From Russia with love.exe Pt. 2conference.hackinthebox.org/hitbsecconf2010ams/materials... ·...
Transcript of From Russia with love.exe Pt. 2conference.hackinthebox.org/hitbsecconf2010ams/materials... ·...
From Russia with love.exe
Pt. 2Underground Hacking Forums from Former East Bloc
Thursday, July 1, 2010
Shhpeakers.. :)
Thursday, July 1, 2010
FY & grugq
Two lingual experts well known for their skillful tongues, the grugqand fyodor have spent 6 months actively monitoring dozens ofrussian web forums to uncover the secrets of the russian hackerculture. This talk focuses on new threats and trends which arediscussed in the open on these sites,but are generally inaccessibleto the larger security community due to the language barrier.Ladies! Ask about our private demonstrations! :D
Thursday, July 1, 2010
Outline
• Hax0r Revolution Intro
• Intelligence: Digging in a pile of trash
• Personalities, Lingo, Monetization
• Technology behind: Tools of trade
• Future Plans
Thursday, July 1, 2010
Hax0r Revolution
Thursday, July 1, 2010
Hax0r Revolution
• 100% money-driven
• Prerequisites:
• Imbalance of Economic system
• Globalization of payment systems
• Accessibility
• Laws, Languages, Cold War, ...
Thursday, July 1, 2010
Revolutionist targets
• Average PC users (your mom and dad)
• Rarely - corporations
Thursday, July 1, 2010
You being 0wn3d
• Exploiting vulnerabilities in Client software (mostly browsers, browser’s add-ons, browser’s plugins, ..)
• Social engineering (computer users are dumb) -> “fake av software”, .pdf.exe things and other old tricks
Thursday, July 1, 2010
Peeking behind the scene
• Looking at the market
• Items and patterns of trade
• Personalities
• Quantified analysis
Thursday, July 1, 2010
Digging in a pile of trash
Thursday, July 1, 2010
Forums
Thursday, July 1, 2010
Need for Automation• Massive amounts of content
• Over 10 top level domains
Multiple sub forums
Thursday, July 1, 2010
Manually
• Natural language
• Too complicated for automated processing
• Misspellings, multiple spellings
• Unformatted postings
Thursday, July 1, 2010
AmusingDiscoveries
Thursday, July 1, 2010
Personalities
Thursday, July 1, 2010
Thursday, July 1, 2010
Geeks, not Gangsters
Thursday, July 1, 2010
Gangsters
Thursday, July 1, 2010
Thursday, July 1, 2010
Thursday, July 1, 2010
ExtremelyNonprofessional
Criminals
Thursday, July 1, 2010
Geeks
Thursday, July 1, 2010
Lingo
Thursday, July 1, 2010
What does this say?
Thursday, July 1, 2010
Can Google help?
Thursday, July 1, 2010
Good luck with that.
Thursday, July 1, 2010
Just FYI
Thursday, July 1, 2010
Hacker Slang
• Fenya - Russian prison slang
• Anglonims - English loan words
• Rhyming slang - Sounds like the English word
• Direct translation
Thursday, July 1, 2010
Scams & Schemes
Thursday, July 1, 2010
Wheres money?
• Extortion
• Job recruitment (Partnerkas, Drops, SMS regs, ..)
• Services
• Goods
Thursday, July 1, 2010
Extortion
• Malware that demands payment
• Fake windows “warning”
Thursday, July 1, 2010
Extortion
Thursday, July 1, 2010
Partnerka
Thursday, July 1, 2010
Partnerka
• Credit card payment gateways
• Visa / Mastercard regulation compliant
• PCI compliant
• Partnerships with webmasters and other scum
• Percentage payouts for purchases
Thursday, July 1, 2010
Thursday, July 1, 2010
Partnerka Payouts
Thursday, July 1, 2010
SMS scams :)
Thursday, July 1, 2010
Cash Out
Thursday, July 1, 2010
Thursday, July 1, 2010
“Дроп”
• -> STORE -> DROP (share) ->
Thursday, July 1, 2010
Virtual Currencies
• Online payment systems for service transactions
• Web Money
• Yandex Money
• eGold [dead]
Thursday, July 1, 2010
Conversion Gateway
Thursday, July 1, 2010
Web Money offices
Thursday, July 1, 2010
Goods
Thursday, July 1, 2010
Skype
Thursday, July 1, 2010
iTunes cards
Thursday, July 1, 2010
Loaders, ExploitKits, ...
Thursday, July 1, 2010
Passports
Thursday, July 1, 2010
CCs
Thursday, July 1, 2010
Equipment
Thursday, July 1, 2010
[websites go here]
Thursday, July 1, 2010
Identity Services
Thursday, July 1, 2010
Complete Package
Под средства любой загрязненности! В комплект входит: 1.Банковский акк(online доступ) 2.АТМ картa(Дневной лимит на снятие средств 1000$/6000$ В МЕСЯЦ-Возможно увеличение лимита +30$-) 3.Карта кодов (для online доступа) 4.Копия паспорта дропа 5.Sim-ka
Thursday, July 1, 2010
Thursday, July 1, 2010
How long does it take to find a usable CC?
Thursday, July 1, 2010
5 seconds
Thursday, July 1, 2010
first link...
Thursday, July 1, 2010
and washing service..
Thursday, July 1, 2010
Traffic Generation
•Best Prices•Fast Stream•Best “Conversion”/Infection Ratio
Thursday, July 1, 2010
Infection: rates and nums
Thursday, July 1, 2010
how much to take down twitter?
Thursday, July 1, 2010
Avg. US$80 per diem
Thursday, July 1, 2010
Question
Thursday, July 1, 2010
why was twitter down?
Thursday, July 1, 2010
cuxumu
Thursday, July 1, 2010
Technology:Tools of Trade
Overview & demos
Thursday, July 1, 2010
Intelligence Gathering
• Automated and manual analysis of publicly available data
Thursday, July 1, 2010
Tools of trade
• Mostly open-source. With custom extensions
Thursday, July 1, 2010
Tools: Nutch
• Content Fetcher; extended with custom Indexers
• Changes to Spider behavior (“proper” robots.txt handling etc)
• Custom “Seeders”
• Distributed Indexing (w/ hadoop)
Thursday, July 1, 2010
Tools: RSS feeds “eater”
• A bunch of python scripts thrown together to fetch rss feeds
Thursday, July 1, 2010
Google App Engine
• Public Interface with transforms, dictionaries and other misc. Stuff.
Thursday, July 1, 2010
Tools: SOLR
• Customized Data indexing and search
• Custom schema and search fields
• JSON output used
• Language “projection” (lingo/slang support)
Thursday, July 1, 2010
Tools: Web UI/Maltego
• Web UI: easier
• Visualization: Maltego Custom Transforms
Thursday, July 1, 2010
Overall picturesque
Thursday, July 1, 2010
Maltego
Thursday, July 1, 2010
Lets look at some %^@%#
Thursday, July 1, 2010
Future Plans
Thursday, July 1, 2010
Future Integration
• Maltego and other viz. tools
• Online Engine Availability
• Scale more, dig more ;-)
• Feed “eaters” (BBSes hear me?;))
• MultiLang: Spanish/Italian/Portuguese
Thursday, July 1, 2010
Availability
• http://www.o0o.nu/projects/intelligence-collection - tools, slides, howto’s etc
• http://383rat.appspot.com - transforms on GAE, indexes, dictionaries etc
Thursday, July 1, 2010
FeedbackAnd Questions([email protected]
Thursday, July 1, 2010