Stolen bank account numbers are commanding the highest price in an underground trade of personal details stolen by hackers, according to a survey released Monday by security vendor Symantec Corp.
Bank account details command prices of up to US$400, while credit card details sell for between $0.50 and $5, e-mail passwords from $1 to $350 each, and e-mail addresses from $2 to $4 per megabyte, according to Symantec's Internet Security Threat Report, which covers the first half of the year.
The online trade in stolen details highlights the commercialization of Internet crime, with gangs researching, developing and marketing nefarious software for other criminals, said William Beer, director of security practice for Europe.
There has been an increase in the quality and quantity of malicious code sold on the Internet, driven by well-funded international groups of criminals, Beer said.
The hackers are obtaining the information through increasingly targeted attacks on computers that often involve collecting personal information about a person from social networks such as MySpace or Facebook, Beer said.
With specific personal details, the hacker can construct a personalized e-mail that entices the victim to either click on an attachment containing malicious software or visit a phishing site.
Symantec is also seeing multistage attacks where the attacker places a small piece of software on a target computer that then acts as a beachhead for downloading other software.
"The end user will not even notice the attacks have taken place because it's a very gradual process," Beer said.
On the spam front, Symantec said it has noticed a 30 percent drop in so-called "pump-and-dump" spam, where e-mails touting penny stocks are sent out, causing a rise in the stock price before the perpetrators sell the stock early. The decline can be attributed to a crackdown by the U.S. Securities and Exchange Commission.
Also down is the percentage of spam with images, which started as a highly effective way to bypass spam filters but is now less so. About 27 percent of the spam analyzed by Symantec between April and May contained images, down from 50 percent the first week in January, Symantec said.
The decrease is due to an improvement in spam filters as well as the decline in pump-and-dump spam, which often used images, the company said.
"Stolen Bank Data Fetches Big Bucks Online" Comments