Recommandé
Recommandé
Contenu connexe
Similaire à Social Engineering and Banking Trojans: How Criminals Manipulate Users
Similaire à Social Engineering and Banking Trojans: How Criminals Manipulate Users (20)
Dernier
Dernier (20)
Social Engineering and Banking Trojans: How Criminals Manipulate Users
- 1. Social Engineering in Banking Trojans Attacking the weakest link Jose Miguel Esparza Mikel Gastesi
- 2. Agenda • Social Engineering?? • Social Engineering + Malware • HTML Injections • Underground Market • Solutions??
- 3. Social Engineering?? • The art of… – … knowing how to handle people
- 4. Social Engineering?? • …or how to manipulate them
- 5. Social Engineering?? • …to Achieve an Objective – Information gathering – Buildings / Rooms access – Power – Material possessions – Others: flirting, favors…
- 6. Social Engineering?? • …to Achieve an Objective – Information gathering – Buildings / Rooms access – Power – Material possessions – Others: flirting, favors (sexual or not)…
- 7. • How? – Face to face – Phone / SMS – Mail – … • Used by – Politicians – Salesmen – Delinquents / Fraudsters – You and me Social Engineering??
- 9. Social Engineering?? • Take advantage of human nature – Feelings / emotions / state of mind – Behavior / personality
- 10. Social Engineering?? • Take advantage of human nature – Feelings / emotions / state of mind • Sadness • Fear • Rancor • Embarrassment • Happiness • Love • Hope – Behavior / personality
- 11. Social Engineering?? • Take advantage of human nature – Feelings / emotions / state of mind – Behavior / personality • Curiosity • Inocence • Honesty • Generosity • Gratitude • Avarice
- 12. Social Engineering?? • Take advantage of human nature – Feelings / emotions / state of mind – Behavior / personality • Tendency to trust
- 13. Social Engineering + Malware
- 14. Ransomware
- 15. Ransomware
- 16. Ransomware
- 17. Ransomware
- 18. Fake Antivirus
- 19. Banking Trojans • Images Overlapping • GUI Applications • Pharming • WebFakes • HTML Injections
- 20. Banking Trojans • Images Overlapping • GUI Applications • Pharming • WebFakes • HTML Injections
- 21. Banking Trojans • Images Overlapping • GUI Applications • Pharming • WebFakes • HTML Injections
- 22. GUI Applications
- 23. GUI Applications
- 24. Banking Trojans • Images Overlapping • GUI Applications • Pharming • WebFakes • HTML Injections
- 25. Banking Trojans • Images Overlapping • GUI Applications • Pharming • WebFakes Phishings • HTML Injections
- 26. Banking Trojans • Images Overlapping • GUI Applications • Pharming • WebFakes • HTML Injections
- 27. HTML Injections
- 28. HTML Injections
- 29. HTML Injections VS WebFakes
- 30. Injections – How they work (I) • Trojan – Binary • Generic – Keylogging, form-grabbing, etc. – Stealing data silently – Configuration file • Specific affectation – Custom attack to entities – User interaction
- 31. Injections - How they work (II) • Configuration – Injecting where? – Injecting what? – Injecting when? • Flags: G,P,L
- 32. Injections - How they work (III) 1. URI found? 2. Obtain webpage 3. Find starting mark 4. Injection 5. Copy from the ending mark 6. Obtain data thanks to formgrabbing
- 33. Injections – How they work (IV)
- 34. Authentication Virtual Keyboard Code Card OTP Token SMS : mTAN PasswordID + 2FA
- 35. Bypassing Authentication • ID + Password + Operations Password
- 36. Bypassing Authentication • Virtual Keyboard – Injection is not necessary here
- 37. Bypassing Authentication • 2FA: Code Card
- 38. Bypassing Authentication • 2FA: SMS – Cheat on the user to infect his mobile phone • Always after login • Security Software simulation • Activation simulation • Profit from the ignorance of the threat
- 39. Bypassing Authentication • ZeuS + Mobile Component (I)
- 40. Bypassing Authentication • ZeuS + Mobile Component (and II)
- 41. Bypassing Authentication • SpyEye + Mobile Component (I)
- 42. Bypassing Authentication • SpyEye + Mobile Component (and II)
- 43. Bypassing Authentication • 2FA: Token – MitB Attack It is NOT Social Engineering • Mobile Transfer warnings? – Let’s play “Simon says…” Demo
- 45. Affected Sectors
- 46. Underground Market • Binaries Market • Injections Market – Standardized – Single Injections – Full-package
- 47. Underground Market • Binaries Market • Injections Market – Standardized ZeuS & co. / SpyEye – Single Injections – Full-package
- 48. Underground Market • Binaries Market • Injections Market – Standardized – Single Injections • Per countries and entities • 60 WMZ/LR (WebMoney / Liberty Reserve) • Package: 700-800 WMZ/LR • Update / Modification: 20 WMZ/LR – Full-package
- 50. Underground Market • Binaries Market • Injections Market – Standardized – Sólo inyecciones – Full-package • Botnet Renting + Injections • $400??
- 52. Underground Market • How do they create them? – Obtaining legit code from the banking pages – Injection creation – Testing
- 53. Underground Market • How do they create them? – Obtaining legit code from the banking pages – Injection creation – Testing
- 54. Underground Market • Obtaining legit code from the banking pages – Manual • Login + Dumping pages
- 55. Underground Market • Obtaining legit code from the banking pages – Automatic • Specific modules • Configuration file
- 56. Underground Market • Obtaining legit code from the banking pages – Automatic • Specific modules – Tatanga • Configuration file
- 59. Underground Market • Obtaining legit code from the banking pages – Automatic • Specific modules • Configuration files – ZeuS – SpyEye
- 61. Underground Market • How do they create them? – Obtaining legit code from the banking pages – Injection creation – Testing
- 62. Underground Market • How do they create them? – Obtaining legit code from the banking pages – Injection creation SOCIAL ENGINEERING!! – Testing
- 63. Underground Market • How do they create them? – Obtaining legit code from the banking pages – Injection creation – Testing • Login • Screenshots • Video Tatanga, Citadel
- 64. • Detection / Prevention • Information / Trainings • Common sense Solutions??
- 65. • Detection / Prevention – Client • Check HTML structure (DOM) – Server • Additional parameters • Dynamique pages Avoid locating injection point Solutions??
- 66. • Detection / Prevention Solutions??
- 67. • Detection / Prevention • Information / Trainings • Common sense Solutions??
- 68. • Detection / Prevention • Information / Trainings • Common sense Solutions??
- 69. • Detection / Prevention • Information / Trainings • Common sense…is not so common Solutions??
- 70. Conclusions • If the user can make a transfer you will always be able to cheat on him and change the destination of the money • How would you cheat on the user by phone? Do it after the login, use a fake webpage, or even call him!
- 71. Questions??
- 72. ¡¡Thanks!! Mikel Gastesi @mgastesi Jose Miguel Esparza @EternalTodo