rsa 090617 webcast slides

8/8/2019 RSA 090617 Webcast Slides

http://slidepdf.com/reader/full/rsa-090617-webcast-slides 1/47

Online Fraud Trends in 2009 and Beyond

Featured Presenter:

Sean Brady, Senior Product Marketing Manager, RSA

Where does RSA see fraud going?

The Trends:

Phishing Fast-Flux

Trojans

Blend of Phishing and Trojans

Fraud as a Service (FaaS)

Attack on Multi-Factor/OTP Authentication

Resolution?

Agenda:



Where Does RSA See Fraud Going?



The Fraud Trends

Phishing

Risk

Sophistication



An Ongoing Problem

Phishing continues essentially unabated

The number of phishing attacks detected by RSA in 2008grew 66% over 2007



The Fraud Trends

Phishing

Fast-Flux

Risk

Sophistication



Proprietary proxy networkreplaced with Asprox

Fast-flux: Investing In the Infrastructure



Mother ship movedto new bulletproof

hosting




User’s machines alsoinfected by malware




The Fraud Trends

Phishing

Risk

Sophistication

Fast-Flux

Trojans



Trojans Are Here to Stay

No differently than any pieceof software, Trojans and

Trojan kits continue to evolve Infrastructure will improve,

similar to phishing

Automated Command &

Control failover Easy evasion of Anti-Virus

Can even now “grab

balances” so fraudsters don’thave to manually checkbalances



The Fraud Trends

Phishing

Risk

Sophistication

Fast-Flux

Trojans

Blend of Phishing & Trojans



Trojan Ecosystems and Infrastructure

Command & ControlBot-Herder

Infection / Update Drop Zone

Victim’s PC

Less than 25% of infectedPCs are protected by AVapplications. Even lesseffectively protected against

the specific threat.



Blend of Phishing and Crimeware



The Fraud Trends

Phishing

Risk

Sophistication

Fast-Flux

Trojans


Fraud-As-A-Service (FaaS)



Growth in Outsourcing

Centralized Trojan Infection Services

Ready-made procurement of Trojan packagesHTML Injection Kits



Infection Services Get Widespread




Non Exclusive Infection$23 per 1k infections




Exclusive Infection$130-270 per 1k infections



Use Only Reviewed Trojans



Easy to Use




Customer service was

outstanding




Downside: control panelIn Russian




Product 9/10

Service 9/10




Phone Banking Fraud is Live and Kicking



Fraud as a Service

Trojan Hosting Infection

OUT

Harvesting

Fraudster

IN

$299 per monthSaaS Subscription

CredentialsMy

AccountReports

User Name Password

Beatles60 abc123

Abba70 bcd234

Queen80 cde345

Everyone in the room can do itWho in the room can do it?



The Fraud Trends

Phishing

Risk

Sophistication

Fast-Flux

Trojans



Attack on Multi-Factor/ OTP Authentication



Attacking Multi-Factor Authentication

Static Methods(older

approaches) Target token

serial numbers

Strong socialengineering

aspect Collection of

event-based andscratch cardmethods (iTan,for example)



Trojan uses a combination of techniques in order tocircumvent strong authentication:

HTML injection Blocking user traffic to the bank’s website

A proxy installed on the victim's PC

How the attack works Attacker steals information required for the transaction

authentication, using HTML injection

Attacker can choose to use/not use the victim’s PC as aproxy to perform the transaction.

Trojan MITB without Session Hijacking



Page Injection



Trojan MITB with Session Hijacking – Zeus (WSNPoem)

Javascript injected using HTML injection

S





MITB transfer to a static money mule

T j MITB i h S i Hij ki






MITB transfer to a dynamic mule

T j MITB ith S i Hij ki







MITB transfer completed – No service message displayed

T j MITB ith S i Hij ki







MITB transfer completed – No service message displayed



Mule Accounts Recovery




M l A R




M l A t R



Resolutions?

Phishing

Risk

Sophistication

Fast-Flux

TrojansBlend of Phishing & Trojans


Attack on Multi-Factor/ OTP Authentication



Technical

Infrastructure

Cash OutFraudster

Layers of Security

Harvesting

Fraudster

Operational

Infrastructure

CommunicationFraud forum / chat room

User Account

Tools Hosting Delivery Mules Drops Monetizing

TransactionMonitoring

IdentityVerification

Authentication

AntiPhishing/

Trojan

Detection

Shut Down

Blocking

Intelligence

E l Ri k f A i i



Dynamically adjusted security based on:

Real time risk assessment (multiple fraud predictors, deviations user profile,Fraud Network matching and link analysis)

Organization’s risk policies

Evaluate Risk of Activity

F M I f ti



For More Information

RSA Special Online Fraud Report: What to Expect in 2009 and Beyond

RSA Online Fraud Intelligence Report: May 2009Subscribe to the RSA Monthly Online Fraud Report

Resources

http://www.rsa.com/document.asp?doc_id=10094


https://rsa-email.rsa.com/servlet/website/ResponseForm?klHEyz7.25VT.40kHNK.25VTyLnplmkHmphg



https://rsa-email.rsa.com/servlet/website/ResponseForm?klHEyz7.25VT.40kHNK.25VTyLnplmkHmphg

rsa 090617 webcast slides

Documents