New America

Additional References

Ablon, Lillian, Martin C. Libicki and Andrea A. Golay. Markets for Cybercrime Tools and Stolen Data: Hackers' Bazaar. Santa Monica, CA: RAND Corporation, 2014. http://www.rand.org/pubs/research_reports/RR610.html. Also available in print form.

Goncharov, Max, “Russian Underground Revisited,” Cybercriminal Underground Economy Series, 2014, http://www.trendmicro.com.au/cloud-content/us/pdfs/security-intelligence/white-papers/wp-russian-underground-revisited.pdf.

Grier, Chris, et al. 2012. Manufacturing compromise: the emergence of exploit-as-a-service. In Proceedings of the 2012 ACM conference on Computer and communications security (CCS '12). ACM, New York, NY, USA, 821-832.

Herr, Trey, and Richard M. Harrison. Cyber Insecurity: Navigating the Perils of the Next Information Age. Lanham, MD: Rowman & Littlefield, 2016. Print.

"How We Go Deeper To Protect You From New Threats". SafeandSavvy.F-Secure.com. N. p., 2013. Web.

Brian Krebs, “Carberp Code Leak Stokes Copycat Fears”, June 13th, 2013, https://krebsonsecurity.com/2013/06/carberp-code-leak-stokes-copycat-fears/

Martin, Sean, CISSP. "The Making Of A Cybercrime Market". CSO Online. N. p., 2017. Web.

Schiffman, Mike. "A Brief History Of Malware Obfuscation: Part 1 Of 2". Cisco Blogs. N. p., 2017. Web.

Shakarian, Jana, and Andrew T. Gunn. "Exploring Malicious Hacker Forums." Cyber Deception: Building the Scientific Foundation. Ed. Paulo Shakarian. New York City: Springer, 2016. 259-82. Print.

Sood, Aditya K., Richard J. Enbody, Crimeware-as-a-service—A survey of commoditized crimeware in the underground market, International Journal of Critical Infrastructure Protection, Volume 6, Issue 1, March 2013, Pages 28-38.

Thomas, Kurt, et al. Framing Dependencies Introduced by Underground Commoditization, Workshop on the Economics of Information Security. 2015. Web.

Prev. Section
What is the Future of the Malware Markets?

About this Project

Computers and computer systems are becoming ubiquitous, managing everything from government databases, to grocery transactions, to activity on our own phones. However, these systems don’t come without their vulnerabilities, and their exploitation has never been in such high demand. So where does malicious software—the code designed to exploit these vulnerabilities—come from? 

This started as a project developed by Luke Heine and Brian de Luna of Harvard College in consultation with Trey Herr for CS 105: Privacy and Technology. Major credit to Kirk Jackson for his help with the graphic redesign. Additional thanks for feedback and support from the New America Cybersecurity Initiative including Rob Morgus, Joanne Zalatoris, and Ian Wallace. Thank you to Jim Waldo for the idea and Ben Buchanan for his review.

Authors

Brian de Luna is a data scientist at Airbnb. He has done a range of side projects that include data visualizations and analyses on topics ranging from malware markets to venture capital funding.

Luke Heine is a director at the Lab for Entrepreneurship and Development at the Harvard Institute of Quantitative Science. His research includes how risk is legitimised by capital and the bottlenecks of cluster formation. 

Trey Herr was a fellow in the Cybersecurity Initiative and formerly with the Belfer Center's Cyber Security Project at the Harvard Kennedy School. His work focuses on trends in state developed malicious software, the structure of criminal markets for malware components, and the proliferation of malware. 

Project Outline:

Dataset:

* If using Safari or Internet Explorer, right-click download link and select "Download Linked File"