Cybercrime Flashcards
What are the types of bad actors in the cybercrime world?
Who are the actors? Exploit developers Botnet masters Spammers Phishers Bulletproof Hosting Providers Counterfeiters Carders, Cashiers, Mules Crowdturfers
Explain the difference between the old market for exploits and the new market for exploits on the black market
In the past, the same party that does the compromising is the same party that makes the money - create exploits, hack the machines, and make money by themselves
Today, the bad guys specialize in different functions. Today some create the exploits and sell them; the buyers purchase the exploit and use them to make more money; etc.
Compromised computers also sold on the black market to launch attacks on other targets
What is the deep web, dark web, and surface web
deep -> it is not indexed on standard search engines
dark -> web content that exists on darkness
surface -> readily available to the public; and searchable with standard search engine
A program that hides malicious code from anti-virus software
Crypters
Trojan Download Manager
Software that allows attacker to update or install malware onto victims computer
Black Hat Search Engine Optimizer
Increases traffic to attackers site by manipulating search engines
Doorway pages
A webpages that list many keywords, in hopes of increasing search engine ranking. Scripts on the page redirect to the traffic page.
What are two characteristics of spam?
Inappropriate or irrelevant
Large number of recipients
What key roles do spammers play in the cybercrime world?
Build, curate, buy and sell email addresses
Send mail on behalf of other actors for free
Traffic PPI services looking to acquire traffic or infections for free
Phishers look to steal personal information for free
What was the percentage of revenue became profit for the scammers in the study?
Only 16%; this indicates that there are many costs affiliated with scamming
Name areas of scam infra where law enforcement can easily act:
- DNS servers
- Web servers
- Merchant bank accounts
How do spammers send such large bulks of emails?
Rent access to botnets or use botnets in house
Explain random domain generation used in C&C architecture. Why Is it so difficult to stop?
Bot masters also use random domain generation because it would be easy for security teams to block the C&C domain despite the fact that it can move between IP addresses. This makes it more difficult to block a single domain.
