Though law enforcement agencies are closing down an increasing number of cybercrime marketplaces, bad actors are not just giving up and going away. Instead, they’re reconvening on other platforms, most notably the messaging app Telegram, as a researcher told the USENIX Security conference last week.
As they explained, the sale of stolen data – such as log-in credentials, personal details, and credit card information that can be used to hack, impersonate and defraud victims – is now taking place in Telegram channels. Previously, the sellers and buyers would have used established anonymous underground forums.
"Generally, when cyber criminals are trading with each other, they need trust so they have to establish connections with each other. They had been doing this on some large underground forums that had been around for years," says PhD student Tina Marjanov, first author of Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram.
"Now Telegram has flipped that model on its head. It's a platform where channels suddenly pop up and then disappear again. These channels are also much smaller than some of the established underground forums, making the whole cybercrime landscape more diverse."
How Telegram became a platform for cybercrime communities
Tina is part of a team of researchers at the Cambridge Cybercrime Centre, who have been exploring how and why Telegram has become a platform where cybercrime communities can flourish, and what can be done to combat this. In one of the largest studies of its kind, they spent a year monitoring communities on Telegram where stolen data is traded. In doing so, they collected 14 million messages and 3.6 million shared files from 1,500 channels where stolen data was being traded.
The goal was to find out what types of stolen data the cybercriminals are offering, how they operate – and what they're doing to evade detection. This was a collaboration with Carnegie Mellon University's Cylab and its researchers Taro Tsuchiya and Nicolas Christin.
Why Telegram has suddenly taken off as a popular forum for cybercrime is not entirely clear. In part, it may be that while recent successful moves by law enforcement agencies to take down underground forums have been successful and have deterred some criminals from using underground forums, many have simply moved elsewhere.
The researchers suggest that Telegram is an appealing alternative because, for the less technical user, it is easier to access than some underground forums. It also has a number of features that make it appealing to cybercriminals, including "the ease with which it can be installed on a mobile phone or a laptop, its resilience to law enforcement take-downs and quick resurgence compared to other forums and marketplaces, and its perceived enhanced privacy", as the researchers point out.
Whatever the reason, the app is now a platform where the team found that at least six different types of stolen data are regularly being bought and sold. These range from log-in credentials and personal documents such as IDs and passports to databases and personal information.
Exploiting victims' weaknesses
This information, among others, included lists of individuals' characteristics, such as whether they were gamblers, investors or addicts. "This is the kind of information that a cybercriminal could use to exploit a victim's weakness – for example, by offering to sell to addicts whatever it is they are addicted to," Tina says.
The researchers were also surprised to find that while English is the most frequently used language overall, it may feature in less than a third of all cybercrime activity. The researchers found clusters of specialised activity in a number of other languages, including Spanish, Chinese, Portuguese, and Russian.
"So any research that focuses on English-only channels is likely to miss important segments," they warn.
To combat the criminal activity, the team is calling on Telegram to moderate so-called 'gateways' on the app. "Telegram recently changed its policy and started actively taking down certain content," Tina says. "And we found that both the longevity of certain groups and their sizes decreased after that. But we also found that users were smart.
"When one group got shut down, its creators had already set up back-up groups or gateways to other – essentially completely independent – groups that don't carry out any criminal activity. Then they would say: 'Hey, I created a new group here. Everyone who used to follow my previous group, which got shut down, move to this new one'. And this is how they stay around."
As the paper puts it, "Gateway channels are crucial for cybercrime communities' stability and growth and allow these communities to quickly recover following a ban. The presence of gateways suggests that future ban attempts will likely see a short-term success and a swift recovery of the banned community. Moderating gateway channels by Telegram remains essential."
The importance of platform policies
The researchers also argue that Telegram's platform policies can play a key role.
"Telegram’s policy changes, such as their decision to cooperate with law enforcement, can drastically affect the ecosystem, as both the lifespan and the growth rate of the channel are affected," they say.
"This highlights the important effect that top-down platform policies can have on the communities they host and the activities they facilitate."
- Tina's research is funded by The Cambridge Trust and King's College, Cambridge.
