Identity Fraud: Presented by: MOHD ZABRI ADIL TALIB Head, Digital Forensics CyberSecurity Malaysia

Transcription

1 Identity Fraud: Platform for Cybercrime Presented by: MOHD ZABRI ADIL TALIB Head, Digital Forensics CyberSecurity Malaysia

2 Introduction of Digital Forensics Department, CyberSecurity Malaysia 2

3 Digital Forensics Department (DFD) Provide Malaysia Law Enforcement (LE) agencies with in house digital forensics capabilities: I. Digital Evidence Analysis and Cyber Investigation including forensics analysis of audio and video II. On-site investigation support III. Data Recovery (logical, electrical and mechanical recovery) IV. Evidence Preservation Facility V. Expert Development Lab 3

4 DFD roles To provide Digital Forensics services to all Law Enforcement Agencies in Malaysia in criminal cases To provide Digital Forensics services to private organization / individual id in civil il cases To appear in court of law for expert testimony presenting the digital evidence findings and analyses 4

5 Forensics Analysis Center Department of Chemistry, Malaysia Reference center for physical evidence examination and analysis CyberSecurity Malaysia Reference center for digital evidence examination and analysis 5

6 Now, let s discuss identity fraud.. 6

7 Cyber crime Malaysia landscape 7

8 Cyber incidents Cases Reported to MyCERT, CyberSecurity Malaysia Type of Incidents Intrusion Intrusion Attempt Spam DOS Cyber Harassment Fraud Content Related Malicious Code 8090 Vulnerabilities Report 9986 Total Case

9 Cyber Incident Statistics Type of fincident id thandled dby MCERTi MyCERT in year 2012

10 Identity theft Definition - When someone else uses your personally identifying information without your permission - It can take place whether the victim is alive or deceased 10

11 Identity theft Is it an offense in Malaysia? To register communication and multimedia services with fraudulent intent is to be a criminal offense under Secto Section 232 of the Communications and Multimedia Act 1998 which carries a fine of up to RM300, 000 or up to 3 years imprisonment or both 11

12 Identity theft Case statistics Fraud - Identity Theft Incident Year 2012 and Fraud Impersonation & spoofing 0 Fraud Unauthorized transaction 2012 Jan Sept 2013 Fraud Online scam 12

13 Identity fraud How do they do it? The perpetrator will use whatever it takes to accomplish their objectives: Hacking technique Physical theft Social engineering technique Social media 13

14 Identity fraud What can they do with it? Criminal can use your personally identifying information to: Drain your bank and credit card accounts Obtain credit cards, loans, insurance, mortgages Get wireless or phone products Obtain employment or immigration status Evade law enforcement Commit other crime 14

15 Identity fraud How do we detect it? Unexplained withdrawal from your bank account Unexplained charges on your credit report Call from debt collectors and medical providers Your legitimate t medical claim rejected because it reached your benefits limit Merchants refuse your cheques Arrested for a crime else allegedly committed in your name 15

16 Identity fraud How do we response to it? Be patience, think rational and positive The process of correcting incorrect information about victim s financial or personal status is a daunting task The damage takes far longer to undo than it took the criminal to commit the crimes 16

17 Identity fraud Howdowepreventit? we 1) Check your financial information regularly 2) Be alert to impersonators online Be sure you know who is getting your personal account or financial information online Do not open suspicious Do not click on suspicious web link from suspicious i Their objective is to get their victims to disclose their financial security information through h unsolicited telephone calls, s and SMS 17

18 Identity fraud Howdowepreventit? we 3) Protect your computer and mobile device Use anti virus software, anti spyware and a firewall Don t open files, click on links or download programs sent by strangers Safely dispose of personal information 18

19 Identity fraud Howdowepreventit? we 4) Protect your data and personal information Encrypt your data Read privacy policies Keep passwords private Don t overshare on social networking sites Current location House photo Vacation countdown Be wise about Wi-Fi Lock up your laptop Lock up your mailbox 19

20 Identity fraud How do we report it? The best way to report it: Communication and Multimedia Consumer Forum of Malaysia CYBER 999 (MyCERT) t / / ervices/report_incidents/cyber 999/main/detail/443/index.htm l 20

21 Identity fraud Case Study: Facebook insult to Sultan of Johor Sumber: fined for Facebook insult to Johor Sultan.aspx 21

22 Identity fraud Case Study: Friendster fake account profile Sumber: 22

23 Identity fraud The challenges : Identity / ownership issues Difficulty in establishing an identity ownership To identify the person who pressed the keyboard is beyond the digital forensics limitation In some cases, the digital evidence is inconclusive 23

24 Conflict of interest: The Challenge of Coordination and Cooperation The success in combating identity theft relies on joint efforts and coordination among all stakeholders in every relevant activity The challenge rests both in the conflict of interest and the different priorities iti each stakeholder has within the fight against identity theft 24

25 Malaysia efforts: Internet Banking Task Force Forum IBTF is set up in 2004 to prevent the increase of financial crime activities IBTF members are: All Malaysia commercial banks (banks providing Internet banking services in Malaysia) LEA s (Royal Malaysia Police, Central Bank (BNM), Malaysian Communications and Multimedia Commission (MCMC) and CyberSecurity Malaysia) Invitation for respective group (telcos / researcher) IBTF main roles are: To develop industry-wide best practices To collaborate with other agencies to handle security infringement incidences 25

26 US Secret Service approach: Electronic Crimes Task Force Methodology Form a strategic alliance of law enforcement, private industry partners, and academia which create an atmosphere to: Increase the sharing of investigative information Increase technical knowledge and capabilities to protect cyber infrastructure Increase ability to reach successful conclusions to cyber crime investigations 26

27 US Secret Service approach: Electronic Crimes Task Force Methodology 27

28 Conclusion: Combating cyber crime The success in combating identity fraud relies on joint efforts and coordination among all stakeholders in every relevant activity US Secret Service has successfully combating the identity theft crime using the Electronic Crime Task Force approach. Enforcement, research center, academia and financial industry need to partner up and collaborate in combating cyber crime More awareness programs to outreaching public about the dangerous of cyber crime and what can they do to prevent themselves from being a victim 28

29 Reference: Online materials d=personal&cnttypeid=0&cntkey=ob04.01&programid=ob- OnlineBanking&chCatId=/mbb/Personal y_ news/ /elakkan-kecurian-identiti-nasihat- 0/e a ecu a t as at daripada-cfm

30 Copyright 2012 CyberSecurity Malaysia 30