網(wǎng)路犯罪案例Cyber crime Reconnaissance Case

1、1 網(wǎng)路犯罪案例網(wǎng)路犯罪案例 Cyber crime Reconnaissance Case Decision Group / CEO 張張 侃侃 Casper Kan Chang Chang_.tw 2 網(wǎng)際網(wǎng)路犯罪主要可分為二大網(wǎng)際網(wǎng)路犯罪主要可分為二大 Internet crime is divided into two major categories Network Packet Reconstruction 可還原網(wǎng)路封包可還原網(wǎng)路封包 Analysis Non- Reconstruction Packet 不可還的原網(wǎng)路封包不可還的原網(wǎng)路封包 以網(wǎng)路作為犯罪之客體 Traditi

2、onal crimes conducted through the Internet. Ex: Credit card fraud, Identity theft, child pornography, indecent chat-room behavior, software as soon as the public deceived again after the Financial Supervisory Commission, said the account has been criminal to use the name of money laundering, must si

3、nk financial security account to avoid being the freezing of accounts, lured victims of the deposit removed, changed into the aforementioned fraud of financial security accounts. 10 B. 網(wǎng)路詐欺案例網(wǎng)路詐欺案例 1-1 Internet fraud Case 一名馬來(lái)西亞籍的華裔賴姓女子，涉嫌與奈及利亞籍男友利用網(wǎng)路詐騙臺(tái) 灣女子。刑事局國(guó)際科與馬國(guó)警方合作，日前逮捕賴姓女子並追緝共犯 A Malaysian w

4、oman of Chinese origin Ms. Lai in connection with a Nigerian boyfriend, used the Internet to defraud Taiwanese woman CIB International Council of Scientific Cooperation with Malaysia arrested by the police and looking for an accomplice Ms. Lai 11 B. 網(wǎng)路詐欺案例網(wǎng)路詐欺案例 1-2 Internet fraud Case 臺(tái)北縣警方今年5月間接獲一

5、名女子檢舉，指稱一名在英國(guó)倫敦工作的網(wǎng) 友，聲稱寄送內(nèi)有英鎊現(xiàn)金的包裹要給她，因未申報(bào)而遭馬國(guó)海關(guān)查扣， 需付稅金後始得放行，請(qǐng)求女子將錢匯至馬國(guó)海關(guān)處。這名女子不疑有他， 連續(xù)匯款兩次共計(jì)2358美元，但遲未收到包裹，始知受騙。 Taipei County police received an indirect May this year, a woman accused, Alleged that a work of netizens in London, claiming that there are pounds in cash to send parcels to give her,

6、 Who were failing to declare the Malaysian Customs and Excise Department seized, pay a tax before it may be released upon the request woman will remit money to the Malaysian Customs and Excise Department. The woman did not suspected him, a total of 2358 U.S. dollars two consecutive remittances, but

7、has not received the latest package, Found out deceived. 12 網(wǎng)路性侵案件！網(wǎng)路性侵案件！ Network of sexual assault cases! 07年網(wǎng)路性侵案件： 一天1.5件。12-18歲少年占六成多。 2009年06月10日蘋果日?qǐng)?bào) 臺(tái)灣 臺(tái)北 市 Network of sexual assault cases in 2007: Daily average 1.5 case. 12-18 year-olds accounted for more than 60%. June 10, 2009 Apple Daily

8、Taipei Taiwan 13 禽獸不如禽獸不如 Is truly pathetic and inferior to animals 臺(tái)北市兩名一瘦一胖的嫌犯，去年七月起，涉嫌在網(wǎng)路上約女網(wǎng)友開(kāi)轟趴，等女網(wǎng)友赴約後將 對(duì)方帶到汽車旅館，誘騙對(duì)方進(jìn)浴室洗澡，再要求發(fā)生性關(guān)係，女網(wǎng)友不願(yuàn)配合，即遭掌摑強(qiáng) 姦得逞 ，警方昨逮捕兩嫌，發(fā)現(xiàn)受害多達(dá)十多人。 Taipei two suspects a thin one fat, begin July 2008 , Suspected on the Internet to invite Female net friend to participate i

