16 ms·
Dark Web Price Index 2020
- rwmurrayVT 6y agoYou would be very hard pressed to find a cloned card + PIN anywhere. That's the holy grail and information like that would never find it's way outside of a team. Think about how easy it is to go to an ATM and use it.. Why would you sell that information for $25? The rest of it seems fairly accurate based on jstash/unicc/etc.
- mopsi 6y ago> Think about how easy it is to go to an ATM and use it.. Doesn't seem easy at all. ATMs have cameras and are monitored for abnormal transactions (stolen cards, unusual withdrawal patterns, etc).
- rwmurrayVT 6y agoIf the data is collected from a skimmer + pin pad camera then you are already in the current area of the cardholder. There are a lot of ATMs without cameras or ways to avoid your face appearing fully in a camera. Unusual patterns and stolen cards are one of the primary reasons that they will rarely ever leave a team. It takes a great deal of work to gather stripe data + PIN. It's much easier to look for a website without PCI compliance. In-person carding is going by the wayside, but is much easier to accomplish if you have good data. You can buy dumps, but no one is turning over a PIN.
- ornornor 6y agoCameras don’t do much unless the suspect has already been arrested and it’s just a matter of building up evidence. Cameras can’t tell you the name and address of the pixel blob that is committing the crime. Cameras as a security device are overrated. My building had countless footage of people entering the bike room or parking and stealing bicycles. Resident makes a complaint to the police, proudly says “we have cctv footage!”, police shrugs and looks at cctv footage, and nothing happens because what do you do with the video of a thief stealing your bike..?
- admax88q 6y agoI'd argue that has less to do with the merit of cameras and more to do with how little police care about stolen bikes compared to stolen credit cards.
- ornornor 6y agoI’d say it goes for any kind of cctv footage. It’s always too low quality to identify an individual, and doesn’t show anything else than the crime happened. It’s useless to identify a suspect unless you already have the suspect in custody and can match time/location/clothes. When has anyone ever been arrested from being identified from cctv footage?
- bsza 6y agoIn the UK, more than 2500 times in one year, according to this article: https://www.theguardian.com/uk-news/2018/nov/11/super-recognisers-police-the-people-who-never-forget-a-face https://www.theguardian.com/uk-news/2018/nov/11/super-recogn...
- ornornor 6y agoOut of how many cases though? 2500/2500 is rather impressive, but 2500/1,000,000? Not so much.
- ryanlol 6y agoCops definitely care more about stolen bikes than stolen credit cards.
- colinmhayes 6y agoWe're not that far from a world where people can be tracked back to their home/car using cctv. Places like London and china have that level of coverage already, they can follow you from one cctv to another, it's just a question of effort.
- mumbisChungo 6y ago
- scoutt 6y agoMaybe there is a legal difference between stealing the data, selling the data and using the data (perhaps in terms of prison years?).
- vmception 6y agoIt is. The majority of the enforcement work is around industry safeguards and customer re-imbursal from insurance pools. And very little of the work is around prosecutions because the liability is shifted and moved around very similar to a corporation, but even more distributed. The hacker doesn't hack, but sells the information to be weaponized. The person that weaponizes only does that to get a giant leak of data, that they sell in pieces. The person that buys a few cards, gets 1 that works, and now we are talking about a few thousand dollars. Almost too small to care for a big investigation. And so on and so forth. There is rarely anyone to levy the whole force of the RICO act + CFAA + Wire Fraud + Conspiracy + Using a fake ID + etc etc
- cosmodisk 6y agoWhy? Isn't that how card skimming used to work? The skimmer pulls card data,while the mechanism designed to capture PIN( video or physical keylogger). Being able to get CC details is quite a different business compared to actually using them to get goods/services.
- jackpeterfletch 6y agoSelling the infomation on the Dark Web is an easier and less risky way to extract value than actually trying to get a product delivered physically.
