The Underground Economy and Ecosystem of SMS Based Cybercrime Denis - PowerPoint PPT Presentation
The Underground Economy and Ecosystem of SMS Based Cybercrime Denis Maslennikov, Senior Malware Analyst, Kaspersky Lab 15.06.2011, 23 rd Annual FIRST Conference, Vienna, Austria Agenda SMS based threats Ransomware SMS Trojans The
The Underground Economy and Ecosystem of SMS Based Cybercrime Denis Maslennikov, Senior Malware Analyst, Kaspersky Lab 15.06.2011, 23 rd Annual FIRST Conference, Vienna, Austria
Agenda SMS based threats • Ransomware • SMS Trojans The ecosystem Underground economy Threats round the globe What should we do? 23 rd Annual FIRST Conference PAGE 2 | | June 15, 2011
Lottery 23 rd Annual FIRST Conference PAGE 3 | | June 15, 2011
How much have users lost? 23 rd Annual FIRST Conference PAGE 4 | | June 15, 2011
Ransomware
Ransomware In a nutshell 23 rd Annual FIRST Conference PAGE 6 | | June 15, 2011
Ransomware In a nutshell 23 rd Annual FIRST Conference PAGE 7 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 8 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 9 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 10 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 11 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 12 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 13 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 14 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 15 | | June 15, 2011
Psychological tricks Legal prosecution threats Data corruption threats Malware infection (!) threats Annoying pop-ups 23 rd Annual FIRST Conference PAGE 16 | | June 15, 2011
What do they want? 23 rd Annual FIRST Conference PAGE 17 | | June 15, 2011
Deblocker 23 rd Annual FIRST Conference PAGE 18 | | June 15, 2011
Deblocker 23 rd Annual FIRST Conference PAGE 19 | | June 15, 2011
Deblocker service statistics Launch: January 2010 Current state: • More than 5,100,000 unique visitors • More than 19,500,000 requests • ~60,000 unique visitors per day • ~230,000 requests per day Source: Kaspersky Lab 23 rd Annual FIRST Conference PAGE 20 | | June 15, 2011
SMS Trojans
SMS Trojans In a nutshell 23 rd Annual FIRST Conference PAGE 22 | | June 15, 2011
Statistics Number of modifications per year 345 336 350 300 250 212 200 150 116 100 50 11 3 0 2006 2007 2008 2009 2010 2011 Source: Kaspersky Lab 23 rd Annual FIRST Conference PAGE 23 | | June 15, 2011
Statistics Platform distribution 8% 3% 5% Symbian Windows Mobile Android J2ME 84% Source: Kaspersky Lab 23 rd Annual FIRST Conference PAGE 24 | | June 15, 2011
Primitive: Trojan-SMS.J2ME.Konov One of the first widespread SMS Trojans: • Small (1,5 – 8 kB) • No encryption • No social engineering tricks 23 rd Annual FIRST Conference PAGE 25 | | June 15, 2011
Advanced: Trojan-SMS.J2ME.VScreener ‘Faulty’ video player Must be ‘tuned’ by user • Quick left soft key pressing SMS are sent during ‘tuning’ Premium rate number and SMS text are stored in ‘ load.bin ’ file File ‘ load.bin ’ is encoded with ADD and ‘0xA’ key 23 rd Annual FIRST Conference PAGE 26 | | June 15, 2011
‘Video player’ Again 23 rd Annual FIRST Conference PAGE 27 | | June 15, 2011
‘Video player’ Again 23 rd Annual FIRST Conference PAGE 28 | | June 15, 2011
SEO and mobile malware 23 rd Annual FIRST Conference PAGE 29 | | June 15, 2011
SEO and mobile malware Blonde porn download 23 rd Annual FIRST Conference PAGE 30 | | June 15, 2011
The ecosystem The root of all evil
Trojan-SMS.J2ME.Konov 23 rd Annual FIRST Conference PAGE 32 | | June 15, 2011
Trojan-SMS.J2ME.Konov $10 or $6 per SMS Mobile operator 23 rd Annual FIRST Conference PAGE 33 | | June 15, 2011
Trojan-SMS.J2ME.Konov Mobile 4460 Content operator 5537 provider 23 rd Annual FIRST Conference PAGE 34 | | June 15, 2011
Trojan-SMS.J2ME.Konov Mobile 4460 Content operator 5537 provider 23 rd Annual FIRST Conference PAGE 35 | | June 15, 2011
Trojan-SMS.J2ME.Konov ‘ epbox 1290’ on Subtenant with ID 1290 4460 & 5537 ‘ epbox ’ ‘ epbox ’ on 4460 renter & 5537 Mobile 4460 Content operator 5537 provider 23 rd Annual FIRST Conference PAGE 36 | | June 15, 2011
Who are ‘ epbox ’ and ‘ epbox 1290’ ‘ epbox ’ renter ‘ epbox 1290’ subtenant 23 rd Annual FIRST Conference PAGE 37 | | June 15, 2011
