Indian porn peddlers peddle Internet porn clips on mobile memory cards

There were several reports (Sex on the go – Demand for mobile porn) on the shifting of the illegal Indian pornography industry from CD/DVD’s to memory cards in mobile phones. Owners of mobile repair shops which are found at every street corner, download these clips from the Internet, and load them onto 4/16 GB memory cards which are then sold to customers, for between 2 to 8 US$ based on the quality of the clips. A 16 GB clip can hold upto 200 porn clips. According to reports, clips on recent scandals are the flavor of the market. Some of these are surreptiously filmed and not made by professional porn stars.

India has over 850 million mobile users. Approximately 8-10% of the mobile users have smart phones. Assuming a small percentage of these smart phone users say 2% are porn watchers then the market size is between 5-10m $ annually. Not very large! The market thrives as many customers are net illiterate and do not have access to wifi networks.

All porn peddlers violate Indian law which forbids the creation and distribution of pornographic content. Viewing porn is not considered a crime.

Swapping memory cards or loading them with pirated videos or clips can lead to malware infection.  

45m$ ATM Heist shows the true potential of Cybercrime

In two separate cyber heists two Middle Eastern banks lost 45 million US dollars. The first cyber-heist which netted 5 m$, took place on December 2012  where cybercriminals targeted pre-paid MasterCard debit cards issued by the National Bank of Ras Al-Khaimah in the United Arab Emirates. While the second intrusion, on Feb19-20 targeted the Bank of Muscat in Oman and netted a jackpot $40 million in 36,000 transactions within a span of 10 hours.

Prepaid debit cards are those cards on which money is preloaded by individuals. In India such cards are commonly used to carry foreign exchange or for corporate rewards. They are identical in appearance and function to credit and debit cards as they are issued under the Visa or MasterCard platform. But unlike other cards, the amount transacted under a pre-paid card is debited from the preloaded balance and requires to be replenished once the amount has been spent

Anatomy of the Attack

Such heist works by altering the credit balances on cloned prepaid debit cards and then withdrawing the amount from ATM’s in several countries. It relies upon both highly sophisticated hackers and on organized criminal cells whose role was to withdraw the cash as quickly as possible. Heists are set-up and controlled by a small set of masterminds who use street criminals called “cashers” from around the world to make the withdrawals from ATM’s, once provided with the cloned prepaid cards. Cashers keep a portion of the fee (approx 20%) and remitted the rest to the masterminds. The masterminds kept track of the amount withdrawn from the hacked cards to ensure that they are not cheated of their share.

In the recent attacks hackers broke into an Indian card processing firm and accessed the prepaid card database to obtain prepaid card information and access codes (PIN) which they used to clone prepaid cards. They were able to alter the account balances and withdrawal limits within the database to load higher amounts and replenish cards. This database was hosted by the card processing company and not within the banks.  

In the next phase, they distributed the hacked prepaid card information to trusted associates around the world who encoded magnetic stripe cards (such as hotel swipe cards) with the data. Once, the cards were prepared, in a globally coordinated action, the heist organizers distributed the access codes (PIN) of the hacked accounts to casher cells who immediately began withdrawing cash from ATM’s across the globe.

The banks were blind to these transactions because these are not tracked in real-time and the losses would only have been found when the accounts were reconciled.

Analysis

An analysis of the heist provides us with several valuable insights:

Firstly, it demonstrates the global nature and complexity of cybercrime. The heist involved several intermediaries such as the heist organizers, hackers, and casher rings across the globe. It involved over a hundred people, was executed in a short time window and involved a sophisticated money laundering operation to remit the money back to the heist organizers. All this is ample testimony to the technological sophistication, coordinated logistics, and financial planning used by cybercriminals.

Secondly, it points out the inability of the financial industry to come together and share information which can help prevent recurrences of similar heists. In this case, the cyber heist on the first bank was repeated a second time.

Thirdly, it is obvious that there were  inadequate security controls to protect the bank from this type of frauds. Failures would have been at multiple levels from inadequate risk assessment to ineffective security controls. In my experience, such failures are mostly due to a lack of appreciation of the business risk and on transferring this context to outsourcers. It may so happen that in this case the outsourcing firm strictly followed all the security processes as laid out by the bank, but still got hacked because there was no partnership in understanding the business context.

Fourthly, it is a rude awakening to the scale of cybercrime today. At 40 million dollars this heist is comparable to the largest bank robberies the world has seen.

And lastly, we still continue to use magnetic stripe cards which facilitated the easy distribution of prepaid card data for the programming of blank cards used in the heist, while safer options like chip and pin cards are available.

Read more: Global cyber, ATM heist nets thieves $45 million from 26 countries

Installing malicious software by exploiting online trust

The endgame of a hacker is to introduce malicious software onto a computer which can later be used for a wide variety of nefarious activities such as stealing user credentials to access social and financial sites or encrypting data on the computer followed by a ransom fee to decrypt it or using it for antisocial activities like spam, pornography and hacking.

Antivirus software, even those from well known brands are not effective against targeted or selective use of malicious malware as there are more suited for defense against mass viruses. Even, if these products are able to update their signature database for specific low volume malware, the process takes four weeks which is a long window of exposure.

The easiest way to introduce malicious software is to convince the user to download it by exploiting online trust networks.  Social networks and Email are two frequently used channels for such exploitation:

Social Networks

Social network can be compromised by using network trust to motivate a user. For example, a link forwarded by a friend is normally considered trusted and a user will click on it without much introspection as to the cyber risk. Introducing posts with malicious links into a social network friend’s circle is commonly undertaken through an anonymous profile or by hacking into a legitimate account.

A second option is to use a malicious third party application or exploiting a weakness in third party applications. For example, third-party applications for twitter help user to schedule tweets automatically. These applications are normally given permissions to read or write on behalf of the user on a social network. Hackers exploit weakness in these applications to introduce malicious posts or tweets.

Emails

Emails are used in a similar manner as social networks. Legitimate accounts are hacked into to send bulk email with malicious links.  Users assume the email has come from a trusted source and click on the link to download the malware. According to a recent blog post by Google, they saw “a single attacker using stolen passwords to attempt to break into a million different Google accounts every single day, for weeks at a time”. Google claims that this activity has reduced significantly in Gmail due to the use of risk based authentication and two step verification.