Cyber black markets at 'unprecedented' maturity levels: Juniper

• New research finds a mature economy mirroring innovation and growth of free market
• Disrupt economics of hacking to break value chains that drive successful attacks: Juniper

JUNIPER Networks said that cyber black markets have a mature economy with characteristics akin to those of a thriving metropolitan city, according to a new global report it sponsored which conducted by the Rand Corporation.
 
The report reveals several economic indicators that cyber black markets have reached unprecedented levels of maturity and growth, Juniper Networks said in a statement.
 
While there has been significant research measuring different parts of the hacker black markets, Rand’s report, Markets for Cybercrime Tools and Stolen Data: Hackers’ Bazaar, examines for the first time these markets in their entirety and applies economic analysis to better understand how they function.
 
Rand found significant levels of economic sophistication, reliability, accessibility and resilience in the products, distribution channels and actors involved in the black markets.
 
Rand’s report, confirmed by Juniper’s experience in the network security ecosystem, suggests the cyber black markets are a mature and growing multibillion-dollar economy with a robust infrastructure and social organisation.
 
It found these black markets, like any other economy, react to market forces like supply and demand, and continue to evolve.
 
“The security industry, government and legal communities must come together to establish new norms for how companies can more vigorously defend themselves against cyber-attacks,” said Nawaf Bitar, senior vice president and general manager of the security business at Juniper Networks.
 
“We must address the root cause behind the accelerated maturation of the cyber-crime market – the very economics that drive its success. By disrupting the economics of hacking, we can break the value chains that drive successful attacks.
 
“We must never lose the moral high ground, however, so we cannot go on the offensive and hack back, but we can no longer remain passive.
 
“By using forms of active defence such as intrusion deception we can identify, thwart and frustrate attackers,” he added.
 
Report highlights
 
Juniper Networks likens the hacker black markets to a thriving metropolitan city with diverse communities, industries and interactions.
 

• Storefronts – Like other forms of ecommerce, many data records, exploit kits and goods are bought and sold from storefronts – which can encompass everything from instant messaging chat channels and forums to sophisticated stores. Rand found some organisations can reach 70 to 80,000 people, with a global footprint that brings in hundreds of millions of dollars.

• Service economy – Rand found that not only goods, but criminal services are available for purchase. These tools, sold on the black market as traditional software or leased like any other managed service, can help enable the most unskilled hackers to launch fairly elaborate and advanced attacks. For example, Rand found botnets, which can be used to launch a Distributed Denial of Service (DDoS) attack, are sold for as low as US$50 for a 24-hour attack.

• Hierarchal society – Much like a legitimate business, Rand found it takes connections and relationships to move up the (cyber) food chain. Getting to the top requires personal connections and those at the top are making the lion’s share of the money.

• Rule of Law – There is indeed honour among thieves. Rand found many parts of the cyber black market are well structured, policed and have rules like a constitution. In addition, those who scam others are regularly banned or otherwise pushed off the market.

• Education and training – Rand identified widely available tools and resources on the black markets that teach criminals how to hack, including instructions for exploit kits and where to buy credit cards. This access to training has accelerated sophistication, a broader set of roles and has helped facilitate entry into the hacker economy.

• Currencies – Transactions in the cyber black markets are often conducted by means of digital currencies. Bitcoin, Pecunix, AlertPay, PPcoin, Litecoin, Feathercoin, and Bitcoin extensions such as Zerocoin are a few. Rand found many criminal sites are starting to accept only digital crypto currencies due to their anonymity and security characteristics.

• Diversity – While Rand found cybercriminals from China, Latin America and Eastern Europe are typically known for quantity in malware attacks, those from Russia tend to be thought of the leader in quality. Rand also found areas of expertise and focus among different countries. Many Vietnamese criminal groups, for example, mainly focus on e-commerce hacks. Cybercriminals from Russia, Romania, Lithuania and Ukraine focus on financial institutions. Many Chinese cybercriminals specialise in intellectual property. And US-based cybercriminals primarily target US-based financial systems. In addition to a diverse set of cybercriminals, Rand also found more cross-pollination between these groups than ever before.

• Criminals – Even the criminal cyber black market has criminals. Known as ‘rippers,’ these specific bad guys do not provide the goods or services they claim.

The research report Markets for Cybercrime Tools and Stolen Data: Hackers’ Bazaar is based on in-depth interviews conducted by Rand between October and December 2013, with global experts who are currently or formerly involved in the market, including academics, security researchers, reporters, security vendors and law enforcement.
 
Related Stories:
 
Exposed: Cybercrime-as-a-Service
 
Hacker economics: Three cost-effective ways to tackle them
 
Smarter, shadier and stealthier cyber-crime forces dramatic change
 
Cyber-attacks greater national threat than physical attacks: Survey

 
For more technology news and the latest updates, follow us on Twitter, LinkedIn or Like us on Facebook.