android hecking

1. 1
ANDROID HACKING
CHAPTER 1
INTRODUCTION
Nowadays mobile users are increasing day by day. The security threats are also increasing
together with the growth of its users. Android is world’s best-selling operating system for
smart phones with great user interactions, impressive functionalities and popular demand.
Android comes as an interesting study from a security perspective.
In this report, I have described basic understanding of Android, its features, architectures and
hecking application running on it. Computer hacking is the most popular form of hacking
now adays, especially in the field of computer security, but hacking exists in many other
forms, such as phone hacking, brain hacking, etc. and it's not limited to either of them.
1.1 WHAT IS ANDROID AND ANDROID HACKING:
Android is an operating system that is based on linux kernel, and design primarily for touch
screen mobile devices such as smart phones, tablets. Initially developed by Android Inc,
which google backed financially and later bought in 2005. Android was unveiled in 2007
along with founding of open handset Alliance : a consortium of hardware, software and
telecommunication companies devoted to advancing open standards for mobile devices.
ANDROID HACKING means any technical effort to manipulate the normal behavior of
network connections and connected systems, here it is android operating system. Hacking is
the process of exploiting vulnerabilities to gain unauthorized access to systems or resources.
In the computer security context, a hacker is someone who seeks and exploits weaknesses in
a computer system or computer network. Since its inception in september 2008, the Android
platform has been a favourite of hackers worldwide. The open source platform and the
the variety of hardware options make Android a hacker’s dream. Android was created with

2. 2
openness in mind and is conductive to use the third party applications and cloud based
services.
1.2 Andriod hecking application:
Hacking is the practice of modifying the features of a system, in order to accomplish a goal
outside of the creator's original purpose. The person who is consistently engaging in hacking
activities, and has accepted hacking as a lifestyle and philosophy of their choice, is called
a hacker. There are several popular applications that are used by developers to heck android
devices to make them faster, increase bettery life, customize screen saver, ringtones, alerts
and more.the list of hecks available to make improvemets to an Android is large and growing
every day. Due to the mass attention given to blackhat hackers from the media, the whole
hacking term is often mistaken for any security related cyber crime. This damages the
reputation of all hackers, and is very cruel and unfair to the law abiding ones of them, from
who the term itself originated. The goal of this website is to introduce people the true
philosophy and ethics of hackers, hopefully clearing their name and giving them the social
status they deserve Popular surface hacks are:
• Tusker: for location based automation. These crimes are committed by a selected
group of criminals. Unlike crimes using the computer as a tool, these crimes requires
the technical knowledge of the perpetrators. These crimes are relatively new, having
been in existence for only as long as computers have - which explains how
unprepared society and the world in general is towards combating these crimes.
• Ability to install custom keyboards like Swipe and Sweiftkey.
• Deep system tweaks including downloading of new kernel and radios to increase
speed and battry life.
1.3 Some biggerhacking threats to android:

3. 3
1. Data in transit: an attack which is used frequently by hackers is man-in middle
attack where an attacker breaks into device and redirects data to exploit the resources
on it before forwarding it to destination. This method allow hacker to spy on
internet browsing activity. In this types of attack the opponent try to release or read
the contents that is transmitted. For example telephone conversation is recorded or
listens by the third party. We would like to prevent an opponent from learning the
contents of these transmissions.
2. Third party apps: in recent study, 57% of malicious apps in the android
marketplace were found in third part app store. In this type of attack opponent try to
analyze and to determine the location and identity of communicating hosts and could
observe the frequency and length of messages being exchanged. This information
might be useful in guessing the nature of communication that was taking place.
3. Malwares: Malware, short for malicious software, is any software used to disrupt
computer operation, gather sensitive information, or gain access to private computer
systems. Malware is defined by its malicious intent, acting against the requirements of
the computer user, and does not include software that causes unintentional harm due
to some deficiency. The term badware is sometimes used, and applied to both true
(malicious) malware and unintentionally harmful software
 Virus: virus is a malware program that, when executed, replicates by
inserting copies of itself (possibly modified) into other computer programs,
data files, or the boot sector of the hard drive; when this replication
succeeds, the affected areas are then said to be "infected". Virus writers
use social engineering and exploit detailed knowledge of security
vulnerabilities to gain access to their hosts' computing resources. viruses
currently cause billions of dollars worth of economic damage each year due
to causing systems failure, wasting computer resources, corrupting data,
increasing maintenance costs, etc.
 SMS Trojans: For a malicious program to accomplish its goals, it must
be able to run without being detected, shut down, or deleted. When a
malicious program is disguised as something normal or desirable, users
may unwittingly install it. This is the technique of the Trojan horse or
trojan. by including premium functionality into a trojan app an attacker can
run up the victims phoner bill and get the mobile carrier to collect and
distribute money to them. Another malicious use of SMS involves using
an infected device to send out msg text to all contacts in the address with a
link to trick the recipents into downloading and installing the worm. So
infecting so many device at one time.
 Rootkits: Once a malicious program is installed on a system, it is
essential that it stays concealed, to avoid detection. Software packages
known as rootkits allow this concealment, by modifying the host's
operating system so that the malware is hidden from the user. Rootkits can
prevent a malicious process from being visible in the system's list
of processes, or keep its files from being read.

4. 4
CHAPTER 2
2.1 HACKING BLUETOOTH ANDROID DEVICES:
There are variety of different types of bluetooth related threats and attacks that can be
executed against unsuspecting mobile phone users. Following are some common android
threats:
2.1.1 Blueprinting attack : information gathering is the first step in the quest to break into
target system. Even Bluetooth devices can be fingerprinted or probed for information
gathering using technique that is known as blueprinting. Using this one can determine
manufacturer, model, version etc for target Bluetooth enable device.
2.1.2 Bluejack attack: it is the process of sending anonyms message from a Bluetooth enable
device to another, within a particular range without knowing the exact source of received
message to the recipient.
2.1.3 Bluesnarf attack: it is the process of connecting vulnerable mobile phones through
blutooth, without knowing the victim. It involves OBEX protocol by which an attacker can
forcibly pull/push sensitive data in/out of victim’s mobile phone, hence also known as OBEX
pull attack.
This attack requires J2ME enabled mobile phones as the attacker tool. With J2ME enabled
phone, just by using bluesnarfing tool like bloover, redsnarf, bluesnarf etc an attacker can
break into target mobile phone for stealing sensitive data such as address book, photos, mp3,
videos, sms.
2.1.4 Bluesnarfer: it downloads the phonebook of any mobile device.
2.1.5 Bloover: it is a J2ME based auditing tool. It is intended to serve as an audit tool to
check whether mobile is vulnerable or not. It can also be used to carry bluebug attack.
2.1.6 Blueback door attack: here the blutooth related vulnerability exploits the pairing
mechanism that is used to establish a connection between twobluetooth enabled devices. Not
only does It gives the attacker complete access and control over the target but also allows the
attacker to place strategic backdoors for continued access and entry.
2.1.7 Bluebug attack: it was first discovered by Martin Herfurt and allows attacker to gain
complete control over data, voice and messeging channels of target mobile phones.
The blutooth protocol allows devices to use 16 digit long pairing codes. Most slave blutooth
devices continue to use default pairing codes such as 0000,1111, 1234 etc so easy to crack
and gain access.
2.1.8 Superblutooth hack: with this java software you can connect to another mobile.
Once connected to another phone via Bluetooth one can:

