Cyber Fraud: Tactics, Techniques and Procedures

9781420091274......Page 1
CYBER FRAUD: Tactics, Techniques, and Procedures......Page 3
Contents......Page 5
Introduction......Page 17
Part I: Underground Culture......Page 21
Introduction......Page 22
Government......Page 23
Purchase of Externally Discovered Vulnerabilities......Page 24
Outsourced......Page 25
Internal Discovery......Page 28
Contracted......Page 30
Purchase......Page 31
Vendors......Page 32
Compensation......Page 33
Open Market......Page 34
Underground......Page 35
Vendors......Page 36
Conclusion......Page 37
Executive Summary......Page 39
Cyber Fraud Roles......Page 40
Cashing Out......Page 41
The Model Made Real: The Carding Underground in 2007......Page 43
“Real-World” Theft......Page 45
Carding Forums......Page 46
Dumps Vendors......Page 48
Noncarding-Related Forums Used for Carding......Page 49
Iceman/Digits......Page 50
Dron......Page 51
Comparison to Data from 2004 to 2005......Page 52
Background Information on Money Mule Operations......Page 53
Increasingly Sophisticated E-Mails......Page 54
Incorporation of “Rock Phish”-–Style Tactics......Page 56
The Hong Kong Connection......Page 57
The Evolution of Cyber Fraud techniques: Phishing and Pharming......Page 61
Phishing......Page 62
Obfuscation Techniques......Page 63
Fast-Flux Phishing Sites: Too Fast for Traditional Solutions......Page 64
How Pharming Works and How It Developed......Page 65
Drive-By Pharming......Page 66
Implications......Page 67
Mitigation......Page 69
Keystroke Logging......Page 70
Phishing and Pharming Trojans......Page 71
Certificate Stealing......Page 72
Insider Threats......Page 73
Financial Gain......Page 74
Database Timing Attacks......Page 75
Laptop Theft: At Home and Abroad......Page 76
The Evolution of Cyber Fraud Techniques: “Pump-and-dump”......Page 77
How “Pump-and-Dump” Stock Scams Work......Page 78
Typical “Pump-and-Dump” Spam Activity Patterns......Page 79
Charging “Pump-and-Dump” Fraudsters......Page 80
PDFs Used in “Pump-and-Dump” Spam, Malicious E-Cards on July 4, 2007......Page 81
E-Trade “Pump-and-Dump” Scam......Page 84
Conclusion......Page 85
Executive Summary......Page 87
Foreign Politics of the Russian Federation......Page 88
Domestic Politics of the Russian Federation......Page 94
Ethnic Tensions within the Russian Federation......Page 95
Economic Background......Page 102
The Russian Information Technology Sector......Page 103
Human Capital......Page 104
Software......Page 105
Mobile Telephony......Page 106
Internet Service Providers......Page 107
Internet Penetration and Use......Page 108
The Role of Government......Page 109
Restrictions on Online Content......Page 110
Motivation/Weltanschauung: Perceptions and Targets......Page 111
The Positive Aspects of Russian Law Enforcement......Page 115
Corruption......Page 116
Corruption among Law Enforcement......Page 118
Piracy and Intellectual Property Infringement......Page 119
Insider Threat......Page 124
Financial Fraud......Page 125
Phishing/Banking Trojans......Page 126
A Shift to Malicious Code......Page 130
Web Infections......Page 131
“Pump-and-Dump” Scams......Page 133
Carding......Page 134
Distributed Denial of Service (DDoS) Attacks......Page 136
Spam......Page 139
Politically Motivated Use of Cyberspace......Page 141
May 2007 Attacks on Estonia......Page 142
The Russian Government: Sponsor of Politically Motivated Cyber attacks?......Page 145
Conclusion......Page 150
Executive Summary......Page 152
Introduction......Page 153
Economics and Business Environment......Page 154
Organized Crime......Page 155
Deregulation and Privatization of IT in the 1990s......Page 157
Internet Penetration and Use......Page 158
E-Government......Page 159
Human Capital and General Features of the IT Workforce......Page 160
Data and Public Information Systems......Page 161
Upcoming Legislative Initiatives......Page 162
