PandaLabs Uncovers Alarming Statistics on Cyber-Crime Black Market

Panda Security's anti-malware laboratory, has released an investigative report on the current cyber-crime black market. PandaLabs discovered a vast network selling stolen bank details along with other types of products in forums and more than 50 dedicated online stores. This is a rapidly growing industry and cyber-criminals are aiding and abetting each other's efforts to steal personal information for financial profit. After posing as a cyber-criminal to infiltrate the network, PandaLabs made some alarming discoveries which are available in the full report here: http://press.pandasecurity.com/usa/press-room/panda-white-paper/.

The cyber-crime black market, which has traditionally centered on distributing bank and credit card details stolen from users around the world, diversified its business model in 2010, and now sells a much broader range of hacked confidential information including bank credentials, log-ins, passwords, fake credit cards and more. But as openly available as this information is, PandaLabs discovered that it can only be accessed by personally contacting the hackers who are promoting their information for sale on forums and in chat rooms.

Making the Sale

By having access to bank credentials, criminals can easily defraud any bank or credit card account long before the hack is discovered. Alarmingly, this data can be purchased for as little as $2 per card, but this level does not provide additional information or verification of the account balance available. If the buyer wants a guarantee for the available credit line or bank balance, the price increases to $80 for smaller bank balances and upwards of $700 to access accounts with a guaranteed balance of $82,000.

Prices are higher if the accounts have a history of online shopping or use payment platforms such as PayPal. For a simple account without a guaranteed balance, PandaLabs found prices starting at $10 and increasing to $1,500 depending on the platform and the guarantee of available funds. Similarly, these cyber-criminals also offer cloned credit/debit cards (from $180), card cloning machines ($200-1,000), and even fake ATM machines (from $3,500 depending on the model). Additional products such as money laundering services (bank transfers or cashing checks) are available for a commission ranging from 10 to 40 percent of the operation. If buyers want to use stolen bank details to buy products online, but are wary of being traced through the delivery address, the cyber-criminals will make the purchase and forward the goods for a fee of between $30 and $300 (depending on the chosen product).

For more sophisticated cyber-criminals who want to set up their own fake online stores and use rogueware techniques to obtain both user details and also reap the money these unsuspecting victims pay for fake antivirus products, there are also teams available to deliver turnkey projects, design, develop and publish the complete store, even positioning it in search engines. In this case, the price depends on the project.

Prices for botnet rental for sending spam (using bot-infected zombie computers, for example) vary depending on the number of computers used and the frequency of the spam, or the rental period. Prices start at $15 and rise to $20 for the rental of a SMTP server or VPN to guarantee anonymity.

Big Business

This cyber-criminal black market caters to buyers' needs just as any other business, and functions in similar ways. Since there is a great deal of competition in this industry, the rule of supply and demand ensures that prices are competitive, and operators even offer bulk discounts to higher-volume buyers. They will offer free 'trial' access to stolen bank or credit card details, as well as money back guarantees and free exchanges.  

However, since it is a black market, there are clearly many areas that differ from traditional business. Since anonymity is of the utmost importance, many sellers use underground forums to keep out of sight. Their offices are effectively the Internet, though they even go as far as advertising their 'office hours.' Some are more brazen about their activities, and have accounts on Facebook and Twitter which they use as shop windows. To ensure anonymity, contact is always made across instant messaging applications or free, generic email accounts.

Once contact is made, the transaction can be executed directly or through a website set up by the seller, using a username and password, which as with any online store, allows buyers to browse and fill their "shopping cart." Payment is always made up-front using services such as Western Union, Liberty Reserve and WebMoney.

More information is available in the PandaLabs Blog.

About PandaLabs

Since 1990, PandaLabs, the malware research division of Panda Security, has led the industry in detecting, classifying and protecting consumers and businesses against new cyber threats. At the core of the operation is Collective Intelligence, a proprietary system that provides real-time protection by harnessing Panda's community of users to automatically detect, analyze, classify and disinfect more than 63,000 new malware samples daily. The automated classification is complemented by a highly specialized global team of threat analysts, each focused on a specific type of malware, such as viruses, Trojans, worms, spyware and other exploits, to ensure around-the-clock protection. Learn more about PandaLabs and subscribe to the PandaLabs blog at http://www.pandalabs.com. Follow Panda on Twitter: http://twitter.com/Panda_Security and Facebook:http://www.facebook.com/PandaUSA. 

SOURCE Panda Security

www.ePINDebit.com www.e-PINDebit.com www.iPINDebit.com www.PINDebit.mobi

Related articles

• Experts warn of global black market in stolen bank details (v3.co.uk)

Panda Security Study Proves Most Small and Mid-Sized Businesses in the Fog About Online Fraud

ORLANDO, Fla., April 22 /PRNewswire/ -- Despite highly publicized cybercriminal attacks against businesses and the ongoing rise of malware perpetrated through schemes such as the Mariposa botnet recently dismantled by Panda Securityand others, the majority of small and medium-sized businesses (SMBs) are not familiar with the banking Trojans used to attain access to and steal from their online accounts. In addition, 11 percent of SMBs reported experiencing at least one incident of online fraud (graphic: http://bit.ly/966qS2). These statistics are some of the key findings from an independent survey released today by Panda Security of more than 300 executives and finance professionals from SMBs across 38 industry sectors in the United States.(1)

Panda Internet Security Now Available in Target Stores Nationwide

"Our agreement with Target serves as further recognition that Panda Security is strengthening its position as a household brand in the U.S."   The Panda Internet Security suite is a comprehensive security solution for consumers that protects against viruses, spyware, rootkits, hackers, online fraud , identity...

