Prices are falling and the number of services is increasing as developers in the online underground compete fiercely for criminals looking to purchase botnets and other tools to mount cyber attacks.
The trends in the so-called malware-as-a-service market reflect a maturing business in which any non-professional can buy or rent all the tools needed to build the malware, distribute it and then siphon credit card and banking data and other personal information from compromised PCs.
Developers even offer software consoles that provide a full view of a botnet and all its nodes.
“You don’t have to be part of a hacking collective to be an effective hacker and someone who is effective at monetising his efforts in this alluring way,” said Grayson Milbourne, Security Intelligence Director for Webroot. “It is rather easy and people are making a lot of money, so we expect [tools] to become more available and less expensive.”
Because of competition among suppliers, prices have been falling rapidly. Since January, Webroot has seen prices starting for a U.S. botnet of 1,000 computers fall from $200 to $120. Today, a person can buy a 10,000-computer botnet for $1,000.
Botnets located in the U.S. fetch the highest prices because the victims tend to have more money in PayPal and bank accounts, as well as credit cards with higher maximum spending limits. By comparison, a 1,000-host botnet in the European Union costs $50, while the same number in Germany, Canada or the U.K. cost $80, according to Webroot.
With the demand for services rising, suppliers are expanding their portfolios. A more recent service is converting malware-infected computers into anonymisation proxies that cyber criminals can use to cover their Web activities.
One newly launched service advertised as ProxyBuy provides access to thousands of hosts that have been converted to SOCKS Servers. SOCKS, which stands for SOCKet Secure, is an Internet protocol that routes network packets through a proxy server.
Prices vary depending on the number of servers. For example, a criminal can buy 1,400-1,500 SOCKS servers for $30. A popular tactic of cybercriminals is to chain numerous servers together to cover their tracks.
Malware-as-a-service operations have been around since the early 2000s, but they have really started taken off since 2006. In general, the services are being used for spamming, launching denial-of-service attacks, harvesting emails and stealing credentials for banking accounts and other Web services.
