Inside the Global Hacker Service Economy

Gozi, MPACK, 76Service, iFrames - these are the new face of malware and identity theft. CSO follows a researcher behind the curtain of modern electronic crime.

By

September 01, 2007 — CSO — Editor's note: This article was originally written for CSO Magazine by Senior Editor Scott Berinato in September 2007. Online it first appeared on CIO.com, broken into several articles due to its length. We have reassembled the feature as it provides CSOonline readers with an unparalleled understanding of what security is up against.

By 2003, online banking was not yet ubiquitous but everyone could see that, eventually, it would be. Everyone includes Internet criminals, who by then had already built software capable of surreptitiously grabbing personal information from online forms, like the ones used for online banking. The first of these so-called form-grabbing Trojans was called Berbew.

Berbew’s creator is believed to be a VXer, or malware developer, named Smash, who rose to prominence by co-founding the IAACA—International Association for the Advancement of Criminal Activity–after the Feds busted up ShadowCrew, Smash’s previous hacking group.

Berbew was wildly effective. Lance James, a researcher with Secure Science Corp., believes it operated undetected for as long as nine months and grabbed as much as 113GB of data—millions of personal credentials.

Inside an Identity Theft Site

A sophisticated new breed of online criminals is making it easier than ever for the bad guys to engage in identity theft and other cybercrime.

Like all exploits, Berbew was eventually detected and contained, but, as is customary with malware, strands of Berbew’s form-grabbing code were stitched into new Trojans that had adapted to defenses. The process is not unlike horticulturalists’ grafting pieces of one plant onto another in order to create hardier mums.

Thus, Berbew code reappeared in the Trojan A311-Death, and A311- Death in turn begat a pervasive lineage of malware called the Haxdoor family, authored by Corpse, who many believe was part of a well-known, successful hacking group called the HangUp Team, based in the port city of Archangelsk, Russia, where the Dvina River empties into the White Sea, near the Arctic Circle.

By 2006, online banking was ubiquitous and form-grabbers had been refined into remarkably efficient, multi-purpose bots. Corpse himself was peddling a sophisticated Haxdoor derivative called Nuclear Grabber for as much as $3,200 per copy. Nordea Bank in Sweden lost 8 million kronor ($1.1 million) because of it.

But by last October, despite his success, Corpse decided that it was time to lay low. A message appeared on a discussion board at pinch3.net, a site that sold yet another Haxdoor relative called pinch.

“Corpse does cease development spyware? news not new, but many do not know” reads a post by “sash” translated using Babelfish. It then quotes Corpse: “I declare about the official curtailment of my activity of that connected with troyanami [trojans]”

This past January, a reporter for Computer Sweden chatted with Corpse, pretending to be a potential customer. Corpse tried to sell him Nuclear Grabber for $3,000 and crowed that banks sweep 99 percent of online fraud cases under the rug. After Computerworld Australia published the chat, Corpse disappeared. He hasn’t been heard from since.

But his form-grabbing code resurfaced, when a friend of Don Jackson asked Jackson to look at a file he found on his computer, as a favor.

That file led Jackson behind the curtain to find hacking with a level of sophistication he’d never seen before.

January: Discovery
Don Jackson is a security researcher for SecureWorks, one of dozens of boutique security firms that have emerged to deal with the inherently insecure, crime-ridden, ungovernable Internet. Jackson’s company and others like it usually sell security products, but their real value is in the research they do. With law enforcement overtaxed by and under-trained for electronic crime, these firms have become a primary source of intelligence on underground Internet activity and VXers’ latest innovations.

Seems like an expensive hobby for a small company but the expense associated with the hardcore intel and technically arduous research is more than paid for by its value as a marketing tool. Being the first to market, even when your product is bad news about security, wins press attention and, it’s hoped, customers. As such, the little security startups stock up on researchers like Jackson who have a working, or sometimes intimate, knowledge of the criminal hacker underground. All day, every day, security researchers at these small companies are dissecting malware that they discover, chatting with bad guys and poking around their domains.

Still, neither the sheer number of firms and jobs like Jackson’s created in the past five years, nor the fact that larger companies like Verizon, Symantec, IBM, and BT are acquiring those companies, are signs that the good guys are catching up. It’s more a sign of how much money can be made trying to catch up. Internet crime is profitable for everyone, except of course its victims.

Jackson’s friend was a victim, but of what he wasn’t sure. All he could say was that several of his online accounts had been hijacked and that a scan of his computer turned up a conspicuous executable, or exe, file, one that wasn’t detected as malware, but wasn’t recognized as something legitimate either. The friend asked Jackson if, as a favor, he’d take a look.

Jackson obliged and discovered that the file had been on the system since December 13, 2006, almost a month. If it turned out to be something new and malicious, then Jackson had discovered a 0-day exploit. It would be a publicity boon for SecureWorks.

Jackson downloaded the exe to a lab computer. “Generally, the exe is not all that exciting to researchers who see hundreds of samples each month,” says Jackson. “There are some exceptions.” This was not an exception. Jackson found a derivative of Corpse’s Haxdoor form grabber, just a new cultivar of an old species, albeit a reasonably well-crafted one Like several form grabbers before it, this one intercepted form data before it was SSL-encrypted, meaning that the little glowing lock in the corner of the browser, the one that online merchants will tell you ensures you that you’re on a safe page, meant nothing of the sort.

Jackson named his discovery after the transliteration of a Russian word he found inside the source code: Pesdato. Later, when he learned what that word meant in Padonki, a kind of Russian hacker slang, he changed its name, instead choosing the moniker of a cartoon character that he made up in grade school: Gozi.

RESOURCE CENTER