Download as PDF, PPTX
More Related Content
Similar to UQ_Cybercrime_Professionalism_Lecture_2024_07.pdf
UQ_Cybercrime_Professionalism_Lecture_2024_07.pdf
- 1. Cyber Crime Professionalism JonOliver Adjunct Professor at Uni Qld
- 2. My Background Academic backgroundin Machine Learning Building antispam filters 2002 -> 2008 Cyber security 2008 to 2024 Academia Industry Sweet Spot
- 3. Technical Capability 1999 Melissa Virus 2002 Spamming 2005 Botnets 2007 Webthreats 2010 Zeus: Banking Trojan 2017Fileless / Living off the Land 2011 Blackhole: Exploit Kits 2014 CryptoLocker: Ransomware 2016: Cridex: Breach based Ransomware 2017 Coinminer 2019 Ransomware as a Service (RaaS) 2021 RaaS double extortion Business Model Cybercrime over 25 years…
- 4. Cyber Criminal Professionalism •Often requires no technical innovation • Excellent execution • Measuring every aspect of a cyber attack • Presenting this data in a UI • Optimizing each step • Perfecting their business model
- 5. Preventing Cyber Crime TechnicalKnowledge + Understanding the business model (study underground forums, read reports of criminals being arrested, …)
- 6. 1. Measuring BlackHole ExploitKit (BHEK) Ref: http://media.blackhat.com/bh-us-12/Briefings/Jones/BH_US_12_Jones_State_Web_Exploits_Slides.pdf
- 7.
- 8.
- 9. Advertising / ReleaseNotes BlackHole exploit Kit 2.0 Рады приветствовать вам совершенно новую версию связки эксплойтов. За более чем 2 года существования нашего проекта, старый движок связки изрядно заездили и затаскали, АВ компании стали очень быстро распознавать по неким критериям что это BlackHole и помечать ее как malware. В новой версии мы переписали все с нуля, причем с нуля переписана не только часть с выдачей эксплойтов, но и админ панель. Из новшеств по выдаче: 1. Мы максимально защитили эксплойты от автоскачивания их АВ компаниями, теперь генерируется динамический УРЛ, который действителен в течении нескольких секунд, нужных лишь для одного заражения потенциально заходящего на ссылку человека. 2. Теперь так же максимально защищен и ваш ехе, АВ компания не сможет его просто так скачать, что позволит держать ваши ехе максимально долго в чистоте. 3. JAR и PDF файлы выдаются только тем версиям плагинов, которые уязвимы, если плагин не уязвим, сплойт не выдается, и не пачкается лишний раз.
- 10. BlackHole exploit Kit2.0 Are pleased to welcome you to a brand new version of the bundle of exploits. For more than 2 years of existence of our project, the old engine arrival and ligaments badly worn, AV companies have become very quick to recognize that this kind of criteria BlackHole and flag it as malware. In the new version we have rewritten from scratch, and re-written from scratch is not only part of the issuance of exploits, but also the admin panel. Of the innovations on the issue: 1. Implemented maximum protection from Automatic systems for downloading exploits, used by AV companies: generate a dynamic URL, which is valid for a few seconds, you need only to one victim at a time. 2. Now, Your executable also protected from multiple downloads, AV company can not just download it, which will keep your exe as long as clean. 3. JAR and PDF exploits show only for detected vulnerable versions of plug-ins if the plug is not vulnerable,exploits not issued, and not get in detection loop. …
- 11. JRE <= 1.6.0_27 1.5.0_31 JRE <= 1.7.0_02 1.6.0_30 1.5.0_33 JRE<= 1.7.0_03 1.6.0_32 1.5.0_32 JRE <= 1.7.0_06 JRE <= 1.7.0_07 JRE <= 1.7.0_10 JRE <= 1.7.0_15 Flash <= 11.5.502.1 46 CVE-2011-3544 gogonaggogonaExp.class CVE-2012-0507 GondadExx.Ohno.class CVE-2012-1723 Gond1723.Gondattack.class CVE-2012-4681 cve2012xxxx.Gondvv.class CVE-2012-5076 gond20125076.Gondqq.class CVE-2013-0422 Xml20130422.XML20130422 .class CVE-2013-1493 yQCI.class CVE-2013-0634 xxxx.swf MSIE <= 7 CVE-2012-1889 javascript CVE-2012-4969 javascript Yes Yes Yes Yes Yes Yes Yes Yes Yes No No No No No No No No No Dispatcher SWF Vulnerability MSIE Vulnerability Infection! Pain to crawl Anti-crawling and serving vulnerable documents by client environment Serve blank page Client IP in black list? Yes No Landing Page
- 12. Cybercriminal Firewall Rules iptables-A INPUT -s aa.119.145.16/28 -j DROP #Kaspersky Labs iptables -A INPUT -s aa.119.145.16/28 -j DROP #Kaspersky Labs … iptables -A INPUT -s bb.188.199.136/29 -j DROP #SYMANTECGMBH iptables -A INPUT -s bb.227.131.216/29 -j DROP #Symantec Ltd … iptables -A INPUT -s xx.110.201.32/29 -j DROP #TREND MICRO DEUTSCHLAND GMBH iptables -A INPUT -s yy.93.166.128/28 -j DROP #Trend Micro UK Limited iptables -A INPUT -s zz.23.206.192/29 -j DROP #TRENDMICROITALYS.R.L. …
- 13.
- 14. 2. Evading SecuritySolutions
- 15.
- 16.
