D2T2 - Emmanuel Gadaix and Philippe Langlois - The SS7 Protocols
From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From...
Transcript of From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From...
![Page 1: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/1.jpg)
From Russia with love.exe
Underground Hacking Forums from Former East Bloc
![Page 2: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/2.jpg)
Outline
• Digging in a pile of trash
• Lingo
• Monetization
• Surprises
• Conclusions
![Page 3: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/3.jpg)
FY & grugq
Two lingual experts well known for their skillful tongues, the grugq
and fyodor have spent 6 months actively monitoring dozens of
russian web forums to uncover the secrets of the russian hacker
culture. This talk focuses on new threats and trends which are
discussed in the open on these sites,but are generally inaccessible
to the larger security community due to the language barrier.
Ladies! Ask about our private demonstrations! :D
![Page 4: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/4.jpg)
Intelligence Gathering
• Automated and manual analysis of publically available data
![Page 5: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/5.jpg)
Digging in a pile of trash
![Page 6: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/6.jpg)
Forumens
![Page 7: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/7.jpg)
Need for Automation
• Massive amounts of content
• Over 10 top level domains
Multiple sub forums
![Page 8: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/8.jpg)
Manually
• Natural language
• Too complicated for automated processing
• Misspellings, multiple spellings
• Unformatted postings
![Page 9: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/9.jpg)
Lingo
![Page 10: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/10.jpg)
What does this say?
![Page 11: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/11.jpg)
Can Google help?
![Page 12: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/12.jpg)
Good luck with that.
![Page 13: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/13.jpg)
Just FYI
![Page 14: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/14.jpg)
Hacker Slang
• Fenya - Russian prison slang
• Anglonims - English loan words
• Rhyming slang - Sounds like the English word
• Direct translation
![Page 15: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/15.jpg)
Scams & Schemes
![Page 16: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/16.jpg)
Wheres the money?
• Extortion
• Partnerka
• Services
• Goods
![Page 17: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/17.jpg)
Extortion
• Malware that demands payment
• Fake windows “warning”
![Page 18: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/18.jpg)
Extortion
![Page 19: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/19.jpg)
Partnerka
![Page 20: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/20.jpg)
Partnerka
• Credit card payment gateways
• Visa / Mastercard regulation compliant
• PCI compliant
• Partnerships with webmasters and other scum
• Percentage payouts for purchases
![Page 21: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/21.jpg)
![Page 22: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/22.jpg)
Partnerka Payouts
![Page 23: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/23.jpg)
Virtual Currencies
• Online payment systems for service transactions
• Web Money
• Yandex Money
• eGold [dead]
![Page 24: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/24.jpg)
Conversion Gateway
![Page 25: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/25.jpg)
Web Money offices
![Page 26: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/26.jpg)
Goods
![Page 27: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/27.jpg)
Skype
![Page 28: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/28.jpg)
iTunes cards
![Page 29: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/29.jpg)
[websites go here]
![Page 30: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/30.jpg)
Identity Services
![Page 31: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/31.jpg)
Complete Package
!"# $%&#$'() *+,"- .)/%0.1&11"$'2!
3 4"56*&4' (7"#2':
1.8)14"($42- )44(online #"$'96)
2.:;< 4)%'a(=1&(1"- *252' 1) $10'2& $%&#$'( 1000$/6000$ 3 <>?@A-3".5"B1" 9(&*2C&12&
*252') +30$-)
3.D)%') 4"#"( (#*0 online #"$'96))
4.D"620 6)$6"%') #%"6)
5.Sim-ka
![Page 32: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/32.jpg)
![Page 33: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/33.jpg)
How does it take to find a usable CC?
![Page 34: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/34.jpg)
5 seconds
![Page 35: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/35.jpg)
first link...
![Page 36: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/36.jpg)
and washing service..
![Page 37: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/37.jpg)
Traffic Generation
•Best Prices•Fast Stream•Best Infection Ratio
![Page 38: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/38.jpg)
how much to take down twitter?
![Page 39: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/39.jpg)
Avg. US$80 per diem
![Page 40: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/40.jpg)
Surprises
![Page 41: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/41.jpg)
why was twitter down?
![Page 42: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/42.jpg)
cuxumu
![Page 43: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/43.jpg)
![Page 44: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/44.jpg)
Conclusions
![Page 45: From Russia with lovedslrouter.sourceforge.net/stuff/HTB/D2T2 - The Grugq and Fyodor... · From Russia with love.exe Underground Hacking Forums from Former East Bloc](https://reader034.fdocuments.us/reader034/viewer/2022043018/5f3a76e33dc9c919c6351215/html5/thumbnails/45.jpg)
Conclusion
• Geeks not Gangsters
• Hacker culture is youth culture
• Profit driven