How is the anti-crime department working?

[DronVR]

How is the anti-crime department working?
Tasks of the cybercrime department:

• Fight against violation of copyright and related rights (Article 146 of the Criminal Code of the Russian Federation, Article 7.12 of the Administrative Code of the Russian Federation);
• Detection of illegal penetration into a computer network (Article 272 of the Criminal Code of the Russian Federation), combating the spread of malicious programs (Article 273 of the Criminal Code of the Russian Federation);
• Identification of violations of the rules of operation of a computer, computer system or their network (article 274 of the Criminal Code of the Russian Federation);
• Identification of the use of fraudulent credit cards (Article 159 of the Criminal Code of the Russian Federation);
• Combating the spread of pornography through the Internet and CDs (Article 242 of the Criminal Code of the Russian Federation).
• Detection of illegal connection to telephone lines (Article 165 of the Criminal Code of the Russian Federation, Article 13.2 of the Administrative Code of the Russian Federation).
• Combating the illicit trafficking of radio-electronic and special technical means (STS), (Article 138 of the Criminal Code of the Russian Federation, Article 171 of the Criminal Code of the Russian Federation, Articles 14.1, 14.42 of the Administrative Code of the Russian Federation)

In such organizations, not some bottom crabs are sitting, but mostly white hackers. White hackers (from the English Black Hat) are citizens who, at a young age, made some kind of computer hacking at the age of not older than 13 years old and fell into the hands of department K. They, in turn, hide the matter without publicizing and exercise total control behind this young hacker, gradually teaching him future work. There are also special schools of the Ministry of Internal Affairs in computer security, they teach a slightly different method with respect to civilian educational institutions in the same specialty.

Although such good specialists work in this institution (blatant lies - most often crabs!), This does not mean that they should be engaged only in mega complex cases. For the most part, they have to do very dirty and obscene work for their professional competence.

For example, one of the citizens of the Russian Federation spoke negatively in the direction of one of the representatives of United Russia party at some forum devoted to political science. The next day, representatives of department K sent a letter to the administration of this resource asking them to delete this statement and generally close this topic on the forum. In response, the department "K" received a refusal from the site administration and in pursuit of a number of negative emotions about this letter. From department K, a series of threats rained down against the administration. In the end, the message was deleted and the topic with it, but in what ways it was achieved, and indeed - this is the work of ordinary operas and this does not apply to computer crimes.

Tactics and strategies of the department:

Operational events are a rather cumbersome topic, a lot of articles can be written about it and it is still impossible to describe everything, because they are constantly being improved and updated, just like the types of attacks and hacks are updated in the hacker world. To do this, I decided to describe some of the standard methods of operational measures.

Well, let's analyze, as they say, the foundation (any system has a foundation, in other words, the standard that the system should adhere to), this is what the standard of operational-search measures looks like:

1. A survey is a conversation with citizens who may be aware of facts, circumstances that are significant for the performance of tasks of operational-search activity.
2. Inquiry.
3. Observation.
4. Operational inspection.
5. Control of mail, telegraph and other messages.
6. Listening to telephone conversations.
7. Operational implementation (employee input into development).

So, in order to deal with each of the stages, we need to present some real picture. Suppose that you, as usual, surf the Internet in search of holes and suddenly break a site, but it turns out that this is the official site of the Moscow Region Administration. You first cursed Google because it brought you to this site, then you started to blame yourself for not even reading the description of the site, but were more interested in describing its errors, and also cursing yourself for leaking the database with confidential data. Then they instantly calmed down when they remembered that you were using a fresh anonymous proxy. Relaxing, you go, put tea, take out buns to sweetly celebrate the victory and enjoy the trophies downloaded from the site.

The next day, smelling of cigarette smoke and a fume of beer, he raises his head from the table, the system administrator of the hacked site and notices that the logs are not in order and reveals the presence of unauthorized access to confidential site data. He quickly brews himself strong coffee, drinks a pill of anti-hangover and then anti-club, runs with bulging eyes with a report on breaking into his boss.

And now, from this moment, the malicious hunt for you begins! And then everything is according to the instructions - a statement is submitted to the local police department with a full description of the hack and attached logs on penetration and another crap. Well, of course, that the employee who accepted the application will not be engaged in this matter, since he does not have the appropriate skills and knowledge. The case is referred to a special department, which we have already learned about - this is Department “K”.

Now it begins First step - This is a survey of citizens who can help in the investigation and search for the offender. In our case, the site admin will be interviewed, they will find out through which hole the hack was made, from which ip-address the hack was made, and they will also ask who the hack was profitable for, whether there are suspicions of someone, or it’s a guest performer like you.