- cbg0 6y agoI think some readers are misunderstanding this, a cloned card in this context is actually skimmed from an ATM, which allows you to copy the physical card because you have copied the magnetic strip and also have the PIN associated with the card, though this is not the same as having the card number, expiration & CVV2 code from online phishing.
- cbg0 6y ago> Why would you sell that information for $25? Because there's almost no risk associated with it. You don't have to get a team together to hit up ATMs and extract money from those cards, which requires trust and increases complexity, you just mount a few skimmers, collect the data, remove the skimmers, and then sell it online and let someone else take the risk.
- ryanlol 6y agoIf you’re already installing and removing skimmers, quickly stopping at a few ATMs doesn’t seem like much work.
- cbg0 6y agoIt's not "much work" but it is a lot of extra risk, because after you empty someone's credit card they'll quickly find out and alert the bank, which will alert the authorities, while skimming can go undetected much easier.
- epanchin 6y agoIn the UK, banks don’t alert the authorities.
- pc86 6y agoWhy not?
- martinald 6y agoThere is so much fraud the police can't keep up. Customers are told to contact 'Action Fraud', which is staffed by people on minimum wage and undercover filming shows them basically laughing at victims as they type up another pointless report that goes into the bin. If you're the police and you have the option of spending resources on burglary or muggings (which cost an absolute fortune in police time, generally low value, but in the public's eye very important) or payment fraud, the police will put time into "in person" crime every time.
- 14 6y agoBecause selling a card online where you never have to meet anyone is much safer then taking a stolen card and start using it where you may end up on camera or police called at point of purchase. Much safer to keep your distance and just sell numbers.
- ryanlol 6y agoYou don’t use dumps with pin at pos, you use them at atms. The ATM won’t call the police on you or care if you’re wearing a motorcycle helmet.
- ryanlol 6y agoYeah, nobody sells dumps+pin for $25. This just doesn’t happen.
- hocuspocus 6y ago> Think about how easy it is to go to an ATM and use it In most places finding an ATM that still uses the magnetic stripe is certainly not easy.
- blotter_paper 6y agoZoe gods have chips: https://youtu.be/jT-jmq8KBw0 https://youtu.be/jT-jmq8KBw0 (Some chips aren't actually signing anything, they're just another way of reading the same info that's on the strip. It depends on the company issuing the card. This isn't covered in the video, but it's true.) As the video shows, there are other vectors of extraction than ATMs.
- skim_milk 6y agoSure, you can get this data, but you also have to test what credit cards work and what don't. You can't just go to an ATM and start working through 50 credit cards you stole until one worked without something noticing. I'm assuming a lot of the cost is sunk to just testing if the credit cards even work and how well their fraud detector/max purchase limit is set up, which is very costly, so labor cost might be very high compared to the raw $25-per-number. Some time ago I accidentally stumbled upon how some organized crime ring determined which credit cards worked. Someone in my party asked the Uber driver one night what other gigs they do for money. He said he uses this one card to get 40% cash back. Of course I asked more questions being the only one in security at this party: He starts talking saying he goes around to different, small, local businesses - but never visiting the same place twice - and uses this card to pay for his friends' food, splitting the bill, but keeping the cash back rewards. Sometimes the card is rejected and he has to keep trying until it works finally. The actual credit card has to frequently connect to his phone by pushing a button on the card to sync with his phone to make purchases. Of course what his phone is doing is downloading a backlog of CCN's which then is sent to the credit card to change the magnetic strip dynamically - completely unknown to him he's testing if credit card numbers are working and getting paid for it. Genius scam, but that's what this one specific crime ring has to pay in order to check the availability of stolen credit card numbers.
- inetknght 6y agoDoes he get a bill and have to pay off the card? I assume that would _also_ go to stolen bank accounts.
