Category: Cyber Crime

UWEcyber academics present at annual NCSC Education Ecosystem Conference

Author Anna Jones | Posted on

Last week, a team from UWEcyber attended the annual NCSC Education Ecosystem conference hosted in Leeds. Ian Johnson (AHOD Cyber Security) and Phil Legg (Professor of Cyber Security) attended as Co-Directors of the UWEcyber Academic Centre of Excellence in Cyber Security Education (ACE-CSE), along with Aida Abzhaparova (Senior Lecturer in Cyber Security and Global Politics) and Alan Mills (Lecturer in Cyber Security), who have both led outreach projects through the ACE-CSE this year. Phil Legg also presented an interactive session at the conference along with his external colleagues from Abertay University and the University of Roehampton as part of his ongoing leadership within the CISSEUK initiative to bring greater collaboration between academia, industry and government, and to improve the connectivity of the education pipeline into cyber security.

Alan Mills presented on the ACE-CSE project for upskilling school teachers across the region. This year, we expanded our teacher training initiative to cover six workshops across two locations (UWE Bristol and Gloucestershire College, Cheltenham), to reach a more varied and diverse mix of educators across the South West region. The workshops were specifically structured around three themes: cyber security for young people (for students years 7-9), cyber security basics (for students years 9-11), and cyber security careers and apprenticeships (for students years 11-13). The project has proved to be a success, with excellent feedback from the teachers who attended, and with a number of follow-up collaborations already underway. We continue to work closely with schools across the region, to help both students and teachers alike to upskill in their cyber security knowledge and expertise.

Phil Legg giving his presentaton

Aida Abzhaparova then presented on the ACE-CSE project for upskilling SMEs across the region. This wa a collaborative project between the cyber security team at UWE, and the DRAGoN team who focus on issues of data governance and privacy – bringing together these two core areas from within UWE to deliver combined workshops. Over two workshops we have helped over 17 SMEs to better understanding cyber security issues, and how they relate to their specific organisation, from construction, to accounting, and even circus skills – the diversity of organisations that chose to attend was fantastic to see! We have also helped to introduce SMEs to the “Five Safes” model developed by DRAGoN as a suitable means of thinking about the access and usage of sensitive data within their organisation.

The conference brings together academia, industry and government, including the Department for Science, Innovation and Technology, the Department for Education, NCSC and GCHQ, as well as the UK Cyber Security Council and other major stakeholders across UK cyber security.

Transformation of Suspicious Activity Reporting to combat Financial and Cyber Crime

Author Anna Jones | Posted on

An integral part of how the United Kingdom tackles money laundering criminality is through the use of Suspicious Activity Reports (SAR). These were first introduced in 1986 by the Drug Trafficking Offences Act, and have evolved through the 2002 Proceeds of Crime Act and the 2019 Money Laundering Regulations. Organisations may file a SAR with the National Crime Agency if they believe they are being utilised as part of a money laundering campaign, however over the years the effectiveness of SARs have been questioned. For example, its deficiencies included an ineffective SARs database, weak monitoring of enforcement outcomes, inadequate training and the lack of government support for the scheme.  It has therefore been suggested that SARs are under-used by law enforcement agencies, and law enforcement bodies continue to have poor management information on how SARs are utilised.

To address this concern, a multi-disciplinary team of UWE Bristol researchers are working with Synalogik Innovations to overcome the shortcomings of the UK Suspicious Activity Reporting scheme, in collaboration with Cardiff University and University of Reading. The multi-disciplinary team of academics includes Phil Legg (Professor of Cyber Security, UWE), Sam Bourton (Lecturer in Law, UWE), as well as Nic Ryder (Professor of Financial Crime, Cardiff University), and Dr Henry Hillman (Lecturer in Law, University of Reading). The team have a long-standing history of working with Synalogik Innovations, in relation to identifying and mitigating against Counter-Terrorism Financing and Organised Crime Groups through the use of technology. In this latest Innovate UK project, the team will explore how Natural Language Processing can aid the creation of SARs, as well as the verification of information presented, and the identification of further supporting information, using the SCOUT platform developed by Synalogik Innovations. With an improved search capability to facilitate the creation and reporting of SARs, we aim to provide a more efficient approach that can help reduce the time in understanding and responding to threats in our society.

