Vulnerabilities / Threats
10/30/2012
05:14 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Shopping The Russian Cybercrime Underground

Inside look at the wide range of hacking and related services being offered in the Russian-speaking cybercrime marketplace illustrates its maturity and popularity

If you weren't already convinced that the Russian cybercrime underground is now a vast, sophisticated, high-volume market, consider this: there are at least 20 different types of services offered in Russian-speaking forums for just about anyone who wants to make a buck off of cybercrime, everything from crime-friendly VPN and security software-checking services to plain old off-the-shelf exploits, according to a new report.

Many of the services found and detailed in the report by Trend Micro today are well-known, but it's the breadth and relatively inexpensive pricing for the financial fraud services the firm studied that are most striking, security experts say.

"This shows the fully fledged commercial nature of it. It's very much crime-as-a-service," says Rik Ferguson, Trend Micro's director of security research in Europe. "It's a very mature market."

Programming services – basically malware-writing -- and software sales are the most popular cybercrime services and activities, according to the report, which provides a glimpse into the underground activity in Russian-speaking forums and cybercriminal circles. The sale of off-the-shelf malware programs like Trojans, spammers, DDoS bots, Zeus, and SpyEye are also among the hottest markets.

Some programming services are more expensive than others, according to Russian ads translated by Trend: a programmer writing a banking Trojan can charge $1,300, while fake programs only cost about $15- to $20.

The basic spamming or botnet businesses are inexpensive first steps into the biz, but the more sophisticated – and lucrative – services are zero-day development and other heavy coding services. "If I want to find out how to break into cybercrime – excuse the terrible pun – I can rent a botnet [for example], now buy myself a BlackHole exploit kit, and infect [victims] with my own custom Trojan from this other vendor ... it's like a jigsaw puzzle," Trend Micro's Ferguson says. Gone are the days of the Russian Business Network dominating the cybercrime scene, he says. "Now there are some individuals and smaller groups, and some bigger players out there, too."

One particularly interesting trend is that bulletproof server hosting pricing is dropping in the underground, he says. You can purchase a dedicated server service for anywhere from 50 cents to $1 per month, for example, and a bulletproof hosting service for $15- to $250 per month.

"The cost of hosting is being driven down. What's surprising is that it's so cheap, but if you look at what's happening in legitimate business, you shouldn't be that surprised: the hosting business has low margins," Ferguson says.

Jeffrey Carr, CEO of Taia Global, says it's a volume business. "And that report just reflects the basic stuff: imagine how much more there is to it," he says.

"It's also important to note that [Russian Federation] hackers are allowed to operate unless they attack Russian Federation sites – government, banking, etc. Then they're arrested," Carr says.

[Insight into key characteristics, behaviors of cybercrime versus cyberespionage attackers can help -- but the threats aren't just from China and Eastern Europe. See Profiling The Cybercriminal And The Cyberspy.]

According to Trend, the remainder of the top 10 most popular services after programming services and software sales (in order) are: hacking services; dedicated server sales and bulletproof-hosting services; spam and flooding services; download sales; DDoS services; traffic sales; file encryption services; Trojan sales; and exploit-writing services and sales.

DDoS and botnet services are relatively cheap: one day of DDoS'ing a victim or victims costs between $30- and $70, or just $10 for one hour. A one-month subscription goes for about $1,200.

Botnet leasing is actually rare in the underground market because it's not as lucrative as other services. "Hackers normally operate their own botnets because selling them is less profitable," the report says.

But bots go for about $200 for 2,000 infected machines. A DDoS botnet can cost $700 and $100 per DDoS botnet update, according to Trend.

The top Russian cybercriminal forums for buying and selling include: antichat.ru; xeka.ru; carding-cc.com; Exploit.IN; InAttack; XaKePoK.su; HACKER-PRO CLUB (HPC); XAkNet.ru; zloy; and HackForce.RU.

Al Huger, vice president of development for the cloud technology group at Sourcefire and a co-founder of Immunet, says the bottom line is that cybercrime is big business now. "It's a volume business. There's so much of it," Huger says. "[And] there are more of them than there are of us."

The "Russian Underground 101" report is available here for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.