5. 5
 Read his/her messages
 Read his /her contacts
 Change profile
 Play ringtone even if phone is on silent
 Play songs
 Restart phone
2.2 Steps to protect your android device:
 Ssl encryption in your device: it is best way to secure the sensitive data.
 Be aware about sms trojans
CHAPTER 3
IT ACT OF INDIA 2000
In May 2000, both the houses of the Indian Parliament passed the Information Technology
Bill. The Bill received the assent of the President in August 2000 and came to be known as
the Information Technology Act, 2000. Cyber laws are contained in the IT Act, 2000.
This Act aims to provide the legal infrastructure for e-commerce in India. And the cyber laws
have a major impact for e-businesses and the new economy in India. So, it is important to
understand what are the various perspectives of the IT Act, 2000 and what it offers.
The Information Technology Act, 2000 also aims to provide for the legal framework so that
legal sanctity is accorded to all electronic records and other activities carried out by electronic
means. The Act states that unless otherwise agreed, an acceptance of contract may be
expressed by electronic means of communication and the same shall have legal validity and
enforceability. Some highlights of the Act are listed below:
Chapter-II of the Act specifically stipulates that any subscriber may authenticate an
electronic record by affixing his digital signature. It further states that any person can verify
an electronic record by use of a public key of the subscriber.
Chapter-III of the Act details about Electronic Governance and provides inter alia amongst
others that where any law provides that information or any other matter shall be in writing or

6. 6
in the typewritten or printed form, then, notwithstanding anything contained in such law, such
requirement shall be deemed to have been satisfied if such information or matter is -
rendered or made available in an electronic form; and accessible so as to be usable for a
subsequent reference. The said chapter also details the legal recognition of Digital Signatures.
Chapter-IV of the said Act gives a scheme for Regulation of Certifying Authorities. The Act
envisages a Controller of Certifying Authorities who shall perform the function of exercising
supervision over the activities of the Certifying Authorities as also laying down standards and
conditions governing the Certifying Authorities as also specifying the various forms and
content of Digital Signature Certificates. The Act recognizes the need for recognizing foreign
Certifying Authorities and it further details the various provisions for the issue of license to
issue Digital Signature Certificates.
Chapter-VII of the Act details about the scheme of things relating to Digital Signature
Certificates. The duties of subscribers are also enshrined in the said Act.
Chapter-IX of the said Act talks about penalties and adjudication for various offences. The
penalties for damage to computer, computer systems etc. has been fixed as damages by way
of compensation not exceeding Rs. 1,00,00,000 to affected persons. The Act talks of
appointment of any officers not below the rank of a Director to the Government of India or an
equivalent officer of state government as an Adjudicating Officer who shall adjudicate
whether any person has made a contravention of any of the provisions of the said Act or rules
framed there under. The said Adjudicating Officer has been given the powers of a Civil
Court.
Chapter-X of the Act talks of the establishment of the Cyber Regulations Appellate
Tribunal, which shall be an appellate body where appeals against the orders passed by the
Adjudicating Officers, shall be preferred.
Chapter-XI of the Act talks about various offences and the said offences shall be
investigated only by a Police Officer not below the rank of the Deputy Superintendent of
Police. These offences include tampering with computer source documents, publishing of
information, which is obscene in electronic form, and hacking.
The Act also provides for the constitution of the Cyber Regulations Advisory Committee,
which shall advice the government as regards any rules, or for any other purpose connected
with the said act. The said Act also proposes to amend the Indian Penal Code, 1860, the
Indian Evidence Act, 1872, The Bankers' Books Evidence Act, 1891, The Reserve Bank of
India Act, 1934 to make them in tune with the provisions of the IT Act.
3.1 Advantages of Cyber Laws
The IT Act 2000 attempts to change outdated laws and provides ways to deal with cyber
crimes. We need such laws so that people can perform purchase transactions over the Net
through credit cards without fear of misuse. The Act offers the much-needed legal framework
so that information is not denied legal effect, validity or enforceability, solely on the ground
that it is in the form of electronic records.

7. 7
In view of the growth in transactions and communications carried out through electronic
records, the Act seeks to empower government departments to accept filing, creating and
retention of official documents in the digital format. The Act has also proposed a legal
framework for the authentication and origin of electronic records / communications through
digital signature.
1. From the perspective of e-commerce in India, the IT Act 2000 and its provisions
contain many positive aspects. Firstly, the implications of these provisions for the e-
businesses would be that email would now be a valid and legal form of
communication in our country that can be duly produced and approved in a court of
law.
2. Companies shall now be able to carry out electronic commerce using the legal
infrastructure provided by the Act.
3. Digital signatures have been given legal validity and sanction in the Act.
4. The Act throws open the doors for the entry of corporate companies in the business of
being Certifying Authorities for issuing Digital Signatures Certificates.The Act now
allows Government to issue notification on the web thus heralding e-governance.
5. The Act enables the companies to file any form, application or any other document
with any office, authority, body or agency owned or controlled by the appropriate
Government in electronic form by means of such electronic form as may be
prescribed by the appropriate Government.
6. Under the IT Act, 2000, it shall now be possible for corporates to have a statutory
remedy in case if anyone breaks into their computer systems or network and causes
damages or copies data. The remedy provided by the Act is in the form of monetary
damages, not exceeding Rs. 1 crore.
3.2 How Cyber Criminals Work:
It has become possible for people with comparatively low technical skills to steal thousands
of pounds a day without leaving their homes. In fact, to make more money than can be made
selling heroin (and with far less risk), the only time the criminal need leave his PC is to
collect his cash. Sometimes they don't even need to do that.
In all industries, efficient business models depend upon horizontal separation of production
processes, professional services, sales channels etc. (each requiring specialized skills and
resources), as well as a good deal of trade at prices set by the market forces of supply and
demand. Cyber crime is no different: it boasts a buoyant international market for skills, tools
and finished product. It even has its own currency. The most straightforward is to buy the
‘finished product’. In this case we’ll use the example of an online bank account. The product
takes the form of information necessary to gain authorized control over a bank account with a
six-figure balance. The cost to obtain this information is $400 (cyber criminals always deal in
dollars). It seems like a small figure, but for the work involved and the risk incurred it’s very
easy money for the criminal who can provide it.
Not all cyber-criminals operate at the coalface, and certainly don’t work exclusively of one
another; different protagonists in the crime community perform a range of important,
specialized functions. These broadly encompass:

8. 8
 Coder – comparative veterans of the hacking community. With a few years'
experience at the art and a list of established contacts, ‘coders’ produce ready-to-use
tools (i.e. Trojans, mailers, custom bots) or services (such as making a binary code
undetectable to AV engines) to the cyber crime labour force – the ‘kids’. Coders can
make a few hundred dollars for every criminal activity they engage in.
 Kids – so-called because of their tender age: most are under 18. They buy, trade and
resell the elementary building blocks of effective cyber-scams such as spam lists, php
mailers, proxies, credit card numbers, hacked hosts, scam pages etc. ‘Kids’ will make
less than $100 a month, largely because of the frequency of being ‘ripped off’ by one
another.
 Drops – the individuals who convert the ‘virtual money’ obtained in cyber crime into
real cash. Usually located in countries with lax e-crime laws (Bolivia, Indonesia and
Malaysia are currently very popular), they represent ‘safe’ addresses for goods
purchased with stolen financial details to be sent, or else ‘safe’ legitimate bank
accounts for money to be transferred into illegally, and paid out of legitimately.
 Mobs – professionally operating criminal organizations combining or utilizing all of
the functions covered by the above. Organized crime makes particularly good use of
safe ‘drops’, as well as recruiting accomplished ‘coders’ onto their payrolls.
3.3 Cyber Forensics: is the art and science of applying computer science to aid the legal
process. With the rapid advance in technology it quickly became more than just an art
though, and nowadays you can even get a cyber forensics specialization degree on the
subject. Computer forensics experts:
 Preserve the evidence.
 Analyze the evidence
 Present the findings.
Computer forensics is done in a fashion that adheres to the standards of evidence that
are admissible in a court of law. Thus, computer forensics must be techno-legal in
nature rather than purely technical or purely legal.
3.3.1 Understand The Suspects
It is absolutely vital for the forensics team to have a solid understanding of the
level of sophistication of the suspect(s). If insufficient information is available to
form this opinion, the suspects must be considered to be experts, and should be
presumed to have installed countermeasures against forensic techniques. Because
of this, it is critical that you appear to the equipment to be as indistinguishable as
possible from its normal users until you have shut it down completely, either in a
manner which probably prohibits the machine modifying the drives, or in exactly
the same way they would.
If the equipment contains only a small amount of critical data on the hard drive, for example,
software exists to wipe it permanently and quickly if a given action occurs. It is straight
forward to link this to the Microsoft Windows "Shutdown" command, for example. However,
simply "pulling the plug" isn't always a great idea, either-- information stored solely in RAM,
or on special peripherals, may be permanently lost. Losing an encryption key stored solely in
Random Access Memory, and possibly unknown even to the suspects themselves by virtue of

