  The criminal underground is populated with forum marketplaces where,
allegedly, cybercriminals share and trade knowledge, skills, and cybercrime
products. However, it is still unclear whether all marketplaces matter the same
in the overall threat landscape. To effectively support trade and avoid
degenerating into scams-for-scammers places, underground markets must address
fundamental economic problems (such as moral hazard, adverse selection) that
enable the exchange of actual technology and cybercrime products (as opposed to
repackaged malware or years-old password databases). From the relevant
literature and manual investigation, we identify several mechanisms that
marketplaces implement to mitigate these problems, and we condense them into a
market evaluation framework based on the Business Model Canvas. We use this
framework to evaluate which mechanisms `successful' marketplaces have in place,
and whether these differ from those employed by `unsuccessful' marketplaces. We
test the framework on 23 underground forum markets by searching 836 aliases of
indicted cybercriminals to identify `successful' marketplaces. We find evidence
that marketplaces whose administrators are impartial in trade, verify their
sellers, and have the right economic incentives to keep the market functional
are more likely to be credible sources of threat.
