Cyber Forensics

Cyber forensics is a process of extracting data as evidence of a crime (involving electronic devices) to catch the culprit by presenting evidence in the court following proper investigation rules. Cyber forensics is also known as computer forensics. The main purpose of cyber forensics is to maintain the thread of evidence and documentation to find out who committed the crime digitally. Cyber forensics can perform the following functions:

It can recover deleted files, chat logs, emails, etc.
It can also retrieve deleted SMS, phone calls.
It can obtain recorded audio of phone conversations.
It can determine which user used which system and for how long.
It can identify which user ran which program.

Table of Contents

Why is Cyber Forensics Important

The importance of cyber forensics is very high in today’s technology driven generation. Technology combined with forensic forensics paves the way for quick investigation and accurate results. The points showing the importance of cyber forensics are given below.

Cyber forensics helps in collecting important digital evidence to trace the culprit.
Electronic devices store huge amounts of data which is not visible to a normal person. For example: In a smart home, for every word spoken by us, the actions taken by the smart devices, collect huge data which is important in cyber forensics.
It is also helpful for innocent people to prove their innocence through the evidence collected online.
It is not only used to solve digital crimes but also to solve real-world crimes like theft cases, murder, etc.
Businesses equally benefit from cyber forensics in tracking down system breaches and finding attackers.

Process Involved in Cyber Forensics

1. Obtaining a digital copy of the system that is being inspected or required to be inspected. 2. Authenticating and verifying the reproduction. 3. Recovering deleted files (using autopsy tools). 4. Using keywords to find the information you need. 5. Setting up a technical report.

What is cybercrime

Cybercrime is any criminal activity that involves a computer, network, or network device. While most cybercriminals use cybercrimes to make a profit, some cybercrimes are committed to directly damage or disable a computer or device. Others use computers or networks to spread malware, illegal information, images, or other content. Some cybercriminals do both – that is, target computers to infect them with a computer virus, which then spreads to other machines and sometimes entire networks. The primary impact of cybercrime is financial. Cybercrime can involve many different types of profit-driven criminal activities, including ransomware attacks, email and Internet fraud, and identity fraud, as well as attempts to steal financial account, credit card, or other payment card information.

Since cybercriminals may target an individual’s private information or corporate data for theft and resale, protecting backup data is particularly important. The U.S. Department of Justice (DOJ) divides cybercrime into the following three categories: 1. Crimes in which a computing device is the target – for example, to gain access to a network. 2. Crimes in which a computer is used as a weapon – for example, to launch a denial of service (DoS) attack. 3. Crimes in which a computer is used as an accessory to a crime – for example, using a computer to store illegally obtained data.

Types of Cybercrime

Cybercriminals have a variety of cybercrime tools at their disposal to carry out malicious attacks. Most attackers commit cybercrime with the hope of financial gain, although the ways in which cybercriminals receive payment may vary. Typical types of cybercrime include the following:

Cyberextortion: This crime involves an attack or threat of an attack, as well as a demand for money to stop the attack. One form of cyberextortion is the ransomware attack. Here, the attacker gains access to an organization’s systems and encrypts its documents and files – anything of potential value – making the data inaccessible until a ransom is paid. Typically, payment is in some form of cryptocurrency, such as Bitcoin.
Cryptojacking: This attack uses scripts to mine cryptocurrency within the browser without the user’s consent. Cryptojacking attacks may involve loading cryptocurrency mining software onto the victim’s system. Many attacks rely on JavaScript code that performs in-browser mining if the user has a tab or window open to the malicious site in their browser. There is no need to install any malware because loading the affected page executes the in-browser mining code.
Identity theft: This type of attack occurs when someone accesses a user’s computer to steal personal information, which is then used to steal that person’s identity or access their valuable accounts, such as banking and credit cards. Cybercriminals buy and sell identity information on darknet markets, providing financial accounts and other types of accounts, such as video streaming services, webmail, video and audio streaming, online auctions, etc. Personal health information is also another common target of identity thieves.
Credit card fraud: This is an attack that occurs when malicious hackers infiltrate the systems of retailers to obtain their customers’ credit card or banking information. Stolen payment cards can be bought and sold in bulk on darknet markets, where hacking groups that steal large amounts of credit cards make a profit by selling them to lower-level cybercriminals, who profit through credit card fraud against individual accounts.
Cyber espionage: This crime involves cybercriminals hacking systems or networks to gain access to confidential information held by a government or other organization. The attacks are motivated by profit or ideology. Cyber espionage activities include cyber attacks in which data is collected, modified, or destroyed, as well as spying on targeted individuals or groups using network-connected devices, such as webcams or closed circuit TV cameras, and monitoring communications, including emails, text messages, and instant messages.
Software piracy: This attack involves the unlawful copying, distribution, and use of software programs intended for commercial or personal use. Trademark infringement, copyright infringement, and patent infringement are often associated with software piracy.
Exit scams: The dark web has given birth to a digital version of an age-old crime known as the exit scam. In today’s form, dark web administrators transfer virtual currency held in marketplace escrow accounts to their own accounts — essentially, criminals steal from other criminals.

