Cyber Fraud - The New Frontiers

CYBER FRAUDTHE NEW FRONTIERS

Albert Hui GREM, GCFA, GCFE, GNFA, GCIA, GCIH, GXPN, GPEN, GAWN, GSNA, CISA, CISM, CRISCPrincipal Consultant

2014 Asia-Pacific Fraud ConferenceNovember 17th 2014 @ Hong Kong

WHO AM I?

• Spoken at Black Hat, High Tech Crime Investigation Association (Asia Pacific Conference), and Economist Corporate Network.

• Risk Consultant for Banks, Government and Critical Infrastructures.

• SANS GIAC Advisory Board Member.

• Co-designed the first Computer Forensics curriculum forHong Kong Police Force.

• Former HKUST Computer Science lecturer.

Albert Hui GREM, GCFA, GCFE, GNFA, GCIA, GCIH, GXPN, GPEN, GAWN, GSNA, CISA, CISM, CRISCPrincipal Consultant

albert@securityronin.com

• Cyber Fraud• External Fraud• Mechanisms and Facilitators

AGENDA

Overview of 2 Prominent Fraud Scenarios• Phishing / Whaling• Man-in-the-Browser

Monetization• Hacker Supply Chain• Underground Economy• Money Laundering

Cyber Security Countermeasures

PHISHINGFROM AN END-USER PROBLEMTO A CORPORATE PROBLEM

CLASSIC PHISHING SCAM:NIGERIAN LETTER

ADVANCED FEES SCAMIS 200+ YEARS OLD

“Spanish Prisoner” scam letter from 1905

PHISHING EVOLUTION

more targetedmore transparent

spear phishing

phishing

whalingpharming

WHALING EXAMPLE

CLASSIC PHISHING AND WHALING COMPARED

Classic Phishing• Ridiculous contents

• Opportunistic

• Straight-forward financial scam

Whaling• Make-Believe contents

• Targeted

• Lateral compromises possible,often leads to corporate espionage

CYBER KILL CHAIN

Recon Weaponize Deliver Exploit Install C2 Action

MONETIZATIONTURNING EXPLOITS INTO CASH

SOME MONETIZATION POSSIBILITIES

bank accounts

computer

file server

customer data stored values(e.g. Q-coins, Taobao credit)

MAN-IN-THE-BROWSER ATTACK:SPOOFED SCREENS

MAN-IN-THE-BROWSER ATTACK:REAL-TIME REDIRECT

FOOD CHAIN

Fraud Rings(can launder money

“safely”)

Hackers(cannot)

MONEY LAUNDERING

MONEY MULES

STORED VALUES

HACKER SUPPLY CHAIN

Anon Payment

Hacker Tools /

Bulletproof Hosting

MonetizationImplications• Sophisticated attacks now available to

non-experts

• Lower breakeven point for attacks

• More “worthwhile” targets

UNDERGROUND ECONOMY

BITCOIN FOR MONEY LAUNDERING

Dark Wallet

CoinJoin

HIDDEN INTERNET

Dark Net / Deep Web Silk Road

The OnionRouter

CYBER SECURITY COUNTERMEASURES

PHILOSOPHY

Defender’s Dilemma• Must secure all possible vulnerabilities

Intruder’s Dilemma• Must evade all detections

Reason’s Swiss Cheese ModelPicture from NICPLD

ESSENTIALS FOR DETECTING CYBER ATTACKS

• Layered defense-in-depth• Redundant security (e.g. two different brands of FWs)• Security event correlation (e.g. SIEM)• Trustworthy logging• Up-to-date threat intelligence• Security awareness and reporting channel• Incident response capability (e.g. CSIRT)

processpeople

technology

ANY QUESTIONS?

THANK YOU

albert@securityronin.com

Cyber Fraud - The New Frontiers

Technology

Transcript of Cyber Fraud - The New Frontiers

Workshop E: Fighting Fraud and Cyber Crime: WTF…"Where's the Fraud"

Cyber Security & Fraud – The impact on small businesses.

Hum 140: Social Media - Cyber fraud

Identifying and Mitigating Cyber Fraud Presentation - FDIC

Fighting cyber fraud: Are you as prepared as you think?Cyber payment fraud. The sobering reality of fraud. Financial losses from impostor fraud exceed $1.2B worldwide. of companies

Fraud Protections, Cyber-Theft and Controls

9 – Fighting Cyber Fraud with Hadoop

Strengthening your fraud and cyber-crime protection controls

Updated Cyber Security and Fraud Prevention Tools Tactics

Digital Security Cyber Security and Fraud Prevention · Digital Security – Cyber Security and Fraud Prevention Citi Online Academy ... Elizabeth Petrie . Director Strategic Analysis

Identifying and Mitigating Cyber Fraud - Federal … Supervision Branch Identifying and Mitigating Cyber Fraud Federal Deposit Insurance Corporation Division of Risk Management Supervision

Fighting cyber fraud with hadoop v2

Counting rules for fraud - GOV UK › ... · Action Fraud is the name of the contact centre that records NFIB fraud and some cyber-enabled and cyber-dependent crimes such as Computer

Cyber Fraud Trends Authentication - FIRST · Cyber Fraud Disruptors Antivirus − Stopped static malware − Packers and scrambling is now common practice Windows XP SP2 Firewall

Cyber Awareness, Scams & Fraud · Cyber Awareness, Scams & Fraud Cyber Protect Officer - Samantha HANCOCK (FHQ) ... • Ransomware generally occurs when a link in an email or an email

The new threats from cyber related fraud?

Cyber Source Fraud Report 2009 0 1

securing our cyber frontiers...SECURING OUR CYBER FRONTIERS 1 Foreword T he whole world suddenly appears to be waking up to the cyber security challenge. Countries are framing policies

Cyber security and fraud

Cyber Payment Fraud Threat Landscape - six-group.com · May 17th, 2017 Swiss Banking Operations Forum Zürich, Switzerland Cyber Payment Fraud Threat Landscape Cyber Defense Measures