Tools Track Computer Viruses, Trojans, Robots

Researchers at Carnegie Mellon University have discovered a pervasive black market for black warez - viruses and Trojans intended to damage or hijack the computers of unsuspecting users. The researchers estimated the value of the transactions over the seven month period in which they studied the issue at $37 million.

The team at Carnegie Mellon was led by Associate Professor of electrical and computer engineering Adrian Perring working at the National Science Foundation's Cybersecurity and Trustworthy Computing Center, working with PhD student Jason Franklin. Research and development of tools for tracking and analyzing the data was conducted simultaneously by Vern Paxson of the International Computer Science Institute and Stefan Savage of the University of California, San Diego.

The quartet developed a set of automated tools to track the transactions as part of the research. What surprised the team after gaining access to the data was the sophistication of the network, which included sales and support of viruses and Trojans, as well as furnishing credit card lists with tens of thousands of stolen credit card numbers.

"These troublesome entrepreneurs even offer tech support and free updates for their malicious creations that run the gamut from denial-of-service attacks designed to overwhelm websites and servers to data-stealing Trojan viruses," said Carnegie Mellon's Perrig in a press release from the university.

The Computer Security Institute in 2007 estimated companies saw a sharp rise in losses due to credit cards being stolen via these illegal tools, from an average of $168,000 in 2006 to over $300,000 so far this year.

Viruses and Trojans are malicious software, intended to either damage or take over a computer, sometimes sending sensitive information such as banking passwords, stored credit card information, and enough information to actually steal the computer owner's identity. An estimated 100 to 200 new viruses are created every month, challenging companies that provide protection against infection to be constantly vigilant, as well as computer users constantly updating their software.

One of the more nefarious types of software the researchers found being hawked online were robot spyware, which may lurk on a system for weeks or months without detection before receiving a command to attack the host computer, or to send the information it has gathered in one large burst of data. Some such robots are also used in denial of service attacks, an effort that brought down access to Yahoo and Microsoft simultaneously in 2005.

"We believe these black markets are growing, so we will have even more incidents to monitor and study in the future," Perrig said.