Common examples of cybercrime

Commonly seen cybercrime attacks include distributed DoS (DDoS) attacks, which use a network’s own communication protocols against it by affecting the network’s ability to respond to connection requests. DDoS attacks are sometimes carried out for malicious reasons or as part of a cyberextortion scheme, but they can also be used to distract the victim organization from another attack or exploit carried out at the same time.

Malware is another common cybercrime that can cause damage to systems, software, or data stored on systems. Ransomware attacks are a type of malware that encrypts or shuts down victim systems until a ransom is paid.

Phishing campaigns help attackers infiltrate corporate networks. Phishing involves sending fraudulent emails to users in an organization, enticing them to download malicious attachments or click on malicious links that then spread malware throughout the network.

In credential attacks, the cybercriminal aims to steal or guess the victim’s username and password. These attacks may be performed by force – for example, by keylogger software – or by exploiting software or hardware vulnerabilities that expose the victim’s credentials. Cybercriminals may also hijack websites to alter or delete content without permission or to access or modify databases.

For example, attackers use structured query language injection exploits to insert malicious code into a website, which can be used to exploit vulnerabilities in the website’s database, allowing a malicious hacker to access and tamper with records or gain unauthorized access to sensitive information and data, such as customer passwords, credit card numbers, personally identifiable information, trade secrets and intellectual property. Other common examples of cybercrime include illegal gambling, the sale of illegal goods – such as weapons, drugs or counterfeit goods – and the solicitation, production, possession or distribution of child pornography.

Categories of cyber crimes can be classified into the following different categories

1. Crimes against individuals:

Harassment through e-mail: Harassment through sending letters, attachments of files and folders, i.e. through email. Currently harassment is common due to the use of social sites. Orkut, Hangouts, Zapak, Facebook, Twitter etc. are increasing day by day.
Cracking: This is one of the most serious cyber crimes known so far. In this a cyber criminal breaks into your computer system without your knowledge and consent and tampers with your valuable confidential data and information.
Cyber-stalking: This means expressed or implied physical threat that creates fear through the use of computer technology such as internet, e-mail, phone, text messages, webcam, website or video.
Dissemination of obscene material: This includes indecent exposure/pornography (basically child pornography), hosting of web site containing these prohibited materials. These obscene things can harm the mind of teenagers and can corrupt or deprave their mind. This can create a big mistake in the society.
SMS Spoofing: Spoofing is the interception through spam which means unwanted uninvited messages.

Here a criminal steals the identity of another in the form of a mobile phone number and sends SMS via the internet and the receiver gets the SMS from the victim’s mobile phone number.

Attack by intimidation: This implies threatening a person with fear for his life or the life of his family through the use of computer networks. E-mail, video or phone.
Page jacking: When a user clicks on a certain link and an unexpected website opens through that link the server is said to be ‘pagejacked’. This happens when someone steals part of a real website and uses it on a fake site. If they use the real site enough, the fake site can be listed by tricking internet search engines and people will land on it by mistake. Unfortunately one cannot stop page jacking but can only deal with it.
Advance fee scams: Advance fee scams are quite easy to identify as you will be asked for money or goods upfront in exchange for giving you credit or money later. These advance fee scams may seem credible and many people have been involved in them.
Defamation: It is the act of accusing a person with the intention of lowering his dignity by hacking his mail account and sending some mails using obscene language to the mail account of unknown persons.
E-mail spoofing: A spoofed e-mail can be said to be one that misrepresents its origin. This suggests that its origin is different from the place it actually came from.
Carding: It means the use of false ATM cards i.e. debit and credit cards by criminals for their own monetary gain by maliciously withdrawing money from the victim’s bank account. There is always unauthorized use of ATM cards in these types of cyber crimes.
Fraud and forgery: It means that the person who is committing the cyber crime i.e. stealing passwords and data storage has done so with a guilty mind, which leads to fraud and forgery.

