2009 Security threat report: Arrests and the law

Behind bars

With international computer crime authorities uniting to tackle cybercriminals, the past twelve months have seen more arrests and harsher sentences for criminals involved in high-profile and financially rewarding computer crimes.

Below are just some of the cases that made the news in 2008.

• January 2008. Three men who constructed an elaborate email scam pleaded guilty in a New York court to stealing more than $1.2 million55. The men sent emails that claimed to come from a victim of terminal throat cancer who wanted to distribute $55 million to charity. One of the gang, Nnamdi Chizuba Ainsiobi, is then said to have telephoned recipients, disguising his voice to pretend he was that suffering from the disease.
• February 2008. An American teenager pleaded guilty to seizing control of hundreds of thousands of zombie computers and using them to display cash-generating adverts56. Some of the compromised computers were based at the Weapons Division of the US Naval Air Warfare Center and the US Department of Defense.
• March 2008. A Chinese court handed out jail sentences of between six and a half to eight years to four men who used a Trojan to steal internet bank account information57.
• April 2008. An Israeli court jailed three members of the Modi’in Ezrahi private investigation firm after they were found guilty of using a Trojan to steal commercial information58.
• May 2008. Authorities in the US and Romania charged a total of 38 people suspected of running an international crime ring that targeted hundreds of financial institutions through phishing emails and SMS text messages59.
• June 2008. 19-year-old Jason Michael Milmont admitted to being the programmer of the Nugache malware that infected Windows computers60. The malware turned the computers into a sophisticated peer-to-peer (P2P)-controlled botnet that contained 5,000 to 15,000 compromised computers at any one time. Milmont used stolen bank information to access accounts and buy goods.
• July 2008. A federal court in Manhattan sentenced 17-year-old Adam Vitale to 30 months in prison for sending out more than 1.2 million spam messages in less than a week61. Vitale was looking for a share of the profits made from selling goods via the messages.
• August 2008. Dutch authorities apprehended Leni de Abreu Neto, following assistance from the FBI and the Brazilian Federal Police62. The 35-year-old Brazilian allegedly ran and leased access to a botnet that comprised 100,000 computers.
• September 2008. A gang of alleged credit card data thieves, said to have stolen CDN $1.8 million (approximately US $1.69 million) from a company in Calgary, were arrested by police in Canada63. One of the arrested men was Ehud “The Analyzer” Tenenbaum who had been caught illegally accessing Pentagon computers 10 years earlier.
• October 2008. The Federal Trade Commission (FTC) convinced a court to shut down a group suspected of being a major international spam operation64. The FTC claimed to have received over three million complaints from computer users who had received emails connected with the spam campaign, many of them offering what was described as a “100 percent safe and natural herbal” male enhancement pill.
• November 2008. A US court ordered CyberSpy Software LLC to stop selling its RemoteSpy keylogging software while the FTC investigates whether it is being used to break the law65. In December the ban was overturned66.

Sophos.com