Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks:...

38
Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator IT Governance Academic Coordinator Brazilian Research and Academic Network – RNP Educational Team – ESR www.esr.rnp.br [email protected] Ivo Peixinho Computer Forensics Expert Head of the IT Division – DINF/CTI/DPF Brazilian Federal Police www.dpf.gov.br [email protected]

Transcript of Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks:...

Page 1: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar

Jacomo PiccoliniSecurity Academic CoordinatorIT Governance Academic CoordinatorBrazilian Research and Academic Network – RNPEducational Team – [email protected]

Ivo PeixinhoComputer Forensics ExpertHead of the IT Division – DINF/CTI/DPFBrazilian Federal [email protected]

Page 2: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Brazilian home banking facts:

• Brazil started home banking operations in late 1990 with modem + proprietary software sent to users by floppy disks, remember those?

• Web access to home banking came around 1999 and fraud was limiteduntil 2003 when phishing attacks started to become epidemic.

• Until 2007 almost all phishing attacks were based on simple fake web pages, sometimes with low quality, old images and old layout and non-working buttons.

• Since 2007 malware based attacks are the main door to collect user’s banking information but from time to time we do see a raise on fake banking pages, now with much better quality.

Page 3: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Brazilian home banking facts:

• Brazil has one of the largest banking operations on the world and is now heavily dependent on home banking and on ATM usage.

• Brazil is also one of the biggest Internet users population.

• Some official and non-official estimative says Internet banking fraud is generation losses around U$ 300,000,000 / year

• Wait one second …. that’s ONE billon in 3 years, that’s a lot of money …

Page 4: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar:

• First steps to defeat miscreants was based on virtual keyboards that were supposed to be immune to logging. They became standard to all banks in Brazil, and many run in Java

Page 5: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar:

• Java can be easily decompiled

Base 64EncodedGifs

Page 6: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar:

• Java can be easily decompiled

Huh??

Embedded binary on Java code?

CPU and Disk data => Host identification(more on that later...)

Page 7: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat:

• Click logging start to kick in malware, it’s rudimentary but effective …

… the hard work is to assemble all the clicks …

Page 8: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat:

• Click logging start to kick in malware, it’s rudimentary but effective …

Information can only be retrieved by a real person: 4/8 1/7 4/8 4/8 1/7 4/8 <ok>

Page 9: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar:

• Second step used were to use two-way authentication with tan-code cards

• We call those “battleship” cards

• People carry them on wallets and even take pictures with cell phones not very safe

• And miscreants love those …

Page 10: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat:

• Two way authentication with 70 entries, miscreants make you fill ALL positions before you can access the fake bank page

… and people have time and patience to do that …

Page 11: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar:

• Browser plugins (g-buster)

Page 12: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar:

• Browser plugins (g-buster) “Infect” the machine before the miscreants do. G-buster monitors system for suspicious activity and reports back to the bank security team.

Page 13: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat: removing g-buster with Avenger tool

Thanks to Kaspersky

Page 14: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat: trading remover tools g-buster

If you have a g-buster killer or remover I will buy it or trade

Page 15: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar: Tokens

• Tokens with timed password (few banks use those – only two?)

• expensive• hard to maintain (helpdesk services)• users keep loosing, destroying, so on …

• Tokens with digital certificates • not very used• user must buy one himself• uses Brazilian government PKI infrastructure

(ICP-Brasil)• A3 certificates (hardware based)

Page 16: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar:

• It started a new malware business - man in the “net” attack

User get infected

Malware check with database server – we have a new one!

Miscreant wait until his application play a song – we have a bank http request

Miscreant collect username/password and access the bank

Miscreant send a Token request to User

Token is sent to database Miscreant receive the tokenNew song is played

Done!

Page 17: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Slide removed from original presentation

Page 18: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Slide removed from original presentation

Page 19: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat: Tokens pop-up

Page 20: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar: Computer registration

• Bank of Brazil “computer registration” used to be like Microsoft WGA

• if you change your HD or video card you need to register it again• if you make a new install you need to register it again

• this was very effective for a short period of time …

Page 21: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat: computer registration

… so Miscreants started to clone all information they need to defeat this …

Page 22: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar: SMS message for transaction commit

• Internet banking software send an SMS with a transaction validation to a pre-recorded cell phone number• User must type SMS code to continue• Used also to validate a new computer for the user• Cheap way to have a “token”• May be subject to SMS network congestion (bigger timeouts?)

