The underground economy 3.0

2

THE UNDERGROUND ECONOMY 3.0THE NEVERENDING STORY

EDDY WILLEMSSECURITY EVANGELIST DIRECTOR EICAR – AMTSO - LSEC

Over 400.000 new malware samples each day Over 400.000.000 malware ... Invisible: Money Gain => Cybercrime!

THE PROBLEM

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 3

WHAT CYBERCRIMINALS REALLY WANT?


‘THE TOOL’ OF A CYBERCRIMINAL: BOTNETS


BOTNET, EVERYTHING WHAT THE CRIMINAL WANT

High Internet Bandwidth- Spam and Phishing- DDoS attacks- The Cloud misuse

Specific money targets (in the cloud)- Emails- Bankaccounts, Paypal, accounts with low authentication

Other money targets (on disk)- Steam accounts- Bitcoin wallets


HOW DO WE GET INFECTED: THE SECOND LAW (OF WILLEMS)

CBP = TF x HFCBP = Cybersecurity Problem

TF = Technological Factor (malware, mal.links, exploits, etc)HF = Human Factor (fear, curious, naive, money gain, etc)


PRIVATE DATA: DRIVING FACTOR OF CYBERCRIME!

Email address- Spam- Phishing- Infections

Email accounts- Fraude and misuse contacts- ID Theft- Access to other accounts (Social Media, e-commerce…)

Bank data- Illegal purchases- Online banking fraude

Targeted attacks- Every data can be (mis)used and is interesting to sell: docs(word,xls,ppt,pdf), pics, etc …


9

ESSENTIAL PLATFORM FOR CYBERCRIME

BLACKMARKET

WHY A BLACKMARKET ?

Know your enemy- Technical Trends- Marketing possibilities- New exploit codes

Information gathering- About detection- Learn about the seller or designer

Measuring the level of threat- Growth of codes- Changes in supply and prices


BLACKMARKET SYSTEM (BUYING AND/OR SELLING)

Botnet Eco-System

Services:Spam, Phishing,Botnet, Ransom, Spyware, DDoS…

Products:Exploits, Tools,(private) Data,Weapons, Drugs,Illegal ID’s …


SPECIALISED BLACK MARKETS

To do a proper attack a cybercriminal needs - Knowledge- Data - Tools

Most of them only knows parts of it Everything can be found in the underground forum

and markets if you look carefully


SOME PLACES IN THE UNDERGROUND

SilkRoad Reloaded DeepBay Pandora Agora And several WebShop…


WITH DIFFERENT RIGHTS AND PERMISSIONS

Available at Deep Web Access via TOR or I2P Some stuff is free

- Webshops- Large variety

Other stuff isn’t free- Depending on your reputation- A new buyer has to prove himself- All over encrypted email/boards


PRICING THE TOOLS: PARTS OF MALWARE FOR THE EXPERTS

RAT : Control the System

Stealer : Information gathering and copy

Crypter : tool to encrypt documents, etc automatically

Bot : Total package including several options


PRICING SERVICES: YOU DON’T NEED TO BE AN EXPERT!

Installation of malware on 1000 machines

Camouflage technique to avoid detection with Antivirus

DDoS : attack per hour/day/week


17G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015

MARKETING !!! INFOGRAPHICS

18

EVERYTHING FOR EVERY PRICE

SALES ON THE BLACKMARKET

THE PRICE OF (YOUR) PRIVATE DATA ON THE BLACKMARKET

70 $ Complete ID 50 $

Bank Account

0,000075 $

Email Address

0,0005 $

Email account

50 $

Paypal account

50 $

Credit Card


BUYING/SELLING ON THE BLACKMARKET

E-commerce Credit cards



E-commerce Paypal accounts



E-commerce Illegal documents and ID’s



E-commerce Weapons



E-commerce Drugs


FROM VIRTUAL TO REAL MONEYINJECTING THE MONEY IN THE REAL WORLDMONEY LAUNDERING


TRANSFORMING FROM VIRTUAL TO REAL MONEY

MONEY MULES:- Transferring money from one account to

another and get a fee (eg. 5% )- Let others use your account to transfer

money and earn money USE PROXY MONEY MULES



HOUSE DROPS – DROP ZONES



Credit card accounts can be credited with virtual money: withdraw money


VIRTUAL MONEY: THE NEW WAY

Over 100 virtual money ‘coins’ Used in several ways

- Depending on the marketplace - Depending on the country

Transactions can easily be done Anonymisation of the bank account holder

Virtual money is ideal to start with in these parallel worlds and market places



Distribution Network of ATM Bitcoin machines



Online gambling industry not really worried


32

HUMAN AWARENESS IS THE FIRST IMPORTANT SECURITY MEASURESECURITY PACKAGES AT EVERY OS/SYSTEM, UPDATES, BACKUPS, ETC…

TOOLS AGAINST CYBERCRIMINALS

I WAS NOT EXAGERATING ABOUT THE CARS… SOME EXAMPLES


SOMETIMES …

Original Silk Road Owner : Ross Ulbricht sentenced to life in 2015 (earned 187 Million dollars)


MOST USEFUL TOOL: ARRESTMENTS ARE SUCCESFUL

THANK YOU!QUESTIONS?

TWITTER: @EDDYWILLEMS


Technology

The underground economy 3.0