Taking a byte out of cybercrime

By: Jane S. Hill ; The Dallas Morning News

Posted: 4/13/05

DALLAS--In December, a man was sentenced for conspiring to steal customers' credit card numbers by hacking into the nationwide computer system used by Lowe's Cos., according to a Department of Justice statement.

The U.S. Attorney credited two FBI special agents with leading the investigation that led to the prosecution and conviction, but there's always a long list of unnamed heroes who made it possible.

No single law enforcement agency will ever have the resources to beat the attackers, said Andrew Macpherson, assistant research professor in the Justiceworks Program at University of New Hampshire.

Instead, fighting cybercrime requires sharing information among citizens, executives, law enforcement officers and academic researchers, to name a few, he said.

While forensics experts dust for cyberfingerprints at the crime scene, others, such as Bhavani Thuraisingham, are on the offensive. As head of the CyberSecurity Research Center at the University of Texas at Dallas and a professor of computer science, Thuraisingham is developing techniques to prevent cybercrime.

Designing safe systems requires a strong understanding of the underlying technology, she said, but it also "helps to understand the mind of a criminal." But most computer scientists don't have that kind of training, so UT Dallas computer specialists are turning to researchers in the business school and social sciences.

"If you don't understand the mind of an attacker, you may come up with some good solutions, but there may not be a real need for them," she said.

In particular, Thuraisingham is interested in securing the Semantic Web, a technology that's still a few years from reality.

Whereas today we read content on the Web and then decide what to do with it, in the future, computer programs will "understand Web pages," recognize words or terms, process the information, and make decisions or carry out sophisticated tasks for you.

But an "intelligent" Web opens the door to security problems, she explained, such as "malicious processes" in the system. These include allowing unauthorized users access to data or doing something completely different with the data than was intended.

To thwart problems, Thuraisingham said, the best practice is to incorporate "end-to-end security" in the early design.

"You have to understand what the Semantic Web is, what the layers are, then look at security of the individual pieces, then look at the security when you combine all the pieces," she said.

She and the other UT Dallas researchers are also working on biometrics--the ability of computers to recognize a user by physical features such as face, fingerprint or iris. Authentication by physical identification sounds secure enough, but it's not foolproof.

"This is our challenge: As we make steady progress, the attacker is making steady progress. We have to be one step ahead."

Macpherson at University of New Hampshire said most people, overwhelmed by the speed of technological changes, can't imagine how the good guys can stay ahead of lone hackers, organized crime rings, child porn traffickers, identity thieves, copyright pirates and other cybersharks.

But agencies such as the Department of Homeland Security are "very good at capturing the issues before they happen and identifying the next wave" of vulnerability, he said.

"Partnerships between private enterprise and law enforcement have been very useful at tackling cyberfraud. We've made great strides."

He suggests that anyone wanting to get involved in fighting cybercrime contact their local InfraGard program (www.infragard.net or dallas.fbi.gov/), which partners with the FBI to protect infrastructure.

Membership gives IT professionals a chance "to interact with different businesses and could lead to jobs down the road," he added.

Another avenue is the Cyber Corps initiative at the University of Tulsa that "trains elite squadrons of computer security experts to form the country's first line of defense against global cyberthreats," according to the Web site (www.cis.utulsa.edu/CyberCorps). Open to college students in their junior year or first-year graduate students, the program offers two years of tuition, paid by the National Science Foundation and Department of Defense, plus a stipend and a summer internship in a federal agency.