Conducted throughout January 2010, the study found that 52 percent of those surveyed had little or no familiarity with banking Trojans, the criminal software used to facilitate unauthorized access to a user's online banking account. Despite the lack of understanding about malware threats, the majority of respondents (63 percent) remain concerned about online banking fraud or identity theft in their organizations.

The study also revealed a big gap between what businesses expect in the way of reimbursement from banks resulting from online fraud versus what funds are actually returned. Sixty-three percent said they strongly or somewhat believed their bank would return all of the funds to their possession. In stark contrast to this perception, only 37 percent of the victims said all of the stolen funds were actually returned. A graphic of this statistic is available here: http://bit.ly/bYFRCz.

"While online banking security is a general concern among most SMBs, most of them have little knowledge about the specific threats targeting organizations of their size," said Sean-Paul Correll, threat researcher at PandaLabs. "In addition, U.S. law puts the burden on business owners for keeping funds secure, rather than the banks. The majority of SMBs surveyed weren't aware of this fact, which means they are operating with a false sense of security."

Throughout 2009 and into 2010, mainstream publications such as USA Today and the Washington Post have reported extensively on the surge of targeted attacks against SMBs, where banking Trojans are used by cybercriminals to gain access to their highly attractive and often more vulnerable online bank accounts. These organizations, which range in size from 1 to 500 employees, typically have fewer in-house resources and budgets for IT security, placing them at greater risk of attack. Sophisticated banking Trojans such as URLZone enable cybercriminals to access the accounts, potentially resulting in a single SMB losing thousands, if not hundreds of thousands of dollars. Furthermore, destructive zombie armies, such as the Mariposa botnet that Panda recently helped shut down in an international coordinated effort with IT security firm Defence Intelligence, Spanish Guardia Civil and the FBI, continue to steal banking credentials at alarming rates.  

Additional key findings from the study include:

• 58 percent of respondents do not have insurance to protect their business from banking fraud or identity theft, or are unsure if they have any protections in place


• 64 percent of respondents have protective and/or procedural methods in place at their organizations to detect or prevent online banking fraud


• 15 percent of respondents have not updated security software on all systems where online transactions are conducted or are unsure of the status of their security software altogether

To download the survey, go to: http://www.pandasecurity.com/homeusers/downloads/white-papers/.  In addition, small business owners who feel their systems have been compromised, or who would like to learn more about the SMB study, should visit: http://us.pandasecurity.com/criticalalert/ for additional support from a Panda Security professional.

According to the study, 71 percent of SMBs are at least somewhat likely to implement new protective or procedural methods in the future to prevent online banking fraud. Panda Cloud Protection, Panda Security's hosted security service for endpoints and email, offers businesses the most proactive, lightweight and easy to manage protection against the threat of banking Trojans and online fraud. Managed through a central Web console that eliminates the need for IT infrastructure investment, Panda Cloud Protection can be administered internally or via an outside services provider. Like all other Panda Security products, Panda Cloud Protection utilizes the company's Collective Intelligence technology to protect businesses against the latest threats instantaneously via the cloud. To learn more about Panda Security's full suite of security solutions for businesses, please visit http://www.pandasecurity.com/usa/enterprise/.

About Panda Security

Founded in 1990, Panda Security is the world's leading provider of cloud-based security solutions, with products available in more than 23 languages and millions of users located in 195 countries around the world. Panda Security was the first IT security company to harness the power of cloud computing with its Collective Intelligence technology. This innovative security model can automatically analyze and classify thousands of new malware samples every day, guaranteeing corporate customers and home users the most effective protection against Internet threats with minimum impact on system performance. Panda Security has 56 offices throughout the globe with US headquarters in Florida and European headquarters in Spain.

Panda Security collaborates with Special Olympics, WWF and Invest for Children as part of its Corporate Social Responsibility policy.

For more information, visit http://www.pandasecurity.com/.

(1) The random survey was conducted by Conduit Systems, LLC on behalf of Panda Security in January 2010 among non-users of Panda solutions.

The sample size and distribution was 307 U.S. executives and financial managers across 38 industries in companies with fewer than 500 employees.

The survey was carried out online, through prior invitation via e-mail.

Sample error: Sampling error calculation has been based on p=q=0.5 for a confidence level of 95%.

