Feeds

Crimelords: Stolen credit cards... keep 'em. It's all about banking logins now

Also, Crimeware-As-A-Service is a thing. Really

The essential guide to IT transformation

Stolen bank login information attracts an even higher price than credit card numbers on underground cybercrime bazaars, and EU logins are worth more than American ones, according to research by McAfee.

The Intel-owned security division's Cybercrime Exposed paper highlights trends in the thriving digital underground, including the ease with which criminals can buy personal information online. For example, buying credit card details without a PIN costs around £16 apiece, a price that rises to £65 with a PIN or £130 with a PIN and a guaranteed good balance.

European Union online banking logins cost 4–6 per cent of the account balance while US online banking logins cost 2 per cent of the account balances. That means an online banking account with a £3,000 plus balance or an American equivalent with $8,000 is worth more these days than a credit card record even in cases where a crooks is also offering to sell a PIN number.

McAfee researchers also discovered that PayPal logins cost six to 20 per cent of the account balance. Western Union transfer details cost 10 per cent of the transfer amount.

Raj Samani and François Paget of McAfee obtained their figures from the going rate on underground cybercime markets, which the two researchers report are stepping further into the background thanks to various law enforcement crackdowns.

"Such underground platforms are implementing stronger mechanisms to ensure that participants are who they purport to be (or at the very least are not law enforcement officials). Ironically, while the platforms that facilitate the services marketplace for illegal activities are going deeper underground, the trade in zero-day vulnerabilities is more transparent than ever before," Samani and Paget report.

The technical barrier to getting involved in cybercrime has been lowered thanks to various Cybercrime-As-A-Service offerings. These include cybercrime-infrastructure-as-a-service (renting out botnets to send spam), bulletproof hosting, password cracking and DDoS for hire offers.

It also includes Crimeware-As-A-Service, a domain that includes the identification and development of the exploits used for the intended operation (droppers, downloaders, keyloggers, bots, and more). This category includes the availability of hardware that may be used for financial fraud (for example, ATM card skimming kit, the McAfee researchers explain.

Another category highlighted by the McAfee duo - Research-As-A-Service - covers the grey market involving the sale of zero-day vulnerabilities. "The sale of vulnerabilities has recently become a growth area for researchers and brokers alike," Samani and Paget conclude.

Back in the day high-minded security researchers reported security problems direct to vendors, sometimes getting a less than thankful response in return. These days security researchers in it purely for the money - so-called green hat hackers from the likes of Vupen Security in France and Endgame System in the US - have risen to the fore. Both organisations shun vendors-run programs instead preferring to sell exploits to Western governments. Independent brokers facilitate the same type of legal but ethically questionable trade and the rewards can be high, as the McAfee team report. One broker was reportedly able the broker to facilitate the sale of an Apple iOS exploit for $250,000 and pocket 15 per cent (or $37,500) in commission.

This is right at the elite end of the market. An Adobe Reader exploit, for example, will fetch a far more modest fee of between $5,000 and $30,000. There's also a market for Java, operating systems and browser exploits. Browser exploits are second only to iOS pwnage tricks, according to figures cited by McAfee, commanding a fee of $60,000 to $150,000 for Firefox or Safari zero-days and perhaps higher for Chrome or Internet Explorer malfeasance.

More details about the exploit vulnerability marketplace, which is legal, together with the changing landscape of the underground economy, can be found found in McAfee's Cybercrime Exposed whitepaper here (PDF). ®

5 things you didn’t know about cloud backup

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.