Cyber Security in Connected Places: Attack Detection in RPL-based Internet of Things

Author Anna Jones | Posted on

By Sarfraz Brohi, Senior Lecturer Cyber Security

Connected places such as smart cities have enabled urban planners to improve citizens’ quality of life by collecting, storing, processing and analysing data. Internet of Things (IoT) is one of the driving technologies of connected places. It integrates different city functions such as parking systems, mobility services, waste management, healthcare and emergency services. Unfortunately, IoT has vulnerabilities that attackers could exploit due to the massive processing of sensitive data. Cyber security breaches in IoT-powered connected places could violate citizens’ privacy, endanger life and cause economic disaster.

IoT security encompasses a massive area of research with a wide array of open challenges. Dr Sarfraz Brohi (Senior Lecturer in Cyber Security at CSCT-UWE, Bristol) collaborated with the researchers from Taylor’s University, Malaysia (Dr Noor Zaman: Cluster head for cyber security research, Ms Fatima Zahra and Dr Navid Khan) and Taif University, Saudi Arabia (Dr Mehedi Masud and Dr Mohammed A. AlZain) to address crucial IoT-specific rank and wormhole attacks by creating a machine learning model.

The fundamental components of an IoT-enabled infrastructure usually include sensors, RFIDs, microcontrollers and digital devices. These components are low power and lossy due to their small size and simple architecture. Therefore, they use lightweight routing standards and protocols for data transmission. RPL is one such protocol used in IoT networks. RPL-based IoT networks are vulnerable to two types of attacks: WSN-inherited attacks and RPL-specific attacks. Rank and wormhole attacks are examples of high-impact attacks from these categories where attackers target the protocol and sensor network vulnerabilities to disrupt network functionalities and compromise resources.

F. Zahra, NZ. Jhanjhi, SN. Brohi, NA. Khan, M. Masud, and MA. AlZain, generated a dataset and developed a model for detecting RPL-specific and WSN-inherited attacks in RPL-based IoT: LIoTN-RPL dataset and MC-MLGBM model. The LIoTN-RPL data pool consists of network traffic data extracted from various network models. These network models have been designed considering three scenarios – one benign and two attack scenarios – and simulated based on the number of IoT nodes and state of nodes. The MC-MLGBM classifies three target classes and addresses two attacks. In this research, they have used accuracy, precision and recall to evaluate the proposed model. To avoid accuracy bias, they have also used cross entropy, Cohen’s Kappa, and MCC as performance evaluation metrics. The existing models usually focus on one category of attacks. The proposed model provides a conceptual framework for aggregately addressing both in RPL-based IoT networks.

The results of this research are discussed in the paper “Rank and Wormhole Attack Detection Model for RPL-based Internet of Things using Machine Learning”, published in the MDPI Sensors special issue on Advances in IoT Privacy, Security and Applications. Authors have reviewed recent methodologies for addressing security issues in IoT and techniques used to detect the attacks. Furthermore, they have analysed the data collection methods in the research domain. This research observed the scarcity of publicly available RPL attack datasets and the prevalence of self-generated datasets using simulators like Cooja. The future direction of this research focuses on more experiments by designing and simulating other RPL-specific and WSN-inherited attack models. LIoTN-RPL will be released as an open-source dataset to the research community to facilitate the development of ML models for attack detection in RPL-based IoT networks.

Read the full article.

UWE Bristol research to help uncover and mitigate against hundreds of online public software supply chain vulnerabilities

Author Anna Jones | Posted on

Many software and cloud platforms rely on the use of containerisation, a modern technique of deploying multiple software services quickly, securely and efficiently on large-scale cloud computing resources such as Microsoft Azure and Amazon Web Services (AWS). Platforms such as DockerHub provide an online repository of over 100,000 ready-to-deploy containers that are used widely in many of today’s modern software platforms. Whilst this offers great convenience for development teams, many of these containers may exhibit vulnerabilities, which if not managed, can introduce vulnerabilities into a company software stack. Recent security issues such as the log4j vulnerability and the Solarwinds Orion attack highlight the growing concern around software supply chain security, the dependencies that are made by development teams on third party software, and the implications of identifying and remediating such vulnerabilities later down the line.

