Botnet economy runs wild

There's no recession in the cybercrime business

San Francisco -- Cybercriminals have created a global business with a supply chain every bit as organized and sophisticated as that of any legitimate business. The difference is that cybercrime takes advantage of unsuspecting consumers and insecure businesses to steal untold amounts of money.

According to security experts and spam fighters speaking at a panel discussion on Wednesday at the RSA Conference, the modern, online criminal ecosystem starts with botnets, which are consumer or college PCs that have been taken over by hackers. A cybercriminal can easily go online and buy a bot-herd. In fact, Joe St. Sauver, manager of security programs at the Internet2 networking consortium and the University of Oregon, said there are 5 million to 5.5 million botnets in active rotation at any time.

Of course, cybercriminals need only a few hundred spambots to send out millions of spam e-mails. Today, a cybercriminal can hire programmers to come up with the latest and greatest types of spam, such as image spam or spam put into PDF attachments. Spammers send test runs through ISPs to see what types of spam get through the easiest, said Larry (who refused to disclose his last name) from the spam-fighting SpamHaus Project.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

San Francisco -- Cybercriminals have created a global business with a supply chain every bit as organized and sophisticated as that of any legitimate business. The difference is that cybercrime takes advantage of unsuspecting consumers and insecure businesses to steal untold amounts of money.

According to security experts and spam fighters speaking at a panel discussion on Wednesday at the RSA Conference, the modern, online criminal ecosystem starts with botnets, which are consumer or college PCs that have been taken over by hackers. A cybercriminal can easily go online and buy a bot-herd. In fact, Joe St. Sauver, manager of security programs at the Internet2 networking consortium and the University of Oregon, said there are 5 million to 5.5 million botnets in active rotation at any time.

Of course, cybercriminals need only a few hundred spambots to send out millions of spam e-mails. Today, a cybercriminal can hire programmers to come up with the latest and greatest types of spam, such as image spam or spam put into PDF attachments. Spammers send test runs through ISPs to see what types of spam get through the easiest, said Larry (who refused to disclose his last name) from the spam-fighting SpamHaus Project.

The types of spam include the traditional "pump and dump" stock-manipulation spam, plus spam for a variety of products. Cybercriminals have become so good at it that they use phishing to fool customers into going to a fake pharmaceutical site and actually fulfill orders for drugs so they can get repeat business. Patrick Peterson of Cisco's IronPort division said this means the cybercriminals have a back-end ecosystem that takes orders, boxes up pills (which may or may not be the pills that the customer ordered) and sends a physical order to the customer.

Larry added that it's easy to get a list of e-mail addresses online. It's easy to get a "spam template"  that helps the cybercriminal create the spam message. And there's a program called darkmailer that combines the list of addresses, the spam message and a list of hacked machines. All the cybercriminal has to do is "hit a button," and the program does the rest. "It makes anybody a spammer," he said, adding that he's been fighting spam since he got his first spam message in 1994.

Larry pointed out that cybercriminals are hiring Web designers to create "spamertized" sites, which are the sites that one is redirected to if one clicks on a phishing spam. It's virtually impossible to track those phishing sites because they're usually hosted on a zombie site and the owner is an innocent consumer.

These days, spamertized sites are taken down quickly and are moved constantly, using what Larry called a "fast flux" proxy system. In other words, if the DNS address changes every five minutes, there's no way law enforcement can track down the owner of the phony site.

Larry Baldwin, chief forensics officer at myNetWatchman, said cybercriminals are moving away from targeting individual consumers and are going after larger data stores, using keyloggers to gain information about credit card numbers.