Crypto & Cyber Investigations

Transcript

[Applause] [Music] i hand the floor over to kamiah cebula from group ib clicker for you big welcome thank you very much um i'm actually quite sad that we interrupted this cool q a session because especially the slide i would like to see the research behind it it's really interesting especially considering taking into account that i'm also with a cyber security company and today i'm going to talk about the view of cyber security for cyber security company on crypto projects and the crypto industry and don't worry i'm not going to do any blaming or anything like this now he will come with all this

money laundry accusations and how they are tracking people and how people are abusing our beautiful currencies i'm not gonna do that i'm going to do something different um our company is working very closely also with financial institutions and now we are in switzerland home of so many of them and i know that many um are also among you guys so i'm going to focus on how cyber criminals used to attack financial institutions and how they are making this shift to crypto businesses and use crypto businesses as the new source of income which i think is a little bit more interesting than talking about mixers and all this kind of stuff let's try to make this comparison um about a company just a little quick so that you have a little bit of a

background we are in cyber security for about 18 years started as a company which was doing criminal investigations and then started to build up more and more services and products and also work closely with some people here in the crowds as well so the expertise is actually coming from almost 18 years of being involved in investigations and incident response work and anti-fraud work and so on and so on so i will structure a little bit like this i will first give you a little bit more details on how we look at cyber security in financial institutions and compare it to uh crypto into the crypto industry and then i will jump directly into two use cases i would like to address i don't have that much time so i will focus on

those two which i think are actually quite interesting yeah and not too generic in a sense especially the second case is something i actually find very entertaining um so i mentioned already that we are looking today at financial institutions crypto businesses a little bit in comparison what kind of attacks are we facing and we saw especially when crypto started to grow big of course um that many cyber criminals start to migrate from the crypto industry from the financial industry towards crypto industry and this has several reasons um here just focus on the left side of it don't focus on the right i will not even talk about it too much what i want to say here on this very generic slide is that financial interest institutions over very many years built

up very strong cyber security programs equip themselves with tools with solutions with everything they need to really defend from attacks from cyber criminals from everything around that and then all of a sudden comes the crypto industry has also currency which can be stolen um but the security level in the crypto projects is usually way lower than in those financial institutions which have built this up over decades of work so we see also very similar pro problems i'm not talking about the blockchain and vulnerabilities and smart contracts and anything like that i'm talking about the companies themselves um and the infrastructure which the companies are building up and which are actually vulnerable to attacks where we

see then password policies as their very simplest way um to actually express it then allow security level in general bugs and so on and so on the attack types which i would put into this category can be also seen here and they are very similar then to what we know from financial institutions now we know attacks with malware of course which we see now on crypto businesses as well we see a classical vulnerabilities which are on every i.t infrastructure you can imagine as long as you don't patch them phishing attacks very very popular of course and i guess many of you are also facing phishing attacks on your customers then i will skip of course the the blockchain

attacks we go into credential reusage i will show you a cool example for that um domain hijacking and then insider text i will also not talk about it too much today so to round this all up and prove my point the kind of infrastructure you see set up here is something what we see on both sides in a financial institution even on a simple enterprise and then of course also in crypto businesses you have a team which is vulnerable to attacks you have it infrastructure you guys are setting up you have communication and processes and then smaller subcategories among that who are subject to potential attacks and here i just built a couple of points in for each and every piece of this infrastructure

and how it can be let's say subject to attacks you see that some of the topics are of course repeating you see fishing in many places because fishing is so general and you can do it against everyone in the company but then also some other attacks which are relevant yeah so just i tried to draw for you this picture that it's not only the blockchain which is which can be abused or can be under attack but it's actually all the infrastructure you're building with your colleagues with your servers you have sitting around and with all everything around that i'll skip this let's go to the first use case from this so now when we talk into accounts that there is more than just a blockchain in your infrastructure we look at for example portals

many of you with your businesses have portals online portals like banks have e-banking portals you have your portals where maybe you can make financial transactions a crypto exchange is the easiest um example for this kind of setup for this kind of infrastructure and those portals can also be subject to attacks just like e-banking portals yeah many of you or know all the social engineering attacks which are happening especially against the elderly when someone is calling you up tries to hijack your accounts with very many different means this can also happen here and there are many many different other types of attacks which we are witnessing in the financial industry for very many years and now we see them showing up in the crypto industry where again financial

