Risk
5/28/2010
11:30 AM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

Botnet Black Market Means Malice For Rent

For less than seventy bucks you can hire a botnet for a day, and for under ten you can grab one for an hour. Welcome to the world of commodity cybercrime.

For less than seventy bucks you can hire a botnet for a day, and for under ten you can grab one for an hour. Welcome to the world of commodity cybercrime.Findings from VeriSign's iDefense research group give a scary glimpse into just how commodified botnets and the attacks they can launch have become.

According to iDefense, botnets capable of launching denial of service attacks -- or running spam campaigns, rogue anti-virus scams or any of the other attacks and activities botnets are so effective at, can be hired for a few a dollars an hour.

$67, researchers found, will get you a botnet for 24 hours; $9 can get you one for an hour.

Want more time? A few thousand will get you a Zeus toolkit from which you can set up financial and transaction scams; variably priced add-ons let you do with the botnet and Zeus... pretty much whatever you want.

What all of this means, of course, is what we've known for awhile: the province of cybercrime is increasingly financial, not technical. That is, the techno-wizards putting the crooked code together aren't as much interested in using it themselves as they are in selling or renting their work (some of which, astonishingly, includes anti-piracy protection!).

The buy-in during the early days of hacking was technical knowledge and code-cutting (and cracking)sophistication. Now the buy-in is just that: money.

Which means that we'll be seeing more and more players, I believe, in the botnet arena and, likely, more and more target attacks as those players hire or buy the tools needed to take on a particular industry or business.

Don't Miss: SMBs Often Hit Hardest By Botnets

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4467
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during the rendering of FRAME elements, which allows remote attackers to spoof the UI via a crafted web site.

CVE-2014-4476
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4477
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4479
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4480
Published: 2015-01-30
Directory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.