Inside the SCAM Jungle:

Transcription

1 Inside the SCAM Jungle: A Closer Look at 419 Scam Operations Jelena Isacenkova Olivier Thonard Andrei Costin Aurelien Francillon Davide Balzarotti

2 Nigerian Scam Trap 2

3 Nigerian Scam Trap 3

4 Spam vs. 419 Scam 419 SCAM SPAM High-volume Highly dynamic infrastructure Automated sending Trap victims through engineering Low-volume Hide behind webmail accounts Manual sending Trap with social engineering techniques effort Contact with victims over URLs Contact with victims via s and/or phone numbers 4

5 Why we study campaigns The goal: identify and characterize 419 scam campaigns find predictive scam features Our assumptions: Scam is likely sent in campaigns, like Spam s and phone numbers are personal scammer assets (Costin et al., PST'13) => linking features 5

6 Outline Dataset Methodology Experimental results Conclusions 6

7 Dataset 7

8 Dataset Public data from 419scam.org From January 2009 till August ,761 scam messages 12 countries (Europe, Africa and Asia) 34,723 unique addresses 11,738 unique phone numbers 8

9 Scam origins by phone numbers 9

10 Scam origins by phone numbers Nigeria 30% Benin 14% South Africa 5% 10

11 Scam origins by phone numbers Nigeria 30% UK Personal Numbering Services (PNS) Benin 14% South Africa 5% 11

12 Scam origins by phone numbers Nigeria 30% UK Personal Numbering Services (PNS) Benin 14% Spain 4% Netherlands 3% South Africa 5% 12

13 Data categories 13

14 Methodology 14

15 TRIAGE Security data mining framework (Thonnard et al. at RAID'10, CEAS'11, RAID'12) Multi-dimentional clustering Links common elements together forming clusters/campaigns 15

16 TRIAGE, part 2 16

17 Experimental results 17

18 Campaigns 1,040 campaigns identified, with at least 5 messages each Top 250 campaigns on average: Long and scarce: last for one year and have only 28 active days Small (38 s): keep low-volume, could be unorganized Use 2 phone numbers Use 6 Reply-To addresses Use 14 From addresses 18

19 Re-use of s and phones 19

20 Re-use of s and phones Being re-used on average 2,5 months Being re-used on average 6 months 20

21 Examples 21

22 22

23 Main traits: Single phone number Two campaign topics Long lived 83 s 23

24 Fake lottery 1 year 24

25 Eskom generates approximately 95% of the electricity used in South Africa and approximately 45% of the electricity used in Africa., - Escom

26 Different topics over time Main traits: Topics change Monthly package of s Single phone number 58 s

27 Different topics over time Main traits: Topics change December January Monthly package of s Single phone number 58 s November February March

28 iphone campaign Main traits: One topic Two phone numbers Big re-used package 190 s

29 Macro-clusters Link strongly connected clusters into loosely connected Linked through s and/or phone numbers 62 macro-clusters, 195 inter-connected clusters 29

30 Top macro-clusters Some are organized groups operating on international scale Fake lottery scam is primarily run by scammers located in Europe that are connected with African scammer groups 30

31 Clusters by countries Majority of unclustered data present isolated African actors => unorganized Macro-clusters cover African and many European actors => bigger organized groups covering Western markets 31

32 Clusters by countries Unclustered: stealthy or isolated scammers Majority of unclustered data present isolated African actors => unorganized Macro-clusters cover African and many European actors => bigger organized groups covering Western markets 32

33 Clusters by countries Unclustered: stealthy or isolated scammers Majority of unclustered data present isolated African actors => unorganized Macro-clusters cover African and many European actors => bigger organized groups Organized covering Western markets 33

34

35 Conclusions s and phone numbers play a crucial role in Nigerian scam Campaigns are long and scarce Scammers hide behind webmail and forwarded phones Scam campaigns differ in their infrastructure, orchestration and modus operandi Different scammers probably compete for trendy topics, thus changing topics over time 35

36 36