- skim_milk 6y agoI couldn't tell 100% if he was "in" on the scam or not - has he really never thought of why they tell him to go to distant restaurants, never returning, and why the card is always declined multiple times, and why the cash back is THAT HIGH? He did give me a referral as if he was trying to sell this idea but I didn't get very far in their signup (first question: my full name. pulled the plug there) and he introduced this topic as if he was "working" on this "technology" that I had to ask a dozen questions to pry open before he even got us introduced to his "credit card" (either he was really working on it and wanted to keep it secret from us actual techies, or knew something was sketchy and didn't want people to know he was doing shady stuff, or he genuinely thinks he is beta testing some legit technology and getting rewarded for it but didn't want to immediately go into detail) But if he isn't in on the scam and does pay off his card, funny enough, that must mean all of his money is going directly to the crime ring. Two birds with one stone!
- pc86 6y ago> Why would you sell that information for $25? Because now you have $25, and you don't have your face on video using a stolen debit card?
- ryanlol 6y agoWhich ATM requires you to show your face?
- deleted 6y ago[deleted]
- bilbopotter 6y agoLet's say I decide to pay $800 for ddos attack. Provider pockets the $800 and doesn't carry out the attack. What's my recourse? Contact customer service? Nope. Contact the police? Hmm. You see the whole thing is a scam. There are plenty of articles online about it.
- deleted 6y ago[deleted]
- waihtis 6y agoI don't think it's that straightforward. If you're in a "law enforcement free-zone" and can bank a recurring service fee versus a one-time scam running these kind of services, why not engage in such behaviour? There are career criminals with reputations also.
- evook 6y agoIt's not a scam. Those scenes live by reputation alone. If you need something as a once in a lifetime service you are well advised to use a trusted third party within the scene. Those are either trade mods or well known veterans. If you become familiar and known in the scene the risk of being scammed is very low and if it happens it's more like a "one last money grab and I am done thing" where the person offering the service will disappear. But since this works once per online persona this really doesn't happen that often.
- kace91 6y agohow does one even begin to become known in a scene if you don't even know where (or if) it exists? Not that I'm planning to purchase any of those services of course, I'm just curious because it sounds like there's no possible starting point, unless by pure chance one of your personal friends happens to be already involved in the area and lets you know.
- doublerabbit 6y agoThere is a very easy starting point. Google Use the phrase "darknet" then just apply the word "markets" and you'll already started the jump down the rabbit hole.
- lifeformed 6y agoWhy do bank accounts with money in them sell for less than the amount in them? Is it counterbalanced by the risk of withdrawing from them?
- lukeramsden 6y agoYes, not only is it very risky to attempt to withdraw money from them, often times you won't manage to get the full amount out before fraud systems go off. Same with credit cards.
- wmeredith 6y agoThis was my thought, admittedly knowing little about this world. E.g. a stolen item's street value is a fraction of it's actual used goods value. It's only worth what you can get in cash within hours.
- Thorentis 6y agoI don't believe any of this. $20 for a credit card that has up to $5000 on it? Which criminal would sell something worth $5000 for $20? Even PayPal accounts with over $3000 selling for $100? Makes absolutely no sense. The other line items about Malware with "slow spread" is absurd. This is BuzzFeed level cyber journalism.
- deleted 6y ago[deleted]
- lukeramsden 6y agoI have no idea how these prices were calculated, but I can tell you that the prices for the credits cards are quite correct (at least approximately). $20 for a credit card with $5k limit is not worth $5k - you've got to actually get value from it, usually by trying to buy goods or bitcoin with it, which is very risky, time consuming, requires a lot of skill and effort, and you won't get the full $5k from it. The people selling them are presumably "hackers" looking to make money off of stolen PII/FI.
- lifeformed 6y agoCouldn't you use card credentials to get a cash advance at an ATM? I am assuming a chip-less card's magstripe just has the credentials on it, so it should be easy to copy? I guess the banks fraud systems would catch an unusual withdraw.
- notahacker 6y agoA lot of cards are going to have low limits or blocks on cash advances. Withdrawals from overseas are particularly likely to fail. And the card owner might realise his credentials have been stolen by the time the card hits the market .
