Forgot your password?
typodupeerror
Crime Security The Almighty Buck IT

Following the Money In Cybercrime 107

Posted by timothy
from the prevailing-wages dept.
jbrodkin writes "Five dollars for control over 1,000 compromised email accounts. Eight dollars for a distributed denial-of-service attack that takes down a website for an hour. And just a buck to solve 1,000 captchas. Those are the going rates of cybercrime, the amounts criminals pay other criminals for the technical services necessary to launch attacks. This criminal underground was detailed Wednesday in a highly entertaining talk given by researcher Stefan Savage at the annual Usenix technical conference in Portland, Ore. Savage's research into the economics of cybercrime began as lip service to satisfy the terms of a government grant, but it turned out to be the key to stopping computer attacks. Targeted methods — such as using CAPTCHAs — don't stop criminals, but they add to the cost burden and put the inefficient criminal organizations out of business, letting security researchers focus only on the ones that survive."
This discussion has been archived. No new comments can be posted.

Following the Money In Cybercrime

Comments Filter:
  • by DanTheStone (1212500) on Thursday June 16, 2011 @01:32PM (#36465516)
    Now we just need to hope that they don't breed better attackers that are all resistant.
    • by pasv (755179)
      Antibiotics are taken after an infection. The problem is most people aren't taking their vitamins (user e-d-u-c-a-t-i-o-n). It may have been acceptable 10 years ago to not know the basics of preventative security measures but now you cannot afford to have an employee that doesn't know.
      • antibiotics are often given a preventative and in many cases for livestock are continually given from birth to death as a preventative.

      • by arisvega (1414195)

        You don't get it, it has to be a car analogy. Like so;

        Instead of keep patching up your car, get one that was built to last.

      • by Dunbal (464142) *
        If you think that taking vitamins ensures you never get an infection, please return your medical degree to the online university that sold it to you. While nutritional deficiencies can be one of MANY contributing factors leading to a depressed immune system, they are by no means the only nor the most important factor. And as an aside, if Vitamin C actually did anything to help the common cold surely there would be no more colds given the global abundance of Vitamin C containing cold symptom products.
      • by Nursie (632944)

        Taking vitamin supplements is for sucker, hippies and weirdos.

        There's no evidence they do anything for people with even a halfway normal diet. In fact taking too much of some vitamins is actively bad for you.

        The vitamin industry, of course, resists all attempts to make them validate their claims or do full testing, instead relying on superstition and handwaving.

        There's a reason the supplement advertisers were made to ad small print to all their advertising material in the UK - "Dietary Supplements MAY be b

    • Psh! How could putting the inefficient cybercrime organizations out of business EVER backfire and select for better cybercrime organizations? That's just nonsense.
    • Re:Like antibiotics (Score:4, Interesting)

      by jellomizer (103300) on Thursday June 16, 2011 @02:29PM (#36466286)

      Well not really. Organized Crime grows but it doesn't reproduce well. If one does split it is often because there are some hot heads who think they can do it better, and takes resources away from the other. So we either get One Organization who is strong while the other is weak and will die off soon. Or both will be weaken and both would die off soon. Very Rarely would they split into 2 strong units.

      However what could happen with all the small guys going away there is less competition for the big ones and then they can monopolize the market... FTC is kinda useless against Organized Crime.

      But if they get too big it gets harder for them to operate without the law noticing and makes it easier for law to bring them down.

      • by icebike (68054) on Thursday June 16, 2011 @02:52PM (#36466578)

        However what could happen with all the small guys going away there is less competition for the big ones and then they can monopolize the market...

        Do these guys really compete at all?

        I've never seen shoplifters or bunglers compete. There are simply too many soft targets out there.

        But the rest of your analysis is otherwise pretty good, and the reduction of organizations might be mostly in the script kiddie market, with the few really good (bad) organizations being pretty much unaffected.

        When the truth emerges about the current deluge of hackers it will probably be a huge mob of semi-literate kiddies running scripts and purchased hacks, mostly for harassment and diversion of government resources while the big boys break into money pits or marketable secretinformation sites.

        While the harassment and dossing have been with us for some time, the tempo has been ramped up. Why are these people concentrating on government agencies like the FBI? My guess is they are being organized to act as a diversion by other governmental agencies or those guys after the big bucks. Maybe Iran is getting back at the west for wrecking their centrifuges. Who knows.

        Personally I suspect its the same organizations helping themselves to the money and their government employers to the secrets.

