From russia final_bluehat10
81
Economy Fyodor Y | ARMORIZE The Grugq | COSEINC
description
Transcript of From russia final_bluehat10
InsightOn Russian
UndergroundEconomy
Fyodor Y | ARMORIZE
The Grugq | COSEINC
Meet the “authors”.. :)
Outline
•Tools and methods
•Introduction: Geeks or Gangsters?
•Underground economy: what u never knew
•Future trends and our research
•Lining up
Чтобы заработь на Интернете не
нужноничего и даже
мозгов
“To make money on Internet you don’t need much, not even brain” - from online tutorial
on how to make money
My favorite quote:
Brief: ToolsAnd methods
Sources
•Dealing with large volume of data (public forums, bbs, manual follow up)
•Mostly public data
•Often: post mortem analysis of compromised systems
Intelligence Gathering
•Automated and manual analysis of publicly available data
Automation: difficulties
•Language: complicated for automated processing (slang, misspellings, multiple spellings)
•Context evaluation for new items of trade requires manual analysis
Ex.: What does this say?
Good luck w/ automated translation
Slang sources•Fenya - Russian prison slang
•Anglonims - English loan words
•Rhyming slang - Sounds like the English word
•Direct translation
Tools of trade
•Mostly open-source. With custom extensions
Tools: Nutch
•Content Fetcher; extended with custom Indexers
•Changes to Spider behavior (“proper” robots.txt handling etc)
•Custom “Seeders”
•Distributed Indexing (w/ hadoop)
Tools: RSS feeds “eater”
•A bunch of python scripts thrown together to fetch rss feeds
Tools: SOLR
•Customized Data indexing and search
•Custom schema and search fields
•JSON output used
•Language “projection” (lingo/slang support)
Tools: Web UI/Maltego
•Web UI: easier
•Visualization: Maltego Custom Transforms
Overall picturesque
Maltego
Introduction:Geeks or
gangsters? :)
From Russia with love..?
•What is the biggest export from Russia except for oil, gas, and nuclear scientists..? :)
-Malware -Stuff that lives in your PC
Against your will :)
Typical export sample:
•Targets MS platforms
•Often - multi-component (loader, payload functions in form of DLL etc)
•Sensitive information collection (data, keystrokes and credential information)
•Turns computer into web proxy, smtp proxy, socks etc (useful for rent, spamming etc)
•May extort money from end user
Looks familiar?
Моscow arest (31/08/2010)
Annual income: over 500,000 rubles (100,000USD)
One unlock charged at300 rubles (10USD)
Via SMS
Scale: big
“export” through legimate sites
Which end up in Google blacklist
Why such spike?
•Fun?
•Profit!
But there’s much more..
malware
OTHERCOOLSTUFF
:-)
That’s not a russian hax0r
This is closer..
Russian Underground
Economy
Where is the money!
•Banking credentials
•Credit cards
•Shops and goods
•Online goods and services
•Online currencies
•Monetization via Carrier providers and more
We don’t sell or advertize any
serviceWe simply look at the trades :-)
Disclaimer:
“Ликбез”Some terminology
•WMZ - web money - one wmz = one USD
•Drop - money mule
•CC - creditcards
•Abuse resistant - Safe to host any kind of fraudulent service
•Partnerka - partnership program
Online currencies
•Web Money (WMZ)
•Yandex Money
•LR (liberty reserve)
Exchange points
Credit cardsVery accessible
Money washing
Drop:Another way to turn dirty cash into
profit
Mass domaintheft
Traffic generationAs big biz
Costs• AU - 300-550$
• UK - 220-300$
• IT - 200-350$
• NZ - 200-250$
• ES,DE,FR - 170-250$
• US - 100-150$
• RU, UA, KZ, KG .. 10-40$
Per 1000 Unique visitors
Other Online goods
Looks familiar?
Cards, burners
And more
Passport scans
“Business package” Pa
Includes..Под средства любой загрязненности! For money of any state of dirtinessВ комплект входит: Pack includes1.Банковский акк(online доступ) Online bank account access2.АТМ картa(Дневной лимит на снятие средств 1000$/6000$ В МЕСЯЦ-Возможно увеличение лимита +30$-) ATM card (1000/6000USD per month withdrawal limit)3.Карта кодов (для online доступа) online access passwords4.Копия паспорта дропа Passport copy of “poor john”5.Sim-ka SIM card
Also can be pre-ordered on custom passport scan
(25USD)
DDOSVery affordable
We remove sites of your concurrents with DDOS attack. Fast and effective.
Supported:
Prices (in WMZ ~= USD)
Discounts for bulk
DDOS 911
Abuse resistant hosting
Malware A/V QA
Hash crackingIn cloud
CaptchaIn cloud
Exploit packs
With nice stats
Stats per countryClicks, loads (pwned ;),
percentage)
Need to build Botnet?
WelcomeTDS system
Seller
Buyer
Owner
“Game” rules :)Iframe traff. 4USD/1000
clicks
No bot traf (ruclicks)Payday - every monday
Making money togetherFake AV affiliation
program
Fake AV payouts
BalanceLogin
Crimeware: thrends
And research
Moving mobile
•Steal a dollar from million - still a million dollars
•WAP sites spreading trojaned games are very popular
Mobile Malware
SEO spam<*bad* word (rus)
Now - delivered proffesionally :)
Malware through Infected ads
Malware infectionHidden behind login screens
•Frequent in banking or other online credential targeted attacks
•Effectively prevents services like google blacklist, HA and other from identifying infections
Research
•Monetization schemes
•Taking over the existing ifrastructures for forensics analysis and statistics
•Hunt the hunters
Hunt the hunter
•Pwnkit - automated exploitkit pwner
•Automated exploit kit fingerprinting
•Password bruteforce
•Exploiting bugs and common misconfigurations
•Generates statistics on exploit pack usage :in the wild:
Misc. Case studies :)
Botnet DIY ;)•Goal: 1000000 nodes botnet
•No skills required
•Buy these (available on sale):
•Traffic
•Abuse-resistant service
•Exploitpack
•Botnet gear
How much it costs•Traffic - 10-15KUSD (mixed) infection
ratio arond 10-20% (depending on exploit pack)
•Abuse resistant server 300USD/month
•Exploitpack 200-2000USD
•Botnet gear 500- 10,000USD
•= 15-20,000USD total + 1-2 months of work
Conclusions
•You can be victim, even if you paid for Kaspersky and apply patches regulary :)
•While malware is what you mostly see, cybercrime is not about malware, it is about money
•Global economy - global fraud
•0day is not important. Volume is important
•(Mostly) not organized crime but ecosystem
What’s next?