Federal Law Enforcement......Page 164
State Law Enforcement......Page 165
Police and the Financial Sector......Page 167
Security Measures and Incident Handling in the Financial Sector......Page 168
Unique Features of the Brazilian Threat Environment......Page 170
Banking Trojans......Page 172
Intellectual Property Theft and Corporate Espionage......Page 176
Taxonomy of Criminal Actors and Organizations......Page 179
General Contours of Fraud Schemes......Page 180
International Connections......Page 183
Conclusion......Page 185
Executive Summary......Page 188
Rumors and Gossip......Page 189
Organization and Structure......Page 190
Affiliated Organizations......Page 192
SBTtel......Page 193
Akimon......Page 195
Nevacon Ltd.......Page 196
Eexhost......Page 197
Too Coin......Page 198
Western Express......Page 200
Absolutee......Page 201
MNS......Page 202
Infobox......Page 203
RBN Domains......Page 206
Rock Phish......Page 207
Metafisher......Page 209
IFrameCash......Page 210
Corpse’s Nuclear Grabber, OrderGun, and Haxdoor......Page 212
Gozi......Page 214
Paycheck_322082.zip......Page 215
MCollect E-Mail Harvester......Page 216
QuickTime Malicious Code and Google Adwords......Page 217
Pornography......Page 218
Pressure from the Media......Page 219
Configuration Changes and Dissolution......Page 220
Executive Summary......Page 225
Stages of Attack......Page 226
Infection......Page 227
Information Theft......Page 228
Techniques and Malicious Code Evolution......Page 229
Screenshots and Mouse Event Capturing......Page 230
Hypertext Markup Language (HTML) Injection......Page 231
Flash Cookie Stealing......Page 232
Brazilian Banking Trojans......Page 233
Pinch (Common Names: Pin, LDPinch)......Page 234
A-311 Death and Nuclear Grabber (Common Name: Haxdoor)......Page 235
Limbo (Common Name: NetHell)......Page 237
Agent DQ (Common Names: Metafisher, Nurech, BZub, Cimuz, BankEm)......Page 241
Apophis (Common Name: Nuklus)......Page 246
VisualBreeze E-Banca/VisualBriz (Common Name: VBriz, Briz, Sters)......Page 249
Snatch......Page 251
Power Grabber......Page 255
Zeus (Common Names: PRG, TCPWP, WSNPOEM)......Page 256
Spear-Phished Information-Stealing Trojans......Page 257
Service Trojan #1 (Common Names: Torpig, Sinowal, Anserin)......Page 258
Service Trojan #2 (Common Names: OrderGun, Gozi, Ursnif, Snifula, Zlobotka)......Page 259
Unknown #3 (Common Name: DotInj)......Page 262
More Unknowns......Page 263
Command-and-Control (C&C) Servers and Drop Sites......Page 264
FTP......Page 265
Bulletproof Hosting......Page 266
Fast-Flux Hosting......Page 267
Minimizing Financial Impact......Page 268
Server Logging to Flag Trojan Victims......Page 269
Stored Passwords......Page 270
Attacking Defaults......Page 271
Credential Processing......Page 272
Conclusion......Page 273
Introduction......Page 275
Increasingly Sophisticated E-mails......Page 276
Example of an E-mail Employment Solicitation for a Money Mule Position......Page 278
Incorporation of “Rock Phish”-Style Tactics......Page 279
March 2007 Posting to Whitestar’s Mailing List......Page 280
Conclusion......Page 294
Part II: Underground InnovatIon......Page 295
Executive Summary......Page 296
What Is an IFrame?......Page 297
How Attackers Use IFrames......Page 298
IFrame Attacks with Secure Socket Layers (SSLs)......Page 299
What the Attacks Look Like......Page 300
Hacking Web Sites and Web Servers......Page 303
Worms and Viruses......Page 304
Postexploitation Activities: Where Criminals Make the Real Money......Page 305
Simple IFrame Economics......Page 307
IFrame-for-Hire Networks......Page 308
The IFrame Stock Market......Page 309
Stopping IFrame Attacks......Page 313
Customer Mitigation......Page 315
The Future of IFrame Attacks......Page 316
Executive Summary......Page 318
Ping Flood Attacks......Page 319
Smurf and Fraggle Reflection Attacks......Page 320
Domain Name System (DNS) Reflection Attacks......Page 321