        • by NoSig (1919688)
          According to the summary these people are selling services to other criminals, so it seems to me that they do compete.
        • Black Markets are part of economics not exceptions to it. Black Markets follow Economic Theory quite well, they often exist when government regulation messes with Demand for a product or service. For Example one of the largest black markets in New York State is Unpasteurized Milk, not that isn't slang for anything, it is Cows Milk that hasn't been threw the Pasteurizing or Homogenization process, people will pay a lot more for this because there is a limited supply and they can only get it threw the Black

  • by WrongSizeGlass (838941) on Thursday June 16, 2011 @01:33PM (#36465534)
    But how do you pay these "companies" when you want to purchase their services? I'm sure not going to give them credit card, or an electronic bank transfer. Do they accept BitCoins? ;-)
  • Wow! (Score:5, Funny)

    by eln (21727) on Thursday June 16, 2011 @01:36PM (#36465572) Homepage
    At those prices, I can't afford to NOT spam!
  • Economics (Score:5, Insightful)

    by SniperJoe (1984152) on Thursday June 16, 2011 @01:49PM (#36465754)
    I am beginning to think that everyone should be forced to take an economics course in their lifetime. So much of the world is driven by economics that I think you'll understand the world quite a bit better if you understand the dollars and cents behind it. Perhaps its a case of "the more economics you know, the more economics you see."
    • Theoretically this should be part of basic high school education, but considering that we only barely expect our high school graduates to be literate (at least in America), I doubt we will see such a situation any time soon.
      • Re:Economics (Score:4, Insightful)

        by operagost (62405) on Thursday June 16, 2011 @02:02PM (#36465920) Homepage Journal
        If our students understood economics, there would be fewer of them going to college with the false expectation that a degree will guarantee them a secure job, and even fewer who believe politicians who promise "free" anything.
        • Worse, if more people understood economics, there'd be even fewer engineers and more parasites (lawyers, politicians and bankers)
      • by slyborg (524607)

        Dunno, my high school required basic Econ to graduate, This was back in the 80's.

    • Re:Economics (Score:4, Insightful)

      by JustSomeProgrammer (1881750) on Thursday June 16, 2011 @01:54PM (#36465830)
      My world history class in college was centered on the history of trade since people always migrated along those paths and society developed along those paths. It was really interesting and taught me that yes, money really does make the world go round.
    • Freakonomics (Score:5, Insightful)

      by Lifyre (960576) on Thursday June 16, 2011 @02:07PM (#36465988)

      I don't know if you've read Freakonomics or not but that is basically the premise of the entire book(s). There are economics in everything, people respond to incentives and if you set up your incentives properly you'll get the result you desire. Fail to properly incentivize people and you can get all sorts of interesting results. I particularly like the Israeli Day Care example.

      • Absolutely. I have read that book (not the sequel yet, though) and that's a bit about why I said what I did. Hell, I was just in the car listening to BBC World News over Sirius and they were talking about the fact that rewards for information regarding terrorism isn't very effective with the Taliban because they are not materialistic and as such, money has little value to them. As you said, it's all about incentives.
      • Re: (Score:2, Funny)

        by Anonymous Coward

        Freakonomics is to Economy like Donald Duck is to Ornithology.

        • by Lifyre (960576)

          You fail in so many ways.

          1) Freakonomics is a collections of observations on a subject.
          2) Economy is a complex system
          3) Donald Duck would be a particular specimen
          4) Ornithology is a field of study

          Now I think I get what you were TRYING for but you obviously don't understand the basic concepts much less how they relate to each other.

          Next time try something along the lines of Freakonomics is to Economics as the Origin of Species is to Biology. That comparison would at least be apples to apples (though a bit e

    • by jbrodkin (1054964)
      Absolutely. I wish I had taken an economics course in college. It's only in my "old age" that I've started to become interested in this stuff.
      • "Youth is wasted on the young." - George Bernard Shaw
      • by Raenex (947668)

        I wish I had taken an economics course in college.

        I did, and you didn't miss much. Unfortunately, most of it involved a bunch of formulas that are only true when everybody acts completely rationally and don't take into account feedback at all. It was just an academic exercise.

        The basic idea of supply and demand is the most fundamental thing you can learn about economies, and just about anybody can understand it.

        • by Anonymous Coward

          Proving that you didn't learn much economics. You just regurgitated information you didn't understand.

          The very basic economics formulas are centuries old and don't have a built-in feedback adjustment. You have to do that yourself. Which is why basic microeconomics has a lot of graphs with a supply curve and a demand curve and gives you problems asking what equilibrium price (or quantity) results from a stated change in quantity demanded, quantity supplied, shock to cost of production, etc etc.

          They're pretty

          • by Raenex (947668)

            I was talking about macroeconomics. The basic formulas for supply and demand are fine.

            Macroeconomics claims to model bigger things, yet most of the formulas I was indeed forced to regurgitate were just not useful in the real world.

            This opinion is also held by many mainstream economist. In fact, it seems to become popular again after every major crisis.

