Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/30/2012
05:14 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Shopping The Russian Cybercrime Underground

Inside look at the wide range of hacking and related services being offered in the Russian-speaking cybercrime marketplace illustrates its maturity and popularity

If you weren't already convinced that the Russian cybercrime underground is now a vast, sophisticated, high-volume market, consider this: there are at least 20 different types of services offered in Russian-speaking forums for just about anyone who wants to make a buck off of cybercrime, everything from crime-friendly VPN and security software-checking services to plain old off-the-shelf exploits, according to a new report.

Many of the services found and detailed in the report by Trend Micro today are well-known, but it's the breadth and relatively inexpensive pricing for the financial fraud services the firm studied that are most striking, security experts say.

"This shows the fully fledged commercial nature of it. It's very much crime-as-a-service," says Rik Ferguson, Trend Micro's director of security research in Europe. "It's a very mature market."

Programming services – basically malware-writing -- and software sales are the most popular cybercrime services and activities, according to the report, which provides a glimpse into the underground activity in Russian-speaking forums and cybercriminal circles. The sale of off-the-shelf malware programs like Trojans, spammers, DDoS bots, Zeus, and SpyEye are also among the hottest markets.

Some programming services are more expensive than others, according to Russian ads translated by Trend: a programmer writing a banking Trojan can charge $1,300, while fake programs only cost about $15- to $20.

The basic spamming or botnet businesses are inexpensive first steps into the biz, but the more sophisticated – and lucrative – services are zero-day development and other heavy coding services. "If I want to find out how to break into cybercrime – excuse the terrible pun – I can rent a botnet [for example], now buy myself a BlackHole exploit kit, and infect [victims] with my own custom Trojan from this other vendor ... it's like a jigsaw puzzle," Trend Micro's Ferguson says. Gone are the days of the Russian Business Network dominating the cybercrime scene, he says. "Now there are some individuals and smaller groups, and some bigger players out there, too."

One particularly interesting trend is that bulletproof server hosting pricing is dropping in the underground, he says. You can purchase a dedicated server service for anywhere from 50 cents to $1 per month, for example, and a bulletproof hosting service for $15- to $250 per month.

"The cost of hosting is being driven down. What's surprising is that it's so cheap, but if you look at what's happening in legitimate business, you shouldn't be that surprised: the hosting business has low margins," Ferguson says.

Jeffrey Carr, CEO of Taia Global, says it's a volume business. "And that report just reflects the basic stuff: imagine how much more there is to it," he says.

"It's also important to note that [Russian Federation] hackers are allowed to operate unless they attack Russian Federation sites – government, banking, etc. Then they're arrested," Carr says.

[Insight into key characteristics, behaviors of cybercrime versus cyberespionage attackers can help -- but the threats aren't just from China and Eastern Europe. See Profiling The Cybercriminal And The Cyberspy.]

According to Trend, the remainder of the top 10 most popular services after programming services and software sales (in order) are: hacking services; dedicated server sales and bulletproof-hosting services; spam and flooding services; download sales; DDoS services; traffic sales; file encryption services; Trojan sales; and exploit-writing services and sales.

DDoS and botnet services are relatively cheap: one day of DDoS'ing a victim or victims costs between $30- and $70, or just $10 for one hour. A one-month subscription goes for about $1,200.

Botnet leasing is actually rare in the underground market because it's not as lucrative as other services. "Hackers normally operate their own botnets because selling them is less profitable," the report says.

But bots go for about $200 for 2,000 infected machines. A DDoS botnet can cost $700 and $100 per DDoS botnet update, according to Trend.

The top Russian cybercriminal forums for buying and selling include: antichat.ru; xeka.ru; carding-cc.com; Exploit.IN; InAttack; XaKePoK.su; HACKER-PRO CLUB (HPC); XAkNet.ru; zloy; and HackForce.RU.

Al Huger, vice president of development for the cloud technology group at Sourcefire and a co-founder of Immunet, says the bottom line is that cybercrime is big business now. "It's a volume business. There's so much of it," Huger says. "[And] there are more of them than there are of us."

The "Russian Underground 101" report is available here for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/30/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5425
PUBLISHED: 2020-10-31
Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity provider...
CVE-2020-15703
PUBLISHED: 2020-10-31
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivile...
CVE-2020-5991
PUBLISHED: 2020-10-30
NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.
CVE-2020-15273
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can ac...
CVE-2020-15276
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.