[ISN] Book excerpt: High-Tech Crimes Revealed: Cyberwar Stories from the Digital Front

[InfoSec News]

http://www.computerworld.com/securitytopics/security/story/0,10801,94643,00.html

[ http://www.amazon.com/exec/obidos/ASIN/0321218736/c4iorg  - WK]

Book (Excerpt) by Steven Branigan
JULY 20, 2004 
COMPUTERWORLD 

This excerpt is from Chapter 3, "If He Had Just Paid the Rent" from
High-Tech Crimes Revealed: Cyberwar Stories from the Digital Front

"The prisoners will not be harmed, until they are found guilty."

-Q, in "Encounter at Farpoint," from the television series, Star Trek:  
The Next Generation


Introduction

The problem with many criminals is that they get addicted to illegal
behavior. The excitement that comes from committing the first crime
has its roots in the fear of getting caught. If they don't get caught,
they are encouraged to do it again and possibly again. As they get
away with more crimes and infractions, they begin to feel untouchable.  
Eventually, they feel like they can commit any crime and get away with
it.

Fortunately for us, that becomes their fatal flaw. All of these little
crimes eventually catch up with them. This is why police training
teaches cops to investigate small crimes, because they can lead to the
discovery of much larger ones. Of course, you can never tell when a
small incident will turn out to be nothing or become a pretty big
deal, so it is important to examine them all.

Take the case of our new friend, Wesley. He was renting an apartment
in New York City for about $2,000 a month. NYC is a tenant-friendly
city, so it is difficult to evict a deadbeat occupant. It did not take
much for Wesley to figure this out, and soon he stopped paying the
rent on his apartment - which went on for months. As you might
imagine, his landlord William didn't like this at all.

William was getting weary of trying to chase him down to collect the
rent. He would get evasive answers and empty promises of payment, but
no money. After six months of fighting for some attention, he had
enough and decided to proceed with legal action. It was time to evict
Wesley. It was not an easy route, but the way he saw it, he simply had
no alternative.

The eviction

William hired a lawyer and filled out the necessary paperwork to start
the eviction process. In NYC, this can be very tricky, and trying to
do it without a lawyer is often a mistake. The process requires a
final, formal demand for the rent. Once this is done, and after a few
more steps, the case can go to court. Only through a trial can the
landlord get the legal authority to forcibly evict the tenant. When he
gets the judgment in his favor, he gets a Warrant of Eviction, which
empowers the government to physically remove a person from his rented
home.

In this case, Wesley went without paying the rent for six months
before the Warrant of Eviction was finalized and assigned to Sheriff
Yar to execute. Expulsion can be either difficult, or more difficult.  
Difficult is when the tenant is in the place at the time of the
eviction. The Sheriff lets the tenant take his personal belongings and
escorts him out of the apartment. The more difficult option is when
the tenant is not there. The Sheriff then needs to forcibly enter the
apartment and remove the personal property that is inside, usually
putting it on the street. Either way, once the process has been
completed, the apartment is turned over to the landlord.

Tenants can usually sense that they are about to be kicked out of
their residence, especially when they haven't been paying rent for a
while. By that time, they have usually vacated the apartment, taking
away anything of value. Wesley wasn't this bright.

There was no one home when Yar arrived, and it was beginning to seem
as if Wesley had skipped town. Because William was there as well, he
was more than happy to open the apartment for Yar. Upon entry, it was
obvious that Wesley had not cleared his apartment out, as there were
quite a few televisions and other strange electrical equipment. This
seemed very odd, and Yar immediately suspected that the apartment was
being used to store stolen goods.

Because the equipment might have been considered evidence of a crime,
leaving it on the street was not an option. He needed help and wanted
to contact the NYPD to have them check it out, but what was he going
to do with the apartment in the meantime? Unfortunately, since this
was not an emergency, he could not call and wait for them. Instead, he
would need to set up a time when they could come by and in the
meantime secure the site to prevent Wesley from coming back in. He
could not let William have his place back -- not yet. Oh great,
William thought, he would have to wait even longer before he could
rent out the apartment again.

So Sheriff Yar padlocked the door, put some yellow tape across its
opening, and posted a notice that an eviction warrant was being
served. He wanted to make sure Wesley was not going to be able to
remove or destroy any of the evidence. Now he could go contact the
NYPD.

Wesley arrived to his "apartment" later in the day to find out he was
being evicted and could not get in. Panicked, he called William and
was informed that he was being expelled because he failed to pay rent
for six months, owing $12,000. Wesley profusely apologized and asked
to meet with him to take care of his debt. William told him that he
would take only cash, no checks, because he knew it was his only
chance to get the money he was owed.

Somehow, in a matter of minutes, Wesley got the money together to pay
his overdue rent. It was hard to believe this was the same guy that
was hard to find and unwilling to pay just a couple of days before.  
William could not believe his eyes and eagerly took the cash. Wesley,
after taking a deep breath of relief, asked to be let into his
apartment. William told him that now he would need to speak to Sheriff
Yar, because that's who now had control over the apartment.

