HITCON FreeTalk 20240726 - Dark side of the Force - 探索暗網威脅【 議題二：Residential proxies and Underground 住宅代理服務地下經濟圈】

講師：Fyodor Yarochkin
Senior Threat Researcher, Trend Micro Research

1. 住宅代理服務地下經濟圈
ResidentialproxiesandUnderground
FyodorYarochkin
(andRyanFlores,miaoski, GD)

2. 2| ©2023 Trend Micro Inc.
Agenda
•HuntingResidentialProxies with honeypots
•Marketof Underground of residential proxies
•Provision of Proxies: Proxyware,
infected devices, freeware, SDK
•Monetization: Abusescenariosandunderground
•Conclusion

3. 3| ©2023 Trend Micro Inc.
Credits
•Heavy lifting: miaoski
•GD
credits

4. 4| ©2023 Trend Micro Inc.
Residential proxies ecosystem

5. 5| ©2023 Trend Micro Inc.
What and whyresidential proxy?
•User identies are often profiled (by anti-fraud
systems, anti-bot systems etc)
•Residential proxies, mobile proxies along with
mobile-number-for-sale services allows scalable
impresonation.
•Residential proxies allow geofencing bypass
•Often used cummulatively with other criminal
services
Residential
proxy
Inside J

6. 6| ©2023 Trend Micro Inc.
Other criminal services: SMS PVA

7. 7| ©2023 Trend Micro Inc.
Other criminal services: anti-captcha

8. 8| ©2023 Trend Micro Inc.
Side income?

9. 9| ©2023 Trend Micro Inc.

10. 10| ©2023 Trend Micro Inc.
What is kolotibablo? J
Колотибабло-> hammer
money -> 搖錢樹

11. How do people get triggered into giving away their computers for proxies?
人民如何被騙?

12. 12| ©2023 Trend Micro Inc.
Passive income：被動收入

13. 13| ©2023 Trend Micro Inc.
被·easyincome騙很容易J

14. 14| ©2023 Trend Micro Inc.
Selling bandwidth (they tell you directly)
•Pawns
•Honeygain
•Repocket
•Earnapp
•PacketShare

15. 15| ©2023 Trend Micro Inc.
ResidentialProxies:more than a single scenario

16. 16| ©2023 Trend Micro Inc.

17. Undestanding residential proxies: honeypots J
Ran by Philippe Z Lin

18. Paying service user
”passive income” service
Malicious
node”passive income” service
https://bank..
Residential
VPN/PROXY
service
provider
ResidentialProxies:scam in nutshell :-D

19. Paying service user
”passive income” service
Malicious
nodeHONEYPOT.
https://bank..
Residential
VPN/PROXY
service
provider
Honeypot-ting the residential proxy infrastructure J

20. Honeypot capabilities: traffic monitoring

21. Residential proxy honeypot goldmine
Capabilities:
Map supply chain of residential proxies (some times)
Monitor traffic
Observe use and mis-use of residential proxies

22. 22| ©2023 Trend Micro Inc.
Results (in nutshell)

23. 23| ©2023 Trend Micro Inc.
Results (in nutshell)
•Complexity of residential proxies supply chain: resellers, distributors
•Variety of methods of compromising benign users computers:
freeware, side income, malicious re-packaged applications, hardware
supplychain attacks, software supply chains and compromised SDK

24. Underground market for proxies

25. 25| ©2023 Trend Micro Inc.

26. 26| ©2023 Trend Micro Inc.

27. 27| ©2023 Trend Micro Inc.

28. Proxy provision

29. 29| ©2023 Trend Micro Inc.
Proxyware

30. 30| ©2023 Trend Micro Inc.
Infected and compromised apps and devices

31. 31| ©2023 Trend Micro Inc.
https://www.virustotal.com/gui/file/b2f59d479e5da8e6e0b4ad67d34c781ef72d7b8253d4a543cc36a85f7809f07/details

32. 32| ©2023 Trend Micro Inc.

33. 33| ©2023 Trend Micro Inc.
“Shared traffic”

34. Monetization

35. 35| ©2023 Trend Micro Inc.
Sneakerbots J

36. 36| ©2023 Trend Micro Inc.

37. 37| ©2023 Trend Micro Inc.
Multiple scrappers
•0c5cb3a38f9ddfc0718e1509c091486e4915e558783297973b8c0bb252904a90fly
01.bin
•e568f5280a1258027a6b360680eea0325d20f09ded2835a2a1e8f5a7ecd54275fly
02.bin
•b892bca1bd19359dd58917f84d238ab010f8a51ae9dd33265d05c14cd685cc7afly
03.bin

38. 38| ©2023 Trend Micro Inc.

39. 39| ©2023 Trend Micro Inc.
Pump and Dump schemes

40. 40| ©2023 Trend Micro Inc.

41. 41| ©2023 Trend Micro Inc.
Pump And Dump?
Registation

42. 42| ©2023 Trend Micro Inc.
Banking Fraud

43. 43| ©2023 Trend Micro Inc.

44. Q&A?

45. ©2023 Trend Micro Inc.
FyodorYarochkin(PhD)
[email protected]