Economic Factors of Vulnerability Trade and Exploitation

Abstract

Cybercrime markets support the development and diffusion of new attack technologies, vulnerability exploits, and malware. Whereas the revenue streams of cyber attackers have been studied multiple times in the literature, no quantitative account currently exists on the economics of attack acquisition and deployment. Yet, this understanding is critical to characterize the production of (traded) exploits, the economy that drives it, and its effects on the overall attack scenario. In this paper we provide an empirical investigation of the economics of vulnerability exploitation, and the effects of market factors on likelihood of exploit. Our data is collected first-handedly from a prominent Russian cybercrime market where the trading of the most active attack tools reported by the security industry happens. Our findings reveal that exploits in the underground are priced similarly or above vulnerabilities in legitimate bug-hunting programs, and that the refresh cycle of exploits is slower than currently often assumed. On the other hand, cybercriminals are becoming faster at introducing selected vulnerabilities, and the market is in clear expansion both in terms of players, traded exploits, and exploit pricing. We then evaluate the effects of these market variables on likelihood of attack realization, and find strong evidence of the correlation between market activity and exploit deployment. We discuss implications on vulnerability metrics, economics, and exploit measurement.Comment: 17 pages, 11 figures, 14 table

DARKMENTION: A Deployed System to Predict Enterprise-Targeted External Cyberattacks

“…Hacking community on D2web.. While the hacking community in D2web sites has been widely investigated in the existing literature for applications such as analyzing the economics of D2web forums/markets [13], [14] and identifying future cyberthreats to mitigate risks [2], [15], none of these studies identify threats related to specific corporations or identify when in the future the predicted events may occur. DARKMENTION specifically predicts enterprise-targeted attacks and the periods in which those threats are predicted.…”

Mining user interaction patterns in the darkweb to predict enterprise cyber incidents

“…In this work, we discuss some of the past and ongoing research in the domain of cyber security analytics that also caters to the general area of predicting future cyber breach incidents in real world systems. Most of the work on vulnerability discussions on trading, exploitation in the underground forums [10,11,28] and related social media platforms like Twitter [14,13,12] have focused on two aspects: (1) analyzing the dynamics of the underground forums and the markets that drive it, thereby focusing on mechanisms that enable the market activity, and giving rise to the belief that the "lifecycle of vulnerabilities" in these forums and marketplaces have significant impact on real world cyber attacks [21,9] (2) prioritization of vulnerabilities using these social media platforms or binary file appearance logs of machines and using them to predict the risk state of machines or systems through exploitation of these vulnerabilities [8]. So, the two components in majority of these studies that have been repeatedly worked upon in silos are analysis of vulnerabilities and their likelihood of exploitation in these forums or platforms and, then vulnerability exploitation severity based prediction to associate them to real world cyber breach incidents [5,12].…”

“…The rapid expansion of the cyber-threat landscape is augmented by the presence of underground platforms that support the discussion, proliferation of exploit awareness, deployment and monetization of such exploits leading Table 1: Table of notations to cyber-attacks [15,16,17,10]. However, despite the existing literature that studies the economies of these underground forums and markets present in the darkweb, there has been very few studies that focus on filtering the markets and forums that actually contribute to the threat scenario [18,19,20].…”

“…As mentioned earlier, this streaming nature of feature generation ensures we engineer the features relevant to the timeframe of attack prediction. For choosing the experts with an in-degree threshold, we select a threshold of 10 (we tried the values in the list [5,10,15,20]) to filter out users having in-degree less than 10 in G Hτ from exp τ . We obtain this threshold by manually investigating a few experts in terms of their content of posts and we find that beyond a threshold of 10, a lot of users get included whose posts are not relevant to any malicious information or signals.…”

Stolen account credentials: an empirical comparison of online dissemination on different platforms

“…The dissemination of stolen credentials and the wider demand for stolen data has resulted in thriving online markets as well as platforms where stolen data are distributed for free (High-Tech Bridge 2014). Previous research on underground markets largely focused on the economy of these markets (e.g., Allodi 2017;Benjamin et al 2015;Franklin et al 2007;Holt, Smirnova, and Chua 2016a;Kigerl 2018) or on how trust issues in these anonymous environments are solved through reputation systems and admission procedures (e.g., Dupont et al 2017;Mell 2012;Motoyama et al 2011).…”