Hosted malware allows n00bs to hack along with the leet

Say you've bought a tool for infecting PCs and using them to send spam, harvest bank details and passwords, or some other criminal act -- but you lack the technical wherewithal to install and maintain the tool yourself.

Have no fear: a new "cybercrime-as-a-service" industry offers hosted, maintained malware deployments that you can rent time on, eliminating the humiliation of groveling before angry teenagers with the technical skills and spare time to get your badware running.

"It was inevitable that services would be sold to people who bought the malware toolkits but didn‘t know how to configure them," Vajdic said.

"Not only can you buy configuration as a service now, you can have the malware operated for you, too. We saw evidence of that this year."

"Investors get malware developers to write code for them and then get the writers to host and distribute it, too."

Vajdic showed delegates an email purported to be from a malware 'provider' offering hosted services for an extra $50 for three months.

Vasco's regional director for Pacific, India and Japan, Dan Dica, said company researchers buy the kits online and disassemble them to try to learn the secrets of their programming.

"The kits come with maintenance, support and a user guide," Dica said.

I keep waiting for really solid evidence that cybercrime is as pervasive as it seems to be. The best indicator I can think of would be a cratering of cybercrime prices -- say, botnet owners slashing prices and desperately spamming all and sundry looking for someone who'll pay to use their bots to DDoS an enemy or victim.

Cybercrime-as-a-service takes off (via /.)

• [wynneth]

  Imagine if something like Conficker were used for good. Thousands, nay, millions of cpus using idle time to run calculations for astrophysics or something equally viable. Instead of logging hours on the big time computers at the University someone could be logging hours on a geographically distributed multithreaded supercomputer. Or using them to SPAM details of these horrible laws being passed around the world and the corruption that pervades all. Either way.

• [wynneth]

  …and yes I realize that was the idea behind the Seti@Home project, before someone tries to point that out.

• [pKp]

  I think I read about that in a great YA sci-fi book some time ago… :)

  It IS frightening, though. Not really new (back when I was a 14-years-old, I had fun scanning IP ranges for trojan-opened ports and changing people’s desktop background), but to imagine that kind of power in the hand of any klutz with 400 bucks to spend…

• [Bade]

  Sorry Cory, but only a n00b would misspell l337.

• [kleer001]

  Conficker was found out in October of 2008.

  Conficker, with an estimated 9X10^6 nodes outranks the combined effort of the scholarly (and practical) efforts of volunteers, ref -> http://www.allprojectstats.com/

  And Conficker is only one botnet. Without a doubt the combined computation power of all involuntary cpus outstrips the efforts of any one government, country, or military power.

  I like to think of it as analogous to snippets of a crappy 80′s cartoon theme song running in your head, with teeth and a yen to sell you \/i@gR_A