9、n party , Female net friend to meet this woman after the other into the Motel, Trick the other into the bathroom taking a bath, and then require a sexual relationship, The victim is unwilling to cooperate, that is, to succeed by slapping rape, the police yesterday arrested two suspected and found th

10、at as many as a dozen people injured. 被害人不甘受辱向警方報(bào)案，警方根據(jù)網(wǎng)路位址清查，並前往汽車旅館調(diào)閱車號(hào)，昨循線逮捕 兩嫌。警方追查發(fā)現(xiàn)，兩嫌去年七月開(kāi)始犯案，每次都由葉嫌以小豬、出來(lái)玩等暱稱， 在奇摩即時(shí)通及豆豆聊天室等網(wǎng)站向女網(wǎng)友搭訕，葉嫌坦承犯案十多起、周嫌則供稱五、六起， 警方正追查其他共犯。 Humiliation of victims unwilling to report to the police, the police inventory of network address and went to the motel access

11、to number, yesterday arrested two suspected through the line. The police traced the two began to commit crimes too 2008 July for each pig by Ye too to come out to play other nickname, the yahoo messange and Peas chat rooms and other websites to Nvwang You strike up, leaves from more than 10 suspecte

12、d offender admits , Zhou said the suspect are for five or six, the police are tracing the other accomplices. 14 駭客蘇柏榕駭客蘇柏榕 替黑幫盜資料替黑幫盜資料 Hacker Su Po-jung work for the underworld to steal data 中時(shí)電子報(bào)/蔡旻岳/臺(tái)北報(bào)導(dǎo) 2007/09/22 China Times / Taipei / Choi Min-Yue 刑事局科技犯罪防制中心查出 ，在網(wǎng)路上暱稱odin的林姓高二生、以及暱稱 cb的蘇柏榕兩人，

13、係以學(xué)術(shù)網(wǎng)路為骨幹，將跳板主機(jī)隱藏於臺(tái)灣學(xué)術(shù)網(wǎng)路內(nèi)， 並利用木馬程式、網(wǎng)站漏洞侵入各大知名網(wǎng)站非法取得資料後，存放在國(guó)外網(wǎng)站主 機(jī)，用以規(guī)避追查。其中xx電信公司用戶帳戶及密碼有兩百四十多萬(wàn)筆遭竊，部分 網(wǎng)站則連程式都被搬走。 CIB Crime Prevention Center for Science and Technology have found that the Internet nickname odin Lin, high-school sophomore, and the nickname cb two Su Po-jung, an academic department a

14、s the backbone network will be a springboard for host hidden in Taiwan Academic Network inside, and the use of Trojan horse programs, Web site vulnerabilities well-known Web site illegally obtained large intrusive information, stored in a foreign website host, to circumvent the tracing. Xx telecom c

15、ompanies in which the user account and password with more than 2.4 million pens stolen, some websites have even the programs are removed. Hacker Su Po-jung 15 網(wǎng)路理財(cái)廣告詐貸銀行案網(wǎng)路理財(cái)廣告詐貸銀行案 -1 Internet advertising bank loan fraud case 高雄市刑警大隊(duì) 2009年5月接獲多家銀行報(bào)案，指稱遭人持偽造文件向銀行申辦信 用貸款，造成銀行遭詐貸的鉅額損失。案經(jīng)該大隊(duì)15分隊(duì)深入調(diào)查發(fā)現(xiàn)，

16、以洪、 方等人共同基於牟取不法利益之犯意聯(lián)絡(luò)及行為分擔(dān)所籌組之詐欺集團(tuán)，用國(guó) 內(nèi)入口網(wǎng)站之免費(fèi)網(wǎng)路空間張貼或貼紙廣告刊載理財(cái)達(dá)人專辦信用貸款、小 額信用貸款訊息等方式，招攬急需資金週轉(zhuǎn)之人頭客戶，由該集團(tuán)成員偽變?cè)熵?cái) 稅、薪資等證明文件，美化貸款人之財(cái)力，並教唆指導(dǎo)人頭客戶持偽造文件向銀行 申辦信用貸款，使金融機(jī)構(gòu)陷於錯(cuò)誤而核準(zhǔn)貸款，該集團(tuán)則向人頭客戶收取高額手 續(xù)費(fèi)牟取暴利 16 網(wǎng)路理財(cái)廣告詐貸銀行案網(wǎng)路理財(cái)廣告詐貸銀行案 -2 Internet advertising bank loan fraud case 17 網(wǎng)際網(wǎng)路犯罪偵察要領(lǐng)網(wǎng)際網(wǎng)路犯罪偵察要領(lǐng) Cyber Crime Inv