institutions have anti-fraud solutions set up they have teams specializing on fraud they have they are equipped to defend from this kind of attack so do analytics on user sessions and everything around that in stelio's presentation was also a little bit mentioned starting with kyc then also user behavior analysis maybe device intelligence and things like that um let's go to the first example just to make it a little bit more visible simple accounts takeovers account takeover means that someone um a criminal is trying to take over the account of a legitimate user simple as that and then they are trying to do fraud with it to learn the money even in banks of course not only with crypto it's not about the currency here

it's about any currency you can use right you can steal it you can launder it you can move it you can use it for every sort of other purposes here we have a case where we are doing for example device intelligence we're looking at devices and behavior analysis um stelios also mentioned a little bit of that in this case you see that tons of those little screens which you see there are all fake devices which are actually ruled by and in the middle you see a fingerprint and a geo yeah from one actually a device major device which is pretending to be many devices and is sitting in the same place and all the little faces you see around there are then user accounts yeah so someone is from one device creating many

devices and accessing many many user accounts why is he doing that there is no legitimate purpose for this kind of behavior so he is definitely trying to do that to do something like stealing currency again moving it or doing whatever else with it and this is something what we see showing up in the crypto industry of course as well because the users there your users are not your companies but the users of your business um they are not so strong with password policies and everything um they reuse passwords which have been leaked somewhere in the past and then they are just guys sitting taking on all these passwords which have been leaked somewhere and try them on other platforms right and then they get in sometimes they need to go around a

second factor not in every crypto business we see a second factor in a banking industry you usually see it so you see that banks again build more prevention here um we can take this into a different level with credential stuffing for example when you would like to use a bot about who's automating all this in the previous picture we had a guy who was really manually typing in all those accounts access them and then did something with them with bots you can automate it you can take a list of logins and passwords and just try them over different kinds of platforms with a single bot which is doing this in an automated fashion so you don't need to do it with your own hands in a financial industry they are defending with anti-bot solutions for

example um they can see selenium for example being used or phantom gs or any sort of other botting technology and can start to prevent it in the crypto industry it makes also sense to do that here we have another case with account farming which is out of your industry inside the crypto industry actually from one of our customers um somebody or a team of people again every screen you see there is a device being used and then you see a fingerprint which means that there is one fingerprint device who is creating fake devices if you look into on the lower fingerprint here you see that he is using actually two fake devices yeah

the next one also two fake devices and then you see the faces in there and the faces are user accounts so those three six 11 fake devices with only four fingerprints are actually using in this case 25 accounts why are they doing it they actually created those accounts and then started to send currency from one account to the other and to raise the reputation of the accounts in the platform to grow a reputation in this business case it actually makes sense the more transactions you have the more communication you have and feedback from other users on this platform the higher your reputation is the more reliable you are on the platform and then of course when you raise your reputation to a

certain level you cannot start to conduct fraud in this particular business case yeah so i cannot disclose which business case it is um to not disclose uh who is affected by this but yeah it is possible yeah so you see a very interesting case which is not working on financial institutions but then on crypto um second use case yeah let's brief a little bit i know i'm talking very fast because we don't have so much time second use case fake crypto businesses here i would compare it's because many maybe most of you guys know the um the social engineering attack done on behalf of microsoft when a microsoft support engineer is calling you and

saying like hey we see that your device is infected with something we would like to clean it and then instead of actually cleaning the device they make you install a remote access tool which then the process are using to steal whatever you have there yeah we see we saw a very interesting case and we are investigating it so i cannot disclose too many details of this investigation that's just the case topics so we have something which we call fake crypto terminals a case maybe some of you guys know this actually um we call the threat actor treasurers or coin tracer there's actually a typo it should be called coin tracer i built this presentation one and a half

days so very short term forbid me for my mistakes um and here you see a couple of screenshots they look actually quite good right looks like solid landing pages good landing pages some business being built up um so the fraudsters actually build materials like this the landing pages but also marketing materials feedback on different feedback sites and so on and so on so they try to build actually a fake business and then they did this let me just read it a little quick this is a message on i think it was telegram or whatsapp um they are texting crypto influencers crypto investors and try to uh buy advertisement for them right so here it

