Cybersecurity and the economy: when recession strikes

Cybercrime and the economy have always been intertwined, but with COVID-19 on the road to causing a seemingly inevitable global recession, many are asking what, exactly, will the impact be on cybercrime. Will criminals step up and increase malware production, ramp up phishing attacks, do whatever it takes to pull in some cash? Or will it cause a little downturn in malware making and other dubious dealings?

Cyber recession: setting the scene

One of our key points of observation would be back in 2009, during the last global recession. While searching for information, one of the flashpoints which kept coming up was a paper put together by a team of researchers from around the world called Crime online: cybercrime and illegal innovation. Almost every article which came back to me referenced it in some way, and it was front and centre for every writeup. It’s so pervasive that even articles written in the last 12 months tend to link it when talking about the impact of recessions on professional computer criminals.

The Telegraph, Metro, OneIndia and many more all focused on the impact the recession would have as per the research paper. The only problem? Having read it, the paper mentions a recession 3 times, 2 of which are the same sentence reused stating that a global recession will likely increase the chances of people moving into cybercrime. And for all the lasting impact references to this paper have had down the years, that’s essentially what all of the linkage is based on: someone saying “here comes the cybercrime recession, probably”.

The Past: Making predictions

Mostly, it’s a very solid and wide-ranging paper covering a large range of threat developments, from credit card fraud and phishing to malware authoring and “value chain analysis.” All very interesting, but outside of many claims that technology x or people getting better at y would result in probable increases in z, nothing really leapt out at me to say, “recession is going to explode bad activity online and this is why”. Was it possible people on the receiving end of the presumed press release saw the single line about recession and pinned their entire piece around it? Who knows, but there didn’t seem to be an awful lot to go on.

Putting the puzzle together

In fairness, it’s not just that one research paper taking up the entirety of 2009’s “here comes the recession hacker boom” content. It was up for discussion and there’s no harm in considering the problem. A panel back in 2009 talked about how a recession creates “more cybercriminals” who then go on to do a lot more cybercriminaling. There’s a fair bit of assumption at work here; that a big slice of people hit by a recession will automatically turn to crime, and computer crime at that. If resources are tight and money is short, if people are so physically impacted by a recession that they need to turn to crime to survive, will they:

1. Invest time, electricity, and stamina they may not have on crash course hacking, malware, phishing, digging around on forums for someone—anyone—to help them so they can maybe go off and rip someone off online with no guarantee any of it will work; or
2. Go out and steal some food or break into physical objects such as cars?

Personally, I’d be in Camp B all the way. Camp A seems like incredibly slim vanishing returns all round.

Wages down, crime up? Not so simple

When a recession hits, do criminals come creeping out of the woodwork? More to the point, do we end up with whole new waves of criminals? We have a few data points we can draw on for this. When major recessions and downturns have struck, crime rates can actually fall significantly. Apart from anything else, it’s quite tricky for career burglars to go about their business when economic factors are keeping people at home.

Throw a global pandemic into the mix which relies on as many people as possible staying indoors whether working or not, and it’s time to get a new criminal enterprise. The question is what, specifically, that criminal enterprise would involve. Computers or something else?

Driving the direction of technological attacks

While many folks seem to think cybercrime is the perfect place to go for replacement crime activities, the reality is it’s not quite that straightforward. In more normal times, the shifts inside online crime as a whole are represented by an ebb and flow towards different types of attack as opposed some sort of wholesale digital stampede to do something differently.

For a while now, we’ve seen consumer detections decrease while their business counterparts go up due to the juicy stuff being locked away behind corporate firewalls. Now, with so many people working from home, we expect to see cybercriminals modify their approach somewhat and start going back to poking around home computers (or at least, work computers suddenly on a home network).

Here comes the massive caveat:

It’s worth mentioning that for every “crime goes down during a recession” piece you know of, you’ll always find a few others claiming the opposite. You want confusing? Have fun with the first page of search results in Google should you want to do some digging of your own:

Click to Enlarge

Criminology and sociology aren’t my field of expertise, and I don’t pretend they are. I’m just highlighting the potentially significant shifts in data analysis for anyone trying to figure out the cybercrime / recession link, because even the non-cybercriminal data seems to have a hard time being stacked up one way or another depending on which data is used and who is telling the story.

What about good old infection / attack numbers? Is it even possible to dust off a big book of figures from more than a decade ago?

Playing the numbers

The answer is “sort of”, and “very cautiously”. Cybercrime from last year tends to be somewhat old hat, never mind something from 5 or 10 years ago which often looks as though it’s landed here from another planet. Everything and anything could potentially be different, from infection types, to spreading techniques, to operating systems and security tools, even down to the way everybody from security vendors and governments tally up their figures.