17、estigation Essentials 組成專案小組 An ad hoc group 依案情內(nèi)容申請(qǐng)技術(shù)支援 For technical support in accordance with the contents of the case 取得報(bào)案詳細(xì)資料 To obtain detailed information on reported 18 網(wǎng)際網(wǎng)路犯罪情資蒐集網(wǎng)際網(wǎng)路犯罪情資蒐集 Cyber criminal intelligence collection 1. 收集電腦稽核紀(jì)錄 : IP, 帳號(hào), 時(shí)間 等 2. 客戶登錄資料 : 帳號(hào)使用人, 姓名, 地址, 電話 等 3.

18、犯罪事實(shí) 1. Collection of computer audit records : Log, IP, User account, time 2. Customer Login information : Account name and address of telephone users 3. Corpus delicti 19 網(wǎng)際網(wǎng)路犯罪證據(jù)蒐集網(wǎng)際網(wǎng)路犯罪證據(jù)蒐集 Cyber crime, gathering of evidence 1. 由被害人及嫌犯電腦上取得資料, Log, 檔案, 紀(jì)錄 . 等 2. 由業(yè)者提供的資料及紀(jì)錄 . 等 3. 網(wǎng)路監(jiān)聽(tīng) 4. 由被害人提供網(wǎng)

19、路封包還原 1. By the victims and suspects to obtain information on the computer, Log, files, records, etc. . 2. Information provided by the industry, and records and so on . 3. Interception 4. From the victims to restore the network packet 20 網(wǎng)際網(wǎng)路犯罪鑑識(shí)工具種網(wǎng)際網(wǎng)路犯罪鑑識(shí)工具種 Cyber crime forensics tools Wired , HTT

20、PS/SSL and VOIP Wireless “Catch-it-as-you-can” forensics systems 封包側(cè)錄還原鑑識(shí)設(shè)備封包側(cè)錄還原鑑識(shí)設(shè)備 Off-Line packet reconstruction software “Stop, look and listen” Forensics software 離線封包鑑識(shí)還原軟體離線封包鑑識(shí)還原軟體 Forensics tools 鑑識(shí)軟體鑑識(shí)軟體 21 鑑識(shí)工具使用鑑識(shí)工具使用 Forensics Tool Use 數(shù)位證據(jù)的鑑識(shí)與採(cǎi)集無(wú)法透過(guò)人的視覺(jué)直接辨識(shí)出來(lái)，如果沒(méi) 有適當(dāng)?shù)墓ぞ呋蜍涹w也是無(wú)法解析，運(yùn)用適當(dāng)?shù)?/p>

21、工具或軟體採(cǎi)集與 辨識(shí)數(shù)位證據(jù)，也是偵辦電腦網(wǎng)路犯罪案件必備的條件 Kam-digital intellectual and collection of evidence can not be humans through direct identified intellectual vision out of future, without the right tools or software are unable to resolve, using the right tools or software acquisition and identified intellectual di

22、gital evidence, but also diligent in Internet Highway necessary conditions for criminal cases Forensics tools 鑑識(shí)軟體鑑識(shí)軟體 由被害人及嫌犯電腦上取得資料, Log, 檔案, 紀(jì)錄 . 等 Collection of computer audit records : Log, IP, User account, time etc 22 網(wǎng)路鑑識(shí)工具使用網(wǎng)路鑑識(shí)工具使用 Cyber Forensics Tool Use Wired , HTTPS/SSL and VOIP Wirele

