Tài liệu ITU Study on the Financial Aspects of Network Security: Malware and Spam doc

LINK DOWNLOAD MIỄN PHÍ TÀI LIỆU "Tài liệu ITU Study on the Financial Aspects of Network Security: Malware and Spam doc": http://123doc.vn/document/1035408-tai-lieu-itu-study-on-the-financial-aspects-of-network-security-malware-and-spam-doc.htm

ITU Study on the Financial Aspects of Network Security:
Malware and Spam
i

EXECUTIVE SUMMARY
Measures to improve information security enhance trust in online activities and contribute directly and
indirectly to the welfare gains associated with the use of information and communication technologies
(ICTs). However, some expenditure on security is only necessary because of relentless attacks by
fraudsters and cybercriminals that undermine and threaten trust in online transactions. Such costs are
not welfare-enhancing but a burden on society. Two vectors through which such attacks are carried
out are malware and spam.
Malware is a summary term for different forms of malevolent software designed to infiltrate and infect
computers, typically without the knowledge of the owner. During the past two decades, the production
and dissemination of malware has grown into a multibillion dollar business. Damages created by
fraudulent and criminal activities using malware and the costs of preventative measures are likely to
exceed that number significantly. Malware puts the private and the public sector at risk because both
increasingly rely on the value net of information services.
Until a few years ago, the most common types of malware were viruses and worms. More recently,
other kinds have appeared and are widely distributed, including trojan horses, backdoors, keystroke
loggers, rootkits, and spyware. Whereas spam and malware were hitherto relatively separable
problems they are presently converging with the emergence of botnets. These networks of remote-
controlled malware-infected computers are the origin of the majority of spam messages but they are
also sustained and extended through spam.
Spam and malware have multifaceted financial implications on the costs and the revenues of
participants in the ICT value chain. Costs of all stakeholders across the value network of information
services, such as software vendors, network operators, Internet Service Providers (ISPs), and users, are
affected directly and indirectly. Cost impacts may include, but are not limited to, the costs of
preventative measures, the costs of remediation, the costs of bandwidth and equipment, and the
opportunity costs of congestion.
Activities associated with spam and malware also generate various revenue streams. Fraudulent and
possibly criminal revenues include the renting out of botnets, bullet proof hosting services,
commissions on spam-induced sales, and stock price manipulation schemes. At the same time, spam
and malware provide legal business opportunities including anti-virus and anti-spam products,
investment to improve the resilience of infrastructure, and bandwidth. Because of this broad range of
financial implications, spam and malware create mixed and sometimes conflicting incentives for
stakeholders. Consequently, coherent responses to the problem are complicated.
During the past few years, the generation, distribution, and use of malware have increasingly become
organized as illegal business activities. Participants in the underground malware economy will pursue
their activities as long as the benefits of semi-legal and illegal activities outweigh the costs of these
activities, including the expected costs of sanctions. Due to the factors discussed in this report, the
economic incentives to expand cybercriminal activity continue to be strong.
Malware and spam are associated with a web of financial flows between the main groups of
stakeholders in the information and communication value net. The development of accurate measures
of these flows is complicated by the large number of legal and illegal players and the elusive nature of
some of the transactions. Most of the financial flows between the legal and illegal players in the
underground cybercrime economy, for example, are not or only partially known.
This report develops a framework within which these financial impacts can be assessed and brings
together the many disparate sources of financial data on malware and spam. The following points
summarize key findings:

