RSA 2009: SOCA attacks heart of organised cyber crime

The criminal underground is making serious money from cyber crime on different fronts, but Britain's Serious Organised Crime Agency (SOCA) is fighting back.

At the RSA Conference in London, Andy Auld, the head of intelligence at SOCA's e-crime department, said that the agency's main goal was to target criminal's IT infrastructures in the same way that such hackers target real businesses.

SOCA is considering infiltrating the groups and trying to undermine them from within using undercover officers, or using sources from criminal forums where fraudsters barter and communicate.

It would also "target the money" by focusing on the electronic exchanges of funds between different criminal groups.

"The exchanges are actually a critical part of the groups and how they function," Auld said. "Taking out the exchanges and the operators who lead forums are one of those targets."

SOCA also wants to identify weaknesses in business that cyber criminals are actively targeting, and find where hackers are storing stolen data.

"These guys are harvesting the data in bulk, using various methods such as hacking corporate networks or mass infection of malware," Auld added.

"They have to store that data somewhere. If you can find the drop zones where that data is stored and reach the affected financial institutions, you are attacking the profitability and damage the reputation of the criminals involved who are trying to restore that data and sell it to third parties."

Auld added: "By the time the sale is made, that data is cancelled and no longer valid for use."

SOCA also wants to target legal businesses that worked with underground enterprises - without even realising it.

He used the example of the Russian Business Network (RBN), a now defunct criminal network that registered as a local internet registry with RIPE, an European body that allocated IP resources to industry.

"RIPE was being paid by the RBN for that service of IP allocation," said Auld.

"Essentially what you have if you interpret it very harshly, RIPE is receiving criminal funds and was therefore involved in money laundering offences."