Cyber Crime — Case Studies
2043 words
10 min read
Visual companion
Python
Type and operator map
Python Week 1: the first filter for runtime behavior
View
Revision summary
What this note is really saying
Short form
# Cyber Crime — Case Studies ## 🎯 Learning Objectives - Analyze the Cambridge Analytica scandal and its implications - Investigate the 2020 Twitter Bitcoin scam hack - Understand ransomware attack patterns and defenses - Extract lessons from major data breaches - Apply ethical analysis frameworks to real-world inci...
Cyber Crime — Case Studies
🎯 Learning Objectives
- Analyze the Cambridge Analytica scandal and its implications
- Investigate the 2020 Twitter Bitcoin scam hack
- Understand ransomware attack patterns and defenses
- Extract lessons from major data breaches
- Apply ethical analysis frameworks to real-world incidents
1. Cambridge Analytica (2018)
1.1 Intuition
Imagine someone collects detailed personality data on you and your friends without your knowledge, then uses it to manipulate you politically. That's Cambridge Analytica — a data analytics firm that harvested 87 million Facebook profiles and used them for political advertising. It wasn't a hack in the technical sense; they used a legitimate feature (Facebook's API) in an illegitimate way.
1.2 Timeline
(Diagram)
1.3 Technical Details
How data was collected:
(Diagram)
API permissions at the time:
| Permission | What it gave | Why it was dangerous |
|---|---|---|
user_friends | User's friend list | Could access friends' public data even if they didn't authorize the app |
user_likes | Pages the user liked | Likes predict personality (OCEAN model) |
user_location | Hometown, current city | Geographic targeting |
user_photos | Profile photos | Identity verification |
1.4 Key Lesson: API Design Matters
The vulnerability wasn't a bug — it was a design choice. Facebook's API gave apps access to friends' data without their consent. Facebook assumed that if user A authorized an app, user A's friends implicitly consented. This was wrong.
Resulting changes:
- Facebook shut down the friends data API (v2.0+)
- All apps now require review for extended permissions
- Data access expires after 90 days if app is unused
- GDPR and CCPA passed partly due to this scandal
2. The Twitter Bitcoin Scam (July 15, 2020)
2.1 Intuition
On July 15, 2020, the biggest names in tech and politics simultaneously tweeted "I'm giving back to the community. Double your Bitcoin!" — and people believed it. The hack wasn't technical in exploiting Twitter's code; it was a phone spear phishing attack on Twitter employees that gave attackers access to Twitter's internal admin tools.
2.2 The Attack
(Diagram)
2.3 Tweets Sent
| Account | Tweet | Followers Reached |
|---|---|---|
| @BarackObama | "I'm giving back to my community. All Bitcoin sent to my address will be doubled!" | 130M |
| @ElonMusk | Same text | 65M |
| @BillGates | Same text | 55M |
| @Apple | Same text | 30M |
| @uber | Same text | 12M |
Total reach: 300M followers Bitcoin received: 12.86 BTC ($117,000 at the time) Transactions: Over 400 transfers to the scam address
2.4 Tracing the Bitcoin
| Transaction | From | To | Amount (BTC) | Time |
|---|---|---|---|---|
| 1 | Unknown | Scam Address | 0.5 | 20:17 UTC |
| 2 | Unknown | Scam Address | 1.0 | 20:19 UTC |
| 3 | Unknown | Scam Address | 2.5 | 20:22 UTC |
| 4 | Unknown | Scam Address | 0.1 | 20:24 UTC |
| ... | ... | ... | ... | ... |
| 50 | Scam Address | Exchange A (partial) | 5.0 | 21:45 UTC |
| 51 | Scam Address | Exchange B (partial) | 3.5 | 21:46 UTC |
2.5 Vulnerabilities Exploited
| Weakness | Description | Solution |
|---|---|---|
| Phone-based verification | IT support could reset accounts via phone | Hardware security keys |
| Weak internal tool security | Admin panel accessible with basic credentials | VPN + MFA + PAM |
| No human verification | No approval required for password resets | Two-person rule |
| Social engineering training | Employees suspeptible to pretexting | Regular security training |
2.6 Aftermath
- Arrested: Graham Ivan Clark (17), Nima Fazeli (22), Mason Sheppard (19)
- Clark sentenced: 3 years in juvenile detention
- Twitter security overhaul: Implemented hardware security keys for all employees
- Industry impact: Led to widespread adoption of FIDO2/U2F security keys in tech companies
3. Equifax Data Breach (2017)
3.1 Intuition
Equifax is one of three major US credit reporting agencies — they hold sensitive financial data on virtually every American adult. In 2017, attackers exploited a known vulnerability in Apache Struts (a web framework) to access Equifax's systems and steal 147 million records. The breach was entirely preventable: a patch was available for 2 months before the attack.