23、ss “Catch-it-as-you-can” forensics systems 封包側(cè)錄還原鑑識(shí)設(shè)備封包側(cè)錄還原鑑識(shí)設(shè)備 網(wǎng)路監(jiān)聽(tīng) Internet Interception 還原已錄製完成網(wǎng)路封包 Reconstruction, The completion of network packets have been recorded Off-Line packet reconstruction software “Stop, look and listen” Forensics software 離線封包鑑識(shí)還原軟體離線封包鑑識(shí)還原軟體 23 網(wǎng)路封包鑑識(shí)分析分網(wǎng)路封包鑑識(shí)分析分 Ne

24、twork packet forensics analysis categories Analysis Non- Reconstruction Packet 不可還的原網(wǎng)路封包不可還的原網(wǎng)路封包 Viruses & Worms, Hacking & Trojans . . 病毐 駭客 木馬程式 Network Packet Reconstruction 可還原網(wǎng)路封包可還原網(wǎng)路封包 Email , Web Mail ,IM, FTP , P2P, VoIP, Video Streaming , HTTP, Online Games, Telnet 電子郵件，網(wǎng)頁(yè)郵件，F(xiàn)TP， P2P，VoIP

25、，影音串流，網(wǎng) 頁(yè)瀏覽，線上遊戲， Telnet 1. 2. 24 提供全系列網(wǎng)路鑑識(shí)產(chǎn)品提供全系列網(wǎng)路鑑識(shí)產(chǎn)品 Complete Solutions for Cyber Forensics 1.Wired packet reconstruction. 2.Wireless (802.11 a/b/g/n) packet reconstruction. 3.HTTPS/SSL interceptor. 4.VOIP packet reconstruction. 5.Off-line packet reconstruction software 6.Network packet forensic

26、s analysis training For more information www.digi- 25 網(wǎng)際網(wǎng)路封包鑑識(shí)分析教育訓(xùn)練課程網(wǎng)際網(wǎng)路封包鑑識(shí)分析教育訓(xùn)練課程 Network Packet Forensics Analysis Training The knowledge of network packet analysis is important for Forensics Investigator and Lawful Enforcement Officer to carry out their daily duty. Network Packet Forensics An

27、alysis Training (NPFAT) provides useful and sufficient knowledge required to analyse network packets. Trainee will be able to identify different packet types according to different Internet Protocols such as packets containing a specific Email (POP3, SMTP and IMAP), Web Mail (Yahoo Mail, Gmail, Hotm

28、ail), Instant Messaging (Windows Live Messenger, Yahoo, ICQ etc.), FTP, Telnet, HTTP and VOIP. Forensics investigation is also science and art. 網(wǎng)際網(wǎng)路封包鑑識(shí)分析教育訓(xùn)練課程（NPFAT）提供所需知識(shí)來(lái)分析網(wǎng)際網(wǎng) 路封包。令學(xué)員將能夠識(shí)別不同型的網(wǎng)路封包根據(jù)不同的Internet協(xié)議，如 電子郵件（POP3，SMTP和IMAP），網(wǎng)路郵件（雅虎郵件，Gmail， Hotmail等），即時(shí)通（如Windows Live Messenger，雅虎，ICQ

29、等），F(xiàn)TP， 遠(yuǎn)程登錄，網(wǎng)頁(yè)瀏覽和VOIP。鑑識(shí)取證調(diào)查還技術(shù)兼具科學(xué)和藝術(shù)素養(yǎng)之 訓(xùn)練課程。 Phillip A Russo Ing. Gustavo Presman Frankie Chan Kok Liang 26 實(shí)績(jī)實(shí)績(jī) Reference site in Taiwan Criminal Investigation Bureau The Investigation Bureau of the Ministry of Justice 國(guó)家安全局國(guó)家安全局 National Security Bureau 國(guó)防部國(guó)防部 Ministry of National Defense,R.O.

