Getting Connected: Are We Safe?

With the lowering of charges and ease of getting connected, many individuals and Institutions rely on the internet for their day to day official, business, social, financial and academic transactions. There are many benefits of using the internet: it is cheaper, faster, and convenient allowing an individual to access almost limitless information wherever and whenever they may be. Rwanda government policy has been and continues to encourage public institutions to reduce consumption of papers and instead use the environmentally friendly and economical internet. It is not unusual for people who may never have touched a computer to be told that they cannot cash cheques or access their money because a bank branch has no “connection”. Many people check mails on the internet as the first thing they do at their places of work or “cyber cafes”. Many institutions and corporations with Local Area Networks (LAN) upload important information on the internet for clients and visitors to access as a service and business strategy. Many of us have received e-mails from strangers telling us that they are children of deceased Nigerian, Ivorian or Togolese multi-dollar-millionaires and would want us to help them access the millions of dollars their late fathers left on account No.....in ......bank in Nigeria. Such criminals hoodwink many gullible individuals; but these are “chicken thieves” in cyberspace. It was reported that for the period between May 2004 and May 2005, almost 1.2 million computer users in the United States alone lost approximately US$929 million while businesses lost an estimated US$2 billion through one form of cybercrime. In 2007, US$3.2 billion was lost by individual Americans. In 2005 people in Britain lost GB£23.2m to only one form of cybercrime. One of the commonest internet fraud stars use to trick users is phishing when they pose as bonafide representatives of government, businesses or banks. The fraudsters copy the graphics from legitimate websites and use them on their own sites to create legitimate-looking scam web pages to dupe the non-suspecting public. Such criminals create a link to a legitimate site webpage spoofing in an e-mail but use bogus HTML source code (link manipulation) using JavaScript commands in order to alter the address bar and instead lead to a fake site. Many users have been prompted to “renew” their registration and thereby reveal their usernames and passwords in. Such links may be identified in the “view source” feature of the e-mail application and by putting the cursor over the link and looking at what is displayed in the URL. One example is the spam to e-mail account users notifying them of ‘an urgent need’, ‘for security reasons’ or ‘routine update’ and require them to update their accounts, before a given period elapses, with usernames, passwords and country of origin/residence. The criminal thereafter access email accounts and can send and receive mails on behalf of users without the knowledge of owners. For example someone received an email from a relative telling the former that the relative had gone to Abuja but had run short of money; could he kindly send $400 to ....Hotel....Street, Abuja? The relative promised to pay as soon as possible. None of the two people had ever been to Nigeria. Internet fraudsters create generic messages which threaten receivers to send them (messages) to other people mentioning the number of recipients and promise blessings if the recipients send them to other people or trouble to those who do not send those messages. Many such spams are malware designed to cause damage yet many people send them to friends and workmates in the hope of avoiding the misfortune or revivifying their fortunes. After infecting the receiving computers these worms search for received and sent addresses in the owners’ mails and use them in the from field to send and receive mails on behalf of the owner for the malware. The criminals’ e-mail header and address are altered (a process referred to as spoofing) by changing the from, return-path and reply-to properties of the e-mail to conceal the origin. There are different internet forums, chatrooms, listservs, email groups, bulletin boards, online role playing games, online dating services, or Usenet and other social networking sites. The challenge is that many people, particularly gullible youth and the not so young who dream of a dream life, may not know the dangers lurking behind the screen. It is much cheaper to ‘human traffic’ a willing adult African in the name of “love” by buying him/her an air ticket for prostitution and other vices in richer countries than any other method. There are many reports of women who meet serial killers (and amateur killers) through dating and social networking sites on the internet in the name of love but end up killed. With underage children, manipulating them for any vice is much easier. There are serial killers, paedophiles, drug peddlers and other criminals on the prowl in the cyber world waiting for victims to snare. The case of Notorious Armin Meiwes aka the Rotenburg cannibal who met and reached an agreement on the internet to butcher and eat his victim which he did on 21 March 2001 is only but one example of the many murders and crimes are hidden behind the computer screen. With the gradual increase in electronic banking and financial transactions in Rwanda, the possibility of bank customers being led to fake websites where they may reveal their secrets in internet scams referred to as pharming is real. Hackers and internet criminals may misdirect website traffic from a bonafide website to a fake one they may have created by manipulating weaknesses particularly in the Domain Name System (DNS) of host computer systems. Others make a link in with stolen personal details such as bank accounts, PIN and passwords to access peoples’ money fraudulently by stealing login information using spyware that records keystrokes when the infected user is on a list of target websites. Another threat to on line bank and financial transactions lies in viruses and worms that steal data. The most notorious are Zeus 1.6 (Zbot) worm that can infect Windows machines using Firefox and Internet Explorer web browsers. It was designed to steal personal financial details and is found in the PCs of banks and major companies and is reported to have infected 12.7 million computers before it was stopped. Viruses and worms create botnets (networks of computers in which malicious software have been electronically installed turning them into “zombies” under control of the worm author) which put computers under the control of cyber gangs and criminals thousands of miles away. Criminals can then send spam e-mail from the host’s machine or search for information such as credit card details on infected machines and send them back to their creator. Criminals may also send replica programmes to other computers, sometimes via the e-mail of the host or those that visit the website or exchange mails with the botnets. Many of these malware such as Cross Site Scripting Virus (XSS Worm) are benign and may lay dormant for sometime but contain malicious payloads (code designed to do more than spread the worm) while the machines are effectively under the control of the cyber criminals allowing them to monitor and collect all kinds of information, including bank details and to sign on to the account and wire money out to their accounts. In the past these criminal accounts could be traced to Eastern Europe in, however criminals have ‘decentralised’ and such can be found in different regions including East Africa. The use of the internet for business poses another threat in form of terrorists and vandals who may interrupt parts of national infrastructure that are connected to the internet. Vandals may cause denial of access to a company/government agency’s website or electronic service, deface its website or post offensive messages. The April 27, 2007 attack on the Baltic state of Estonia when its parliament, banks, ministries, newspapers and broadcasters were paralyzed by cyber attacks. It is possible that terrorists and even vandals may paralyze national infrastructure that use internet. The most fearsome threat in getting connected to internet is posed by cyber warfare. Some countries are resorting to the use of internet for espionage, sabotage and acts of war against others in the cyber world. U.S., General Keith B. Alexander the first head of the US Cyber Command, “the newest global combatant and its sole mission is cyberspace, outside the traditional battlefields of land, sea, air and space”, told the Senate Armed Services Committee that “mismatch between our technical capabilities to conduct operations and the governing laws and policies.” It was reported that the United States Department of Defense sees the use of computers and the Internet to conduct warfare in cyberspace as a threat to national security. It was reported on 7 April, 2009, that Pentagon had spent more than $100 million in the last six months responding to and repairing damage from cyber attacks and other computer network problems. The possibility of an individual or groups sending malware to destroy, copy and send information, swamp a website or create malfunctions in communication and information systems and networks is real. Many of the mentioned crimes may sound foreign and far removed from Rwanda, but as we increasingly get connected to the cyber highway they might be getting closer. It remains to be seen how soon our Parliamentarians will pass laws to combat and deter cybercrimes, our police will be equipped to investigate and prosecute cyber crimes and how fast our institutions will respond to the threat, train and empower employees to avoid, recognize and report cyber crime. ekaba2002@yahoo.com