Page 23: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat: Cell phone cloning by harvesting passwords of carrier websites

• Carrier stores use the Internet for registering new cell phones • Store workers get bored and click on stuff they receive by email • With access, miscreants can “clone” cell phones and obtain SMS transaction codes

Page 24: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat: Cell phone cloning by harvesting passwords of operator software

Malware source (found on Google )

Uses DELPHI language

Cell phone carriers

Page 25: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat: Cell phone cloning by harvesting passwords of operator software

“advanced” crypto

Page 26: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Raising the bar: Cellular registration – NEW

• This is new in the Brazilian Banking economy

• Cell phone is a commodity – we have 180 million x 200 million population• Cost is transferred to end user – you use your phone• Different architecture – less malware (for now)• Have some issues – dead battery

– no signal (inside a bunker) – network congestion (mia sms)

• Mobile will be the new desktop – FACT

• Miscreants will target cell phones / technology / carriers • You will be kidnapped with your phone

Page 27: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat: ATM skimmers are always present

Picture removed from original presentation

Page 28: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat: .pac files to change proxy configuration

… and the winner is …

Miscreants, since this .pac file is online for more than two months …

Sorry guys but #FAIL

Page 29: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants are hard to beat: hosts manipulation are common

This hosts file has ‘only’ 422 entries

Page 30: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Defacing is still not a crime in Brazil

Picture removed from original presentation

Page 31: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Miscreants at large: Vídeo

Page 32: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

What’s next? What’s the next move?What’s the solution?

Please THIS IS a JOKE:

This is NOT a JOKE: Miscreants will compromise WIFI routers to route traffic … or any other kind of home user equipment to make this …

Page 33: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Latest police operations on bank fraud

• Operação espelho – 04/16/2009• 10 search warrants on 4 states• Credit card cloning (goat sucker) and cash withdrawal fraud• Inside job – miscreants infiltrated inside a government bank

• Operação trilha – 05/28/2009• Greatest police operation on Internet bank fraud so far• 136 search warrants on 13 states• Multiple frauds – Trojans spread by email and cameras on ATM machines• Pictures of the miscreants (one was arrested on the US)

Page 34: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Latest police operations on bank fraud

• Operação Nômade – 06/04/2009• 20 criminals arrested• Goat suckers used for cloning of the magnetic strip of cards• Fake credit card billing machines for storing card information• Operation name (nomad) came from constant address changes from miscreants

• Operação Contrafação – 06/04/2009• 4 criminals arrested• Multiple operations – document forgery, credit card cloning and Internet fraud• Fake IDs, credit cards and computer software (trojans) found

• Operação Clonagem – 09/16/2009• Bank card cloning• Electronic devices for card cloning found with the criminals• Also R$ 4.000,00 in CASH

Page 35: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Latest police operations on bank fraud

• Operação Ícaro – 03/04/2010• 4 states involved• Credit card cloning • Criminals used the cards to purchase products on the Internet, specially plane tickets• Use of social engineering – calling victims home to get card information• Selling of credit card numbers – from R$ 3,00 to R$ 150,00 depending on the limit

• Operação Neverland – 05/03/2010• Harvesting of bank passwords using trojans• Payment of bills using these passwords• This operation was a result of the “tentáculos” project• The leader of the group had a nickname of “Michael Jackson”• R$ 700.000,00 on financial loss

Page 36: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Latest police operations on bank fraud

• Operação RASTRO – 05/28/2010• Credit card cloning• 1.500 cards found with the criminals

• Greatest card seizure EVER from the Federal Police• Money laundry – criminals buy stuff with cards and sells them with lower price• Group leader used the cards to buy construction materials for him to build his house • Gang acquired R$ 1.500.000,00 on stuff • This picture is not his house

Page 37: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Tentáculos project (2009 – 2010)

• Partnership between the Federal Police and Banks for obtaining Internet fraud information.• Gathering of info from multiple banks and use of intelligence tools for correlation between frauds and criminals.• Already resulted on one operation (neverland)• Permanent group on the Federal Police focused on electronic fraud.• Expected Result: reduction on 50% of frauds

Page 38: Phishing Malware vs Brazilian Banks: What each side is ... · Phishing Malware vs Brazilian Banks: What each side is doing to raise the bar Jacomo Piccolini Security Academic Coordinator

Thanks – Questions to:

Jacomo PiccoliniSecurity Academic CoordinatorIT Governance Academic CoordinatorBrazilian Research and Academic Network – RNPEducational Team – [email protected]

Ivo PeixinhoComputer Forensics ExpertHead of the IT Division – DINF/CTI/DPFBrazilian Federal [email protected]


Turning on network protections for Web Fraud · F5 Agility 2014 2 Fraud and malware remains a challenge Malware/Fraud Statistics Mobile Malware (MM) Phishing attacks 15% increase

Turning on network protections for Web Fraud · F5 Agility 2014 2 Fraud and malware remains a challenge Malware/Fraud Statistics Mobile Malware (MM) Phishing attacks 15% increase

. Firma Electrónica. Fraude y Seguridad en la Red. Qué es el phishing y cómo protegerse. Malware.

. Firma Electrónica. Fraude y Seguridad en la Red. Qué es el phishing y cómo protegerse. Malware.

