The ZlobFather

Posted by Maxim Weinstein Wed, 16 Jul 2008 16:57:00 GMT

Ars Technica reports on a recent report by security vendor Finjan, describing how criminal malware groups are getting more organized, much like the Mafia in The Godfather or the drug gangs in The Wire:

Finjan describes the employee structure that these cybercrime companies employ as being similar to the Mafia. In both cases, there is a “boss” who operates as a business entrepreneur and doesn’t commit the (cyber)crimes himself, with an “underboss” who manages the operation, sometimes providing the tools needed for attacks. In the Mafia, several “capos” operate beneath the underboss as lieutenants leading their own section of the operation with their own soldiers, and in cybercrime, “campaign managers” lead their own attacks to steal data with their “affiliation networks.” The stolen data are sold by “resellers,” similar to the Mafia’s “associates.” Since these individuals did not partake in the actual cybercrime, they know nothing about the original attacks. They do, however, know about “replacement rules” (for example, stolen credit cards that have been reported) and other company-specific policies, just like the sales representatives you talk to in your average store.

The more organized the criminals, the more industry players need to work together, share data, and organize ourselves against the badware threat. This is especially true if we want to thwart badware while still maintaining integrity and openness, as I described in my recent guest blog post at ZDNet.