An anonymous reader writes "The latest findings of a report explore the trend of loosely organized clusters of attackers trading stolen data online being replaced by hierarchical cybercrime organizations. These organizations deploy sophisticated pricing models, crimeware business models refined for optimal operation, crimeware drop zones, and campaigns for optimal distribution of the crimeware. These cybercrime organizations consist of strict hierarchies, in which each cybercriminal is rewarded according to his position and task."
I don't see how this is "New News." I have heard several public government speakers in the past that talked about how cyber crime it based on the Mafia hierarchy.
Hierarchial organizations are much easier to attack.
This type of organization will be even easier to attack than usual, because there's no loyalty on the internet and no possibility of physical retribution.
It's much like fighting a conventional enemy versus fighting guerrilla militias. That being said, organization breeds efficiency, and facilitates larger operations.
I'm suddenly reminded of the line from the movie "Sneakers."
Cosmo: There I was in prison. And one day I help a couple of older gentlemen make some free telephone calls. They turn out to be, let us say, good family men.
Martin Bishop: Organized crime?
Cosmo: Hah. Don't kid yourself. It's not that organized.
Are they going to start sending notifications of their organizational change through spam, just like my current corporate VPs like to do through e-mail?
"The organization changes announced by Boris Brezgnoff represent a positive signal to all of our stakeholder groups - investors, clients and especially zombie PC owners - that we are repositioning our african operations to pursue accelerated growth. These changes will facilitate the cross-pollination of expertise we have developed across Nigeria. These changes will also enable further refinement of our global delivery strategy as we increase intra- and inter-business unit communication and pursue cross-business unit opportunities.
To deliver on this strategy and in recognition of their contribution to our past growth, the following leadership changes will be effective as of July 15, 2008:
Ivan Lebovich will assume the position of DDOS Extortion Vice President, Southern Hemisphere. Ivan's deep understanding of all of our services - particularly our Tier 2 and Tier 3 business - and his ability to develop strong relationships with key accounts will help expand our penetration of clients based in the southern hemisphere. His passion for the global delivery of our IT services and his excellent ongoing relationship with our primary nearshore USDS (Untraceable Spam Delivery System) accounts - South Africa and Malaysia - ensures the effective management of this critical delivery centre. I personally want to thank Ivan for his many years of dedicated service to the FIRM (Free Internet Russian Mafia) and look forward to working with him as he takes on this promotion to business unit leader."
First, it's important to clarify that as far as I'm aware, we're not in the business of compromising networks or gaining access to other systems without just cause. When there is a clear threat to security, we then employ legal and just means to deal with that threat. Also, I'm not able to discuss specific methods that we might or might not be employing but only speak in terms of concepts and capabilities that we should have in order to be successful conducting operations in cyberspace. If you have insights
head of the U.S. Army Computer Network Operations (CNO)-Electronic Warfare (EW) Proponent's Futures Branch, in a recent slashdot interview. Both "organisations" (the military & the criminal) seem to be "cybering-up" massively.
Ok buddy, this is how it's going to work. You're going to pay us 10% of the profits you get off your google ads. What we're going to do for you is make sure that no one else is out there pushing in on your corner of the market. We'll even set up a bunch of other sites that refer people to your site to increase your business.
If you don't pay up, we'll vandalize your page, buy your domain out from under you and unplug your server.
Now I know why I don't generally bother reading these articles. This one has to be one of most cursory and pointless articles I have read in a long long time.
Vetinari recognized that crime was inevitable. But if you were going to have crime, make it organized crime. I believe there was a point where Vetinari made the thief's Guild realize that instead of fighting over a slice of the pie to make more money, take a reasonable slice, and then make the pie bigger.
Sound like life imitating art.
In the Discworld, the ruler of Ankh-Morpork deals with crime by making it into a Guild, which then ensures that crime stays at an acceptable level by permanently removing unlicensed criminals. It is not only a satire on the Mafia, it is a satire on corrupt police forces and insurance companies (the criminals do not have protection rackets per se, they offer insurance against their own activities).
The study of crack dealers mentioned in Freakonomics showed a heirarchy similar to any US corporation, with the lowest level getting about the same hourly rate as in McDonalds. There really is no hard and fast line between organised business and crime, just degrees of criminality ranging from (say) welfare friendly food providers on the West Coats down to crack dealers. As Enron and Bear Sterns have shown us, size and visibility is no guarantee of legality.
So why are the officials surprised? The structures that fight the crime become more organized so it is expected for the latter to do the same. Cause and effect.
It never ceases to amaze me that even the lowest of the low scumbag criminals can form crime rings and organize into a hierarchical management structure.
And it's always been that way.
The booze runners of the 20's and 30's to the crack dealers of the 80's, and everything before and after.
They have pretty much corporate org charts.
