Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

9/14/2016
03:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

France's Online Criminal Underground Built On Foundation Of Distrust

French criminals seeking black market goods and services -- cyber and otherwise -- have to look in darker shadows and work harder to prove their felonious credibility.

Criminals in North America needn't always go as far as the Deep or Dark Web looking for weapons, drugs, stolen identities, or malware kits; those can often be found on the open web. And while these marketplaces certainly aim for criminal buyers, they're often penetrated by amateurs and even law enforcement. According to a new report by Trend Micro, things are very different in France.

The French underground is a comparatively small operation -- only about 40,000 individuals strong, according to estimates by the Gendarmerie Nationale and Police Nationale. The small size, however, may be a deliberate function of the fact that it's so hard to crack into, and even those inside the community often work mostly alone.

"French cybercriminals are very cautious," Trend Micro threat researcher and author of the report Cedric Pernet says, "because they are frightened by both law enforcement agencies which might be working on trying to catch them and the other cybercriminals who might scam them." 

The French underground exists only on the Dark Web, say researchers, and access is vigorously restricted through a system of vetting, reputation-based controls, membership programs, and "halls of shame" where anyone exercising dishonor amongst thieves will be blasted. 

Shaming is also for competitors, and sometimes the dog-eats-dog world gets so nasty that marketplace operators commit cyberattacks against each other, with little regard for their own customers. Researchers cite one example: the administrator of marketplace A -- knowing that some of its customers also patronized marketplace B -- took its own members' credentials and used them to hack into marketplace B -- and steal Bitcoins. (This ultimately backfired.)

Full access to forum services is often allowed only after obtaining a high enough reputation score - proving one's criminal mettle with each "incriminating post or successful fradulent transaction," as the report explains.

Even then, trust is wary and security is paramount. Members of the French underground generally use encrypted communications and accept payments only through Bitcoins or Prepaid Card Services that require no identity information. Payments are also generally done through escrow services that take a 5% to 7% cut (one marketplace had a semiautomatic escrow system with two-factor authentication and took only 4%) and some will restrict further purchases until payment has cleared for initial purchases.

"I feel the situation was different some years ago, before Bitcoin appeared," Pernet says. Bitcoin makes it easier for marketplaces to handle money, says Pernet, "Therefore, it is also easier to be scammed by marketplace administrators who might run away with all the money. Add some wars between different marketplaces and you have quite a pretty good feeling on why they are paranoid. The hack of the whole database of one of the biggest marketplace last year also made them think how vulnerable they are, and enforced the use of encrypted communications even in private messages on marketplaces."

Many sellers also cut out the marketplace operator and instead run "autoshops" -- sites maintained by individual providers who deal directly with buyers. Autoshops are so common that there are even autoshop creation services that provide CMSes and domain registration.

Even the products themselves slant towards the stealthy. In addition to stolen credentials and locally produced ransomware are a niche market for small, easily hidden or disguised weapons -- including pen guns, brass knuckles, and flexible knives shaped like credit cards. Also popular are fake bills for use in sale fraud, fake car registrations for use in the sale of stolen automobiles and bank account opening services.

Working in the French underground isn't an entirely friendless endeavor, though. "When it comes to make a lot of money illegally, few people have all the required skillset to do it all by themselves," says Pernet. So at least in some cases, "Therefore, they need to partner/team up."

Related Content:

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16860
PUBLISHED: 2019-11-19
Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local machine could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime, and potentially execute arbitrary code at an ele...
CVE-2019-16861
PUBLISHED: 2019-11-19
Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local server could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime, and potentially execute arbitrary code at an elevated ...
CVE-2014-5118
PUBLISHED: 2019-11-18
A Security Bypass Vulnerability exists in TBOOT before 1.8.2 in the boot loader module when measuring commandline parameters.
CVE-2019-12422
PUBLISHED: 2019-11-18
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
CVE-2012-4441
PUBLISHED: 2019-11-18
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.