Cracking open the cybercrime economy

Hacking for fun has evolved into hacking for profit, and created a business model nearly as sophisticated as that of legal software.

A correction was made to this story. Read below for details.
"Over the years, the criminal elements, the ones who are making money, making millions out of all this online crime, are just getting stronger and stronger. I don't think we are really winning this war."

As director of antivirus research for F-Secure, you might expect Mikko Hypponen to overplay the seriousness of the situation. But according to the Finnish company, during 2007 the number of samples of malicious code on its database doubled, having taken 20 years to reach the size it was at the beginning of this year.

There seems to be some serious evidence then for the idea of an evolution from hacking and virus writing for fun to creating malicious code for profit. Security experts are increasingly pointing to the existence of a "black" or "shadow" cybereconomy, where malware services are sold online using the same kinds of development methods and guarantees given by legitimate software vendors.

It is difficult to establish exactly how organized this malware economy is but, according to David Marcus, security research manager at McAfee Avert Labs, it's relatively straightforward to buy not only the modules to build malware, but also the support services that go with it.

"If it weren't for Storm, bots would be in significant recession. Some days we're seeing 1,000 different variants a day."
--David Marcus, security research manager, McAfee Avert Labs

"From Trojan creation sites out of Germany and the Eastern bloc, you can purchase kits and support for malware in yearly contracts," said Marcus. "They present themselves as a cottage industry which sells tools or creation kits. It's hard to tell if it's a conspiracy or a bunch of autonomous individuals who are good at covering their tracks."

As well as kits and support, legions of compromised computers, or botnets, can be hired for nefarious purposes--usually for spam runs, or to perpetrate denial-of-service attacks. One of the most successful botnets of 2007 has been "Storm," so-called due to the hook-line used to trick victims into opening e-mails containing the Trojan horse. In January, the first malware was sent out with the tagline "230 dead as storm batters Europe."

The Storm botnet, estimated now to contain millions of compromised computers, has advanced defenses. The servers that control the botnet use so-called fast-flux Domain Name System (DNS) techniques to constantly change their location and names, making them difficult to locate and shut down. And security researchers who have attempted to find the command and control servers have suffered denial-of-service attacks launched by the controllers of the botnet.

"Storm has been exceptionally successful," said McAfee's Marcus. "It's used for spam runs, and researchers attempting to locate Storm command and control servers have come under attack. The hardest part is finding the key to those channels. They're not always easy to detect and find. Some of the communications are encrypted, while some are difficult to detect from a network point of view. I hate to use the word evolution, but they're certainly learning from their successes and failures. If it weren't for Storm, bots would be in significant recession. Some days we're seeing 1,000 different variants a day."

Weathering the Storm
Joe Telafici, director of operations at McAfee's Avert Labs, said Storm is continuing to evolve. "We've seen periodic activity from Storm indicating that it is still actively being maintained. They have actually ripped out core pieces of functionality to modify the obfuscation mechanisms that weren't working any more. Most people keep changing the wrapper until it gets by (security software)--these guys changed the functionality."

In the past year, the development of illegal malware has reached the point where it is almost as sophisticated as the traditional software-development and sales channel, according to Telafici.

"We've seen platform development, middleware, solutions sellers and hosting--all types of software and companies, with the same level of breakdown," said Telafici.

One indication of the maturity of the black economy, according to Telafici, was the recent case of a hacker who wrote a packer (software used to bypass antivirus protection) and who "threw in the towel recently as it wasn't profitable enough--there's too much competition. They opened the source code and walked away."

Security vendors seem to be powerless to take any action against the groups in control of botnet networks, especially those who use fast-flux techniques to move the location of command and control servers.

"With botnets, we are unlikely to make a dent unless we find the guy who controls the command and control server," said Telafici.

While law-enforcement agencies have a headstart in tracking cybercriminals, due to their experience of dealing with economic crimes such as fraud, many of the crimes are seemingly small, not warranting police attention.

Featured Video