We know that cybercriminals are almost always seeking financial gain, but it seems that this is not usually what young cybercriminals have in mind when they take their first steps over to the \u201cdark side\u201d.<\/p>\n
For example, an interesting report<\/a> by the UK\u2019s National Crime Agency (NCA) found that many are not necessarily motivated by financial reward. In fact, recognition from their peers, popularity in the forums they belong to, and a sense of success, are bigger influencing factors.<\/p>\n \u201cThe sense of accomplishment at completing a challenge, and proving oneself to peers are the main motivations for those involved in cybercriminality,\u201d the authors of the paper stated.<\/p>\n As an example, the report includes the testimony given by an 18-year-old who was arrested for unauthorized access to a US government website. At the time of his arrest he said: \u201cI did it to impress the people in the hacking community, to show them I had the skills to pull it off \u2026 I wanted to prove myself.\u201d<\/p>\n There is another major factor that tempts many youngsters to get involved in the world of cybercrime: a feeling that it isn\u2019t a crime in the \u2018traditional sense\u2019, and that they won\u2019t be arrested <\/strong>for carrying out a cyberattack.<\/p>\n In fact, the NCA is certain that many British teenagers who get involved in cybercrime wouldn\u2019t get involved in \u2018traditional crimes\u2019, based on the lack of prior convictions among the country\u2019s cyberattackers. \u201cPerception of the risk of law enforcement intervention remains low,\u201d the agency reports.<\/p>\n A third factor that attracts them is the ease with which they can start launching attacks or malicious activites. There are all kinds of tools available online which are neither expensive nor difficult to use.<\/p>\n Recently we talked about the cybercrime business model<\/a>, which consists in selling packages of tools that can easily be used by anyone, even those with little technical knowledge. Hence new phenomena like ransomware-as-a-service have appeared, offering the sale of ransomware services and other forms of fraud, attacks, and malware \u201cas a service\u201d.<\/p>\n This means teenagers can pay a fixed price, for example $175 in the case of the Karmen ransomware, and buy tools that will allow them to infect other users relatively easily.<\/p>\n An even easier way for beginners to get started, according to the NCA, is to get involved in video game cheat websites and modding forums (for modifying games), from where they may \u201cprogress\u201d to forums dedicated to cyberattacks, where such things are discussed openly.<\/p>\n \u201cVery little skill is needed to begin criminal activity online. With tools such as booters and Remote Access Trojans (RAT), users can make a small payment (or often no payment) and begin breaking the law,\u201d the report states.<\/p>\n Unfortunately, the availability of step-by-step tutorials and video guides makes the transition to criminality all too easy. \u201cOnce the law is broken, subsequent transgressions become easier,\u201d the NCA continues.<\/p>\n However, the agency firmly believes that the guidance of a mentor and early intervention can dissuade these young people from entering into the world of cybercrime. This way, the gap between them and the authorities would be closed.<\/p>\n In cybercriminal forums though, the law and its consequences are rarely discussed\u2014if the topic arises it is quickly dismissed. These youngsters only become aware of the consequences of their actions when someone they know is arrested.<\/p>\n The people who took part in the study said they didn\u2019t have a mentor to guide them toward a more positive path and get them \u201con the right track,\u201d since the person they tend to follow is the revered cybercriminal who carries out the community\u2019s most complex attacks.<\/p>\n The NCA stated: \u201cEx-offenders who managed to cease their activities and gain an education or career in technology have credited this change to a positive mentor, or someone who gave them an opportunity to use their skills positively.\u201d<\/p>\n On this latter point though, the analysis gets a little weaker. In truth, there are always opportunities to work \u201con the positive side\u201d in technology; in fact, we are constantly talking about the lack of cybersecurity professionals<\/a> and how there aren\u2019t enough people to fill the posts available<\/a>. Why then do these youngsters feel the need to try out the \u201cdark side\u201d before someone comes along and rescues them?<\/p>\n Of course, lots of security professionals experimented with hacking in their youth and perhaps even took it beyond mere fun before deciding what they wanted to do with their knowledge. In the corporate world though, people naturally ask themselves, \u201cCan it really be a good idea to hire someone young who has developed a piece of malware, has run a botnet, or made money by infecting people with ransomware?\u201d<\/p>\n The debate on whether or not to hire self-confessed \u201chackers\u201d has been raging for years and will likely never end \u2013 the answers as to whether it is a good idea or not generally depend on the particular context of each case.<\/p>\n In conclusion, the worrying thing about this report is that it is so easy for young people to get involved in the world of cybercrime and that they may see it as being risk-free (as well as feeling that they lack opportunities and positive role models).<\/p>\n Well, we are some of the people who can see a great many good reasons to work in security and we keep trying every day to nurture people\u2019s interest in this career.<\/p>\n <\/p>\nA sense of impunity?<\/strong><\/h2>\n
The search for a mentor<\/strong><\/h2>\n