Symantec Global internet Security threat report
Underground economy servers—goods and services available for sale
this discussion focuses on the most frequently advertised items for sale on underground economy servers observed by Symantec. the underground economy is an evolving and self-sustaining black market where underground economy servers, or black market forums, are used for the promotion and trade of stolen information and services. this information can include government-issued identification numbers such as Social Security numbers (SSns), credit card numbers, debit card information, user accounts, email address lists, and bank accounts. Services include cashiers, scam page hosting, and job advertisements such as for scam developers or phishing partners. Much of this commerce is built within channels on irC servers. For an in-depth analysis of how the underground internet economy functions, please see the Symantec Report on the Underground Economy, published november 2008.191
the measure of goods and services available for sale is by distinct messages, which are considered as single advertisements for a good or service, though the same advertisement may appear thousands of times. to qualify as a new message there must be variations such as price changes or other alterations in the message.
in 2009, credit card information was the good most frequently advertised for sale on underground economy servers observed by Symantec, accounting for 19 percent of all advertised items (table 21). this was a decrease from 32 percent in 2008. Although this appears to be a significant drop, the percentage observed in 2007 was 21 percent, which may indicate that there was higher availability of credit card numbers on underground economy servers in 2008. the number of data breaches reported in those years is a further indication of this. there were more than twice as many data breaches reported in 2008 than in 2007. Similarly, there were almost twice as many data breaches reported in 2008 than there were in 2009. Credit card information advertised on the underground economy consists of the credit card number and expiry date, and may include the name on the card (or business name for corporate cards), billing address, phone number, CVV2 number, and pin.192
Range of Prices
$0–$600 plus 50%–60%
Credit card information
Bank account credentials
Credit card dumps
Website administration cre
Table 21. Goods and services advertised for sale Source: Symantec
on underground economy servers
http://eval.symantec.com/mktginfo/enterprise/white_papers/b-whitepaper_underground_economy_report_11-2008-14525717.en-us.pdf Card Verification Value 2 (CVV2) is a three- or four-digit number on the credit card and used for card-not-present transactions, such as internet or phone purchases. this was created to add an extra layer of security for credit cards and to verify that the person completing the transaction was in fact, in possession of the card.