BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets...
Transcript of BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets...
![Page 1: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/1.jpg)
BOLETO +30 years old Brazilian popular payment system
21% of all payments in the country in 2011
18% of all online sales in 2012
Simple: just print and pay
![Page 2: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/2.jpg)
![Page 3: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/3.jpg)
P0wned by a Barcode stealing money from offline users
the untold story, killing the FUDs
Fabio Assolini
Kaspersky Lab, #VB2014
![Page 4: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/4.jpg)
Video
![Page 5: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/5.jpg)
Barcode
Value to pay
Due Date
Customer data
Issuer Bank 44 digit ID field
![Page 6: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/6.jpg)
P0wned by a barcode
Boleto Bancario simply referred as Boleto It is issued by stores, online retailers, government, banks and all kind of businesses, can be paid in any bank.
It’s the preferred way to pay bills and buy goods, used by people that don’t have a credit card or an internet banking account. It’s so popular that
FIFA sold World Cup tickets through them.
A Boleto can be paid at ATMs, branch facilities and internet banking of any Bank, Post Office, Lottery Agent and some supermarkets until its due date. After due date it can only be paid at the issuer bank facilities.
![Page 7: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/7.jpg)
P0wned by a barcode
![Page 8: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/8.jpg)
P0wned by a barcode
![Page 9: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/9.jpg)
Real ID number
Other ID number inserted by the
malware
Real Barcode
Other barcode inserted by the
malware
![Page 10: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/10.jpg)
The malware
It’s like SpyEye: webinjects in the browser session
![Page 11: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/11.jpg)
The C&C
Request: http://141.105.65.5/111111111%201111.1111%20111.111111%201%2011 Response: 03399.62086 86000.000009 00008.601049 7 00000000000000
![Page 12: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/12.jpg)
The Control Panel
This is what you’ve heard from the RSA history, but there is more, much more…
![Page 13: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/13.jpg)
The migration
Most of the Brazilian criminals who use
Trojan bankers to steal money are migrating
their attacks to target boletos, using the
same infrastructure. It’s more protifable.
Cheap Crimeware kits available on
Facebook, costing only $250.00
They are fast adopting new techniques.
Forget about that old and big Delphi trojan
bankers - they evolved.
![Page 14: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/14.jpg)
The migration
Most of the Brazilian criminals who use
Trojan bankers to steal money are migrating
their attacks to target boletos, using the
same infrastructure. It’s more protifable.
Cheap Crimeware kits available on
Facebook, costing only $250.00
They are fast adopting new techniques.
Forget about that old and big Delphi trojan
bankers - they evolved.
![Page 15: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/15.jpg)
Brazilians and Eastern European, the cooperation
![Page 16: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/16.jpg)
Brazilians and Eastern European, the cooperation
![Page 17: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/17.jpg)
Brazilians and Eastern European, the cooperation
![Page 18: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/18.jpg)
Brazilians and Eastern European, the cooperation
![Page 19: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/19.jpg)
Brazilians and Eastern European, the cooperation
![Page 20: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/20.jpg)
Brazilians and Eastern European, the cooperation
Working with ZeuS GameOver gangs to create encrypted payloads XORed with a
32-bit key and compressed by ZLIB, using the extensions .JMP, .BCK, .ENC…
![Page 21: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/21.jpg)
SSL MitM using Fiddler
The new versions are able to MitM SSL connections. HTTPS can’t save you
![Page 22: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/22.jpg)
Targeting Network Devices
Attacking DLS modems remotely, changing DNS servers, since 2012.
Not massive but still used.
![Page 23: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/23.jpg)
Targeting Network Devices
A serie of attacks, doing DNS
poisoning on big ISPs (~12
million customers)
Redirecting users to fake
banking pages that generate
boletos
Changing boletos when
generated at online stores
![Page 24: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/24.jpg)
Targeting Network Devices
Massive web-based attack on home routers using malvertising
techniques, changing DNS settings and redirecting to fake boletos
![Page 25: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/25.jpg)
Targeting Network Devices
Massive web-based attack on home routers using malvertising
techniques, changing DNS settings and redirecting to fake boletos
![Page 26: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/26.jpg)
Targeting Network Devices
Massive web-based attack on home routers using malvertising
techniques, changing DNS settings and redirecting to fake boletos
![Page 27: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/27.jpg)
Fake websites, sponsored links, malicious extensions
![Page 28: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/28.jpg)
Fake websites, sponsored links, malicious extensions
Trojan-Banker.Win32.ClearWind.a activate the Developer mode and install any extension
Firefox is a target as well!
![Page 29: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/29.jpg)
Fake websites, sponsored links, malicious extensions
![Page 30: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/30.jpg)
Fake websites, sponsored links, malicious extensions
![Page 31: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/31.jpg)
How much money was stolen? How many victims?
U$ 3.75 billion
R$ 8.6 billion
![Page 32: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/32.jpg)
How much money was stolen?
U$ 6.6 billion annual profit
Half of the money from a
big bank was stolen?
![Page 33: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/33.jpg)
How much money was stolen?
![Page 34: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/34.jpg)
How much money was stolen?
Control panel displaying repeated and testing entries
![Page 35: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/35.jpg)
Protection
Boletos in PDF mode
![Page 36: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/36.jpg)
Protection
Kaspersky Safe Money
![Page 37: BOLETO - Virus Bulletin · Boleto It is issued by stores, ... Lottery Agent and some supermarkets until its due date. ... Virus Bulletin 2014 More details at Securelist.com .](https://reader031.fdocuments.net/reader031/viewer/2022021803/5b87d82a7f8b9a46538c6b2a/html5/thumbnails/37.jpg)
Questions Thanks
Follow me at @Assolini
Virus Bulletin 2014
More details at Securelist.com