Criminals selling stolen identities at bargain basement prices
Whole identities go for $14, credit card numbers for as little as $1
Computerworld - Cybercrooks have created a full-blown goods and services market where thieves sell stolen identities for as little as $14 and credit card account numbers for just $1, a Symantec researcher said today.
Symantec painted a gloomy, sometimes disturbing picture of the state of Internet security in a just-published report based on data from the second half of 2006. By tracking the trade in stolen information, the Cupertino, Calif., security company got an inside view of criminal bazaars, where identity thieves, hackers, spammers, fraudsters and organized gangs come together to buy, sell, rent and lease the information and tools that can make them millions.
"This is the first time we looked at the underground economy, and one of the more interesting things we found is a maturing of the [underground] marketplace," said Vincent Weafer, senior director of Symantec's security response team. "It's run on a business model, where qualified data, like a qualified sales lead, is worth more. At times, criminals will pay 10 times more for qualified leads versus unqualified."
In the global underworld marketplace, a qualified lead would be a complete identity with name, mailing address, bank and credit account numbers, Personal Identification Numbers (PINs), date of birth and mother's maiden name. Those sold for between $14 and $18 each, said Weafer. An unqualified lead might be simply a credit card number along with its card verification number; thieves sell these for $1 to $6 each. Not surprisingly, 86% of the credit and debit card accounts advertised for sale in the underground were issued by U.S. banks.
"Criminals have found that they can rent or lease or leverage almost anything they need" by using the marketplace to obtain technical expertise and malicious code, mailing lists to spam out that code and botnets to sustain the attacks, said Weafer. Purveyors, meanwhile, also have handy access to illicit flea markets, which Symantec says are more often than not U.S-based. A slight majority, 51%, of all underground economy servers known to Symantec were located in the U.S.
"There are definitely a couple of core groups behind many of the attacks," said Weafer, who repeatedly called them "gangsters" or "mobsters." "They're definitely in it for the long haul. But there's a lot of transition, like in any a marketplace, and there's a lot of 'churn' at the very superficial level in buyers and sellers."
And everyone on the other side is getting smarter, said Weafer. "The underground economy is going even more underground. They're getting wise to the ways that law enforcement or security researchers find them."
Cybercrooks are also patient when they need to be. Weafer outlined an attack last year that obtained bank account information that was missing PINs. "It was only six months later that [law enforcement] started to see the accounts used, and then only two or three a day. The criminals hadn't gotten the PIN, but as soon as they got the missing piece, they began to steal money.
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!