From Russia with love.exe Pt. 2 Underground Hacking Forums from Former East Bloc
Wednesday, July 7, 2010
Shhpeakers.. :)
Wednesday, July 7, 2010
FY & grugq Two lingual experts well known for their skillful tongues, the grugq and fyodor have spent 6 months actively monitoring dozens of russian web forums to uncover the secrets of the russian hacker culture. This talk focuses on new threats and trends which are discussed in the open on these sites,but are generally inaccessible to the larger security community due to the language barrier. Ladies! Ask about our private demonstrations! :D
Wednesday, July 7, 2010
Outline • Hax0r Revolution Intro • Intelligence: Digging in a pile of trash • Personalities, Lingo, Monetization • Technology behind: Tools of trade • Future Plans Wednesday, July 7, 2010
Hax0r Revolution
Wednesday, July 7, 2010
Hax0r Revolution • 100% money-driven • Prerequisites: • Imbalance of Economic system • Globalization of payment systems • Accessibility • Laws, Languages, Cold War, ... Wednesday, July 7, 2010
Revolutionist targets
• Average PC users (your mom and dad) • Rarely - corporations
Wednesday, July 7, 2010
You being 0wn3d • Exploiting vulnerabilities in Client software (mostly browsers, browser’s add-ons, browser’s plugins, ..)
• Social engineering (computer users are
dumb) -> “fake av software”, .pdf.exe things and other old tricks
Wednesday, July 7, 2010
Peeking behind the scene • Looking at the market • Items and patterns of trade • Personalities • Quantified analysis
Wednesday, July 7, 2010
Digging in a pile of trash
Wednesday, July 7, 2010
Forums
Wednesday, July 7, 2010
Need for Automation • Massive amounts of content • Over 10 top level domains
Multiple sub forums
Wednesday, July 7, 2010
Manually • Natural language • Too complicated for automated processing • Misspellings, multiple spellings • Unformatted postings
Wednesday, July 7, 2010
Amusing Discoveries
Wednesday, July 7, 2010
Personalities
Wednesday, July 7, 2010
Wednesday, July 7, 2010
Geeks, not Gangsters
Wednesday, July 7, 2010
Gangsters
Wednesday, July 7, 2010
Wednesday, July 7, 2010
Wednesday, July 7, 2010
Extremely Nonprofessional Criminals
Wednesday, July 7, 2010
Geeks
Wednesday, July 7, 2010
Lingo
Wednesday, July 7, 2010
What does this say?
Wednesday, July 7, 2010
Can Google help?
Wednesday, July 7, 2010
Good luck with that.
Wednesday, July 7, 2010
Just FYI
Wednesday, July 7, 2010
Hacker Slang • Fenya - Russian prison slang • Anglonims - English loan words • Rhyming slang - Sounds like the English word • Direct translation
Wednesday, July 7, 2010
Scams & Schemes
Wednesday, July 7, 2010
Wheres money? • Extortion • Job recruitment (Partnerkas, Drops, SMS regs, ..)
• Services • Goods Wednesday, July 7, 2010
Extortion
• Malware that demands payment • Fake windows “warning”
Wednesday, July 7, 2010
Extortion
Wednesday, July 7, 2010
Partnerka
Wednesday, July 7, 2010
Partnerka • Credit card payment gateways • Visa / Mastercard regulation compliant • PCI compliant • Partnerships with webmasters and other scum
• Percentage payouts for purchases Wednesday, July 7, 2010
Wednesday, July 7, 2010
Partnerka Payouts
Wednesday, July 7, 2010
SMS scams :)
Wednesday, July 7, 2010
Cash Out
Wednesday, July 7, 2010
Wednesday, July 7, 2010
“Дроп”
•
-> STORE -> DROP (share) ->
Wednesday, July 7, 2010
Virtual Currencies • Online payment systems for service transactions
• Web Money • Yandex Money • eGold [dead] Wednesday, July 7, 2010
Conversion Gateway
Wednesday, July 7, 2010
Web Money offices
Wednesday, July 7, 2010
Goods
Wednesday, July 7, 2010
Skype
Wednesday, July 7, 2010
iTunes cards
Wednesday, July 7, 2010
Loaders, ExploitKits, ...
Wednesday, July 7, 2010
Passports
Wednesday, July 7, 2010
CCs
Wednesday, July 7, 2010
Equipment
Wednesday, July 7, 2010
[websites go here]
Wednesday, July 7, 2010
Identity Services
Wednesday, July 7, 2010
Complete Package Под средства любой загрязненности! В комплект входит: 1.Банковский акк(online доступ) 2.АТМ картa(Дневной лимит на снятие средств 1000$/6000$ В МЕСЯЦ-Возможно увеличение лимита +30$-) 3.Карта кодов (для online доступа) 4.Копия паспорта дропа 5.Sim-ka
Wednesday, July 7, 2010
Wednesday, July 7, 2010
How long does it take to find a usable CC?
Wednesday, July 7, 2010
5 seconds
Wednesday, July 7, 2010
first link...
Wednesday, July 7, 2010
and washing service..
Wednesday, July 7, 2010
Traffic Generation
•Best Prices •Fast Stream •Best “Conversion”/Infection Ratio
Wednesday, July 7, 2010
Infection: rates and nums
Wednesday, July 7, 2010
how much to take down twitter?
Wednesday, July 7, 2010
Avg. US$80 per diem
Wednesday, July 7, 2010
Question
Wednesday, July 7, 2010
why was twitter down?
Wednesday, July 7, 2010
cuxumu
Wednesday, July 7, 2010
Technology: Tools of Trade Overview & demos
Wednesday, July 7, 2010
Intelligence Gathering • Automated and manual analysis of publicly available data
Wednesday, July 7, 2010
Tools of trade
• Mostly open-source. With custom extensions
Wednesday, July 7, 2010
Tools: Nutch • Content Fetcher; extended with custom Indexers
• Changes to Spider behavior (“proper” robots.txt handling etc)
• Custom “Seeders” • Distributed Indexing (w/ hadoop) Wednesday, July 7, 2010
Tools: RSS feeds “eater”
• A bunch of python scripts thrown together to fetch rss feeds
Wednesday, July 7, 2010
Google App Engine
• Public Interface with transforms, dictionaries and other misc. Stuff.
Wednesday, July 7, 2010
Tools: SOLR • Customized Data indexing and search • Custom schema and search fields • JSON output used • Language “projection” (lingo/slang support)
Wednesday, July 7, 2010
Tools: Web UI/Maltego
• Web UI: easier • Visualization: Maltego Custom Transforms
Wednesday, July 7, 2010
Overall picturesque
Wednesday, July 7, 2010
Maltego
Wednesday, July 7, 2010
Lets look at some %^@%#
Wednesday, July 7, 2010
Future Plans
Wednesday, July 7, 2010
Future Integration • Maltego and other viz. tools • Online Engine Availability • Scale more, dig more ;-) • Feed “eaters” (BBSes hear me?;)) • MultiLang: Spanish/Italian/Portuguese Wednesday, July 7, 2010
Availability • http://www.o0o.nu/projects/intelligencecollection - tools, slides, howto’s etc
• http://383rat.appspot.com - transforms on GAE, indexes, dictionaries etc
Wednesday, July 7, 2010
Feedback And Questions (
[email protected] or
[email protected])
Wednesday, July 7, 2010