3.2 Timeline
| Date | Event |
|---|---|
| March 7, 2017 | Apache releases patch for CVE-2017-5638 (Struts vulnerability) |
| May 13, 2017 | Attackers begin scanning for vulnerable Equifax servers |
| May 13 - July 30 | Attackers exfiltrate 147M records over 76 days |
| July 29 | Equifax detects suspicious traffic |
| September 7 | Public disclosure of breach |
3.3 Data Stolen
| Data Type | Records | Risk |
|---|---|---|
| Full names | 147M | Identity theft |
| Social Security Numbers | 147M | Tax fraud, loan fraud |
| Birth dates | 147M | Account takeover |
| Addresses | 147M | Physical mail fraud |
| Driver's license numbers | 38K | Document fraud |
| Credit card numbers | 209K | Direct financial fraud |
3.4 Root Cause Analysis
(Diagram)
Key failures:
- Patch management: Equifax had a tool to deploy patches but didn't use it for this vulnerability
- Network segmentation: The web-facing application had direct access to the database
- Monitoring: 76 days of data exfiltration (76 GB) was not detected
- Incident response: Took 6 weeks to disclose the breach after detection
4. Ransomware Case: WannaCry (2017)
4.1 Intuition
WannaCry was a ransomware worm that infected 200,000+ computers in 150 countries in 4 days. It encrypted users' files and demanded 600 in Bitcoin to decrypt them. What made WannaCry special was its propagation method: it used a Windows vulnerability (EternalBlue) that had been developed by the NSA and leaked by the Shadow Brokers hacker group.
4.2 Spread Pattern
| Day | Infected Systems | Countries |
|---|---|---|
| May 12 | 50,000 | 74 |
| May 13 | 150,000 | 116 |
| May 14 | 200,000 | 150 |
| May 15 | 200,000+ | 150+ |
Worst affected: UK's National Health Service (NHS) — 70,000 devices infected, 19,000 appointments cancelled.
4.3 Kill Switch Discovery
A researcher (MalwareTech) registered a domain name hardcoded in the malware, which triggered the malware's "kill switch" — stopping the spread. This highlights a key learning: always test malware for killing mechanisms.
5. Lessons Learned Framework
(Diagram)
5.1 Common Patterns Across Cases
| Case | Root Cause | Type | Could Have Been Prevented |
|---|---|---|---|
| Cambridge Analytica | Poor API design | Policy/Design | Yes (data access limits) |
| Twitter Hack | Social engineering | Human | Yes (hardware keys) |
| Equifax | Unpatched software | Technical | Yes (patch management) |
| WannaCry | Unpatched vulnerability | Technical | Yes (patch management) |
6. Common Pitfalls
Pitfall 1: Believing "It Won't Happen to Us"
The mistake: Assuming your organization is too small or too obscure to be targeted.
Why students make it: Major breaches make headlines for big companies; small organizations seem below attackers' radar.
How to catch it: Automated attacks don't discriminate — they scan the entire internet for vulnerabilities. Equifax's attacker wasn't targeting Equifax specifically; they scanned for vulnerable Struts servers anywhere.
Correct approach: Assume you will be targeted. Prepare incident response plans, practice backups, and implement Defense in Depth regardless of organization size.
Pitfall 2: Confusing "Compliant" with "Secure"
The mistake: Assuming that meeting regulatory requirements (PCI-DSS, GDPR, HIPAA) means you're safe.
Why students make it: Compliance frameworks look comprehensive and have legal teeth.
How to catch it: Equifax was PCI-DSS compliant when breached. Compliance is a minimum baseline, not a security guarantee.
Correct approach: Use compliance as a starting point, but continuously assess actual risks, conduct penetration testing, and practice incident response.
Pitfall 3: Focusing Only on Prevention
The mistake: Investing all security budget in prevention (firewalls, antivirus) and nothing in detection/response.
Why students make it: Prevention is more visible and easier to budget for.
How to catch it: Every major breach involves detection failure — the attacker was inside for weeks or months before discovery.
Correct approach: Follow the "1-10-60 rule": 1 minute to detect, 10 minutes to investigate, 60 minutes to contain. Balance prevention with detection (SIEM, EDR) and response (incident response team, playbooks).
