Cybercrime? It's all about the money, Jacobs School computer scientist says

Photo: Erik Jepsen/UC San Diego Publications

It's all about the money, Stefan Savage, a computer science professor at the Jacobs School, says in the Los Angeles Times. 

“Ninety-nine percent of what you and I deal with when it comes to computer security is motivated by economics,” Savage said. “Data breaches? It’s all about the money. Spam? It’s all about the money. Malware? It’s all about the money. The problem is we are looking at this as a purely technical problem.”

 Over the years, Savage and colleagues at the Jacobs School and the International Computer Science Institute, an independent nonprofit in Berkeley, have probed the economics of cyber crime. The LA Times explains:

Throughout 2011 and 2012, he and a team of researchers posed as buyers of counterfeit goods sold on the Internet and, by tracking the flow of money in these transactions, showed that only a handful of banks were involved in these activities. Working with a Washington, D.C.-based anti-piracy organization called the International Anti-Counterfeiting Coalition (IACC), they helped create a framework whereby brandholders and credit card companies could work together to shut down the counterfeiter's financial accounts, effectively cutting off their economic lifeblood.

Full LA Times article here.

 More about Savage's work here, here  and  here.

Using Bitcoins to Make Illegal Purchases Online May Not Be Anonymous After All

Computer science Ph.D. student Sarah Meiklejohn (pictured) is causing a major stir in the world of cryto-currency and black market transactions. 

She’s part of a team at UC San Diego and George Mason University investigating the Bitcoin market and cybercrime.  Meiklejohn has become an expert on tracking Bitcoin transactions which, on the surface, appear to be anonymous. But the team found a way to link transactions to Bitcoin merchants and services – potentially undermining one major use of Bitcoin: funding online purchases of illegal products. 

In July, Meiklejohn helped cybercrime expert Brian Krebs verify that users had deposited a total of two bitcoins (~$200) into a purse on the Silk Road black market to purchase heroin that would be sent to Krebs’ home. (Krebs was able to alert the police before the heroin arrived at his home.) 

More recently, a columnist at Forbes magazine asked Meiklejohn to see if she could trace an order for small amounts of marijuana from three different Bitcoin-based online black markets. Meiklejohn followed “digital breadcrumbs” on Silk Road and had little trouble tracing the drug buys back to the Forbes writer using a clustering analysis and detecting a specific point in Bitcoin’s blockchain record of transactions – linking the user to the drug buy. The Forbes columnist, Andy Greenberg, quotes Meiklejohn as saying 

There “are ways of using Bitcoin privately. But if you’re a casual Bitcoin user, you’re probably not hiding your activity very well.” 

Not surprisingly, the findings have hit paydirt on Slashdot, and Bloomberg Businessweek noted that a new paper by Meiklejohn and her colleagues “argues that the network’s increased reliance on a few large accounts makes user identities less secure.” 

That paper, “A Fistful of Bitcoins: Characterizing Payments Among Men with No Names,” will be presented at ACM Internet Measurement Conference in Barcelona Oct. 24, but an advance version is now available.

Meiklejohn’s co-authors at UC San Diego include undergraduate Marjori Pomarole, grad student Grant Jordan, Center for Networked Systems research scientist (and Jacobs SChool alum) Kirill Levchenko, former computer science postdoc Damon McCoy (now teaching at George Mason), as well as computer science professors Geoff Voelker and Stefan Savage.