9. 9
having been automatically generated, may render a great deal of data on the hard drive(s)
unusable, or at least extremely expensive and time-consuming to recover.
3.3.2 Electronic evidence considerations
Electronic evidence can be collected from a variety of sources. Within a company’s network,
evidence will be found in any form of technology that can be used to transmit or store data.
Evidence should be collected through three parts of an offender’s network: at the workstation
of the offender, on the server accessed by the offender, and on the network that connects the
two. Investigators can therefore use three different sources to confirm of the data’s origin.
CHAPTER 4
CYBER LAW CASES IN INDIA AND WORLD:
4.1 MYSPACE CATCHES A MURDERER
MySpace has played an important role in helping Oakland police apprehend a 19-year old
man accused of shooting a San Leandro High School football player Greg "Doody" Ballard,
Jr.
Oakland police had a street name of a suspect and were able to identify Dwayne Stancill, 19
of Oakland from a picture they found on a gang's MySpace page. Police brought the suspect
to their headquarters where detectives say he confessed. What was most troubling to
investigators was the lack of motive for the killing.
4.1.1 OFFICIAL WEBSITE OF MAHARASTRA GOVERNMENT HACKED
MUMBAI, 20 September 2007 — IT experts were trying yesterday to restore the official
website of the government of Maharashtra, which was hacked in the early hours of Tuesday.
Rakesh Maria, joint commissioner of police, said that the state’s IT officials lodged a formal
complaint with the Cyber Crime Branch police on Tuesday. He added that the hackers would
be tracked down. Yesterday the website, http://www.maharashtragovernment.in, remained
blocked.
Deputy Chief Minister and Home Minister R.R. Patil confirmed that the Maharashtra
government website had been hacked. He added that the state government would seek the
help of IT and the Cyber Crime Branch to investigate the hacking.
“We have taken a serious view of this hacking, and if need be the government would even go
further and seek the help of private IT experts. Discussions are in progress between the
officials of the IT Department and experts,” Patil added.
The state government website contains detailed information about government departments,
circulars, reports, and several other topics. IT experts working on restoring the website told
Arab News that they fear that the hackers may have destroyed all of the website’s contents.

10. 10
According to sources, the hackers may be from Washington. IT experts said that the hackers
had identified themselves as “Hackers Cool Al-Jazeera” and claimed they were based in
Saudi Arabia. They added that this might be a red herring to throw investigators off their trail.
According to a senior official from the state government’s IT department, the official website
has been affected by viruses on several occasions in the past, but was never hacked. The
official added that the website had no firewall.
4.1.2Three people held guilty in on line credit card scam
Customers credit card details were misused through online means for booking air-tickets.
These culprits were caught by the city Cyber Crime Investigation Cell in pune. It is found
that details misused were belonging to 100 people.
Mr. Parvesh Chauhan, ICICI Prudential Life Insurance officer had complained on behalf of
one of his customer. In this regard Mr. Sanjeet Mahavir Singh Lukkad, Dharmendra Bhika
Kale and Ahmead Sikandar Shaikh were arrested. Lukkad being employeed at a private
institution, Kale was his friend. Shaiklh was employed in one of the branches of State Bank
of India .
According to the information provided by the police, one of the customer received a SMS
based alert for purchasing of the ticket even when the credit card was being held by him.
Customer was alert and came to know something was fishy; he enquired and came to know
about the misuse. He contacted the Bank in this regards. Police observed involvement of
many Bank's in this reference.
The tickets were book through online means. Police requested for the log details and got the
information of the Private Institution. Investigation revealed that the details were obtained
from State Bank of India . Shaikh was working in the credit card department; due to this he
had access to credit card details of some customers. He gave that information to Kale. Kale in
return passed this information to his friend Lukkad. Using the information obtained from
Kale Lukkad booked tickets. He used to sell these tickets to customers and get money for the
same. He had given few tickets to various other institutions.
Cyber Cell head DCP Sunil Pulhari and PI Mohan Mohadikar A.P.I Kate were involved in
eight days of investigation and finally caught the culprits.
In this regards various Banks have been contacted; also four air-line industries were
contacted.
DCP Sunil Pulhari has requested customers who have fallen in to this trap to inform police
authorities on 2612-4452 or 2612-3346 if they have any problems.

11. 11
CHAPTER 5
CYBER LAWS IN INDIA
 Why Cyberlaw in India ?
When Internet was developed, the founding fathers of Internet hardly had any
inclination that Internet could transform itself into an all pervading revolution which
could be misused for criminal activities and which required regulation. Today, there
are many disturbing things happening in cyberspace. Due to the anonymous nature of
the Internet, it is possible to engage into a variety of criminal activities with impunity
and people with intelligence, have been grossly misusing this aspect of the Internet to
perpetuate criminal activities in cyberspace. Hence the need for Cyberlaws in India.
 What is the importance of Cyberlaw ?
cyberlaw is important because it touches almost all aspects of transactions and
activities on and concerning the Internet, the World Wide Web and Cyberspace.
Initially it may seem that Cyberlaws is a very technical field and that it does not have
any bearing to most activities in Cyberspace. But the actual truth is that nothing could
be further than the truth. Whether we realize it or not, every action and every reaction
in Cyberspace has some legal and Cyber legal perspectives.
 Does Cyberlaw concern me ?
Yes, Cyberlaw does concern you. As the nature of Internet is changing and this new
medium is being seen as the ultimate medium ever evolved in human history, every
activity of yours in Cyberspace can and will have a Cyberlegal perspective. From the
time you register your Domain Name, to the time you set up your web site, to the time
you promote your website, to the time when you send and receive emails , to the time
you conduct electronic commerce transactions on the said site, at every point of time,
there are various Cyberlaw issues involved. You may not be bothered about these
issues today because you may feel that they are very distant from you and that they do
not have an impact on your Cyber activities. But sooner or later, you will have to
tighten your belts and take note of Cyberlaw for your own benefit.
 Cyberlaw Awareness program
Are your electronic transactions legally binding and authentic? Are you verifying
your customers' identities to prevent identity theft? Does your online terms and
conditions have binding effect? Are you providing appropriate information and clear
steps for forming and concluding your online transactions? How are you ensuring data
protection and information security on your web site? Are you recognising the rights
of your data subjects?

