State of Black Market for Stolen Credit Cards (2015) by N. Vlajic

Transcription

1 State of Black Market for Stolen Credit Cards (2015) by N. Vlajic

2

3 Worst Security Hacks of the Last Decade

4

5 Why Do Hackers Go After Credit Cards? immediate payoff * stolen C.C. numbers can be used right away, anywhere in the Internet low hanging fruit for criminals * C.C. numbers can an be easily stolen from under-protected e-commerce Web-sites low likelihood of capture * it is easy to obscure evidence

6 How Do Credit Card Numbers Get Stolen? Scenario 1: Harry the Hacker methods of operation * malware installed on a corporate server * malware installed on a public computer data skimmed whenever user logs in their bank number, credit card number, address, password * malware installed on a public server malware downloaded to a client machine at every visit of infected Web-site

7

8 How Do Credit Card Numbers Get Stolen? Scenario 2: Phishing Phil method of operation * malware sent via as attachment / link - user must be fooled at opening attachment / link and initiating malware installation phishing = most common attack vector in most (corporate) hacks

9 How Do Credit Card Numbers Get Stolen? Scenario 3: Waiter/Waitress with Payment Terminal [ dangerous retail insider ] method of operation The waitress whisks away your credit card and swipes it through the restaurant's register. Then, she pulls out a small device, about the size of an ice cube, from her apron and swipes it through that

10 How Do Credit Card Numbers Get Stolen? Scenario 4: Payment Terminal By Outside Trio [ dangerous retail outsider 1 ] method of operation Sally, Simon and Bud walk into a toy store. Bud waits in line to check out. When Bud is at the register, Simon comes running up to the clerk, screaming that his wife has fainted. As Sally and Simon distract the sales clerk, Bud switches the credit card reader at the register with a modified one of his own

11 How Do Credit Card Numbers Get Stolen? Scenario 5: Credit Card Skimmer (Gas Lass) [ dangerous retail outsider 2 ] method of operation It's late. There's no one around except a sleepy attendant at the register inside. The Gas Lass attaches a skimmer over the credit card reader at the pump. It's a special skimmer: It emits a Bluetooth signal to a laptop close by. The Gas Lass heads off to the motel next door and sets up her laptop to receive the data

12 Where Do Stolen Credit Card Numbers Go? Credit Card Broker Credit Card Carder

13 Where Do Stolen Credit Card Numbers Go? 1) Credit Card Brokers black market agents who buy and re-sell stolen credit card numbers

14 Central Shop = Web portal for sale of credit card data

15 What is the selling price for stolen credit card numbers?

16 What else can you find on the black market?

17 Where Do Stolen Credit Card Numbers Go? 2) Credit Card Carders criminals that ultimately use/exploit stolen credit card numbers ways carders use stolen c. c. numbers print plastic card with the new number [ not effective in case of EMV/chip cards ] make online purchases [ not easy on some sites as other user info may also be required]

18 It is race against the clock to charge as much money to the card as possible before the bank closes the account. carders must quickly extract & convert stolen money into other forms of capital [ process aka as money laundering ] extraction & conversion should be hard to detect or trace back multiple conversion steps often used

19 Credit to Gift Card Shell Game

20 Money Mules aka smurfer - serves as an intermediary for criminals & criminal organisations transport fraudulently gained money or goods to fraudsters may or may not be aware of true nature of business

21 Money Mules money mule job Ad examples

22 Money Mules money mule prosecution

23 Money Mules

24 Money Mules

25 How Do Carders Test Stolen C.C. Numbers? stolen credit card numbers not worth much unless verified thieves use online payment websites to test whether c.c. numbers work in some cases verification is done using bots Charity Web-sites are ideal for testing of stolen c.c. due to simple (bot-friendly) design and little built-in security.

26

27 How Do Law Enforcement Officers Discover C.C. Hacks? LAO & anti-fraud specialists purchase batches of c.c. numbers from crime forums / carding sites look for patterns that might help identify who got breached carding site Rescator is now able to detect suspicious transactions done by law enforcement officials purchases get declined

28 [1] bloomberg.com [2] bankrate.com References [3] engadget.com [4] motherboard.vice.com [5] symantec.com [6] dailymail.co.uk [7] mcafee.com [8] nerdwallet.com

29 [9] tripwire.com [10] bambooinnovator.com [11] Reuters.com [12] safeinternetbanking.com [13] us-cert.gov [14] antimoneylaunderinglaw.com [15] blogs.msdn.com [15] blogs.msdn.com

30 [16] philanthropy.com [17] kerbsonsecurity.com [18] informationisbeautiful.net

31 Questions 1) What is the most common approach that hackers resort to in order to steal credit card numbers? 2) Define the term broker in the context of credit card fraud chain? 3) Which types of web-sites are commonly used by hackers for testing of stolen credit card numbers?