The Evolution of the Shadow Economy

Black market.

Shadow economy.

Underground economy.

Organized crime.

These are a few well-known terms used to describe a $105 billion worldwide criminal industry. And while they don't hold conferences or tradeshows, Internet criminals are at the wheel of an economy driven in very much the same way as the real economy -- by the principle of supply and demand.

Maksym Schipka, senior architect at MessageLabs, has been hunting cybercriminals for over ten years.

"I've been in the AV (antivirus) industry since 1997, and ever since I've been very excited about the industry," Mr. Schipka told IGamingNews. "I've been doing all sorts of things, including designing and developing antivirus engines and antivirus products and researching the latest trends and how cybercrimes evolve, really.

"But I've been doing all of that from the very pragmatic point of view to learn and to understand and to be able to predict what kind of threat we are going to see tomorrow, so that we could start devising protections today," he added.

In looking deeper into cybercrime, Mr. Schipka began to draw strong parallels between the real economy and the underground economy.

"It just was so striking that I decided it was worth bringing it to the public and talking about it a bit more, because knowing about what drives the underground economy -- by putting parallels between it and the real economy -- would enable people to understand the shadow economy better, and therefore plan their protections and devise the strategies for protecting themselves better," he said.

The Birth of the Shadow Economy

The shadow economy started with a couple of scientists who wondered whether they could create an intelligent computer program that would observe, evolve and adapt with other computer programs, Mr. Schipka said.

"Those programs weren't too complicated and were only created as an interesting experiment," he added.

But what started out as a harmless experiment was eventually coopted.

"Pimpled teenagers began to create malicious programs to spread as much as they could simply to gain recognition," Mr. Schipka said. "It was a way of saying: 'Hello, I'm here. Notice me.'"

Then, as the Internet evolved and the world became more interconnected, a faction of the criminal underground began to realize they could make money from sending spam, for example, he said.

But just as quickly, he said, the underground realized that the way it was sending spam was too easy to block, which is when spam and malware -- which was created to enable the spammers to send their unsolicited e-mails -- started to converge.

The Shadow Economy Finds Investors

Criminals on the Internet, realizing they could make a profit from the new technologies in cybercrime, started to think it sensible to organize, and people with different responsibilities and different specialties joined to form malware groups, Mr. Schipka said.

Some of the more famous groups include 29A, known for the first Win 2000 virus, and Russian Business Network, which specializes in personal identity theft.

As these groups began to grow, the real-world criminals took notice and became interested in organized Internet crime, Mr. Schipka said.

"They were already making money on drugs and selling firearms, etc., but they realized with this whole Internet thing they could make even more money in an illegal way and they started to invest into these groups and evolve them and create certain structure around them," he said.

Today's Underground

"Nowadays, organized groups still exist but are contributing only a small part -- about 10 percent -- to the underground Internet criminal market," Mr. Schipka said. "Everything else is an open market -- a set of loosely interconnected Web sites, disconnected shops, or outlets, buying and selling malware for a profit."

The shadow economy is still run in very much the same way, but without nearly as much the organized-crime element, he said.

Hundreds of forums exist with names like "exploit.in" for the sole purpose of buying and selling malware, and each has its own specialty -- like distributed denial of service, or DDOS, attacks, buying and selling identities and methods for hiding malware.

"If you need for example a list of C.E.O.s of manufacturing companies in Canada, for example, that's the sort of thing you can request on these forums," Mr. Schipka said. "And anonymity is guaranteed because the buyer may be in the United States and the seller may be in Nigeria and they only know each other by their MSN screen names."

Although governments have managed to shut down a number of these forums, supply and demand keeps them coming back.

Conference Spotlight: Combating Cybercrime in Betting & Gaming

Maksym Schipka will be presenting the keynote address on January 27 at the CCBG conference in London.

Click here for more information on this event.