Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008)...
Transcript of Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008)...
![Page 1: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/1.jpg)
Honor Among ThievesA Common’s Analysis of Cybercrime Economics
Sadia Afroz, Vaibhav Garg, Damon McCoy, Rachel Greenstadt
![Page 2: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/2.jpg)
Tragedy of the commons
![Page 3: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/3.jpg)
Underground forum
What is the relationship?
Farmers and cows
![Page 4: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/4.jpg)
• Cybercrime is limited resource economy
• Underground forums facilitate sharing of stolen resources
![Page 5: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/5.jpg)
== Underground forums
== members of the forums
== members of the forums
![Page 6: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/6.jpg)
Why is this important?
• Well-defined criteria to estimate sustainability in the physical world
• Are cybercrime communities sustainable?
![Page 7: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/7.jpg)
• Sustainable communities are more economically efficient
• Can we make these communities unsustainable?
Why would we care?
![Page 8: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/8.jpg)
• Ostrom’s framework for sustainable community:
- Low cost of monitoring
- Moderate rates of change of the resource/ resource consumers
- Frequent communication between resource members
- Low costs of enforcement
- Exclusion
Framework for sustainability
![Page 9: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/9.jpg)
• Which underground forums meet these criteria?
• Are these forums successful?
![Page 10: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/10.jpg)
Data5 forums
10
![Page 11: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/11.jpg)
Data5 leaked forums
11
![Page 12: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/12.jpg)
Data5 leaked forums
(Russian)
12
![Page 13: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/13.jpg)
Data5 leaked forums
(Russian)
Antichat(May 2002-Jun 2010)
13
![Page 14: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/14.jpg)
Data5 leaked forums
(Russian)
Antichat(May 2002-Jun 2010)
14
(English)
BadHackerZ(Nov 2003-May 2008)
BlackHat(Oct 2005-Mar 2008)
![Page 15: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/15.jpg)
Data5 leaked forums
(Russian)
Antichat(May 2002-Jun 2010)
15
(English)
BadHackerZ(Nov 2003-May 2008)
BlackHat(Oct 2005-Mar 2008)
(German)
Carders(Feb 2009- Dec 2010)
L33tCrew(May 2007-Nov 2009)
![Page 16: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/16.jpg)
0
12,500
25,000
37,500
50,000
Antichat BadhackerZ Blackhat Carders L33tCrew
9,306
3,0974,2293,026
15,165
9,5285,3284,4895,123
25,871
Members
Active members Lurkers16
![Page 17: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/17.jpg)
What is a successful forum?
• Long lasting and engaged
• “Small world”
![Page 18: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/18.jpg)
Small world
2. Distance between any two members is small
1. Members are part of a connected group
![Page 19: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/19.jpg)
What is a successful forum?
• Except BadhackerZ all shows “small world” effect
• BadhackerZ is an unsuccessful forum
• The rest of forums are successful
![Page 20: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/20.jpg)
Low cost of monitoring
• 3 ways of monitoring:
- admins and mods
- automated filtering
- community driven
![Page 21: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/21.jpg)
Low cost of monitoring
- BadhackerZ had admins and mods
- Rest of the forums used all ways
![Page 22: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/22.jpg)
Moderate rates of change of the resource consumers
0
25
50
75
100
2002-01 2003-07 2005-01 2006-07 2008-01 2009-07
% m
embe
rs
Time (year-month)
Antichat BadhackerZ Blackhat Carders L33tCrew
![Page 23: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/23.jpg)
Frequent communication between resource members
0
25
50
75
100
2002-01 2003-07 2005-01 2006-07 2008-01 2009-07
% p
rivat
e po
sts
Time (year-month)
Antichat BadhackerZ Blackhat Carders L33tCrew
0
25
50
75
100
2002-01 2003-07 2005-01 2006-07 2008-01 2009-07
% p
ublic
pos
ts
Time (year-month)
Antichat BadhackerZ Blackhat Carders L33tCrew
![Page 24: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/24.jpg)
Low cost of Enforcement
• Bots
• Community driven: special threads for complaints
• Punishment is either monetary or temporary/permanent bans
![Page 25: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/25.jpg)
• Anybody can join!
• But access is restricted based on rank
Exclusion
![Page 26: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/26.jpg)
Summary
• Successful/sustainable forums have:
- Easy monitoring
- Moderate increase in members
- Frequent communication
- Limited privileged access
- Strict enforcement
![Page 27: Honor Among Thieves - ICSI | ICSIsadia/papers/talk-ecrime13.pdf · BlackHat (Oct 2005-Mar 2008) Data 5 leaked forums (Russian) Antichat (May 2002-Jun 2010) 15 (English) BadHackerZ](https://reader033.fdocuments.in/reader033/viewer/2022042912/5f46c6874469056b7f739aea/html5/thumbnails/27.jpg)
Future work
• Analyze more forums
• Use different measures of success
• Identify economically efficient ways to dismantle underground communities