Vulnerabilities / Threats
10/30/2012
05:14 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Shopping The Russian Cybercrime Underground

Inside look at the wide range of hacking and related services being offered in the Russian-speaking cybercrime marketplace illustrates its maturity and popularity

If you weren't already convinced that the Russian cybercrime underground is now a vast, sophisticated, high-volume market, consider this: there are at least 20 different types of services offered in Russian-speaking forums for just about anyone who wants to make a buck off of cybercrime, everything from crime-friendly VPN and security software-checking services to plain old off-the-shelf exploits, according to a new report.

Many of the services found and detailed in the report by Trend Micro today are well-known, but it's the breadth and relatively inexpensive pricing for the financial fraud services the firm studied that are most striking, security experts say.

"This shows the fully fledged commercial nature of it. It's very much crime-as-a-service," says Rik Ferguson, Trend Micro's director of security research in Europe. "It's a very mature market."

Programming services – basically malware-writing -- and software sales are the most popular cybercrime services and activities, according to the report, which provides a glimpse into the underground activity in Russian-speaking forums and cybercriminal circles. The sale of off-the-shelf malware programs like Trojans, spammers, DDoS bots, Zeus, and SpyEye are also among the hottest markets.

Some programming services are more expensive than others, according to Russian ads translated by Trend: a programmer writing a banking Trojan can charge $1,300, while fake programs only cost about $15- to $20.

The basic spamming or botnet businesses are inexpensive first steps into the biz, but the more sophisticated – and lucrative – services are zero-day development and other heavy coding services. "If I want to find out how to break into cybercrime – excuse the terrible pun – I can rent a botnet [for example], now buy myself a BlackHole exploit kit, and infect [victims] with my own custom Trojan from this other vendor ... it's like a jigsaw puzzle," Trend Micro's Ferguson says. Gone are the days of the Russian Business Network dominating the cybercrime scene, he says. "Now there are some individuals and smaller groups, and some bigger players out there, too."

One particularly interesting trend is that bulletproof server hosting pricing is dropping in the underground, he says. You can purchase a dedicated server service for anywhere from 50 cents to $1 per month, for example, and a bulletproof hosting service for $15- to $250 per month.

"The cost of hosting is being driven down. What's surprising is that it's so cheap, but if you look at what's happening in legitimate business, you shouldn't be that surprised: the hosting business has low margins," Ferguson says.

Jeffrey Carr, CEO of Taia Global, says it's a volume business. "And that report just reflects the basic stuff: imagine how much more there is to it," he says.

"It's also important to note that [Russian Federation] hackers are allowed to operate unless they attack Russian Federation sites – government, banking, etc. Then they're arrested," Carr says.

[Insight into key characteristics, behaviors of cybercrime versus cyberespionage attackers can help -- but the threats aren't just from China and Eastern Europe. See Profiling The Cybercriminal And The Cyberspy.]

According to Trend, the remainder of the top 10 most popular services after programming services and software sales (in order) are: hacking services; dedicated server sales and bulletproof-hosting services; spam and flooding services; download sales; DDoS services; traffic sales; file encryption services; Trojan sales; and exploit-writing services and sales.

DDoS and botnet services are relatively cheap: one day of DDoS'ing a victim or victims costs between $30- and $70, or just $10 for one hour. A one-month subscription goes for about $1,200.

Botnet leasing is actually rare in the underground market because it's not as lucrative as other services. "Hackers normally operate their own botnets because selling them is less profitable," the report says.

But bots go for about $200 for 2,000 infected machines. A DDoS botnet can cost $700 and $100 per DDoS botnet update, according to Trend.

The top Russian cybercriminal forums for buying and selling include: antichat.ru; xeka.ru; carding-cc.com; Exploit.IN; InAttack; XaKePoK.su; HACKER-PRO CLUB (HPC); XAkNet.ru; zloy; and HackForce.RU.

Al Huger, vice president of development for the cloud technology group at Sourcefire and a co-founder of Immunet, says the bottom line is that cybercrime is big business now. "It's a volume business. There's so much of it," Huger says. "[And] there are more of them than there are of us."

The "Russian Underground 101" report is available here for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3409
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

CVE-2014-4620
Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

CVE-2014-4623
Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

CVE-2014-4624
Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

CVE-2014-6151
Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.