Cybercrime-as-a-service: inside the botnet black market

Pop by the underground market on your way home to pick up a few of the latest botnets!
A flourishing underground market in botnets is worrisome thanks to poorly secured, internet-connected household devices. (Michelle Parise)

As the market grows for 'smart' internet-enabled household devices, hackers have started turning them into botnets. Botnets are networks of remotely controlled devices, which can be used for malicious purposes. Now, these Internet of Things botnets are turning up for rent on secret markets.

Botnets have been around for a long time, harnessing desktop computers by getting users to install malware. Now, though, hackers are targeting poorly secured, internet-connected household devices to create the botnets. Botnets can be harnessed for Distributed Denial of Service attacks, where a website is temporarily brought down by overwhelming it with traffic. In October, the Mirai botnet took on an internet infrastructure company. That attack temporarily knocked out popular sites like Twitter and Spotify.

Finn Brunton

There's a flourishing, underground market in botnets. Finn Brunton is an assistant professor at NYU, where his research focuses on the history and theory of hacking. He says the marketplace for botnets is very straightforward. "Everything is transacted more or less anonymously," he says. "It's pretty simple. They say 'we will charge, let us say, x number of hundreds or thousands of dollars, depending on the size, for x number of machines, for let's say, a week...' and then you pay up."

"They are part of a larger transformation in the world of hacking and cybercrime, which is cybercrime-as-a-service."

The scary thing is that you don't really need much technical expertise to rent one of these botnets. "From the side of being a customer of one of these big botnets, it's very 'plug and play'," Finn says. "You never need to know or think about the hundreds of thousands of 'smart' door locks and tea kettles, and internet routers...and all the other objects...that are the mechanisms that make this possible.... To some degree you need to be in the mix of this world to know where to go and who to talk to," Finn says. But "they are part of a larger transformation in the world of hacking and cybercrime, which is cybercrime-as-a-service."

One reason these botnets are potentially so worrisome is that in the rush to create a market for 'smart home' devices, security has not always been a top priority. "The way that the Internet of Things has developed as a market has been one of the great setbacks in the safety and security of the online world," he says, referring to the last few years. "What we've witnessed is the production, on an enormous, unprecedented scale, of devices which are a) not secured particularly well, and in some cases at all by the original manufacturer," he cautions. "And b) that are be very difficult to impossible for the consumer themselves to make any changes to."


To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

Become a CBC Member

Join the conversation  Create account

Already have an account?