- xondono 6y ago- You could, but you'd be exposing yourself, so you'll want to send a mule in your place. - That adds extra risk, so you might have to pay someone to scare that mule into doing their part. - You'll want to get that laundered somehow, so you'll want to arrange some nice path that leaves no trail to you, maybe through Western Union? And so the costs keep increasing and your margin goes down. The key of the game is to setup this kind of stuff at scale. Then it doesn't really matter if you're making only 60$ from each card, as long as it covers the cost.
- netsec_burn 6y agoWhat makes malware "low quality", "high quality", "premium", 70% reliability, etc. Sounds like it's all low quality to me, because outside on the regular market zerodays can be 100k-1M or more. If I remember correctly, Alphabay used to be where darknet zerodays were listed before it was taken down.
- tmikaeld 6y agoConsidering the enormous amount of un-patched android phones, I'd assume that low quality is considered a low-end phone being malware controlled. So what it can do is as limited as it's hardware and connectivity?
- malux85 6y agowhere's the best place now?
- easterncalculus 6y agoZero days also aren't malware necessarily. Zero days are usually bought and sold by those that use them to create malware they don't sell (to keep the 0day secret). Paid malware isn't all necessarily low quality, but most of it out there is. If you want something high quality I'd imagine you wouldn't see the listing for a particular malware that is high quality, but for someone who can write something high quality. Something custom developed will always be less detected than something being traded around.
- qwerty456127 6y agoWhy hacked Facebook/Gmail/Instagram/etc accounts are so expensive?
- dewey 6y agoOne reason might be that these "legit" accounts are used to pay for ads: https://www.cnet.com/news/your-hacked-facebook-account-may-be-bankrolling-scam-ad-campaigns/ https://www.cnet.com/news/your-hacked-facebook-account-may-b...
- stevespang 6y agoPhone verified facebook logins (and the others) are like $5 and less . . .
- cycomanic 6y agoFollow up question, if they are so important why has no-one created a scheme of scamming the scammers. Just create lots of new arbitrary Gmail accounts and sell them on the dark web? How do they prevent that?
- ndr 6y agoWhat makes you think this is not the thing on sale?
- tripletao 6y agoA hacked Gmail account and an empty new account both have commercial value, but with very different applications. For the quoted price (~$150), a hacked real email account would have to be full of personal information useful for identity theft type fraud, or able be used to gain further control of other accounts that support password reset by email. An empty new account ("PVA", phone-verified account) is good only for spamming, registering fake accounts with services that require an email address, etc., with typical pricing in the tens of cents. PVAs are closer to commodities, while the pricing for a hacked real account would vary a lot with the victim (child vs. college student vs. investment banker vs. careless cryptocurrency enthusiast vs. ...). Of course nothing stops an anonymous seller from defrauding an anonymous buyer in a one-off transaction. But sellers operate under some kind of semi-stable pseudonym, so they do care about their reputations. They might also be selling on a market where some third party would look at the goods provided and adjudicate a dispute.
- itchyjunk 6y agoIf you get on torsearch or similar tor search engines, you see ads for similar stuff. You also see links in forums and such for places selling what you want. These are the types of prices the ad's themselves claim. Is the author taking all those numbers at face value? Or is this some more in-depth research where it was possible to purchase one or more services? If it's former, I don't find these numbers to mean much. The links can be dead by the time you get to them. You don't know if it's just another honeypot. You don't know if you'll get what you pay for.
- bilbopotter 6y agoExactly the author didn't buy a single thing. Honeypot scams all the way.
- hashmal 6y agoHow can you build a dark web price index and not mention drugs at all?
- Legogris 6y ago> We were only interested in products and services relating to personal data, counterfeit documents, and social media.
