SLIDE 1
DIALING BACK PHONE VERIFIED ACCOUNT ABUSE
Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks), Damon McCoy (GMU)
Security & Abuse Research
DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro - - PowerPoint PPT Presentation
DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro - - PowerPoint PPT Presentation
DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks), Damon McCoy (GMU) Keys to the kingdom Security & Abuse Research Blackmarket for bulk accounts Security
SLIDE 2
SLIDE 3
Security & Abuse Research
Blackmarket for bulk accounts
SLIDE 4
Security & Abuse Research
Existing protections
CAPTCHAs Email verification IP reputation Phone verification
SLIDE 5
Security & Abuse Research
OCR: 50% accuracy, $30/mo Human solver: >95% accuracy, $0.70 per 1K Mail.ru: $5 per 1K accounts Yahoo: $8 per 1K accounts Proxies: 15K - 30K IPs for $250/mo
?
Existing protections
CAPTCHAs Email verification IP reputation Phone verification
SLIDE 6
Security & Abuse Research
Phone verified accounts (PVA) 10-100x more expensive
SLIDE 7
Security & Abuse Research
Yet we see a steady stream of abusive PVA
SLIDE 8
Security & Abuse Research
Deep dive into phone verified abuse
Marketplace for accounts Origin of phone numbers Registration techniques
Strengthen resource bottleneck for cheap phones
Our work
SLIDE 9
Security & Abuse Research
1 ACCOUNT BLACKMARKET
SLIDE 10
Security & Abuse Research
Advertisements for accounts
Forums Freelance Listings Web storefronts
SLIDE 11
Security & Abuse Research
Identify 14 merchants, track public pricing Purchase 2,217 Google PVA from 7 merchants Price: $85-500 Authenticity: 100% working PVA Delivery rate: 24-48 hours Disabled in 1 month: 68%
Blackmarket as an oracle
SLIDE 12
Security & Abuse Research
Prices range $85-500
Price per 1K accounts, multiple merchants
$600 $450 $300 $150 $0
SLIDE 13
Security & Abuse Research
Price reflects quality
Original value of accounts Value lost to disabling
$600 $450 $300 $150 $0
SLIDE 14
Security & Abuse Research
Pricing trends over 8 months
Does price reflect failure in defenses?
Price per 1K accounts 30-40% drop in price of Google PVA Prices over $150 remain stable
$150 $125 $100 $85 $50
SLIDE 15
Security & Abuse Research
PHONE ORIGIN 2
SLIDE 16
Security & Abuse Research
Datasets
Google PVA, disabled for abuse: 300,000 Purchases reveal sample is representative For each account: Associated carrier, country information Geolocation of signup IP CAPTCHA solution attempts
SLIDE 17
Security & Abuse Research
Phone country of origin
Top origins United States India Indonesia Nigeria South Africa Bangladesh 27% 22% 12% 4% 4% 4%
60% 40% 20% 0% Weekly % of abusive PVA
SLIDE 18
Security & Abuse Research
VOIP largest abuse source
24% of PVA verified over VOIP Includes: Google Voice Pinger TextPlus Enflick GoTextMe Bandwidth.com PT Bharti Vodafone MTN Idea Telekomunikasi Aircel … Level 3 Cell Telengy Carrier US ID IN IN NG IN ID IN … US ZA US 19.9% 7.3% 5.3% 4.0% 3.0% 2.8% 2.2% 2.1% … 0.86% 0.84% 0.81% Country Popularity Rank 1 2 3 4 5 6 7 8 … 18 19 20
SLIDE 19
SLIDE 20
Security & Abuse Research
Phone for price of a CAPTCHA
Not Verified
SLIDE 21
Security & Abuse Research
Strategy in practice [now defunct]
New phone per CAPTCHA Free SMS Service
SLIDE 22
Security & Abuse Research
Strategy in practice [now defunct]
Claim 5 forwarding numbers New phone per CAPTCHA Free SMS Service Google Voice
SLIDE 23
Security & Abuse Research
Strategy in practice [now defunct]
Claim 5 forwarding numbers Register 5 accounts per phone number New phone per CAPTCHA Free SMS Service Google Voice Google Account
25 accounts per CAPTCHA 60-80% of all disabled PVA between Oct-Jan
SLIDE 24
Security & Abuse Research
Where do non-VOIP phones originate?
Same locations as human CAPTCHA farms. Socio-economic disparity creates an abuse vector.
SLIDE 25
$140–420 per 1K SIMs
SLIDE 26
$140–420 per 1K SIMs
SLIDE 27
Buyers bid on SMS endpoints: ~$0.20/SMS Sellers list phone numbers, respond with code.
SLIDE 28
Security & Abuse Research
REGISTRATION STRATEGIES 3
SLIDE 29
Security & Abuse Research
How do older protections perform?
CAPTCHAs Email verification IP reputation Phone verification
SLIDE 30
Security & Abuse Research
56% of registrations shown a CAPTCHA Correctly solved 96% of the time Indicative of human solvers
CAPTCHA breaking
SLIDE 31
Security & Abuse Research
Minimizing IP re-use
Restrict IP re-use over all time to < 20 accounts
SLIDE 32
Security & Abuse Research
Frequent phone re-use
< 30% of phone numbers unique
Can re-use phone numbers multiple times
SLIDE 33
Security & Abuse Research
Access to number is short lived
Lifetime < 1hr compared to 1mo for benign
SLIDE 34
Security & Abuse Research
DIALING BACK ABUSE 4
SLIDE 35
Security & Abuse Research
Frequently abused carriers
Over 1,000 abused carriers Top 10 carriers contribute 50% of abusive PVA
SLIDE 36
Security & Abuse Research
Carrier reputation
Bandwidth.com PT Bharti Vodafone MTN Idea Telekomunikasi Aircel Carrier US ID IN IN NG IN ID IN 41% 91% 98% 98% 97% 98% 99% 98% Country % Good Rank 1 2 3 4 5 6 7 8
Most VOIP registrations abusive All other carriers serve predominantly good users
SLIDE 37
Security & Abuse Research
Pushing back on abusive carriers
In January, we took action on carrier abuse:
Blocked VOIP numbers acquired with CAPTCHA Restricted all other known VOIP numbers to single use Restricted some Indian, Indonesian telcos to single use
SLIDE 38
Security & Abuse Research
Impact on pricing
Price returns back to pre-VOIP levels Price per 1K accounts
SLIDE 39
Security & Abuse Research
How did merchants react?
In April, purchase a new set of 2,478 PVA
Only 12% were Bandwidth.com, compared to 80% before Some previously unseen VOIP services Merchants hit max registration limit
Need finer grain phone reputation signals
SLIDE 40
Security & Abuse Research
Summary
Thriving account black market Use purchasing as an oracle into criminal capabilities Use pricing as an early warning of failing defenses Phone verification requires reputation support
SLIDE 41
THANKS!
kurtthomas@google.com