Cybercrime Economy
Total Page：16
File Type：pdf, Size：1020Kb
Cybercrime Economy AN ANALYSIS OF CRIMINAL COMMUNICATIONS STRATEGIES BY LEROY TERRELONGE III CONTRIBUTIONS BY MAX ALIAPOULIOS Kingpin Operations The cybercRiminal Finance Cybercrime ecosystem Economy Product Manager Botnet master Manager, Mule Ops Payment Systems SME An Analysis of Criminal Communications Strategies Sr Developer Design/UI AV CI/Crypting QA Bulletproof Hoster Analytics Traffic Herder n the continuous game of cat and mouse Second, cybercriminal communities allow for between cybercriminals and the information the division of labor and, consequently, econo- security community, the criminals have long mies of scale for the cybercriminal ecosystem. Iunderstood that they can act much more Many cybercrime schemes depend on the Sr Loader Dev Sr Bot Dev Exploit R&D Redirect Ops Ad Broker SME Spammer eectively together than they can individually. actions of a cast of characters working in Image 1 - The cybercriminal ecosystem In addition, cybercriminals’ unrelenting drive to concert, including malware developers, cryptor conceal their activities presents countless writers, spammers, botnet masters, payment challenges for organizations seeking to protect card specialists, and cashers, among others. If Image 1: Depiction of the cybercrime ecosys- goods and services through online forums. Like themselves from cyber threats. Often operating cybercriminals were required to carry out their tem: The division of labor allows actors to any other community, cybercrime communities within the exclusive confines of the Deep & schemes on an individual basis, it would take specialize in domains for which they have a have rules (both explicit and implicit), enforcers Dark Web, cybercriminals are known to utilize them many years to develop the necessary comparative advantage or special talent, advanc- (moderators), an organizer (administrator), various tools to engage with one another and cross-domain expertise. The substantial ing the level of expertise in their particular area unique jargon, and varying barriers to entry. But, advance their tactics all while evading detec- resource expenditure required to obtain the of specialization beyond what could be accom- once they gain acceptance into the “club,” tion. In order to provide greater visibility into equipment needed to support a crime plished if each individual actor were responsible members have access to the institutional knowl- the interconnected nature of the cybercrime campaign would also serve as a barrier. In a for all elements of the cybercrime chain. In edge and resources aorded by the forum and economy, this paper examines the most cybercrime community, however, members addition, the barrier of entry is lower for new its members. common communication strategies and tools specialize according to their interests and participants because they can merely purchase used by cybercriminals across seven dierent talents; this allows them to reach higher levels the goods and services they need, as opposed Image 2 on following page: Screenshot of communities. of proficiency in just one link of the cybercrime to spending significant time and money building Darkode (now defunct), one of the most chain. They can then share this knowledge capacity themselves. well-known online forums and marketplaces for First, criminal communities provide a place for with other community members (for free or for malware, stolen data, credit card numbers, actors to collaborate by sharing tips and tricks pay), which raises the overall level of activity, The traditional meeting place for cyber actors, botnets, and malicious tools. The site was that help them defeat security measures and expertise, and eciency in the entire system. including cybercriminals, has been and contin- seized and many of its members were arrested evade detection. Indeed, criminal communities ues to be the online messaging board, or web in July 2015 as part of a coordinated internation- resemble research communities in that each forum. In many ways, these forums are the al law enforcement eort. member of the community can learn from the beating heart of the cybercrime economy. successes and failures of other members. Members meet, recruit additional support, buy Despite the central role of the forum for cyber- technical tools (e.g. malware), and sell their illicit criminal enterprises -- not to mention its crucial 2 3 function of bringing criminals together and maintain access to logs of their previous commu- allowing them to find each other -- once crimi- nications. These forums are notorious for nals meet, they may choose to move their suddenly disappearing or experiencing unex- communications outside of the forum for a pected downtimes, during which criminals’ number of reasons -- even though the forums forum correspondence becomes temporarily or have native private messaging platforms. One permanently inaccessible. The causes for this reason for this behavior is that criminals can instability can be nefarious, as in the case of never be quite sure exactly who has access to “exit scams” wherein forum administrators close the backend of the forum on which they are the board and abscond with all the funds held in operating. Even in the unlikely scenario that a member’s accounts or in the forum’s escrow criminal could trust that the forum administrator service. Forums can also disappear or be had their best interests at heart, administrator disrupted during law enforcement busts when accounts can be compromised. Such a compro- ocers seize forum servers. Forums may also mise would put any unencrypted personal go down for more benign reasons, such as communications into the hands of an unknown instances where there is no longer enough and untrusted party. interest in maintaining the forum or if the admin- istrators are no longer able to pay the hosting Another reason cybercriminals choose to fee. communicate outside of forums is so they can Image 1: Depiction of the cybercrime ecosys- goods and services through online forums. Like tem: The division of labor allows actors to any other community, cybercrime communities specialize in domains for which they have a have rules (both explicit and implicit), enforcers comparative advantage or special talent, advanc- (moderators), an organizer (administrator), ing the level of expertise in their particular area unique jargon, and varying barriers to entry. But, of specialization beyond what could be accom- once they gain acceptance into the “club,” plished if each individual actor were responsible members have access to the institutional knowl- for all elements of the cybercrime chain. In edge and resources aorded by the forum and addition, the barrier of entry is lower for new its members. participants because they can merely purchase the goods and services they need, as opposed Image 2 on following page: Screenshot of to spending significant time and money building Darkode (now defunct), one of the most capacity themselves. well-known online forums and marketplaces for malware, stolen data, credit card numbers, The traditional meeting place for cyber actors, botnets, and malicious tools. The site was including cybercriminals, has been and contin- seized and many of its members were arrested ues to be the online messaging board, or web in July 2015 as part of a coordinated internation- forum. In many ways, these forums are the al law enforcement eort. beating heart of the cybercrime economy. Members meet, recruit additional support, buy Despite the central role of the forum for cyber- technical tools (e.g. malware), and sell their illicit criminal enterprises -- not to mention its crucial Choice of Messaging Platform Cybercriminals can choose from a wide variety stored, the jurisdiction in which the services’ of platforms to conduct their peer-to-peer (P2P) servers are located (can they be accessed by communications. This choice is typically law enforcement agencies?), the privacy policy influenced by a combination of factors, which of the service, the information collected from can include: users to set up an account on the service, etc. Ease of use — All other factors held equal, cybercriminals, like any other user, prefer services that are simple, have a clean graphi- cal user interface (GUI), are intuitive to use, and are not “buggy”. They may also appreci- ate customizations and/or localizations that make it easier for them to use the tool. Such features may be especially appealing to speakers of less-common languages or those who use operating systems other than the commercially-popular Windows and OS X. Country and/or language — Communication Image 3 - Secure Messaging Scorecard from the EFF platforms are sometimes promoted heavily, or Image 2 - Darkode Homepage even exclusively, to speakers of a particular language. When these platforms are the Image 3: The Electronic Frontier Foundation dominant communication medium for a developed a Secure Messaging Scorecard in function of bringing criminals together and maintain access to logs of their previous commu- language group, cybercriminals are likely to which it ranked the security/encryption practices allowing them to find each other -- once crimi- nications. These forums are notorious for use them in their “civilian” lives to interact with of thirty-seven popular messaging applications nals meet, they may choose to move their suddenly disappearing or experiencing unex- friends and family. Indeed, this usage may along seven basic criteria: communications outside of the forum for a pected downtimes, during which criminals’ creep into their