okay ladies and gentlemen next presenter
offering to tell us about what we can
get for nothing and for free
Gabriel said like
check check Budapest
first of all I'm sorry if my Hungarian
is a bit Rusty but the best I can do in
like a couple of hours
um
first thing first I'd like to
feed the audience with whom I'm I'm
speaking at the moment so can we do like
a show of hands who around here is a
developer
okay who is an Android developer
oh man okay let's try another way who
likes money
oh yeah that's better I like money see I
mean we already have chemistry So today
we're gonna talk about how we can make
money or with low risks and a lot of
profit but now I guess it's my turn so
um
they call me the public transportation
hacker back home in Bucharest I managed
to do a me Fair hack at some point and
this was basically my Gateway into cyber
security I was a developer before that
and after that I discovered that I I
couldn't travel for free uh inside
Bucharest so I decided to hack my car as
well
um
it didn't run for for free though so I
still had to pay for gas and it didn't
pay the bills you know just a lot of
Privacy Information very sensitive stuff
I recommend that you go and watch it and
if you own a Mazda your car can be owned
like very quickly if you don't have all
of the latest updates installed
and finally I decided to settle working
for human security XY tops uh hunting
killer Bots
they aren't there yet so the best we can
do right now is just hunting Bots that
do ad frauds I mean I hope you enjoy all
of the ads that were presented today
damn it all right but ads can be way
more more annoying than this and they
can be very very very very profitable
for you so that's very simple numbers
game right
who let's say that Adroid is a business
right and in this business you have a
certain market cap right there is a
certain profit you can gather each year
so what kind of numbers are we talking
about let's do a show or a show of hands
again do you think that it's in the
Millions
tens of Millions
all right you're aiming big I like that
I mean High uh hundreds of millions of
dollars each year
no man that's rookie numbers
billions
it's actually 34 billion dollars for
2021 and it's expected to grow to double
in size by the end of next year
according to the internet let's call it
like that
so even if you have like a small Time
Business uh and you get like 0.1 percent
of the market cap you would still
generate
34 million in Revenue each year that's
more than what Candy Crush used to make
at some point
when before they launched but it can get
way better than that and we're gonna
dive into it
um
how is this possible first of all well
this is the whole
ad Tech ecosystem
we've got
data suppliers agencies agency trading
desks dsps exchanges ad networks
vertical Network targeted networks
performance we've got data suppliers
again as servers retargeting and
they all tie in with each other so
basically it is very very very very very
very hard to follow the money
on the internet nobody knows you're a
dog we all know that so on the internet
when you do add fraud nobody knows that
you're even there actually because it's
actually one of the lowest reward lowest
risk highest reward Industries when it
comes to fraud out there I mean for bank
fraud you can get busted for credit card
fraud you can get busted
for payment system fraud you can get
busted but for ad fraud
it's not criminally uh like uh
allowed yet or disallowed to do that
kind of activity it's just breaching the
terms and conditions of a company and of
course uh there's always like the
trade-off between a noun for a company
between announcing that they've been the
target of a massive ad fraud operation
and actually lowering the
trust the clients having them and uh
actually being fair and and being fair
to the market or just flipping it under
the rug and call it in the day and
settling with with the parties involved
um
I mean so what's the catch
I mean usually I had this as the final
slide and the version of the internet
actually had this but and I thought that
man that would be like a very bad uh
punchline for the end of the show
um
what's the catch how how can this be so
good well we are the catch the cyber
security industry needs to up their game
and needs to basically not consider ad
fraud being done by various apps as
possibly unwanted programs because they
are definitely not unwanted
um they do uh they are definitely
unwanted basically they can eat up your
CPU Cycles they heat up your phone uh
they increase your phone bill at the end
of the day and remember that there was
this malware core drainer bot
it did add fraud and it actually burned
batteries uh in the process and we're
gonna have like a taste of that a bit
later as well
but first let's do a bit of of history
of all of the botanists that have been
going on around there we've got the
Earthling spammer one of the first that
got actual money from developing a
botnet they did 1.5 million emails and
rating 3 million cash in cash in the end
uh they got sued for 21 million 25
million so uh quite a a bad deal for the
developer we had Graham who again was
doing a lot of email spam and they
erecting
around 2.7 million at the end of their
career uh then
as we progressed
um the threats out there started
progressing as well and actually
building botnets can be a little bad for
your business because you can get
indictments for the police the cyber
security laws became strict transcriptor
so they went in other directions and
they started doing fake traffic and add
fraud in order to make it harder from a
legal perspective to punish them so
arthro rookie numbers 50k per month then
we have massport and Eve and methbot was
