Mot-clé - interview

Fil des billets - Fil des commentaires

mercredi 29 novembre 2017

Attaques APT : l'être humain doit devenir le maillon fort

Hello,

Je viens d'accorder une interview à Sécurité Off, disponible ici:

https://www.securiteoff.com/attaques-apt-letre-humain-devenir-maillon-fort/

J'espère que ça vous plaira ;-)

jeudi 20 août 2009

Infiltration d'un botnet - Cisco

Cisco a publié récemment un document très intéressant intitulé "Infiltrating a Botnet".

Nous y découvrons le travail de l'une des équipes de Cisco, lors d'investigations forensic "classiques" auprès d'un client, dans le but d'en savoir plus sur une compromission du S.I.

L'équipe de Cisco s'est vite rendue compte que de nombreuses machines du client concerné présentaient des symptômes assez alarmants, dont notamment une activité IRC sur un port exotique. Il s'est avéré qu'il s'agissait comme on pouvait le supposer d'un malware, entrant dans un schéma de botnet.

Pour rappel, le protocole IRC (Internet Relay Chat) est l'un des plus vieux protocole utilisé dans le cadre de communications entre des machines compromises (bot) et un serveur (command&control) géré par le ou les fraudeurs. Bien d'autres techniques existent, mais nécessitent plus de travail de la part des pirates. Ce protocole reste largement utilisé pour gérer des botnets "amateurs", les botnets plus professionnels déployant généralement des communications chiffrées.

Après une rapide investigation, de nombreuses machines du client ont été retirées du botnet et "assainies". L'équipe de Cisco s'est alors intéressée directement au fraudeur contrôlant ce botnet. En particulier, ils se posaient des questions sur le niveau de compétence du botmaster : était-il un "script kiddie" ou quelqu'un jouissant d'un bon niveau technique ?

Une seule façon de le savoir pour eux: après avoir surveillé le serveur IRC de contrôle du botnet en se faisant passer pour un bot, les chercheurs ont engagé le dialogue par ce biais avec le pirate. L'échange est assez savoureux. Le pirate en face semble rôdé, croyant que son interlocuteur est un autre botmaster. Du coup, il tient des propos plutôt intéressants. On y apprend que son botnet idle souvent, c'est à dire qu'il est souvent dormant, et que le pirate a récemment vendu quelques milliers de bots (800$ pour 10000 machines). L'activité majeure de ce pirate reste cependant le phishing. Le reste de la discussion tourne autour de l'underground de ce type de cybercriminalité, je vous laisse en prendre connaissance...

Je n'entrerais pas (ou si peu...) dans le troll habituel sur ce genre d'opération... Est-il éthique, pour un chercheur, de se connecter sur un serveur IRC qui est probablement hébergé sur un serveur compromis, pour aller discuter avec un fraudeur ? Les informations qui en sortent sont en tout cas intéressantes.

Enfin, s'il vous venait à l'idée de pratiquer ce genre de chose, je ne saurais que trop vous recommander la prudence : tous les botmasters ne sont pas aussi "zen" que celui présenté dans le document de Cisco. Bon nombre d'entre eux disposent de contre-mesures empêchant les chercheurs de se connecter sur leur serveur IRC, ces contre-mesures lançant généralement une attaque massive de déni de service vers l'adresse IP "suspecte", pour quelques minutes ou quelques heures...

samedi 21 juillet 2007

Spammer Interview


Macworld released an interesting spammer interview this week ... It is just confirming what I always thought : spammers became real business men...

Original link is here, but I'll copy/paste you the content here anyway :

“Ed,” a retired spammer, built a considerable fortune sending e-mails that promoted pills, porn and casinos. At the peak of his power, Ed says he pulled in $10,000 to $15,000 a week, storing the money in $20 bills in stacks of boxes.

It was a life of greed and excess, one that preyed especially on vulnerable people hoping to score drugs or win money gambling on the Internet. From when he was expelled from high school at 17 until he quit his spam career at 22, Ed — who does not reveal his full name but sometimes goes by SpammerX — was part of an electronic underworld profiting from the Internet via spam.

“Yes, I know I’m going to hell,” said Ed, who spoke in London on Wednesday at an event hosted by IronPort Systems, a security vendor now owned by Cisco Systems. “I’m actually a really nice guy. Trust me.”

A quick-witted and affable guy who wears an earring and casual clothes, there was a time when Ed wasn’t so nice. He sent spam to recovering gambling addicts enticing them to gambling Web sites. He used e-mail addresses of people known to have bought antianxiety medication or antidepressants and targeted them with pharmaceutical spam.

In short, Ed said he was “basically what people hate about the Internet.”

He spent 10 hours a day, seven days a week studying how to send spam and avoid filtering technologies in security software designed to weed out garbage e-mail. Most spam filters are effective 99 percent of the time; he aimed for that remaining window, using tricks such as including slightly different images in his spam, which can fool filters into thinking the e-mail is legitimate.

“The better I got at spam, the more money I made,” Ed said.

He would start a spam run by finding an online merchant who wanted to sell a product. Then he’d acquire a list of e-mail addresses — another commodity that has spawned its own market in the world of spam. He’d also set up a domain name, included as a link in a spam message, that, if clicked, would redirect the recipient to the merchant’s Web site, enabling Ed to get credit for the referral.

The spam would then be sent from a network of hacker-controlled computers, called botnets. Those machines are often consumer PCs infected with malicious software that a hacker can control. Ed would “rent” time on those computers from another group of hackers that specialized in creating botnets.

If one of the spam recipients bought something, Ed would get a percentage of the sale. For pharmaceuticals the commission was around 50 percent, he said.

Response rates to spam tend to be a fraction of 1 percent. But Ed said he once got a 30 percent response rate for a campaign. The product? A niche type of adult entertainment: photos of fully clothed women popping balloons.

To track the money, merchants set up a “referral sales page” where spammers can see how much they make from a spam run. Ed would log in frequently, watching the money increase. He was paid into electronic payment transfer accounts, such as e-gold or PayPal, or into his debit card account, which he could cash out in $20 bills.

That became problematic when the cash became voluminous. He says he made $480,000 his last year of spamming. But the lifestyle of being a spammer was taking a toll. In essence, he had no life.

It’s hard to go into a bar and explain your job to a woman by saying “I advertise penis enlargement pills online,” Ed said. “It doesn’t go down very well.”

He rationalized his actions by saying spamming is not like robbing someone, although the lurid impact of spam was clear. Some nine million Americans have some dependence on prescription drugs, Ed said, and he noticed that the same people were buying different drugs each month. “These were addicts,” he said.

Additionally, “the product is always counterfeit to some degree. If you’re lucky, sometimes it’s a diluted version of the real thing,” he said. Viagra is cut with amphetamines, and homemade pills are common from sketchy labs in countries such as China, India and Fiji, Ed said.

So Ed got out of the business. He’s written a book, “Inside the Spam Cartel: Trade Secrets from the Dark Side,” which he said has had some take-up in law enforcement circles eager to learn more about the spam business, which he projects will only get worse.

As broadband speeds increase, spammers will increasingly look to market goods by making VOIP (voice over Internet Protocol) calls or sending out videos, Ed said. The ultimate unsolvable problem is users, who continue to buy products marketed by spam, making the industry possible.

“I think in 10 years we’ll still get spam,” Ed said. “Be prepared to be bombarded.”