Posté par: igor51 le mars 26, 2017, 09:01:24
[html]
Introduction
Brazil has been designated a major hub for financially motivated
eCrime threat activity. Brazilian threat actors are targeting domestic
and foreign entities and individuals, with frequent targeting of U.S.
assets. The country routinely places in "Top Five" lists of
various global cyber crime rankings, and multiple sources claim that
financially motivated threat activity in the country has increased
within the past few years.
In this blog we provide insight into the tactics, techniques and
procedures (TTPs) of a Brazilian cyber crime group that specializes in
payment card fraud operations. The threat actors, observed by FireEye
Labs, use a variety of different methods to either compromise or
acquire already compromised payment card credentials, including
sharing or purchasing dumps online, hacking vulnerable merchant
websites and compromising payment card processing devices. Once in
their possession, the actors use these compromised payment card
credentials to generate further card information. The main methods
used by the observed group to launder and monetize illicit funds
include online purchases of various goods and services as well as ATM withdrawals.
Based on extensive observation of this group's activity, we are able
to characterize their operations lifecycle starting with the initial
operational setup; followed by the methods used to compromise
credentials or, conversely, purchase already compromised credentials;
then the process of generating new cards for subsequent abuse, which
includes validation and cloning; and finally the subsequent
monetization strategies. Figure 1 depicts this operation workflow.
Figure 1: Brazilian carding operation workflow
Phase 1: Setting Up the Workplace
We observed this group taking several preparatory measures to
maintain anonymity.
The members of the group use a variety of tools, including CCleaner,
on a daily basis to effectively remove any evidence of their
operations. This includes browsing history, temporary files,
Clipboard, typed URLs, cookies, recently opened documents, and
conversations via Skype, Windows Messenger, etc. This almost certainly
limits the potential amount of evidence that law enforcement could
obtain and use against the suspects in the case of an arrest or
property search.
Another common step taken by threat actors is changing their
system's MAC Address to avoid being uniquely identified. For this
purpose, these actors often use tools such as Technitium MAC Address Changer.
We have observed these actors using Tor or proxy-based tools similar
to Tor (e.g., UltraSurf, as seen in Figure 2). We have also observed
them using virtual private network services that use IPs based in
numerous countries to ensure anonymity and obfuscate criminal operations.
Figure 2: Ultra Surf 12.10
Additionally, many actors conduct transactions using virtual
currencies, most prominently Bitcoin, to anonymize criminal
transactions. Due to the comparative anonymity and lack of government
oversight often associated with the use of virtual currencies, virtual
currency is of significant value for actors involved in illicit
operations when they are performing transactions among themselves.
Phase 2: Data Acquisition
Based on our observations, this group uses a variety of different
methods to either compromise or acquire already compromised payment
card credentials.
Payment card "dumps" are commonly shared amongst Brazilian
threat actors via social media forums such as Facebook, Skype, and
web-based WhatsApp messenger. These social media circles are highly
prevalent amongst these regional actors and are often the preferred
method of communication. This group takes advantage of those
communities to obtain stolen data from peers. Similarly, the group
takes advantage of freely available consolidations of email
credentials, personal information, and other data shared in eCrime
forums for fraud purposes.
The group systematically purchases payment card data via different
online shops. These shops include "Toy Store," "Joker's
Stash," and "Cvv2finder." The venues, called "dump
shops," allow customers to use a web-based platform to sort
through thousands or millions of individual pieces of card data and
purchase as much or as little as they want. The shops provide
customers with filters to select the individual pieces of card data
they wish to purchase and add to their carts for checkout, similar to
legitimate sites. The same types of shops also allow malicious actors
to steal credentials stolen from other services such as email
providers, online bill payment websites, entertainment services, or
travel booking websites.
These actors scan websites for vulnerabilities to exploit to
illicitly access databases. They most commonly target Brazilian
merchants, though others use the same tactics to exploit entities
outside Brazil. One simple method the group uses is Google Dorks,
advanced Google searches used to identify security loopholes on
Google-indexed websites. An example is shown in Figure 3.
Figure 3: Example of Portuguese-language Google
Dork used in exploitation
The group also uses the SQL injection (SQLi) tools "Havij
Advanced SQL Injection Tool" and "SQLi Dumper version
7.0" (Figure 4) to scan for and exploit vulnerabilities in
targeted eCommerce sites. Of note, these tools can dump whole
databases from targeted victims.
Figure 4: SQLi Dumper v7.0
This group has also shown interest in modifying point-of-sale (POS)
terminals to harvest magnetic stripe and EMV chip data.
"Toy Store"
FireEye Labs identified "Toy Store"