As part of our CSC3 research, Alan Mills, Jonathan White and Phil Legg, have developed a suite of docker security visualisation and remediation tools: OGMA and BORVO. The suite of tools enable developer and security teams to quickly identify vulnerabilities against a variety of container security scanning platforms. Results from existing scanning tools can often differ or conflict, and so our aggregated approach helps provide a unified analysis to address conflicts and provide a visual means for thorough examination the results. Our approach also provides a more intuitive risk assessment that considers the true impact of vulnerabilities, such as how easily the vulnerability could actually be exploited by external or internal actors. Furthermore, the suite also provides developers with informed assessment of how to remediate the security issues whilst preserving the intended software functionality that is dependent on the container.

Our research paper “OGMA: Visualisation for Software Container Security Analysis and Automated Remediation” has been peer-reviewed and accepted for the IEEE Conference on Cyber Security and Resilience where the work will be presented and published at the end of July. We will also be sharing our insights in our related presentation on “Securing the Supply Chain – Practicality v Paranoia” at the upcoming BSides Cheltenham conference this weekend, which is a community-organised event for the regional cyber security industry and enthusiasts, and follows our lightning talk on software supply chain security delivered at CYBERUK 2022 earlier this year. OGMA and BORVO are both released as open-source applications that we have made available to the wider research community, to facilitate the examination and remediation of software vulnerabilities in containerised applications. For more details, including how to download and use the tools, please visit our GitHub page.

UWE Bristol hosts one of region’s largest cyber security events to attract future talent

Author Anna Jones | Posted on

Last month UWE Bristol hosted the Unlock Cyber Taster Day at Frenchay campus, which was attended by over 300 young people.

Students aged 12 to 14 participated in hands-on activities including manipulating a Scalextric track to improve the performance of model racing cars.

The event was run by Unlock Cyber, an employer-led initiative established by UWE Bristol to build a community of young cyber security enthusiasts with the right skills to follow a career into the sector.

Industry and cyber representatives from across the West of England region attended the event yesterday in the School of Engineering building to deliver the cyber activities for schoolchildren.

UWE Bristol Cyber Schools Outreach Manager Elaine Brown, who manages the Unlock Cyber project, said: “Young people often think that employers need you to have a lot of technical expertise when in fact this is not the case. They are looking for applicants with good communication skills and enquiring minds, who enjoy problem solving and can work under pressure. We’re trying to engage with and excite more young people, especially girls, who probably think cyber is not for them, to ensure that cyber is more diverse and inclusive. Our biggest challenge moving forwards is how we can cope with the level of demand from schools.”

Kevin Milwood, Cyber Risk Manager from Hargreaves Lansdown, said: “Unlock Cyber stands for what I believe in – giving young people the opportunity to learn about careers in cyber. It’s such an important area for business and I’m passionate about doing what I can in the local area to develop the UK’s skills supply chain to meet the ever-increasing demand for cyber experts. The national curriculum is currently quite limited, so it’s great that Hargreaves Lansdown can get involved with a programme like this that lets us share our expertise.”

Ben Waring, HR and Resourcing Advisor at Leonardo Cyber Security Division in Bristol, said: “Cyber threats are a reality for all of us, so we want to respond to these long-term threats in a positive manner by generating future career opportunities for young people. For the Unlock Cyber taster day, our apprentices have designed a Cyber Crime scene, testing the students’ knowledge of how cyber criminals might target them and use any available information against them. This activity also helps students think about how they can better protect themselves and their family from cyber crime.”

UWE Bristol has worked with the National Cyber Security Centre (NCSC) and regional partners to develop the Unlock Cyber programme. The university has been recognised by NCSC for its excellence in cyber security education, across its outreach activities through Unlock Cyber, its taught programme at UWE Bristol, and its work across the region and the wider UK to improve cyber security education.

