Exposing the Money Behind Malware

Exposing the money behind the malwareOctober 2012 Chester Wisniewski

Who am I?

• Hacker• Speaker• Researcher

A guy with a really cool job

Social network spam

Social network spam trends

of social networking users reportbeing hit by spam via these services

That’s an increase of 20.3% froma year ago.

Social networking malware

KoobfaceWhat is it capable of?

Steal software keys Upload stored

passwords Web server/DNS proxy Search hijacking (PPC) CAPTCHA busting Fake AV Social network spam bot

How do we get infected?

Zbot/Zeus in the newsLaw enforcement crackdown, widely decentralized and international in nature

Image courtesy of krebsonsecurity.com

SEO – How they do it

SEO leads to social engineering

What’s driving these activities?

Brought to you by Партнерка[partnyo'rka]

Pharma hosting195.95.155.13 (AS2118) MoskvaCom Ltd, RU

Google search for pharma #s

Average sale = $140-180 USD

Map of people buying Rx

Spamit/GlavMed/GlavTorg

ChronopayMac fake anti-virus industry revealed

Pharma affilliate profitabilityDate Orders

03 216

04 193

05 231

06 191

07 189

10 128

Average sales/day 124

This affiliate used 66 unique domains referencing his Affilliate ID

• 124 orders per day• Average sale = $160• 40% commission

124 * 160 = $19840 * 40% =

$7936/day

Pharma partnyo'rka profitability

Image courtesy of krebsonsecurity.com

Fake anti-virus by the numbersTopSale2.ru

Fake anti-virus top affiliatesSome more successful than others

Affiliate IDAffiliate Username

Account Balance (USD)

4928 nenastniy $158,568.8656 krab $105,955.762 rstwm $95,021.164748 newforis $93,260.645016 slyers $85,220.223684 ultra $82,174.543750 cosma2k $78,824.885050 dp322 $75,631.263886 iamthevip $61,552.634048 dp32 $58,160.20

Courtesy of Secureworks.com

Ransomware

Complete Security

Email Data Endpoint Mobile Web Network

Clean up

Automation

Visibility Local self-help

WiFi security

Keep people working

Technical support

Access control

Intrusion prevention

Anti-malware User education

Data Control

Stop attacks and breaches

Firewall

Email encryption

Virtualization

Endpoint Web Protection

Mobile Control

Secure branch offices

Encryption for cloud

Live Protection

Mobile app security

Protect everywhere

Web ApplicationFirewall

URL Filtering

Anti-spam Patch Manager

ApplicationControl

Encryption

Device Control

Reduce attack surface

Why you’re safer in our world

• Complete security that works better together• Defense in depth you can actually deploy

You’ll also see the benefits of consolidating your security vendors:

Consolidated licensing costs One trusted partner for support

You’ll get better threat and data protection more simply, and more cost effectively

Complete Security

WithoutComplexity

Active Protection

@chetwisniewski on Twitter

chesterw@sophos.com

App.net/chester

Chester Wisniewski on G+

http://nakedsecurity.sophos.com

http://podcasts.sophos.com

http://www.sophos.com/security

Exposing the Money Behind Malware

Technology

Transcript of Exposing the Money Behind Malware

2013 m sc econstructing the cryptanalytic attack behind the flame malware

Exposing the Emperor's

Reconstructing the Cryptanalytic Attack behind the Flame ... · Reconstructing the Cryptanalytic Attack behind the Flame Malware MSc Thesis (Afstudeerscriptie) written by Fillinger,

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Behind a Malware Lifecycle and Infection Chain€¦ · Malware infection chains and lifecycles are often talked about in the advanced threat discussions in a generic way, addressing

A Look at DNS-Changing Malware - Trend Micro · changing malware allowed the cybercriminals behind Esthost to earn US$14 million over several years. The esThosT Takedown Esthost was

Re-exposing secrets

Exposing Electronics

Productivity - Crashplan · automatic cloud backup, exposing your business to big risks—from spreading malware and ransomware, to losing productivity, revenue and even customers.

Exposing what's Beneath

Introduction of Malware Issues - OECD• Usually the malwares hurt you by: – the malware themselves – bad guys ‘behind’ them •destroy your important work or personal data;

Exposing Web Vulnerabilities

Exposing The Truths Behind Every Real Estate Investing Myth

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Exposing Shaytan (QSEP)

Behind the Curtain: Exposing Advanced Threats

Exposing Translator Bias

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Exposing GEO TV

Exposing Sweatshops.