Risk Assessment / Security & Hacktivism

OECD on malware: it’s all about the economics

OECD has released a comprehensive report on the modern malware industry, its …

The Organization for Economic Cooperation and Development (OECD) and the Asia Pacific Economic Co-operative (APEC) have released a comprehensive report (PDF) on the current state of the malware market and the economic, social, and political factors that are driving malware development. The study, Malicious Software (Malware): A Security Threat to the Internet Economy is notable for its breadth. Unlike many security reports, which focus on a single issue or type of threat, OECD examines how various types of malware function, the changing shape of the industry's business model, the role governments and international governmental organizations play in halting malware distribution (or, in some cases, facilitating it), and the various incentives and disincentives that might effectively retard the growth and reduce the impact of malicious software.

Readers who follow the security industry closely won't find much new here, but the document is an excellent primer for anyone seeking information on how and why the malicious software market has evolved to date. While we've talked repeatedly about the growing commercialization of the malicious software market, OECD makes the point that there are still a number of other thespians on the thoroughly illegal stage.

These various actors may all create malware, but their end goals (and the degree of malicious intent driving their actions) can vary considerably, as shown in Figure 6 below. As the graph shows, malware authors (also known as script kiddies) who are primarily after their own personal 15 minutes of fame will tend to favor high-visibility attacks built around preexisting commercial products. Criminal organizations, meanwhile, including those in the business of selling botnet time, will attempt to stay as low profile as possible, and will employ any and all means to stay below the radar.

While OECD doesn't advocate charging for e-mail service, the organization does note that the near-total lack of business costs is a substantial economic incentive to any company interested in the illegal software market. "All the costs of dealing with spam and malware are passed on to the Internet provider and the 'unwilling' recipients...on top of the costs of repairing the computer or having lost money to scams...criminals minimise their costs to the extreme: they pay no tax, escape the cost of running a genuine business, and pay commission only to others in criminal circles worldwide and at a comparatively low price."

Current malware trends. Green arrows indicate rising trends, orange arrows are falling trends.

The ultra-low costs of these types of ventures has helped to push botnet pricing down to commodity levels. According to the joint OECD-APEC report, the average weekly rental rate of a botnet is US$50-$60 per 1,000-2,000 systems, or approximately 33¢-50¢ per computer. Prices this low literally mean that criminal organizations have little to nothing to lose and everything to gain.

The report concludes by calling for the formation of a global partnership against malware. The proposed organization would be a coalition of of various governments, the private sector, the technical community, and (oddly) civil society, all of which would unite their powers to battle the forces of evil the malicious software industry. The potential efficacy of such a sprawling partnership is a topic that's open to debate, but OECD is absolutely correct when it states that the task of fighting malware is "complex and would benefit from more comprehensive measurement, co-ordination and policy solutions...The need for a consistent approach to a global problem is not new but malware presents particular complexities due to the wide variety of actors with responsibility for combating malware."

Expand full story

You must to comment.


You May Also Like