says good afternoon we want to order advertising from you we are not competitors we have a cool tool very useful and convenient terminal for traders how much would it cost we are interested in video format perhaps a recommendation we have allocated a good budget in this case between one and three bitcoins depending on how many followers this influencer for example has for advertising thank you for the feedback and then they send the link to their site coin tracer in this case you can download marketing materials there you could google it and get feedback about this company so it looks actually very very legit and then some of those influencers would actually

agree so they would get um a file sense to actually set up this this kind of solution on their devices and the solution was actually a trojan so those guys took actually the effort and the time to build a fake business make it look very legit to just then distribute a trojan malware and they even paid so sometimes they paid in advance like a bitcoin or two in advance to those influencers because they knew that they would steal more in the end yeah and then um they installed this trojan and destroying could actually do everything um they wanted it could uh they could take over the device of the victim they could just record everything what is happening on the screen take

screenshots from there they immediately got all the login password combinations they could steal second factors for transactions because they are on the device it's very easy they could do everything they want on this device and with this they stole tons of money we think it's around the millions um in u.s dollars in the end because they could steal not only a cryptocurrency they could also steal from uh bank accounts because again they have all accesses and they can steal a second factor also in this in this whole trip yeah so quite an interesting way actually to infiltrate victims and then to um to steal and do criminal activities what we did here in this case is we started to investigate and this is all i

can disclose this is a little glance on the infrastructure of those guys so you see the domain coin tracer you see connections to a certain geolocations to certain registration data and more domains being registered in the same kind of way so we looked into this a little bit deeper what else are those guys actually registering and then we found more and more businesses which the fake businesses which they have created so again landing pages marketing materials and things like that in this case we see here some as far as i remember some crypto taxes exactly some crypto taxes crypto tax software which you can just download on the website and when you download it there is actually a

trojan entity and you are infected as well and they can again conduct activities right so it's more kind of a scam using malware than a direct attack on users of a particular business but a general attack on the crypto industry in this case in the sense right um then another business which we have found um it's it's launched actually in russia but we see it developing in other countries now as well so that's why the slot uh the screenshot on the left side is still in russian language they are generating fake transaction confirmations um why would they do that there are platforms where you can buy stuff with cryptocurrency marketplaces

um many sort of use cases where a transaction confirmation can actually help you to conduct fraud like hey i bought this from you here is the transaction confirmation from my platform i send you the currency sent me that either the currency i'm buying or the product i'm buying or whatever it is and on this way they steal then funds which is also then a different kind of approach you have to do a lot of social engineering when you have this so you have basically a transaction confirmation and with this you try to conduct fraud and here you have a description in in russian of um explanation how to use actually their tool and they have a website where they actually share which kind of steps you

have to take to get this confirmation and then also use cases like our advice if you want to conduct fraud with it this is how you could do it and then they describe actually in a very nice way how it is possible and of course you pay for every transaction confirmation so they are not doing it for free they also want to make money in the end so you pay for the confirmation which they are generating for you and then you have to make somehow money with it being a scammer we see this kind of approach not only for uh for crypto we see it also in fiat currency and attacks on marketplaces where they create those fake transaction confirmations and also conduct fraud um in both areas um the average age of the scammers who are using those

confirmations is between 12 and 16 years yeah so they are actually very very young for them it's just like i'm making some extra care some pocket money for them it's a game it's just fun to do that yeah they write victims like hey i bought this cupboard from you here's the transaction confirmation send it over and then sometimes they do it and they receive this kind of stuff there's then another step to it where fraudsters are offering an escrow service a fake escrow service so you would as a seller of a product receive receive an email and in the email you have a link like hey

the user already paid for your product you can go here and receive the funds and then they go on a link land on a domain and there they are asked to put in their credit card credentials so that they can receive the money um and then even the otp comes in and said like oh to receive your funds please put in your otp but instead of receiving funds the funds go out of your credit cards you're paying for something and then they take it to another level where they do a second step because the seller is then complaining like hey i went to the escrow side but instead of receiving money i lost money what is going on and then the scammer contacts you and says oh yeah that was a mistake in the platform use the link again now it should work

yeah okay everyone understood where this is going yeah so they they scan people even two times with it and we see this it started actually on online marketplaces but now we see it also inserting crypto projects as well yeah so for today i think this is enough time my time is up um thank you for your attention it was nice to speak in front of a big audience again after such a long time if you have questions please feel free to ask thank you so much