11/06/2018...11/06/2018 1 “OLAF. Improving and updating techniques for preventing, detecting and investigating fraud” 14 th JUNE 2018 Bucharest, Romania Dr. Eng. Giuseppe ZUFFANTI,

11/06/2018

1

“OLAF. Improving and updating techniques for preventing, detecting

and investigating fraud”

14th JUNE 2018

Bucharest, Romania

Dr. Eng. Giuseppe ZUFFANTI, Direttore Tecnico Principale

Ministry of Internal Affairs - POLICE OF STATE

Cybercrime: Evolution and

Digital Investigation

MINISTRY OF INTERNAL AFFAIRS

POLICE OF STATE - ITALYPostal and Communications Police

Compartment of “Piedmont and Aosta Valley”

OUTLINE OF PRESENTATION

The Italian Police Forces

Cybercrime Evolution

Digital Investigation


Police of State - ItalyPostal and Communications Police


The Italian Police Forces

Guardia di Finanza

Corpo Forestale dello Stato

Corpo di Polizia Penitenziaria

Arma dei Carabinieri

Polizia di Stato

Law N.121 of 1981

December 31, 2016 - From 5 to 4




The Public Security System in Italy

• The Chief of Police – Director General of Public Security. He is

assisted by:

• one First Deputy Director General

• two Deputy Directors General

The DPS coordinates police forces' operations, and manages and

organizes the Polizia di Stato.




11/06/2018

2

Administration and Logistics

• Police Force Coordination and Planning Office

• Public Security Department Secretariat

• Office for the General Administration of the Public Security Department

• Central Directorate for General Affairs of the Polizia di Stato

• Central Inspections Office

• Central Directorate for Human Resources

• Central Directorate for Health Services

• Central Directorate for Technical and Logistical Services and Property Management

• Central Directorate for Accounting Services




Training

•Central Directorate For Police Training

•Police Academy

•Interagency College Of Advanced Studies For Law

Enforcement Officials




Investigations

• Criminal Police Central Directorate

• Central Anticrime Directorate

• Central Directorate for the Anti-Terrorism Police

• Central Directorate for Antidrug Services

• Central Directorate for Immigration and Border Police

• Anti-Mafia Investigations Directorate

• Central Interagency Office for Personal Security

• Central Directorate for Road Police, Railway Police, Postal and

Communications Police and the Special Units of the Polizia di Stato




ROAD POLICE

RAILWAY POLICE POSTAL AND COMMUNICATIONS POLICE

………….

Central Directorate for Road Police,

Railway Police, Postal and

Communications Police and the

Special Units of the Polizia di Stato




11/06/2018

3

• 1 Central Service

• 20 Compartments

• 80 Sections




Counterfeiting CC

ATM Attack

Skimming

Phishing

On-line Frauds

Etc..

Child pornography

Computer Crime Investigation

Hacking

Education children on saferInternet use

University Cooperation

Etc..

Computer ForensicR&D







Cybercrime?

A crime like any other,but with the addition ofthe IT component, whichcan be the instrument

and/or the target of thecrime.




11/06/2018

4

•Computercrime as a target

•Computercrime as an instrument

Evolution of Cyber Crime




Increase of Cyber Crime

Number of attacks

Sophistication

Damage

Malware




Having Data = Petroleum of Infosphere

Cyber-Thefts instead robbery

80% of the company are unaware under cyber attack

It’s possible to by a single cyber attack with a normal

transaction (50$ by bitcoin)







11/06/2018

5







Why my Computer?

Identity Thieves

Enemies/Opponents/Envious

Stalkers

Hackers/Crackers

Pedophiles

Manager of Botnet







11/06/2018

6

VIRUS

ONLINE SCAM

SEX EXTORTION (PORN REVENGE)

SEXTING

GROOMING

INTERNET ADDICTION

WEB REPUTATION

CYBERBULLYING

FILE-SHARING

Some threats on Internet …




Malware i.e.: Zeus

Open Source Criminal Project

Black Market/Deep Web

Spy Functions (Webcam Capture,

Sound Capture, Remote Desktop,

Keylogger, Form Grabbing)




BOTNET




Ransomware

What is it?

How it works?

Example




11/06/2018

7

Cryptolocker

What is it?

How it works?

Example







11/06/2018

8







Phishing Quiz: 10 email, 19.000 users of 144 Country

• 3% of users OK

• 80% KO!!




SPEAR PHISHING

E-mail spoofing

Social Engineering

Footprinting




11/06/2018

9

Company Real Supplier

BUSINESS EMAIL COMPROMISE (CEO Fraud)

Fake Supplier (Man in the Middle)




Easy to find material

Web

Forum

Filesharing

Deep Web

CHILD PORNOGRAPHY

ON-LINE




CHILD GROOMING• …Relationships

• …trying to establish the likelihood of the child telling

• ….try to isolate their victim • ….promises

• ….intimidation

• It is easy for ‘groomers’ to find child

victims online.

• …false physical description of

themselves

• social networking sites.







11/06/2018

10

SEXTING

Sexting is sending, receiving, or forwarding sexually explicit messages, Photographs or images, primarily between mobile phones.

It may also include the use of a computer or any digital device.




WEB REPUTATION

25% of selectors declares excluded potential candidates find social profiles internet




CYBERBULLYING

Kids who are cyberbullied are more likely to:

• Use alcohol and drugs

• Skip school

• Experience in-person bullying

• Be unwilling to attend school

• Receive poor grades

• Have lower self-esteem

• Have more health problems







Law. 71/2017

11/06/2018

11

• Webcam

• Pre-recorded video

• Sexual behaviour• Ransom send the video

SEX EXTORTION




INTERNET ADDICTION

• Cybersexual addiction

• Cyber-relationship addiction

• Net compulsions

• Information overload

• Computer addiction







DARKNET

a small part of the internet that cannot be accessed

through standard browsers.

