Cybercrime tactics

What tactics do criminals use to scam people online, and is there anything we can do about it? Adam Murphy spoke to Alice Hutchings from the Department of Computer Sciences in the University of Cambridge, who went through just a few of the tactics used, starting with something that feels a little familiar...

Alice - Okay. So a DDoS attack is a term which refers to denial-of-service attack which refers to kind of overwhelming resources to a site or a service to make it inaccessible to other people.

Adam - A “Denial of Service” attack, is a common way of taking down websites. It does this by flooding a server with so many requests for a certain web page that it just cannot deal with it. Imagine if every time you tried to speak at a party, everyone around you just started yelling questions at you at the same time.

Alice - There's a number of reasons why this would happen. So it's a technique that's used for revenge, so if you have a grudge against somebody, and there's been a number of police stations that have been targeted with denial-of-service attacks for example. It could be for extortion, so if there's an event coming up you could threaten to take down somebody’s website and demonstrate your capabilities beforehand in order to get them to pay money to stop their site been attacked at an important time. Also we see a large volume of attacks against home Internet connections and these tend to be very short attacks and we believe they're used for taking down opponents in online games.

亚当-对我来说,感觉像旧的学校立体声typical mafia tactics. It's a nice web site you've got here… shame if something happened to it. Alice's specialities also include another old school tactic: fraud, but with a cyber twist.

Alice - One area I’ve been looking at recently is airline ticketing fraud. So the sale of genuine tickets, genuine airline tickets, that have been obtained fraudulently, say with compromised credit cards or with a compromised frequent flyer account. And then these are traded online either to people who don't realise they've been victimised or to complicit travelers and they're using them to commit other types of criminal activity.

Adam - And how common is that? Because that seems relatively new in terms of internet things.

Alice - I mean in terms of the global travel trade, there's you know, many many people traveling by plane every day but there's probably a couple of hundred people who are traveling on a ticket that has been obtained fraudulently.

Adam - Asking someone how to just “fix crime” isn't very helpful. So what can we do for these denial-of-service attacks?

Alice - So what we've been doing recently is trying to evaluate some of the different interventions that police have been using to try and stop denial-of-service attacks or at least a particular type of denial-of-service attack which is caused by denial-of-service-for-hire. So there's what's called a booter service which allows users to open accounts on there and then it lowers the barrier of entry where there's very little technical expertise required in order to carry out an attack. Police have developed different intervention strategies to try and deal with it. Some of these include prosecuting the operators of the booter services, they've also been influential in having some of the marketing of these taken off some of the forums that allow these to be advertised.

Adam - They've also been messaging people, letting them know that what they're about to do is illegal. And that has had an impact on cutting it down.

Alice - And we've actually found that these have various levels of success, and all of them have resulted in a reduction in attacks, although the level of attacks is increasing over time. There have been dips following these different interventions.

Adam - As Ross told us cybercrime has remained pretty constant. So how does that stack up with the overall crime rate?

爱丽丝——在过去的几十年,criminologists are being quite excited because it's been a big crime drop, crime has been going down quite steadily. What's really interesting though is if you start looking at some of the figures here. One place we can start looking at is the victim survey for England and Wales. This is an annual household survey and they ask very standardised questions about the type of crime that they've experienced over time. And this is where we get indicators of things like the crime drop because we're not just looking at reported crime. You find that questions aren't added very often to the crime survey, but they did actually add some questions in 2016, and they ask questions now about fraud and computer misuse. And what's really interesting is that in 2016 the crime rate from the victimization survey actually doubled. People started to realise that crime hasn't necessarily started going down, it's been going online, we just weren't capturing it in the data. Most people weren't sure where to report crime to, how do you report that you've received malware on your computer for example. I mean, the nature of the crime has changed so maybe there’s less violent crime online. There’s a hypothesis that things like online drug markets actually reduce the level of violence because most of the violence that's associated with the drug trade is to do with kind of interpersonal conflict. And so if you put it online, that can kind of disappear as well. And so in some cases it might be reducing levels of crime as well.