Criminals selling stolen identities at bargain basement prices

Computerworld - Cybercrooks have created a full-blown goods and services market where thieves sell stolen identities for as little as $14 and credit card account numbers for just $1, a Symantec researcher said today.

Symantec painted a gloomy, sometimes disturbing picture of the state of Internet security in a just-published report based on data from the second half of 2006. By tracking the trade in stolen information, the Cupertino, Calif., security company got an inside view of criminal bazaars, where identity thieves, hackers, spammers, fraudsters and organized gangs come together to buy, sell, rent and lease the information and tools that can make them millions.

"This is the first time we looked at the underground economy, and one of the more interesting things we found is a maturing of the [underground] marketplace," said Vincent Weafer, senior director of Symantec's security response team. "It's run on a business model, where qualified data, like a qualified sales lead, is worth more. At times, criminals will pay 10 times more for qualified leads versus unqualified."

In the global underworld marketplace, a qualified lead would be a complete identity with name, mailing address, bank and credit account numbers, Personal Identification Numbers (PINs), date of birth and mother's maiden name. Those sold for between $14 and $18 each, said Weafer. An unqualified lead might be simply a credit card number along with its card verification number; thieves sell these for $1 to $6 each. Not surprisingly, 86% of the credit and debit card accounts advertised for sale in the underground were issued by U.S. banks.

"Criminals have found that they can rent or lease or leverage almost anything they need" by using the marketplace to obtain technical expertise and malicious code, mailing lists to spam out that code and botnets to sustain the attacks, said Weafer. Purveyors, meanwhile, also have handy access to illicit flea markets, which Symantec says are more often than not U.S-based. A slight majority, 51%, of all underground economy servers known to Symantec were located in the U.S.

"There are definitely a couple of core groups behind many of the attacks," said Weafer, who repeatedly called them "gangsters" or "mobsters." "They're definitely in it for the long haul. But there's a lot of transition, like in any a marketplace, and there's a lot of 'churn' at the very superficial level in buyers and sellers."

And everyone on the other side is getting smarter, said Weafer. "The underground economy is going even more underground. They're getting wise to the ways that law enforcement or security researchers find them."

Cybercrooks are also patient when they need to be. Weafer outlined an attack last year that obtained bank account information that was missing PINs. "It was only six months later that [law enforcement] started to see the accounts used, and then only two or three a day. The criminals hadn't gotten the PIN, but as soon as they got the missing piece, they began to steal money.