- prodmerc 6y agoYou don't even need the dark web these days haha I bought an expensive T-shirt a long time ago from a rather legit looking apparel company (nice website, LTD company/bank account). Learned the right words on Reddit, hit up Instagram and started looking for and messaging people. Got a few replies, went with the one who had the most legit looking photos. After a few questions on WhatsApp (yeah, really, lol) got directed to the website and bought the right item... via direct debit because their payment processor was "down". Big risk on my part, I guess, my plan if popo called was to just say "hey I only ordered a t-shirt!"... I did not think it through very well. Got it pretty fast (Royal Mail tracked and signed) and found a gift pack of "Revels" inside. How nice of them! It seems rather risky for them, wouldn't it take just one guy to talk? Or maybe the seller was new to the business. Tbf, setting up a company, bank account and shipping, all while staying anonymous is extremely easy (but not legal) in the UK compared to the rest of EU.
- hashmal 6y agoDon't give everyone the secrets! ;) Joking appart, my question wasn't to learn about drug prices for "practical use". I just think it's an interesting subject: how the web changes underground/illegal markets, what impact it has, etc. There are lots of counterintuitive things in that field (look at how Portugal handles it), which makes it even more interesting to me. "war on drugs vs war on drug users".
- bilbopotter 6y agoHitman-for-hire darknet sites are all scams. This wired article explains how these offerings are all scams. https://www.wired.co.uk/article/kill-list-dark-web-hitmen https://www.wired.co.uk/article/kill-list-dark-web-hitmen
- rezic 6y agoThat was a great read, thanks!
- SV_BubbleTime 6y agoIf you are a real hitman it seems you have a steep marketing issue to operate on dark net. “First hit free” is a bad approach.
- duxup 6y agoIt seems like an anonymous hitman system just doesn't work. For the hitman, it's much safer to just take the down payment / etc and not do anything. That's just way more cost effective / lower risk to do that over and over again. For the person hiring them... no reason to think the hitman won't do the logical thing and not do the hit / walk with the up front cash.... and probably limited no incentive to pay after the deed is done if in fact everyone is anonymous. Historically speaking hitmen seem to be tied to organizations who the hitman and the employer more or less can trust / provide some level of protection / regular work / other work or at least the promise of it. And generally the the professional hitmen eventually tend to be disposed of by the next hitman after their usefulness to their employer fades... A system where nobody trusts anyone would seem to only attract scammers and some random idiots. Hard to imagine it working out any other way.
- joan_kode 6y agoDark web marketplaces are not exactly "a system where nobody trusts anyone". They are pseudonymous, as opposed to completely anonymous, and sellers absolutely build reputation and some degree of trust. Otherwise nothing would work - the problems you point out would prevent any business at all. It's theoretically possible for a hitman to build reputation in such an environment. However, it would have to be comparatively slow and high-stakes, which I suspect is the main problem and tips the scale towards scamming.
- vmception 6y agoOne thing I hate about the underground is the blatant racism to deny service, and then having to pretend that this is not a reflection of the general society but not being able to talk about it. From forgers to illegal sex workers. Even the rationales are flimsy.
- pmiller2 6y agoThis seems like an interesting comment, but I don't really understand it, probably from lack of context. Are you saying darknet sellers discriminate based on race for reasons that don't make a lot of sense? Or am I misunderstanding?
- vmception 6y agosome darknet sellers and illicit marketplaces discriminate against certain races, while I never see other certain races singled out at all. there are easy rebuttals to help justify why different kinds of service providers discriminate in those specific trades if I elaborated at all, but the rationales behind them still don't make sense. I only posted as it might be a shared experience for some people passing through here, and insightful to people that haven't experienced it. If you are in the habit of questioning the validity of a reality you personally haven't perceived, then this comment just isn't for you.
- at_a_remove 6y agoNot questioning the validity but saying they don't understand and requesting further detail.
- vmception 6y agoyeah its not going to happen, sorry. if there are people with a shared experience here then go ahead and talk about it.
- GordonS 6y agoI'm probably missing something here, but I don't really understand how service providers in an anonymous marketplace can discriminate based on race - how would they know the race, gender or any other attribute of their buyer?