I guess it's human nature to follow the rules/leader. Some just choose different sides of the law.
Does anyone remember Introversion's little hacker game, Uplink?
You worked as a (mostly malicious) contract hacker for a corp called Uplink, creating and editing identities for clients, stealing and deleting data, and transferring large sums of money in exchange for a bounty proportional to the difficulty/danger of being caught.
Looks very similar to this situation.
Just checked - you can still buy Uplink on Steam for $10.
Yeah but the steam version doesn't work with the mods that modify the binary. Fortunately it is possible to get them working though if you don't mind lowering your neuromancer rating a little if you get my drift.
Aside from people's general comments that this is both obvious and many other people have already presented this type of information before I think their assessment is inaccurate. First of all their numbers make it obvious that they are only monitoring semi-open forums and not completely closed ones. Additionally their data looks like it is US and Russia-centric, not focusing on the numerous markets that exist in Ukraine, Bulgaria, Romania, Poland, western Africa and South America. Plus overall they are mixing up organized crime and specialization. What they are describing is mature capitalization with job specialization moreso than organized crime. They are limiting themselves to groups where amateur data thieves require specialists to perform higher risk elements of cashing out, using the stolen data.
The real elements of organized crime are the ones where traditional non-cyber groups hire computer experts to get data, and move money through traditional, well-established means. These groups are the ones going after high profile money and you'll never see anything online about them until a law enforcement case brings them down.
Google AdWords - runs paid ads for services needed by scammers, such as "bulletproof hosting" [google.com].
Google Checkout - collects money [google.com] for scam tools.
Google's proliferation of low-security services makes it easier for scammers to operate, and to hide. If they had to buy those services from a hosting company, there'd be a money trail to follow back to the source. Using Google's free, unauthenticated services makes it easier for the operator to conceal their identity.
If they're going corporate, they've lost the thread:
"No sense being a grifter if it's just like being a citizen." -- Paul Newman, playing confidence man Henry Gondorf in "The Sting".
Can't be true! (Score:3, Funny)
Coming the fall to HBO (Score:5, Funny)
The Sopr0nos.
Re: (Score:1, Interesting)
Re: (Score:1)
Re: (Score:1, Insightful)
Re: (Score:2)
mods = fags.
Re:Coming the fall to HBO (Score:4, Funny)
Parent
As someone who read that as (Score:1)
My first thought was "Sweet justice."
Good news (Score:5, Insightful)
Re:Good news (Score:5, Funny)
Hierarchial organizations are much easier to attack.
This type of organization will be even easier to attack than usual, because there's no loyalty on the internet and no possibility of physical retribution.
http://www.realinternetmafia.com/ [realinternetmafia.com]
They're not going to break your legs.
Parent
Re: (Score:3, Insightful)
O RLY? (Score:2)
That being said, organization breeds efficiency
There's a documentary on that very subject you should see.
It's called Office Space
Re:Good news (Score:5, Funny)
I'm suddenly reminded of the line from the movie "Sneakers."
Cosmo: There I was in prison. And one day I help a couple of older gentlemen make some free telephone calls. They turn out to be, let us say, good family men.
Martin Bishop: Organized crime?
Cosmo: Hah. Don't kid yourself. It's not that organized.
Parent
Re: (Score:2)
Gee...for the good old days of "criminal cooperatives".....
Re: (Score:2)
Gee...for the good old days of "criminal cooperatives".....
The new way doesn't sound like a lot of fun to me. If all you get is bureaucracy and a pay scale, you may as well work for the government.
I wonder if there are any special fringe benefits for the rank-and-file cybercriminal.
Spam Reorg Notification? (Score:5, Funny)
Are they going to start sending notifications of their organizational change through spam, just like my current corporate VPs like to do through e-mail?
"The organization changes announced by Boris Brezgnoff represent a positive signal to all of our stakeholder groups - investors, clients and especially zombie PC owners - that we are repositioning our african operations to pursue accelerated growth. These changes will facilitate the cross-pollination of expertise we have developed across Nigeria. These changes will also enable further refinement of our global delivery strategy as we increase intra- and inter-business unit communication and pursue cross-business unit opportunities.
To deliver on this strategy and in recognition of their contribution to our past growth, the following leadership changes will be effective as of July 15, 2008:
Ivan Lebovich will assume the position of DDOS Extortion Vice President, Southern Hemisphere. Ivan's deep understanding of all of our services - particularly our Tier 2 and Tier 3 business - and his ability to develop strong relationships with key accounts will help expand our penetration of clients based in the southern hemisphere. His passion for the global delivery of our IT services and his excellent ongoing relationship with our primary nearshore USDS (Untraceable Spam Delivery System) accounts - South Africa and Malaysia - ensures the effective management of this critical delivery centre. I personally want to thank Ivan for his many years of dedicated service to the FIRM (Free Internet Russian Mafia) and look forward to working with him as he takes on this promotion to business unit leader."
