HackerScope: The Dynamics of a Massive Hacker Online Ecosystem

TL;DR

This paper introduces HackerScope, a systematic approach to analyze the online hacker ecosystem by studying malware repositories and security forums, revealing its growth, collaboration, and influential members.

Contribution

HackerScope provides a novel methodology for analyzing hacker communities through multi-platform network analysis and profiling influential hackers.

Findings

The ecosystem is growing rapidly, tripling new malware authors every 2 years.

It is highly collaborative compared to typical GitHub communities.

Identified 30 influential hackers maintaining cross-platform online brands.

Abstract

Authors of malicious software are not hiding as much as one would assume: they have a visible online footprint. Apart from online forums, this footprint appears in software development platforms, where authors create publicly-accessible malware repositories to share and collaborate. With the exception of a few recent efforts, the existence and the dynamics of this community has received surprisingly limited attention. The goal of our work is to analyze this ecosystem of hackers in order to: (a) understand their collaborative patterns, and (b) identify and profile its most influential authors. We develop HackerScope, a systematic approach for analyzing the dynamics of this hacker ecosystem. Leveraging our targeted data collection, we conduct an extensive study of 7389 authors of malware repositories on GitHub, which we combine with their activity on four security forums. From a modeling point of view, we study the ecosystem using three network representations: (a) the author-author network, (b) the author-repository network, and (c) cross-platform egonets. Our analysis leads to the following key observations: (a) the ecosystem is growing at an accelerating rate as the number of new malware authors per year triples every 2 years, (b) it is highly collaborative, more so than the rest of GitHub authors, and (c) it includes influential and professional hackers. We find 30 authors maintain an online "brand" across GitHub and our security forums. Our study is a significant step towards using public online information for understanding the malicious hacker community.