Underground Chrysovalantis Christodoulou World Wid ide Web - PowerPoint PPT Presentation

The Underground Chrysovalantis Christodoulou

World Wid ide Web 28/04/2020 12:06 PM CS682-The Undergraound 2

Trafficking Fraudulent Accounts: The Role le of f the Underground Market in in Twitter Spam and Abuse Kurt Thomas† Damon McCoy‡ Chris Grier† ∗ Alek Kolcz Vern Paxson† ∗ † University of California, Berkeley ‡ George Mason University ∗ International Computer Science Institute Twitter {kthomas, grier, vern}@cs.berkeley.edu, mccoy@cs.gmu.edu, ark@twitter.com 28/04/2020 12:06 PM CS682-The Underground 3

Overview ❑ What are the most popular websites? - Facebook, Google, Twitter, Instagram, etc. ➔ Perfect Target for abuse (Fraud Advertising, Fake News, etc.) ❑ Need for Fraudulent, Spam accounts “Twitter has shut down up to 70 million fake and suspicious accounts- BBC 2018” 28/04/2020 12:06 PM CS682-The Underground 4

Contributions 1. Study the organization of the Underground market by monitoring 27 merchants profiting from the sale of Twitter accounts 2. Study merchants’ techniques for bypassing registration defenses and how barriers affect the accounts’ price 3. Implement a classifier to identify fraudulent accounts 4. Study the impact of the classifier on Twitter spam 28/04/2020 12:06 PM CS682-The Underground 5

Methodology Purchasing from Analyze the Market Tracking merchants Merchants selling Twitter accounts 28/04/2020 12:06 PM CS682-The Underground 6

Id Identify fy Merchants ❑ Total Number of identified Merchants: 27 48 Hours Merchants Distribution Support 14 12 12 10 10 8 6 5 4 2 0 Own Website BlackHat Forums Freelance sites Own Website BlackHat Forums Freelance sites 28/04/2020 12:06 PM CS682-The Underground 7

Purchasing fr from Merchants ❑ 144 orders -> 120K accounts ~ $5000 ❑ Bi-weekly basis from June 2012 – April 2013 ❑ Price Range: $1-20 ❑ Payment Methods: 28/04/2020 12:06 PM CS682-The Underground 8

Periods-Prices Table 1: List of the merchants we track, the months monitored, total purchases performed (#), accounts purchased, and the price per 100 accounts. Source of solicitations include blackhat forums†, Fiverr, and Freelancer and web storefronts‡ 28/04/2020 12:06 PM CS682-The Underground 9

Analysis ❑ Price: $0.04 Median account price ❑ Delivery: 1 day Median time before accounts arrive ❑ Fraud: 13% Accounts resold (Access after sale) ➔ Excellent Service 28/04/2020 12:06 PM CS682-The Underground 10

Analysis (c (cont.) Few changes on Prices due to high availability 28/04/2020 12:06 PM CS682-The Underground 11

Analysis – Price Comparison ❑ Prices from buyaccs.com Web Services Price Per Thousand Hotmail.com (resale*) $2 Hotmail.com $4 Yahoo $6 Twitter $20 Google (PVA)** $100 Facebook (PVA)** $100 * Resale accounts indicates account that was previously used **PVA - Phone Verified Account 28/04/2020 12:06 PM CS682-The Underground 12

Existing Defenses ❑ IP Blacklisting, throttling ❑ Email challenge-response ❑ CAPTCHAs ❑ Phone verification Merchants can circumvent those approaches 28/04/2020 12:06 PM CS682-The Underground 13

IP IP Blacklisting - Bypass ❑ Purchase accounts with unique registration IP: 79% Registration Origin Popularity India 8.50% Ukraine 7.23% Usually low- cost services Turkey 5.93% Thailand 5.40% Mexico 4.61% Other 68.33% 28/04/2020 12:06 PM CS682-The Underground 14

Email Confirmation - Bypass ❑ 77% of accounts was verified by a unique email address ❑ Hotmail & Yahoo Prices: $6/per thousand Average Twitter Price Average Twitter Price without confirmation with confirmation $30 $47 28/04/2020 12:06 PM CS682-The Underground 16

CAPTCHAs - Bypass ❑ ~ 35% of accounts they purchase solved CAPTCHA ❑ Increase the cost of accounts ❑ ~ 92% of the attempts fails But they don’t really care because it’s an automated process 28/04/2020 12:06 PM CS682-The Underground 17

Detecting Fraudulent Accounts (C (Classifier) ❑ Purely based on registration signals ❑ Train on 120K purchased accounts Features: 1 2 3 Automatically generated naming regex Time of registration Sequence of registration events e.g. e.g. Name: Maria Andreou E N E 3 Screen name: mariaksda E 1 E 2 Timing = δ finish – δ start Email: MariaAasdlka912@hotmail.com Welcome Registration Screen Complete 28/04/2020 12:06 PM CS682-The Underground 18