- TheAdamAndChe 6y agoIt scares me that posts like this always write of Tor like it's not compromised. I browsed Tor regularly between 2011 and 2013. Late 2012 and early 2013 brought the most precipitous drop in deviant material. Before then, you couldn't throw a stone without coming upon CP(I avoided it like the plague but knew it was there), you could buy literally any drug on the Silk Road safely, and you could easily find bomb-making and asymmetric warfare information. Nowadays? Not so much.
- SahAssar 6y agoDo you mean that the entire system is compromised or just that individual sites are? Because it sounds like you are painting with a very broad brush here.
- TheAdamAndChe 6y agoI consider it likely that the entire system is compromised. I saw with early Tor that if a network is both truly anonymous and advertises itself as truly anonymous, deviant material is accessible everywhere. Tor didn't stop advertising itself as anonymous yet defiant material is a lot rarer, which tells me that it may not be as anonymous nowadays as they say.
- devalgo 6y agoThis isn't proof of anything except that the makeup of content there has changed over time. You can find write ups of how people like Dread Pirate Roberts or other large Marketplace players were caught and it doesn't seem like it was due to compromises in Tor, naturally if there are backdoors that 3 letter agencies are using they wouldn't advertise it but that doesn't seem to be the case.
- neatze 6y agoIt might be compromised, but there is alternative explanation, people who don't agree with defiant content do there best to shut it down. (eg. over time there are more people attacking hosting with some defiant content for fun)
- wolco 6y agoWhat shocked me is no price for youtube followers. I guess twitter, ig matter where youtube followers don't.
- JohnTHaller 6y agoA large percentage of followers that don't engage in watching videos hurts you in the YouTube algorithm. Twitter and Instagram likely just want to show high user numbers.
- crznp 6y agoRather: fake youtube followers have a negative ROI. Perhaps because they don't matter, but perhaps because they are more difficult to create or Google is better at spotting fakes.
- coronadisaster 6y agoOr maybe Twitter and IG dont care about fakes...
- b1ur 6y agoThat's my guess. On twitter/ig, advertising deals would be done directly between accounts and advertisers, so the social media provider itself wouldn't really care; fraudulent engagement numbers are third-party. YouTube is different, where the host also provides the advertising service, and fake numbers hurt Google's bottom line. So they're probably both harsher on fakes and better at detecting them
- cwkoss 6y agoOr maybe search priority is related to percentage of followers that interacted with a given video
- ed25519FUUU 6y agoThe most surprising thing to me on that list was the AAA emergency road service membership card for $70. Why would this be so valuable? Stealing somebody else’s free emergency tow? Isn’t a membership itself only like $120 a year?
- nojito 6y agoIt's used to commit insurance fraud.
- Taek 6y agoOne of the biggest takeaways from this for me is that PayPal has awful security when it comes to compromised accounts. The only reason compromised accounts would trade for prices that high is because hackers have a high success rate of stealing funds from them, and a low chance of getting caught. Credit cards and bank credentials being worth comparatively much less means that hackers don't have easy ways to secure the funds - either there's a high risk that the transaction is reverted, or there's a high risk that the hacker gets caught and goes to jail. You can tell it's not just an effort issue because the value of the accounts barely scale as the amounts in the accounts increase.
- awakeasleep 6y agoIt's hard to parse your take, I think the phrase 'security' must be overloaded. Considering there are ~325 million active paypal accounts, wouldn't there be a huge supply if their security, overall, was lax? And furthermore, isn't the security of a criminal getting money out of the system only equivalent to getting the money through banks?
- Taek 6y ago"Paypal has awful security" -> it is easy and low risk to walk away with a bunch of cash if you get access to a Paypal account. I'll try to re-word the GP, thanks for highlighting your confusion.
- notatoad 6y ago>wouldn't there be a huge supply if their security, overall, was lax? i don't think normal demand curve applies to stolen bank accounts. the value of a stolen account would be the average amount of money you can expect to get out of it, regardless of how many stolen accounts are available. An increase in supply wouldn't make that any different.
