Intellectual Property Law

SAN FRANCISCO -- Cybercriminals have become industrialized to increase their effectiveness. They are increasingly using encryption to cover their tracks and prevent forensic investigators from recovering evidence, according to Joe Stewart, security researcher for SecureWorks.

Stewart, speaking at the RSA Security Conference in San Francisco Wednesday, said the criminals are using virtual private networks to siphon stolen information from hacked companies so the stream of exiting data often goes undetected by the victim. They've also wised up to encrypting their hard drives so even when they're captured by authorities, evidence stored on their computers can't be cracked.

Lawrence Baldwin, a security consultant and operator of MyNetWatchman, who spoke on a panel with Stewart, described malware-distribution services that help malicous-code creators infect machines with viruses and keystroke logging programs. The entrepreneurs behind the distribution services control legions of hacked computers corralled into botnets, and charge customers (other hackers and spammers) for the privilege of running their own malware on the hacked machines.

The going rate for infection distribution varies from $5 per 1,000 computers in Asia to $130 for 1,000 installations in the United States.

The distribution services are just one example of the ways that criminals in the computer underground have become industrialized to trade niche skills and expertise.

Baldwin also described anonymization VPN services catering to the underground that use hijacked botnet computers to hide a criminal's tracks. Using a VPN client, a criminal can choose any hacked system or node on the botnet through which to tunnel his traffic or access a victim's bank account.

Bank-fraud detection systems generally assume that a legitimate customer will log into his account from an IP address based in the city where he resides. So, a criminal in Eastern Europe who obtains the online banking credentials of a victim in the United States can log into the victim's bank account through a botnet node near that victim's address. The bank system doesn't flag the transaction as anomalous.

The underground also offers mule recruitment. Carders who steal credit- and debit-card numbers from banks and financial institutions need mules around the world to code the stolen account numbers and PINs onto blank cards. Then, the mules either withdraw funds from ATMs or run drop addresses -- snail-mail addresses where goods purchased with stolen credit-card numbers are shipped. The mule operating a drop address sells the goods on e-Bay or elsewhere, then transmits the revenue (minus a commission) back to the hacker through Western Union or online payment services such as PayPal, Web Money or e-Gold. ATM cashers transmit their revenue the same way.

Recruitment services operate like temp agencies, allowing hackers and carders to hook up with mules in numerous states or countries. The usefulness of a mule is generally short-lived, however, because they're easily caught on ATM cameras making withdrawals or through stakeouts at drop addresses. Mules are a finite resource, Baldwin and Stewart explained. But in today's economy, their ranks are likely to grow.