Who are ‘ epbox ’ and ‘ epbox 1290’ ‘ epbox ’ Affiliate network renter owner(s) Affiliate A ‘ epbox 1290’ subtenant 23 rd Annual FIRST Conference PAGE 38 | | June 15, 2011
Who are ‘ epbox ’ and ‘ epbox 1290’ ‘ epbox ’ Affiliate network renter owner(s) Affiliate A Affiliate B Affiliate C ‘ epbox 1290’ ‘ epbox M’ ‘ epbox N’ subtenant subtenant subtenant 23 rd Annual FIRST Conference PAGE 39 | | June 15, 2011
The root of all evil Affiliate network registration form 23 rd Annual FIRST Conference PAGE 40 | | June 15, 2011
The root of all evil Affiliate network registration form Name Email Website URL Website name WMZ and WMR ICQ (optional) 23 rd Annual FIRST Conference PAGE 41 | | June 15, 2011
The root of all evil Affiliate network registration form No sensitive data! Name Email Website URL Affiliate ID ‘ epbox 1290’ Website name WMZ and WMR ICQ (optional) 23 rd Annual FIRST Conference PAGE 42 | | June 15, 2011
Typical affiliate website 23 rd Annual FIRST Conference PAGE 43 | | June 15, 2011
Typical affiliate website 23 rd Annual FIRST Conference PAGE 44 | | June 15, 2011
Typical affiliate website Referrer check Remote server Affiliate ID 23 rd Annual FIRST Conference PAGE 45 | | June 15, 2011
Typical affiliate website Referrer check Remote server Affiliate ID JAR constructor SMS Trojan with affiliate ID 23 rd Annual FIRST Conference PAGE 46 | | June 15, 2011
Typical affiliate website Referrer check Remote server Affiliate ID JAR constructor SMS Trojan with affiliate ID Thousands of websites! 23 rd Annual FIRST Conference PAGE 47 | | June 15, 2011
Ransomware Same situation 23 rd Annual FIRST Conference PAGE 48 | | June 15, 2011
Ransomware Same situation 23 rd Annual FIRST Conference PAGE 49 | | June 15, 2011
Underground economy …and lottery results :)
Underground economy Revenue sharing The Infected affiliate Affiliate phone/PC owner(s) Mobile Content operator provider 23 rd Annual FIRST Conference PAGE 51 | | June 15, 2011
Underground economy Revenue sharing The Infected affiliate Affiliate phone/PC owner(s) SMS 31-50% of SMS price Mobile Content operator provider 23 rd Annual FIRST Conference PAGE 52 | | June 15, 2011
Underground economy Revenue sharing The Infected affiliate Affiliate phone/PC owner(s) 1-5% of SMS SMS price 31-50% of SMS price Mobile Content operator provider 23 rd Annual FIRST Conference PAGE 53 | | June 15, 2011
Underground economy Revenue sharing 1-5% of SMS price The Infected affiliate Affiliate phone/PC owner(s) 1-5% of SMS 40-67% of SMS price SMS price 31-50% of SMS price Mobile Content operator provider 23 rd Annual FIRST Conference PAGE 54 | | June 15, 2011
$$$ 23 rd Annual FIRST Conference PAGE 55 | | June 15, 2011
$$$ ‘…10 people were arrested…’ ‘…malware which blocks PC…’ 23 rd Annual FIRST Conference PAGE 56 | | June 15, 2011
$$$ ‘…10 people ‘…half a year…’ were arrested…’ ‘…malware ‘…SMS as which blocks ransom…’ PC…’ 23 rd Annual FIRST Conference PAGE 57 | | June 15, 2011
$$$ ‘…10 people ‘…half a year…’ were arrested…’ ‘…1 billion rubles…’ ‘…malware ‘…SMS as which blocks ransom…’ PC…’ 23 rd Annual FIRST Conference PAGE 58 | | June 15, 2011
Calculations 1,000,000,000 rubles ~ $30,000,000 $30,000,000/6 ~ $5,000,000 per month 23 rd Annual FIRST Conference PAGE 59 | | June 15, 2011
‘Death penalty’ Largest mobile affiliate network was fined: The fine was equal to 25% of the affiliate network weekly income: • 1,590,000 rubles ~ $53,000 • Weekly income ~ $212,000 • Monthly income ~ $850,000 People were losing at least $1,200,000 per month 23 rd Annual FIRST Conference PAGE 60 | | June 15, 2011
Final score $6,200,000 per month 23 rd Annual FIRST Conference PAGE 61 | | June 15, 2011
Threats round the globe
Ransomware 23 rd Annual FIRST Conference PAGE 63 | | June 15, 2011
Ransomware 23 rd Annual FIRST Conference PAGE 64 | | June 15, 2011
Ransomware 23 rd Annual FIRST Conference PAGE 65 | | June 15, 2011
A long time ago… 23 rd Annual FIRST Conference PAGE 66 | | June 15, 2011
Porn SMS senders ‘ Nooit spijt ’ case 23 rd Annual FIRST Conference PAGE 67 | | June 15, 2011
Porn SMS senders ‘ Nooit spijt ’ case 23 rd Annual FIRST Conference PAGE 68 | | June 15, 2011
‘Dating’ apps If you are from UK 23 rd Annual FIRST Conference PAGE 69 | | June 15, 2011
Recommend
More recommend
Explore More Topics
Stay informed with curated content and fresh updates.
Sambuz