30、C 憲兵司令部憲兵司令部 Military Police, R.O.C 海岸巡防署海岸巡防署 Coast Guard Administration 國(guó)防大學(xué)國(guó)防大學(xué) National Defense University 中央警察大學(xué)中央警察大學(xué) Central Police University 27 owDLS#)5cksjqyGNV$07fmuCJRY(3biqxFNU$+7emtBIQY*3aipxEMU!+6eltAIPX*2ahpwELT#-6dlsAHPW&29howDLS#)5dkszHOW%18govDKSZ)4cjrzGOV%08fnvCKRZ(4bjqyGNV$07fmu

31、BJRY(3biqxFNU$+7emtBIQY*3aipxEMT!+6eltAIPX*2ahpwELT#-ovDKSZ)5ckrzGOV%18gnvCKRZ(4cjryGNV$07fnuCJRY(3bjqyFNU$+7emuBJQY*3aipxFMU!+6eltBIQX*2ahpwEMT!-6dlsAHPX&29howDLS#-5dkszHOW&19govDKSZ)5ckrzGOV%08gnvCKRZ(4cjryGNV$07fnuCJRY(3biqyFNU$+7emuBJQY*3aipxFMDLT#- 5dkszHOW&19govDKS#)5ckrzGOV%18gnvCKRZ(4cjryGNV

32、$08fnuCJRY(3bjqyFNU$+7emuBJQY*3aiqxFMU!+6eltBIQX*2ahpwEMT!-6dlsAHPX&29howDLT#-5dkszHOW&19govDKSZ)5ckrzGOV%18gnvCKRZ(4cjryGNV$07fnuCJRY(3bjqyFNU$+7emMT!-6dltAIPX&29hpwELT#-5dksAHPW&19govDLS#)5ckrzHOW%18gnvCKSZ)4cjryGNV%08fnuCJRZ(4bjqyFNU$07fmuBJQY*3biqxFMU!+6emtBIQX*2aipxEMT!-6dltAIPX&29howELT#-5dksA

33、HPW&19govDLS#)5ckrzGOW%18gnvCKSZ)4cjryGNFMU!+7emtBIQX*2aipxEMT!-6eltAIPX&29hpwELT#- 5dksAHPW&19gowDLS#)5ckrzHOW%18gnvCKSZ)4cjryGOV%08fnuCJRZ(4bjqyFNU$07fmuBJQY*3biqxFMU!+7emtBIQX*2aipxEMT!-6dltAIPX&29hpwELT#-5dksAHPW&19zGOV%08fnvCKRZ(4bjqyGNV$07fmuBJRY(3biqxFNU$+7emtBIQY*3aipxEMT!+6eltAIPX*2ahpwELT#

34、-6dlsAHPW&19howDLS#)5dkszHOW%18govDKSZ)4cjrzGOV%08fnuCKRZ(4bjqyGNV$07fmuBJRY(3biqxFMU$+7emtlsAHPW&29howDLS#)5dkszHOW%19govDKSZ)4ckrzGOV%08fnvCKRZ(4bjqyGNV$07fmuCJRY(3biqxFNU$+7emtBIQY*3aipxEMU!+6eltAIPX*2ahpwELT#- 6dlsAHPW&29howDLS#)5dkszHOW%18govDKSZ)4cjrzGOV%U$+7emtBJQY*3aipxEMU!+6eltAIQX*2ahpwELT

35、!-6dlsAHPW&29howDLS#-5dkszHOW%19govDKSZ)4ckrzGOV%08fnvCKRZ(4bjryGNV$07fmuCJRY(3biqxFNU$+7emtBJQY*3aipxEMU!+6eltAIPX*2ahpwW&19govDKS#)5ckrzGOW%18gnvCKRZ)4cjryGNV$08fnuCJRY(3bjqyFNU$+7fmuBJQY*3aiqxFMU!+6eltBIQX*2ahpxEMT!-6dlsAIPX&29howDLT#-5dkszHPW&19govDKS#)5ckrzGOV%18gnvCKRZ(4cjryGNV$U!+6emtBIQX*2ah

36、pxEMT!-6dltAIPX&29howELT#- 5dkszHPW&19govDLS#)5ckrzGOW%18gnvCKRZ)4cjryGNV$08fnuCJRY(4bjqyFNU$+7fmuBJQY*3aiqxFMU!+6emtBIQX*2ahpxEMT!-6dlsAIPX&29howELT#-5vDKSZ)4cjryGOV%08fnuCKRZ(4bjqyFNV$07fmuBJQY(3biqxFMU$+7emtBIQX*3aipxEMT!-6eltAIPX&2ahbiqxFMU!+6emtBIQX*2ahpxEMT!-6dlsAIPX&29howELT#-5dkszHPW&19govDK