The FIRM responds... (Score:1)
First, it's important to clarify that as far as I'm aware, we're not in the business of compromising networks or gaining access to other systems without just cause. When there is a clear threat to security, we then employ legal and just means to deal with that threat. Also, I'm not able to discuss specific methods that we might or might not be employing but only speak in terms of concepts and capabilities that we should have in order to be successful conducting operations in cyberspace. If you have insights
it's actually Lt. Col. John Bircher, (Score:1)
head of the U.S. Army Computer Network Operations (CNO)-Electronic Warfare (EW) Proponent's Futures Branch, in a recent slashdot interview.
Both "organisations" (the military & the criminal) seem to be "cybering-up" massively.
FeeBay? (Score:2)
And kneecapped, obviously.
Website protection rackets (Score:2, Interesting)
If you don't pay up, we'll vandalize your page, buy your domain out from under you and unplug your server.
Re:Website protection rackets (Score:4, Funny)
Sorry, Viacom is still waiting on the ruling which will allow them to do this.
oh, and at least TFA doesn't lump p2p in there.
Parent
Re: (Score:2)
That search page of yours looks mighty combustible... with all them dry links lying around...
Like just a match in the wrong place and it could go up like nothing. We wouldn't want that now would we ?
Re: (Score:2)
I still cannot figure out why the threat of vandalizing a server works better than a threat of breaking both wrists.
RTFA (Score:5, Informative)
Now I know why I don't generally bother reading these articles. This one has to be one of most cursory and pointless articles I have read in a long long time.
Re: (Score:1)
Prior Art (Score:1)
This is a Pratchett reference (Score:5, Insightful)
The study of crack dealers mentioned in Freakonomics showed a heirarchy similar to any US corporation, with the lowest level getting about the same hourly rate as in McDonalds. There really is no hard and fast line between organised business and crime, just degrees of criminality ranging from (say) welfare friendly food providers on the West Coats down to crack dealers. As Enron and Bear Sterns have shown us, size and visibility is no guarantee of legality.
Parent
sophisticated pricing models (Score:4, Funny)
extra annoyment (100% cpu) for zombie computer owners: +$20
tarpit iptables rule workaround: +$30
24/7 phone support: +$300
lunch with PharmaMaster: $5m
Well DUH! (Score:1)
Organized crime (Score:3, Insightful)
And it's always been that way.
The booze runners of the 20's and 30's to the crack dealers of the 80's, and everything before and after.
They have pretty much corporate org charts.
I guess it's human nature to follow the rules/leader. Some just choose different sides of the law.
Sounds like Uplink (Score:2, Interesting)
Does anyone remember Introversion's little hacker game, Uplink?
You worked as a (mostly malicious) contract hacker for a corp called Uplink, creating and editing identities for clients, stealing and deleting data, and transferring large sums of money in exchange for a bounty proportional to the difficulty/danger of being caught.
Looks very similar to this situation.
Just checked - you can still buy Uplink on Steam for $10.
Re: (Score:1)
Re: (Score:2)
Yeah but the steam version doesn't work with the mods that modify the binary. Fortunately it is possible to get them working though if you don't mind lowering your neuromancer rating a little if you get my drift.
Re: (Score:1)
Thanks for the tip - the mods were the best part!
another garbage press release (Score:4, Insightful)
Re: (Score:1)
What I want to know is.... (Score:1)
Put them in charge! (Score:2)
The last law abiding corporation I worked for promoted based upon blood lines and/or an employees ability to hang from the ceiling by their lips.
The central role of Google (Score:4, Insightful)
Google is an integral part of today's online scams. Google provides material support to scammers, and helps collect the money.
Google's proliferation of low-security services makes it easier for scammers to operate, and to hide. If they had to buy those services from a hosting company, there'd be a money trail to follow back to the source. Using Google's free, unauthenticated services makes it easier for the operator to conceal their identity.
It's full-service evil.
Re: (Score:3, Insightful)
Surely you're being facetious. Thank god we have free and anonymous services on the web.
What, you'd prefer to live in a world where you couldn't be anonymous online?
Your argument soudn like you're saying this is a bad thing and everything everyone does online should be id verified.
Fuck that.
We're going to have a hard enough time preventing that from happening thanks to the fascism creep going on in our sick system as it is.
Gangs & McDonald's (Score:1)
Reminds me of Freakonomics, in which Levitt discusses how drug-dealing gangs' organizational structure mirrors that of McDonalds.
The invisible hand (Score:2)
Run Windows (Score:1)
What are these crooks thinking? (Score:1)
Huh? (Score:1)
Thank you Microsoft (Score:1)