CYBERUK 2022

Author Anna Jones | Posted on

By Professor Phil Legg

Earlier this month saw the UK Government host their flagship annual cyber security conference, CYBERUK 2022, that brings together government, industry and academia. Hosted in Newport, South Wales, there were thousands of attendees from major corporations, global government leaders, and the UK academic communities that work closely with the National Cyber Security Centre to understand the technical, economic and social challenges around modern cyber security and its position in today’s world. 

Ransomware, organised crimes groups, and nation state attacks, were all key agenda items up for debate. We heard talks describing how the average cyber-attack is now estimated to cost £2.2 million in terms of the remediate impact that organisations face, be that information, operational and asset-based losses, reputational damage, legislative costs, and other financial implications. We heard discussion about the recent log4j crisis that has hit businesses around the globe, that emphasises the challenges around software supply chain security, and understanding the different software components, be that open-source or proprietary code bases, that make up an organisation’s platform for conducting business. Perhaps one of the most poignant moments of the event was hearing from victims of cyber crime – specifically those tasked with defending their organisations, their staff, and their customers – and hearing about the human impact of cyber crime and the full range of emotional turmoil that people have been thrown into. The recent events in Ukraine and Russia highlight this further, as we have witnessed cyber attacks as part of warfare. As we live in a connected society, there is no doubt that our online and offline worlds are now as one. 

Education will always sit in the centre of cyber security and cyber crime, since prevention will always be greater than the cure. That is why the work of the Cyber Security and Cyber Crime Research Cluster, coupled with the work of our NCSC Academic Centre of Excellence in Cyber Security Education (ACE-CSE) continues to play a vital role in how we can identify, mitigate, and prevent against criminal activities and the dangers that they pose to our connected society. 

Targeting the Proceeds of Darknet Market Crime: A Familiar Unending Struggle?

Author Anna Jones | Posted on

Dr Matthew Robert Shillito

Leading Darknet markets such as Hydra, World Market, and Cypher have long attracted law enforcement attention. They provide access to illicit goods and services (such as drugs, fake identity documents, and hitmen for hire), under the cover of anonymity afforded by the technology used to access them, namely the Tor browser and Virtual Private Networks (VPNs). To maintain that anonymity throughout the whole process, cryptocurrencies are utilised as the payment method of choice.

So, why is the old-adage of ‘follow-the-money’ so important, in this context? Well, provided there are no human errors prior to accessing Tor, and that the marketplace has not been compromised (e.g. by law enforcement accessing servers), then it is the payment stage where users are potentially most vulnerable and information can be pieced together. Users have placed their faith in the marketplaces’ chosen cryptocurrency, betting that it will sufficiently mask their identity. If it does not, then it can serve to undermine the earlier browsing anonymity achieved by utilising Tor and a VPN. As a result, law enforcement success in this area can prevent crime from paying, and send out a deterrent message to criminals.

Where success is achieved, it is principally due to the public (open) nature of many blockchains and the increasing use of public-private partnerships to harness private sector resources and technology in investigating blockchain transaction data. Further, once law enforcement has a lead, the fact traditional anti-money laundering obligations (such as know-your-customer) have been placed on digital currency exchanges can result in the uncovering of identifying information.

However, whilst there have been some high-profile, successful, Darknet investigations (e.g. Silk Road, Alphabay and Hansa) overall, law enforcement has struggled to consistently get to grips with the challenge these markets present. Indeed, evidence from Chainalysis suggests that other than two small blips, both revenue and total transfers to Darknet Marketplaces have strongly increased year-on-year since 2011.

Why then, has success been so hard to come by? Fundamentally, Darknet investigations can and have taken years to come to fruition. They are impeded by many of the same basic issues that face traditional financial crime investigations, lack of resources and insufficient law enforcement training. When this is coupled with age-old issues surrounding international criminal cooperation, such as: language barriers; cultural & legal differences; and competing priorities; it makes for a particularly difficult albeit entirely predictable challenge.

The challenge is further exacerbated by the techniques criminals use to launder their cryptocurrency. Methods include: operating numerous wallets; use of unlicensed exchanges and buying cryptocurrency ‘locally’ (away from exchanges); use of tumblers / mixers to obscure funds; and switching funds for other payment forms e.g. pre-paid cards, to cash out. Again, if these seem familiar, it’s because they are traditional techniques that we have struggled to overcome, adopted for this new criminal arena.

