A Quick Tour Of Cybercrime’s Underground

One of the strange features of cybercrime is how much of it is public. A quick search will turn up forums and sites where stolen goods, credit cards and data are openly traded. But a glance into those places may not give you much idea about what is going on.

"Everyone can join as long as you speak Russian," said Anton, a malware researcher at security firm SentinelOne, who has inhabited this underground world for more than 20 years.

"By Russian I mean the USSR, so there is Ukrainians, there is Kazakhstan, there is Belarus. The Romanians are doing all the dirty work like spam and maintenance so they are not really involved in developing malware," he said. "But, today, is it mainly Russian? Yes."

Those vibrant underground marketplaces have a long history and Anton adds that he tracks the malware makers to gain insights into what they might do next.

Analysis

Tony Rowan, chief security consultant at SentinelOne, which employs Anton to log what happens on crime forums and dark web marketplaces.

"It gives us an insight into the directions these communities are taking.

"We have to monitor these to understand what they are doing, the success they are having and what they are about to do next.

"You have to be prepared rather than just sit back and wait for it to happen to you. It's essential for us to have this kind of contact because without it we are blind."

Rick Holland, strategy head at security firm Digital Shadows, which tracks online hacker groups.  "There's a lot of criminality going on in the open web, particularly when you get into the Russian federation. They do not need to be on the dark web. Some are quite brazen and quite public whereas others have a much higher level of operational security.

"If we are tracking a criminal location and we find chatter about our clients that can be of value," he said. "In the longer term it's what's coming over the horizon. What are they dialing-up next?

"It's not trivial to do something like that, it's definitely not easy to do although I think there's definitely value in working out what they are doing."

The underground changed after the millennium turned and e-commerce took off. Forums popped up that talked about how to cash in via spam, phishing, malware and web attacks.

There was another big shift in 2007-08, said Anton, as the criminals sought a way to fleece people that gave better returns than the cruder techniques. The first wave, which started the modern era of cybercrime, used fake anti-virus software.

"They installed some really, really poorly written software on your machine," he said, explaining the scam. "It looked like anti-virus but it actually does nothing.

"It tells you: 'We just scanned your PC and we have found many problems. You need to fix it now, you need to buy this software. It only costs $35-40 (£28-32)'," he said.

This worked better than earlier scams, said Anton, but it took a lot of effort to catch people out and get them to pay.

Often, he said, when people paid via a credit card they reversed the transaction once they found out they had been tricked. Conversion rates, meaning the number of victims who handed over cash, stayed low.

"This meant they must do something better, something more scary."

Frightened people pay up, said Anton, adding that this drove the next evolution: lockers. "What they do is they attack your browser and put up a big page on your main desktop, saying you were found with illegal child pornography or something very, very scary," he said.

"People got afraid saying 'OK, maybe one of my kids did it, maybe, I'm not sure, I'll pay',".

The one-page attacks asked for more money, up to $200 (£160), and proved so successful that many police forces issued warnings that urged people not to pay.

The success, and also the publicity, forced the next stage of crime-ware - ransomware, Anton explained. "I call it an evolution because the same people that did the fake anti-virus before are doing ransomware now. And they were doing the fake police page in the years between 2010 and 2013," he said.

Ransomware has the best conversion rate, he said, because victims cannot ignore its effects.

"It's real damage so that you can see that your files are no longer working. And that's the best proof for the user that he must pay," he said.

Never Stop

Its rise has also been helped by the advent of virtual currency Bitcoin, because it has few of the drawbacks of credit cards or other payment systems.

"Today you cannot talk about ransomware without mentioning Bitcoin because that's what made this evolution come," said Anton.

The damage is not just limited to the amount people pay. Estimates from the FBI suggest that the 992 cases of ransomware carrier Cryptowall reported during a 14-month period cost victims $18m (£14.4m). Some of the cost was in the ransom, up to $10,000 (£8,000), but this was multiplied by lost productivity, legal fees and work done to remove the infections.