12. 12
 Transacting on the Internet has wide legal implications as it alters the conventional
methods of doing business. To build enduring relationships with your online
customers the legal issues of e-transactions need to be addressed from the onset.
This Awareness program will cover
The basics of Internet Security
basic information on Indian Cyber Law
Impact of technology aided crime
Indian IT Act on covering the legal aspects of all Online Activities
Types of Internet policies required for an Organization.
Minium hardware and software, security measures required in an organization to
protect data.
4.1 ADVANTAGES OF CYBER LAWS
The IT Act 2000 attempts to change outdated laws and provides ways to deal with cyber
crimes. We need such laws so that people can perform purchase transactions over the Net
through credit cards without fear of misuse. The Act offers the much-needed legal framework
so that information is not denied legal effect, validity or enforceability, solely on the ground
that it is in the form of electronic records.
* From the perspective of e-commerce in India, the IT Act 2000 and its provisions contain
many positive aspects. Firstly, the implications of these provisions for the e-businesses would
be that email would now be a valid and legal form of communication in our country that can
be duly produced and approved in a court of law.
* Companies shall now be able to carry out electronic commerce using the legal
infrastructure provided by the Act.
* Digital signatures have been given legal validity and sanction in the Act.
* The Act throws open the doors for the entry of corporate companies in the business of

13. 13
being Certifying Authorities for issuing Digital Signatures Certificates.
* The Act now allows Government to issue notification on the web thus heralding e-
governance.
* The Act enables the companies to file any form, application or any other document with
any office, authority, body or agency owned or controlled by the appropriate Government in
electronic form by means of such electronic form as may be prescribed by the appropriate
Government.
* The IT Act also addresses the important issues of security, which are so critical to the
success of electronic transactions. The Act has given a legal definition to the concept of
secure digital signatures that would be required to have been passed through a system of a
security procedure, as stipulated by the Government at a later date.
4.2 TWO SIDES OF INDIAN CYBER LAW OR IT ACT OF INDIA
Cyber laws are meant to set the definite pattern, some rules and guidelines that defined
certain business activities going on through internet legal and certain illegal and hence
punishable . The IT Act 2000, the cyber law of India , gives the legal framework so that
information is not denied legal effect, validity or enforceability, solely on the ground that it is
in the form of electronic records.
One cannot regard government as complete failure in shielding numerous e-commerce
activities on the firm basis of which this industry has got to its skies, but then the law cannot
be regarded as free from ambiguities.
The IT Act 2000 attempts to change outdated laws and provides ways to deal with cyber
crimes. Let’s have an overview of the law where it takes a firm stand and has got successful
in the reason for which it was framed.
1. The E-commerce industry carries out its business via transactions and communications
done through electronic records . It thus becomes essential that such transactions be made
legal . Keeping this point in the consideration, the IT Act 2000 empowers the government
departments to accept filing, creating and retention of official documents in the digital
format. The Act also puts forward the proposal for setting up the legal framework essential
for the authentication and origin of electronic records / communications through digital
signature.
2. The Act legalizes the e-mail and gives it the status of being valid form of carrying out
communication in India. This implies that e-mails can be duly produced and approved in a
court of law , thus can be a regarded as substantial document to carry out legal proceedings.
3. The act also talks about digital signatures and digital records . These have been also
awarded the status of being legal and valid means that can form strong basis for launching
litigation in a court of law. It invites the corporate companies in the business of being
Certifying Authorities for issuing secure Digital Signatures Certificates.
4. The Act now allows Government to issue notification on the web thus heralding e-
governance.

14. 14
5. The act also provides statutory remedy to the coporates in case the crime against the
accused for breaking into their computer systems or network and damaging and copying the
data is proven. The remedy provided by the Act is in the form of monetary damages, not
exceeding Rs. 1 crore($200,000).
6. Also the law sets up the Territorial Jurisdiction of the Adjudicating Officers for cyber
crimes and the Cyber Regulations Appellate Tribunal.
7. The law has also laid guidelines for providing Internet Services on a license on a non-
exclusive basis.
The IT Law 2000, though appears to be self sufficient, it takes mixed stand when it comes to
many places like:
1. The law misses out completely the issue of Intellectual Property Rights, and makes no
provisions whatsoever copyrighting, trade marking or patenting of electronic information
and data. The law even doesn’t talk of the rights and liabilities of domain name holders ,
the first step of entering into the e-commerce.
2. The law even stays silent over the regulation of electronic payments gateway and
segregates the negotiable instruments from the applicability of the IT Act , which may
have major effect on the growth of e-commerce in India . It leads to make the banking
and financial sectors irresolute in their stands .
3. The act empowers the Deputy Superintendent of Police to look up into the investigations
and filling of charge sheet when any case related to cyber law is called. This approach is
likely to result in misuse in the context of Corporate India as companies have public
offices which would come within the ambit of "public place" under the Act. As a result,
companies will not be able to escape potential harassment at the hands of the DSP.
The Act initially was supposed to apply to crimes committed all over the world, but nobody
knows how can this be achieved in practice , how to enforce it all over the world at the same
time???
* The IT Act is silent on filming anyone’s personal actions in public and then distributing it
electronically.
* For example, many Delhi based newspapers advertise the massage parlors; and in few cases
even show the ‘therapeutic masseurs’ hidden behind the mask, who actually are prostitutes.
Delhi Police has been successful in busting out a few such rackets but then it is not sure of
the action it can take…should it arrest the owners and editors of newspapers or wait for some
new clauses in the Act to be added up?? Even the much hyped case of the arrest of Bajaj, the
CEO of Bazee.com, was a consequence of this particular ambiguity of the law. One cannot
expect an ISP to monitor what information their subscribers are sending out, all 24 hours a
day..
But can the cyber laws of the country be regarded as sufficient and secure enough to provide
a strong platform to the country’s e-commerce industry for which they were meant?? India
has failed to keep in pace with the world in this respect, and the consequence is not far
enough from our sight; most of the big customers of India ’s outsourcing company have
started to re-think of carrying out their business in India .Bajaj’s case has given the strongest
blow in this respect and have broken India ’s share in outsourcing market as a leader.

15. 15
CHAPTER 6
SYSTEM REQUIRMENTS
In present scenario the cyber crimes are increasing day by day. This is because of the bad
people who are living in this world and disturbing the environment with their bad thinking.
Because of these cyber crimes the girls are getting scared as there are many cases of fake id’s
which the bad people make for their benefit or for making the girls image bad in public. After
introducing the cyber law in our country the cyber crimes are becoming less but now also
some of the cases are their which changes the public mind about the people of our country.
Through cyber law many people got arrested and they are now also behind the bar. After
seeing so much safety the people are not creating much violence about this. Because of cyber
crime many people had being suffered and mainly the rich people and the girls. Therefore
Cyber crime system requirements in India are being increasing day by day as per the crimes
are increasing.
Today also there are so many cases of crimes pending in the court and the people are waiting
because of the deficiency of lawyers for cyber crime. So there is need of really good lawyers
who can support the people and provide them a good status in the society. Most of the cases
are of hacking other’s account, spreading virus in others system through email, etc. and
through this many people are suffering from cyber crime. Therefore the cyber crime system
requirements in India are being there as per the cyber crimes are increasing and through this
crime the people feels unsafely about their personal accounts and their id’s.
As per the system the person gets fixed years of jail after getting caught in this crime but
between these people many people are intelligent also but they are using their brain in wrong
direction. If these people use their brain in right direction then they can get good amount of
money with great image also. By doing this bad work some people get addicted to this and
they make this as their professional carrier. When the cyber crime system requirements in
India get fulfilled most of the people will get their response from your side. Many people are
waiting to get their case in the court but not getting it, therefore some people who goes in this
field try to choose cyber crime as their carrier because through this, many people will get
their image back and you will also feel good about them.
6.1 TYPES OF HACKERS
6.1.1 Whitehat hackers: A white hat hacker, also rendered as ethical hacker, is, in the
realm of information technology, a person who is ethically opposed to the abuse of computer
systems. Realization that the Internet now represents human voices from around the world
has made the defense of its integrity an important pastime for many. A white hat generally
focuses on securing IT systems, whereas a black hat (the opposite) would like to break into
them.
The primary difference between white and black hat hackers is that a white hat hacker claims
to observe ethical principles. Like black hats, white hats are often intimately familiar with the
internal details of security systems, and can delve into obscure machine code when needed to
find a solution to a tricky problem.

