Pierluigi Paganini February 24, 2013

Few days ago  I was surfing on my favorite security web sites and I found an interesting post published by the great security expert Dancho Danchev on Webroot portal that released a profitable e-commerce of credentials related to compromised PayPal accounts.

The security analyst found an underground web site that proposes Paypal account accesses categorizing them on amount of money they retain, the site propose a list of accounts with related balances and offers them for prices between $15 and $20 each one, and propose also accounts with no assets at $2, criminals acquire empty accounts hoping that owner will make deposits soon.

The web site proposed credentials related to accounts of US (1,543) and UK (14) users.

In reality the sale model is more articulated, every account is ranked on different attributes such as the availability of  email address of victim, card confirmation, verified/not verified account, type of account, bank confirmation, first name of the victim, the country of origin and of course the balance.

This attributes concur in the evaluating of selling prices, Dancho Danchev on the monetization process implemented by criminals writes:

 “What we’ve got here is a decent example of how these inexperienced cybercriminals are looking for ways monetize the fraudulently obtained data as soon as possible, instead of ‘cashing out’ the accounts by themselves, which could lead to possible risks to their operational security.”

What is really interesting is the complete offer of criminals that provide also an anonymizing service through a built-in Socks5 proxy checker.

SOCKS is an Internet protocol that routes network packets between a client and a server through a proxy server,  SOCKS5 provides also  authentication mechanisms to allow connections to server only to authorized users, in the specific case it is used to interact with the hacked PayPal accounts in anonymous mode.

“These are not publicly obtainable Socks5 servers. Instead, they are compromised malware-infected hosts converted into anonymization proxies, allowing the cybercriminals who are about to “cash out” the hacked PayPal accounts to risk-forward the possibility of getting traced back to the IP of an innocent malware-infected victim.” 

The monitoring of underground web sites and forums is vital in the cybercrime prevention, thanks to their analysis it is possible to detect new criminal trends and establish proper countermeasures, these reports are fundamental for investigation and sharing of result is essential … let’s pay attention to the born of similar E-shops.

Pierluigi Paganini