Financial aspects of network security:
Malware and Spam
ii
• Estimates of the financial effects of malware differ widely. Figures for overall effects range from
US$ 13.2 billion of direct damages for the global economy (in 2006) to US$ 67.2 billion in direct
and indirect effects on U.S. businesses alone (in 2005).
• In a survey of its members, the Computer Security Institute (CSI) estimated the loss caused by
cybersecurity breaches per responding firm to US$ 345,000 in 2006. This number is most likely
not representative for businesses in general due to the unique membership of CSI. The 2006
number is considerably lower than its peak in 2001 but more than double the 2005 level.
• Consumer Reports estimated the direct costs to U.S. consumers of damages experienced due to
malware and spam to US$ 7.1 billion in 2007.
• One estimate put the global cost of spam in 2007 at US$ 100 billion and the respective cost for the
U.S. at US$ 35 billion. Another study found that the cost of spam management in the U.S. alone
amounted to US$ 71 billion in 2007.
• In 2007, the costs of click fraud in the U.S. were estimated to be nearly US$ 1 billion.
• Numbers documenting the magnitude of the underground Internet economy and transactions
between it and the formal economy also vary widely. One source estimates the worldwide
underground economy at US$ 105 billion.
• No reliable numbers exist as to the potential opportunity costs to society at large due to reduced
trust and the associated slower acceptance of productivity-enhancing IT applications. However, a
considerable share of users expressed concern and indicated that it reduces their willingness to
perform online transactions.
Although the financial aspects of malware and spam are increasingly documented, serious gaps and
inconsistencies exist in the available information. This sketchy information base also complicates
finding meaningful and effective responses. For this reason, more systematic efforts to gather more
reliable information would be highly desirable.

ITU Study on the Financial Aspects of Network Security:
Malware and Spam
www.itu.int/ITU-D/cyb/cybersecurity/docs/itu-study-financial-aspects-of-malware-and-spam.pdf
1
1. INTRODUCTION
Measures to increase information security enhance trust in online activities, contributing
directly and indirectly to the welfare gains associated with the more intense use of
information and communication technologies (ICTs). As trust probably benefits society at
large, efforts to increase information security may generate positive externalities, spill-overs
that not only benefit the investor in security but a sector or even the economy as a whole. An
optimal level of security is reached when the direct and indirect benefits of additional security
approximate the additional costs of security. Because security is costly, it is rational to
tolerate a certain level of insecurity. The cost of security is, however, greatly increased for all
stakeholders because of relentless assault by fraudsters and cybercriminals. Two forms of
attack that are gaining notoriety are malware and spam. Their financial effects are the focus
of this report.
Malware is a summary term for different forms of malevolent software that are designed to
infiltrate and infect computers, typically without the knowledge of the owner. During the past
two decades, the production and dissemination of malware grew into a multibillion dollar
business. As the discussion in sections 5 and 6 below illustrates, the direct and indirect costs
of fraudulent and criminal activities using malware likely exceed that number significantly.
Malware puts both the private and the public sectors at risk because both increasingly rely on
the value net of information services. All stakeholders across the value network of
information services, such as software vendors, network operators, Internet Service Providers
(ISPs), and users, are affected by malware and spam. A response to malware and spam is
complicated by the fact that spam and malware not only cause costs but also generate new
business opportunities and revenue streams. Cost impacts include, but are not limited to, the
costs of preventative measures, direct and indirect damages, the costs of remediation,
infrastructure costs, and the opportunity costs of congestion. Business opportunities
associated with malware and spam include anti-virus and anti-spam products, new and
enhanced security services, and additional infrastructure investment in equipment and
bandwidth.
Malware has also spawned operations in a legally gray zone in which a legal and illegal
economy overlap. Such semi-legal activities include spam-induced sales, bullet-proof
Internet hosting, or pump and dump stock schemes. Moreover, malware is generated in and
fuels a sizeable underground economy. Such illegal activities include the herding and renting
out of botnets, different forms of fraud, and cybercrime. Some of the revenues generated in
this underground economy are laundered and injected in the legal economy. This mesh of
legal, semi-legal and illegal activities creates mixed and even conflicting incentives for
individual stakeholders. Furthermore, it complicates coherent policy responses to the
problem.
Until recently, spam and malware could be considered as two separate problems. However,
due to the emergence and growth of botnets they are increasingly overlapping and
converging. Botnets are networks of malware-infected computers. They are both the origin
of the majority of spam messages but are also sustained and extended through spam.
1

Whereas it is fairly safe to claim that malware and spam have negative effects on the ICT
value net in the aggregate individual stakeholders are not affected equally and not all are
impeded by malware.



1
See http://www.itu.int/ITU-D/cyb/cybersecurity/projects/botnet.html and FTC, Spam Summit: The Next
Generation of Threats, Washington, D.C.: Federal Trade Commission, November 2007.


