Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/21/2016
04:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

SpyEye Creators Sentenced To Long Prison Terms

FBI found that arrest halted the release of nasty SpyEye 2.0.

Two severe sentences handed down this week for the brains behind the SpyEye banking Trojan show that cybercriminals cannot avoid stiff penalties simply by limiting their activities to the development and distribution of malicious code. Still, the sentences also show that profiting directly from the use of malware can add up to harsher terms.

According to the US Department of Justice, SpyEye strains were used to infect over 50 million computers, stealing personally identifiable information and banking data, automatically stealing funds, and causing close to $1 billion in "financial harm to individuals and financial institutions around the globe." 

Despite the fact that he himself was not charged with stealing anything, primary SpyEye developer Aleksandr Andreevich Panin, a.k.a. "Gribodemon" and "Harderman," of Russia, was sentenced to nine years -- six months of prison (plus three years probation).  

His associate, Hamza Bendelladj, a.k.a. "Bx1," of Algeria, did profit directly from SpyEye. Not only did he develop and sell malicious plug-ins for botnets -- for proliferating malware and automating the theft of funds from victim bank accounts -- Bendelladj also stole personally identifiable information from close to half a million people, the court charged, and ran an online marketplace, VCC.sc, for selling this stolen credit card data.

For his crimes, Bendelladj was sentence to 15 years prison, plus three years probation. 

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

These sentences come years after both men were arrested. Bendelladj was apprehended in Thailand in January 2013 and extradited to the US in May 2013; Panin was apprehended while in an Atlanta airport in July 2013.

SpyEye was developed to be the next Zeus. According to the DOJ, Panin allegedly received the source code and rights to sell Zeus from its creator, Evginy Bogachev, a.k.a "Slavik," and incorporated many Zeus components into SpyEye. 

In 2014, Loucif Kharouni, senior threat researcher with Trend Micro at the time, told Dark Reading that Panin was apprehended in the first place because he "got sloppy." He shared information on underground forums that Trend Micro researchers collaborating with law enforcement used to track him down. Kharouni said this was something that Zeus-creator Bogachev would never do. Bogachev remains at-large and is the FBI's most-wanted cybercriminal.

The arrest of Panin apparently interrupted the development of more advanced malware. From the DOJ release:

The FBI discovered that within months of his arrest, Panin was planning to release a new strain of SpyEye, called 'SpyEye 2.0', which, if released, would have been one of the most prolific and undetectable botnets distributed to date, and cause immeasurable losses to the international banking industry and individuals around the world.

In a blog today, Don Jackson, senior threat researcher at Damballa, which aided in the investigation, described the statement Panin gave at his sentencing hearing as "one of unqualified remorse, making no excuses, accepting full responsibility, and professing trust in the fairness of whatever sentence the judge pronounced. Although one knew it had to have been, it seemed more rehearsed than coached, and it seemed absolutely genuine."

Bendelladj, on the other hand, according to Jackson's report, "was described as extremely uncooperative," and "His apology and any assurances that he would never engage in such behavior again seemed perfunctory and hollow."

During the uncommonly long five-day sentencing hearing, Jackson reports, some of the points of contention -- all of which would, of course, affect the precise length of prison sentences -- showed how cybercrime uniquely twists traditional law. It raised questions like:

  • How many malware infections could be legally attributed to Bedelladj and how many should be attributed to other SpyEye customers?
  • What impact does the effectiveness and availability of anti-virus software have on the harm caused by these malware infections, and what impact does that have on sentencing? 
  • What exactly constitutes a payment card "access device" -- how much data is enough to grant access and does it count if is out-of-date? How many access devices were the defendants in possession of?

For more information, see the DOJ release

Related stories: 

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
4/22/2016 | 9:28:54 AM
Accomplices
Accomplice culpability -- plain and simple.  It's no different than driving the getaway car or custom-designing the explosives for the bank's safe.  They knew what they were doing, and the law provides for that.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/1/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Threat from the Internet--and What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15478
PUBLISHED: 2020-07-01
The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.
CVE-2020-6261
PUBLISHED: 2020-07-01
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The readability of the trace file is impaired.
CVE-2020-15471
PUBLISHED: 2020-07-01
In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c.
CVE-2020-15472
PUBLISHED: 2020-07-01
In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.
CVE-2020-15473
PUBLISHED: 2020-07-01
In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.