Cybercriminals Offer High Quality Plastic U.S Driving Licenses/University ID Cards

Continuing the series of blog posts profiling the most recent underground market propositions for high quality fake passports/IDs/documents, in this post, I'll emphasize on a cybercrime-friendly vendor that's exclusively targeting the U.S market.

Go through previous research into the market for fake passports/IDs/documents:

• Newly Launched 'Scanned Fake Passports/IDs/Credit Cards/Utility Bills' Service Randomizes and Generates Unique Fakes On The Fly
• A Peek Inside the Russian Underground Market for Fake Documents/IDs/Passports
• Vendor of Scanned Fake IDs, Credit Cards and Utility Bills Targets the French Market Segment

Offering fake plastic driving licenses for over 25+ U.S States, including student IDs for major U.S Universities for a static price of $150, the vendor not just currently outperforms competing vendors in terms of quality in this particular market segment -- within the cybercrime-friendly community in question -- but also, is already receiving recommendations from other cybercriminals to raise the price of his underground market 'asset', indicating penetration pricing in action.

Payment methods accepted? Bitcoin, Western Union and Moneygram.

Sample underground market ad:
[VENDOR's NAME REDACTED] has over 25+ states on tap, along with 'secondaries' to offer, all of of which and are high quality, meaning in-state without issue, in most cases. All IDs contain UV (where applicable as some states don't), multispec-hologram, 1D/2D barcode and/or magstripe that will scan/swipe to read DMV/AAMVA license standard.

The vendor is requiring the following data from his potential customers:
Name - First, MI, Last
Address
DOB
Sex
Hair Color
Height
Weight
Eye color
Driver License number - if a number isn't provided one will be randomly generated
Endorsements and/or Restrictions - if not included these will be left blank
Scanned signature - if not provided you will receive a generic font signature

*****More\Less info may be required depending on the state requested

Scanned passport picture - no webcam pictures can be accepted.

If you cannot get a real passport picture and have a decent camera, please take a pic from the chest up against a white background/drywall with the flash 'ON'. I will handle the cropping aspect. Also try to have good lighting and when scanning use high resolution. You may also upload a signature. I ask that this be written using a black sharpie style pen to achieve the best results.

You may upload this info to sendspace.com or the file-sharing site of your choosing and forward me the download link. I will confirm reception via email and you order will begin processing. All IDs are 150USD with incentive to group buys. Payment can be made via BTC, WU, Moneygram. Payment will be collected upon completion and approval of your order.

Sample screenshots of the service's current 'inventory':

The market for fake passports/IDs/documents is prone to flourish, as more cybercriminals demand both, scanned, and plastic fake IDs to be later one abused in related fraudulent schemes. Naturally, the market is quick to supply, and those who excel in their Operational Security and quality of the underground market 'assets', will begin occupying a decent market share within this underground market segment. Continue reading →

The Cost of Anonymizing a Cybercriminal's Internet Activities - Part Four

Continuing the "The Cost of Anonymizing a Cybercriminal's Internet Activities" series, in this post, I'll profile an API-supporting, blackhat SEO-friendly vendor of anonymization services, which is currently offering hundreds of thousands of compromised SSH accounts, HTTP/HTTPs based (compromised) proxies, and the ubiqutous for the cybercrime ecosystem, Socks 4/5 servers.

Catch up with related research on the topic:

• The Cost of Anonymizing a Cybercriminal's Internet Activities - Part Three
• The Cost of Anonymizing a Cybercriminal's Internet Activities
• The Cost of Anonymizing a Cybercriminal's Internet Activities - Part Two
• Cybercriminals SQL Inject Cybercrime-friendly Proxies Service
• Malware Infected Hosts as Stepping Stones
• Hacked PCs as ‘anonymization stepping-stones’ service operates in the open since 2004 
• ‘Malware-infected hosts as stepping stones’ service offers access to hundreds of compromised U.S based hosts
• New service converts malware-infected hosts into anonymization proxies
  

The service is currently offering access to 180,331 compromised SSH accounts, 9597 HTTP/HTTPS proxies, and 110,185 (compromised) Socks servers located virtually all over the World.

How are they gaining access to this accounting data in the first place? Despite the overall availability of brute-forcing tools, in 2013, one of the most popular tactic for obtaining stolen/compromised accounting data, remains the practice of 'data mining' a botnet's already infected 'population' for virtually anything kind of accounting data, to be later on monetized through multiple distribution/abuse channels.

Sample screenshots of the anonymization service:

Sample screenshots of the API in action:

What's also worth emphasizing on is the fact, that, the service is not just targeting potential cybercriminals wanting to anonymize their Internet activities, but also, black hat SEO monetizers, who now have access to hundreds of thousands of fresh Socks servers for the purpose of abusing them on their way to monetize their fraudulent/malicious campaigns.

Vertical market integration, or the one-stop-shop market model, has always been an inseparable part of the cybercrime ecosystem, as it increases the probability that a cybercriminal's one-stop-shop would immediately occupy a larger market share within the cybercrime ecosystem, consequently resulting in more revenue from the facilitation of fraudulent and malicious activity.

Some of the most popular instances of this trendy business concept applied by cybercriminals internationally, include but are not limited to the following real-life underground market propositions:

• A vendor of mobile spamming services would not only offer the actual spamming process, but also, offer harvested mobile mobile numbers as a value-added service, next to the on demand harvesting of mobile numbers for any given geographical region.
• A vendor of managed spam services, would also offer the option to buy segmented and geolocated, as well as often validated, email addresses, with the ability to perform custom harvesting for any given country
• A vendor of managed iFraming platform would also offer access to hijacked traffic to be automatically converted to malware-infected hosts through the platform, with additional services including as for instance, managed crypting of the iFrame/malicious script in real-time
• An author of Web malware exploitation kit, would be also offering managed iFrame/script crypting services next to bulletproof hosting in case the customer desires those

The cost of anonymizing a cybercriminal's Internet activities in this particular case? The price is shaped based on the anonymization method of choice.

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter. Continue reading →