17.2.1. Reputation Systems, Auction Sites, and Gambling Applications

One historic example of an uncommon application being targeted by crimeware is Trojan.checkraise [338]. This program disguised itself as a rake-back calculator, which is often used by online poker players.^[1] This particular rake-back calculator actually stole passwords associated with popular online poker sites. Clearly, rake-back calculators are the kind of tool only a small number of people will try (you not only have to be an online poker player, but you also have to be serious and knowledgable enough to know about rake-back promotions). From an attacker’s perspective, however, even a single victim might provide a very high yield, especially if the account belongs to a high-stakes poker player.

^[1] Online poker sites profit by taking a small percentage (usually up to a maximum) of each pot that is played. This amount is called the rake. To draw more traffic to their sites and entice new customers, many sites offer rake-back promotions. These promotions are typically offered through affiliates; when a customer signs up for an account to a given poker site through a particular affiliate, the customer receives a small percentage of whatever rake was deducted from poker hands he or she was involved in. The affiliate also receives a commission for referring the customer. Rake-back calculators allow online poker players to estimate how much rake they would get back through a given rake-back promotion.

Poker sites also provide a natural mechanism for transferring money. Many sites allow direct interplayer transfers (or the transfer can happen in more diabolical ways, such as by having one player “dump” a certain amount of money to another player during the course of play by purposefully playing hands badly). A series of such transfers could prove difficult to trace.