The Underground Economy and Ecosystem of SMS Based Cybercrime Denis Maslennikov, Senior Malware Analyst, Kaspersky Lab 15.06.2011, 23 rd Annual FIRST Conference, Vienna, Austria
Agenda SMS based threats • Ransomware • SMS Trojans The ecosystem Underground economy Threats round the globe What should we do? 23 rd Annual FIRST Conference PAGE 2 | | June 15, 2011
Lottery 23 rd Annual FIRST Conference PAGE 3 | | June 15, 2011
How much have users lost? 23 rd Annual FIRST Conference PAGE 4 | | June 15, 2011
Ransomware
Ransomware In a nutshell 23 rd Annual FIRST Conference PAGE 6 | | June 15, 2011
Ransomware In a nutshell 23 rd Annual FIRST Conference PAGE 7 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 8 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 9 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 10 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 11 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 12 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 13 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 14 | | June 15, 2011
Ransomware Variety 23 rd Annual FIRST Conference PAGE 15 | | June 15, 2011
Psychological tricks Legal prosecution threats Data corruption threats Malware infection (!) threats Annoying pop-ups 23 rd Annual FIRST Conference PAGE 16 | | June 15, 2011
What do they want? 23 rd Annual FIRST Conference PAGE 17 | | June 15, 2011
Deblocker 23 rd Annual FIRST Conference PAGE 18 | | June 15, 2011
Deblocker 23 rd Annual FIRST Conference PAGE 19 | | June 15, 2011
Deblocker service statistics Launch: January 2010 Current state: • More than 5,100,000 unique visitors • More than 19,500,000 requests • ~60,000 unique visitors per day • ~230,000 requests per day Source: Kaspersky Lab 23 rd Annual FIRST Conference PAGE 20 | | June 15, 2011
SMS Trojans
SMS Trojans In a nutshell 23 rd Annual FIRST Conference PAGE 22 | | June 15, 2011
Statistics Number of modifications per year 345 336 350 300 250 212 200 150 116 100 50 11 3 0 2006 2007 2008 2009 2010 2011 Source: Kaspersky Lab 23 rd Annual FIRST Conference PAGE 23 | | June 15, 2011
Statistics Platform distribution 8% 3% 5% Symbian Windows Mobile Android J2ME 84% Source: Kaspersky Lab 23 rd Annual FIRST Conference PAGE 24 | | June 15, 2011
Primitive: Trojan-SMS.J2ME.Konov One of the first widespread SMS Trojans: • Small (1,5 – 8 kB) • No encryption • No social engineering tricks 23 rd Annual FIRST Conference PAGE 25 | | June 15, 2011
Advanced: Trojan-SMS.J2ME.VScreener ‘Faulty’ video player Must be ‘tuned’ by user • Quick left soft key pressing SMS are sent during ‘tuning’ Premium rate number and SMS text are stored in ‘ load.bin ’ file File ‘ load.bin ’ is encoded with ADD and ‘0xA’ key 23 rd Annual FIRST Conference PAGE 26 | | June 15, 2011
‘Video player’ Again 23 rd Annual FIRST Conference PAGE 27 | | June 15, 2011
‘Video player’ Again 23 rd Annual FIRST Conference PAGE 28 | | June 15, 2011
SEO and mobile malware 23 rd Annual FIRST Conference PAGE 29 | | June 15, 2011
SEO and mobile malware Blonde porn download 23 rd Annual FIRST Conference PAGE 30 | | June 15, 2011
The ecosystem The root of all evil
Trojan-SMS.J2ME.Konov 23 rd Annual FIRST Conference PAGE 32 | | June 15, 2011
Trojan-SMS.J2ME.Konov $10 or $6 per SMS Mobile operator 23 rd Annual FIRST Conference PAGE 33 | | June 15, 2011
Trojan-SMS.J2ME.Konov Mobile 4460 Content operator 5537 provider 23 rd Annual FIRST Conference PAGE 34 | | June 15, 2011
Trojan-SMS.J2ME.Konov Mobile 4460 Content operator 5537 provider 23 rd Annual FIRST Conference PAGE 35 | | June 15, 2011
Trojan-SMS.J2ME.Konov ‘ epbox 1290’ on Subtenant with ID 1290 4460 & 5537 ‘ epbox ’ ‘ epbox ’ on 4460 renter & 5537 Mobile 4460 Content operator 5537 provider 23 rd Annual FIRST Conference PAGE 36 | | June 15, 2011
Who are ‘ epbox ’ and ‘ epbox 1290’ ‘ epbox ’ renter ‘ epbox 1290’ subtenant 23 rd Annual FIRST Conference PAGE 37 | | June 15, 2011
Who are ‘ epbox ’ and ‘ epbox 1290’ ‘ epbox ’ Affiliate network renter owner(s) Affiliate A ‘ epbox 1290’ subtenant 23 rd Annual FIRST Conference PAGE 38 | | June 15, 2011
