That is no longer the case. <\/p>\n\n\n\n
Enterprising cybercriminals have now brought phishing to the common man with turn-key phishing kits and Phishing-as-a-Service (PhaaS) products that come with subscriptions and varying levels of service. There is no longer a technical barrier \u2013 only a financial one.<\/p>\n\n\n\n
So, today we\u2019re going to talk about the rise of phishing-as-a-service and turn-key phishing kits, but we\u2019re also going to look at the evolution of the cybercrime economy, which is beginning to embrace platform capitalism<\/a> and other more traditional business practices. <\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n Cyren is an IT security company that offers a\nSecurity-as-a-Service and threat intelligence solutions. I mention this because\nit\u2019s a great jumping off point to quickly explain the whole \u2018as-a-service\u2019\nconcept to anyone that isn\u2019t familiar. <\/p>\n\n\n\n Whereas traditional software came in the form of a download\n(or, back in the days of antiquity you could purchase it in a physical format\nat a brick-and-mortar store) that resided on the user\u2019s device,\nsoftware-as-a-service (and similarly infrastructure-as-a-service and platform-as-a-service)\nis hosted on the provider\u2019s servers and made available via the internet. It\u2019s a\nform of cloud computing. <\/p>\n\n\n\n There are several advantages to this business model:<\/p>\n\n\n\n Now apply that to any \u201cas-a-Service\u201d product you come across and you should have a solid idea how it works \u2013 whether it\u2019s a security product or a video game. <\/p>\n\n\n\n In a July 1st<\/sup> blog post, Cyren reports finding 5,334 unique, turn-key phishing kits<\/a> just from 2019. These are products offered by the aforementioned \u201cPhishing-as-a-Service industry.\u201d If the fact it\u2019s big enough to refer to as an industry troubles you, that\u2019s just the tip of the iceberg when it comes to the cybercrime economy \u2013 we\u2019ll get to that in a minute though.<\/p>\n\n\n\n These PhaaS operations offer both one-off turn-key phishing\nattack kits for as little as $50; as well as full-service subscriptions that,\non average, cost $50-80 per month. They even offer discounts. Here\u2019s an\nexample, courtesy of Cyren:<\/p>\n\n\n\n We\u2019ll touch on this more in a moment, but just take a second and look at the presentation of these products. This doesn\u2019t look like some fly-by-night criminal operation \u2013 this is a legitimate eCommerce website. Complete with shopping cart, product ratings and a professional-looking UI. They’re even using proven marketing tactics like the decoy effect and price priming. These criminal enterprises are leveraging traditional, legitimate business practices to push their products.<\/p>\n\n\n\n One of the additional benefits of the SaaS business model that we didn\u2019t list earlier is that it provides a strong incentive for providers to continue refining and improving their products. After all, if it\u2019s ineffective or goes stagnant then customers are going to start abandoning ship and money will be lost. Phishing-as-a-Service is no different. Only in PhaaS\u2019s case, that benefit is pernicious. Because it means the phish are evolving, becoming better \u2013 sentient. Ok, not sentient, but smarter. <\/p>\n\n\n\n Per Cyren:<\/p>\n\n\n\n A straight line can be drawn between the availability of such kits and turn-key phishing platform services and the growth in evasive phishing\u2014phishing attacks that use tactics to confound detection by email security systems. Today\u2019s reality is that we are seeing more evasive phishing campaigns in the hands of more attackers at less effort and lower cost than in the past, as technically sophisticated phishing attack developers have adopted a SaaS business model to let even the most amateur criminal wanna-be [sic] spoof targeted web sites with a high degree of authenticity and embedded evasive tactics.