Having said that, there are some interesting snippets of information buried in the pile. The Great Recession hit in 2009, after the build-up of the 2007-08 financial crisis. A UKGOV-hosted cybercrime report from 2013 notes that many aspects of internet fraud dipped around the time of the year-long recession, with higher tallies surrounding it depending on attack type.

“Internet enabled card-not-present fraud” (catchy!) was at around £131 million loss costs recorded in 2010, starting off at a peak of about £181 million in 2008. This is, however, a partial estimate, and online banking fraud hit a peak of £59.7 million in the year of the recession before collapsing to £39.6 million by 2012. Even so, Financial Fraud Action reported “just” 50k phish banking phishes in 2009 and 256k by 2012.

The malware explosion of 2012 onwards

Numbers are somewhat tricky to come by, but not impossible. Although this AV Test chart for overall malware development begins with 2011, you can see the full chart in this 2015/16 PDF document which ranges from 2005 at 1.7 million all the way up to 2016 hitting some 578 million(!) From 2007 onwards, the new figure increases year on year from anything between 10 to 20 million, with nothing unusual about 2009 compared to the others. In fact, it isn’t until 2012/13 that the numbers begin to explode into the stratosphere. The one thing I mainly remember about 2009 in terms of security was prevalence of worms: Sality, Conficker, and others.

In terms of *new* malware created per year, another AV Test report (2017/18) is similarly illuminating. Once again, 2009 isn’t particularly notable whereas 2012 seems to be the point where things kick into high gear, remaining that way until 2016 when things take a small dip.

Elsewhere, though, different types of fraud received a boost. Internet fraud losses were up to the tune of 33% in 2008, though your mileage will vary with regards to taking the final year of the financial crisis and tying it specifically to the period of 2009 accepted as the recession itself. However you stack it up, it’s fair to say some types of crime would go up and some down, as expected – or at least, not explode the way you’d think it might.

Present: The cybers will get us

If we wind ourselves forward to the past few years, we see talk of cybercrime specifically being a potential cause for a possible recession. In 2018, the fear of a massive attack on banking systems worldwide was touted as the way we’d all be dragged into recession town, population: us. The way this was supposed to happen is as follows:

1. Rogue nation state or someone with equivalent resources somehow causes a massive “cashout strike”, where a huge wave of fraudulent withdrawals happens simultaneously and this is on such a scale that the banks all fall over. Yes, this is quite speculative.
2. A script kiddy does…something…malicious and everything breaks. This is even more speculative.

That’s, uh, pretty much it. The article itself mentions that the banks would probably return to normal once functionality is restored, and if you’re undercutting your own “this is bad” point with “actually not really” then in all fairness it’s probably not how civilization is brought to its knees.

Elsewhere, we have another prediction of cyber related recession antics from 2019. Once again, the trigger is going to be some sort of undefined bank exploit / attack where the financial sector comes crashing down around our ears. The fascinating part is that the article begins by stating that a recession is definitely going to happen “within 2 years”. Well, they were correct – but not for the reasons stated. As it turns out, the cybers getting us might have been a bit more preferable to what came along in 2020…

(Potential) future: 2020 and beyond

As we’ve seen so far, computer criminals deciding to shuffle the deck and throw it out the window is primarily based on what-if scenarios ranging from unlikely and incredibly vague to unlikely and a bit less vague. Dusting off the crystal ball is an interesting exercise, but the reality of the situation is that the current financial meltdown came hand in hand with a virus of the non-digital kind.

Right now, we can’t move for conflicting reports during the actual pandemic itself. On the one hand, you have Ransomware authors claiming they won’t target hospitals during the pandemic. This isn’t entirely altruistic; they must know hammering health services will attract unnecessary legal attention in the fallout. Having said that: here’s a bunch of health services under fire from hack attacks during the pandemic. As before, some types go down, some go up. It isn’t uniform and very difficult to make sense of so much conflicting data.

Elsewhere, we have organizations reporting “five-fold increases” in cyber-attacks. By the same token, we have entities such as Microsoft and NCSC claiming the overall levels of cyber-crime aren’t going up. Criminals don’t seem to be making more money off the back of COVID-19 either.

That’s all well and good for scammers riding the coat-tails of the pandemic in the here and now, and numbers could change dramatically as time goes on. How about any future-based, lasting recession?

My entirely unscientific guess – and that’s all we can do, guess – is that even accounting for any new recession, cybercrime will just keep on keeping on and expand or contract at its own pace if it follows the same general pattern we saw in 2009. We’re in an unprecedented situation for technology, and may need to wait till the smoke clears to figure out what we do next. Believe me when I say I’m as fascinated as you are to see where it ends up.

Let’s just hope it’s a little bit more preferable to what we have right now.

The post Cybersecurity and the economy: when recession strikes appeared first on Malwarebytes Labs.