Cybercrime is (often) boring : maintaining the infrastructure of cybercrime economies

Collier, Ben and Clayton, Richard and Hutchings, Alice and Thomas, Daniel R. (2020) Cybercrime is (often) boring : maintaining the infrastructure of cybercrime economies. In: Workshop on the Economics of Information Security, 2020-12-14 - 2020-12-15.

[thumbnail of Collier-etal-WEIS-2020-Cybercrime-is-often-boring-maintaining-the-infrastructure]
Preview
 Text. Filename: Collier_etal_WEIS_2020_Cybercrime_is_often_boring_maintaining_the_infrastructure.pdf
Accepted Author Manuscript
Download (254kB)| Preview

Abstract

It is generally accepted that the widespread availability of specialist services has helped drive the growth of cybercrime in the past fifteen to twenty years. Individuals and groups involved in cybercrime no longer need to build their own botnet or send their own spam because they can pay others to do these things. What has seldom been remarked upon is the amount of tedious administrative and maintenance work put in by these specialist suppliers. There is much discussion of the technically sophisticated work of developing new strains of malware or identifying zero-day exploits but the mundane nature of the day to day tasks of operating infrastructure has been almost entirely overlooked. Running bulletproof hosting services, herding botnets, or scanning for reflectors to use in a denial of service attack is unglamorous and tedious work, and is little different in character from the activity of legitimate sysadmins. We provide three case studies of specialist services that underpin illicit economies and map out their characteristics using qualitative sociological research involving interviews with infrastructure providers and scraped data from webforums and chat channels. This enables us to identify some of the distinct cultural and economic factors which attend this infrastructural work and to note, in particular, how its boring nature leads to burnout and the withdrawal of services. This leads us to suggest ways in which this new understanding could open novel avenues for the disruption of cybercrime.

CORE (COnnecting REpositories)