NESTA Crime Online - University of Brighton Repository

Recent estimates state that about 3,000 different botnet command & control servers 139
are known to be operating every day, with each botnet averaging 20,000 compromised
computers. 140
2.1.1.3 Exploitation
The third activity involves the final exploitation of the stolen information obtained
through the cyber attack: turning the traded data into cash. When criminals obtain the
stolen data (personal information, credit card and bank details), they must use it to steal
money. This is not without risk, and this is where the chance of detection and arrest
increases significantly. 141
This activity involves high risk and lower technical capabilities, and can be easily
embraced by organised criminal gangs and individual agents looking for money. 142 There
are many ways to exploit information obtained from illicit means. Some involve technical
skills while others require no more than the ability to use an ATM. 143
For instance, cloning credit cards requires a minimum understanding of technical
procedures. Cybercriminals install a false front to ATM machines that conceals a device
capable of cloning all the relevant card details necessary to create a digital copy. First, a
scanner reads the magnetic stripe on the reverse of the card to capture the card data,
which contains the 16 digit card number, the card start and expiry dates, the
cardholder’s name and the security number on the card. Second, a small digital camera
photographs the card owner entering the PIN code, providing the owner does not
139 Command & control infrastructure is the system that remotely sends instructions to the hijacked computers
(zombies) that comprise the botnet. This is done via an IRC (Inter Relay Chat) server installed illegally. If the
command-and-control is disabled, all the machines in the botnet become useless to the botmaster.
140 Some C&C servers manage just a few infected computers (~10), large ones manage thousands of bots
(~300.000) – Barroso, (2007), ENISA Position Paper No. 3; Botnets – The Silent Threat.
141 Kaspersky, (2005), “The changing threat, from prankster to professionals”.
142 Russian crime groups, for example, minimize the risk of being caught by selling the credit card information
to, amongst others, Nigerian groups who are more prepared to take the risk of being caught. In London,
recently, a Latvian criminal was caught when a long queue of ATM users complained to the police who arrested
the user in possession of a large number of credit/debit cards complete with pin codes written on each card.
He was only detected because he was too lazy, incompetent or impatient to move from one machine to
another. These users can net over £20,000 a week. Interview with Roy West, Cheque and Credit Card Unit,
City of London Police, 9 th December 2008.
143 Details on the examples of this are provided in the following section on dynamic capabilities.
Page 48