2) Crimes against property of persons: As a result of the rapid growth in international trade, where businesses and consumers are increasingly using computers to create, transmit and store information in electronic form instead of traditional paper documents, there are certain crimes that affect property of persons:

Intellectual Property Crimes: Any unlawful act by which the owner is deprived of his rights either wholly or partially is a crime. Common forms of IPR infringement can be said to be software piracy, infringement of copyright, trademark, patent, design and service mark, theft of computer source code etc.
Cybersquatting: It means where two persons lay claim to the same domain name either by claiming that they registered the name first or by claiming the right to use it before the other or by using something similar to the first. For example two similar names i.e. www.yahoo.com and www.yaahoo.com.
Cyber Vandalism: Vandalism means intentionally destroying or damaging the property of another. So cyber vandalism means destroying or damaging data when the network service is shut down or interrupted. It can include any type of physical damage inflicted to any individual’s computer. These acts can be in the form of theft of the computer, any part of the computer or any peripheral device connected to the computer.
Hacking computer system: Hacking activity will result in loss of data as well as computer. Moreover research specifically indicates that the aim of those attacks was not primarily financial gain and also not to tarnish the reputation of any particular individual or company.
Transmitting virus: Viruses are programs that attach themselves to a computer or file and then transmit themselves to other files and other computers on the network. They usually affect the data on the computer by either changing or deleting it. Worm attacks play a major role in affecting the computerization system of individuals.
Cyber trespassing: It means accessing someone’s computer without the correct permission of the owner and disturbing, altering, misusing or damaging the data or system using a wireless internet connection.
Internet time theft: Basically, internet time theft comes under hacking. It is the use of internet hours paid for by another person by an unauthorized person. The person who gains access to another person’s IP user ID and password through hacking or by gaining access through illegal means uses it to access the internet without the other person’s knowledge. You can identify time theft if your internet time has to be recharged frequently despite low usage.

3) Cyber Crimes against Government: Certain crimes are committed by groups of individuals with the intent to threaten international governments using Internet facilities:

Cyber Terrorism: Cyber terrorism is a major burning issue of domestic and global concern. The common form of these terrorist attacks on the Internet are distributed denial of service attacks, hate websites and hate e-mails, attacks on sensitive computer networks, etc. Cyber terrorist activities threaten the sovereignty and integrity of the nation.
Cyber Warfare: It refers to politically motivated hacking to carry out sabotage and espionage. It is a form of information warfare that is sometimes considered similar to conventional warfare, although this analogy is controversial both because of its accuracy and political motivation.
Distribution of Pirated Software: It means distributing pirated software from one computer to another with the intent to destroy government data and official records.
Possession of Unauthorized Information: With the help of Internet it is very easy for terrorists to access any information and possess that information for political, religious, social, ideological purposes.

4) Cybercrime against society at large: An illegal act done with the intention of causing harm in cyberspace will affect a large number of individuals:

Cyber trafficking: It can be trafficking of drugs, human beings, arms etc. which affects a large number of individuals. Trafficking is also a serious crime in cyberspace.
Online gambling: Online fraud and cheating is one of the most lucrative businesses that is growing in cyberspace today. There have been many cases that are related to credit card crime, contract crime, job offers, etc.
Financial crime: This type of crime is common because the number of users of networking sites and phone networking is increasing rapidly, where criminals try to attack by sending fake mails or messages through the Internet. Example: Using credit cards by illegally obtaining passwords.
Forgery: It means deceiving a large number of people by sending threatening mails, as online business transactions are becoming a habitual necessity of today’s lifestyle.

Read Also:

1553900cookie-checkCyber Forensics

Name	Domain	Purpose	Expiry	Type
_ga	altechbloggers.com	Google Universal Analytics long-time unique user tracking identifier.	2 years	HTTP
IDE	doubleclick.net	Google advertising cookie used for user tracking and ad targeting purposes.	2 years	HTTP

Name	Domain	Purpose	Expiry	Type
_ga_GSZLHBGB35	altechbloggers.com	---	2 years	---
jetpack_post_subscribe_modal_dismissed	www.altechbloggers.com	---	1 days	---