1. No category

Dolla Dolla Bill Y'all:
Cybercrime Cashouts
Benjamin Brown
Akamai Technologies
Who I Am
Benjamin Brown
Akamai Technologies
-  Darknet and Cybercrime
Research
-  Security Incident Response
-  System Architecture Reviews
-  Security Training and Workshops
Main Topics
• 
• 
• 
• 
• 
• 
• 
• 
Contextual Overview
Non-Fiat Currencies
Carding 101
Tangible Goods
Keeping it Digital
Importance of ID
Loan, Tax, and Medical
eLaundering
Contextual Overview
• Cybercrime
• Carding
• Identity Fraud
• Laundering
Contextual Overview - Actors
In-Scope:
•  Carders and Low/Mid Level ID
Fraudsters
Out-Of-Scope:
•  State-Backed Actors / Major
Organized Crime
Non-Fiat Currencies
Why Should We Care
•  Canada
– Past 5 Years: ID Theft Tripled
– 2010 to 2014 ID Fraud +42%
•  U.S. (2014)
– $16 Billion | 12.7 million consumers
– New ID Fraud Victim Every 2 Secs
Carding 101 - Skimming
Carding 101 - SQLi
Carding 101 – Machine Comp
Carding 101 - PoS
Carding 101 – Buy Them!
Tangible Goods
Tangible Goods
Tangible Goods
•  Receiving / Sending Goods
– Expose Home / Business Address
– Postal Office Box
•  Requires ID, Cameras, Employees
– Abandoned ‘Drop’
•  Will They Deliver? Mail Forwarded?
– Mules
•  Steal / Flip On You
– Controlled Deliveries!
Keeping It Digital
•  Rewards Programs
– Retail, Travel, Hospitality
• Vouchers
– Easily Transferrable
– Often Do Not Expire (Class-Actions)
• eGiftCards
– Easily Transferrable
– Good As Cash (No Restrictions)
– Many Outlets To Resell
Keeping It Digital
Keeping It Digital
Keeping It Digital
Keeping It Digital - Malware
Keeping It Digital - Phishing
Keeping It Digital - Bruting
Keeping It Digital - Bruting
Keeping It Digital – Checkers
Keeping It Digital – Checkers
Keeping It Digital – Bonus!
•  More CCs!
•  Personal Info
– Addresses, Phone #s, etc.
•  Cross-Program Fraud
•  Done? Sell The Account!
Importance of ID - Auth
•  Knowledge-Based Auth
– Resetting VBV/ MC SecureCode
– Security Qs For Acct Access
– Credit History Qs For Creation
• Past Phone #s and Addresses
• Valid National ID Number / Passport
Importance of ID - Services
Importance of ID - Exchanges
Importance of ID - FULLZ!!
Importance of ID - FULLZ!!
Importance of ID – Proof of ID
Reddit!
Importance of ID
•  CCs Easily Burned
•  Longer-Term Schemes
•  More Types of Fraud
•  Complementary Fraud
•  Bigger Payouts
•  Built-In Scapegoat
Loan Fraud
•  Personal or Business
•  Student Loans
•  Mortgage and Title Fraud
•  Cash Advances on Credit
•  Completely Online Loans
Tax Fraud
•  Tax Refund Interception
•  Digital – H&RBlock / TurboTax
•  Pose As Canadian Revenue
Agency (CRA)
– Demand Payment / Get PII
Medical Fraud
•  Fake Clinic
•  Collusion With Care Provider
–  Cut of Fraudulent Billing
•  Uncovered Individual
•  Sidestep Prescription Limits on
Controlled Substances
Medical Fraud – Medi Fullz!
Wash Them Bills
Wash Them Bills - Fiverr
Wash Them Bills - Freelance
Wash Them Bills - No Soul
•  Start a Charity!
– Bonus Points: SSL Icons Everywhere
– Hard Mode: Submit a T2050
– Start a Church
– Start a Political Action
Committee (PAC)
Wash Them Bills - No Soul
Wash Them Bills - Webshop
Wash Them Bills – Bank Drop
Wash Them Bills
Wash Them Bills – BTC Card
Defenses
En Guard – Gen PII Holder
•  Encrypt
– At rest & In Transit
•  Don’t Ask For Unneeded Info
•  Don’t Be A Hoarder
•  “Anonymized Data” Is Hard
En Guard – Rewards
•  Rate Controls
•  Unique IDs, Passphrases
•  Two-Factor Auth
•  Anomaly Detection
– Geo, Info Changes, Acct Use
En Guard – PoS
•  Encrypt (in transit and at rest)
•  Secure Hardware Access
•  Segment Wifi / Wired
•  Web Presence
– WAF, Prepared Statements,
Sanitization, Business Logic
En Guard – Loans
• Require Conversation!
• Flag on VOIP Numbers
• Flag on Particular Geos
• Throw Curveball Qs
En Guard – ALL
•  Security Training
– Social Engineering
– Current Trends In Fraud
– Clear Escalation Paths
En Guard – Personal
•  Don’t Save Info
•  Check For Skimmers
•  Use VPNs
•  Hold PoS Accountable
•  Credit / ID Watch
En Guard – Personal
•  Don’t Reuse Creds
•  Rotate Creds
•  Security Questions
– Don’t Put on Social Media
• Adversarial Mindset!
En Guard – Personal - Post
•  File Police Report
•  Set Fraud Alert From Credit
Reporting Agencies
•  Replace Cards
– For Health, DL, SIN call
1 800 O-Canada
Questions?
BBROWNTALKS@GMAIL