16. 16
The term "white hat" in Internet slang refers to an ethical computer hacker, or a computer
security expert, who specializes in penetration testing and in other testing methodologies to
ensure the security of an organization's information systems.Ethical hacking is a term coined
by IBM meant to imply a broader category than just penetration testing. White-hat hackers
may also work in teams called "sneakers", red teams, or tiger teams,WhiteHat Adda.]
6.1.2 Greyhat hackers: Gray hat describes a cracker (or, if you prefer, hacker) who
exploits a security weakness in a computer system or product in order to bring the weakness
to the attention of the owners. Unlike a black hat, a gray hat acts without malicious intent.
The goal of a gray hat is to improve system and network security.
further difference among these types of hacker lies in their methods of discovering
vulnerabilities. The white hat generally breaks into systems and networks at the request of
their employer or with explicit permission for the purpose of determining how secure it is
against hackers, whereas the black hat will break into any system or network in order to
uncover sensitive information and for personal gain. The grey hat generally has the skills and
intent of the white hat but will break into any system or network without permission.
In the search engine optimization (SEO) community, grey hat hackers are those who
manipulate web sites’ search engine rankings using improper or unethical means but that are
not considered search engine spam.
A grey hat hacker lies between a black hat and a white hat hacker. A grey hat hacker may surf
the Internet and hack into a computer system for the sole purpose of notifying the
administrator that their system has a security defect, for example. They may then offer to
correct the defect for a fee. Grey hat hackers sometimes find the defect of a system and
publish the facts to the world instead of a group of people. Even though grey hat hackers do
not perform hacking for their personal gain, unauthorized access to a system can be
considered illegal and unethical.
6.1.3 Blackhathackers: A black hat hacker is an individual with extensive computer
knowledge whose purpose is to breach or bypass internet security. Black hat hackers are
also known as crackers or dark-side hackers. The general view is that, while hackers build
things, crackers break things.
A "black hat" hacker is a hacker who "violates computer security for little reason beyond
maliciousness or for personal gain" (Moore, 2005).Black hat hackers form the stereotypical,
illegal hacking groups often portrayed in popular culture, and are "the epitome of all that the
public fears in a computer criminal". Black hat hackers break into secure networks to destroy,
modify, or steal data; or to make the network unusable for those who are authorized to use the
network. Black hat hackers are also referred to as the "crackers" within the security industry
and by modern programmers. Crackers keep the awareness of the vulnerabilities to
themselves and do not notify the general public or the manufacturer for patches to be applied.
Individual freedom and accessibility is promoted over privacy and security. Once they have
gained control over a system, they may apply patches or fixes to the system only to keep their
reigning control. Richard Stallman invented the definition to express the maliciousness of a
criminal hacker versus a white hat hacker who performs hacking duties to identify places

17. 17
CHAPTER 7
COMPUTER CRIMES
7.1 Computer crime, cyber crime, e-crime, hi-tech crime or electronic crime generally refers
to criminal activity where a computer or network is the source, tool, target, or place of a
crime. These categories are not exclusive and many activities can be characterized as falling
in one or more category. Additionally, although the terms computer crime or cybercrime are
more properly restricted to describing criminal activity in which the computer or network is a
necessary part of the crime, these terms are also sometimes used to include traditional crimes,
such as fraud, theft, blackmail, forgery, and embezzlement, in which computers or networks
are used to facilitate the illicit activity.
Computer crime or cyber crime can broadly be defined as criminal activity involving an
information technology infrastructure, including illegal access (unauthorized access), illegal
interception (by technical means of non-public transmissions of computer data to, from or
within a computer system), data interference (unauthorized damaging, deletion, deterioration,
alteration or suppression of computer data), systems interference (interfering with the
functioning of a computer system by inputting, transmitting, damaging, deleting,
deteriorating, altering or suppressing computer data), misuse of devices, forgery (ID theft),
and electronic fraud.
7.1.1 Discussion
A common example would be when a person intends to steal information from, or cause
damage to, a computer or computer network. This can be entirely virtual in that the
information only exists in digital form, and the damage, while real, has no physical
consequence other than the machine ceases to function. In some legal systems, intangible
property cannot be stolen and the damage must be visible, e.g. as resulting from a blow from
a hammer. Yet denial of service attacks for the purposes of extortion may result in significant
damage both to the system and the profitability of the site targeted. A further problem is that
many definitions have not kept pace with the technology. For example, where the offense
requires proof of a trick or deception as the operative cause of the theft, this may require the
mind of a human being to change and so do or refrain from doing something that causes the
loss. Increasingly, computer systems control access to goods and services. If a criminal
manipulates the system into releasing the goods or authorizing the services, has there been a
"trick", has there been a "deception", does the machine act because it "believes" payment to
have been made, does the machine have "knowledge", does the machine "do" or "refrain from
doing" something it has been programmed to do (or not). Where human-centric terminology
is used for crimes relying on natural language skills and innate gullibility, definitions have to
be modified to ensure that fraudulent behavior remains criminal no matter how it is
committed (consider the definition of wire fraud).
Issues surrounding hacking, copyright infringement through warez, child pornography, and
paedophilia (see child grooming), have become high-profile. But this emphasis fails to
consider the equally real but less spectacular issues of obscene graffiti appearing on websites
and "cyberstalking" or harassment that can affect everyday life. There are also problems of
privacy when confidential information is lost, say, when an e-mail is intercepted whether
through illegal hacking, legitimate monitoring (increasingly common in the workplace) or
when it is simply read by an unauthorized or unintended person.

18. 18
E-mail and Short Message Service (SMS) messages are seen as casual communication
including many things that would never be put in a letter. But unlike spoken communication,
there is no intonation and accenting, so the message can be more easily distorted or
interpreted as offensive. In England and Wales, s43 Telecommunications Act 1984 makes it
an offense to use a public telecommunications network to send 'grossly offensive, threatening
or obscene' material, and a 'public telecommunications network' is widely enough defined to
cover Internet traffic which goes through telephone lines or other cables.
Secondly, a computer can be the tool, used, for example, to plan or commit an offense such
as larceny or the distribution of child pornography. The growth of international data
communications and in particular the Internet has made these crimes both more common and
more difficult to police. And using encryption techniques, criminals may conspire or
exchange data with fewer opportunities for the police to monitor and intercept. This requires
modification to the standard warrants for search, telephone tapping, etc.
Thirdly, a computer can be a source of evidence. Even though the computer is not directly
used for criminal purposes, it is an excellent device for record keeping, particularly given the
power to encrypt the data. If this evidence can be obtained and decrypted, it can be of great
value to criminal investigators. Thus, specialized government agencies and units have been
set up to develop the necessary expertise. See below for a link to the U.S. Department of
Justice's website about e-crime and its computer forensics services.
7.1.2 Computer Fraudes
Computer fraud is any dishonest misrepresentation of fact intended to induce another to do or
refrain from doing something which causes loss. In this context, the fraud will result in
obtaining a benefit by:
* altering computer input in an unauthorized way. This requires little technical expertise and
is not an uncommon form of theft by employees altering the data before entry or entering
false data, or by entering unauthorized instructions or using unauthorized processes;
* altering, destroying, suppressing, or stealing output, usually to conceal unauthorized
transactions: this is difficult to detect;
* altering or deleting stored data; or
* altering or misusing existing system tools or software packages, or altering or writing code
for fraudulent purposes. This requires real programming skills and is not common.
Manipulating banking systems to make unauthorized identity theft with reference to ATM
fraud.
7.1.3 Offensive Contents
The content of websites and other electronic communications may be harmful, distasteful or
offensive for a variety of reasons. Most countries have enacted law that place some limits on
the freedom of speech and ban racist, blasphemous, politically subversive, seditious or
inflammatory material that tends to incite hate crimes. This is a sensitive area in which the
courts can become involved in arbitrating between groups with entrenched beliefs, each
convinced that their point of view has been unreasonably attacked. In England, s28 Crime
and Disorder Act 1998 defines a racial group, following Mandla v Dowell-Lee (1983) 2 AC
548 (in which a requirement to wear a cap as part of a school uniform had the effect of