Second phase - This is to make inquiries about the criminal, or rather to process the received data from the first stage, roughly speaking, they will check your IP address in order to find out where, who is your provider. An ordinary citizen can do this using the WHOIS protocol.

WHOIS - This is an application-level network protocol based on the TCP protocol that hangs on port 43. The main application is to obtain registration information about the owners of domain names, IP addresses and autonomous systems.

So, after breaking through the IP address obtained in the logs of the hacked machine, they see in the line Country: USA - that is, the machine with this IP address is in the United States. And this is one of two options, either some kind of CIA devotee decided to break the administration site of the Moscow region, or this is a server - a normal proxy server. Well, the first option is unlikely, but all versions are still being developed, and they need to be checked. First, the IP address is punched through the public server database. If the IP address is clean, then there is a possibility that the server is recently crooked and a proxy is installed there. In this case, you can get by calling open ports. Yes, of course, proxies can also be set up not on a standard port such as 3128 or 8080, 80. But all the same, the services will be shown by the scanner and there are a bunch of other options on how to determine whether a proxy server is worth it or not, take my word for it, for the guys from Department "K" - this will not cause any difficulties.

Having learned that this is a proxy server that you brazenly used to penetrate the system, the K department is faced with the question of how to get information from that server about which IP address it was accessed at a given time. They have two ways, an official request from their colleagues in the United States, and if you get an answer, the case will develop much easier and the answer will be attached to the case. Or the second option, not legal. In the event that Department “K” receives a refusal in an official request, and it will be so, since there is no such agreement between our countries, then in order to advance the case it will be necessary to conduct unauthorized access to this server, again, the guys from Department “K "It’s not difficult, they are sitting there just for such purposes. But having received data from the server about your IP address, this will not be able to get to the point, but you are already embarking on development and it is at this point that you need to sit down on treason.

So, having learned your IP-address, it again makes its way through WHOIS and here it is already clearly visible that you are a comrade from Russia who lives, for example, in Moscow.

They break through where you work, what you do, and a number of other necessary information. Further, they visit the provider and on some fictitious basis, such as your customers’ machines, send spam or are infected with viruses, they demand to provide logs for your person. And now, there are documents that during some other operational activities it was revealed that your IP-address from such-and-such a time was accessing the IP-address from which the site was hacked, but here it is freely attach to the case and this will serve against you in court.

Comes into play third stage - Now you are carefully monitoring your identity, they monitor what sites you visit, where, what you send, etc.

During these events, your personality will finally consolidate itself in a not very successful direction, since it is unlikely that you will stop going to forbidden sites, such as undeground, to break sites and cars.

And here he is fourth stage - this is an operational inspection, in other words, on the basis of all the data obtained during the search, you became the main suspect, and now it’s easy to authorize you to search your apartment and seize your system unit and all media such as flash drives, disks and some other compromising materials on you . They can also take all your notebooks, prints, magazines and a number of other paper media, which may contain something tasty for the investigation. And yet, they do not disdain to poke around in your trash can (not virtual, but real.) All documents from there are also seized, if understood.

All your junk is transported to the building of department “K”, where they will pull out information about where you were, what you did, what software was installed on your computer, whether it was counterfeit (in which case one more article will catch you) . So, they pull your hard drive out of the system and connect it to a device that only reads (this is done in case you decide to protect yourself and install a program that can format the hard drive).

Even if you formatted your hard one before the seizure, then again, it will not be difficult for the employees of department “K” to pull out the necessary information for the investigation. Even programs such as ChromeAnalysis (a program that shows what, where, when, where the owner of this computer went through the GoogleChrome browser), FoxAnalysis (shows the same thing as the ChromeAnalysis program only about the Firefox browser), Web Historian (a universal program for analyzing time browser files) - these programs will show all your travels around the world of the Internet, as well as help to create the correct report, all your locations in the protected part of the Moscow Region Administration site will be shown.

So, now you see that it is not difficult for the employees of Department “K” to pull information from your hard drive, which confirms the fact of hacking.

Fifth and sixth stages - this is to ensure that you have no options at all in court to otmazatsya. This option works for 70%, since you start calling friends, for example, hacker friend Vasya Pupkin and start telling: “Remember, I told you that the site broke? So today they came, they seized everything, etc. etc." (never do that). The recording of a telephone conversation is also attached to the case, and here you yourself are talking about the fact of hacking.

Seventh stage - this stage is put into effect if it was not possible to collect the evidence base in the previous stages. A person is being introduced into your social circle, you are posting all the necessary information and at the time of some hacking you are neatly packaged, and everything starts from the fourth stage.

Source: @odeepweb