Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

9/14/2016
03:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

France's Online Criminal Underground Built On Foundation Of Distrust

French criminals seeking black market goods and services -- cyber and otherwise -- have to look in darker shadows and work harder to prove their felonious credibility.

Criminals in North America needn't always go as far as the Deep or Dark Web looking for weapons, drugs, stolen identities, or malware kits; those can often be found on the open web. And while these marketplaces certainly aim for criminal buyers, they're often penetrated by amateurs and even law enforcement. According to a new report by Trend Micro, things are very different in France.

The French underground is a comparatively small operation -- only about 40,000 individuals strong, according to estimates by the Gendarmerie Nationale and Police Nationale. The small size, however, may be a deliberate function of the fact that it's so hard to crack into, and even those inside the community often work mostly alone.

"French cybercriminals are very cautious," Trend Micro threat researcher and author of the report Cedric Pernet says, "because they are frightened by both law enforcement agencies which might be working on trying to catch them and the other cybercriminals who might scam them." 

The French underground exists only on the Dark Web, say researchers, and access is vigorously restricted through a system of vetting, reputation-based controls, membership programs, and "halls of shame" where anyone exercising dishonor amongst thieves will be blasted. 

Shaming is also for competitors, and sometimes the dog-eats-dog world gets so nasty that marketplace operators commit cyberattacks against each other, with little regard for their own customers. Researchers cite one example: the administrator of marketplace A -- knowing that some of its customers also patronized marketplace B -- took its own members' credentials and used them to hack into marketplace B -- and steal Bitcoins. (This ultimately backfired.)

Full access to forum services is often allowed only after obtaining a high enough reputation score - proving one's criminal mettle with each "incriminating post or successful fradulent transaction," as the report explains.

Even then, trust is wary and security is paramount. Members of the French underground generally use encrypted communications and accept payments only through Bitcoins or Prepaid Card Services that require no identity information. Payments are also generally done through escrow services that take a 5% to 7% cut (one marketplace had a semiautomatic escrow system with two-factor authentication and took only 4%) and some will restrict further purchases until payment has cleared for initial purchases.

"I feel the situation was different some years ago, before Bitcoin appeared," Pernet says. Bitcoin makes it easier for marketplaces to handle money, says Pernet, "Therefore, it is also easier to be scammed by marketplace administrators who might run away with all the money. Add some wars between different marketplaces and you have quite a pretty good feeling on why they are paranoid. The hack of the whole database of one of the biggest marketplace last year also made them think how vulnerable they are, and enforced the use of encrypted communications even in private messages on marketplaces."

Many sellers also cut out the marketplace operator and instead run "autoshops" -- sites maintained by individual providers who deal directly with buyers. Autoshops are so common that there are even autoshop creation services that provide CMSes and domain registration.

Even the products themselves slant towards the stealthy. In addition to stolen credentials and locally produced ransomware are a niche market for small, easily hidden or disguised weapons -- including pen guns, brass knuckles, and flexible knives shaped like credit cards. Also popular are fake bills for use in sale fraud, fake car registrations for use in the sale of stolen automobiles and bank account opening services.

Working in the French underground isn't an entirely friendless endeavor, though. "When it comes to make a lot of money illegally, few people have all the required skillset to do it all by themselves," says Pernet. So at least in some cases, "Therefore, they need to partner/team up."

Related Content:

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Healthcare Industry Sees Respite From Attacks in First Half of 2020
Robert Lemos, Contributing Writer,  8/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: It's a technique known as breaking out of the sandbox kids.
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20383
PUBLISHED: 2020-08-13
ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations involving files and using symbolic links.
CVE-2020-24348
PUBLISHED: 2020-08-13
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.
CVE-2020-24349
PUBLISHED: 2020-08-13
njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.
CVE-2020-7360
PUBLISHED: 2020-08-13
An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was r...
CVE-2020-24342
PUBLISHED: 2020-08-13
Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row.