  • Cyber security protects the CIA triad: Confidentiality, Integrity, Availability
  • Both individuals and organizations need cybersecurity (not just IT departments)
  • Cybersecurity is a national security issue, not just a business concern
  • Growing IoT and digital economy increase the urgency for cyber security

1.13 Cybercrime vs. Traditional Crime

While cybercrime and traditional crime share the same general criminal intent (to cause harm or gain illegally), they differ substantially in their execution, impact, and investigation.

Parameter Cybercrime Traditional Crime
Medium Computers, networks, and the internet Physical world — real locations and people
Physical Presence No physical presence required; attacks from anywhere globally Perpetrator typically present at the crime scene
Scale of Impact Can affect millions of victims simultaneously (e.g., data breaches) Limited by geography; typically affects fewer victims
Speed of Execution Can be executed in milliseconds; automated attacks Limited by human action and physical constraints
Evidence Digital evidence: logs, files, metadata, network packets Physical evidence: fingerprints, CCTV, witnesses
Anonymity High anonymity — VPNs, Tor, fake identities make attribution difficult Lower anonymity; face and identity more easily traced
Jurisdiction Crosses national borders; jurisdiction is complex and contested Jurisdiction is clear and geographically defined
Investigation Requires specialized digital forensics tools and cyber expertise Uses physical forensics: fingerprinting, surveillance
Cost to Commit Low cost — readily available hacking tools and malware-as-a-service Higher cost and risk due to physical planning required
Asset Target Data, money, intellectual property, systems Physical property, cash, persons
Persistence Attacker can maintain persistent access without detection for months Crime is generally a single point event

Similarities Between Cybercrime and Traditional Crime

Key Points for Examination:

  • Cybercrime is borderless — a criminal in one country can attack victims worldwide
  • Digital evidence is volatile and must be preserved immediately (chain of custody)
  • Cybercrime requires specialized investigation skills not needed for traditional crime
  • Anonymity tools (VPN, Tor) significantly complicate cybercrime attribution

1.14 Fuel for Cybercrime: Motivating Factors

The "fuel" for cybercrime refers to the motivations that drive individuals and groups to commit cybercrimes. Understanding these motivations helps security professionals anticipate threats and design countermeasures.

Primary Motivations (Fuel for Cybercrime)

Motivation Description Typical Actor Example
Financial Gain Most common — cybercrime offers high returns with lower risk than physical crime Organized cybercrime groups Ransomware, banking trojans, credit card theft
Ego and Recognition Desire for status and respect within hacker communities Script kiddies, young hackers Website defacement, bragging in underground forums
Revenge Personal or professional grudges motivate targeted attacks Disgruntled employees, ex-partners Insider threat — sabotaging former employer's systems
Ideology / Hacktivism Political, social, or religious beliefs drive attacks on opposing entities Hacktivists (Anonymous, LulzSec) DDoS on government sites, data leaks of corporate records
Espionage Stealing state or corporate secrets for competitive or strategic advantage Nation-state actors, corporate spies APT attacks on defense industries, Stuxnet
Thrill and Challenge Intellectual curiosity and the challenge of defeating security systems Ethical hackers gone rogue, curious individuals Unauthorized penetration of secure systems "just to see if it's possible"
Cyberwarfare Governments attacking other nations' digital infrastructure Military cyber units, intelligence agencies Russia-Ukraine cyberattacks, NotPetya malware

Factors That Amplify Cybercrime (Enablers)

How a Cybercriminal Plans an Attack

  1. Target Selection: Choose based on motivation (banks for financial, government for political)
  2. Reconnaissance: OSINT gathering — social media, company websites, Shodan, LinkedIn
  3. Vulnerability Identification: Network scanning, researching known CVEs for target's software
  4. Tool Acquisition: Download exploit kits, purchase malware on dark web, write custom tools
  5. Execution: Deploy attack — phishing email, direct exploit, supply chain compromise
  6. Maintain Access: Install backdoors, rootkits, create rogue admin accounts
  7. Cover Tracks: Delete logs, use anonymous channels, destroy forensic evidence

Key Points for Examination:

  • Financial gain is the most common fuel for cybercrime
  • Hacktivism is different — it is ideologically motivated, not financially
  • Cryptocurrencies like Bitcoin are commonly used to receive ransom payments anonymously
  • Malware-as-a-Service (MaaS) has lowered the technical barrier to commit cybercrime
  • Understanding motivations helps predict likely targets and attack methods

Unit I Summary

Back to Syllabus Next: Unit II - Mobile and Wireless Security