Stolen bank account numbers are commanding the highest price in an underground trade of personal details stolen by hackers. That's according to a survey from security vendor Symantec, which found that bank account details command prices of up to US$400, while credit card details sell for between $0.50 and $5, email passwords from $1 to $350 each, and email addresses from $2 to $4 per megabyte.
The details have been published in the company's Internet Security Threat Report which covers the first half of the year.
The online trade in stolen details highlights the commercialisation of Internet crime, with gangs researching, developing and marketing nefarious software for other criminals, said William Beer, director of security practice for Europe.
There has been an increase in the quality and quantity of malicious code sold on the Internet, driven by well-funded international groups of criminals, Beer said.
The hackers are obtaining the information through increasingly targeted attacks on computers that often involve collecting personal information about a person from social networks such as MySpace or Facebook, Beer said.
With specific personal details, the hacker can construct a personalised email that entices the victim to either click on an attachment containing malicious software or visit a phishing site.
Symantec is also seeing multi-stage attacks where the attacker places a small piece of software on a target computer that then acts as a beachhead for downloading other software.
"The end user will not even notice the attacks have taken place because it's a very gradual process," Beer said.
On the spam front, Symantec said it has noticed a 30 percent drop in so-called "pump-and-dump" spam, where emails touting penny stocks are sent out, causing a rise in the stock price before the perpetrators sell the stock early. The decline can be attributed to a crackdown by the US Securities and Exchange Commission.
Also down is the percentage of spam with images, which started as a highly effective way to bypass spam filters but is now less so. About 27 percent of the spam analysed by Symantec between April and May contained images, down from 50 percent the first week in January, Symantec said.
The decrease is due to an improvement in spam filters as well as the decline in pump-and-dump spam, which often used images, the company said.