NESTA Crime Online - University of Brighton Repository

Crimeware-as-a-Service (CaaS): Parallel to the concept of software-as-a-service, 224
crimeware-as-a-service is rapidly gaining attention in the underground economy. Using
CaaS, criminals can now rent malware and hosting services along with any patches
needed to defeat security software. The final user only needs to have a target and to
identify the type of data they seek to steal, while the technical work can be hired. The
emergence of CaaS releases criminals from having to deal with the technical challenges
of cybercrime. Under this business model, everything can be rented, from crimeware
toolkits to pay-per-infection services.
a) Crimeware toolkits offer off-the-shelf tools that allow criminals to gather and sort out
the data stolen, minimising the need for coding skills to operate them. 225 One director of
security strategies for a major corporation said “for subscriptions starting as low as $20
(£13.40) per month, such enterprises sell "fully managed exploit engines" that spyware
distributors and spammers can use to infiltrate systems worldwide. 226
b) The pay-per-infection model emulates the ‘pay-as-you-go’ approach, based on actual
usage rates. These businesses sell other criminals code that enables them to infect
websites with malware or spyware. One interviewee found a website that was initially
charging !40 (£35) each time the spyware was downloaded to personal machines;
however, the site offered more favourable rates when the traffic increased. 227
Business models are not independent from each other; they often combine. For
instance, the swarming model – where participants work together on a common goal -
can also include crime-as-a service elements. Many sources have discussed and made
224 Software as a service (SaaS) is a model of software delivery where an application is hosted as a service
provided to customers across the Internet. This model is centred on separating software possession and
ownership from its use. Turner, M., Budgen, D., and Brereton, P. (2003). Turning software into a service.
Computer, 36(10), pp 38-44 (October).
225 Finjan, (2008), Web Security Trends Reports, Q1.
226 Gunter Ollmann, at IBM's Internet Security Systems X-Force team quoted at:
www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=90
15588.
227 Finjan, (2007), eCriminal eCommerce and the Web Models and Techniques Used to Support it, Baptie
Online; by Tim Warner, UK Country Manager, Finjan.
Page 79