1. 2014 Asia-Pacific Fraud Conference
November 17th 2014 @ Hong Kong
CYBER FRAUD
THE NEW FRONTIERS
Albert Hui GREM, GCFA, GCFE, GNFA, GCIA, GCIH, GXPN, GPEN, GAWN, GSNA, CISA, CISM, CRISC
Principal Consultant

2. WHO AM I?
Albert Hui GREM, GCFA, GCFE, GNFA, GCIA, GCIH, GXPN, GPEN, GAWN, GSNA, CISA, CISM, CRISC
Principal Consultant
albert@securityronin.com
• Spoken at Black Hat, High Tech Crime Investigation Association
(Asia Pacific Conference), and Economist Corporate Network.
• Risk Consultant for Banks, Government and Critical Infrastructures.
• SANS GIAC Advisory Board Member.
• Co-designed the first Computer Forensics curriculum for
Hong Kong Police Force.
• Former HKUST Computer Science lecturer.

3. FOCUS
• Cyber Fraud
• External Fraud
• Mechanisms and Facilitators

4. AGENDA
Overview of 2 Prominent Fraud Scenarios
• Phishing / Whaling
• Man-in-the-Browser
Monetization
• Hacker Supply Chain
• Underground Economy
• Money Laundering
Cyber Security Countermeasures

5. PHISHING
FROM AN END-USER PROBLEM
TO A CORPORATE PROBLEM

6. CLASSIC PHISHING SCAM:
NIGERIAN LETTER

7. ADVANCED FEES SCAM
IS 200+ YEARS OLD
“Spanish Prisoner” scam letter from 1905

8. PHISHING EVOLUTION
more transparent more targeted
spear phishing
phishing
whaling
pharming

9. WHALING EXAMPLE
trojan

10. CLASSIC PHISHING AND WHALING COMPARED
Classic Phishing
• Ridiculous contents
• Opportunistic
• Straight-forward financial scam
Whaling
• Make-Believe contents
• Targeted
• Lateral compromises possible,
often leads to corporate espionage

11. CYBER KILL CHAIN
Recon Weaponize Deliver Exploit Install C2 Action

12. MONETIZATION
TURNING EXPLOITS INTO CASH

13. SOME MONETIZATION POSSIBILITIES
bank accounts
computer
file server
customer data stored values
(e.g. Q-coins, Taobao credit)
credit cards

14. MAN-IN-THE-BROWSER ATTACK:
SPOOFED SCREENS
trojan (e.g. Zeus)

15. MAN-IN-THE-BROWSER ATTACK:
REAL-TIME REDIRECT
trojan (e.g. Zeus)

16. FOOD CHAIN
Fraud Rings
(can launder money
“safely”)
Hackers
(cannot)

17. MONEY LAUNDERING

18. MONEY MULES

19. STORED VALUES

20. HACKER SUPPLY CHAIN
Anon
Payment
Hacker
Tools /
Bulletproof
Hosting
Monetization
Implications
• Sophisticated attacks now available to
non-experts
• Lower breakeven point for attacks
• More “worthwhile” targets

21. UNDERGROUND ECONOMY

22. BITCOIN FOR MONEY LAUNDERING
Dark Wallet
CoinJoin

23. HIDDEN INTERNET
Dark Net / Deep Web Silk Road
The Onion
Router

24. CYBER SECURITY COUNTERMEASURES

25. PHILOSOPHY
Defender’s Dilemma
• Must secure all possible vulnerabilities
Intruder’s Dilemma
• Must evade all detections
Reason’s Swiss Cheese Model
Picture from NICPLD

26. ESSENTIALS FOR DETECTING CYBER ATTACKS
• Layered defense-in-depth
• Redundant security (e.g. two different brands of FWs)
• Security event correlation (e.g. SIEM)
• Trustworthy logging
• Up-to-date threat intelligence
• Security awareness and reporting channel
• Incident response capability (e.g. CSIRT)

27. ANY QUESTIONS?
? ?

28. THANK YOU
albert@securityronin.com