Hacking as a Service: There are many who may not remember the days when HTML was written entirely by hand, just as there are many hackers who cannot remember when an exploit had to be built from scratch. The process of hacking has not ceased to be illegal, but it seems to have become more user-friendly. Combine this with the increase in the number of transactions taking place online, and the ground is ripe for the development of the underground economy.
With sophisticated exploit kits, free tools, botnets, and hackers for hire, it has become relatively easy to do what was previously only possible for skilled hackers. An illegal marketplace has been created where anyone can buy and sell malware, exploit kits, botnets, credit card information, zero-day vulnerabilities (for which no patch is available) for popular operating systems or applications, as well as services such as attacking and destroying a website or performing DDoS attacks. So how does this whole market work?
Just as Software as a Service (SaaS) is transforming the way we access applications, Hacking as a Service (HaaS) is making it easier for attackers.
From a financial perspective, the cost of hiring a hacker is similar to that of hiring any other professional. The time hackers spend determines their fee, the longer it takes to complete the attack process, the higher their fee. A simple DDoS attack or a few malicious SEO links could cost as little as $100, while RATs like Blackshades or botnet rental could cost from $250 to $500. Full control of a botnet like ZeuS with management and control capabilities can range from $20,000.
Since hackers obviously won’t wait until their services are requested to seek financial benefits, they usually seek revenue through the sale of exploit toolkits. Initially, selling toolkits was not that profitable, as once they are purchased, downloaded, and resold, the profits they can bring to the developers gradually decrease. The Blackhole toolkit solved this problem by introducing a service model for updates, with which the user can receive support, new features, and new zero-day exploits provided that they have subscribed to the original developer. The developers in turn will invest some money in finding and creating new exploits and features in the toolkit. Open source exploit kits such as Metasploit can be downloaded for free.
Are there different specialties among Hackers?
Just as with “legitimate” and ethical hackers and IT/Network security professionals, hackers have specialties. There may be some who are more adept at programming and creating viruses or Trojans, just as there are IT Security professionals who specialize in creating signatures to detect such malware and participate in the creation of antivirus/antimalware products. There may be others who specialize in identifying vulnerabilities in software or operating systems. There may be others who are experienced in hacking websites or networks. This industry is as diverse as the list of network security certifications that IT managers strive to obtain to become more skilled.
What is the solution?
As it has been found, the cost can be relatively low, for causing great damage, while the barriers to action have been significantly reduced. From the point of view of an IT administrator, this situation should not lead to resignation, but to the search for new smart ways of protection. In general, ensuring that all software patches are updated, and fully informed about new trends in the industry are an important principle. Speaking of trends, make sure you are in touch with the relevant authorities in case you fall victim to a botnet attack. Symantec 's work in this area has led to several blows against botnets so far.
It is important that users are educated on how to protect their data. Network administrators should inform them to avoid clicking on email links they are not familiar with or opening attachments they do not recognize. Administrators should also prohibit pirated software and conduct awareness training to keep users informed.
Editor's Note: This information is not provided to help you compare the market or to encourage you to engage in illegal activities, but to better understand what IT managers and administrators. The costing provided is not referenced to anything specific, but rather to the time spent on these activities.
