NESTA Crime Online - University of Brighton Repository

een much speculation and debate as to the level of organisation of these groups.
Unfortunately much more is known about what they can do than about who is behind
them, let alone details about how these actors link together.
The one thing we know is that in the cybercrime business most participants connect on
the Internet. Web forums and Internet Relay Chats (IRCs) 149 are the marketplaces
where buyers and sellers meet and exchange ideas, goods and services - and payment
arrangements. The purpose of illicit forums is to allow cybercriminals to communicate
anonymously and in real time.
A year-long research study on underground web forums and IRCs created and run by
cybercriminals 150 identified three primary types of trader on underground economy
servers: sellers who advertise their goods and services for sale; potential buyers; and
requesters who post advertisements for specific items to buy.
Web forums and IRCs are operated by the administrators, and although they both serve
the same purpose, there are fundamental differences between them. In web forums,
potential vendors are subject to peer-reviewed processes before they are granted
vendor status. Participants of web forums tend to be more established, and are
generally accessed by invitation-only. Their strength as a solid link for cybercriminals is
also their main weakness, since they are easier to trace. 151 In contrast, IRCs are mainly
based on reputation and virtually anyone can advertise. As a consequence IRCs have
more traffic and are becoming more popular marketplaces between fraudsters. However,
their transitory nature makes it more prone to admit ‘unethical’ criminals or law
enforcement agents. To overcome this weakness, one of the services offered in IRCs are
‘checking’ services, to assess the validity of the data offered, such as card numbers and
CVV2 numbers.
149 Real-time Internet text messaging mainly designed for group communication in discussion forums.
150 Symantec, (2008), “Symantec Report on the Underground Economy”, July 07–June 08.
151 Symantec, (2008), “Symantec Report on the Underground Economy”, July 07–June 08.
Page 50