Classifier Performance 99.99% Precision: Percentage of identified accounts that are spam Recall: 95.08% Percentage of all detected spam accounts → Really good Performance 28/04/2020 12:06 PM CS682-The Underground 19

Recall Over Time Need for continuously purchasing 28/04/2020 12:06 PM CS682-The Underground 20

Im Impact on Twitter ❑ Apply the classifier to all register accounts between April 2012 – April 2013 ❑ Detect several million of spam accounts ❑ 27 Merchants was responsible for the 10-20% of all detected spam accounts 28/04/2020 12:06 PM CS682-The Underground 21

Im Impact on Twitter (c (cont.) Estimated Revenue: $127-459K 28/04/2020 12:06 PM CS682-The Underground 22

Disrupting the Market? ❑ Monitoring False Positives - Check how many user complaint about the suspension of their accounts - Achieved Precision: 99.9942% ❑ Monitoring Market immediately after the application of the detector All of the stock got suspended ... Not just mine .. It happened with Temporarily not selling Twitter.com all of the sellers .. Don’t know what accounts twitter has done ... buyaccountsnow.com buyaccs.com April 10, 2013 April 06, 2013 28/04/2020 12:06 PM CS682-The Underground 23

Market Fallout & Recovery ry ❑ Immediately after application of the algorithm → 90% of accounts suspended ❑ 2 weeks after application of the algorithm → 50% of accounts suspended ❑ Market recovers relatively fast, but authors achieve to disrupt it 28/04/2020 12:06 PM CS682-The Underground 24

Conclusions ❑ Buying accounts is relatively easy ❑ The market is responsible for the 10-20% of spam accounts on Twitter ❑ The market generates $127K-459K revenue per year ❑ The market bypass defenses but the cost of accounts get higher ❑ Proposed Machine Learning classifier achieve great, but temporal results ❑ Required stronger defenses after registration 28/04/2020 12:06 PM CS682-The Underground 25

PharmaLeaks: Understanding the Business of f Online Pharmaceutical Affiliate Programs Damon McCoy, George Mason University; Andreas Pitsillidis and Grant Jordan, University of California, San Diego; Nicholas Weaver and Christian Kreibich, University of California, San Diego, and International Computer Science Institute; Brian Krebs, KrebsOnSecurity.com; Geoffrey M. Voelker, Stefan Savage, and Kirill Levchenko, University of California, San Diego

Overview 2 1 Buy Services ( Commission ) Affiliate Marketer (Spammer) Spam Email Purchase/Delivery 3 Affiliate Program User (Customer) (Seller) 28/04/2020 12:06 PM CS682-The Underground 27

Contributions ❑ The contribution of the paper is on its results Main Goal: Extensive study of the pharmacy affiliate programs, because they are a major sponsor of spam (email and web), in order to understand their main aspects, and ultimately, disrupt the whole market 28/04/2020 12:06 PM CS682-The Underground 28

Affiliate Programs ❑ Affiliate Programs operates as a normal business and thus they have the same needs: 1. Good relationship with marketers 2. Good relationship with suppliers (goods and shipping) 3. Easiness on Payment processing ➔ Let’s analyze these aspects! 28/04/2020 12:06 PM CS682-The Underground 29

Methodology Customer Demographics Product Popularity Affiliates general operation Leaked Datasets Analyze Data Outcomes 28/04/2020 12:06 PM CS682-The Underground 30

Leaked Datasets ❑ Numerous “leaked” sources of financial and operational data for 3 affiliate programs. - Leaked data was a result of competitive hacking “war” *SpamIt is a fork of GlavMed and probably they are operating with the same people 28/04/2020 12:06 PM CS682-The Underground 31

Customer Demographics Orders Revenue Rate (%) Affiliate Repeated Country Program Customers United States 1,044,173 74.8 Revenue (%) Great Britain 88,823 6.4 27 GlavMed Canada 53,113 3.8 38 SpamIt Germany 39,353 2.8 RX-Promotion 9-23 Australia 31,918 2.3 France 29,581 2.1 Italy 15,406 1.1 Switzerland 10,478 0.8 Spain 9,578 0.7 Repeated Customers shows Sweden 7,717 0.6 satisfaction Other 65,277 4.6 28/04/2020 12:06 PM CS682-The Underground 32

Product Demographics *Without ED products SpamIt 28/04/2020 12:06 PM CS682-The Underground 33

Affiliates General Operation – Payments Lose relationship with payment method (VISA) 28/04/2020 12:06 PM CS682-The Underground 34

Affiliates General Operation – Registrations Avg. new customers for: GlavMed/SmaIt = ~ 3,500/week RX-Promotion = ~ 1,500/week Market is growing 28/04/2020 12:06 PM CS682-The Underground 35