2 ITU Study on the Financial Aspects of Network Security:
Malware and Spam
www.itu.int/ITU-D/cyb/cybersecurity/docs/itu-study-financial-aspects-of-malware-and-spam.pdf

For example, security service providers create business activities from malware. Financial
service providers have to weigh the benefits of enhanced security against the potential
negative effects on online banking and the efficiency gains associated with it. As they
experience costs and benefits differently, stakeholder will adopt a range of responses to the
threats depending on their perceived individual costs and benefits but not necessarily based on
social costs and benefits. As long as these different responses contribute to improvements
overall, they are not problematic. However, if they are at cross purposes, they may aggravate
the problems caused by malware. Recent studies of stakeholder incentives and the economics
of security showed many instances in which the public interest and individual responses were
aligned but also others where they were not.
2

Reliable empirical information on the operational and financial aspects of malware and spam
is difficult to come by. Many of the available estimates of attack trends and damages are
provided by security service providers. While certainly useful, indeed these are often the only
available figures, they need to be considered within this context as security service providers
may have incentives to over- rather than underestimate security problems. Other information
is considered proprietary or only reported if the damage exceeds a certain threshold. The
purpose of this study is to sort through the available data and to document the state of
knowledge on the financial effects of malware and spam. Where financial information is not
available, we attempted to provide operational data if they allowed a provisional glance at the
magnitude of a problem.
Given resource and time constraints, the study could not collect original data but had to focus
on existing sources, pulling together scattered and scarce information resources. This report
also develops an analytical framework, synthesizes, and where possible integrates,
fragmented existing knowledge. We also point to gaps in the data that ideally would be filled
in future efforts to support the design of better counter-measures against spam and malware.
The next section briefly discusses the problem of malware and the subsequent one gives a
short overview of fraudulent and criminal business activities. Section four reviews the
available empirical evidence on the financial effects of malware and section five the
information base regarding spam. The concluding section is a first attempt at an overall
assessment of the welfare effects of spam and malware.

2. THE PROBLEM OF MALWARE
Until a few years ago, the most common types of malware were viruses and worms. More
recently other types appeared and are widely distributed, including trojan horses, backdoors,
keystroke loggers, rootkits, and spyware. These terms correspond to the functionality and
behavior of the malware. For instance, a virus is self-propagating and a worm is self-
replicating. Malware is often categorized into “families” (referring to a particular type of
malware with unique characteristics) and “variants” (usually a different version of code in a



2
See M. J. G. van Eeten, J. M. Bauer with contributions by M. de Bruijne, J. P. Groenewegen, and W.
Lemstra, Economics of Malware: Security Decisions, Incentives, and Externalities, , OECD STI Working
Paper 2008/1 JT03246705, Paris, OECD, 2008, available online at
http://www.oecd.org/dataoecd/53/17/40722462.pdf
. See also R. Anderson, R. Böhme, R. Clayton, and
T. Moore, Security Economics and the Internal Market, Study for the European Network and Security
Information Agency (ENISA), March 2008, available at
http://www.enisa.europa.eu/pages/analys_barr_incent_for_nis_20080306.htm
.

ITU Study on the Financial Aspects of Network Security:
Malware and Spam
www.itu.int/ITU-D/cyb/cybersecurity/docs/itu-study-financial-aspects-of-malware-and-spam.pdf
3
particular family). Malware is put in an information system
3
to cause harm to that system or
other systems, or to subvert them for use other than that intended by their owners.

