Google read black-market bot-account prices as a scoreboard; a VoIP block lifted them 30%+

WIRED reported in September 2015 on a Google paper written with six universities that reviewed existing cybercrime research. It argued that technical security alone does not dent the criminal economy; companies should look at the supply chain and attack its weak, cost-sensitive points. Google researcher Kurt Thomas said problems that seem intractable technically become solvable when viewed economically.

One method was to use the black market as a mirror. Google follows the price of bot-controlled Google accounts sold for YouTube and Chrome web store spam, fake reviews of malicious Android apps and phishing pages on Google Drive. Thomas called the markets an oracle for how well defences are doing: rising prices mean something is working, a drop means a problem. In late 2013 the price fell from about $170 per thousand accounts to $60. Analysing sign-ups showed close to a quarter of the bot accounts used VoIP phone numbers, a cheap way round Google's one-account-per-phone check.

Google blocked commonly abused VoIP services, forcing criminals back to SIM cards, and the price of the accounts rose between 30% and 40%. The researchers also recommended hitting infrastructure beyond one's own product, with payment processors the most promising target, and working with academics, who can study the markets without brand risk.

Treat the black-market price of abused Google accounts as a live measure of how well the defences work.

The price of an abused account is a number Google can watch without needing access to the criminals' systems.

A sudden price drop points to the exact loophole that made accounts cheap.

Closing a cheap loophole raises criminals' costs and cuts their profit margins.

Attackers' costs are a better yardstick than counting patched vulnerabilities.

Measure defences by the attacker's cost, then squeeze the cheapest step in their supply chain.

Google said the VoIP block raised the price of bot accounts by 30% to 40%. The article reports no broader outcome. The researchers noted limits: individual criminals are elusive, arrested ones are quickly replaced, and botnet domain seizures can cause collateral damage.