          • by idontgno (624372)

            That just proves that Newtonian mechanics isn't complete physics the same way that high school Macroeconomics isn't the complete economic picture. However, there is a difference: classical mechanics corresponds pretty closely to gross everyday observation of physical phenomena, but pure elementary Macro and Micro bear only the slightest correspondence to the gyrations and churn of the great big huge Global Economy, as frantically and inconsistently reported by every news organ in the world, and as debated e

    • Re:Economics (Score:5, Insightful)

      by gstoddart (321705) on Thursday June 16, 2011 @02:19PM (#36466148) Homepage

      I am beginning to think that everyone should be forced to take an economics course in their lifetime.

      The problem is ... which version of 'economics'?

      It seems there's the broad, general sense of economics which attempts to explain how things work as an interconnected system. And, then there's the economics which is almost dogmatic ... it's a belief that under certain circumstances, and given a set of assumptions, a given outcome would naturally occur. Those, I'm not convinced are supported by anything more than a desire for it to be true.

      I, for instance, have yet to be convinced that "trickle down economics" actually accomplishes what its proponents claim it will. I also, am completely unconvinced by things that the rampant socialists say would happen if we listened to them since their numbers are equally imaginary. They both amount to wishful thinking.

      At a certain point, economics devolves into ideology and philosophy. And your belief in what works ceases to be empirical, and more focused on how you think the world should operate if you could rewrite reality to suit your own needs (or, force everyone to adopt your theories long enough for them to be proven true/fail utterly).

      I agree that some understanding of economics is valuable ... but then it breaks down to become a belief system, and goes all to hell. Modern economics is like the Emperor's New Clothes ... as long as we all keep deluding ourselves that it works, everyone is happy. Occasionally, a glaring counter example comes along that people chalk up as being an anomaly.

      It seems that goes for both ends of how people believe economics works.

      • by mcmonkey (96054)

        I, for instance, have yet to be convinced that "trickle down economics" actually accomplishes what its proponents claim it will.

        Really? So what will it take to convince you that "trickle down economics" actually accomplishes the opposite of what its proponents claim it will?

        Because from there, it's an easy walk over to being convinced that those proponents know this and have been lying about their intentions the whole time.

        • by gstoddart (321705)

          Really? So what will it take to convince you that "trickle down economics" actually accomplishes the opposite of what its proponents claim it will?

          Surprisingly little, but in the interests of being somewhat balanced, I chose to highlight that the two extremes are both a little shaky without actually focusing too much on one or the other.

          Because from there, it's an easy walk over to being convinced that those proponents know this and have been lying about their intentions the whole time.

          As someone I used to

      • by dargaud (518470)

        I, for instance, have yet to be convinced that "trickle down economics" actually accomplishes what its proponents claim it will.

        I heard a (good) economist debunk it in one single sentence (I'm paraphrasing here): "If you give money to the rich, they'll put it in an offshore account or use it to purchase expensive art from other rich people. None of it goes back to the economy. If you give money to the poor, they use it to eat or to fix their car. It's back in the economy within a week."

  • by interkin3tic (1469267) on Thursday June 16, 2011 @02:16PM (#36466108)
    It suggests that CAPTCHAs can narrow the profit margin, but just a few lines above that it says they only cost a dollar to overcome. So these spammers will sell 1000 e-mail accounts for 8 dollars, and adding a dollar to the end cost to compensate for the CAPTCHAs would totally destroy their business model?

    Was that supposed to mean that each of the thousand CAPTCHAs adds a dollar in cost to spammers? Because then I could see how that would cause some problems for them.
    • Was that supposed to mean that each of the thousand CAPTCHAs adds a dollar in cost to spammers?

      Yes.

      • by gnick (1211984)

        Was that supposed to mean that each of the thousand CAPTCHAs adds a dollar in cost to spammers?

        Yes.

        No. Read it again. It adds $1 to each block of 1,000 CAPTCHAs, not each of the 1000 CAPTCHAs.

  • I wonder what the going rate for stealing credit card numbers that have been saved on a website for returning customers. I know, because I've been the victim on identity theft twice now, and let me tell you, it ain't pretty. Recovering financially takes a year or more through vigorous DIY credit repair strategies and can make you weary of future online purchases. I read in another recent post all the grief that PayPal gives its customers and I can also attest to the fact that they are the most self-serving
    • by satuon (1822492)

      I use PayPal because you don't have to disclose anything to the sellers, you don't give a credit card number. I've heard they charge a few percent of the entire sum for each transaction though.

  • by Animats (122034) on Thursday June 16, 2011 @02:23PM (#36466204) Homepage

    Of course you follow the money. There aren't that many spammers; about three years ago, there seemed to be only about ten unique large-scale spammers. Taking one of them down made a significant dent in spam traffic for a month.

