Feeds

Russian cybercrooks shun real currencies, develop private altcoins

Only n00bs need real-world cash in the cryptocurrency era

Using blade systems to cut costs and sharpen efficiencies

Fraudsters are using private currencies to conduct transactions with each other on Russian-language cybercrime forums.

The advent of new private financial systems and currencies in the Russian-language cybercrime community is a trend indicating a stronger level of collaboration, cooperation and sophistication amongst individual fraudsters and between different fraudster boards in the digital underground, according to security researchers at RSA.

"Ever since the Liberty Reserve takedown in May of last year and the confiscation of all accounts by law enforcement, fraudsters have been busy finding a solid currency to which they can entrust their spoils without the risk of losing them in a bust," the researchers explain in a blog post.

"The obvious choices were Perfect Money and BitCoin, but both currencies carry inherent risk. Perfect Money is of questionable background, while BitCoin does not provide fraudsters the required level of anonymity and is not immune to seizure. These risks have pushed the underground to adopt - or really create - unique currency systems to help protect the financial security of its dwellers."

Examples of new underground digital currencies include MUSD. The MUSD currency, first seen in November 2013, is used in a single underground board. Forum members can use the currency to purchase services from each other, as well as pay for advertising on the board itself. The currency provides a built-in escrow-service and guarantees anonymity. One exchange agent is "offering to cash out MUSD for hard currency in person at an office in Kiev, Ukraine," RSA’s Fraud Intelligence agent reports.

Another currency, United Payment System, is shared by four different Russian language forums. Each forum has its own official exchange agent, and each exchange agent has an administrator who is supervised by a senior forum member to keep him or or "honest". Cash-out options include refilling different pre-paid cards as well as using the exchange agent.

Yet another digital currency, UAPS, is referred to as the ‘First Commercial Bank’ on one of the most powerful boards in the Russian-language cybercrime community. RSA researchers rate it as the "most advanced and secure option for fraudsters" of the three nascent currencies. Adding funds and cashing out is available directly from the UAPS system. And there's a strict policy of retaining data for only two months, an approach that brings privacy benefits.

Researchers at RSA conclude that the use of bespoke digital currencies on underground forums creates a huge headache for law enforcement.

Private financial systems and currencies in the Russian-language cybercrime community is a trend indicating a stronger level of collaboration, cooperation and sophistication amongst individual fraudsters and between fraudster boards in the cybercrime world.

These new internal currencies are carefully administered and secured, ensuring a high level of anonymity in transaction and hiding the user identities, making it more difficult for law enforcement to trace, block, or seize funds and accounts.

Michael Jackson, the former COO at Skype, a decentralised comms network just as Bitcoin is a decentralised digital currency, and an expert in digital currencies told El Reg that cybercrooks may be moving away from BitCoin because of its volatility.

"It is clear that criminals are often the first to exploit new technology, so it comes as no surprise that fraudsters are using underground forum-specific currencies as a system for value transfer," said Jackson, partner at early-stage venture capital firm Mangrove Capital Partners "Indeed, e-gold and even less supervised mainstream products such as DMZ have been used as currency on botnets for a long time."

"This demonstrates to us, as investors, that virtual currencies can be useful rather than just speculative. It also shows us that there will be various iterations on virtual currencies and Bitcoin itself may not be the dominant one. Furthermore, it suggests that criminals don't trust Bitcoin - I hope this is because they think the police will find them, but I suspect it's more to do with the fact that they don't like volatility. Even an online dope seller wants predictability in his business."

Jackson added that there are historical precedents for undergrounds currencies finding their own exchange commodities.

"Systems for value transfer have obviously been used for many years in criminal circles. There is reasonable certainty that art stemming from high value art thefts are used as collateral," he added. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.