doing three million dollars per day
that's more than Candy Crush was making
and now we have Eve
2.5 million dollars per day confirmed
that's way way way more than the most
successful game out there which is again
Candy Crush is making every day like
every day and
fortunately
if
is a success story for us Eve got shut
down at the end of their life cycle it
was one of the most sophisticated
operation that we at White Ops
and now human managed to to shut down
um they we had to do 18-month University
collaboration uh that uh basically
raised the awareness in law enforcement
and it actually led to a multinational
takedown and arrests and in 2021 I think
they were actually charred for a cyber
wire fraud I think
and put in prison but it was for three
people out of the whole network so what
can I don't think it was only three I
mean definitely it wasn't 23 people so
um because an operation that actually
had three subset operations need way
more it's like a business already need
way more people to work so
they had bgp hijacks
they had kofta infections and the
residential proxy Network and what they
were they were doing they were actually
building counterfeit websites
and they use the Bots that would route
the the traffic through U.S based
residential proxies
in order to view their own ads and they
did that all day long 24 hours seven
days a week and managed to make 5.2
million dollars of course this basically
attracted
um the attention of the authorities and
um in the end I mean uh sucks for them
they got shut down and they got arrested
so fraudsters out there
had to reprofilate
they no longer use traditional botnets
they don't do fraud they do data driven
intelligent marketing
and this was a campaign from 2019
and it was done through by the means of
apps on the Play Store
um
they're quite inconspicuous they didn't
do anything strange nothing weird
until
you'd see ads and weird websites
popping on your screen
you know there was a trend at that one
point it started going down in the last
year but you just browse
randomly on your phone and then poof you
would have a weird website popping on
your screen this is called out of
context advertising it's again a breach
of the terms and conditions and
companies
can actually litigate against you
again it's a civil court issue so it's
not criminally punishable that's why
they are data-driven intelligent
marketing they are not doing anything
suspicious and now to get a bit into the
nitty-gritty maybe someone wants to put
a signature and hunt for more threads
they did this through Androids intent
receivers and whenever you would turn
the Bluetooth on and off or turn your
Wi-Fi on and off poof you would have
another ad popping up
they actually in order to evade the
uninstallation of the apps because yeah
man it's Android I can just uninstall
the app well you might think you'd be
uninstalling the app but actually they
built a fake shortcut on your home
screen and hide the original shortcut of
the app so whenever you would uninstall
the fake shortcut
the Apple still there you you still
thought that it it was uh uninstalled
but uh you'd still get ads popping up
all the time
and we shut them down we took them from
the play store but of course that they
evolved uh and adapted because it's very
easy to do adaptation when it comes to
ad fraud because you don't get any more
errors on your apps you just randomize
or they get taken down so you just need
to vary your ttps and at one point
you're gonna get ads again in your apps
and you can carry on and now we have two
shoe
that added a bit more like some more
tricks first of all they started using
obfuscation
and some simple uh xor
encoding
they also did some pretty cool Invasion
techniques
um
they really really hated Trend and
Google Google mostly because they knew
that sometimes apps get popped on
internal farms in order to get their
traffic and behavior analyzed and they
wanted to avoid all of those sandboxes
so they would look for the Wi-Fi
the y5 that were around and if they
would find something from Trend or
Google they would just seize their whole
operation
they also looked for apps that contained
a test in their name again in order to
evade any kind of
um of uh
test devices where a researcher might do
some kind of reversing
and they are partially successful
we still stop them and got the chance to
play whack-a-mole once some more with
another app that we're gonna call
Poseidon actually not an app but a whole
actor
Poseidon again had a pretty big presence
on the Play Store it was an operation
around like tens in the range of tens of
apps
they use the exact same technique of
displaying out of context ads
and you just scroll around on your phone
play a game and pop you'd get an ad on
top of of that game and most advertisers
just accept what is called an impression
which is the ad view being viewed as
actionable and legitimate and you'd get
your money even better if they pop up so
with
at such random behaviors you would be
tempted to just tap it by accident and
also give them a payout for actually
clicking the ad
they did this Randomness by basically
hijacking as many intents as possible so
you would install or replace an app you
would get an ad
you would pop in a call you get ads
maybe you can even touch it with your
face bonus points you mount some media
you get an ad and
that was done by registering high
priority receivers in order to
be the first ones catching those intents
basically they took this to whole art
and
they even built an SDK
being again an intelligent marketing
platform or whatever and they would go
to developers tell them hey I see that
your game is not making a lot of Revenue
