Cybercriminals consider their financial options, post-Liberty Reserve

Costa Rica-based Liberty Reserve, proprietor of the virtual currency known as LR, was busted by the Feds as being a purveyor of untraceable money transfers and money laundering, and a haven for cybercriminals of every stripe, from online drug dealers to small business scammers.

Since then, the shadowy cyber-underground “collectively have been progressing through the classic stages of grief, from denial to anger and bargaining, and now grudging acceptance that any funds they had stashed in the e-currency system are likely gone forever,” said security researcher Brian Krebs.

But, nature does abhor a vacuum. “Just as the entertainment industry’s crackdown on music file-sharing network Napster in the late 1990s spawned a plethora of decentralized peer-to-peer (P2P) file-sharing networks, the argument goes, so too does the US government’s action against centrally-managed digital currencies herald the ascendancy of P2P currencies — particularly Bitcoin,” Krebs said.

However, unlike Liberty Reserve, Bitcoin isn’t tied to the US dollar, and instead fluctuates – in some cases wildly – depending on market factors. That means the worth of a transaction could go from $1 to $1,000, or vice versa, in the space of a day: not exactly good for “everyday criminal commerce,” as Krebs puts it. This fact is igniting a firestorm of discussion among criminals in online forums, Krebs said. 

There's another issue: since Liberty Reserve was taken offline, Bitcoin exchange Mt. Gox announced that it would be requiring ID verification from its purchasers.

Another candidate for the post-LR illegal financial crown is a Panamanian e-currency known as Perfect Money, but Krebs noted it has been in a rush to clean house lately, closing accounts and announcing that it won’t accept new account registrations from US citizens or companies.

Some are thinking about eschewing public e-currencies altogether. “Ninja,” the administrator of the Carder.pro crime forum, is considering architecting a “carding payment system.” This would “serve forum members and be housed at Internet servers in North Korea, or perhaps Iran (really, any country that has declared the United States a sworn enemy would do),” Krebs said.

Krebs also ran across a hacker in a Russian-language crime forum that has announced his very own private e-currency and exchange exclusively for forum members. “Dear friends! I submit to your consideration a new project as a payment system,” he posted. ”After eight years of excellent reputation in the financial services industry, I now want to offer a mini-payment system, designed specifically for your needs. It is not necessarily made for you to keep your savings in, but instead to use this system for small settlements.”

Realistically, though, the obvious heir to Liberty Reserve, Krebs said, is the WMZ unit from a Russian company called WebMoney. Roughly analogous to LR in many ways (tied to the US dollar, offshore, virtual, supports anonymity), WebMoney is already popular in the criminal underweb. “[It] has been around for so long – and its logo is about as ubiquitous on Underweb stores as the Visa and MasterCard logos are at legitimate Web storefronts – that most miscreants and n’er-do-wells in the underground already have accounts there,” Krebs noted, explaining that a ban on new US accounts may not matter very much.

What’s hot on Infosecurity Magazine?