Who are ‘ epbox ’ and ‘ epbox 1290’ ‘ epbox ’ Affiliate network renter owner(s) Affiliate A Affiliate B Affiliate C ‘ epbox 1290’ ‘ epbox M’ ‘ epbox N’ subtenant subtenant subtenant 23 rd Annual FIRST Conference PAGE 39 | | June 15, 2011
The root of all evil Affiliate network registration form 23 rd Annual FIRST Conference PAGE 40 | | June 15, 2011
The root of all evil Affiliate network registration form Name Email Website URL Website name WMZ and WMR ICQ (optional) 23 rd Annual FIRST Conference PAGE 41 | | June 15, 2011
The root of all evil Affiliate network registration form No sensitive data! Name Email Website URL Affiliate ID ‘ epbox 1290’ Website name WMZ and WMR ICQ (optional) 23 rd Annual FIRST Conference PAGE 42 | | June 15, 2011
Typical affiliate website 23 rd Annual FIRST Conference PAGE 43 | | June 15, 2011
Typical affiliate website 23 rd Annual FIRST Conference PAGE 44 | | June 15, 2011
Typical affiliate website Referrer check Remote server Affiliate ID 23 rd Annual FIRST Conference PAGE 45 | | June 15, 2011
Typical affiliate website Referrer check Remote server Affiliate ID JAR constructor SMS Trojan with affiliate ID 23 rd Annual FIRST Conference PAGE 46 | | June 15, 2011
Typical affiliate website Referrer check Remote server Affiliate ID JAR constructor SMS Trojan with affiliate ID Thousands of websites! 23 rd Annual FIRST Conference PAGE 47 | | June 15, 2011
Ransomware Same situation 23 rd Annual FIRST Conference PAGE 48 | | June 15, 2011
Ransomware Same situation 23 rd Annual FIRST Conference PAGE 49 | | June 15, 2011
Underground economy …and lottery results :)
Underground economy Revenue sharing The Infected affiliate Affiliate phone/PC owner(s) Mobile Content operator provider 23 rd Annual FIRST Conference PAGE 51 | | June 15, 2011
Underground economy Revenue sharing The Infected affiliate Affiliate phone/PC owner(s) SMS 31-50% of SMS price Mobile Content operator provider 23 rd Annual FIRST Conference PAGE 52 | | June 15, 2011
Underground economy Revenue sharing The Infected affiliate Affiliate phone/PC owner(s) 1-5% of SMS SMS price 31-50% of SMS price Mobile Content operator provider 23 rd Annual FIRST Conference PAGE 53 | | June 15, 2011
Underground economy Revenue sharing 1-5% of SMS price The Infected affiliate Affiliate phone/PC owner(s) 1-5% of SMS 40-67% of SMS price SMS price 31-50% of SMS price Mobile Content operator provider 23 rd Annual FIRST Conference PAGE 54 | | June 15, 2011
$$$ 23 rd Annual FIRST Conference PAGE 55 | | June 15, 2011
$$$ ‘…10 people were arrested…’ ‘…malware which blocks PC…’ 23 rd Annual FIRST Conference PAGE 56 | | June 15, 2011
$$$ ‘…10 people ‘…half a year…’ were arrested…’ ‘…malware ‘…SMS as which blocks ransom…’ PC…’ 23 rd Annual FIRST Conference PAGE 57 | | June 15, 2011
$$$ ‘…10 people ‘…half a year…’ were arrested…’ ‘…1 billion rubles…’ ‘…malware ‘…SMS as which blocks ransom…’ PC…’ 23 rd Annual FIRST Conference PAGE 58 | | June 15, 2011
Calculations 1,000,000,000 rubles ~ $30,000,000 $30,000,000/6 ~ $5,000,000 per month 23 rd Annual FIRST Conference PAGE 59 | | June 15, 2011
‘Death penalty’ Largest mobile affiliate network was fined: The fine was equal to 25% of the affiliate network weekly income: • 1,590,000 rubles ~ $53,000 • Weekly income ~ $212,000 • Monthly income ~ $850,000 People were losing at least $1,200,000 per month 23 rd Annual FIRST Conference PAGE 60 | | June 15, 2011
Final score $6,200,000 per month 23 rd Annual FIRST Conference PAGE 61 | | June 15, 2011
Threats round the globe
Ransomware 23 rd Annual FIRST Conference PAGE 63 | | June 15, 2011
Ransomware 23 rd Annual FIRST Conference PAGE 64 | | June 15, 2011
Ransomware 23 rd Annual FIRST Conference PAGE 65 | | June 15, 2011
A long time ago… 23 rd Annual FIRST Conference PAGE 66 | | June 15, 2011
Porn SMS senders ‘ Nooit spijt ’ case 23 rd Annual FIRST Conference PAGE 67 | | June 15, 2011
Porn SMS senders ‘ Nooit spijt ’ case 23 rd Annual FIRST Conference PAGE 68 | | June 15, 2011
‘Dating’ apps If you are from UK 23 rd Annual FIRST Conference PAGE 69 | | June 15, 2011
Recommend
More recommend
