The easy way to become a cyber criminal
You might think that becoming a cyber criminal required some hard work and dedication to your task, maybe even some form of apprenticeship where you learn the craft at the side of a more experienced hacker.
But new research has identified a one-stop, outsourced online shop, providing hosting, design and payment solutions for cyber criminals looking for a low-cost of entry method to sell their ill-gotten assets.
Cyber attack prevention specialist Digital Shadows conducted research into deer.io, a Russian-language site that hosted darkside.global. The service appears to have been active since at least October 2013 and, at the time of writing, claims that its users have profited from over 240 million roubles (approximately $3.8 million).
Deer.io claims to offer technical hosting including anonymity and security, payment handling, website design and DDoS protection. In so doing, it attracts users with low technical capabilities who would find it hard to orchestrate these services themselves.
It also has an automatic payment system -- available for Webmoney, Yandex, Money and QIWI -- which means transactions can occur 24/7 without requiring constant vendor attention. Deer.io charges a monthly fee of 500 roubles (around $8) to provide customer service and product development, and apparently offers prompt responses to queries.
"Just when you thought it couldn't get any easier, cybercriminals are now experiencing even lower barriers to entry," says Rick Holland, vice president, strategy at Digital Shadows. "While this trend is not necessarily new, the fact that all of these support services are wrapped into a one-stop shop marks a change. Moreover, amid constant hype surrounding the dark web, it is important to note that this exists on the surface web, and that the dark web does not monopolize criminality".
Most of the shops hosted on deer.io sell illegal or semi‐illegal (that's to say in breach of Terms and Conditions) digital goods. These relate to a number of services including registering social media accounts, typically with the intent of supporting social media spam and artificially increasing the popularity of other accounts/posts.
Stolen, legitimate social media accounts are advertised in small quantity but at higher prices than newly registered accounts. Dedicated servers (mostly Azure and AWS) and domain names are available for sale too. The site even gives users the opportunity to login to test shops to see how they work before purchasing.
Digital Shadows points out that while deer.io itself isn't criminal -- and its admins deny responsibility for illegal items advertised -- it seems willing to turn a blind eye to some activity.
More information about deer.io and its likely impact on the overall cyber crime landscape is available on the Digital Shadows blog.
Photo Credit: igor.stevanovic/Shutterstock