<\/p><\/blockquote>\n\n\n\n Obviously, none of that is good. Cyren reports that 87% of\nphishing kits include evasive techniques, and that\u2019s really a matter of\nsemantics. Cyren has six techniques that it defines as evasive and it looks for\nthe presence of at least one of those before saying a kit uses evasive\ntechniques. <\/p>\n\n\n\n Six different evasive techniques, all intended to fool mail\nclients into delivering the email. That\u2019s their approach. <\/p>\n\n\n\n We tend to categorize phishing techniques a bit differently at Hashed Out. In fact, Casey wrote about this very thing on Friday, listing 10 different types of phishing<\/a> attacks and scams. <\/p>\n\n\n \n\t\t\t10 Types of Phishing Attacks and Phishing Scams<\/a>\n\t\t<\/p>\n\t\t \n\t\t\t\n\t\t\t\t\t\t\t\t\t In Hashing Out Cyber Security <\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t By Casey Crane <\/span>\n\t\t\t\t\t\t\t<\/em>\n\t\t<\/p>\n\t\t \n\t\t\t\t There’s more than just one type of phish. Knowing what to look for can help your organization from getting swallowed. Here are 10 different types of phishing.<\/p>\n\t\t\t<\/p>\n\t\t<\/div>\n\t\t \n\t\t\t\n\t\t\t\tRead more\t\t\t<\/a>\n\t\t<\/p>\n\t<\/div>\n<\/div>\n\n\n\n Every phishing email attempts to be evasive. Some more\nsuccessfully than others. Historically, the evasiveness of a phish was indicative\nof the level of technical sophistication of its creator. That\u2019s what makes Phishing-as-a-Service\nso worrisome \u2013 anyone with a little bit of cash can now send convincing phish. <\/p>\n\n\n\n The biggest barrier to entry has been removed.<\/p>\n\n\n\n The cybercrime economy generated \u2013 by conservative estimates – $1.5 trillion dollars in 2018<\/a>. <\/p>\n\n\n\n Crimeware-as-a-Service, a category that includes Phishing-as-a-Service, generated a modest $1.6 billion. That\u2019s still more than the GDP of the Solomon Islands. That figure looks to increase in 2019.<\/p>\n\n\n\n Here are some other services you can purchase via the SaaS\nmodel:<\/p>\n\n\n\n But the larger trend is that the lines between legitimate enterprise and criminal enterprise have begun to blur in ways we never expected. We mentioned earlier how professional the storefront that was selling turn-key phishing kits looked, but that trend didn\u2019t start with PhaaS. The biggest generator of cybercrime profits are illegal markets. And a huge part of that is counterfeit goods. <\/p>\n\n\n\nSubscribe to Phishing-as-a-Service just like you would Netflix<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/bigstock-202108018-300x300.png\")
<\/figure><\/div>\n\n\n\nPhishing-as-a-Service and Turn-key phishing kits<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Example-phishing-offerings-Screen-Shot-2019-06-04-1024x357.png\")
<\/figure><\/div>\n\n\n\nBetter phish than you can catch in the wild<\/h2>\n\n\n\n
This is indicative of a larger pattern with the cybercrime economy<\/h2>\n\n\n\n
\n Crime<\/strong>\n <\/td> \n Annual Revenues<\/strong>\n <\/td><\/tr> \n Illegal online\n markets\n <\/td> \n $860 Billion\n <\/td><\/tr> \n Trade secret, IP\n theft\n <\/td> \n $500 Billion\n <\/td><\/tr> \n Data Trading\n <\/td> \n $160 Billion\n <\/td><\/tr> \n Crime-ware\/CaaS\n <\/td> \n $1.6 Billion\n <\/td><\/tr> \n Ransomware\n <\/td> \n $1 Billion\n <\/td><\/tr> \n Total Cybercrime\n Revenues\n <\/td> \n $1.5 Trillion\n <\/td><\/tr><\/tbody><\/table>\n\n\n\n \n Cybercrime\n Product or Service<\/strong>\n <\/td> \n Price (in US\n Dollars)<\/strong>\n <\/td><\/tr> \n SMS Spoofing\n <\/td> \n $20\/month\n <\/td><\/tr> \n Custom Spyware\n <\/td> \n $200\n <\/td><\/tr> \n Hacker-for-Hire\n <\/td> \n $200+\n <\/td><\/tr> \n Malware Exploit\n Kit\n <\/td> \n $200-$700\n <\/td><\/tr> \n Blackhole Exploit\n Kit\n <\/td> \n $700\/month or\n $1,500\/year\n <\/td><\/tr> \n Zero-Day Adobe\n Exploit\n <\/td> \n $30,000\n <\/td><\/tr> \n Zero-Day iOS\n Exploit\n <\/td> \n $250,000\n <\/td><\/tr><\/tbody><\/table>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/bigstock-Software-Icon-Isolated-On-Whit-275107171-287x300.png\"){kind=icon}
<\/figure><\/div>\n\n\n\n![\"Hashed](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568-1024x267.jpg\")
<\/figure>\n","protected":false},"excerpt":{"rendered":"