Underground hackers are selling zero-day exploits for Microsoft's new Windows Vista operating system at $50,000 a pop, according to computer security researchers at Trend Micro.
The Windows Vista exploit—which has not been separately verified—was just one of many zero-days available for sale at an auction-style market broken into by the Tokyo-based anti-virus vendor.
In an interview with eWEEK, Trend Micro's chief technology officer, Raimund Genes, declared prices for exploits for unpatched code execution flaws are in the $20,000 to $30,000 range, depending on the popularity of the software and the consistency of the attack code.
Bots and Trojan downloaders that typically hijack Windows machines for use in spam-spewing botnets were being sold for about $5,000, Genes said.
The Trend Micro finding highlights the true monetary value of software vulnerability information and serves as additional confirmation that a profitable underground market exists for exploit code targeting unpatched flaws.
Back in December 2005, researchers at Kaspersky Lab in Moscow found proof that the exploit code used in the WMF (Windows Metafile) attack was being advertised by Russian hacker groups for $4,000.
On the other hand, according to Genes, the typical worth of a destructive exploit has increased radically, driving an underground market that could exceed the value of the legal security software business.
"I think the malware industry is making more money than the anti-malware industry," Genes said.
Trend Micro's researchers also found the underground marketplace flooded with personal data stolen in phishing attacks and virtual money hijacked from online gamers.
Genes said the average prices for credit card and bank log-in data can vary dramatically, depending on the bank's brand and the way the data is mapped to names, Social Security numbers, dates of birth and physical addresses.
A custom Trojan capable of stealing online account information can be purchased for between $1,000 and $5,000, while a botnet-building piece of malware can cost between $5,000 and $20,000, Genes said.
Credit card numbers with valid PINs are sold for $500 each, while billing data that includes an account number, physical address, Social Security number, home address and birth date can be found for between $80 and $300.
The auction marketplace is also advertising driver's licenses for $150, birth certificates for $150, Social Security cards for $100, and credit card numbers with security code and expiration date for between $7 and $25.
PayPal or eBay account credentials are available for $7, Genes said.
|
