The underground economy where criminals sell stolen personal and financial data appears to often rely on network infrastructure
supplied by the kingpins of the botnet world, according to Symantec's biannual Internet Threat Report published Monday.
Symantec tracked 6 million separate bots — compromised computers used to send spam or steal personal data — controlled by roughly 4,700 separate servers through so-called “bot herders” who could be anywhere
in the world. During the same six-month period, from last July through December, Symantec also watched 332 of what it calls
“underground economy servers,” where stolen personal data, such as credit card and bank account information, is routinely
bartered and sold. According to Alfred Huger, Symantec’s vice president of engineering, it’s not unusual for these underground
economy servers to be the same as those maintained by the bot herders.
Read the latest WhitePaper - Creating Information Management Leverage with Veritas Storage Foundation by Symantec
“We think the bot herders are people maintaining the infrastructure for this criminal activity,” Huger says.
Symantec came to this conclusion, described in the “Symantec Internet Security Threat Report, Trends for July-December 06,”
through both its global sensor network and researchers who spent time lurking in the online criminal world where buying and
selling of stolen personal information takes place.
At these “underground economy servers,” Symantec watched 5,000 criminal transactions over a five-month period. As to where
these servers are situated, Symantec says 51% are in the United States, 15% in Sweden, 7% in Canada and 6% in Germany, with
the remainder elsewhere. Often, these servers are stolen, too, used remotely right under the noses of their rightful owners,
particularly small businesses and consumers.
And it’s a bustling marketplace for identity theft. "You can buy a U.S. identity — a credit card, bank account, Social Security,
date of birth — for $20," says Huger. "A single U.S.-based credit card ranges from $1 to $6, with U.K.-based cards a little
higher, $2 and $12. We think it’s because the pound is worth more money." Access to an online bank account with $9,900 in
it would go for about $300. The main language is typically English.
