How to report a computer crime: malware by email

by Bob Burls @ Naked Security By Sophos

Do you know how to report a computer crime? Or even who you would report it to?

We looked at unauthorised email account access in the first of our series of articles on how to report a computer crime. Now we turn our heads to malware by email.

We'll look at what offences are committed in different countries when a crime like this happens, how you should report the crime, and what evidence you can preserve.

 

 

Take this scenario:

• Andre receives an email with an attachment. The subject line indicates the attached file is a short movie of an A-list celebrity in a state of undress.
• Andre is a fan of the celebrity purported to be the subject of the movie so he opens the attached file. It is in fact a variant of Troj/Poison malware.
• Andre has an anti-virus application installed, but receives no alert.
• The malware, when ran, displays an error message which states that a codec is missing and that the movie cannot be played.
• Andre gives the matter no further thought and takes no action. He has, of course, inadvertently infected his computer with malware.
• The resulting infection compromises the security of Andre’s PC and opens a backdoor connection.
• Two days later the malware is detected by Andre's anti-virus software when the signatures are updated.
• A cybercriminal who is a member of an underground forum had purchased a copy of the Troj/Poison backdoor malware kit.
• The cybercriminal compiled his own Troj/Poison malware executable and distributed it via a list of email addresses, including Andre's, that he paid for on the forum.
• The cybercriminal disguised the malware as the celebrity movie in order to lure victims to run his Troj/Poison variant and distributed the malware by spamming it to the bulk list of email addresses he acquired.
• The cybercriminal had no particular victim in mind; his intent was to lure as many victims as possible.

 

What was the offence?

 

We can break it down like this:

• The cybercriminal performed an unauthorised act in relation to a computer. It is unauthorised because he did not have permission to install the malware on Andre’s computer, and had Andre known he would not have consented to the cybercriminal’s action.
• The cybercriminal knew that his activity was unauthorised.
• The cybercriminal intended to impair the operation of Andre’s computer by installing a backdoor on the computer defeating the security.
•  

The legal bit

We've focused on the UK, USA, Canada and Australia, but each country has its own legislation, though the relevant statute often exists to accommodate the same offences in each country.

 

UK

In the UK, most computer crime falls under offences covered by one of three pieces of law:

• Computer Misuse Act 1990
• Communications Act 2003
• Fraud Act 2006

Other associated crimes could include Conspiracy or Money Laundering offences, but victims of computer crime are more often than not affected by at least one of the three acts listed above.

In this case, the cybercriminal commits an offence of an "Unauthorised Act with Intent to Impair”, contrary to Section 3 of the Computer Misuse Act 1990, committed when an offender modifies a computer with intent to impair the functionality of that computer.

 

USA

In the USA, most cybercrime offences are covered by Title 18, United States Code (USC) Section 1030 – Fraud and related activity in connection with computers.

This is what the cybercriminal contravened when he disseminated the malware-filled email.

 

Canada

The Criminal Code of Canada contains sections that specifically cater for cybercrime, including:

• Unauthorised Use of Computer
• Possession of Device to Obtain Computer
• Mischief in Relation to Data
• Identity Theft and Identity Fraud

In this case, both Section 342.1 Canadian Criminal Code (CCC) - Unauthorised Use of a Computer - and Section 430(1.1) CCC - Mischief in Relation to Data (damaging data) - were contravened.

 

Australia

Both state laws and commonwealth laws exist in Australia. In South Australia, the investigation of cybercrime by police is classified under three tiers and is spread across the organisation depending, mainly, on severity.

The primary legislation for computer offences is the Summary Offences Act, 1953 (SOA) and the Criminal Law Consolidation Act, 1935 (CLCA).

 

Reporting the crime

 

UK

In the UK, when a crime has taken place it should be reported to the police, so Andre should go to his local police station to report it.

A crime allegation may be investigated by a police force or may be referred to the Police Central e-Crime Unit (PCeU) which provides the UK's investigative response to the most serious incidents of cybercrime. The PCeU requests that the routine reporting of computer crime offences are not made directly to them.

There is also an alternative reporting body for internet-enabled crime: Action Fraud.

Action Fraud records and passes on crime reports to the National Fraud Intelligence Bureau, who then decides whether the incident requires further investigation, as not all computer crimes are investigated.

 

USA

The Department of Justice website contains a Computer Crime and Intellectual Property Section with a contact page for reporting incidents to local, state or Federal Law Enforcement Agencies (LEA).

Two Federal LEAs have a remit to investigate some computer crimes:

• The Federal Bureau of Investigation (FBI)
• The United States Secret Service (USSS)

In this case Andre should report the crime at his FBI Local Office, or US Secret Service or Internet Crime Complaint Centre.

 

Canada

The Royal Canadian Mounted Police (RCMP) are the main agency with regard to the investigation of federal statutes, but they also have policing responsibility for a number of the Canadian provinces and all 3 territories, as well as some local police services in towns and cities.

A computer crime victim, like Andre, should report their incident to their local police service. If appropriate, it will be escalated for the attention of the agency with federal responsibility, the RCMP.

 

Australia

Andre should report the crime to the Australian State or Territory Police.

Investigation policy differs from state to state but the Australian Federal Police website offers a guide on whether the crime should be reported to either Australian State or Territory Police.

 

Preserving the evidence

Andre may want to consider preserving the original email he received, and any anti-virus alert log that was generated as a result of the infection.

 

Remediation

Andre should run a malware removal tool to identify and clean up the infection. 

As the effects of different kinds of malware vary considerably, he should also talk to his anti-virus vendor for advice on any other remediation he should perform which is particular to the kind of malware he has.

In future, Andre should always exercise caution when downloading attachments from emails that he is not expecting.

He should also always make sure his anti-virus signatures are kept up to date, and that his operating system and applications are patched.

Conclusion

In general, it's important that all computer crime is reported. Even if no investigation follows, crime report intelligence can be built up and an accurate picture of the levels of computer crime can be produced.

If victims of a particular crime do not come forward to report incidents, then the number stated in crime reporting statistics will be not be a true reflection of the number of crimes taking place.

The scenario above is given as an example to help you in understanding when and what offences have taken place. Please be reminded that no two situations are the same and we have not catered for the “what if” situation.

We have also not included any corporation’s AUP (Acceptable Use Policy) that may be in place and may have been breached.

All of the scenarios are made up and the characters depicted bear no resemblance to any person.

Acknowledgements

Daedalus Teks does not take credit for this article, Daedalus Teks shares articles like these in order to make clients more aware of the I.T. Field.  Daedalus Teks gratefully acknowledges the assistance of Naked Security and the following organisations in preparation of this series of articles:

1. UK Police Central e-Crime Unit
2. Action Fraud
3. United States Federal Bureau of Investigation
4. United States Secret Service
5. Royal Canadian Mounted Police
6. South Australia Police