2.1. Functioning of Malware
There are two principal ways by which malware can be inserted into information systems to
carry out the malicious player’s goal. One option is an automated installation and the other is
manual installation. Malware compromises the system and may download additional payload
code to expand or update its functionality. Once installed, new features and capabilities are
therefore easily added.
4

Malware can be used to distribute spam and to support criminal activities including those
based on spam. It can be used to infect systems to gain remote access for the purpose of
sending data from that system to a third party without the owner’s permission or knowledge.
Malware can be instructed to hide that the information system has been compromised, to
disable security measures, to damage the information system, or to otherwise affect the data
and system integrity. Sometimes it uses encryption to avoid detection or conceal its means of
operation.
Acquiring malware is relatively easy and affordable, thus making it available to a wide a
variety of attackers. A flourishing underground economy exists for its sale and distribution.
Furthermore, current generations of malware are easier to tailor to specific purposes and
provide attackers with the capability to launch sophisticated attacks beyond their
programming skill level. At the same time, the latest generation of malware is increasingly
difficult to detect and remove. Variants of it are effective at defeating built-in information
security counter-measures. For example, some forms of malware can circumvent strong
forms of multi-factor authentication and others have been able to undermine the effectiveness
of digital certificates.
Malware not only affects personal computers but also servers. In 2007, Google estimated that
one in 10 web pages might serve malware to unsuspecting visitors.
5
Furthermore, experts
predict that malware will increasingly target mobile phones, personal digital assistants
(PDAs) and a wide range of other intelligent devices.

2.2. Fraudulent and criminal uses
Early generations of viruses and malware were written and distributed by hackers who sought
to enhance their “fame and glory.” During the past few years, considerable evidence points to
the fact that the generation, distribution and use of malware is driven predominantly by
economic interests.
6
Actors in the underground malware economy will continue to pursue



3
“Information systems” is a generic term referring to computers, communication facilities, computer and
communication networks, and data and information that may be stored, processed, retrieved or
transmitted by them, including programs, specification and procedures for their operation, use and
maintenance. See OECD, Guidelines for the Security of Information Systems and Networks, Paris
1992.
4
D. Danchev, “Malware–Future Trends,” January 31, 2006, p. 3, online at
http://www.linuxsecurity.com/docs/malware-trends.pdf
.
5
See http://news.bbc.co.uk/2/hi/technology/6645895.stm.
6
See Symantec Internet Security Threat Report, September 2007 available at
http://www.symantec.com/enterprise/theme.jsp?themeid=threatreport
; M. Schipka, “The Online Shadow
Economy: A Billon Dollar Market for Malware Authors,” White Paper, MessageLabs, 2007; ITU, Botnet


4 ITU Study on the Financial Aspects of Network Security:
Malware and Spam
www.itu.int/ITU-D/cyb/cybersecurity/docs/itu-study-financial-aspects-of-malware-and-spam.pdf

these activities, as long as benefits from semi-legal and illegal activities outweigh the costs of
these activities, including the expected costs of sanctions. Due to the relatively low cost of
launching fraudulent or criminal activities in cyberspace and the high potential gains, the
economic incentives to expand cyber criminal activity continue to be strong.
Malware, together with other cyber tools and techniques, provides a low cost, reusable
method of conducting cybercrime, much of it launched using unsolicited email messages. The
majority of spam originates from botnets. According to net security firm Marshal 85 percent
of botnet-originated spam comes from only six botnets, with two botnets (Srzibi and Rustock)
accounting for more than 60 percent of all spam launched this way.
7
Malware and spam can
be categorized in various ways, for example, by target (business or private individuals), by
method, and even by degree of legality (not all spam is per se illegal). A range of methods
can be used to reach different objectives. Forms of attacks on businesses include denying
access to critical information systems, conducting espionage, and extorting money (e.g.,
ransom). A main attack vector for individuals is the stealing information (e.g., identity theft)
but forms of extortion are also in use. The tools with which these goals are pursued include
Distributed Denial of Service (DDoS) attacks, click fraud, phishing, and many more.
Not all unsolicited email is necessarily illegal and/or unwanted by the recipient. Different
people have diverging views as to which information constitutes advertising as opposed to
unwanted information. Consequently, a precise definition of “spam” is impossible. Due to its
low cost, e-marketers will use email to advertise their products and services as long as a
sufficiently large share of recipients responds with purchases.
8
Spam has thus been defined as
“information pollution,” the “waste product of senders trying to reach those few recipients
who actually want what they [the e-marketers] are offering.”
9
The glut of information
generated by mass e-mail campaigns could therefore be seen as the result of a lack of
information about senders and recipients.
10
In contrast, “malicious spam” (or just “spam”) is
sent with explicit fraudulent or criminal intent. This differentiation is, for example, reflected
in the U.S. CAN-SPAM Act of 2003, which defines the characteristics of illegal activities but
continues to allow certain forms of electronic marketing.
11

