Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

9/14/2016
03:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

France's Online Criminal Underground Built On Foundation Of Distrust

French criminals seeking black market goods and services -- cyber and otherwise -- have to look in darker shadows and work harder to prove their felonious credibility.

Criminals in North America needn't always go as far as the Deep or Dark Web looking for weapons, drugs, stolen identities, or malware kits; those can often be found on the open web. And while these marketplaces certainly aim for criminal buyers, they're often penetrated by amateurs and even law enforcement. According to a new report by Trend Micro, things are very different in France.

The French underground is a comparatively small operation -- only about 40,000 individuals strong, according to estimates by the Gendarmerie Nationale and Police Nationale. The small size, however, may be a deliberate function of the fact that it's so hard to crack into, and even those inside the community often work mostly alone.

"French cybercriminals are very cautious," Trend Micro threat researcher and author of the report Cedric Pernet says, "because they are frightened by both law enforcement agencies which might be working on trying to catch them and the other cybercriminals who might scam them." 

The French underground exists only on the Dark Web, say researchers, and access is vigorously restricted through a system of vetting, reputation-based controls, membership programs, and "halls of shame" where anyone exercising dishonor amongst thieves will be blasted. 

Shaming is also for competitors, and sometimes the dog-eats-dog world gets so nasty that marketplace operators commit cyberattacks against each other, with little regard for their own customers. Researchers cite one example: the administrator of marketplace A -- knowing that some of its customers also patronized marketplace B -- took its own members' credentials and used them to hack into marketplace B -- and steal Bitcoins. (This ultimately backfired.)

Full access to forum services is often allowed only after obtaining a high enough reputation score - proving one's criminal mettle with each "incriminating post or successful fradulent transaction," as the report explains.

Even then, trust is wary and security is paramount. Members of the French underground generally use encrypted communications and accept payments only through Bitcoins or Prepaid Card Services that require no identity information. Payments are also generally done through escrow services that take a 5% to 7% cut (one marketplace had a semiautomatic escrow system with two-factor authentication and took only 4%) and some will restrict further purchases until payment has cleared for initial purchases.

"I feel the situation was different some years ago, before Bitcoin appeared," Pernet says. Bitcoin makes it easier for marketplaces to handle money, says Pernet, "Therefore, it is also easier to be scammed by marketplace administrators who might run away with all the money. Add some wars between different marketplaces and you have quite a pretty good feeling on why they are paranoid. The hack of the whole database of one of the biggest marketplace last year also made them think how vulnerable they are, and enforced the use of encrypted communications even in private messages on marketplaces."

Many sellers also cut out the marketplace operator and instead run "autoshops" -- sites maintained by individual providers who deal directly with buyers. Autoshops are so common that there are even autoshop creation services that provide CMSes and domain registration.

Even the products themselves slant towards the stealthy. In addition to stolen credentials and locally produced ransomware are a niche market for small, easily hidden or disguised weapons -- including pen guns, brass knuckles, and flexible knives shaped like credit cards. Also popular are fake bills for use in sale fraud, fake car registrations for use in the sale of stolen automobiles and bank account opening services.

Working in the French underground isn't an entirely friendless endeavor, though. "When it comes to make a lot of money illegally, few people have all the required skillset to do it all by themselves," says Pernet. So at least in some cases, "Therefore, they need to partner/team up."

Related Content:

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9016
PUBLISHED: 2020-02-16
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.
CVE-2020-9013
PUBLISHED: 2020-02-16
Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code.
CVE-2020-9007
PUBLISHED: 2020-02-16
Codoforum 4.8.8 allows self-XSS via the title of a new topic.
CVE-2020-9012
PUBLISHED: 2020-02-16
A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
CVE-2019-20456
PUBLISHED: 2020-02-16
Goverlan Reach Console before 9.50, Goverlan Reach Server before 3.50, and Goverlan Client Agent before 9.20.50 have an Untrusted Search Path that leads to Command Injection and Local Privilege Escalation via DLL hijacking.