DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE...
Transcript of DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE...
![Page 1: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/1.jpg)
DIALING BACK PHONE VERIFIED ACCOUNT ABUSEKurt Thomas, Dmytro Iatskiv, Elie Bursztein,
Tadek Pietraszek, Chris Grier (Databricks), Damon McCoy (GMU)
![Page 2: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/2.jpg)
Security & Abuse Research
Keys to the kingdom
![Page 3: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/3.jpg)
Security & Abuse Research
Blackmarket for bulk accounts
![Page 4: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/4.jpg)
Security & Abuse Research
Existing protections
CAPTCHAs
Email verification
IP reputation
Phone verification
![Page 5: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/5.jpg)
Security & Abuse Research
OCR: 50% accuracy, $30/mo
Human solver: >95% accuracy, $0.70 per 1K
Mail.ru: $5 per 1K accounts
Yahoo: $8 per 1K accounts
Proxies: 15K - 30K IPs for $250/mo
?
Existing protections
CAPTCHAs
Email verification
IP reputation
Phone verification
![Page 6: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/6.jpg)
Security & Abuse Research
Phone verified accounts (PVA) 10-100x more expensive
![Page 7: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/7.jpg)
Security & Abuse Research
Yet we see a steady stream of abusive PVA
![Page 8: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/8.jpg)
Security & Abuse Research
Deep dive into phone verified abuse
Marketplace for accounts
Origin of phone numbers
Registration techniques
Strengthen resource bottleneck for cheap phones
Our work
![Page 9: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/9.jpg)
Security & Abuse Research
1 ACCOUNT BLACKMARKET
![Page 10: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/10.jpg)
Security & Abuse Research
Advertisements for accounts
Forums Freelance ListingsWeb storefronts
![Page 11: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/11.jpg)
Security & Abuse Research
Identify 14 merchants, track public pricing
Purchase 2,217 Google PVA from 7 merchants
Price: $85-500Authenticity: 100% working PVADelivery rate: 24-48 hoursDisabled in 1 month: 68%
Blackmarket as an oracle
![Page 12: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/12.jpg)
Security & Abuse Research
Prices range $85-500
Price per 1K accounts, multiple merchants
$600
$450
$300
$150
$0
![Page 13: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/13.jpg)
Security & Abuse Research
Price reflects quality
Original value of accountsValue lost to disabling
$600
$450
$300
$150
$0
![Page 14: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/14.jpg)
Security & Abuse Research
Pricing trends over 8 months
Does price reflect failure in defenses?
Pric
e pe
r 1K
acc
ount
s
30-40% drop in price of Google PVA
Prices over $150 remain stable$150
$125
$100
$85
$50
![Page 15: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/15.jpg)
Security & Abuse Research
PHONE ORIGIN2
![Page 16: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/16.jpg)
Security & Abuse Research
Datasets
Google PVA, disabled for abuse: 300,000
Purchases reveal sample is representative
For each account:
Associated carrier, country informationGeolocation of signup IPCAPTCHA solution attempts
![Page 17: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/17.jpg)
Security & Abuse Research
Phone country of origin
Top origins
United StatesIndiaIndonesiaNigeriaSouth AfricaBangladesh
27%22%12%
4%4%4%
60%
40%
20%
0%Wee
kly
% o
f abu
sive
PVA
![Page 18: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/18.jpg)
Security & Abuse Research
VOIP largest abuse source
24% of PVA verified over VOIP
Includes:
Google VoicePingerTextPlusEnflickGoTextMe
Bandwidth.comPTBhartiVodafoneMTNIdeaTelekomunikasiAircel…Level 3CellTelengy
CarrierUSIDININ
NGINIDIN…
USZAUS
19.9%7.3%5.3%4.0%3.0%2.8%2.2%2.1%
…0.86%0.84%0.81%
Country PopularityRank12345678…181920
![Page 19: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/19.jpg)
![Page 20: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/20.jpg)
Security & Abuse Research
Phone for price of a CAPTCHA
Not Verified
![Page 21: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/21.jpg)
Security & Abuse Research
Strategy in practice [now defunct]
New phone per CAPTCHA
Free SMS Service
![Page 22: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/22.jpg)
Security & Abuse Research
Strategy in practice [now defunct]
Claim 5 forwarding numbers
New phone per CAPTCHA
Free SMS Service Google Voice
![Page 23: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/23.jpg)
Security & Abuse Research
Strategy in practice [now defunct]
Claim 5 forwarding numbers
Register 5 accounts per phone number
New phone per CAPTCHA
Free SMS Service Google Voice Google Account
25 accounts per CAPTCHA
60-80% of all disabled PVA between Oct-Jan
![Page 24: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/24.jpg)
Security & Abuse Research
Where do non-VOIP phones originate?
