Security company scours 'Dark Web' for stolen data

IDG News Service - Alex Holden, founder of security company Hold Security, is in the business of bringing companies bad news.

Holden often reaches out to organizations, alerting them that their valuable data is circulating on underground hacker forums. These days, that's pretty frequent.

Holden's company, which focuses on penetration testing and auditing, recently expanded into monitoring the so-called dark or deep web, which refers to password-protected forums where cybercriminals sell or trade the data they've stolen.

"We went from being reactive and working a breach and getting the information for the client to monitoring as much of the Internet as possible and bringing the data into our data centers and looking at it," he said.

Data breaches are costly for organizations. A Symantec-sponsored survey released in May conducted by the Ponemon Institute found the average cost to recover from one was highest in the U.S. at $5.4 million, followed by $4.8 million in Germany and $4.1 million in Australia.

Holden's research in part contributed to the revelation last month that three major data brokers -- LexisNexis, Kroll Background America and Dun and Bradstreet -- had been victims of persistent breaches, which leaked consumer and business data as reported by security analyst and journalist Brian Krebs.

Those public disclosures, however, are just the tip of iceberg, as hackers dig deeper and deeper into company networks, Holden said in an interview Tuesday. His company has profiles on as many as 10,000 data thieves worldwide, a formidable, clever force that is causing security headaches worldwide.

Earlier this month, Hold Security launched a subscription service called "Deep Web Monitoring," where the company's analysts search secret forums and let companies know if their data has been compromised. If a company isn't working with Hold Security, Holden said he will sometimes approach the organization's legal team to let them know there's a breach.

Holden, who also is chief information security officer for his company, has a small team of analysts, mostly based in the U.S. They look for email addresses, login credentials, employee and customer names as well as any other data circulating on forums and chat channels. Hold Security's clients are predominantly in financial services, the medical industry and e-commerce businesses.

Just in the last month alone, the company's analysts came across more than 100 million stolen user IDs and passwords, Holden said.

If the data appears to match that of one of its clients, a delicate negotiation may take place. Some companies will give the nod to Hold Security to negotiate to prevent the data from becoming public.

"We often try to communicate with the cybercriminals and say 'Alright, I know you stole this data, but I want exclusive rights'," Holden said. "In some cases, we were successful doing that."

Other companies may opt for a more defensive strategy. If a company's network is compromised, some have chosen to instead seed fake data on their systems. Malware that periodically collects database information would suck up the bogus data.

"The bad guys are not really good at keeping backups of the original data," Holden said. In one case, Holden said "we were able to taint the data that was being stolen."

Cybercriminals are also in competition with one another. There have been instances of one hacker ratting out another to Holden's analysts in an attempt to shut down their competitor.

"There is no kinship between certain thieves," he said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk