Sometimes there's a case of cybercrime that shines a light on a dark place.
In this case, that place is the deep web.
And the sliver of light shining on it comes from investigators and prosecutors as they sent a 21-year-old U.K. man to jail.
Unfortunately, you won't like the things that appeared because it reveals what those in InfoSec are up against in 2018.
Item #1: DDoS attacks against household names
Alex Bessell created his own botnet of more than 9,000 devices.
He used it to launch DDoS attacks against companies such as Google, Skype, and Pokemon.
And of course, he didn't just launch the attacks on his behalf. His botnet was for hire. Yet another example of DDoS-as-a-service.
Item #2: An entire cybercrime store
Police in the U.K. say in addition to the 102 DDoS attacks from his botnet, and stealing user names and passwords, Bessell ran an online business on the deep web called Aiobuy.
This is cybercrime-as-a-service, revealed.
How much business can one bad actor attract? This is scary:
- Cybercrime products for sale: 9,000
- remote admin tools
- botnet tools
- crypters to hide work from anti-virus
- booter access
- more
- Registered customers: 26,000
- Total sales: $700,000
And this is what cybersecurity leaders are up against in 2018. One bad actor who can rake in close to a million dollars while enabling potentially thousands of cybercrimes around the globe.
Lack of jail time part of InfoSec's problem
What's the punishment for enabling cybercrime around the world? Two years in jail.
And believe it or not, the police and prosecutors count this as a win, because others like him have often been sentenced to probation or community service.
“Anyone who is using their technical expertise for sinister motives needs to sit up and take notice of this sentence—because they face a very real risk of being jailed,” says officer DC Mark Bird, from the dedicated West Midlands Regional Cybercrime Unit.
So there you have it.
A sole proprietor has the ability to set their own hours, bring in 700k helping cybercriminals around the world, and if caught, face minimal jail time.
And that is what InfoSec is up against in 2018.