    Junky spam and junky bogus web sites are obsolete, even in the criminal world. The old mindset was to filter out emails and sites that "looked junky". The old "Web Spam Challenge [lip6.fr] was based on this. They have a big file of pages which humans have classified, by a quick look, as "spam" or "not spam". Five or ten years ago, that sort of worked, because most of the junk sites were really tacky. Phishing sites used to have blatant misspellings. That's history. Today's crooks have good web site production values.

    So you have to dig deeper. On the web spam/bogus web site front, part of the right answer is to find out who's behind the web site and do a background check. (We do that at SiteTruth.com, as I've mentioned before.) Right now, even a superficial check (is there a mailing address on the site? Is it a known phishing site? Do seals of approval check out? Non-junk SSL cert?) is enough to knock out a big fraction of the junk. The deeper checks (is there a business at that address? How long in business? How much revenue last year? What's their business credit rating?) tell us enough to have some confidence about business legitimacy.

    The original article mentions "ordering tons of stuff from phishing scams to trace the path of the money." That's what the FBI should be doing more of. Law enforcement can have accounts created, plug into the credit card system, and watch their credit cards being used in real time. It's hard to do that without law enforcement authority.

    • by Dunbal (464142) *

      a significant dent in spam traffic for a month.

      A month.

      Time to bring out draconian legislation that hits spammers where it hurts - go after the idiots who respond to spam, just like they go after the "johns" that try to pick up prostitutes... a few ads in the local paper saying that John Q Neighbor was trying to buy v14gr4 or an online degree should really help.

      I hope you don't think I was being serious.

  • by Jane Q. Public (1010737) on Thursday June 16, 2011 @02:25PM (#36466234)
    Busting CAPTCHAs is not a crime. Not usually, anyway. Sure, it may violate a website's terms of service, but US courts so far (quite correctly) say that's not a crime, unless you're "stealing" a for-pay service. And maybe not even then.

    It is not valid to label something a "crime" just because it's inconvenient for some people. The lesson to be learned here is that CAPTCHAs are a lazy (and often lousy) way to prevent "unauthorized" access.

    Also, while most CAPTCHAs today can be busted with automated tools, as OP says it's often more economical to just hire teams of people from Pakistan or India to do it manually. The going rate on freelancer sites is about $1 per 1000, but sometimes it's even less.
    • by _Sprocket_ (42527)

      Busting CAPTCHAs is not a crime. Not usually, anyway. Sure, it may violate a website's terms of service, but US courts so far (quite correctly) say that's not a crime, unless you're "stealing" a for-pay service. And maybe not even then. It is not valid to label something a "crime" just because it's inconvenient for some people. The lesson to be learned here is that CAPTCHAs are a lazy (and often lousy) way to prevent "unauthorized" access.

      I didn't see anywhere in the article where it labeled solving CAPTCHAs as a crime. And I don't remember ever seeing anyone claiming that a CAPTCHA prevents unauthorized access either. What the article does say is that a CAPTCHA solving service is one of the tools that criminals employ in their trade. And while it might seem futile to use a CAPTCHA, doing so induces a cost to criminals that tends to limit how many criminals continue to operate.

      In my experience, CAPTCHAs never completely solve the proble

      • The article is titled "Following the Money In Cybercrime". Further, the article states:

        "... And just a buck to solve 1,000 captchas. Those are the going rates of cybercrime..."

        Which is very clearly an implication that busting CAPTCHAs is a crime. It is not explicitly stated, no, but it's a very strong implication! One could not blame a reader for reading that busting CAPTCHAs is, indeed a crime.

        • by _Sprocket_ (42527)
          The article also talked about scammers sending around 12 million emails per purchase. That doesn't mean the article is now strongly implying that sending an email is criminal. I see your point. But I would suggest that a reader seeing this sort of implication needs to go back and re-read the article again.
          • I disagree. The two sentence above, just as I quoted them in the order they appeared, very clearly imply that busting CAPTCHAS are illegal. If the author did not mean to directly imply that, then there would have been absolutely no purpose to stating "And just a buck to solve 1,000 captchas." immediately before "Those are the going rates of cybercrime..."

            But since the author did put those words in that order, anybody who knows how to read English does, in fact, know that the implication was clearly int
  • Always think of this comic when i hear the word captcha now.

    xkcd [xkcd.com]
  • Is what you need to become if you want to do crimes of money these days. If our government was serious, this crap would be toast instantly. See how quick they got the DC Sniper after he gave them no more than a Cayman Island bank account number. Think "what would Harry Harrison do?".

    This proves that
    A: We're not serious about this.
    B: It's probably half the government itself in an attempt to create people believing they need even more power.

When you don't know what to do, walk fast and look worried.

Working...