Vulnerabilities / Threats
10/30/2012
05:14 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

Shopping The Russian Cybercrime Underground

Inside look at the wide range of hacking and related services being offered in the Russian-speaking cybercrime marketplace illustrates its maturity and popularity

If you weren't already convinced that the Russian cybercrime underground is now a vast, sophisticated, high-volume market, consider this: there are at least 20 different types of services offered in Russian-speaking forums for just about anyone who wants to make a buck off of cybercrime, everything from crime-friendly VPN and security software-checking services to plain old off-the-shelf exploits, according to a new report.

Many of the services found and detailed in the report by Trend Micro today are well-known, but it's the breadth and relatively inexpensive pricing for the financial fraud services the firm studied that are most striking, security experts say.

"This shows the fully fledged commercial nature of it. It's very much crime-as-a-service," says Rik Ferguson, Trend Micro's director of security research in Europe. "It's a very mature market."

Programming services – basically malware-writing -- and software sales are the most popular cybercrime services and activities, according to the report, which provides a glimpse into the underground activity in Russian-speaking forums and cybercriminal circles. The sale of off-the-shelf malware programs like Trojans, spammers, DDoS bots, Zeus, and SpyEye are also among the hottest markets.

Some programming services are more expensive than others, according to Russian ads translated by Trend: a programmer writing a banking Trojan can charge $1,300, while fake programs only cost about $15- to $20.

The basic spamming or botnet businesses are inexpensive first steps into the biz, but the more sophisticated – and lucrative – services are zero-day development and other heavy coding services. "If I want to find out how to break into cybercrime – excuse the terrible pun – I can rent a botnet [for example], now buy myself a BlackHole exploit kit, and infect [victims] with my own custom Trojan from this other vendor ... it's like a jigsaw puzzle," Trend Micro's Ferguson says. Gone are the days of the Russian Business Network dominating the cybercrime scene, he says. "Now there are some individuals and smaller groups, and some bigger players out there, too."

One particularly interesting trend is that bulletproof server hosting pricing is dropping in the underground, he says. You can purchase a dedicated server service for anywhere from 50 cents to $1 per month, for example, and a bulletproof hosting service for $15- to $250 per month.

"The cost of hosting is being driven down. What's surprising is that it's so cheap, but if you look at what's happening in legitimate business, you shouldn't be that surprised: the hosting business has low margins," Ferguson says.

Jeffrey Carr, CEO of Taia Global, says it's a volume business. "And that report just reflects the basic stuff: imagine how much more there is to it," he says.

"It's also important to note that [Russian Federation] hackers are allowed to operate unless they attack Russian Federation sites – government, banking, etc. Then they're arrested," Carr says.

[Insight into key characteristics, behaviors of cybercrime versus cyberespionage attackers can help -- but the threats aren't just from China and Eastern Europe. See Profiling The Cybercriminal And The Cyberspy.]

According to Trend, the remainder of the top 10 most popular services after programming services and software sales (in order) are: hacking services; dedicated server sales and bulletproof-hosting services; spam and flooding services; download sales; DDoS services; traffic sales; file encryption services; Trojan sales; and exploit-writing services and sales.

DDoS and botnet services are relatively cheap: one day of DDoS'ing a victim or victims costs between $30- and $70, or just $10 for one hour. A one-month subscription goes for about $1,200.

Botnet leasing is actually rare in the underground market because it's not as lucrative as other services. "Hackers normally operate their own botnets because selling them is less profitable," the report says.

But bots go for about $200 for 2,000 infected machines. A DDoS botnet can cost $700 and $100 per DDoS botnet update, according to Trend.

The top Russian cybercriminal forums for buying and selling include: antichat.ru; xeka.ru; carding-cc.com; Exploit.IN; InAttack; XaKePoK.su; HACKER-PRO CLUB (HPC); XAkNet.ru; zloy; and HackForce.RU.

Al Huger, vice president of development for the cloud technology group at Sourcefire and a co-founder of Immunet, says the bottom line is that cybercrime is big business now. "It's a volume business. There's so much of it," Huger says. "[And] there are more of them than there are of us."

The "Russian Underground 101" report is available here for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-3154
Published: 2014-04-17
DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 does not properly create temporary files, which allows local users to obtain the XAUTHORITY file conte...

CVE-2013-2143
Published: 2014-04-17
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.

CVE-2014-0036
Published: 2014-04-17
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.

CVE-2014-0054
Published: 2014-04-17
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External ...

CVE-2014-0071
Published: 2014-04-17
PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.

Best of the Web