Stealing financial and other personal information has been another prime goal of malware.
Over the past five years, information theft (and in particular online ID theft) has been an
increasing concern to business, governments, and individuals. Keyloggers and trojans are
used to collect personal information directly from infected machines. Botnets are used to host
phishing campaigns often using forms of social engineering to trick users into revealing
personal information.
Malware has also been implicated in click fraud, a technique relying on infected machines to
generate clicks on online advertisements. Online advertisers, such as Google AdSense,



Mitigation Tool Kit, November 2007; and R. Anderson, R. Böhme, R. Clayton and T. Moore,.Security
Economics, supra note 2.
7
See J. Leyden, “ Most Spam Comes from Only Six Botnets”, available at
http://www.theregister.co.uk/2008/02/29/botnet_spam_deluge/
; see also Panda Security, Annual Report
2007, available at
http://www.pandasecurity.com/resources/pro/02dw_Annual_Report_Pandalabs_2007.pdf.
8
M. Mangalindan, "Spam Queen: For Bulk E-mailer, Pestering Millions Offers Path to Profit", Wall Street
Journal, November 13, 2002, p. A1, argued that even response rates of 0.001 percent (that is, 1 in
100,000) could generate profits.
9
M. W. Van Alstyne, “Curing Spam: Rights, Signals & Screens,” The Economists' Voice: Vol. 4: Issue 2,
Article 4. Available at http://www.bepress.com/ev/vol4/iss2/art4
.
10
Ibid.
11
See U.S. Congress, Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003
(CAN-SPAM Act of 2003), Public Law 108–187.

ITU Study on the Financial Aspects of Network Security:
Malware and Spam
www.itu.int/ITU-D/cyb/cybersecurity/docs/itu-study-financial-aspects-of-malware-and-spam.pdf
5
sometimes pay the owners of websites that host their ads for every instance someone clicks on
an ad.
12
Attackers can strike a deal with the hosting website to instruct the bots in the botnet to
automatically click on the advertisements, generating false “hits.” This process can be further
enhanced if the botnet hijacks the default web page of compromised end-user machines so
that the “clicks” are executed each time the victim loads the browser.
Extortion, another form of abuse, is often based on the threat of launching a Distributed
Denial of Service (DDoS) attack against a website. Popular targets include online gambling
and e-commerce sites. A variant compromises the victim’s machine and then denies the
victim access to his or her own digital data, resources or other services. To be able to
unscramble his/her encrypted data, the user must pay a ransom. Businesses may run into
substantial financial losses if their revenue-generating opportunities are affected or even come
to a standstill, whether they give in to the extortion or not. Sometimes these attacks are
employed by competing firms with the intent of sabotaging the other firm’s business
operations.
13
Several high profile cases in 2006 brought this kind of extortion to the limelight,
even though it may be less frequently used as others forms of malware.
14

A rising use for malware is espionage in which malicious code is used to intercept crucial
information about a country’s citizens, business or critical infrastructures, threatening the
security of individual organizations or even of a whole nation.
15
The United Kingdom
recently reported an attack on its public and private critical information infrastructure by
trojans.
16


2.3. Factors aggravating the dissemination of malware
The potential versatility and sophistication of malware render it a potent tool. This is further
enhanced by several developments in the information and communication value net.
Particularly important are the growing number of Internet users, the declining costs of storage
and email access, widespread availability of malware tools, and a growing gap between the
sophistication of systems and applications and end user awareness. The increased reliance on
ICT, the advent of broadband, and technology vulnerability all magnify the problem.
As both the public and the private sector adopt increased use of ICT, the opportunities to
attack information systems multiply. The OECD, in 2004, found that 100 percent of the large
scale businesses in member countries were conducting transactions online.
17
Medium sized
firms are also following that strategy.
18
Individuals as well are conducting an increasing range
of activities online. People shop, bank, file taxes, and access information for work, and social
networking online. The growth of online consumers and sellers provides cyber criminals with
a larger victim base and, other things equal, reduces the probability of identification.



