Cyber Crime and Cyber Terrorism

FIGURE 17.2
Blackhole pricing model.

---

237
 
A botnet roadmap
high prices. Actually early versions are distributed free of charge and often these 
former versions have been “backdoored” by criminals, meaning that the novice thief 
(so called lamer) also becomes the victim.
In the recent past, instead, the glut of freely available criminal tools has low-
ered the cost barrier of entry into cybercrime and encouraged more wannabe cyber-
gangsters (lamer) into online crime. As mentioned today’s malware scene is highly 
organized, structured, and professional in its approach.
The spread of the Internet, especially for government and commercial purposes, 
has led to an evolution of the business model of the criminal market behind the 
modern threats. It is possible to imagine a layered reverse-pyramid structure (in 
terms of organizations involved, the size of these organizations, skills and goals) 
(
Figure 17.3
).
Organizations with more technical skills (probably the less numerous and com-
parable to a kind of Cyber-Mercenaries) are those who design and distribute various 
types of crimeware (payloads and exploit kits) according to different modes of diffu-
sion (spam, phishing, social engineering, drive-by or watering-hole), but do not take 
any particular action. In many cases, the cyber mercenaries instead of monetizing 
botnet activities by directly implementing fraud schemas rent a series of services to 
other criminals—a trend confirmed by the constant monitoring of the underground 
market offers. The prepared infrastructure is ready to be “sold” or better “rent” to 
the highest bidder. The rental model showed better revenue than the sale one. In fact 
many criminals made their money simply by renting access to their botnets rather 
than engaging in Spam, DDoS or information theft campaigns of their own devising 
(remember that the so-called Blackhole “landing page” could be the compromised 
sever by itself or an hosting server).
Those who pay to take criminal action do not need a high technical skill, but 
their attacks are usually more motivated and more numerous. The two most common 
reasons are socio-political (Hacktivist) and economic (Cyber Criminal). Criminals