1. The Grugq | COSEINC
Fyodor Y | ARMORIZE

2. Meet the “authors”.. :)

3. Outline
• Tools and methods
• Introduction: Geeks or Gangsters?
• Underground economy: what u never
knew
• Future trends and our research
• Lining up

4. Интернете не нужно
ничего и даже
My favorite quote:
мозгов
ничего и даже
мозгов
“To make money on Internet you don’t need much, not
even brain” - from online tutorial on how to make
money

5. Brief: Tools
And methods
And methods

6. Sources
• Dealing with large volume of data (public
forums, bbs, manual follow up)
• Mostly public data
• Often: post mortem analysis of
compromised systems

7. Intelligence Gathering
• Automated and manual analysis of publicly
available data

8. Automation:
difficulties
difficulties
• Language: complicated for automated
processing (slang, misspellings, multiple
spellings)
• Context evaluation for new items of trade
requires manual analysis

9. Ex.: What does this say?

10. automated translation

11. Slang sources
• Fenya - Russian prison slang
• Anglonims - English loan words
• Rhyming slang - Sounds like the English word
• Direct translation

12. Tools of trade
• Mostly open-source. With custom
extensions

13. Tools: Nutch
• Content Fetcher; extended with custom
Indexers
• Changes to Spider behavior (“proper”
robots.txt handling etc)
• Custom “Seeders”
• Distributed Indexing (w/ hadoop)

14. Tools: RSS feeds “eater”
• A bunch of python scripts thrown together
to fetch rss feeds

15. Tools: SOLR
• Customized Data indexing and search
• Custom schema and search fields
• JSON output used
• Language “projection” (lingo/slang support)

16. Tools: Web UI/Maltego
• Web UI: easier
• Visualization: Maltego Custom Transforms

17. Overall picturesque

18. Maltego

19. Introduction:
Geeks or gangsters? :)
Geeks or gangsters? :)

20. From Russia with
love..?
• What is the biggest export from Russia
except for oil, gas, and nuclear scientists..? :)

21. -Malware -
Stuff that lives in your PC
Against your will :)

22. Typical export sample:
• Targets MS platforms
• Often - multi-component (loader, payload
functions in form of DLL etc)
• Sensitive information collection (data,
keystrokes and credential information)
• Turns computer into web proxy, smtp
proxy, socks etc (useful for rent, spamming
etc)
• May extort money from end user

23. Looks familiar?

24. Моscow arest
(31/08/2010)
Annual income: over One unlock charged at
500,000 rubles 300 rubles (10USD)
(100,000USD) Via SMS

25. Scale: big

26. “export” through
legimate sites

27. Which end up in
Google blacklist
Google blacklist

28. Why such spike?
• Fun?
• Profit!

29. But there’s much
more..
malware
OTHER
COOL
STUFF
:-)

30. That’s not a russian
hax0r

31. This is closer..

32. Russian Underground
Economy
Economy

33. Where is the money!
• Banking credentials
• Credit cards
• Shops and goods
• Online goods and services
• Online currencies
• Monetization via Carrier providers and
more

34. Disclaimer:
We don’t sell or
advertize any service
We simply look at the trades :-)

35. “Ликбез”
Some terminology
Some money - one wmz = one USD
terminology
• WMZ - web
• Drop - money mule
• CC - creditcards
• Abuse resistant - Safe to host any kind of
fraudulent service
• Partnerka - partnership program

36. Online currencies
• Web Money (WMZ)
• Yandex Money
• LR (liberty reserve)

37. Exchange points

38. Credit cards
Very accessible

39. Money washing

40. Drop:
Another way to turn dirty cash into profit

41. Mass domain
theft
theft

42. Traffic generation
As big biz
As big biz

43. Costs
Per 1000 Unique visitors
• AU - 300-550$
• UK - 220-300$
• IT - 200-350$
• NZ - 200-250$
• ES,DE,FR - 170-250$
• US - 100-150$
• RU, UA, KZ, KG .. 10-40$

44. Other
Online goods
Online goods

45. Looks familiar?

46. Cards, burners

47. And more

48. Passport scans

49. “Business package” Pa
Includes..
Includes..
Под средства любой загрязненности! For money of any state of dirtiness
В комплект входит: Pack includes
1.Банковскийакк(online доступ Online bank account access
)
2.АТМ картa(Дневнойлимитна снятиесредств1000$/6000$ В МЕСЯЦ-Возможноувеличение
лимита +30$-) ATM card (1000/6000USD per month withdrawal limit)
3.Картакодов (дляonline доступа online access passwords
)
4.Копия паспортадропаPassport copy of “poor john”
5.Sim-ka SIM card
Also can be pre-ordered on custom
passport scan (25USD)

50. DDOS
Very affordable
We remove sites of affordable
Very your concurrents with
DDOS attack. Fast and effective. Supported:
Prices (in WMZ ~= USD)
Discounts for bulk

51. DDOS 911

52. Abuse resistant hosting

53. Malware A/V QA

54. Hash cracking
In cloud
In cloud

55. Captcha
In cloud
In cloud

56. Exploit packs

57. With nice stats

58. Stats per country
Clicks, loads (pwned ;), percentage)

59. Need to build
Botnet?

60. Welcome
TDS system
TDS system

61. Seller

62. Buyer

63. Owner

64. “Game” rules :)
Iframe traff. No bot traf (ruclicks)
4USD/1000 clicks Payday - every monday

65. Making money together
Fake AV affiliation program

66. Fake AV payouts
Login Balance

67. Crimeware: thrends
And research
And research

68. Moving mobile
• Steal a dollar from million - still a million
dollars
• WAP sites spreading trojaned games are
very popular

69. Mobile Malware

70. SEO spam
<*bad* word (rus)

71. Now - delivered
proffesionally :)

72. Malware through
Infected ads
Infected ads

73. Hidden behind login
screens
Hidden behind login
screens
• Frequent in banking or other online
credential targeted attacks
• Effectively prevents services like google
blacklist, HA and other from identifying
infections

74. Research
• Monetization schemes
• Taking over the existing ifrastructures for
forensics analysis and statistics
• Hunt the hunters

75. Hunt the hunter
• Pwnkit - automated exploitkit pwner
• Automated exploit kit fingerprinting
• Password bruteforce
• Exploiting bugs and common
misconfigurations
• Generates statistics on exploit pack
usage :in the wild:

76. Misc. Case studies :)

77. Botnet DIY ;)
• Goal: 1000000 nodes botnet
• No skills required
• Buy these (available on sale):
• Traffic
• Abuse-resistant service
• Exploitpack
• Botnet gear

78. How much it costs
• Traffic - 10-15KUSD (mixed) infection ratio
arond 10-20% (depending on exploit pack)
• Abuse resistant server 300USD/month
• Exploitpack 200-2000USD
• Botnet gear 500- 10,000USD
• = 15-20,000USD total + 1-2 months of
work

79. Conclusions
• You can be victim, even if you paid for
Kaspersky and apply patches regulary :)
• While malware is what you mostly see,
cybercrime is not about malware, it is
about money
• Global economy - global fraud
• 0day is not important.Volume is important
• (Mostly) not organized crime but
ecosystem

80. What’s next?

81. Questions?
• Fyodor.y@armorize.com