12
Online advertisers use a range of compensation models. Clickfraud is only possible if a payment is
dependent on the number of clicks. If the advertising website is only paid if an actual transaction takes
place, clickfraud is less of a problem.
13
See D. Pappalardo and E. Messmer, “Extortion via DDoS on the Rise: Criminals are Using the
Attacks to Extort Money from Victimized Companies”, Network World, May 15, 2005, available at
http://www.computerworld.com/networkingtopics/networking/story/0,10801,101761,00.html.
14
See SOPHOS, 2007 Security Threat Report; page 8; available online at
http://www.sophos.com/security/
.
15
See D. Goodin, “Pentagon Attackers stole 'Amazing Amount' of Sensitive Data,” March 6, 2008, available at
http://www.theregister.co.uk/2008/03/06/pentagon_breach_assessment/
.
16
See “Targeted Trojan Email Attacks”; NISCC Briefing Issued 16 June 2005 (Centre for the Protection
of the National Infrastructure); http://www.cpni.gov.uk/docs/ttea.pdf
.
17
OECD Science, Technology and Industry Scoreboard 2005: Toward a Knowledge-based Economy,
available at http://lysander.sourceoecd.org/vl=880974/cl=12/nw=1/rpsv/scoreboard/d09.htm
.
18
Ibid.


6 ITU Study on the Financial Aspects of Network Security:
Malware and Spam
www.itu.int/ITU-D/cyb/cybersecurity/docs/itu-study-financial-aspects-of-malware-and-spam.pdf

The availability of increasingly sophisticated applications and a global migration to
broadband connectivity contribute to problems generated by malware. With the expansion of
broadband access, more customers are taking advantage of always-on connectivity, use
wireless hotspots at home or while traveling, and use more and more diverse devices to
connect to the Internet. The multiplicity of devices, network configurations, and applications
offers new attack vectors for malware to reach a target. In 2007, the ITU quantified the global
number of internet users as nearly 1.5 billion. Of this total, nearly 340 million, slightly less
than a quarter, used broadband connections.
19
The large number of users helps attackers carry
out assaults as they can compromise more computers to, for example, send massive amounts
of spam and conduct DDoS attacks. More widespread availability of wireless broadband
access allows attackers to use connectivity in public places, further complicating finding these
criminals.
A last point that deserves mentioning is technological vulnerabilities. Different and newer
types of software and hardware also bring along complexity and associated vulnerabilities that
can be exploited by attackers. These effects are sometimes exacerbated by user ignorance as
well as a lack of incentives to reveal these vulnerabilities and update software. Microsoft, for
example, reported an increase of nearly 2,000 disclosed vulnerabilities from 2005 to 2006.
20

At the same time, the firm reported an increase in the number of disinfected machines from
less than 4 million at the beginning of 2005 to more than 10 million at the end of 2006 (aided
by a malware removal tool introduced by the firm).
21
Similarly, the security service provider
Symantec
22
reported a 12 percent rise in the number of known vulnerabilities from the first
half of 2006 (January–June) to the second half (June–December) which the firms suspects is
primarily caused by the increase in broadband connectivity.




19
See International Telecommunication Union (ITU), ITU ICT EYE, http://www.itu.int/ITU-D/ict/statistics/.
20
See Microsoft Security Intelligence Report; July–December 2006; pg. 8; available online at
http://www.microsoft.com/downloads/details.aspx?familyid=af816e28-533f-4970-9a49-
e35dc3f26cfe&displaylang=en (last accessed December 3, 2007).
21
Ibid., p. 20-21.
22
Symantec Corporation has over 40,000 sensors monitoring network activity in over 180 countries
around the world. See Symantec Internet Security Threat Report, Volume XI at 38; available at
http://eval.symantec.com/mktginfo/enterprise/white_papers/ent-
whitepaper_internet_security_threat_report_xi_03_2007.en-us.pdf.