7. Key Concepts Reference
| Concept | Definition | Example |
|---|---|---|
| Social Engineering | Manipulating people to divulge information | Twitter hack pretexting calls |
| API Abuse | Using legitimate API features in unintended ways | Cambridge Analytica friends data |
| Patch Management | Process of applying software updates | Equifax's failure to patch Struts |
| EternalBlue | NSA exploit leaked by Shadow Brokers | Used in WannaCry |
| Kill Switch | Mechanism to stop malware | WannaCry domain registration |
| Defense in Depth | Multiple layers of security controls | Prevention + detection + response |
| Zero Trust | Never trust, always verify | Internal segmentation, least privilege |
8. 📝 Practice Questions
Q1: What was the primary vulnerability in the Cambridge Analytica case?Answer: The primary vulnerability was Facebook's API design that allowed apps to collect data not just on users who authorized the app, but also on all their friends. This meant 270,000 quiz-takers led to data on 87 million users. It was a design flaw, not a technical bug — Facebook assumed that if user A authorized an app, user A's friends implicitly consented to their data being collected too. Q2: How did the Twitter Bitcoin scam attackers gain access to verified accounts?Answer: The attackers used phone-based spear phishing (pretexting) — they called Twitter employees pretending to be from Twitter IT support, claiming they needed the employee's credentials to fix a VPN issue. Once they had access to Twitter's internal admin tools, they could reset passwords for any verified account without additional verification. Q3: Why was the Equifax breach considered "entirely preventable"?Answer: The vulnerability (CVE-2017-5638 in Apache Struts) was patched by Apache on March 7, 2017 — 2 months before attackers exploited it on May 13. Equifax had a patch deployment tool but never used it to deploy this specific patch. If they had applied the available patch in those 2 months, the breach would not have occurred. Q4: What stopped WannaCry's spread, and why is this important?Answer: A security researcher (MalwareTech) registered a domain name that was hardcoded in the malware. The malware checked if this domain resolved; when it did, the malware shut down (kill switch). This is important because it shows: (1) malware authors often include kill switches for testing, (2) reverse-engineering malware can reveal kill switches, and (3) the kill switch stopped the spread but didn't help already-infected systems. Q5: Compare the attack vectors of Cambridge Analytica vs. the Twitter hack.Answer: Cambridge Analytica was an API/data abuse attack — exploiting legitimate technical features (Facebook's friends API) for unauthorized data collection with no technical hacking involved. The Twitter hack was a social engineering attack — manipulating human employees (not technical systems) to gain access. Cambridge Analytica used code legally; the Twitter hackers used deception illegitimately. Q6: What is the "1-10-60 rule" in incident response?Answer: The 1-10-60 rule sets targets for incident response: detect the breach within 1 minute, investigate and understand the scope within 10 minutes, and contain/eradicate the threat within 60 minutes. This reflects the reality that attackers can cause enormous damage in hours, so speed of detection and response is critical. Equifax failed this — attackers had 76 days of undetected access. Q7: Why was the Twitter hack's impact so severe despite being a relatively simple attack?Answer: The impact was severe because: (1) it targeted the most influential accounts on the platform (Obama, Musk, Gates) with massive reach (300M+ followers), (2) it exploited trust in verified accounts, (3) it damaged Twitter's credibility at the highest level, (4) the Bitcoin scam was just the visible impact — attackers could have done much worse (stock manipulation, false news). The simplicity of the attack (phone calls) made it more concerning — it showed that even sophisticated tech companies are vulnerable to basic social engineering. Q8: If you were CISO of Equifax in March 2017, what would you have done to prevent the breach?Answer: (1) Maintained an accurate asset inventory to know all systems running Apache Struts, (2) subscribed to vulnerability announcements (CVE alerts), (3) had a patch management policy requiring critical patches within 48 hours, (4) deployed automated vulnerability scanning, (5) implemented network segmentation so the web server couldn't directly access the database, (6) monitored outbound data transfers for unusual volumes (76 GB over 76 days should have been detected). Q9: What is the difference between a data breach and a ransomware attack?Answer: A data breach involves unauthorized access to and exfiltration of data (the attacker steals information). The primary harm is loss of confidentiality — personal information is now in the attacker's hands. A ransomware attack involves encrypting the victim's data and demanding payment for decryption. The primary harm is loss of availability — the victim cannot access their own data. WannaCry was ransomware; Equifax was a data breach. Some attacks combin both (e.g., attackers exfiltrate data before encrypting it). Q10: How did GDPR change the consequences of data breaches compared to before 2018?Answer: Before GDPR, data breach penalties in the EU were minimal. GDPR introduced: (1) mandatory breach notification within 72 hours, (2) fines up to 4% of global annual revenue or €20M (whichever is higher), (3) expanded definition of personal data, (4) right to data deletion, (5) data protection impact assessments required. This means breaches like Cambridge Analytica now carry massive financial consequences — Meta was fined €1.2 billion in 2023 for GDPR violations related to data transfers.
9. 🔗 Cross-References
- Week 4 - Cyber Crime: Technical background on attack types
- Week 6 - Fake News: Misinformation campaigns
- Week 10 - Ethics: Ethical frameworks for data use
- BSCS4022 (OS): Access control, security models Join Discord PreviousCryptography BasicsNextFake News Detection