.svg){kind=logo} | |
 Building 92 at Microsoft Corporation headquarters in Redmond, Washington | |
| Abbreviation | DCU |
|---|---|
| Purpose | An international legal and technical team of attorneys, investigators, and forensic analysts, with expertise across the areas of malware, botnets, IP crimes, and technology-facilitated child exploitation |
| Headquarters | Microsoft Redmond Campus |
| Location |
|
| Coordinates | 47°38′23″N122°7′42″W / 47.63972°N 122.12833°W /47.63972; -122.12833 |
Region served | Worldwide |
Parent organization | Microsoft |
TheMicrosoft Digital Crimes Unit (DCU) is aMicrosoft sponsored team of international legal andinternet security experts employing the latest tools and technologies to stop or interfere with cybercrime and cyber threats. The Microsoft Digital Crimes Unit was assembled in 2008. In 2013, a Cybercrime center for the DCU was opened inRedmond, Washington.[1] There are about 100 members of the DCU stationed just in Redmond, Washington at the original Cybercrime Center. Members of the DCU includelawyers,data scientists, investigators,forensic analysts, andengineers.[1] The DCU has international offices located in major cities such as:Beijing,Berlin,Bogota,Delhi,Dublin,Hong Kong,Sydney, andWashington, D.C.[2] The DCU's main focuses arechild protection,copyright infringement andmalware crimes.[1][2] The DCU must work closely withlaw enforcement to ensure the perpetrators are punished to the full extent of the law. The DCU has taken down many major botnets such as the Citadel, Rustock, and Zeus. Around the world malware has cost users about $113 billion and the DCU's job is to shut them down in accordance with the law.[1]
There are three areas on which the DCU concentrates:[3]
Trespass to Chattel is a legal term for how the Microsoft Digital Crimes Unit takes down its cyber criminals. Chattel is old English for cattle, which was considered to be valuable property to the owner. Essentially meaning that any property that is not land is referred to as chattel or "cattle". When spam or malware infects a user's computer or network that is considered to be "trespass to chattel" because they aretrespassing on the user's property. The cybercrime is that the criminal has trespassed on the user's computer or network because they are responsible for the spam or malware they intended to harm the user with. The DCU's legal team has to pursue thecyber criminal in court using these old legal doctrines and laws to charge them with the crime of trespassing.[1]
Abotnet is a network of compromised computer (Zombies) that are controlled without the user's knowledge. These are usually used to do repetitive tasks such as spam but can also be used for distributing malware andDistributed Denial of Service(DDOS) attacks. These botnets are controlled by a single criminal or a network of criminals.[4] The Microsoft Digital Crimes Unit is constantly hunting down Botnet networks that are used for these tasks. The DCU has dealt with botnets forspamming,key-logging and data ransom. The DCU has also taken down botnets such as Citadel, Rustock, and Zeus. It is an everyday fight for the DCU to continue to locate new threats from botnets and take them down.[5]
On March 18, 2011, the Microsoft Digital Crimes Unit took down theRustock Botnet. The Rustock botnet was responsible for over half of thespam worldwide sent to users and had controlled over 1 million computers. This spam had viruses attached to the emails and some werephishing emails. Microsoft with the help of theU.S. Marshals got warrants to seize the identified localcommand-and-control servers and do analysis on them. The DCU and U.S. marshals raided the servers located inChicago,Columbus,Dallas,Denver,Kansas City,Scranton, andSeattle. After the DCU had seized the servers and terminated them the entire world had a large decrease in spam. Since then there has been no spam from the Rustock Botnet.[6][7]
On March 25, 2012, the Microsoft Digital Crimes Unit took down theZeus Botnet. This investigation was also known as Operation b71. The Zeus botnet is responsible for stealing more than $100 Million from over 13 million infected computers. The botnet was installed on the user's computer frompirated versions ofWindows or hidden through a download online. The Zeus botnet works by waiting for the user of the computer to open aweb browser and attempt to do somebanking oronline shopping then show a similar looking webpage with a field to enter the login information. The login information is then sent to a Zeus server and the criminal can access the user's accounts. The DCU, accompanied byU.S. Marshals, shut down the botnet by raiding twocommand-and-control server facilities locatedScranton,Pennsylvania andLombard, Illinois. From there the DCU made a case to prosecute 39 unnamedcyber criminals who were responsible for this botnet by accessing the servers and retrieving the stolen data. After this botnet was shut down the starter code has since been sold on the black market to make other variations of this botnet such as Citadel and many more. Therefore, the Zeus botnet code itself is still active and has evolved.[8]
On June 6, 2013, the Microsoft Digital Crimes Unit took down the Citadel botnet's 1000 servers. The Citadel botnet had infected an estimated 5 million computers using akey-logging program to steal the information. Citadel is responsible for stealing at least $500 million from online personalbank accounts in over 80 countries. They stole from banks such asAmerican Express,Bank of America,PayPal,HSBC,Royal Bank of Canada andWells Fargo. The Citadel code emerged from the cybercrime kit known as Zeus which is sold as a starter code on the black market for thousands. The creators of Citadel are unknown but the DCU has prepared a large amount of charges to prosecute them. The DCU has since then helped users update their systems to get rid of the malware that may still be on their computers but is inactive.[9]
On December 5, 2013, the Microsoft Digital Crimes Unit, theFBI,Europol, and other industry partners attempted to disrupt theZeroAccess botnet.[10] Although the efforts took down 18 hosts that were part of the ZeroAccess command and control network, because of thepeer-to-peer nature of the botnet, ZeroAccess remains active.[11]