19. 19
excluding Sikh boys whose religion required them to wear a turban), as a group of persons
defined by reference to race, color, nationality (including citizenship) or ethnic or national
origin; and a religious group as a group of persons defined by reference to religious belief or
lack of religious belief. Therefore, it is equally an offense to show hostility to a person who
practices a particular faith as to a person who has no religious belief or faith.
7.1.4 Harassment
Whereas content may be offensive in a non-specific way, harassment directs obscenities and
derogatory comments at specific individuals focusing for example on gender, race, religion,
nationality, sexual orientation. This often occurs in chat rooms, through newsgroups, and by
sending hate e-mail to interested parties (see cyber bullying, harassment by computer,
stalking, and cyberstalking). In England, in a broader form than s43 Telecommunications Act
1984, s1 Malicious Communications Act 1988 makes it an offense to send an indecent,
offensive or threatening letter, electronic communication or other article to another person.
Now, s2 Protection from Harassment Act 1997 criminalizes a course of conduct amounting to
harassment which the defendant knows, or ought to know, amounts to harassment of another.
If a reasonable person in possession of the same information would think the course of
conduct amounted to harassment of the other, the knowledge will be imputed to the
defendant. Although harassment is not defined, s7 states that it includes causing alarm or
distress, and conduct is defined as including speech in all its forms. In DPP v Collins (2006)
1 WLR 308 the defendant repeatedly telephoned the offices of his MP on a wide range of
political matters. In conversations with employees at the office and on messages left on the
telephone answering machine, he used racist terms to show the frustration he felt at the way
in which his affairs were being handled. No-one was personally offended, but the staff
became depressed. Charged under s127(1) Communications Act 2003, the magistrates found
that the terms were offensive but that a reasonable person would not find them grossly
offensive. To determine whether any message content is merely offensive or grossly
offensive depended on their particular circumstances and context, i.e. in the wider society
which is an open and just multi-racial society, the test of offensiveness was objective.
More problematic are deliberate attacks which amount to defamation although, in March
2006, Michael Keith-Smith became the first person to win damages from an individual
internet user after she accused him of being a 'sex offender' and 'racist blogger' on a Yahoo!
discussion site. She also claimed that his wife was a prostitute. The High Court judge decided
that Tracy Williams, of Oldham, was "particularly abusive" and "her statements demonstrated
that ... she had no intention of stopping her libellous and defamatory behavior". She was
ordered to pay £10,000 in damages, plus £7,200 costs. In general, libel is not treated as a
criminal matter except when it may provoke the person defamed into retaliatory violence (All
forms of unsolicited e-mail and advertisements can also be considered to be forms of Internet
harassment where the content is offensive or of an explicit sexual nature. Now termed spam,
it has been criminalized in various countries.
7.1.5 Drug Trafficking
rug traffickers are increasingly taking advantage of the Internet to sell their illegal substances
through encrypted e-mail and other Internet Technology. Some drug traffickers arrange deals
at internet cafes, use courier Web sites to track illegal packages of pills, and swap recipes for
amphetamines in restricted-access chat rooms.

20. 20
The Internet's easy-to-learn, fast-paced character, global impact, and fairly reliable privacy
features facilitate the marketing of illicit drugs. Detecting money laundering of cash earned
by drug traffickers is very difficult, because dealers are now able to use electronic commerce
and Internet banking facilities. Also, traffickers have been using online package tracking
services offered by courier companies to keep tabs on the progress of their shipments. If there
happened to be some sort of undue delay, this could signal authority interception of the drugs,
which would still allow the dealers time to cover their tracks. Law enforcement is also more
deficient because illicit drug deals are arranged instantaneously, over short distances, making
interception by authorities much more difficult.
The rise in Internet drug trades could also be attributed to the lack of face-to-face
communication. These virtual exchanges allow more intimidated individuals to more
comfortably purchase illegal drugs. The sketchy effects that are often associated with drug
trades are severely minimized and the filtering process that comes with physical interaction
fades away. Furthermore, traditional drug recipes were carefully kept secrets. But with
modern computer technology, this information is now being made available to anyone with
computer access.
To understand the techniques for securing a computer system, it is important to first
understand the various types of "attacks" that can be made against it. It should be noted, there
are numerous third party vendors which not only produce software capable of monitoring
these computer systems internally, but there are security products capable of monitoring
external activity, whether observed or hidden monitoring, such as via security cameras or
other similar security system types.
7.2 COMPUTER INSECURITIES
7.2.1 Financial cost: Serious financial damage has been caused by computer security
breaches, but reliably estimating costs is quite difficult. Figures in the billions of dollars have
been quoted in relation to the damage caused by malware such as computer worms like the
Code Red worm, but such estimates may be exaggerated. However, other losses, such as
those caused by the compromise of credit card information, can be more easily determined,
and they have been substantial, as measured by millions of individual victims of identity theft
each year in each of several nations, and the severe hardship imposed on each victim, that can
wipe out all of their finances, prevent them from getting a job, plus be treated as if they were
the criminal. Volumes of victims of phishing and other scams may not be known.

