An Inquiry into the Nature and Causes of the Wealth of Internet

Miscreants

Outline

I. Introduction

II. Market Overview

III. Market Analysis

IV. Goods, Services, and Prices

V. Discussion

Introduction

• 7 months– 13 Million Messages, 2.4GBs of Information– IRC Network– Hacking for fun -> Hacking for Profit

• Reputation economy– Defacing web sites– Authoring viruses

• Cash economy– SPAM– Phishing– DDoS Extortion

Market Overview

• Dishonesty and Distrust in the Market– Buyers, Sellers– Participant Verification

• Market Activity– Advertisements

• Goods– Compromised Machines, Mass Email Lists

• Services– EFT, Spamming and Phishing for Hire

– Sensitive Data

Market Analysis

• Credit Card Data– Valid Cards: 402 Unique/day

• *Based on Luhn Check

• Financial Data– Difficult to validate, trivial to fake

• Identity Data– SS#: 18.6 Unique/day

• SS# is sufficient to steal an identity

• On average, credit/debit fraud 427.50/card

Market Analysis

• 19,000 Unique Messages / Day

• IRC Nick– 553 new/day

• Most last less than 40 minutes

• IRC Bots– !chk <cc#>– !cclimit <cc#>

Goods, Services, and Prices

• Hacking Related– Most common: Compromised Hosts account for

68.4% of sales ad’s– Hacked hosts and root accounts only account for

5.39% of sales ad’s

• Spam and Phishing Tools– Bulk Email Lists and Vulnerable Web Email Forms

(for email injection attacks)

• Online Credentials and Sensitive Data– Fresh Credit Card Data, Account Information

Goods, Services, and Prices

• Services– Cashier– Confirmers– DoS

• Cost of Compromised Host 2$-25$

Quick Facts from 2006 Internet Crime Report

• In 2006, IC3 processed more than 200,481 complaints – IC3 referred 86,279 complaints of crime to federal,

state, and local law enforcement agencies around the country for further consideration

• Internet auction fraud was by far the most reported offense, comprising 44.9%

• Among perpetrators, 75.2% were male • Among complainants, 61.2% were male• Electronic mail (e-mail) (73.9%) and webpages

(36.0%) were the two primary mechanisms

•http://www.ic3.gov/media/annualreport/2006_IC3Report.pdf

Discussion

• How do you counter this market?