Feeds

Boffins plot to disrupt underground black markets

Fake IDs to thwart trade in stolen IDs

Reducing security risks from open source software

Academic researchers are developing techniques to disrupt underground black markets frequented by malicious hackers and virus writers.

Researchers at Carnegie Mellon University have developed two approaches to interrupt the operation of black market sites that hawk viruses, stolen data, and attack services.

One tactic involves bad mouthing buyers or sellers in order to eliminate their verified status, discouraging others from engaging in trades with them. The other attacks the effectiveness of the markets themselves by undermining the cybercrooks' verification or reputation system, creating a deceptive sales environment.

One technique developed by the team involves establishing fake verified-status identities that are difficult to distinguish from other-verified status sellers, making it hard for buyers to identify "honest" verified-status sellers from "dishonest" verified-status sellers.

"Just like you need to verify that individuals are honest on eBay, online criminals need to verify that they are dealing with 'honest' criminals," explained Jason Franklin, a PhD student in computer science at Carnegie Mellon.

Franklin, and fellow researcher Adrian Perrig at Carnegie Mellon, has been working with Vern Paxson of the International Computer Science Institute and Stefan Savage of the University of California, San Diego, in designing new computer tools to better understand and potentially thwart the growth of online black markets.

The project involved monitoring the black market for seven months and developing automated tools to make sense of the data. The researchers estimate trades in illegal materials worth an estimated $37m took place during the monitoring period. This involved the trade in 80,000 credit card records, though how many of these were valid was outside the scope of the project.

Despite law enforcement actions against known black market sites, such as the US Secret Service-run Operation Firewall three years ago, underground sites continue to proliferate. The operation, which targeted the notorious Shadowcrew and resulted in 28 arrests around the globe, barely scratched the surface of the problem, according to Carnegie Mellon researchers.

"The scary thing about all this is that you do not have to be in the know to find black markets, they are easy to find, easy to join and just a mouse click away," Franklin said. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.