21. 21
Individuals who have been infected with spyware or malware likely go through a costly and
time-consuming process of having their computer cleaned. Spyware and malware is
considered to be a problem specific to the various Microsoft Windows operating systems,
however this can be explained somewhat by the fact that Microsoft controls a major share of
the PC market and thus represent the most prominent target.
7.2.2 Reasons: There are many similarities (yet many fundamental differences) between
computer and physical security. Just like real-world security, the motivations for breaches of
computer security vary between attackers, sometimes called hackers or crackers. Some are
teenage thrill-seekers or vandals (the kind often responsible for defacing web sites); similarly,
some web site defacements are done to make political statements. However, some attackers
are highly skilled and motivated with the goal of compromising computers for financial gain
or espionage. An example of the latter is Markus Hess who spied for the KGB and was
ultimately caught because of the efforts of Clifford Stoll, who wrote an amusing and accurate
book, The Cuckoo's Egg, about his experiences. For those seeking to prevent security
breaches, the first step is usually to attempt to identify what might motivate an attack on the
system, how much the continued operation and information security of the system are worth,
and who might be motivated to breach it. The precautions required for a home PC are very
different for those of banks' Internet banking system, and different again for a classified
military network. Other computer security writers suggest that, since an attacker using a
network need know nothing about you or what you have on your computer, attacker
motivation is inherently impossible to determine beyond guessing. If true, blocking all
possible attacks is the only plausible action to take.
7.2.3 Vulnerabilities: To understand the techniques for securing a computer system, it is
important to first understand the various types of "attacks" that can be made against it. These
threats can typically be classified into one of these seven categories:
1. Exploits: Software flaws, especially buffer overflows, are often exploited to gain control
of a computer, or to cause it to operate in an unexpected manner. Many development
methodologies used by embedded software licensing professionals rely on testing to
ensure the quality of any code released;; this process often fails to discover extremely
unusual potential exploits. The term "exploit" generally refers to small programs
designed to take advantage of a software flaw that has been discovered, either remote or
local. The code from the exploit program is frequently reused in trojan horses and
computer viruses. In some cases, a vulnerability can lie in certain programs' processing
of a specific file type, such as a non-executable media file.
2. Eavesdropping: Any data that is transmitted over a network is at some risk of being
eavesdropped, or even modified by a malicious person. Even machines that operate as a
closed system (ie, with no contact to the outside world) can be eavesdropped upon via
monitoring the faint electro-magnetic transmissions generated by the hardware such as
TEMPEST. The FBI's proposed Carnivore program was intended to act as a system of
eavesdropping protocols built into the systems of internet service providers.
3. Social engineering and human errors: A computer system is no more secure than the
human systems responsible for its operation. Malicious individuals have regularly
penetrated well-designed, secure computer systems by taking advantage of the
carelessness of trusted individuals, or by deliberately deceiving them, for example
sending messages that they are the system administrator and asking for passwords. This
deception is known as Social engineering.

22. 22
4. Denial of service attacks: Denial of service (DoS) attacks differ slightly from those
listed above, in that they are not primarily a means to gain unauthorized access or control
of a system. They are instead designed to render it unusable. Attackers can deny service
to individual victims, such as by deliberately guessing a wrong password 3 consecutive
times and thus causing the victim account to be locked, or they may overload the
capabilities of a machine or network and block all users at once. These types of attack
are, in practice, very hard to prevent, because the behavior of whole networks needs to be
analyzed, not only the behaviour of small pieces of code. Distributed denial of service
(DDoS) attacks are common, where a large number of compromised hosts (commonly
referred to as "zombie computers") are used to flood a target system with network
requests, thus attempting to render it unusable through resource exhaustion. Another
technique to exhaust victim resources is through the use of an attack amplifier - where
the attacker takes advantage of poorly designed protocols on 3rd party machines.
5. Indirect attacks: Attacks in which one or more of the attack types above are launched
from a third party computer which has been taken over remotely. By using someone
else's computer to launch an attack, it becomes far more difficult to track down the actual
attacker. There have also been cases where attackers took advantage of public
anonymizing systems, such as the tor onion router system.
6. Direct attack: Common consumer devices that can be used to transfer data
surreptitiously.
Common consumer devices that can be used to transfer data surreptitiously.
Someone gaining physical access to a computer can install all manner of devices to
compromise security, including operating system modifications, software worms, key
loggers, and covert listening devices. The attacker can also easily download large
quantities of data onto backup media, for instance CD-R/DVD-R, tape; or portable
devices such as keydrives, digital cameras or digital audio players. Another common
technique is to boot an operating system contained on a CD-ROM or other bootable
media and read the data from the harddrive(s) this way. The only way to defeat this is to
encrypt the storage media and store the key separate from the system.
Attackers can deny service to individual victims, such as by deliberately guessing a
wrong password 3 consecutive times and thus causing the victim account to be locked, or
they may overload the capabilities of a machine or network and block all users at once.
These types of attack are, in practice, very hard to prevent, because the behavior of
whole networks needs to be analyzed, not only the behaviour of small pieces of code.
7.2.4 Security measures
A state of computer "security" is the conceptual ideal, attained by the use of the three
processes:
1.prevention
2.detection
3.response

23. 23
* User account access controls and cryptography can protect systems files and data,
respectively.
* Firewalls are by far the most common prevention systems from a network security
perspective as they can (if properly configured) shield access to internal network services,
and block certain kinds of attacks through packet filtering.
* Intrusion Detection Systems (IDS's) are designed to detect network attacks in progress and
assist in post-attack forensics, while audit trails and logs serve a similar function for
individual systems.
* "Response" is necessarily defined by the assessed security requirements of an individual
system and may cover the range from simple upgrade of protections to notification of legal
authorities, counter-attacks, and the like.
7.3.5 Difficulty With Response: Responding forcefully to attempted security breaches (in
the manner that one would for attempted physical security breaches) is often very difficult for
a variety of reasons:
* Identifying attackers is difficult, as they are often in a different jurisdiction to the systems
they attempt to breach, and operate through proxies, temporary anonymous dial-up accounts,
wireless connections, and other anonymising procedures which make backtracing difficult
and are often located in yet another jurisdiction
* Law enforcement officers are often unfamiliar with information technology, and so lack the
skills and interest in pursuing attackers. There are also budgetary constraints. It has been
argued that the high cost of technology, such as DNA testing, and improved forensics mean
less money for other kinds of law enforcement, so the overall rate of criminals not getting
dealt with goes up as the cost of the technology increases.
Other crimes such as email “phishing” are not as known to the public until an individual
receives one of these fraudulent emails. These emails are cover faced by the illusion that the
email is from your bank or another bank. When a person reads the email he/she is informed
of a problem with he/she personal account or another individual wants to send the person
some of their money and deposit it directly into their account. The email asks for your
personal account information and when a person gives this information away, they are
financing the work of a criminal.
The attacker can also easily download large quantities of data onto backup media, for
instance CD-R/DVD-R, tape; or portable devices such as keydrives, digital cameras or digital
audio players. Another common technique is to boot an operating system contained on a CD-
ROM or other bootable media and read the data from the harddrive(s) this way. The only way
to defeat this is to encrypt the storage media and store the key separate from the system. The
only way to defeat this is to encrypt the storage media and store the key separate from the
system.

24. 24
CHAPTER 8
INTERNET CRIMES
With the evolution of the Internet, along came another revolution of crime where the
perpetrators commit acts of crime and wrongdoing on the World Wide Web. Internet crime
takes many faces and is committed in diverse fashions. The number of users and their
diversity in their makeup has exposed the Internet to everyone. Some criminals in the Internet
have grown up understanding this superhighway of information, unlike the older generation
of users. This is why Internet crime has now become a growing problem in the United States.
Some crimes committed on the Internet have been exposed to the world and some remain a
mystery up until they are perpetrated against someone or some company.
The different types of Internet crime vary in their design and how easily they are able to be
committed. Internet crimes can be separated into two different categories. There are crimes
that are only committed while being on the Internet and are created exclusively because of
the World Wide Web. The typical crimes in criminal history are now being brought to a
whole different level of innovation and ingenuity. Such new crimes devoted to the Internet
are email “phishing”, hijacking domain names, virus immistion, and cyber vandalism. A
couple of these crimes are activities that have been exposed and introduced into the world.
People have been trying to solve virus problems by installing virus protection software and
other software that can protect their computers. Other crimes such as email “phishing” are not
as known to the public until an individual receives one of these fraudulent emails. These
emails are cover faced by the illusion that the email is from your bank or another bank. When
a person reads the email he/she is informed of a problem with he/she personal account or
another individual wants to send the person some of their money and deposit it directly into
their account. The email asks for your personal account information and when a person gives
this information away, they are financing the work of a criminal
8.1 Statistics:
The statistics that have been obtained and reported about demonstrate the seriousness Internet
crimes in the world. Just the "phishing" emails mentioned in a previous paragraph produce
one billion dollars for their perpetrators (Dalton 1). In a FBI survey in early 2004, 90 percent
of the 500 companies surveyed reported a security breach and 80 percent of those suffered a
financial loss (Fisher 22). A national statistic in 2003 stated that four billion dollars in credit
card fraud are lost each year. Only two percent of credit card transactions take place over the
Internet but fifty percent of the four billion, mentioned before, are from the transaction online
(Burden and Palmer 5). All these finding are just an illustration of the misuse of the Internet
and a reason why Internet crime has to be slowed down.
8.2 Stopping the problem:
The question about how to police these crimes has already been constructed, but this task is
turning out to be an uphill battle. Since the first computer crime law, the Counterfeit Access
Device and Computer Fraud and Abuse Act of 1984, the government has been trying to track
down and stop online criminals. The FBI has tried many programs and investigations in order
to deter Internet crime, like creating an online crime registry for employers (Metchik 29). The
reality is that Internet criminals are rarely caught. One reason is that hackers will use one
computer in one country to hack another computer in another.

