Two held for sending obscene mails

HYDERABAD: The Cyber Crime police arrested two software engineers who were involved in two different offences of sending obscene emails containing pornographic images. According to Cyber Crime police, a woman working in a private firm lodged a complaint on August 25 about receiving obscene emails with pornographic images along with other female employees. After analysing the case technically, based on IP log and subsequent enduser details, it came to light the accused Vemuri Ravi Kumar was involved in sending obscene mails to a woman employee and arrested by police recently. On interrogation, he confessed he had again sent obscene emails from his computer system installed at his office. The accused confessed he was an exemployee of the victim's company and due to nonrecognition of his hard work, he transmitted the obscene and defamatory emails to the employees. Police recovered one computer and pen drive. In another case, a software engineer was nabbed by Cyber Crime police involved in sending abusive mails to a married woman. The victim had lodged a complaint with on September 7 about receiving emails with abusive content and which defamed the character of her sister. Based on IP log and subsequent enduser details, the accused Muqthadir Ahmed was arrested. On interrogation, he confessed he had sent the abusive emails defaming the woman from his computer system installed at his residence. The accused confessed he had developed friendship with the sister of the victim and tried to get into a relationship. With the woman rejecting his marriage proposals, he sent abusive and defamatory emails to her brotherinlaw, defaming the character of her sister.

Read More

Statistics and the 'Cyber Crime Epidemic'

According to the recently released Norton Cyber Crime Report for 2011, 431 million adults worldwide were victims of cyber crime last year. The total cost of those crimes amounts to some $114 billion. This precise statement, however, hides an important problem: We actually lack comprehensive data in assessing the true scale and scope of cyber crime. This is because we primarily rely on businesses to voluntarily self-report incidences of attacks and intrusions without any means to verify their statements. To turn the tide in the fight against cyber crime, we first need to know its true impact on the world economy.

William W. Watt once remarked, "Do not put your faith in what statistics say until you have carefully considered what they do not say." In examining the statistical outpouring of data on cyber crime, one should pay special attention to what those statistics do not say. The recently published report, Second Annual Cost of Cyber Crime Study, by the Poneman Institute, a U.S. based information security policy research center, is another good case in point. The report states that "over the past year, the median cost of cyber crime increased by 56 percent and now costs companies an average of $6 million per year." This statistic was compiled using a self-report survey of 50 U.S. based businesses.

The reason businesses routinely under-report incidents of cyber crime is that most information on cyber crime losses are derived from surveys; that is, statisticians merely send questionnaires to companies and hope they are answered in good faith. Businesses have vested self-interests in under-reporting incidents since they either do not want to lose consumer confidence or be held accountable by shareholders or boards. Consequently, the data we collect from such surveys has very low predictive power and cannot serve as a basis for informed policy formulation.

What most people do not realize is that cyber criminals do not have to be too sophisticated to inflict major damage. Cheap malware that can be purchased online often suffices. The real danger to a country's economy arises from advanced persistent threats (APTs) -- highly sophisticated and long-planned intrusions often executed with state sponsorship. Jeffrey Carr, a U.S. based cyber security expert, recently stated that the biggest threat is the theft of intellectual property in high-value technology and energy assets. Here too under-reporting is endemic.

One report claims that U.S. intellectual property theft -- an APT -- costs 750,000 jobs annually, much of which is conducted via cyber space. The validity of this number, however, is questionable since many APT attacks either are not detected or are kept secret for many years. Most companies do not even know that they are under attack, and if they do know, companies are not willing to share data because we lack a trusted identity to collect it.

There are dozens of public- and private-led cyber security data distribution forums in existence already, but the number, scope, and diversity makes for a complex environment where sharing information is very difficult. What is needed is the equivalent to the U.S. Center for Disease Control and Prevention, an umbrella organization coordinating the different activities of forums and which could conduct broad analysis into cyber space. In the United States the National Security Telecommunication Advisory Committee provides a good model for sharing and normalizing threat data that could be generalized to various initiatives from defense, finance, or information-based industries.

Such a new umbrella organization could induce private sector companies to voluntarily provide at least a modicum of raw statistical data about their performance. For example, the data breach reports should be "anonymized," which will, from a business perspective, facilitate sharing. With this minimal data, rudimentary statistics could be compiled and common responses developed. The main focus here should be on data treatment and distribution. Data must be usable and accurate enough to enable action and suppress vulnerabilities in companies.

The significant disconnect within many corporations, where internal security experts are unable to justify increased security methods or spending due to a lack of measured information, presents a grave danger to the well-being of our global economy. Having trusted measures and performance benchmarks will significantly reduce this information gap between security and executive leadership in organizations. It will help formulate more cost effective defense strategies against cyber crime. Better detection rates of attacks, faster responses to incidents, and sounder policy formulations will make companies more secure and consequently more competitive in the global market. As Gordon Gekko stated in Wall Street: "The most valuable commodity I know of is information." This has never been truer than in the age of cyber space.

Read More

Cyber crime: Brokerage firm cheated of Rs 2.32 cr

JAIPUR: A city brokerage firm paid dearly for lapses in computer security after someone hacked into its network and defrauded it of Rs 2.32 crore by extending the share purchase limits of four defunct accounts. The hackers then "purchased" the shares of a company listed on the Bombay Stock Exchange (BSE) on alarmingly high prices using the firm's network.

The police with help of cyber crime experts have now tracked some suspects and shot off a letter to the BSE for seizing payment to the seller of the shares. Police suspect the same gang had been involved in defrauding another brokerage firm in Kolkata of Rs 6 crore. One gang member, belonging to Jhunjhunu, has been identified.

According to the police, Rajesh Kumar, representative of the brokerage firm, Navjeevan, operating out of Apex Mall in Ashok Nagar police station area, lodged a complaint saying some unknown persons hacked into its system.

"The hackers' purchased the shares of a company named Clarus at high prices using Navjeevan's software. The sellers of the shares had hiked the price of them and kept purchasing them until it reached the firm's limit of purchase with the BSE," said Hitesh Choudhary, a cyber crime expert helping the police.

He added that on the basis of the computer's IP address used in the purchase and the study of a similar case, one man has been identified.

The complainant Rajesh Kumar told TOI the fraud took place on September 19 and since then he had been constantly trying to get information regarding the share sellers from the BSE, but he did not get any co-operation.

"Instead, they suspended my firm's BSE membership for not depositing the money used in purchase of the shares. I feel completely helpless as the owner of four accounts which were used to purchase shares will obviously not pay the money," Rajesh claimed.

A senior police officer said the money transaction to the sellers' account has been halted after police wrote to the BSE. "An investigation in on," the officer added.

Read More