As cyber criminals devise ever-more sophisticated means to defraud unsuspecting users and businesses, the popular "cyber-crime-as-a-service" operating model is making it tougher for law enforcement agencies and security companies, and entrenching a division of labour among fraudsters.
This is according to Daniel Cohen, head of business development for EMC's security entity RSA in Israel. He describes the market as "mature" and outlines five pivotal aspects that are keeping cyber-crime-as-a-service thriving:
Credit cards still fair game
Cohen says, although financial institutions go to great lengths to educate consumers about credit card vigilance, while boosting security measures, the cards' popularity on the black market means fraudsters will continue looking to cash-in for as long as possible.
"Cards are still a top commodity and, depending on how difficult it is to get information from certain countries, they can still fetch up to $250. But once people buy the stolen card details, they still need someone else to cash out whatever money may be available if that is their preferred option. Other players in the market continue to provide that service."
Good customer service
Like their counterparts in the legitimate retail sector, some cyber criminals also aim to boost their business by ensuring as smooth and easy customer service as possible, according to Cohen. 'In one of our investigations, we found an Android app which allows users to login, browse and buy stolen credit card information. These kinds of apps are usually advertised on underground forums and are just another way fraudsters are trying to stay ahead of the pack."
Cohen adds some black market merchants will replace credit card details, if the one they sold ends up blocked before the buyer cashes in.
Flexible solutions
Once fraudsters get their hands on stolen card information, says Cohen, they go all out. "We've seen situations where criminals run call centre services for buyers of stolen card information. They then call the banks for you in an attempt to change the billing addresses when they have the necessary personal information."
He adds some services can call banks in foreign languages, where necessary. "Some of them even cater for specific accents; for example, if the card owner is from the southern parts of the US then the call centres would bear that in mind."
Test runs
In the case of attacks such as distributed denial of service (DDOS), Cohen notes a lot of cyber criminals offer free test runs, to prove authenticity of their skills as well as gain credibility underground. "A DDOS attack can cost as little as $5 to $10 for systems to be disrupted for an hour, but their test runs want to show buyers that it can be done."
Easy payments
A pivotal part of keeping the cycle of cyber crime going is the ability to make payments without hassles. "Some forums have started trading in their own e-currencies which can be redeemed for normal cash value. Crypto currencies are another decentralised and accessible means of exchanging money on these networks," Cohen says.
Share
