Online Cyber Crime 'Supermarkets' Offer Special Deals

Core Facts
What is the value of a UK identity? - Symantec, today announces that UK identities are being bought and sold in bulk-buy special offers on "cyber crime supermarket" style underground economies, according to the latest edition of its Internet Security Threat Report - Volume XIII.

The bi-annual global report found that UK bank account details are being sold on underground economy servers for as little as £5, and are the most commonly advertised item for sale on these "cyber supermarket" black market forums used by criminals to advertise and trade stolen information and services.

Where you live also indicates how attractive your identity is to cyber criminals as the report found that EU identities are in much higher demand, being traded at prices 50 per cent higher than American identities. This is because of the flexibility of their use, since EU citizens are able to travel and conduct business freely throughout Europe making them useful to attackers who can use the identities easily across borders.

The Internet Security Threat Report also found that the higher the bank balance, the more lucrative it will be when sold on the cyber supermarket, with high value business accounts advertised for considerably more than lower balanced consumer ones. Bank accounts that bundled in personal information such as names, addresses and dates of birth were advertised at higher prices than those without this extra information - indicating how identity thieves are adopting a 'buy-one-get-one-free' philosophy.

The Symantec report also found that cyber crime is becoming increasingly sophisticated and personalised, with an increase in attacks on the end-user consumer. When it comes to trading, identities have now become a commercial commodity with Symantec observing a new phenomenon of bulk-buying of confidential consumer data - where personal details are packaged up in bargain bundles. For example, during the last six months of 2007, Symantec observed bundles of 50 credit card numbers for sale at £20 (£0.40 each), and 500 credit card bundles for £100 (£0.20 each).

After credit cards, full identities were the third most common item advertised for sale on the cyber supermarket, making up nine percent of all advertised goods, an increase from six percent in the first half of 2007. Symantec observed that identity trading is on the increase with some details being sold for as little as 50p - even stolen eBay accounts are up for grabs.

The variety of personal data for sale is constantly growing as cyber criminals are constantly changing and adapting their methods to introduce new tactics to achieve their goal of identity fraud. The report found that Mailers are now one of the most popular ways cybercriminals have designed to mislead Web users. The constant developments of new methods of attack indicates that the underground economy is a mature one. The personalisation of malicious activity and the price bargains and packages available are also indicators of the economy's sophistication.

Quotes
Richard Archdeacon quote: "Our latest report has clearly identified that the underground economy market for stolen online consumer data is continuing to grow and become more aggressively driven by market forces. We are not only seeing new types of data displayed readily for sale, but also seeing more aggressive trading arrangements taking place between cyber buyer and seller. There is also an obvious shift in focus from attacks targeted at instant financial gain versus those aimed at obtaining identity information from consumers in pursuit of longer term rewards."

"When new information like this report is produced it becomes even more critical that consumers are aware of how best to protect themselves and their identities when interacting in any way online. Users can take protective measures such as installing the latest Internet security and phishing protection software, ensuring passwords are strong, only ever enter credentials onto an official site and do not click through email links, and keep personal information safe . All very basic advice, but tips that could make a huge difference if consumers are targeted by a phishing attack."

Boilerplate Statements About the Symantec Internet Security Threat Report The Symantec Internet Security Threat Report provides a complete view of the Internet threat environment and is the only publicly available report of its kind that publishes not only an in-depth analysis of data and trends but also the methodologies used to arrive at its findings. The purpose of the report is to provide the information needed to help consumers and enterprises effectively secure their systems now and in the future.

About Symantec
The Symantec Internet Security Threat Report provides a complete view of the Internet threat environment and is the only publicly available report of its kind that publishes not only an in-depth analysis of data and trends but also the methodologies used to arrive at its findings. The purpose of the report is to provide the information needed to help consumers and enterprises effectively secure their systems now and in the future.

If you would like to discuss these issues with Symantec or would like advice on internet security, please contact me on +44 (0)20 8834 3504 to arrange a briefing.