ATTACKER BEHAVIOR

Over the past years, cybercrime has become highly differentiated and professionalized with a vast ‘underground’ (illegal) market that supplies various services required for an attack (Franklin et al., 2007).

The division of labor can be illustrated with Zeus, an effective financial malware that caused considerable damage. It was coded by competent programmers that sold it as a do-it-yourself (DIY) kit for several thousand dollars (Riccardi et al., 2013). Fraudsters customized the malware and distributed it to their victims by either renting spamming services, directly deploying it via ‘pay-per-install’ services, or via other methods. After the malware was distributed the attackers waited for victims and eventually managed to steal money and move it into other accounts. Finally, the money needed to be cashed out without leaving a trail. This was done using people known as ‘money mules’. Thus four major types of players were involved in Zeus even though the different roles may be carried out by vertically integrated players.

Cybercrime is also affected by the social relations among criminals. Because there is a risk of being cheated by a fellow criminal, Herley and Florencio (2010) argue that prices in the underground markets are driven down to reduce the risks for buyers. In turn, this makes it less attractive to offer valuable items and creates a cycle of decay. The authors suggest this leads to a two-tier structure with Internet relay chat (IRC) markets as the lower tier, filled with goods that are hard to monetize. Organization of criminal activities rather than ad hoc action is the route to profit. Repeated transactions also form a mechanism that incentivizes buyers and sellers to uphold their promises. Wondracek et al. (2010) looked at parts of the online adult industry employing practices that can be at best described as shady: acquiring traffic and infecting visitors for a fee.

Their measurements

showed that traffic brokers honored the amount and origin of traffic they were contracted for. Another mechanism, deployed in recent years on marketplaces active in the ‘dark web^,, consists of seller ratings (Christin, 2013). Similar to eBay, criminal buyers rate criminal sellers after a transaction; the reputation effect increases the incentives of criminals to stay honest. Despite these differences, both tiers of the underground market generate large negative externalities for society.

To be economically rational, the anticipated success rate and monetary value of an attack need to outweigh its costs. Florencio and Herley (2013b) use this insight to explain the large gap between potential and actual harm online - the fact that most users do not get their accounts hijacked despite using pet names and birthdates as passwords. Automating attacks to scale is hard because of user diversity; it is also hard to know in advance which users offer sufficient financial prospects to be worth an attack. Herley (2012) presents this as the reason why Nigerian scams - the prince with $5 million in dire need of your help - are so obvious. These scams are expensive to run and the attacker wants only the most gullible users. In short, many attacks cannot be made profitable on scale, which is one of the reasons why many doomsday scenarios did not unfold as predicted.

Focusing defender efforts on bottlenecks in the attacker monetization chain can be an ingenious way to reduce attacks. A monumental study has been the work of Levchenko et al. (2011) investigating the spam value chain. The team tracked a billion spam URLs and placed orders for the offerings (including Viagra). The study found that spammers fulfilled most purchases with real products (albeit generic versions). Interestingly, spammers refund unsatisfied customers to appease the scarcest resource in the spam value chain: the payment channel. Credit card companies put pressure on the acquiring banks who provide spammers with the ability to receive payments.

Such financial relationships are very hard to replace, much harder than the technical infrastructure used for spamming and rogue pharmacies. Spam can be sent extremely cheaply via botnets, making conversion rates as low as one in 12.5 million viable (Kanich et al., 2008). Other elements are also readily available. But setting up relations within a credit card network turns out to be a bottleneck, as it requires legal documents, fees and time. Astonishingly, 95 percent of spam-advertised sales used merchant services from a handful of banks. After the study was released, Pfizer and Microsoft, two big targets of spam-advertised goods, asked VISA and MasterCard to act against these banks. This made a detrimental blow to spam profitability and production globally (Thomas et al., 2015).

Obviously, criminals do not like getting caught and paying a fine or spending time in jail reduces profitability. Law enforcement has been traditionally weak in cyberspace due to crimes crossing jurisdictions. This is gradually changing and law enforcement agencies are ramping up efforts, as evidenced by multiple high-profile arrests in recent years (Krebs, 2011). Anderson et al. (2013) believe investing in law enforcement abilities to arrest cybercriminals to be very efficient, as many attacks are run by a small number of gangs.

13.7

<< | >>

↑

Source: Bauer J., Latzer M. (Eds.). Handbook on the Economics of the Internet. Edward Elgar,2016. — 603 p.. 2016

More economic literature on Economics.Studio

ATTACKER BEHAVIOR

More on the topic ATTACKER BEHAVIOR: