Senetas on Deciphering Information Security Blog

By Julian Fay

LONDON  - Dissecting the underground economy has almost become a sport at the RSA Conference with numerous speakers attempting to explain the complex cybercrime ecosystem described as being “larger than Microsoft”.

At a special press briefing (“no cameras, no video”), Uri Rivner, head of new technologies for the vendor, RSA, described it as the dark cloud where criminals use your resources to promote their business, where crime forums abound with sale items: “40,000 CVVs (credit card records), 20 UK banks in stock, 150 Gb UK logs”, and where banner advertisements offer fast cars, premium hotels and women as incentives to deal with a particular malware vendor.

Rivner said his organisation shut down 10,000 fishing attacks every month and at any one time there were 120 live attacks on government portals, banks and online games.

Also speaking today with a ban on “any form of recording” were Andy Auld of UK’s Serious Organised Crime Agency and FBI cybercrime unit supervisory special agent, Keith Mularski.  CDN assumes their names can be mentioned and their presentation summarised since media were present.

The agents said that in May this year they had evidence of 4700 legitimate websites, including www.paulmccartney.com , that were infected by drive-by downloads, but now more than 6500 are infected.  Forums, or hacking boards, discovered by FBI and SOCA had up to 8000 members with a peer-review system to verify that vendors of stolen data were legitimate.

The agents detailed the inner workings of the famed Russian Business Network, which provided pay per view child porn to a third of the globe from St Petersburg, saying:“…we strongly believe this group had local police, judiciary and the St Petersburg government in their pockets…when we tried to investigate we met very significant hurdles.”  Surveillance showed Network bosses drove around in “an armour-plated Audi A8, escorted by a shiny Range Rover”.

Mularski said the Russians even had a business continuity plan ready when things “got too hot” and they morphed into the Taiwan Industrial Network, however authorities shut them down before they could get their new network operational.  Before the takedown in November 2007 Mularski said a list of 10 nick-named affiliates each earned from $US58,000 to $US158,000 every month, “and this was their 10% fee, so the bosses were making millions”.

They explained how cybercrims would never accept credit cards, instead setting up digital currency through WebMoney, Liberty Reserve and Pecunix to enable anonymity, instant irrevocable payments and cheaper-than-bank fees for money laundering between fraudsters in UK and USA and malware vendors in Russia and Vietnam.  

Conference delegates were shown a professional job website designed only to recruit mules - often innocent money transfer agents. It attracted 1925 applicants, but only 33 were recruited and the rest of the detailed applicant data was sold off to spammers. 

Also detailed: a rogue anti-virus software company in Kiev had 400 employees selling infected fake AV software for $49.99 – one million Americans bought it, but 990,000 then complained to a call centre in USA before it was shut by the FBI.

RSA’s Rivner said the cybercriminals had their own dynamic currency market with stolen data values fluctuating on forums: the most popular Trojan, Zeus, now fetches $US1000 while stolen US data sells for only half the value of UK business information. 

They warned: only check the mccartney website if you have up-to-date AV software, but a legitimate website to see if you’re being scammed is FBI’s www.lookstoogoodtobetrue.com