Selling information

There is so much valuable information for sale

Quite often when someone contacts us to remove malware from their website we're asked the question, "What do hackers want with my site? I don't sell anythying."

There is so much information that cyber criminals are interested in, that your website doesn't need to sell anything in order to become a "profit center" for cyber criminals.

Hackers are always interested in your credit card information, but as discussed earlier, they are often interested in spreading their malware to the computers of people who visit your site. Your website becomes a distribution point.

On some of the forums for cyber criminals, or "wannabe's", they offer blocks of WordPress credentials. Most often they're offering banking logins, PayPal logins and other financial institutions.

In these schemes, there are multiple levels. There are people who create the software to steal passwords. They will charge from $2,000 up to $10,000 for their malware. This is the type of malware that comes with a FUD guarantee.

If the anti-virus companies begin to detect it, the original authors of the malware, will send you new code that will evade detection. One such piece of malware is Hand Of Thief.

"Hand of Thief's developers aren't going to be the ones milking your bank account dry, however. Instead, they're going to be selling licenses of the trojan to those who will. Current pricing is $2,000 with free updates, but that's soon to go up to $3,000. That sounds like a high price, until you realize that it could pay for itself instantly if someone with a packed bank account is targeted."

At the next level you have people who buy this and possibly use it with many different pay per install offerings to distribute it to as many people as possible. These people will make money from the installation on the front-end and they'll make money on that back-end by selling the information gathered from these installations.

Hackers at this level will use the malware code with a crypter (similar to a packer) that produces a FUD virus file.

Here is a screen shot of one such crypter program and it's description:

The above is an actual screen shot taken from a website that offers to sell their crypter.

When these hackers infect computers, the malware they purchased and "crypted" sends them information stolen from computers. But they don't use the stolen information.

These hackers sell the information.

One of the people involved in the Target store breach reportedly made more that $1.7million from the sale of the credit card data stolen in the Target situation.

Supposedly, these people purchased the holographic images used on credit cards and also utilized machines that actually create the credit cards.

The final level is the people who buy the stolen information. For credit cards, they typically hire "mules" to carry out the actual use of the stolen information.

These "mules" are usually unsuspecting people who are "duped" into buying equipment from a local electronics store. They are instructed to ship the goods some where overseas. In return they get to keep some small amount left on the cards.

There are enough people who fall for this, that it's actually quite a large market.

If you have any questions about the use of stolen information by cyber criminals, please feel free to send us an email via our contact page