Uploaded byAlbert Hui
Insights into the Cybercrime Ecosystem
The document discusses the cybercrime ecosystem and specialization within it. It describes how cybercriminals specialize in specific criminal business functions like developing malware, exploit kits, crypting software, and spamming. This specialization allows criminals to scale up their operations and legitimize most business activities. The document also examines how cybercriminals realize financial gains through activities like spamming, renting botnets, selling accounts and personal information, money laundering through methods such as using money mules and stored value cards, and using online casinos and auction sites.
More Related Content
Similar to Insights into the Cybercrime Ecosystem
Insights into the Cybercrime Ecosystem
- 1. INSIGHTS INTO THE CYBERCRIMEECOSYSTEM Albert Hui GREM, GCIA, GCIH, GCFA, CISA
- 2. WHO AM I? ļ¶Member of: ā¢ Digital Phishnet ā¢ Association of Certified Fraud Examiners ā¢ SANS Advisory Board ļ¶ Former incident analyst / researcher at top-tier retail, commercial, and investment banks. ļ¶ Former government security auditor. ļ¶ Now a security ronin.
- 3. JURISDICTION ARBITRAGE Cybercrime is borderless;cyber law enforcement is not.
- 4. TEN YEARS AGO CopyrightĀ© 2010 Albert Hui (CC) BY-NC-SA 4
- 5. TODAY Copyright Ā© 2010Albert Hui (CC) BY-NC-SA 5
- 6. TODAY Copyright Ā© 2010Albert Hui (CC) BY-NC-SA 6 Photofromhttp://krebsonsecurity.com
- 7. TODAY Copyright Ā© 2010Albert Hui (CC) BY-NC-SA 7 āIn Spain, it is not a crime to own and operate a botnet or distribute malware,ā Capt. Lorenzana told Krebsonsecurity in March. āSo even if we manage to prove they are using a botnet, we will need to prove they also were stealing identities and other things, and that is where our lines of investigation are focusing right now.ā
- 8. BUSINESS FUNCTION SPECIALIZATION Scale upthe business.
- 9. CYBERCRIME ECOSYSTEM Copyright Ā©2010 Albert Hui (CC) BY-NC-SA 9 Security Researchers Malware Writers publish / sell exploits Script Kiddies sell malwares / exploit kits Packer / Crypter Developer Sell packers / crypters sell / publish / make known of vulnerabilities / techniques Hackers pay per install P2P File Downloaders / Web Surfers (Victims) spread malwares Crack Programmer Software Pirates supply software steal accounts (e.g. QQ, game, credit card numbers, e-banking logins) sell accounts / zombies Accounts / Zombies Resellers Spammers, Virtual Asset Resellers, Personal Info Resellers Fraudsters sell accounts sell credit card numbers / e-banking logins Money Launderers Money Mules Bulletproof Hosting buy hosting services Botnet Operators Sell zombies sell botnet Traffic Resellers
- 10. WHY SPECIALIZE? ļ¶ Scaleup ļ¶ Legitimize most business activities Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 10
- 11. PAY-PER-INSTALL Copyright Ā© 2010Albert Hui (CC) BY-NC-SA 11
- 12. INSTALL SERVICE Copyright Ā©2010 Albert Hui (CC) BY-NC-SA 12
- 13. EXPLOIT KIT Copyright Ā©2010 Albert Hui (CC) BY-NC-SA 13
- 14. CRYPTER Copyright Ā© 2010Albert Hui (CC) BY-NC-SA 14
- 15. DOWNLOADER Copyright Ā© 2010Albert Hui (CC) BY-NC-SA 15
- 16. SEO Copyright Ā© 2010Albert Hui (CC) BY-NC-SA 16
- 17. DOORWAY PAGE Copyright Ā©2010 Albert Hui (CC) BY-NC-SA 17
- 18.
- 19. SPAMMING ļ¶ Spamming ads ļ¶Spamming scam emails ļ¶ Spamming phishing emails ļ¶ Spam-assisted pump and dump Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 19
- 20. BOTNET ļ¶ Leasing outbotnets (leave dirty jobs to the buyers) ļ¶ Why people pay for botnets? ā¢ Orchestrate click frauds ā¢ Cyber extortion rackets using DDoS ā¢ Distribute more sinister malwares (e.g. Zeus, Torpig, Silent Banker) Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 20
- 21. CAPITALIZING ACCOUNTS ļ¶ Sellingin-game items ļ¶ Selling game accounts ļ¶ Selling personal information (for telemarketing / defrauding) Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 21
- 22. VIRTUAL CURRENCIES ļ¶ WoWgold, Linden Dollar, Qå¹£, etc. Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 22
- 23.
- 24. WASH THY MONEYCLEAN Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 24
- 25. STORED-VALUE CARDS ļ¶ Prepaidcredit cards ļ¶ Merchant gift cards Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 25
- 26. SAFE HAVENS ļ¶ Onlinegambling sites ļ¶ Offshore financial services Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 26
- 27. ONLINE AUCTIONS ļ¶ Moneylaundering via product purchase (ę“åƶ) Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 27
- 28. SMURFING Copyright Ā© 2010Albert Hui (CC) BY-NC-SA 28 $ $ $ $ $ $ $ $ $ $ $ $ $ $ $$
- 29. MONEY MULE Copyright Ā©2010 Albert Hui (CC) BY-NC-SA 29
- 30. BUSINESS ETHICS OF THEUNDERWORLD
- 31. SHAVING ļ¶ Many PPIsare accused of shaving Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 31
- 32. PHISHING Copyright Ā© 2010Albert Hui (CC) BY-NC-SA 32
- 33. LOOK BEHIND YOURBACK Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 33
- 34. LOOK BEHIND YOURBACK Copyright Ā© 2010 Albert Hui (CC) BY-NC-SA 34
- 35. THANK YOU! albert.hui@gmail.com Copyright Ā©2010 Albert Hui (CC) BY-NC-SA 35
Editor's Notes
- #7Ā āWe didnāt just get the command and control servers; with Mariposa we got the guys behind it. The problem is that we can take down the botnet but the criminals are still out there and can start a new botnet ā that happens most of the times.ā said Luis Corrons, technical director at PandaLabs.
- #11Ā Only the hackers who perform break-ins and thefts, and the financial operators are clearly criminal.
- #17Ā Drive-by downloads
- #25Ā Investopedia Dictionary defines money laundering as āthe process of creating the appearance that large amounts of money obtained from serious crimes, such as drug trafficking or terrorist activity, originated from a legitimate source.ā According to the International Monetary Fund (IMF), money laundering transactions are almost beyond imagination ā 2 percent to 5 percent of global Gross Domestic Product. Necessary element of any criminal activity undertaken for profit. placement -> layering -> integration
- #29Ā Smurfing, a subset of structuring, the practice of executing financial transactions in a specific pattern calculated to avoid the creation of certain records and reports required by law (Bank Secrecy Act (BSA)).
- #30Ā Nigeria scam? Sometimes you actually do receive the money.