The dark web is primarily used to traffic illegal goods

and services, including drugs, firearms, child

pornography, botnet operations, fraud services, etc.

In order to access the dark web, you must use

specialized (open source) software like Tor.




11/06/2018

12

PSEUDONYMOUS NOT ANONYMOUS SOPHISTICATED

BUSINESSES

• Dark marketplace users rely on pseudonyms to

establish identity and build a reputation.

• Reputation management is among the most

important elements of transacting on a dark

marketplace.

• The largest dark marketplaces employ full customer

support and have developed highly sophisticated

technology platforms.

GOODS AND SERVICES

• Drugs are still the most common listing on the major

dark marketplaces. However, services are a rapidly

growing part of the ecosystem.

• Ransomware as a service, botnets for hire, hacking

as a service, and even independent drug quality

testing services are increasingly common offerings.

DARK MARKET




•Hard to discover link communication parties

Anonymizing networks







I2P

FREENET




11/06/2018

13




CRIPTOCURRENCY




BLACK MARKET




Examples: Markets:

• 1776

• Abraxas

• Agape

• Agora

• Alpaca

• AlphaBay

• Amazon Dark

• Anarchia

• Andromeda

• Area51

• Armory (not to be confused with the original Silk Road 1 weapons

site which closed for lack of sales; this is a much later,

independent site which was probably a scam)

• Atlantis

• BlackBank Market

• Black Goblin

• BlackMarket Reloaded

• Black Services Market

• Bloomsfield

• Blue Sky Market

• Breaking Bad

• bungee54

• BuyItNow

• Cannabis Road 1

• Cannabis Road 2

• Cannabis Road 3

• Cantina

• Cloud9

• Panacea

• Pandora

• Pigeon

• Pirate Market

• Poseidon

• Project Black Flag

• Sheep

• Silk Road 1

• Silk Road 2

• Silk Road Reloaded (I2P)

• Silkstreet

• Simply Bear

• The BlackBox Market

• The Majestic Garden

• The Marketplace

• The RealDeal

• Tochka

• TOM

• Topix 2

• TorBay

• TorBazaar

• TorEscrow

• TorMarket

• Tortuga 2

• Underground Market

• Utopia

• Vault43

• White Rabbit

• Zanzibar Spice

• Crypto Market /

Diabolus

• DarkBay

• Darklist

• Darknet Heroes

• DBay

• Deepzon

• Doge Road

• Dream Market

• Drugslist

• East India Company

• Evolution

• FreeBay

• Freedom Marketplace

• Free Market

• GreyRoad

• Havana/Absolem

• Haven

• Horizon

• Hydra

• Ironclad

• Kiss

• Middle Earth

• Mr Nice guy 2

• Nucleus

• Onionshop

• Outlaw Market

• Oxygen




11/06/2018

14




Underground Forums trade of goods and services – hub -

criminal relationships

E-commerce

Key factors




Deep Web provide services to buy Credit Cards

SKIMMED and CLONED – USA and EU VISA credit

cards.

Payment methods is BITCOINS.

UNDERGROUND

FORUMDEEP WEB SITE







11/06/2018

15







Deep Web sites provides services to buy

PASSPORT, IDCARD, DRIVER LICENSES.

Payment methods is BITCOINS.

UNDERGROUND

FORUMDEEP WEB SITE







11/06/2018

16




EXAMPLE OF UNDERGROUND FORUM

Download Software for Skimming




OPEN SOURCE INTELLIGENCE

We need to perform OSINT and Big Data analysis




• Finding and analyzing information from any source that is

publically available.

• Has there been a methodology change.

• Prior to the Internet age, OSINT consisted of analyzing

newspapers, magazines, radio and TV from across the globe.

• OSINT became popular and used by all sectors.

OSINT




11/06/2018

17

• People

• Groups of people

• Companies

• Organizations

• Web sites

• Internet infrastructure

• Phrases

• Affiliations

• Documents and files

INFORMATION GATHERING




Who IS, DomainTools, Maxmind, Whoisology, Reverse Who IS, etc..










11/06/2018

18

Information Gathering with Maltego (1)




Information Gathering with Maltego (2)










11/06/2018

19




PC, CAMERA, SW ETC..

MAGNETIC CARDS, CREDIT

CARDS CLONED

BLOCK NOTES WITH PIN ,

TIMESTAMP AND MORE

INFORMATION MOULDS MOULD, RAW

MATERIAL

SKIMMERS










11/06/2018

20

Pinhole camera

ZOOM







Plastic cover with pinhole camera Overlapped plastic cover:r/w m.s.

SKIMMING




Pinhole camera




11/06/2018

21

Video ATM skimming




CASH TRAPPING

1 2 3




• A joint international operation led to the dismantling of a group of cybercriminals

active in Italy and other countries who are suspected of committing financial

fraud involving email account intrusions.

• Arrest of 49 suspected members of the criminal group Digital forensic to

found evidence

• EC3 and Eurojust, Italian Polizia di Stato (Postal and Communications Police), the

Spanish National Police, the Polish Police Central Bureau of Investigation, and

supported by UK law enforcement bodies.

• EUR 6 million, accumulated within a very short time.

• Modus operandi

OPERATION “TRIANGLE”







11/06/2018

22

www.poliziadistato.it

www.commissariatodips.it

THANK YOU FOR YOUR ATTENTION!

[email protected] Tel. +39 011 301 46 44

Dr. Eng. Giuseppe ZUFFANTI, Direttore Tecnico Principale

Ministry of Internal Affairs - Police of State