Wesley got really upset and tried to argue to get his money back, but
William, being a true New Yorker, knew better than to give him the
cash back. Getting the back rent paid was a nice surprise for William,
but since Sheriff Yar had the apartment, he still did not have an
apartment to rent.

The NYPD cops arrived quickly to inspect the apartment. They
immediately determined that the "TVs" in the room were actually
computer monitors. The "other electrical stuff" was computer and
networking equipment. With that mystery solved, a new one arose. What
were all of these devices being used for? This was a residential
apartment, not an office, so this equipment seemed very out of place.  
The cops were unsure as to how the equipment was being utilized and
decided to play it safe. They posted a couple of officers to guard the
place and left.

They decided to leave the apartment and find a law enforcement agency
that specialized in computer cases. In NYC, Supervisory Special Agent
Robert Weaver of the New York Field Office of the U.S. Secret Service
had just recently started an experimental multijurisdiction,
multidiscipline task force known as the New York Electronic Crimes
Task Force (NYECTF). It is comprised of agents from the Secret
Service, the FBI, the NYPD, and the State Police, along with
representatives from the high-tech industry that specialize in
computer crime investigations and computer forensics. The NYECTF, with
its diverse makeup and expertise, was designed to handle cases just
like this.

The NYECTF agents accepted the case but were not able to come down to
inspect the location immediately because they needed to get a search
warrant. As we are well aware, those can take a couple of days to get
completed. So in the meantime, members of the NYECTF were able to get
some cops from the NYPD to continue guarding the apartment while the
paperwork was completed, ensuring that the potential evidence inside
the apartment was not compromised.

A simple twist

Wesley's panic grew. Not only could he not get into his apartment, but
also the police were either looking through his stuff or were about to
look through it. He was scared and desperate, so he decided that he
needed to do something. Calling upon his fantastic criminal mind, he
set about a course of action. He broke into his own apartment (which
was under surveillance) through a window and came out quickly, running
off with a laptop computer. The police officers that were guarding the
place were caught by surprise. Who would have expected that a tenant
who had been evicted from his apartment would want to break back in?  
It seems very funny today, but a few years ago, law enforcement did
not think that high-tech crimes would inspire such amazingly bold
acts. At that time, no one would have expected it.

Sadly, when the police finally realized what was going on, Wesley was
already gone. Apparently there was something very valuable to him in
that computer. Of course, the cops felt really embarrassed that they
allowed this to happen. Their sergeant, a bit frustrated, replaced
them with different officers who were more careful.

NYECTF

I got involved in this case together with one of my friends, Hugh,
because we were part of this new task force. We were pleased to be
able to offer our computer and telephone expertise to help the NYECTF.  
Hugh was a seasoned telecommunications security professional, having
worked for companies such as New York Telephone and Nynex for many
years. He was very knowledgeable and easy to work with.

Some members of the organization, who asked to meet with us in NYC,
called us in. They had an assignment coming up and wanted to discuss
some options, so we got together with them at their office in 7 World
Trade Center early in the evening. From there, we went down to the
parking garage of 1 WTC (the north tower). Because of the bombing of
the WTC garage by fanatics in 1993, additional security had been put
into place. You needed official permission and a special pass to gain
access. The guys on the task force definitely had the pull to escort
us in.

The Secret Service had a section of the garage reserved for them.  
Here, they stored their government vehicles, affectionately known as
G-rides, and parked their personal cars. We met there to discuss the
upcoming search and to help load the van with the equipment that would
be needed. One of the things that Hugh noticed right away was a
"Nynex" vehicle that just did not look right. He turned to Bob,
pointed to the van, and politely asked, "What the hell is that?" With
a smirk, Bob told him that it was one of their undercover vans. Hugh
responded that it made sense, because it wasn't a real Nynex truck. To
this day, none of us could tell how Hugh knew!

High-tech crimes revealed

After a little while, it started to sink in to Hugh and me where we
were. The garage walls were painted green in some sections, yellow and
red in others -- not a usual color scheme, to be sure. We were told
that the red paint signified the area where the bomb had been set off
three years prior, at level B-2. We finally understood we were near
the location where the truck bomb was set off back in February 1993.  
This was a very somber moment for us.

As we stood in the building's foundation, I remember marveling at the
immensity of the structure, thinking that it would be nearly
impossible to significantly damage these massive buildings that were
reaching nearly a quarter-mile into the sky. Sadly, recent history has
proven me wrong.

The rest of the night was spent preparing the computer forensic
equipment for the search, which was scheduled for the next day. We
were assembling cartons, power cords, any disk duplicators that we
could find and items of the like. This was just some basic preparation
that needed to be done.

[...]