From Bounty to Exploit: Cybercriminals Use Crowdsourcing for New Attacks

These contests are public calls for articles asking for technical content featuring offensive methods. They can be limited to a particular domain or be more generic in nature. Any forum member can submit a technical text proposing a new attack, technique, vulnerability, or offensive method. The organizer of the contest offers a prize (sometimes prizes) that will be awarded to the best or more innovative of those articles.

In this way, criminal actors could reliably get an edge in the cat-and-mouse competition against network defenders. If they keep running these contests frequently, eventually they could find a paradigm shift that would significantly alter the offensive status quo. It is therefore important to know what they are doing to prevent a new way of attack that will catch us unaware in the future. Indeed, it is possible that these contests would breed an innovation significantly challenging for cybersecurity.

In the next sections, we summarize the kinds of context we have been seeing and why they are relevant.

This is the malware group equivalent of a singing or talent competition such as “American Idol” or “America’s Got Talent.” Although these talent-seeking contests are not the most frequent kind, we have spotted them in the past and believe that their relevance lies in possibly hiring the best candidates to develop their newer malware strains.

Take for instance the following post from a criminal actor in an “exploit” forum posted on Nov. 16, 2020. The translation is as follows:

The prize fund of 2 bitcoins (US$38,061.60) is sizeable. This would be the equivalent of around 40 months’ worth of salary for an average software developer in Moscow, and even divided among the top three winners, it would still amount to over a year’s worth of salary for each of them.

The second type of contest is knowledge-driven, where cybercriminals seek articles that bring forward the knowledge level of the offensive technology field. The following is an example of a translated post for one such contest:

In this context, the organizers are looking to increase knowledge in the cryptocurrency field. Paradoxically, the prize is set in US dollars and not in cryptocurrency, as one might expect. These contexts are geared toward experts on the field and, though they favor technique-based knowledge as well, including articles that explain protocols and dig up unusual software.

Figure 1. Forum contest regarding cryptocurrency exploitation

Often, we observe more generic calls for articles that don’t limit the topic to a single domain. In fact, there is one cybercriminal forum that runs a series of contest that is currently in its seventh iteration, with the cybercriminals running the contest every few months. Both the participation and interest in this contest have been steadily increasing alongside the increase in prize offerings:

It is interesting to note the range of topics in this contest, as the topics are broader in scope than the previous cryptocurrency-focused contest. Their applications are also eminently practical: The organizers only want offensive techniques that can be put to use immediately. The topics they cover are the main stages of an intrusion, namely social engineering, vulnerability exploitation, privilege escalation, counteracting defense software, gaining persistence, and generic malware technology. This could mean that the criminal underground is also interested in the internet of things (IoT) as a topic in any of its dimensions, such as entering an IoT network or using an IoT device an attack target, either for the device’s capabilities or perhaps for the data it can hold.

Figure 2. XSS7 Contest

Again, the prize is quite high: 1 bitcoin (US$19,030.80). These criminals are investing quite a large sum of money in order to produce new offensive capabilities. It is also important to bear in mind that this is the last one in a series, in which these same organizers are running the same kind of contest every few months. The prizes offered in this contest series have been going up as well:

Figure 3. The growth of contest prizes

As a point of comparison, the white hat vulnerability-seeking contest was paying participants US$270,000 for the most valuable bug found in their most recent edition in Vancouver.

Figure 4. Pwn2Own leaderboard

The winning articles, however, are the most interesting part of these past contests, although they can be quite disappointing based on the content we have managed to access. In particular, they tend to feature hacking tutorials or summaries of well-known subjects. While it is probably a good thing for the criminal community to have ready access to these attack methodologies, we have not seen anything close to groundbreaking just yet.

Figure 5. Summary of the winning article titled “20 years of payment acceptance problems”

Figure 6. Introduction to a contest’s winning article, “Finding RCE 0-days in IoT”

In a recent twist on the contest format, LockBit, a well-known ransomware group, just released version 3.0 of their malware. Alongside this, cybercriminals also introduced a bounty program that works very much like one of these contests. The idea of the bug reward program involves offering money to anybody who can help improve the software by attacking it (or any of the server infrastructure behind it) and disclosing how it could have been avoided. Cybercriminals also accept any attack that could affect the malware group in a negative way, such as abusing the Tor network, the TOX messenger they use to communicate, or any web bugs. They also offer US$1 million to anybody who can identify or “dox” the LockBit affiliate program’s manager, an individual who operates under the moniker “LockBitSupp.”

Figure 7. LockBit’s bug bounty program

Even though this is not a traditional contest as explained previously, the bug bounty program is essentially run the same way and accomplishes the same objective: to pool creative ideas from the community’s hive mind and thereby improve how cybercriminals stay operational under the radar of the law. This is, in a sense, therefore also a contest for criminal defenders as they continue to work to stay ahead of cybercriminals.

The previous kinds of contests are the most concerning ones if we take into account that they might place completely new attacks in the hands of the criminals. However, they are not the only kinds of contests in existence. Criminal forums have been using this contest format for quite some time now, and we have seen them sparking creativity in all sorts of fields, even non-technical ones.

For instance, we have seen contests looking for the best poem, suggesting that perhaps internet criminal poetry might go down in history as a new genre in Russian literature. We have also observed contests looking for creative content to promote the criminal forum where the contest will take place. Such content might include videos, logos or images, and other promotion strategies to increase website viewership. Some of these websites regularly run logo creation contests and other artistic projects.

In general, these other contests are far less interesting for our purposes, and we mention them here only to highlight that this format is popular in the criminal underground and goes beyond the offensive technology field. Indeed, forum criminals have just adapted it to benefit from its great power of bringing about innovation.

While the current trend is modest, we expect to see increasingly more of these competitions and a steady increase in prizes until these truly do become “X-Prizes” and game changers. These contests also have the effect of speeding criminal innovation since few criminal groups can afford to have a proper research and development department. However, by using this crowdsourcing model, the whole criminal community effectively becomes a research and development team, which is very powerful.

The evolutions spurred by this trend do not need to be major changes to be successful. Given the way crime works, they do not need big strategic wins; instead, there is much to be said for smaller tactical wins. This might mean a new procedure to carry out tactics, techniques, and procedures (TTPs) that are already known. Such a development is very valuable — at least in the short term — if it allows criminals to bypass current defenses. And this remains true even if an attack is not newsworthy from the point of view of innovation.

In addition to small tactical wins, if these exercises in creativity are regularly run, chances are that the criminals would eventually hit the jackpot and discover a completely new attack. This could be a game changer, similar to that time when the Maze ransomware started implementing leak sites to better extort target companies. With this new extortion method, the ransomware group succeeded in placing its victims under more duress, lest anyone else see the whole pile of stolen information on the leak site. This small change in attack behavior was instrumental in bringing about the current new wave of ransomware that focuses not only on encrypting data but also on stealing it and threatening to make it public. Ultimately, this paradigm shift can start from something relatively small, only to later alter the threat landscape significantly.

These contests therefore have the potential to perform the same function and give criminals the next big attack that IT security cannot see coming. The chance of one of these contests hitting the jackpot might be slim, but if criminals keep organizing them, one can expect a kind of “black swan” or unforeseen attack that could come about at some point.