- deleted 6y ago[deleted]
- cainxinth 6y ago
- SV_BubbleTime 6y ago> The “quality” [counterfeit money] tend to cost around 30% of the banknote value. This was the most surprising to me. Seems like it’s extremely high priced. You get a 30% discount for using counterfeits and potentially getting the secret service on you? Maybe that is a reflection of its quality but... Yea, no thanks. Edit: Ohhhh My bad read it wrong. 70% off... better but these would have to be amazing quality.
- wmf 6y ago30% of the banknote value = 70% discount. I suppose if you're spending the cash on something illegal anyway the Secret Service is less of a concern.
- SV_BubbleTime 6y agoYou’re right. I’m an absolute idiot. So $6 actual for a $20 bill. I see how that could be tempting to someone but I’m pretty sure it would have to be somewhere outside the US, you don’t mess with fake money here.
- b1ur 6y agoI haven't explored the darknet in over 5 years, but some of these prices seem a bit high. Around 2014-2015 I saw PayPal accounts listed for $3 a piece ($5 if you bundled it with SOCKS proxy access). Which could mean a couple things: PayPal security has gotten tighter, restricting the supply of accounts; PayPal security has actually gotten worse, increasing the actual value of the accounts; or maybe these guys are doing "market" research and determined that their profit margins were higher charging $25 for the same product. It could also mean that the writers of this article didn't do enough digging to find a "better" deal. Interesting read but I'm not sure how much I trust their numbers
- JamesBarney 6y agoCouldn't it also be that the buyers are better at extracting value from the accounts.
- darth_avocado 6y agoI love the lady in the comments section, just being boss and looking for tips to become a criminal
- mullen 6y ago> AAA emergency road service membership card $70 I think the renewal for my AAA membership was $74. Why would anyone pay for a fake membership for $70?
- janekm 6y agoI’m going to guess that the real AAA card would have your actual name on it.
- Raphmedia 6y agoIf I remember correctly, those kind of cards are used in the process of identity theft / building fake identities.
- kube-system 6y agoPeople are not using the cards to get service from AAA, they're likely using them as fake forms of non-photo identification. The same goes for the fake bank statements.
- bawolff 6y ago> Avoid public or unsecured WiFi. If you must log into an account on a network you don’t 100% trust, use a VPN to encrypt all communications. Even bank websites can be forged to be almost undetectable if an attacker has administrative access to the network you’re using. I think we should stop fear mongering over shady wifi. In a world with HSTS and CT, these types of attacks ars incredibly difficult to pull off.
- scrose 6y agoAren’t you assuming that users are only navigating to HTTPS sites and entering information? That’s unfortunately not the case. That also ignores the fact that having information about general activity can in itself be a privacy concern, whether or not that information is readable.
- bawolff 6y agoI am assuming that users go to their bank website by typing it into google and then clicking on their bank as a result. Google is HSTS. The bank may or may not be (what a sad state of affairs, but i digress) but the link from google will at least be https. What websites do you have in mind that are not https and that average users enter personal information that could lead to identity theft on? > having information about general activity can in itself be a privacy concern, whether or not that information is readable. It definitely can be in some threat models. In the context of average user being the target of drive-by identity theft, i struggle to see a realistic threat model for traffic-analysis of encrypted network traffic.
- nionasgnionio 6y agoWhat is CT in this context?
- shawabawa3 6y agoCertificate transparency - chrome requires all certificates to have a public certificate transparency log which makes it very difficult for attackers to generate bad certificates undetected
- anonymousDan 6y agoCan anyone point me to some of the 'how to cash out' guides mentioned? Doing some research in this area and quite interested to learn about techniques used in practice and how they compare to those proposed in academic literature.
- malwarebytess 6y agoWhy is malware listed in quantities? lol Did they scrape data from various black market sites naively?