New study reveals the cost of doing business on the dark web
Wikipedia defines the dark web, sometimes also referred to as the dark net, as a part of the internet that exists in an encrypted world of networks within networks.
Requiring specific software to access the dark web sites themselves, most commonly the Tor browser, this small corner of the internet is both an anonymous haven for whistleblowers and political activists, as well as a highly profitable marketplace where criminals sell their ill-gotten goods.
Flashpoint intelligence analysts have taken a look at the cybercrime economy through the lens of dark web marketplace prices over the last two years. Everything is for sale here, from a $20,000 bank loan for next to nothing, through to services that will attack sites and services on a rental basis.
Sourced from the most popular cybercrime marketplaces, some of which have been closed down now as my colleague Zak Doffman wrote earlier in the year, the prices remain representative of the dark web as a whole today.
The dark web economy
On September 13, I wrote about how an earlier dive into the dark web economy by Armor Threat Resistance Unit researchers revealed it was possible to exchange $800 (£630) of Bitcoin for $10,000 (£7,900) cash. At the time, that sounded like an unbeatable deal for those willing to break the law and face the jail time. And then along came the Flashpoint analysts who found even bigger illicit "bargains" in these dark web marketplaces. Access to a compromised bank account, known as a "bank log" in cybercrime parlance, with a balance of $10,000 (£7,900), could be yours for $25 (£19.75), for example. While personal information packages that enable a criminal to steal the victim's identity, or "fullz" as they are known, and achieve a promised $20,000 (£15,800) bank loan cash-out were on offer for just $5 (£4) more. If that sounds cheap, fullz packages start at around $4 (£3) as they are seen as a commodity item within these circles.
Ian Gray, the Flashpoint intelligence analyst who authored the report released on October 15, said: "Fullz that include the victim's financial information often cost more because they can be used for a greater variety of fraud schemes than personally identifiable information (PII) without such information." Some of the marketplace dealers even rate their fullz packages by the credit scoring attached to the individual, with a correlation between asking price and score level.
It's not just cold cash for sale on the dark web
Because these dark web marketplaces attract, by their very nature, the criminal element of society, the items on offer reflect this. So, alongside a database purporting to contain the PII of some 92 million Brazilian citizens, being auctioned off with a starting price of $15,000 (£11,875) you can also find drugs, both medicinal and recreational, weapons and passports.
The passport market is a particularly interesting one and can be divided into three main categories. The cheapest are scanned passports with the buyer information inputted starting at $5 (£4), and the most expensive are actual physical passports, which can cost as much as $5,000 (£4,000.) However, the most popular category is that of the passport template that enables the buyer to complete their information. The pricing for these templates vary, but the report found U.S. passports of this nature for $18 (£14.25) with Canadian passports costing $26 (£20.50) and the Netherlands, at $50 (£40) being the most expensive.
The variety of goods for sale on the dark web doesn't stop there. Distributed Denial of Service (DDoS) attacks are being sold "as a service" with the criminals renting out time on their DDoS attack botnets. "Most attacks remain focused on video games cheating and personal harassment," Gray said in the report, which is reflected in the low rental costs starting at as little as $0.35 (£0.28) for ten minutes, $25 (£19.75) for a day and the more significant money restricted to such offers as attacking any site for five hours which had a $250 (£197.50) price tag.
Although cybercrime continues to thrive, and threat actors become ever more sophisticated in their attack methodologies, the Flashpoint report reveals that much of the illicit commodity pricing has been relatively static across the past two years. This isn't altogether surprising, if I am honest. The buyer carries a higher risk than the seller in these transactions. The anonymity offered, although not always delivered by dark web networks means the seller has a perception of being relatively safe. The buyer, meanwhile, has to move out of the shadows to profit from their purchases. The risk of getting caught and the considerable legal consequences this brings makes these dark web sites a buyer's market, hence the low pricing.
