Ruslan Rakhmetov, Security Vision
In today's reality, the concept of ‘hacker’ is becoming more and more distant from the original definition of a first-class technical specialist who deeply understands the principles of software and hardware operation. Nowadays, most hacks are not committed by enthusiastic researchers who want to understand how the defence of a particular information system works. Modern hackers are no longer talented loners, but financially or politically motivated cybercriminals, members of cybercriminal APT groups, hacktivists, cyber spies and soldiers of pro-government cyberarmies. In this article, we will try to look at IS issues through the eyes of attackers to understand who is performing customised cyber hacks and why.
The current cybercrime monetisation scheme is such that in some aspects it resembles a marketplace - there are offers, prices and customers. The most common offers include illegal hacking of email, social networks, and messengers. These services are rendered under the guise of ‘restoring access’ to accounts, and they are of interest either to competitors or business partners, but most often to ordinary citizens who, for various reasons, want to gain access to the messages of their friends, relatives and close friends. If we categorise the purposes of such custom hacks, we can distinguish the following groups:
1. Personal accounts of ordinary users in social networks and messengers. If the user is not a public figure (artist, blogger, athlete, etc.), then the hacking of his account may be of interest, first of all, to a narrow circle of close people. If the account is monetised in some way (for example, through a promoted YouTube channel or a channel in Telegram), then the goal of hacking customers may be to steal this media resource for profit, quick resale, advertising, sending viruses, spam or fraudulent messages to deceive the audience. The cost of hacking such accounts can be 2-5 thousand rubles - this is the amount that curious partners and jealous spouses can afford.
2. personal accounts of top managers, business owners, politicians. Such accounts are often a more effective lever to influence the audience: for example, fake news about a ‘new investment scheme’ posted on behalf of a major businessman will have a wider audience reach. In such cases, the fraud can generate a good income for the hackers - from mass collection of personal data to receiving money from gullible subscribers who hoped for a lucrative investment. In addition, such a hack with the placement of fake or even illegal information can cause a serious blow to the reputation of managers and owners of companies, which will have an impact on the organisation itself. For ‘customers’ of such hacks, hackers set a price based on the prominence of the attacked person - but only if the hired cybercriminal understands who the target account belongs to.
3- Business accounts of companies and brands. Brand promotion in social networks and messengers has long become routine, and SMM-specialists of companies, who often run corporate blogs and social networks from personal devices and do not involve employees of IS-departments in the protection of such accounts. As a result, the security settings of the social platforms used may not be optimal: for example, the most common mistakes are unconnected two-factor authentication, SMM-specialist's personal email as an address for restoring access, open web sessions on various devices, including personal unprotected laptops. Such business accounts attract attackers: due to the described errors, they are easy to hack, and multi-million audience reach leads to quick monetisation of the attack. For example, posting information about allegedly new payment details on a brand's official but hacked social media page will lead to customers sending money to fraudsters. Similarly, posting a link to a ‘new version of the app’ will lead to a rapid increase in the number of infected devices, and the ‘news’ of a company's bankruptcy could seriously undermine its credibility. Hacking such a business account is much more expensive than attacking a regular account and can cost tens of thousands of rubles.
4. Corporate accounts. Accounts for access to email, corporate messengers or for remote access to company infrastructure are targeted by competitors, serious cybercriminals or cyber spies. Although APT groups and cyberarmies also have their own resources to carry out an attack, they may in some cases ‘outsource’ this task to so-called cyber mercenaries who hack for money. Moreover, the division of cybercriminals' “specialisations” has led some of them to focus specifically on obtaining credentials, which they then sell to other cybercriminals on Darknet trading platforms. Thus, a whole illegal business is built around the sale of corporate credentials, and the cost of hacking can be up to several tens of thousands of dollars.
Let's look at the main methods used by attackers in customised hacks:
1. Phishing. The easiest, cheapest, and most effective way to compromise an account is still phishing. In the simplest, which has become a classic case, the user receives an email or messenger message about the alleged need to confirm the account to avoid blocking with a link to a phishing web page that looks identical to the real resource, but is hosted on a domain owned by the attackers. This page asks the user for a login and password (and a one-time code in the case of multifactor authentication), which are then used by the attackers or given to the ‘customer’ of the hack.
2. Password selection. Bruteforce (password selection, including password dictionary) and Credential stuffing (using passwords from published data leaks) techniques allow attackers, with proper persistence and a certain amount of luck, to obtain valid credentials.
3. Cookie and web token theft. Web tokens or cookies rather than credentials (login and password) can be used to gain access to an account, and various web attacks on services and clients (e.g., XSS, CSRF, XXE, etc.) are used to obtain them. This type of attack is more difficult to implement, but as soon as a specific vulnerability appears on a web resource, it is exploited en masse, which makes the attack easier.
4. malware exploitation. This type of attack involves infecting the device of the attacked user with various types of malware - remote access Trojans, keyloggers, infostealers, etc. Once the virus ‘settles’ on the victim's device - on a PC, laptop or smartphone - it starts collecting information that the user saves in browsers or enters on the keyboard (including logins and passwords). This data is then archived and sent to the hacker, who only has to pass the access data to the ‘customer’ of the hack.
5. Compromising the communication channel. This type of attack is quite difficult to implement, but is common in corporate account hacking. Most often, attackers create a fake Wi-Fi hotspot, which is placed not far from the office (for example, in a minibus in the nearest car park). Then, the name of this hotspot is changed to the name of the attacked company's Wi-Fi network, and the real corporate wireless network is ‘jammed’ by multiple fake requests. As a result, employees connect to the fake Wi-Fi network and their devices start synchronising emails and messengers, passing all traffic through the attackers' equipment. As a result, with insufficiently strict security settings for corporate communication systems, attackers will be able to obtain corporate credentials.
6. SIM card reissuance. The SIM swap technique has been used by attackers for more than 10 years: attackers either collude with employees of mobile phone shops or forge a power of attorney on behalf of the victim to reissue the SIM card. As a result, the victim's SIM card stops working, and all confirmation codes to restore access to the account are sent to the reissued SIM card. This technique, however, is quite dangerous and difficult for the attackers due to the necessity of personal visit to a telecom salon and forging a power of attorney with valid passport data of the victim.
7. Using fake IDs of law enforcement officials, forged warrants and decrees. Top-level fraudsters may use fake IDs of law enforcement officials, forged warrants and decrees to ‘officially’ gain access to certain information - for example, the content of social network correspondence or email correspondence. Fake requests for information to the administration of email services or social networks can be sent in a variety of ways, but the most desperate attackers use fake IDs when making personal visits to various organisations that can provide the victim's data.
On the Darknet and in messengers you can find many adverts for such hacks to order: attackers guarantee the result and boast of extensive experience in such illegal activities. Of course, both the hacks themselves and the use of stolen information are illegal, which is what some scammers take advantage of, taking an advance payment from potential ‘customers’ and then disappearing with the money - victims of such deception will not complain to the police. In addition, some attackers accept an order to hack an account without prepayment, then look for the required information in the many published data leaks, and if they do not find it, they simply refuse to continue the work. However, given the large amounts of credentials already published in the public domain and the fact that users often use the same passwords on different sites, this technique is becoming increasingly effective for attackers, despite its simplicity.