37、S#)5ckrzGOW%18gnvCKRZ)4cjryGNV$08fnuCJRY(4bjqyFNU$+7fmuBJQY*3aibjryGNV$07fnuCJRY(3biqyFNU$+7emtBJQY*3aipxEMU!+6eltAIQX*2ahpwELT!-6dlsAHPW&29howDLS#- 5dkszHOW%19govDKSZ)4ckrzGOV%08fnvC&29howDLS#)5dkszHOW%18govDKSZ)4ckrzGOV%08fnvCKRZ(4bjqyGNV$07fmuCJRY(3biqxFNU$+7emtBIQY*3aipxEMU!+6eltAIPX*2ah9govFMU!

38、+7emtBIQX*2aipxEMT!-6eltAIPX&29hpwELT#-5dksAHPW&19gowDLS#)5ckrzHOW%18gnvCKSZ)4cjryGOV%08fnuCJRZQX*3aipxEOV%18gnvCKRZ(4cjryGNV$08fnuCJRY(3bjqyFNU$+7emuBJQY*3aiqxFMU!+6eltBIQX*2ahpwEMT!-6dlsAIPX&29hHOW%18gnvDKltAIPX*2ahpwELT#- 6dlsAHPW&29howDLS#)5dkszHOW%18govDKSZ)4ckrzGOVbjqyFNU$+7fmuBJQY*3aiqxFMU!+6

39、eltBIQX*4cjrzGOV%08fnvCKRZ(4bjqyGNV$07fmuBJRY(3biqxFMU$+7e6dlsAHPW&29howDLS#)5dkszHOW%19govDKSZ)4ckrzGOV*2aipxEMT!-6dltAIPX&29hpwELT#-5dksAHPW&1908fnuCJRZ(4bjqyFNV$07fmuBJQY(3biqxFMU!+7emtBIQX*3aipzGOV%18gnvCKRZ(4cjryGNV$07fFMU!+7emtBIQX*2aipxEMT!-6eltAIPX&29hpwELT#-5dksAHPW&19govDLS#)5-6dlsAIPX&29h

40、owDLT#- 5dkszHOW&19govDKS#)5ckrzGOV%18gnvCKRZ(4cjryGNV$08fnuCJRY(3bjqyFNUOV%08fnvCKRZ(4bjqyGNV$07fmuCJRY(3biqxFNU$+7emtBIQY*3aipxEMU!+6eltAIPX*2ahpwELT#-6dlsAtBIQX*3aipxEMT!-6eltAIPX&29hpwELT#-5dksAHPW&19gowDLS#)5ckrzHOW%18gnvCKSZ)4cjryGOV%0sAHPW&19govDLS#)5ckrzHOW%18gnvCKSZ)4cjryGNV%08fnuCJRZ(4bjqy

41、FNU$07fmuBJQY*3biqxFMUNV$07fnuCJRY(3bjqyFNU$+7emuBJQY*3aipxFMU!+6eltBIQX*2ahpwEMT!-6dlsAHPX&29howDLT#U!+6eltAIPX*2ahpwELT#- 6dlsAHPW&19howDLS#)5dkszHOW%18govDKSZ)4cjrzGOV%08fnvCKR!-6dDLS#)5ckszHOW%18govDKSZ)4cjrzGOV%08fnuCKRZ(4bjqyGNV$07fmuBJRY(3biqxFMU$DKSZ)5ckrzGOV%08gnvCKRZ(4bjJQY*3biqxFMU!+6emtBIQX*2aipxEMT!-6dltAIPX&29howGNV$07fmuCJRY(3biqyFNU$+7emtBJQY*3ai9howDLS#-5dkszHOW&19govDKSZ)5ckrzGOV*3aipxEMT!-6eltAIPX&2ahpwELT#- 5dlsAHPW&19gowDLS#)5ckszHOW%18gnvmuBJRY(3dkszHPW