ITU Study on the Financial Aspects of Network Security:
Malware and Spam
www.itu.int/ITU-D/cyb/cybersecurity/docs/itu-study-financial-aspects-of-malware-and-spam.pdf
7
3. BUSINESS MODELS RELATED TO MALWARE
A diverse cast of actors with widely differing motives populate the malware economy. Main
groups are (1) innovators seeking to find security problems to improve the working of
information systems; (2) amateurs seeking fame and notoriety without malicious intent; (3)
copy catters who usually only replicate simple attacks but often with malicious goals, (4)
insiders, usually employees with experience at a particular work place that breach security,
and (5) a range of actors in the realm of organized crime.
23
Figure 1 illustrates the evolution
of malware in terms of motives from fame seeking but relatively harmless “techies” to
criminals motivated by financial gain.

Figure 1. Visibility of malware vs. malicious intent

Source: www.govcert.nl

Malware-based crimes are steadily becoming cross-national or even global in nature, making
it very difficult to find the perpetrators. Even if a criminal can be identified, differences in
national laws and weaknesses in cross-border cooperation can make prosecution daunting.
This has obfuscated our understanding of the underlying motives and demographic profiles of
the individuals and groups involved. Consequently, the design of effective countermeasures
is greatly complicated.
The malware market and associated activities have expanded and differentiated beyond
smaller groups so that apparently mechanisms to increase trust among the many actors are
emerging. For example, some malware variants carry a guarantee by the seller to remain
undetectable by anti-malware software. Certain versions may include “service level
agreements” by which a seller promises to provide a newer undetectable version in case of
detection.
24




23
Adapted from McAfee Virtual Criminology Report 2007; page 8; available online at
http://www.mcafee.com/us/threat_center/white_paper.html.

24
See MessageLabs Intelligence: 2007 Annual Security Report, available at
http://www.messagelabs.com/resources/mlireports
.


8 ITU Study on the Financial Aspects of Network Security:
Malware and Spam
www.itu.int/ITU-D/cyb/cybersecurity/docs/itu-study-financial-aspects-of-malware-and-spam.pdf

3.1. Division of labor
The cyber criminal market is surprisingly specialized. Division of labor and competition
among actors has contributed to a considerable drop in the price of malware. Figure 2
illustrates key players in the malware economy. Given the dynamic nature of this realm,
however, the degrees of specialization, and the differentiation of roles are in continuous flux.
Figure 2. Division of labor in the malware underground economy Visibility of malware vs.
malicious intent
Malware
Writer
Guarantee
Service
Spammers
Credit Card
Abuser
Botnet
Owner
Malware
Distributor
Reseller
Identity
Collector
eShops
Drop Service
Drop Site
Developers
Drop Drop
Drop
Uses Services
Seller Malware
Sells credit
cards with
identities
Buys Goods
Uses
Services
Forward Goods
Ships
Goods
Uses Services
Sells Identities
Uses Services
Sells Malware
Sells Malware
Buys
Drop
Site
Template

Source: Source: MessageLabs, 2007

Certain groups of malicious actors seem to be involved in the entire malware ecosystem from
the development of malware, acquisition of targets and distribution of spam and/or malware,
all the way to laundering the money into a “clean” bank account. Much of the criminal
market, however, is divided into segments that have a certain expertise. This expands the
opportunity to source partners globally, primarily through Internet Relay Chat (IRC)
channels, underground bulletin boards, and online forums.
For example, a malware distributor may buy malware from an author and use services offered
by a botnet owner to spread it (see below section 3.2 for a discussion of botnets). Botnets are
assembled from thousands to millions of infected computers located around the world. The
person running a bot on his or her system is typically completely unaware of it. Performance
degradation is at best noticeable during the short periods during which the botnet is active.
The system of computers constituting the botnet enables the attacker to efficiently target a
large number of individual users and organizations.
Other participants specialize in turning illegally acquired information into money, be it from
stolen credit cards or identity theft. Stolen credit card information, for example, may be used
to make purchases for parties known as “drops.” These drops, in turn, post the acquired
merchandise on eBay or sell it immediately for cash. This way balances in credit card
accounts are extracted to the criminals and the funds eventually laundered.