From Russia with love.exe Pt. 2 - Hack In The Box Security Conference
Transcription
From Russia with love.exe Pt. 2 - Hack In The Box Security Conference
From Russia with love.exe Pt. 2 Underground Hacking Forums from Former East Bloc Thursday, July 1, 2010 Shhpeakers.. :) Thursday, July 1, 2010 FY & grugq Two lingual experts well known for their skillful tongues, the grugq and fyodor have spent 6 months actively monitoring dozens of russian web forums to uncover the secrets of the russian hacker culture. This talk focuses on new threats and trends which are discussed in the open on these sites,but are generally inaccessible to the larger security community due to the language barrier. Ladies! Ask about our private demonstrations! :D Thursday, July 1, 2010 Outline • Hax0r Revolution Intro • Intelligence: Digging in a pile of trash • Personalities, Lingo, Monetization • Technology behind: Tools of trade • Future Plans Thursday, July 1, 2010 Hax0r Revolution Thursday, July 1, 2010 Hax0r Revolution • 100% money-driven • Prerequisites: • Imbalance of Economic system • Globalization of payment systems • Accessibility • Laws, Languages, Cold War, ... Thursday, July 1, 2010 Revolutionist targets • Average PC users (your mom and dad) • Rarely - corporations Thursday, July 1, 2010 You being 0wn3d • Exploiting vulnerabilities in Client software (mostly browsers, browser’s add-ons, browser’s plugins, ..) • Social engineering (computer users are dumb) -> “fake av software”, .pdf.exe things and other old tricks Thursday, July 1, 2010 Peeking behind the scene • Looking at the market • Items and patterns of trade • Personalities • Quantified analysis Thursday, July 1, 2010 Digging in a pile of trash Thursday, July 1, 2010 Forums Thursday, July 1, 2010 Need for Automation • Massive amounts of content • Over 10 top level domains Multiple sub forums Thursday, July 1, 2010 Manually • Natural language • Too complicated for automated processing • Misspellings, multiple spellings • Unformatted postings Thursday, July 1, 2010 Amusing Discoveries Thursday, July 1, 2010 Personalities Thursday, July 1, 2010 Thursday, July 1, 2010 Geeks, not Gangsters Thursday, July 1, 2010 Gangsters Thursday, July 1, 2010 Thursday, July 1, 2010 Thursday, July 1, 2010 Extremely Nonprofessional Criminals Thursday, July 1, 2010 Geeks Thursday, July 1, 2010 Lingo Thursday, July 1, 2010 What does this say? Thursday, July 1, 2010 Can Google help? Thursday, July 1, 2010 Good luck with that. Thursday, July 1, 2010 Just FYI Thursday, July 1, 2010 Hacker Slang • Fenya - Russian prison slang • Anglonims - English loan words • Rhyming slang - Sounds like the English word • Direct translation Thursday, July 1, 2010 Scams & Schemes Thursday, July 1, 2010 Wheres money? • Extortion • Job recruitment (Partnerkas, Drops, SMS regs, ..) • Services • Goods Thursday, July 1, 2010 Extortion • Malware that demands payment • Fake windows “warning” Thursday, July 1, 2010 Extortion Thursday, July 1, 2010 Partnerka Thursday, July 1, 2010 Partnerka • Credit card payment gateways • Visa / Mastercard regulation compliant • PCI compliant • Partnerships with webmasters and other scum • Percentage payouts for purchases Thursday, July 1, 2010 Thursday, July 1, 2010 Partnerka Payouts Thursday, July 1, 2010 SMS scams :) Thursday, July 1, 2010 Cash Out Thursday, July 1, 2010 Thursday, July 1, 2010 “Дроп” • -> STORE -> DROP (share) -> Thursday, July 1, 2010 Virtual Currencies • Online payment systems for service transactions • Web Money • Yandex Money • eGold [dead] Thursday, July 1, 2010 Conversion Gateway Thursday, July 1, 2010 Web Money offices Thursday, July 1, 2010 Goods Thursday, July 1, 2010 Skype Thursday, July 1, 2010 iTunes cards Thursday, July 1, 2010 Loaders, ExploitKits, ... Thursday, July 1, 2010 Passports Thursday, July 1, 2010 CCs Thursday, July 1, 2010 Equipment Thursday, July 1, 2010 [websites go here] Thursday, July 1, 2010 Identity Services Thursday, July 1, 2010 Complete Package Под средства любой загрязненности! В комплект входит: 1.Банковский акк(online доступ) 2.АТМ картa(Дневной лимит на снятие средств 1000$/6000$ В МЕСЯЦ-Возможно увеличение лимита +30$-) 3.Карта кодов (для online доступа) 4.Копия паспорта дропа 5.Sim-ka Thursday, July 1, 2010 Thursday, July 1, 2010 How long does it take to find a usable CC? Thursday, July 1, 2010 5 seconds Thursday, July 1, 2010 first link... Thursday, July 1, 2010 and washing service.. Thursday, July 1, 2010 Traffic Generation •Best Prices •Fast Stream •Best “Conversion”/Infection Ratio Thursday, July 1, 2010 Infection: rates and nums Thursday, July 1, 2010 how much to take down twitter? Thursday, July 1, 2010 Avg. US$80 per diem Thursday, July 1, 2010 Question Thursday, July 1, 2010 why was twitter down? Thursday, July 1, 2010 cuxumu Thursday, July 1, 2010 Technology: Tools of Trade Overview & demos Thursday, July 1, 2010 Intelligence Gathering • Automated and manual analysis of publicly available data Thursday, July 1, 2010 Tools of trade • Mostly open-source. With custom extensions Thursday, July 1, 2010 Tools: Nutch • Content Fetcher; extended with custom Indexers • Changes to Spider behavior (“proper” robots.txt handling etc) • Custom “Seeders” • Distributed Indexing (w/ hadoop) Thursday, July 1, 2010 Tools: RSS feeds “eater” • A bunch of python scripts thrown together to fetch rss feeds Thursday, July 1, 2010 Google App Engine • Public Interface with transforms, dictionaries and other misc. Stuff. Thursday, July 1, 2010 Tools: SOLR • Customized Data indexing and search • Custom schema and search fields • JSON output used • Language “projection” (lingo/slang support) Thursday, July 1, 2010 Tools: Web UI/Maltego • Web UI: easier • Visualization: Maltego Custom Transforms Thursday, July 1, 2010 Overall picturesque Thursday, July 1, 2010 Maltego Thursday, July 1, 2010 Lets look at some %^@%# Thursday, July 1, 2010 Future Plans Thursday, July 1, 2010 Future Integration • Maltego and other viz. tools • Online Engine Availability • Scale more, dig more ;-) • Feed “eaters” (BBSes hear me?;)) • MultiLang: Spanish/Italian/Portuguese Thursday, July 1, 2010 Availability • http://www.o0o.nu/projects/intelligencecollection - tools, slides, howto’s etc • http://383rat.appspot.com - transforms on GAE, indexes, dictionaries etc Thursday, July 1, 2010 Feedback And Questions ([email protected] or [email protected]) Thursday, July 1, 2010