25. 25
CHAPTER 9
INTERNET FRAUDS
9.1 Overview: Internet fraud is committed in several ways. The FBI and police agencies
worldwide have people assigned to combat this type of fraud; according to figures from the
FBI, U.S. companies' losses due to Internet fraud in 2003 surpassed US$500 million. In some
cases, fictitious merchants advertise goods for very low prices and never deliver. However,
that type of fraud is minuscule compared to criminals using stolen credit card information to
buy goods and services.
9.2 Identity theft schemes
9.2.1 Stolen credit cards
Most Internet fraud is done through the use of stolen credit card information which is
obtained in many ways, the simplest being copying information from retailers, either online
or offline. There have been many cases of crackers obtaining huge quantities of credit card
information from companies' databases. There have been cases of employees of companies
that deal with millions of customers in which they were selling the credit card information to
criminals.
Despite the claims of the credit card industry and various merchants, using credit cards for
online purchases can be insecure and carry a certain risk. Even so called "secure transactions"
are not fully secure, since the information needs to be decrypted to plain text in order to
process it. This is one of the points where credit card information is typically stolen.
9.2.2 Get wire transfer info
Some fraudsters approach merchants asking them for large quotes. After they quickly accept
the merchant's quote, they ask for wire transfer information to send payment. Immediately,
they use online check issuing systems as Qchex that require nothing but a working email, to
produce checks that they use to pay other merchants or simply send associates to cash them.
9.3 Purchase scams
9.3.1 Direct solicitations
The most straightforward type of purchase scam is a buyer in another country approaching
many merchants through spamming them and directly asking them if they can ship to them
using credit cards to pay.
An example of such email is as follows:
From: XXXXXX XXXXXX [XXXXXXX@hotmail.com] Sent: Saturday, October 01, 2005
11:35 AM Subject: International order enquiry
Goodday Sales, This is XXXXXX XXXXXXX and I will like to place an order for some
products in your store, But before I proceed with listing my requirements, I will like to know
if you accept credit card and can ship internationally to Lagos, Nigeria. Could you get back to

26. 26
me with your website so as to forward you the list of my requirements as soon as possible.
Regards, XXXXXX XXXXXX, XXXXXXXX Inc. 9999 XXXXX street, Mushin, Lagos
23401, Nigeria Telephone: 234-1-99999999, Fax: 234-1-9999999, Email:
XXXXXXXXX@hotmail.com
Most likely, a few weeks or months after the merchant ships and charges the Nigerian credit
card, he/she will be hit with a chargeback from the credit card processor and lose all the
money.
9.3.2 Counterfeit Postal Money Orders
According to the FBI and postal inspectors, there has been a significant surge in the use of
Counterfeit Postal Money Orders since October 2004. More than 3,700 counterfeit postal
money orders (CPMOs) were intercepted by authorities from October to December of 2004,
and according to the USPS, the "quality" of the counterfeits is so good that ordinary
consumers can easily be fooled.
9.3.3 Online automotive fraud
There are two basic schemes in online automotive fraud:
A fraudster posts a vehicle for sale on an online site, generally for luxury or sports cars
advertised for thousands less than market value. The details of the vehicle, including photos
and description, are typically lifted from sites such as eBay Motors and re-posted elsewhere.
An interested buyer, hopeful for a bargain, emails the seller, who responds saying the car is
still available but is located overseas. He then instructs the buyer to send a deposit via wire
transfer to initiate the "shipping" process. The unwitting buyer wires the funds, and doesn't
discover until days or weeks later that they were scammed.
A fraudster feigns interest in an actual vehicle for sale on the Internet. The "buyer" explains
that a client of his is interested in the car, but due to an earlier sale that fell through has a
certified check for thousands more than the asking price and requests the seller to send the
balance via wire transfer. If the seller agrees to the transaction, the buyer sends the certified
check via express courier (typically from Nigeria). The seller takes the check to their bank,
which makes the funds available immediately. Thinking the bank has cleared the check, the
seller follows through on the transaction by wiring the balance to the buyer. Days later, the
check bounces and the seller realizes they have been scammed. But the money has long since
been picked up and is not recoverable.
9.3.4 Cash the check system
In some cases, fraudsters approach merchants and ask for large orders: $50,000 to $200,000,
and agree to pay via wire transfer in advance. After brief negotiation, the buyers gives an
excuse about the impossibility of sending a bank wire transfer. The buyer then offers to send
a check, stating that the merchant can wait for the check to clear before shipping any goods.
The check received, however, is a counterfeit of a check from a medium to large U.S.
company. If asked, the buyer will claim that the check is money owed from the large
company. The merchant deposits the check and it clears, so the goods are sent. Only later,
when the larger company notices the check, will the merchant's account be debited.

27. 27
CHAPTER 10
CONCLUSION
Computer crime is a general term that embraces such crimes as phishing, credit card frauds,
bank robbery, illegal downloading, industrial espionage, child pornography, kidnapping
children via chat rooms, scams, cyberterrorism, creation and/or distribution of viruses, Spam
and so on. All such crimes are computer related and facilitated crimes.
With the evolution of the Internet, along came another revolution of crime where the
perpetrators commit acts of crime and wrongdoing on the World Wide Web. Internet crime
takes many faces and is committed in diverse fashions. The number of users and their
diversity in their makeup has exposed the Internet to everyone. Some criminals in the Internet
have grown up understanding this superhighway of information, unlike the older generation
of users. This is why Internet crime has now become a growing problem in the United States.
Some crimes committed on the Internet have been exposed to the world and some remain a
mystery up until they are perpetrated against someone or some company.
The different types of Internet crime vary in their design and how easily they are able to be
committed. Internet crimes can be separated into two different categories. There are crimes
that are only committed while being on the Internet and are created exclusively because of
the World Wide Web. The typical crimes in criminal history are now being brought to a
whole different level of innovation and ingenuity. Such new crimes devoted to the Internet
are email “phishing”, hijacking domain names, virus immistion, and cyber vandalism. A
couple of these crimes are activities that have been exposed and introduced into the world.
People have been trying to solve virus problems by installing virus protection software and
other software that can protect their computers. Other crimes such as email “phishing” are not
as known to the public until an individual receives one of these fraudulent emails. These
emails are cover faced by the illusion that the email is from your bank or another bank. When
a person reads the email he/she is informed of a problem with he/she personal account or
another individual wants to send the person some of their money and deposit it directly into
their account. The email asks for your personal account information and when a person gives
this information away, they are financing the work of a criminal
So we should say no to cyber crimes.

28. 28
10. REFRENCES:
WWW.Cyberlawsindia.net
http://en.wikipedia.org/wiki/Computer_crime
www.facebook.com/mrooppss

29. 29