Cyber Fraud Copyright © Hybrid Application Security Ltd. (2010-2012). All Rights Reserved.

Cyber Cyber FraudFraud

Copyright © Hybrid Application Security Ltd. (2010-2012). All Rights Reserved.

Pioneer in AI based website protection

First business-logic security solution

Website misuse detection

User behavior profiling


Hybrid Leak Sensor


About Me

Founder: Hybrid Security

Blogger: Chapters In Web Security

Hacker: MultInjector

WebTuff

R.U.D.Y


Cyber Fraud

Identity and CC fraud

Automated bot activities

Business logic abuse


Citibank


Sony


AT&T


Exponential growth Geographic clusters Mutual website-client infection

Bot Epidemic

Infections - McAfee Distribution - Microsoft


Man-In-The-Browser

“…Automated transaction monitoring or anomaly detection and response could have prevented many of the frauds…” FFIEC


Business Logic Flows

Login

Register

Main Page

RegistrationDetails

Item Search Results

VerifyEmail

LandAdd To

Shopping Cart

Payment &Checkout


Missing / additional parametersVulnerable password recoveryFalse registrationInvalid parametersInvalid business workflowsGuessable session identifiersForceful browsing

Business Logic Flaws

Highly Illogical

…


Target Victims

GovernmentAirlines

FinancialGaming

E-CommerceSubscription Services


Commission manipulationSpread tamperingTransaction time lingeringLogic fuzzing

Forex Fraud


0.01 ₪ ~ 0.00168144044 £

Forex Fraud

Normal business logic:

After 2 digit currency rounding:

Kosher

500% more satisfaction for the buck!!

1,000,000 transactions * 0.00168144044 £ = 1681.44044 £ ~ 10,000 ₪

1,000,000 transactions * 0.01 £ =10,000 £ ~ 60,000 ₪

( , April 8 2012 )


Client-side logic flaws: Flash / JS / Java / SilverlightDigital goods theftPoker botsPlayer collusionScreen scraping

Online Gaming Fraud


Online Gaming Fraud


Using GHDB / Shodan to hack into open PBXAuthentication bypass / unpaid content downloadSubscriber PII scraping

Telecom Fraud


Browser “Helper” ObjectsParameter injectionEvil BankersPump & DumpAccount traversal

E-Banking Fraud


Concerts, sports, flights, moviesTicket scalping botsLower vendor marginsSeat locking & defacement

Ticket Order Fraud


Web 2.0 spam botsSocial scrapersPredators & impostersPhishingLikejacking

Social Network Fraud


Card-Not-PresenteWallet Pick-pocketing(Google, PayPal)Auction botsAffiliate click fraudStolen goods

E-Commerce Fraud


Data mining / Industrial Espionage / Email harvestingBrowser COM API + JavaScript injectionScrape-As-A-Service:ScraperWiki

Spiders & Scrapers

Kosher


https://scraperwiki.com/

Black & white lists

Dynamic web page profiling

Heuristic behavior analysis

Technology Evolution


HybridAppliance

Hybrid Telepath

Hybrid Cloud


Behavior Analysis


Hybrid Architecture


Reverse Proxies (F5, Zeus, Cisco) SIM/SOC (HP, IBM, Symantec) Firewalls (Juniper, Checkpoint, Cisco, Fortinet) Analytics (Clicktale, GhostRec, LivePerson) Sniffers (Radware, Metronome, Sourcefire) Authentication (SafeNet, Microsoft, Oracle)

3rd Party Integration


Web: www.hybridsec.comEmail: [email protected]: +1 (650) 319-7389


Cyber Fraud Copyright © Hybrid Application Security Ltd. (2010-2012). All Rights Reserved.

Documents

Transcript of Cyber Fraud Copyright © Hybrid Application Security Ltd. (2010-2012). All Rights Reserved.