Criminals selling stolen identities at bargain basement prices
Whole identities go for $14, credit card numbers for as little as $1
Computerworld - Cybercrooks have created a full-blown goods and services market where thieves sell stolen identities for as little as $14 and credit card account numbers for just $1, a Symantec researcher said today.
Symantec painted a gloomy, sometimes disturbing picture of the state of Internet security in a just-published report based on data from the second half of 2006. By tracking the trade in stolen information, the Cupertino, Calif., security company got an inside view of criminal bazaars, where identity thieves, hackers, spammers, fraudsters and organized gangs come together to buy, sell, rent and lease the information and tools that can make them millions.
"This is the first time we looked at the underground economy, and one of the more interesting things we found is a maturing of the [underground] marketplace," said Vincent Weafer, senior director of Symantec's security response team. "It's run on a business model, where qualified data, like a qualified sales lead, is worth more. At times, criminals will pay 10 times more for qualified leads versus unqualified."
In the global underworld marketplace, a qualified lead would be a complete identity with name, mailing address, bank and credit account numbers, Personal Identification Numbers (PINs), date of birth and mother's maiden name. Those sold for between $14 and $18 each, said Weafer. An unqualified lead might be simply a credit card number along with its card verification number; thieves sell these for $1 to $6 each. Not surprisingly, 86% of the credit and debit card accounts advertised for sale in the underground were issued by U.S. banks.
"Criminals have found that they can rent or lease or leverage almost anything they need" by using the marketplace to obtain technical expertise and malicious code, mailing lists to spam out that code and botnets to sustain the attacks, said Weafer. Purveyors, meanwhile, also have handy access to illicit flea markets, which Symantec says are more often than not U.S-based. A slight majority, 51%, of all underground economy servers known to Symantec were located in the U.S.
"There are definitely a couple of core groups behind many of the attacks," said Weafer, who repeatedly called them "gangsters" or "mobsters." "They're definitely in it for the long haul. But there's a lot of transition, like in any a marketplace, and there's a lot of 'churn' at the very superficial level in buyers and sellers."
And everyone on the other side is getting smarter, said Weafer. "The underground economy is going even more underground. They're getting wise to the ways that law enforcement or security researchers find them."
Cybercrooks are also patient when they need to be. Weafer outlined an attack last year that obtained bank account information that was missing PINs. "It was only six months later that [law enforcement] started to see the accounts used, and then only two or three a day. The criminals hadn't gotten the PIN, but as soon as they got the missing piece, they began to steal money.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast Best Practices: How to Improve Business Continuity with Virtualization VMware solutions include a range of business continuity capabilities to help ensure availability for applications across your virtualized environment. Learn More>>
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- Live Webcast
Enhance Your Virtualization Infrastructure With IBM and Vmware
Date: Wednesday, May 14, 2014, 1:00 PM EDT
Virtualization technology is now expanding beyond the server compute elements to encompass networking and storage...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts