Home -> Law Blog Directory -> Intellectual Property Law Blogs -> Threat Level

Intellectual Property Law

: Threat Level

Underground Crime Economy Healthy, Security Group Finds

By Ryan Singel, Kevin Poulsen, Sarah Lai Stirland, Kim Zetter, and David Kravets

The net's underground economy in stolen credit cards and phished bank-account logins remained healthy over the last year, despite continued high-profile takedowns of online criminal marketplaces, according to a report on the underground economy released Monday by Symantec security researchers.

Some $276 million worth of credit cards, bank account info, security exploits and hacker tools were up for sale on online web forums and internet relay chat channels, or IRC, that Symantec monitored from July 2007 to June 2008.

While that's a far cry from the fictitious $100 billion annual cybercrime figureoften used to fan fears of online crime, the figure shows that the underground market in stolen credit cards and bank accounts remains robust, despite the increasing proficiency of law enforcement groups in taking down high-profile figures in the 'carder' community.

There is also a continuing trend towards professionalization of online crimein Eastern Europe and Russia ? including participation from organized crime, and the groups can sometimes mass-produce credit cards by the thousand from numbers bought or stolen online. In contrast, North American groups are loose federations of individuals who met online in chat rooms and decide to partner up, according to Symantec.

If criminals snagged $350 worth of goods out of each credit card on offer, the potential total worth of the online market would be $5.3 billion, according to the report(.pdf). If scammers could get $40,000 out of each bank account, then some $1.7 billion worth of bank accounts were on offer.

Credit cards with CVV2 numbers (the little security numbers printed on cards) are now prized, since many online merchants now require it for purchases but aren't allowed to store it in their databases. Still, a hundred cards cost only about $0.70 a piece in bulk, while credit cards without such numbers go for as little as $0.10.

Bank account logins and passwords remain the most prized and command the largest fees, since they get scammers even closer to the money.

Hackers also sell DIY kits, including botnets, hosting services for phishing websites, spam-blasting services and automated scripts for finding vulnerabilities in websites.

In recent years, law enforcement groups have gotten craftier at infiltrating and taking down web forums. High-profile takedowns include DarkMarketand ShadowCrew. While those sites increase the risk of infiltration by law enforcement, they reduce the risk of being ripped off by a seller or buyer ? thanks to reputation ratings not unlike those found on eBay.

See Also:

• Notorious Crime Forum DarkMarket Goes Dark
• Feds Charge 11 in Breaches at TJ Maxx, OfficeMax, DSW, Others ...
• Indicted Federal Informant Allegedly Strong-Armed Hacker Into ...
• Cybercrime Supersite 'DarkMarket' Was FBI Sting, Documents Confirm ...
• Did Anti-Spam Group Create a Backstory For DarkMarket's Undercover ...

Full post as published by Threat Level on November 24, 2008 (boomark / email).