third Cyber Security Assessment Netherlands - NCSC

tend to unknowingly facilitate this criminal behaviour, but also
‘bulletproof’ providers can be recognized – they are doing so
consciously. In between are companies who operate in the twilight
zone. International virtual payments processors are frequently used
by (high tech) criminals because of the speed and anonymity that
can be achieved.
1.3 Tools used by cyber criminals
During the reporting period, there has been no substantial change
in the way cyber criminals operate. However, criminals are becoming
increasingly aggressive in their actions. One example of this
is ransomware automatically downloading and displaying child
pornography. Botnets remain a popular tool for earning a lot
of money. Malware is increasingly being used to take over computers
completely, reducing the need to use phishing to collect user
credentials. Last year’s CSAN recognised that ransomware plays a key
role in cyber crime targeted directly at end users. Its use increased
significantly during the reporting period, as did the use of encryption
to further thwart law enforcement.
Botnets
Botnets are clusters of infected computer systems which can
be controlled remotely. They are still considered to be the major
element in cyber crime. One important feature is that botnets’
architectures make them particularly difficult to eliminate. See also
the detailed section on botnets for more information, such as how
they work and what happened in recent cases such as Pobelka.
A botnet herder’s business model includes renting their botnet
out for a range of services. For example, botnets consisting of
100,000 bots are available to let for large-scale attacks for a few
hundred U.S. dollars per day.
Malware
A big portion of known malware is targeted at collecting financially
(re)usable data. An important category is made up by banking
trojans, designed to abuse personal users’ internet banking
environments. Generally this malware will attempt to retrieve the
user’s login credentials or to manipulate bank transfers without this
being noticed by the user.
Encryption and cloud
Law enforcement is complicated by the increased use of encryption
on both digital communications and file storage. The
growing popularity of cloud services creates legal as well
as technical challenges, for example raising questions in matters
of (police) jurisdiction.
Ransomware
The spread of so-called ransomware is increasing rapidly. Its
emergence was already highlighted in last year’s report. Ransomware
hijacks the infected system’s functionality, e.g. by encrypting
files or blocking the operating system from working. The malware
then demands a payment from the user to restore the functionality
– which then seldom happens – and puts the user under pressure
not to file a report. Following the first instances in 2009 in Russia
and Eastern Europe, ransomware has now spread to Western
Europe, the United States and many other countries.
More professional ransomware
Ransomware is noteably becoming more professional.
Criminals use encryption and virtual currencies for their
identities to remain concealed. There impact on the victim
is also increasing. Criminals are willing to use any means to
encourage the user to pay and not to file a report with the
police. Examples are: showing police logos, displaying child
pornography and switching on the computer’s webcam so
that the user is shown on-screen. Just like any type of malware,
a ransomware infection can be caught on the regular internet,
under the wrong circumstances. This has a direct impact
on individual citizens’ sense of security, even more so than
hacking, skimming and internet banking fraud.
1.4 Challenges in law enforcement
The dichotomy between high tech crime and ‘regular’ cyber crime
has a big impact on law enforcement. It is therefore highly valuable
to invest in finding and prosecuting the perpetrators of high tech
crime. After all, the impact of this type of cyber crime is manifest.
Furthermore, less knowledgeable attackers adopt these tools and
methods. Of course, improving law enforcement on high tech crime
requires the police to make a relatively big investment in people,
resources and expertise.
In addition to operational limitations, technical complications exist
when it comes to digital research. Criminals’ digital tracks leading
abroad (such as the IP address used) may result in issues of jurisdiction.
Perpetrators are also increasingly using software to completely
conceal their location: one popular example is Tor. A new phenomenon
is that criminal data is increasingly found in the cloud. Koops
[57: WODC 2012]
investigated the consequences of this ‘criminal cloudification’
on law enforcement. He concludes that the development in
itself does not pose new problems, but it is stressing all the existing
legal and technical aspects to the max.
In order to address these problems the Minister of Security and
Justice in May 2013 proposed legislation on extending police
capabilities with respect to performing remote investigations on
computers of suspects and, if necessary, to remotely copy data or
render it inaccessible. These competences also allow for situations
where the system’s physical location is unknown.
When combating cyber crime, a problem of a more technical nature
is the use of encryption on both digital communications and file
storage. Nowadays its quality is such that expertly encrypted data
cannot always be decrypted without the owner’s collaboration.
Encryption also poses a problem when investigating seized systems.
In the context of criminal investigations, the police can already
order a third party (but not the suspect) to decrypt the inaccessible
56