Crimelords: Stolen credit cards... keep 'em. It's all about banking logins now

Also, Crimeware-As-A-Service is a thing. Really


Stolen bank login information attracts an even higher price than credit card numbers on underground cybercrime bazaars, and EU logins are worth more than American ones, according to research by McAfee.

The Intel-owned security division's Cybercrime Exposed paper highlights trends in the thriving digital underground, including the ease with which criminals can buy personal information online. For example, buying credit card details without a PIN costs around £16 apiece, a price that rises to £65 with a PIN or £130 with a PIN and a guaranteed good balance.

European Union online banking logins cost 4–6 per cent of the account balance while US online banking logins cost 2 per cent of the account balances. That means an online banking account with a £3,000 plus balance or an American equivalent with $8,000 is worth more these days than a credit card record even in cases where a crooks is also offering to sell a PIN number.

McAfee researchers also discovered that PayPal logins cost six to 20 per cent of the account balance. Western Union transfer details cost 10 per cent of the transfer amount.

Raj Samani and François Paget of McAfee obtained their figures from the going rate on underground cybercime markets, which the two researchers report are stepping further into the background thanks to various law enforcement crackdowns.

"Such underground platforms are implementing stronger mechanisms to ensure that participants are who they purport to be (or at the very least are not law enforcement officials). Ironically, while the platforms that facilitate the services marketplace for illegal activities are going deeper underground, the trade in zero-day vulnerabilities is more transparent than ever before," Samani and Paget report.

The technical barrier to getting involved in cybercrime has been lowered thanks to various Cybercrime-As-A-Service offerings. These include cybercrime-infrastructure-as-a-service (renting out botnets to send spam), bulletproof hosting, password cracking and DDoS for hire offers.

It also includes Crimeware-As-A-Service, a domain that includes the identification and development of the exploits used for the intended operation (droppers, downloaders, keyloggers, bots, and more). This category includes the availability of hardware that may be used for financial fraud (for example, ATM card skimming kit, the McAfee researchers explain.

Another category highlighted by the McAfee duo - Research-As-A-Service - covers the grey market involving the sale of zero-day vulnerabilities. "The sale of vulnerabilities has recently become a growth area for researchers and brokers alike," Samani and Paget conclude.

Back in the day high-minded security researchers reported security problems direct to vendors, sometimes getting a less than thankful response in return. These days security researchers in it purely for the money - so-called green hat hackers from the likes of Vupen Security in France and Endgame System in the US - have risen to the fore. Both organisations shun vendors-run programs instead preferring to sell exploits to Western governments. Independent brokers facilitate the same type of legal but ethically questionable trade and the rewards can be high, as the McAfee team report. One broker was reportedly able the broker to facilitate the sale of an Apple iOS exploit for $250,000 and pocket 15 per cent (or $37,500) in commission.

This is right at the elite end of the market. An Adobe Reader exploit, for example, will fetch a far more modest fee of between $5,000 and $30,000. There's also a market for Java, operating systems and browser exploits. Browser exploits are second only to iOS pwnage tricks, according to figures cited by McAfee, commanding a fee of $60,000 to $150,000 for Firefox or Safari zero-days and perhaps higher for Chrome or Internet Explorer malfeasance.

More details about the exploit vulnerability marketplace, which is legal, together with the changing landscape of the underground economy, can be found found in McAfee's Cybercrime Exposed whitepaper here (PDF). ®

Similar topics


Other stories you might like

  • Skyhigh Security rises from McAfee-FireEye’s SSE
    CEO chats to us about zero trust, data protection, and more

    Skyhigh Security, formed from the Secure Service Edge (SSE) pieces of McAfee Enterprise and FireEye, today announced its name and data-guarding portfolio. 

    CEO Gee Rittenhouse, who led McAfee Enterprise Cloud and is a former Cisco security executive, said Skyhigh aims to shift practitioners' focus from granting or blocking network access to resources, to fine-grain monitoring and protection of applications and data even after people have logged in.

    Instead of simply securing access to an application, Skyhigh examines what people and machines do with the software, and how they use information with in once their identity has been verified and access granted, Rittenhouse said.

    Continue reading
  • LokiLocker ransomware family spotted with built-in wiper
    BlackBerry says extortionists erase documents if ransom unpaid

    BlackBerry security researchers have identified a ransomware family targeting English-speaking victims that is capable of erasing all non-system files from infected Windows PCs.

    LokiLocker, a ransomware-as-a-service (RaaS) family with possible origins in Iran, was first seen in the wild in mid-August 2021, BlackBerry Threat Intelligence researchers write in a blog post today.

    "It shouldn't be confused with an older ransomware family called Locky, which was notorious in 2016, or LokiBot, which is an infostealer," they say. "It shares some similarities with the LockBit ransomware (registry values, ransom note filename), but it doesn't seem to be its direct descendant."

    Continue reading
  • Conti ransomware gang's source code leaked
    Latest info dump days after anonymous outing of 60,000 messages

    Infamous ransomware group Conti is now the target of cyberattacks in the wake of its announcement late last week that it fully supports Russia's ongoing invasion of neighboring Ukraine, with the latest hit being the leaking of its source code for the public to see.

    This disclosure comes just days after an archive leaked containing more than a year's worth of instant messages between members of Conti, believed to be based in Russia: we're talking 400 files and tens of thousands of lines of internal chat logs written in Russian. The internal communication files include messages that run from January 2021 to February 27 of this year.

    Conti announced on February 25 that it was giving its "full support" to Russia's attack on Ukraine, adding the threat that, "If anybody will decide to organize a cyberattack or any war activities against Russia, we are going to use our all possible resources to strike back at the critical infrastructures of an enemy."

    Continue reading

Biting the hand that feeds IT © 1998–2022