Same locations as human CAPTCHA farms.Socio-economic disparity creates an abuse vector.
![Page 25: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/25.jpg)
$140–420 per 1K SIMs
![Page 26: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/26.jpg)
$140–420 per 1K SIMs
![Page 27: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/27.jpg)
Buyers bid on SMS endpoints: ~$0.20/SMSSellers list phone numbers, respond with code.
![Page 28: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/28.jpg)
Security & Abuse Research
REGISTRATION STRATEGIES3
![Page 29: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/29.jpg)
Security & Abuse Research
How do older protections perform?
CAPTCHAs
Email verification
IP reputation
Phone verification
![Page 30: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/30.jpg)
Security & Abuse Research
56% of registrations shown a CAPTCHA
Correctly solved 96% of the timeIndicative of human solvers
CAPTCHA breaking
![Page 31: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/31.jpg)
Security & Abuse Research
Minimizing IP re-use
Restrict IP re-use over all time to < 20 accounts
![Page 32: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/32.jpg)
Security & Abuse Research
Frequent phone re-use
< 30% of phone numbers unique
Can re-use phone numbers multiple times
![Page 33: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/33.jpg)
Security & Abuse Research
Access to number is short lived
Lifetime < 1hr comparedto 1mo for benign
![Page 34: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/34.jpg)
Security & Abuse Research
DIALING BACK ABUSE4
![Page 35: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/35.jpg)
Security & Abuse Research
Frequently abused carriers
Over 1,000 abused carriersTop 10 carriers contribute 50% of abusive PVA
![Page 36: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/36.jpg)
Security & Abuse Research
Carrier reputation
Bandwidth.comPTBhartiVodafoneMTNIdeaTelekomunikasiAircel
CarrierUSIDININ
NGINIDIN
41%91%98%98%97%98%99%98%
Country % GoodRank12345678
Most VOIP registrations abusiveAll other carriers serve predominantly good users
![Page 37: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/37.jpg)
Security & Abuse Research
Pushing back on abusive carriers
In January, we took action on carrier abuse:
Blocked VOIP numbers acquired with CAPTCHA
Restricted all other known VOIP numbers to single use
Restricted some Indian, Indonesian telcos to single use
![Page 38: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/38.jpg)
Security & Abuse Research
Impact on pricing
Price returns back to pre-VOIP levels
Pric
e pe
r 1K
acc
ount
s
![Page 39: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/39.jpg)
Security & Abuse Research
How did merchants react?
In April, purchase a new set of 2,478 PVA
Only 12% were Bandwidth.com, compared to 80% beforeSome previously unseen VOIP servicesMerchants hit max registration limit
Need finer grain phone reputation signals
![Page 40: DIALING BACK PHONE VERIFIED ACCOUNT ABUSE - Elie ......DIALING BACK PHONE VERIFIED ACCOUNT ABUSE Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier (Databricks),](https://reader033.fdocuments.net/reader033/viewer/2022060800/60844457c75eda56267c5926/html5/thumbnails/40.jpg)
Security & Abuse Research
Summary
Thriving account black market
Use purchasing as an oracle into criminal capabilities
Use pricing as an early warning of failing defenses
Phone verification requires reputation support