Cybercrime. Professional Hackers Paid per the job, usually flat rates State-side hackers can earn up...
-
Upload
alexis-freeman -
Category
Documents
-
view
215 -
download
0
Transcript of Cybercrime. Professional Hackers Paid per the job, usually flat rates State-side hackers can earn up...
CybercrimeCybercrime
Professional Hackers
• Paid per the job, usually flat rates• State-side hackers can earn up to $200K a year• The work is usually writing tools for others to
use, developing/finding new exploits, and coding up malware
• Occasionally they will do a black bag job, but these are rare, unless they are simply looking for “loot” on easy targets
Spammers
• They earn millions per year selling their direct mail services
• They are not picky and do not consider the person doing the selling is committing fraud, including the Russia Mafia
• After years of jumping from ISP to ISP, it is much easier to lease “capacity” from hacker botnets or develop their own
• They are the main employer of professional hackers
The WeaponsThe Weapons
• Botnets– Average size is 5000 computers, some have been as large as 500,000
computers– New command and control software allows botnet capacity leasing of
subsections of the botnet
• Phishing– is the act of attempting to acquire information such as
usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication.
• Targeted Viruses– Used to create quick one-time-use botnets– Also used when specifically targeting a single site or organization
• The usual Internet attack tools– Metasploit, etc
Precision TacticsPrecision Tactics
Precision Tactics - HotelPrecision Tactics - Hotel
• Hacking the PC in the hotel room– Can do remote– Will check into the same hotel as target if need be– Will resort to wiretaps, closed circuit video cameras, and other
physical penetration attempts• Known times when the target is out of the room are
especially dangerous– Speakers and trainers are especially vulnerable, since they have
to be in their talks, other do not• Law enforcement regularly bugs hotel rooms at security
conferences– Hotels (especially Vegas, Atlantic City) will comply to avoid LE
looking at their computers• Organized crime outfits *do* attend conferences
Precision Tactics – Office
• Posing as regular office personnel• Planting network-based or hardware-based
sniffing devices• Conventional listening devices (bugs) are not
uncommon
Precision Tactics – Infiltration
• Will pose as script kiddies, and “gain skills” fairly quickly, rising in status in various IRC channels
• Will join and form hacking groups• Will direct attacks for the group to perform, usually
directing blame toward the kiddies rather than themselves
• This is not a new technique – it is in use today by some governments, most notably French Intelligence
ExamplesExamples