If that is not tricky enough, darknet criminals do have some unique crypto bows to their string. They are increasingly utilising cryptocurrencies that are more privacy based, such as Monero , as their blockchain’s cannot be searched in as useful a way. Further, Darknet markets are increasingly self-closing in the belief that this makes it harder for law enforcement to establish a paper trail to all criminal activity conducted there. Certainly, given the way the Darknet works, this creates an issue in terms of evidence gathering.

But, perhaps the most significant challenge of all is confiscation. A determined criminal can simply refuse to hand over cryptocurrency and there is little law enforcement can do. Efforts have been made to induce compliance, such as adding additional time to a sentence. But, it can be questioned how persuasive that would actually be.

Whilst the recent announcement by the US Department of Justice that they are forming a specialist ‘digital currency unit’ is to be welcomed. That these challenges are predominantly long-standing unresolved issues suggests they’re not about to be overcome anytime soon. This coupled with tech specific complexities, and the potential impossibility of confiscation means law enforcement face a tall order to deter Darknet marketplace crime.

Welcome to the Cyber Security and Cyber Crime Research Cluster (CSC3 ) blog

Author Anna Jones | Posted on

Welcome to the Cyber Security and Cyber Crime Research Cluster (CSC3 ) blog where we plan to share with you the latest updates from the CSC3.

Cyber security is the application of technologies, processes and controls to protect systems, networks, programs, devices and data from cyber-attacks. In the “Hidden Cost of Cybercrime” report, McAfee estimates the average cost of cybercrime in 2020 as $945,000,000,000, up from $522,500,000,000 in 2018. Traditional crimes are now widely conducted through online means.

From a cyber crime perspective, there are two classes of attack: cyber-dependent crime (criminal behaviour that is reliant on technology and its use in society, such as ransomware attacks and cryptocurrency money laundering) and cyber-enabled crimes (traditional crimes that have now become more widespread due to technology, such as cyber bullying and online fraud). Such cyber-attacks may originate from “script kiddies” and insider threats, through to sophisticated and professional operations by organised crime groups and enemy nation states.

The Cyber Security and Cyber Crime Cluster (CSC3) will conduct novel multi-disciplinary research relating to both the conduct of, and the mitigation of cyber attacks. As a broad and ever-evolving research domain, this will involve a number of related areas, including understanding the motivations and precursors of criminality, the technical means that enable criminality to be conducted, and appropriate mitigation and best practice to uphold security and defence.

This research cluster will bring together a multi-disciplinary team of academics to promote synergy and new collaborations, with expertise across financial crime, digital forensics, software security exploitation, insider threat detection, cryptocurrencies and online fraud. It will serve to build capacity in this research domain, by involving our postgraduate and undergraduate student communities in paid research opportunities to support our expansion of research in this area.

Students and staff will work with major external partners to combat today’s challenges, in partnership with Avon and Somerset Police, the South West Regional Organised Crime Unit, the South West Cyber Resilience Centre, the Ministry of Defence, Synalogik Innovations, Leonardo MW, and the National Cyber Security Centre (NCSC).

UWE Bristol have rapidly established a reputation within cyber security education, working alongside the National Cyber Security Centre (NCSC) to offer a fully certified MSc Cyber Security and the only certified Degree Apprenticeship in England and Wales. Recognised as an Academic Centre of Excellence in Cyber Security Education (ACE-CSE) in December 2020, we now seek to expand multi-disciplinary research in this domain.

The nature of this cluster is to build capacity across related technical and societal areas of cyber security and cyber crime. Through our working groups, we will be able to address cutting-edge challenges as seen by our partners, and provide research opportunities for our students to collaborate in to build their student experience.

We look forward to sharing with you developments from this research cluster.

 

This research cluster is funded through the Expanding Research Excellence scheme at UWE Bristol. The scheme aims to support and develop interdisciplinary, challenge-led research across the University. It is designed to bring together research clusters or networks that will work together to respond to challenges (local, regional, national, global) aligned with major research themes.

Back to top