Endpoint

4/21/2016
04:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

SpyEye Creators Sentenced To Long Prison Terms

FBI found that arrest halted the release of nasty SpyEye 2.0.

Two severe sentences handed down this week for the brains behind the SpyEye banking Trojan show that cybercriminals cannot avoid stiff penalties simply by limiting their activities to the development and distribution of malicious code. Still, the sentences also show that profiting directly from the use of malware can add up to harsher terms.

According to the US Department of Justice, SpyEye strains were used to infect over 50 million computers, stealing personally identifiable information and banking data, automatically stealing funds, and causing close to $1 billion in "financial harm to individuals and financial institutions around the globe." 

Despite the fact that he himself was not charged with stealing anything, primary SpyEye developer Aleksandr Andreevich Panin, a.k.a. "Gribodemon" and "Harderman," of Russia, was sentenced to nine years -- six months of prison (plus three years probation).  

His associate, Hamza Bendelladj, a.k.a. "Bx1," of Algeria, did profit directly from SpyEye. Not only did he develop and sell malicious plug-ins for botnets -- for proliferating malware and automating the theft of funds from victim bank accounts -- Bendelladj also stole personally identifiable information from close to half a million people, the court charged, and ran an online marketplace, VCC.sc, for selling this stolen credit card data.

For his crimes, Bendelladj was sentence to 15 years prison, plus three years probation. 

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

These sentences come years after both men were arrested. Bendelladj was apprehended in Thailand in January 2013 and extradited to the US in May 2013; Panin was apprehended while in an Atlanta airport in July 2013.

SpyEye was developed to be the next Zeus. According to the DOJ, Panin allegedly received the source code and rights to sell Zeus from its creator, Evginy Bogachev, a.k.a "Slavik," and incorporated many Zeus components into SpyEye. 

In 2014, Loucif Kharouni, senior threat researcher with Trend Micro at the time, told Dark Reading that Panin was apprehended in the first place because he "got sloppy." He shared information on underground forums that Trend Micro researchers collaborating with law enforcement used to track him down. Kharouni said this was something that Zeus-creator Bogachev would never do. Bogachev remains at-large and is the FBI's most-wanted cybercriminal.

The arrest of Panin apparently interrupted the development of more advanced malware. From the DOJ release:

The FBI discovered that within months of his arrest, Panin was planning to release a new strain of SpyEye, called 'SpyEye 2.0', which, if released, would have been one of the most prolific and undetectable botnets distributed to date, and cause immeasurable losses to the international banking industry and individuals around the world.

In a blog today, Don Jackson, senior threat researcher at Damballa, which aided in the investigation, described the statement Panin gave at his sentencing hearing as "one of unqualified remorse, making no excuses, accepting full responsibility, and professing trust in the fairness of whatever sentence the judge pronounced. Although one knew it had to have been, it seemed more rehearsed than coached, and it seemed absolutely genuine."

Bendelladj, on the other hand, according to Jackson's report, "was described as extremely uncooperative," and "His apology and any assurances that he would never engage in such behavior again seemed perfunctory and hollow."

During the uncommonly long five-day sentencing hearing, Jackson reports, some of the points of contention -- all of which would, of course, affect the precise length of prison sentences -- showed how cybercrime uniquely twists traditional law. It raised questions like:

  • How many malware infections could be legally attributed to Bedelladj and how many should be attributed to other SpyEye customers?
  • What impact does the effectiveness and availability of anti-virus software have on the harm caused by these malware infections, and what impact does that have on sentencing? 
  • What exactly constitutes a payment card "access device" -- how much data is enough to grant access and does it count if is out-of-date? How many access devices were the defendants in possession of?

For more information, see the DOJ release

Related stories: 

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
4/22/2016 | 9:28:54 AM
Accomplices
Accomplice culpability -- plain and simple.  It's no different than driving the getaway car or custom-designing the explosives for the bank's safe.  They knew what they were doing, and the law provides for that.
How to Attract More Women Into Cybersecurity - Now
Dawn Kawamoto, Associate Editor, Dark Reading,  1/12/2018
Researchers Offer a 'VirusTotal for ICS'
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/16/2018
Which CISO 'Tribe' Do You Belong To?
Kelly Sheridan, Associate Editor, Dark Reading,  1/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.