Like eBay For Malware: Computer Crime Is Slicker Than You Think

Given the competition for the enormous sums of money in the cybercrime market, it is not surprising that the quality of the products and services available to the would-be cybercriminal are increasing along with the sophistication of the markets and vendors. The most recent versions of many malware applications are extremely user-friendly, with point-and-click graphical interfaces and a wide range of functionality. They tout their ability to evade detection and defeat antivirus software and other countermeasures. Most importantly, they require little or no expertise to use.

"Code has had to become much, much more sophisticated and very professional in quality in order to turn a profit," says Friedrichs. "We've certainly seen spyware, for example, that leverages very advanced rootkit capabilities in order to hide and stay resident on a system once it's installed itself."

The availability of cracked versions of older software and low-cost applications created in developing countries forces malware writers to polish their product if they want to compete. Nevertheless, quality software can command a healthy premium. "Nuclear Grabber goes for $3,000 because this is a fantastic product that has multiple functionalities in multiple environments," Holt says of one popular attack tool. "So, if you want to do phishing, you can use it for phishing. If you want a keylogger, you can use it for keylogging. It's up to you."

According to Gutmann, some vendors have hired professional linguists to craft spam messages that bypass filters while remaining meaningful to the recipient, while phishers use psychology graduate students to develop scams that will lure victims into giving up their personal data. "They have better experts than we do!" he said in his Defcon presentation.

Malware applications are even beginning to incorporate their own security measures, both to outmaneuver competitors and avoid detection. A trojan, for example, might update a computer's antivirus signatures to block subsequent infection attempts by competing malware, while server attack tools might install patches or fix misconfigurations to protect a Web host delivering malicious code to unsuspecting visitors. "It's ironic, but the bad guys need security too," notes Parry. "They hack each other, and they want to keep us from getting access to their backend mechanics."

The bottom line is that the good guys are facing more and better equipped opponents. "

"Anything that you want to find, you can buy at these markets," Holt concludes. "It's so deep that you don't have to have a technical background to really get into identity theft and credit card fraud and hard core kinds of computer crime."

Damon Poeter contributed to this article.