Cybercriminals have created a full-blown goods and services market where thieves sell stolen identities for as little as $14 and credit card account numbers for just $1, a Symantec researcher said Monday.
Symantec painted a gloomy, sometimes disturbing picture, of the state of internet security in a just-published report based on data from the second half of 2006. By tracking the trade in stolen information, the security company got an inside view of criminal bazaars, where identity thieves, hackers, spammers, fraudsters and organized gangs come together to buy, sell, rent and lease the information and tools that can make them millions.
"This is the first time we looked at the underground economy, and one of the more interesting things we found is a maturing of the [underground] marketplace," said Vincent Weafer, senior director of Symantec's security response team. "It's run on a business model, where qualified data, like a qualified sales lead, is worth more. At times, criminals will pay ten times more for qualified leads versus unqualified."
In the global underworld marketplace, a qualified lead would be a complete identity with name, mailing address, bank and credit account numbers, PINs, date of birth, and mother's maiden name. Those sold for between $14 and $18 each, said Weafer. An unqualified lead might be simply a credit card number along with its card verification number; thieves sell these for $1 to $6 each. Not surprisingly, 86 per cent of the credit and debit card accounts advertised for sale in the underground were issued by US banks.
"Criminals have found that they can rent or lease or leverage almost anything they need" by using the marketplace to obtain technical expertise and malicious code, mailing lists to spam out that code and botnets to sustain the attacks, said Weafer. Purveyors, meanwhile, also have handy access to the illicit flea markets, which Symantec says are more often than not US-based. A slight majority, 51 per cent, of all underground economy servers known to Symantec were located in the US.
"There are definitely a couple of core groups behind many of the attacks," said Weafer, who repeatedly called them "gangsters" or "mobsters." "They're definitely in it for the long haul. But there's a lot of transition, like in any a marketplace, and there's a lot of 'churn' at the very superficial level in buyers and sellers."
And everyone on the other side is getting smarter, said Weafer. "The underground economy is going even more underground. They're getting wise to the ways that law enforcement or security researchers find them."
Cybercrooks are also patient when they need to be. Weafer outlined an attack last year that obtained bank account information that was missing PINs (Personal Identification Number). "It was only six months later that [law enforcement] started to see the accounts used, and then only two or three a day. The criminals hadn't gotten the PIN, but as soon as they got the missing piece, they began to steal money.
"The underground marketplace is really all about enabling people to make money," Weafer said.
The raw numbers from the second half of 2006 were just as disturbing. "There was an increase in the volume and intensity of attacks, even compared to a year ago." The number of newly-discovered vulnerabilities, said Symantec's report, was up 12 per cent over the first six months of 2006, and marked a new high for a half-year period. Malware designed to take on Windows increased by 22 per cent over early 2006 numbers, while the number of hijacked computers, or "bots," was up 29 per cent.
"The only area we saw a decrease was in the number of botnet controllers," said Weafer. Although bots were up dramatically, the number of command-and-control systems – the machines attackers use to issue instructions to the compromised computers – was down by 25 per cent. "Attackers are aware that many companies and governments are watching them," said Weafer, who theorized that the drop in controllers was a result of the botnet operators consolidating their networks.
Ironically, although other countries' computers often are blamed for attacks, Symantec's figures indicate that the greatest number of bot command-and-control servers are based in the US. China, for example, accounted for 26 per cent of the world's bot-infected machines – and Beijing had the dubious honor of the most infected city, with 5 per cent of the global total. But 40 per cent of the botnet controllers were located in the United States.
Increasingly sophisticated criminals are 2007's biggest threat, said Weafer. In comparison, all the talk about possible Vista vulnerabilities is just so much noise. "Vista will be a vulnerability issue this year, but XP will be the focus [for attackers] for at least the next 12 months even though Vista vulnerabilities will get more publicity," said Weafer.
Weafer had little defensive advice other than the usual: enable a firewall, promptly patch operating systems and applications and keep anti-virus software updated. "As a consumer, your chance of being a victim is dependent on your behaviour," he said, recommending that users not open file attachments and steer clear of the internet's more disreputable neighborhoods.
And enterprises? "Their biggest challenge is stopping intellectual property and confidential information from going out," Weafer said.