Cyber crime detection: A long road ahead for India

India cannot proclaim that it has the infrastructure to counter cyber attacks with ease.

Statistics pertaining to the number of cyber attacks in the country say so.

While in 2007, India witnessed 217 attacks, 2010 saw 966 and in 2011, the figure crossed 1,000.

India's cyber security is definitely a cause for concern and every day there are new forms of onslaughts.

The latest form of an assault which the world is talking about is the Flame.

The latter has targeted countries like Iran (189 attacks), Isreal/Palestine (98 attacks), Sudan (32), Syria (30), Lebanon (18), Saudi Arabia (10) and Eqypt (5).

. . .

In India, according to Kaspersky Lab which first discovered this piece of malware there has been one detection.

"We observed only 1 detection of Flame in India, Alex Gostev, chief security expert, Global Research and Analysis Team, Kaspersky Lab told rediff.com.

"Every infected sample can replicate to a limited (and very small) number of neighbouring machines, so we do not expect that this number to increase", he added.

There are two known methods of replication: via external media (USB disks) and via local area network, and they are limited using infection counters.

. . .

It is unlikely that a significant number of its copies will cross country borders.

The 'Flame' malware is very sophisticated and the scope of the attack is limited to a small number of computers compared to any other common malware.

It could have exploited the MS10-061 Spooler vulnerability when it was a true 0-day one.

While it is difficult to completely prevent all such attacks, common security measures could have prevented or limited its replication.

It is important to implement proper security policies regarding usage of USB sticks, network level security and to keep Windows and AV software fully updated and patched.

. . .

Infected computers do not have much in common.

The victims are different organisations and individuals.

The primary target of this malware is information that can be interesting to its owners.

We are not sure exactly if India were attacked by Flame.

Only few detections by Kaspersky Lab anti-virus were registered on the computers with Indian IP addresses.

But that could have been any user, even a tourist, who was in India at the moment.

. . .

The countries worst hit by Flame are Iran, Israel/Palestine, Syria, Lebanon.

We don`t have the information on the type of victim.

However, in general, once a system is infected, Flame begins a complex set of operations, including sniffing the network traffic, taking screenshots, recording audio conversations, intercepting the keyboard, and so on.

All this data are available to the operators through the link to Flame's command-and-control servers.

. . .

India could consider this to be a close shave as the Flame, which is deadly in nature, has not done much damage.

Cyber security experts say that India, in the coming days, will have to deal with various sorts of 'geeks', who develop malware and spyware, cyber criminals, hactivists and the like.

Currently, India's bigger concern is the use of cyber space by terrorist outfits.

Home Minister P Chidambaram had pointed out at the Chief Ministers' meeting on the National Counter Terrorism Centre that cyber crime is a grave threat for India.

. . .

Terming the cyber space as the fifth domain after land, sea, air and space, the minister said crimes like hacking, data theft, financial fraud and espionage are often taking place on cyber space.

Cyber security experts say India has started dealing with cyber offences.

It was recently discovered how the Indian Mujahideen was constantly using web space to carry out their activities.

However, these threats could be overcome if the infrastructure is up to the mark.

The real problem begins when India's data are compromised and tools such as Duqu, Flame or Stuxnet are used.

As for India's cyber crime cells, lack of expertise has often been a concern.

. . .

The approach all through has been slow and reactionary.

India does have a good number of ethical hackers, but they often tend to shy away from national duty because of lack of protection, salaries and infrastructure.

Moreover, there is no proper centralised agency to monitor cyber crimes.

Lack of intelligence collection points often leads to either delay or no information at all.

In 2010, about 799 people were arrested.

But the conviction figure had been dismal.

The convictions that have taken place are always related to petty crimes on cyber space.

. . .

While police do unearth information about the bigger players, there lies a problem of connecting the dots and then proving a modus operandi before the court.

India has made the required amendments to its laws dealing with cyber crimes.

The jail terms for those guilty have been enhanced.

Sources in the Intelligence Bureau say that the reason why cyber terrorists thrive is because there is no sense of fear.

They are well aware of the flaws in the system that help them get away.

There is a burning need to have a proper agency which can react soon in order to prevent the crime rather than ponder over it once it takes place.