- 17. Professional Operations: TorrentLocker 2014-2017 Ref:http://www.trendmicro.com.au/cloud-content/au/pdfs/security-intelligence/white-papers/australian_web_threat_landscape_-v7.pdf
- 18.
- 19. Evading Spam Filters TechniqueTorrentLocker Outbreaks Honeypots Send email to legitimate email accounts IP Reputation Use rented servers Header analysis / phishing detection Don’t spoof Use email authentication Antispam Content Send plausible content Phishing lists Compromise many legitimate web- servers Misc Low volume. Optimize timing
- 20. TorrentLocker – Atypical spam run • state-nsw-gov.com, state1-nsw-gov.com, state2-nsw-gov.com, state3-nsw- gov.com, state4-nsw-gov.com sent a spam outbreak • Between 1am and 9am • Constituted approx 0.13% of email sent to Australian email addresses • Appeared to be sent to a carefully culled email address list • < 1% were to invalid email addresses • Used Email Authentication (DKIM and SPF)
- 21. TorrentLocker – usingEmail Authentication ;; ANSWER SECTION: info-service-osr.org. 3593 IN TXT "v=DMARC1; p=reject; rua=mailto:admin@info-service-osr.org" info-service-osr.org. 3593 IN TXT "v=spf1 ip4:194.58.1.1/16 ip4:193.124.1.1/16 ip4:151.248.1.1/16 a mx ~all"
- 22. TorrentLocker – compromisedwebservers 96 on a single outbreak hxxp://ahaliapublicschool.org/files/awmGz1ZvAL4zyy.php hxxp://alokitogrambangla.org/jscripts/P8sMnGioHtzHwwlvzqklwqGuUeh7Z54.php hxxp://alternativ-medizin.org/cms2/media/WHw0iGEgoEdkWEn.php ... hxxp://ttcchurch.org/uploadify/ND4wLfkrAizuISqskln2AX2WJ.php hxxp://turismodegalicia.org/uploadify/dh4F61g7aAupmqaiEDKgNZcY.php hxxp://www.bkmlaw.org/8XNjrWBqEIFXWA45N1eoCrBCjpGx.php
- 23. TorrentLocker – usingCaptcha
- 24.
- 25. Value of CompromisedMachine Monetization Approach Return Spam $ Banking Trojan $$ Stealing Intellectual Property $$ Ransomware (Opportunistic – spam based) $$$ Coinmining $ to $$$ Ransomware (Breach based) $$$$ Double Extortion Ransomware $$$$$
- 26.
- 27. Security: Before /After Ransomware Criteria Pre Ransomware Post Ransomware Detection urgency Within a few hours was often adequate At time of infection Errors to avoid Critical False Positives Missed detections Impact of missed detection Often small Use some resources: network / power / … Files encrypted + more Blackmail / extortion ML Strength
- 28. Comment 1 Industry wastoo slow in adopting Machine Learning (ML) for malware
- 30.
- 31. 2021: 4640 papers on MLfor detecting ransomware
- 32.
- 33. So why areransomware attacks still happening? ML evasion? Something else?
- 34. x Source: “Intriguing propertiesof Neural Networks”, Szegedy et al., Feb 2014, https://arxiv.org/pdf/1312.6199.pdf Tricking ML Speaker Insect Dog Ostrich
- 35.
- 36. Not Quite… Breach-based/ FilelessRansomware Ref: https://blogs.vmware.com/cloud/2020/08/27/investigating-stopping-fileless-attacks-carbon-black-cloud/ https://community.carbonblack.com/t5/Knowledge-Base/Cb-Defense-Understanding-quot-repmgr-quot-or-quot-Cb-Defense/ta-p/47542
- 37. Ransomware by RDPAbuse: Phase 1 Step 1 RDP server Brute force: Johnsmith abc123 Maryjones qw3rty … Bot Step 2 Found User and Password admin l3tm31n! Bot Bot Step 3 Bad actor sells RDP credentials on Underground forum Bad Actor
- 38.
- 39. Ransomware by RDPAbuse: Phase 2 Ransomware (RW) Actor purchases credentials on underground forum Bad Actor RW Actor
- 40. © 2020 TrendMicro Inc. 41 A growing category of cyber-crime consists of breaking into corporate networks and doing nothing else – except selling that illicit access to others for about $7,000 a go, says infosec biz Digital Shadows. The firm described what it said was a "notable increase" in the number of stolen-creds-for- sale postings, with the average price for a working access method being $7,100 and comprising around 17 per cent of listings seen by Digital Shadows. This price increases to $9,800 for remote desktop protocol (RDP) access, echoing research from ESET showing a 700 per cent increase in the number of RDP access attempts during 2020.
- 41. Ransomware by RDPAbuse: Phase 3 RDP server 1. Ransomware (RW) actor logs in with stolen credentials 2. Turns off Security / Makes multiple attempts / Privilege Escalation / … 3. Infects with ransomware OR 1. Ransomware (RW) actor logs in with stolen credentials 2. Fileless ransomware RW Actor
- 42.
- 43. Ransomware and ML MachineLearning does not work if someone turns it off… Many ransomware groups have adopted this approach
- 44.
- 45. Advantages of BreachBased Ransomware • Can target victims who may be in a situation where they feel compelled to pay ransom • Can increase the amount of money you demand ($$$$)
- 46. Cyber criminal professionalism Perfectthe Business Model Perfect the Business Model Optimising the infection process Many elements of a cyber attack are available for rent Pay $$$ for premium services (the latest vulnerability, freshly compromised credentials) Customer service Release notes Tracking every component of the infection process