Markets in Malware - Adam Hogan

Explore the dynamics of malware markets in this BSides Cleveland conference talk. Delve into the economics of cybercrime, examining labor specialization, financial trust, and price discrimination in illegal markets. Investigate the challenges of hostage-taking and ransom negotiations, drawing parallels to established practices in certain cultures. Analyze the reputation-building mechanisms for malware authors and the creation of extra-legal governance structures. Discuss the impact of international laws on ransom payments to terrorist organizations and evaluate the cost-benefit analysis of cybercriminal activities. Examine the limitations on growth for ransomware operations and the trend towards vertical integration in cybercrime. Consider the impressive supply chain of malicious actors and the role of commodity malware and containerization in the evolving landscape of digital threats.

Intro
Labor specialization Financial trust
PRICE DISCRIMINATION
First challenge is a logistical one: acquire a live hostage and convey them to a place from which the ransom negotiation can be safely conducted.
EXTRA-LEGAL GOVERNANCE
IN CULTURES WHERE HOSTAGE- TAKING IS AN ESTABLISHED WAY OF RESOLVING INTER COMMUNITY CONFLICT (E.G. YEMEN) HOSTAGES TRADITIONALLY HAVE THE SOCIAL STATUS OF A GUEST!
CAN MALWARE AUTHORS BUILD A REPUTATION?
CREATING RULES • DISSEMINATING INFORMATION • EVALUATING PERFORMANCE • SPOTTING BREACHES OF PROTOCOL • ENFORCING RULES AND NORMS
THE OVERLONG CAPTIVITY OF THE CHANDLERS
COUNTER EXAMPLE
UN AND DOMESTIC LAW FORBID THE TRANSFER OF MONEY TO TERRORIST ORGANIZATIONS
LAW ENFORCEMENT?
COST / BENEFIT
THERE ARE NO GIANT KIDNAPPING ENTERPRISES
LARGE KIDNAPPING ORGANIZATIONS BECOME PROTECTION RACKETS
LARGE REBEL GROUPS BECOME GOVERNMENTS
GRIM SPIDER WIZARD SPIDER
VERTICAL INTEGRATION
HOW TO CHARGE A HIGHER RANSOM?
WHAT LIMITS THE GROWTH OF RANSOMWARE?
COMMODITY MALWARE
CONTAINERIZATION
BAD GUYS SUPPLY CHAIN IS IMPRESSIVE