WHERE CYBER CRIMINALS GO TO BUY YOUR STOLEN DATA; WHAT MALICIOUS CITES PROVIDE BOTH FREE, AND PAID ACCESS TO STOLEN CREDIT CARDS, COMPANY DATA BASES, MALWARE, & MORE

Source Link

Where Cyber Criminals Go To Buy Your Stolen Data; What Malicious Cites Provide Both Free, And Paid Access To Stolen Credit Cards, Company Data Bases, Malware, & More

In light of the news that a billion or so Yahoo accounts have been hacked/compromised, there was a timely article on DarkReading.com’s website about where cyber criminals go to purchase your stolen data. Sean Martin had a December 3, 2016 article on the cyber security publication’s website with the title above. 

“With nothing more than a standard Web browser, cyber criminals can find personal, private information all over the public Internet,” Mr. Martin wrote. “It just isn’t legitimate services — from the genealogy sites, to the public records and social media — that can be mined and exploited for nefarious purposes. Openly malicious criminal activities are also happening on the public Internet.” Though Mr. Martin does note that “much of the cyber crime underground consists of private, and established [digital gated] communities, that don’t appear in a normal search engine, and are not accessible by regular users — without authorization.” In other words, this is the digital equivalent of a gated community; and, a way these malicious sites attempt to keep out the prying eyes of law enforcement. 

The identity and fraud detection provider, CSID, told Mr. Martin that “there are different levels of cyber criminal resources — and, not all are tightly protected.” “The quantity, and quality of the more easily accessible forums are still high, the CISO team said; and, anyone can access content — such as stolen credit cards, cyber attack tools, and even advanced malware, which can be leveraged with minimal technical know-how required.”

Adam Tyler, Chief Innovation Officer at CSID, described to Mr. Martin, how [digital] black market organizations are becoming more like traditional businesses we visit and buy from every day, Mr. Martin wrote. “For example,” Mr. Tyler said, “many sites now have their own – FaceBook, Twitter, even YouTube pages to advise their member base on new attacks, and tools that are available,”

Christopher Doman, Consulting Analyst at Vectra Networks, said “data sold on criminal [digital] marketplaces, age quickly, meaning that once the information is stolen, it has to be used for fraudulent purposes quickly. The more times the information is abused for fraud, the more the information will be devalued.”

“Companies should have these [digital] marketplaces monitored, looking for trends in data breaches, and attacks, as well as to see if any of their data is compromised,” said Carefree Solutions CEO Paul San Soucie. “One point that I’m not sure is evident, is there is more pubic, and Dark Web research than any one IT [security] person can handle. Researching, and absorbing the information requires significant training and experience. Even large U.S. banks that have dedicated [cyber] security staff, are not able to do some of the research and analysis that specialized [cyber security] reconnaissance teams can perform.”

San Soucie nevertheless, suggests treading carefully when doing this research, Mr. Martin noted. “While you can get to most of these sites using standard https, I still consider them dark, and strongly recommend accessing them via a VPN, as both criminal and government sources track who accesses them,” Mr. Soucie warned. 

If your curiosity gets the better of you and, you have to go on to the Dark Web, using a VPN is a must. While there are many legitimate users and vendors on the Dark Web — for a variety of reasons: privacy, distrust of government, off-the-grid types, etc. — it is the digital version of the Wild Wild West, and often nothing is what it seems. Masquerading, deception, and digital quicksand await you.