NESTA Crime Online - University of Brighton Repository

accelerating on a monthly basis. With Storm Worm, we can see the agility of
cybercriminals in releasing upgraded versions of malware and blended attacks. In other
cases, malware acquires improved functions compared with its rivals and even
substitutes itself for malware installed by competitors. Unlike hackers, such groups do
not appear to compete with each other or protect against other types of groups where
there would seem to be little rivalry given the abundance of ‘booty’ available.
Consequently, there is no need to compete over resources since they are far from
scarce. The rivals here are the law enforcement agents who seek to identify and shut
down their operations.
Another recent example of product upgrading can be seen in the Conflicker worm which
emerged in late 2008 and sought to integrate millions of inflected computers to create a
giant botnet. Computer experts worry that it could become a profitable platform for
massive Internet fraud and theft. They also increasingly suspect that Conflicker will hold
computers to ransom. According to IT experts, Conflicker’s software developer(s) has
repeatedly updated its software in a cat and mouse game. Researchers who have been
painstakingly disassembling the Conflicker code have found difficulty in determining
where the author(s) is located, or the organisation underlying the development of the
worm, or whether the programme is being maintained by one person or a group of
hackers. 166
Functional upgrading. This refers to increasing value added by changing the mix of
activities conducted within the firm. This implies either integrating activities that were
not performed in the firm before or outsourcing them (an example in a legitimate
business would be outsourcing or taking responsibility for accounting or logistics). 167
There are multiple examples of functional upgrading in the cybercrime business, where
evidence suggests that certain gangs have expanded their core activities. In the Storm
Worm example, functional upgrading is illustrated by their move from simply spreading
malware to the actual exploitation of vulnerabilities. Tamil cybercriminals in London are
thought to have subcontracted parts of their operation to South East Asia to enable
them to maintain a low profile on the streets and avoid the adverse attention of other
gangs.
166 John Markoff, “Computer experts united to hunt worm”, New York Times, 18 th March 2009.
167 Kaplinsky R, and Morris M., (2001).
Page 57