© 2006 Consumer Jungle Malware: Spam, Viruses, Spyware, Phishing, Pharming, Trojans, Worms, Backdoors, and Zombie Computers.

© 2006 Consumer Jungle Malware: Spam, Viruses, Spyware, Phishing, Pharming, Trojans, Worms, Backdoors, and Zombie Computers.

Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

Using Deep Networks and Transfer Learning To Address ... · Transfer Learning Multi-class: friend, 419 scam, malware, credential phishing, phishing training, propaganda, social engineering,

Using Deep Networks and Transfer Learning To Address ... · Transfer Learning Multi-class: friend, 419 scam, malware, credential phishing, phishing training, propaganda, social engineering,

Threat intelligence, detection and response @ scale Prevention Monitoring / Visibility Response Delegating Trust Summary 2 ... Online banking 8 Adware Phishing Malware Exploit. Malware

Threat intelligence, detection and response @ scale Prevention Monitoring / Visibility Response Delegating Trust Summary 2 ... Online banking 8 Adware Phishing Malware Exploit. Malware

SPAM, MALWARE, Phishing et emails Commerciaux · «Predictive Email Defense» contre les spam, malware, phishing et emails commerciaux : retour d’expérience de la ville d’Asnières

SPAM, MALWARE, Phishing et emails Commerciaux · «Predictive Email Defense» contre les spam, malware, phishing et emails commerciaux : retour d’expérience de la ville d’Asnières

Phishing (main malware phishing cases in Poland) Tomasz Sawiak tomasz.sawiak (at) safecomp.com tomasz.sawiak (at) safecomp.com.

Phishing (main malware phishing cases in Poland) Tomasz Sawiak tomasz.sawiak (at) safecomp.com tomasz.sawiak (at) safecomp.com.

Spear Phishing Defense Framework - PhishLabs · A strategic, end-to-end model for managing and improving protection against spear phishing attacks Security Awareness Training Malware

Spear Phishing Defense Framework - PhishLabs · A strategic, end-to-end model for managing and improving protection against spear phishing attacks Security Awareness Training Malware

Data sheet AntiFraud Protect your brand from phishing and malware … · 2020-07-16 · Protect your brand from phishing and malware attacks Data sheet | AntiFraud Overview For brand

Data sheet AntiFraud Protect your brand from phishing and malware … · 2020-07-16 · Protect your brand from phishing and malware attacks Data sheet | AntiFraud Overview For brand

Deutscher Präventionstag SOPHOS 31-05-2011x berichtenvon Phishing-Angriffenauf diesemWeg. Das sindmehralsdoppeltso viele wie in 2009. PHISHING. Social Networking Malware derNutzerSozialerNetzwerke

Deutscher Präventionstag SOPHOS 31-05-2011x berichtenvon Phishing-Angriffenauf diesemWeg. Das sindmehralsdoppeltso viele wie in 2009. PHISHING. Social Networking Malware derNutzerSozialerNetzwerke

Deep Malware Analysis - Joe Sandbox Sandbox Cloud Feature... · Sandbox Cloud Deep Malware Analysis Classification Ransomware Spreading Phishing Banker Adware Trojan / Bot Spyware

Deep Malware Analysis - Joe Sandbox Sandbox Cloud Feature... · Sandbox Cloud Deep Malware Analysis Classification Ransomware Spreading Phishing Banker Adware Trojan / Bot Spyware

Online ID Theft, Phishing, and Malware

Online ID Theft, Phishing, and Malware

Hard Truths about Account Takeover & Strategies to Defend ......Use of stolen creds Malware: Export data Malware: C2 Social: Phishing Malware: Spyware/keylogger Incident Count Palo

Hard Truths about Account Takeover & Strategies to Defend ......Use of stolen creds Malware: Export data Malware: C2 Social: Phishing Malware: Spyware/keylogger Incident Count Palo

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2014

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2014

What is Bad Email? Spam, Phishing, Scam, Hoax and Malware distributed via Email

What is Bad Email? Spam, Phishing, Scam, Hoax and Malware distributed via Email

Phishing is More Common and More Sophisticated · with a phishing email, but email hacking is much more than phishing and launching malware. Join Roger A. Grimes, KnowBe4’s Data-Driven

Phishing is More Common and More Sophisticated · with a phishing email, but email hacking is much more than phishing and launching malware. Join Roger A. Grimes, KnowBe4’s Data-Driven

Protecting Your Network from Malware - Akamai...Protecting Your Network from Malware The threat landscape is becoming increasingly hostile. Malware and ransomware campaigns, phishing

Protecting Your Network from Malware - Akamai...Protecting Your Network from Malware The threat landscape is becoming increasingly hostile. Malware and ransomware campaigns, phishing

Malware & Phishing Intelligence

Malware & Phishing Intelligence

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2012

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2012