Slashdot Mirror
Hackers Offer Subscription, Support for Malware
Stony Stevenson writes "Organised gangs are taking a page out of security vendors' books and setting up their own websites that offer support and subscriptions for malware and spyware. From the article: 'For subscriptions starting as low as $20 per month, enterprises can sell fully managed exploit engines that spyware distributors and spammers can use to infiltrate systems worldwide, said Gunter Ollmann, director of security strategies at IBM's ISS X-Force team. Many exploit providers simply wait for Microsoft's monthly patches, which they then reverse engineer to develop new exploit code against the disclosed vulnerabilities, Ollmann said. "Then all you've got to do is just subscribe to them on a monthly basis.'"
When I first read the title, I thought it meant that hackers were now selling "protection" from malware in much the same way organized gangs have sold "protection" in the past. Perhaps a better title would be "Hackers organize, sell exploits as business"
Couldn't they make more money by offering a 'Patch Wednesday' kind of service which updated Microsoft products and protected against the next round of vulnerabilities? Seeing as no one else is able to do this there's a very obvious gap in the market here for someone who knows a bit about exploiting MS products!
...then kill them.
Erm, if you're daft enough to sign up and give them your credit card details directly, doesn't that mean they no longer need bother writing the malware?
When I saw the summary, I was half-certain it had to be a delayed April 1 submission. Then I looked at the article. And thought about it.
It actually fits a pattern we've seen with viruses, trojans, spyware, other malware, cracking, even spam. They've gone from small shops, often one programmer trying to make a name for himself, to full-on organized crime using businesslike structures and tactics.
How long before we see a defection and find out that N.Korea or some other evil empire's government is sponsoring this type of activity. All that malware out there isn't just annoying you with spam, a lot of it is trying industrial espionage.
Support NYCountryLawyer RIAA vs People
$20? What a rip off. I get the latest malware and spyware for free every day courtesy of my coworkers.
The next step is obviously to protect their IP, so look for patents such as:
:)
"a method of injecting code into a web-browser to steal credit card details.... on the internet"
"a method of using many remote controlled computer's, without the owners express consent* to send unwanted advertising material, to many, many people... on the internet"
After that expect to see Exploit Genuine Advantage programs to ensure that the stolen data you are using is from genuinely advantageous exploits, and not from some half baked knock off malware or virus, duplicated by a disreputable individual.
Obviously the last step will be the mergers, (after all the above should ensure a profitable market is created and grows). Symantec will merge with EvilCode PLC, to produce Evil-Symantec, McAfee will merge with McNasty, to produce McNastfee. These new entities will be able to leverage both the illegal exploit market and provide protection services simultaneously, probably all in one product... , Finally Microsoft will change its OS so that it no longer "works" with all these wondrous exploits and... hell will freeze over
The site they're writing about, found by searching with Google for phrases in the article, isn't quite what the article says it is.
It's really yet another slimy "affiliate" program. "We give our code to your and you need to setup it to your websites. We pay for installs and for trusted webmasters for traffic if they want that." They're not selling malware with support. They're buying traffic to install their malware via drive-by installs. That's not exactly new. CometCursor, BonzaiBuddy, and Zango come to mind.
From the original article, someone else may be selling "fully managed exploit engines", but it's not these guys.
ie isn't a virus development tool. It's just an installer.
Help stamp out iliturcy.