Resource Depletion Attacks......Page 322
Land Attack......Page 323
Motivations for Conducting DDoS Attacks......Page 325
Extortion......Page 326
DDoS and Phishing Attacks......Page 327
Operation Cyberslam......Page 328
DDoS as Revenge......Page 329
Miscellaneous......Page 330
Denial of Service (doS) and Botnets......Page 331
Bot Master......Page 333
Recruiting an Army — The Scanning Phase......Page 334
Propagation through a Central Repository......Page 335
Controlling the Army......Page 336
Recent Advancements in Botnet Control......Page 337
Number of Attacks......Page 338
Financial Gain......Page 339
AgoBot/PhatBot DDoS Commands......Page 341
Conclusion......Page 342
Torpig Exploitation and Installation......Page 343
Spreading the Exploits......Page 346
Analysis......Page 347
Executive Summary......Page 348
Background......Page 363
File and Network Information......Page 364
Toolkit Back-End......Page 365
Mitigation and Analysis......Page 368
Trojan Details......Page 369
Laqma Loader — Command-and-Control Registration/Upgrade......Page 372
Laqma Grabber — Deploying the User-Mode Rootkit......Page 374
Laqma Grabber — Persistence and Configuration Timers......Page 376
Laqma — Attack Dispatcher......Page 378
Laqma — Attack Handlers......Page 380
Executive Summary......Page 382
Introduction......Page 383
Attack Trends: February 2007 through May 2008......Page 384
Spear-Phishing Examples......Page 386
History of Spear-Phishing Attacks......Page 388
Group A......Page 389
Group A Phishing Attacks......Page 390
Money Mule Operations......Page 392
Apache Kit......Page 393
Current Code......Page 395
Command-and-Control Scripts......Page 397
Commands......Page 398
Database Layout......Page 399
Changes, Future Direction, and Group Activity......Page 400
Network Architecture......Page 401
Targeted Malicious Code Attacks on Job Seekers......Page 403
Detection......Page 405
Available Hypertext Transfer Protocol (HTTP) Commands......Page 407
MySQL Database and PHP Interface......Page 408
Changes in the Newest Versions......Page 411
Peeper......Page 412
Focus on High-Value Banking......Page 413
High-Resolution Data Use......Page 414
Automation of Transactions......Page 415
Education through Testing......Page 416
Appendix A: Catalog of Attacks......Page 417
Executive Summary......Page 420
The SilentBanker Trojan Dropper......Page 421
Enhanced Clash Resistance......Page 422
Unpacking without a Trace......Page 423
Hash-Based Applications Programming Interface (API) Resolution Table......Page 424
API Hook Installation......Page 425
The Nefarious Browser-Only Thread......Page 428
Ws2_32.connect IP Replacement (a.k.a. DNS Hijack) Hook......Page 430
InternetReadFile and HttpSendRequest Injection/Hijack Hooks......Page 431
Wininet.CommitUrlCacheEntry Cookie Retrieval Hooks......Page 434
Wininet.InternetErrorDlg Basic Auth and Proxy Capture Hook......Page 436
Wininet.HttpAddRequestHeader Acceptable Encoding Hooks......Page 438
Wininet.InternetQueryDataAvailable Buffer Resize Hook......Page 439
Reverse Engineering the File-Encoding Algorithm......Page 440
Snort Signatures......Page 443
HTML Injection Fields Posted to Server......Page 444
Conclusion......Page 445
Appendix A......Page 446
Appendix B......Page 449
Outbound Channel Methods......Page 459
Encryption......Page 460
Steganography......Page 461
Intrusion Detection and Prevention Systems (IDS/IPS)......Page 462
Anomaly Detection......Page 463
Traffic Normalization......Page 464
Conclusion......Page 465
Executive Summary......Page 466
Better......Page 467
Mobile Phone Operating Systems......Page 468
Multimedia Messaging Service......Page 469
Micro-Browser-Based......Page 470
The Rise of Mobile Malicious Code......Page 471
Mobile Malicious Code Trend Analysis......Page 473
Best Security Practices for Mobile Malicious Codes......Page 474
Sources......Page 475
Epilogue......Page 476