It is popular, he said, because of another shift in the way that the underground is organised. In the past the groups writing the malware sent the spam, analysed the results and fleeced the victims. Not any more, he said. Now, many groups writing ransomware run it as a service.

"They will give you the software with your affiliate ID so if you spread it they will know that it's from you and you will get a payout," he said. "You will get 70% and they will get the 30% out of each payment."

Competition among ransomware writers means some other groups give better returns.

But, he said, those groups may be producing poorly-written malware that struggles to get past the digital defences people and businesses use.

The evolution of the underground has hit a peak with ransomware and Bitcoin, said Anton, and their combined success has kicked off a gold rush.

"It's getting more and more people attracted to it, like from the criminal side. More and more people are starting to spread it."

They will not stop, either, he said. "I think if you get easy money and it just keeps coming, why not continue it, right? It's obvious."

BBC

UK Fraud Hits £1.1bn As Cyber Crime Soars:

The Dark Web Is Hidden In Plain Sight:

 

 

« Flight Ban On Laptops 'sparked by IS threat'
Security & Encryption After Edward Snowden »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

National Cyber Directorate Israel

National Cyber Directorate Israel

The Israeli National Cyber Directorate provides incident handling services for civilian entities and critical infrastructures and works to increase national resilience against cyber threats.

Alan Turing Institute

Alan Turing Institute

Alan Turing Institute is the UK national institute for data science. A major focus is Big Data analysis with applications including cyber security.

4iQ

4iQ

4iQ fuses surface, social, deep and dark web sources to research and assess risks to people, infrastructure, intellectual property and reputation.

Canadian Security Intelligence Service (CSIS)

Canadian Security Intelligence Service (CSIS)

CSIS collects and analyzes threat-related information concerning the security of Canada in areas including terrorism, espionage, WMD, cybersecurity and critical infrastructure protection.

limes datentechnik

limes datentechnik

limes datentechnik is an authority in the fields of cryptography and data compression. The FLAM product family is an internationally accepted standard for efficient and safe handling of data.

NFIR

NFIR

NFIR is a specialist in the field of cyber security incident response and digital forensics.

State Service of Special Communications & Information Protection of Ukraine (SSSCIP)

State Service of Special Communications & Information Protection of Ukraine (SSSCIP)

State Service of Special Communications and Information Protection is the technical security and intelligence service of Ukraine, under the control of the President of Ukraine.

Axio Global

Axio Global

Axio is a leading cyber risk management SaaS company. Our Axio360 platform gives companies visibility to their cyber risk, and enables them to prioritize investments to protect their business.

Safe Systems

Safe Systems

Safe Systems provide compliance centric IT services for community banks and credit unions, ensuring that they are kept up to date on current technologies, security risks, and regulatory changes.

Epiphany Systems

Epiphany Systems

Epiphany enhances your defensive security controls by providing you with an offensive perspective. We expose the most likely attack paths to your most critical IT assets and users.

OpenAVN (DefenseArk)

OpenAVN (DefenseArk)

Defending your life online, keeping your data safe and private. We detect digital threats magnitudes faster than the leading antivirus software.

HORNE

HORNE

HORNE is a professional services firm supporting clients in public, private & government sectors nationwide.

Sansec

Sansec

Sansec is the global leader in eCommerce malware and vulnerability detection. We help you to stay ahead of hackers!

Nullify

Nullify

Nullify is your automated security sentry that continuously finds and fixes security issues across your codebase.

Genix Cyber

Genix Cyber

Genix Cyber provides world-class cybersecurity services that protect systems, cloud applications, infrastructure, critical data, and networks from evolving cyber threats.

Secure Enterprise Engineering (SEE)

Secure Enterprise Engineering (SEE)

SEE provides disruptive cybersecurity system engineering, architecture, and operational capabilities to make our customer’s missions execute faster, smarter, and more securely.