SOURCE Panda Security

Panda Security Study Proves Most Small and Mid-Sized Businesses in the Fog About Online Fraud

ORLANDO, Fla., April 22 /PRNewswire/ -- Despite highly publicized cybercriminal attacks against businesses and the ongoing rise of malware perpetrated through schemes such as the Mariposa botnet recently dismantled by Panda Securityand others, the majority of small and medium-sized businesses (SMBs) are not familiar with the banking Trojans used to attain access to and steal from their online accounts. In addition, 11 percent of SMBs reported experiencing at least one incident of online fraud (graphic: http://bit.ly/966qS2). These statistics are some of the key findings from an independent survey released today by Panda Security of more than 300 executives and finance professionals from SMBs across 38 industry sectors in the United States.(1)

Panda Internet Security Now Available in Target Stores Nationwide

"Our agreement with Target serves as further recognition that Panda Security is strengthening its position as a household brand in the U.S."   The Panda Internet Security suite is a comprehensive security solution for consumers that protects against viruses, spyware, rootkits, hackers, online fraud , identity...

Conducted throughout January 2010, the study found that 52 percent of those surveyed had little or no familiarity with banking Trojans, the criminal software used to facilitate unauthorized access to a user's online banking account. Despite the lack of understanding about malware threats, the majority of respondents (63 percent) remain concerned about online banking fraud or identity theft in their organizations.

The study also revealed a big gap between what businesses expect in the way of reimbursement from banks resulting from online fraud versus what funds are actually returned. Sixty-three percent said they strongly or somewhat believed their bank would return all of the funds to their possession. In stark contrast to this perception, only 37 percent of the victims said all of the stolen funds were actually returned. A graphic of this statistic is available here: http://bit.ly/bYFRCz.

"While online banking security is a general concern among most SMBs, most of them have little knowledge about the specific threats targeting organizations of their size," said Sean-Paul Correll, threat researcher at PandaLabs. "In addition, U.S. law puts the burden on business owners for keeping funds secure, rather than the banks. The majority of SMBs surveyed weren't aware of this fact, which means they are operating with a false sense of security."

Throughout 2009 and into 2010, mainstream publications such as USA Today and the Washington Post have reported extensively on the surge of targeted attacks against SMBs, where banking Trojans are used by cybercriminals to gain access to their highly attractive and often more vulnerable online bank accounts. These organizations, which range in size from 1 to 500 employees, typically have fewer in-house resources and budgets for IT security, placing them at greater risk of attack. Sophisticated banking Trojans such as URLZone enable cybercriminals to access the accounts, potentially resulting in a single SMB losing thousands, if not hundreds of thousands of dollars. Furthermore, destructive zombie armies, such as the Mariposa botnet that Panda recently helped shut down in an international coordinated effort with IT security firm Defence Intelligence, Spanish Guardia Civil and the FBI, continue to steal banking credentials at alarming rates.  

Additional key findings from the study include:

• 58 percent of respondents do not have insurance to protect their business from banking fraud or identity theft, or are unsure if they have any protections in place


• 64 percent of respondents have protective and/or procedural methods in place at their organizations to detect or prevent online banking fraud


• 15 percent of respondents have not updated security software on all systems where online transactions are conducted or are unsure of the status of their security software altogether

To download the survey, go to: http://www.pandasecurity.com/homeusers/downloads/white-papers/.  In addition, small business owners who feel their systems have been compromised, or who would like to learn more about the SMB study, should visit: http://us.pandasecurity.com/criticalalert/ for additional support from a Panda Security professional.

According to the study, 71 percent of SMBs are at least somewhat likely to implement new protective or procedural methods in the future to prevent online banking fraud. Panda Cloud Protection, Panda Security's hosted security service for endpoints and email, offers businesses the most proactive, lightweight and easy to manage protection against the threat of banking Trojans and online fraud. Managed through a central Web console that eliminates the need for IT infrastructure investment, Panda Cloud Protection can be administered internally or via an outside services provider. Like all other Panda Security products, Panda Cloud Protection utilizes the company's Collective Intelligence technology to protect businesses against the latest threats instantaneously via the cloud. To learn more about Panda Security's full suite of security solutions for businesses, please visit http://www.pandasecurity.com/usa/enterprise/.

About Panda Security

Founded in 1990, Panda Security is the world's leading provider of cloud-based security solutions, with products available in more than 23 languages and millions of users located in 195 countries around the world. Panda Security was the first IT security company to harness the power of cloud computing with its Collective Intelligence technology. This innovative security model can automatically analyze and classify thousands of new malware samples every day, guaranteeing corporate customers and home users the most effective protection against Internet threats with minimum impact on system performance. Panda Security has 56 offices throughout the globe with US headquarters in Florida and European headquarters in Spain.

Panda Security collaborates with Special Olympics, WWF and Invest for Children as part of its Corporate Social Responsibility policy.

For more information, visit http://www.pandasecurity.com/.

(1) The random survey was conducted by Conduit Systems, LLC on behalf of Panda Security in January 2010 among non-users of Panda solutions.

The sample size and distribution was 307 U.S. executives and financial managers across 38 industries in companies with fewer than 500 employees.

The survey was carried out online, through prior invitation via e-mail.

Sample error: Sampling error calculation has been based on p=q=0.5 for a confidence level of 95%.

SOURCE Panda Security