Deviating From the Cybercriminal Script: Exploring Tools of Anonymity (Mis)Used by Carders on Cryptomarkets

Abstract

This work presents an overview of some of the tools that cybercriminals employ in order to trade securely. It will look at the weaknesses of these tools and how the behaviour of cybercriminals will sometimes lead them to use tools in a non--optimal manner, creating opportunities for law enforcement to identify and apprehend them. The criminal domain this article focuses on is carding, the online trade in stolen payment card details and the consequent criminal misuse of such data. However, these findings could be applied more broadly, as many of the analysed tools are used across (cyber)criminal domains. This paper is a continuation of earlier work (van Hardeveld, Webber & O'Hara, 2016), in which a crime script analysis of 25 carding tutorials presented the tools that cybercriminals use to cash--out stolen payment card details while remaining anonymous. We use these tutorials and an analysis of the literature to identify how they can be used incorrectly and create a typology of potential behavioural and technological pitfalls in these tools. Finally, we conclude that finding pitfalls in the usage of tools by cybercriminals has the potential to increase the efficiency of disruption, interception and prevention approaches. However, in future work, interviews with law enforcement experts and convicted cybercriminals or still active users should be used to analyse the operational security of cybercriminals in more depth.

You Can’t See What You Can’t See: Experimental Evidence for How Much Relevant Information May Be Missed Due to Google’s Web Search Personalisation

“…It has also been awarded a European Privacy Seal [24]. Tor is essentially a modified Mozilla Firefox Browser with additional proxy applications and extensions that hides any identifying information by fragmenting the links between the client and server by redirecting the traffic through thousands of relays [11].…”

Freedom in the wilderness: A study of a Darknet space

“…The primary unit, or ‘object’, of analysis in this study is the Freesite and the content they house. Given the elusive nature of hackers and the illicit nature of many hacking activities, exploring the content and data left by hackers has become a common way of studying both hackers and Darknets (Holt et al, 2012; Kubitschko, 2015a; Moore and Rid, 2016; Nycyk, 2016; van Hardeveld et al, 2017).…”

“…Journalistic accounts have detailed the way the Darknet facilitates criminal activity (Bartlett, 2015) and described the Darknet as the ‘Wild West’ of the Internet (Kushner, 2015; also see Gehl, 2016 for a deeper discussion on Darknets in the media). Academic work has continued in this vein, with a strong focus on the criminal element (Bancroft and Scott Reid, 2016; Broséus et al, 2016; Hout and Bingham, 2013; Jardine, 2015, 2016, 2017; Moore and Rid, 2016; Owen and Savage, 2015; van Hardeveld et al, 2017).…”

Examining the Social Organization Practices of Cybercriminals in the Netherlands Online and Offline

“…Criminological inquiry on cybercrime has increased dramatically over the last decade, with some emphasis on economic-motivated offenses (e.g., Holt & Bossler, 2016; Yar, 2013). There are a range of cybercrimes that generate revenue for offenders through the theft and resale of information or the facilitation of fraudulent financial transactions, including phishing, computer hacking, and the use of malicious software that captures keystrokes and sensitive user information (e.g., Dupont et al, 2017; Holt, 2013; Holt & Lampke, 2010; Hutchings & Holt, 2015; Leukfeldt, 2017; Leukfeldt et al, 2017a, 2017b, 2017c, 2017d; van Hardeveld et al, 2017).…”

“…including phishing, computer hacking, and the use of malicious software that captures keystrokes and sensitive user information (e.g., Dupont et al, 2017;Holt, 2013;Holt & Lampke, 2010;Hutchings & Holt, 2015;Leukfeldt, 2017;Leukfeldt et al, 2017aLeukfeldt et al, , 2017bLeukfeldt et al, , 2017cLeukfeldt et al, , 2017dvan Hardeveld et al, 2017).…”