do you want to embed this SDK we're
gonna Hey kid wanna buy some ads we're
gonna make it really profitable for you
and it worked the operation was so
successful that they actually added
in addition to the out of context ads
some hidden ads services and auto
clicking on those hidden ads so even
though you weren't seeing anything they
would pop a hidden web view on your
phone and
just tap ads in the background in the
meantime uh Google met a lot of
improvements to the way that Android
apps are being run and processed they
were either shut down from the dynamica
from the sandbox perspective or it
wasn't possible from an API perspective
to to to display web views while you
were just running as a service but they
adapted they started adding them to
notifications and they kept playing the
whack-a-mole game of whack-a-mole and
they use the same technique they would
look for intents so whenever you would
unlock your phone you'd get an ad by
looking for the user presence
they would also randomly delay it in
order to trick you so it wasn't always
after unlocking the phone they would
also wait a specific amount of time as
an extra measure for evasion
and
they also added more persistence
mechanism as I said Android kept upping
its uh API access of from the side of
malicious apps and but they would keep
the persistence by rebinding a specific
job they are the job scheduler and pop
from now and then and run some code
saying hey can I run ads right now and
then it would the answer would be no you
can't okay I'm sleeping after one minute
they would pop again can I run ads right
now yeah you can and they will display a
random ad
and we shut them down
and they adapted and evolved and
added one more thing
let's look at the code this was Poseidon
this is Neptune
Poseidon Neptune
Poseidon Neptune you see the
similarities they again added
obfuscation because most of the
solutions back then was just blocking
them based on the strings embedded
inside the Dex file
and
they added some extra functionality that
allowed them to spoof what is called the
app ID back then so they would modify
a lot more data
in addition to that
and they would also add
accelerometer y z and rotational Z wise
and the click delays in order to make it
a lot harder for um
for uh analytics companies or anti-fraud
companies to actually detect them
the next one is one of the more
interesting cases
it's a case of monkey patching so for
whoever doesn't know what monkey
patching is it is the process through
which you override a
functional pointer in code that is
actually running in order to hijack the
execution flow and
basically do whatever you want with
other people's code and in our case
it was actually forcing you to stay in
an ad and watch it till the end so there
was no escaping from them in order to
maximize the revenue
they will just pop an ad and you
wouldn't be able to to click the X
even if you tried
until
they are satisfied with the result and
they would receive them
final impression metrics on it
it's propagated through the Play Store
again
they were around
like in the dozens
bypassing the stores policies and doing
their nefarious deeds and this is where
the magic happened
they use the same techniques as before
job schedulers services rescheduling
themselves
and they would use an invocation Handler
from java who here is a Java developer
or was a Java developer
so this is a a a proxy Java proxy uh
it's a very legitimate way of doing
tests from what I knew at some point I
hope that I'm right
but basically overriding parts of the
code that
you need to to switch at runtime
and they were changing
this method
in case they found that you would invoke
this method was invoked they would
change its value from True to false in
order to prevent you from shutting the
shutting the ABS the method was from
Google's SDK so you would be stuck
with that ad running Non-Stop
now let's stop the Monkey Business
and get to more serious operations this
one is called terracotta uh it was
inspired by the great Terracotta Army
from a tomb of a Chinese emperor of
soldiers that looked kind of the same
but they had tiny differences from each
other the the amount of detail that went
into building that was was insane but
the boilerplate they used certain
let's call it copied and pasted
templates on which they would add the
features and this is how we spotted them
we would see traffic that could cluster
really well in certain
fools basically
around certain areas and this meant that
somebody is very bad at producing
Randomness when it comes to to viewing
ads so
we started
looking for the app we could not find it
unfortunately because they are also
spoofing the app name of the app that
was generating the income now the thing
is that
you don't need a certain app to cash in
you just need to be the right publisher
so the money comes to the publisher and
not to the app ID basically to the
developer of the app so they were like
all over the place with all of these
devices that looked to be copied and
pasted
and fortunately we managed to find
an IP of an app
of an entry that was very close to one
of our investigators very very very
close in a hospital and uh he personally
knew the network administrator over
there so uh just do some human
intelligence and they actually
identified the person who had the phone
and the phone got the the person got a
very cool like offer a brand new phone
versus a bug redone mess full of malware
of course they accepted it was like a
no-brainer especially because the phone
had the battery that drained very very
very fast
and it actually was very hot to the
touch
so we put it into the lab we uh kind of
gave access to the whole reversals and
this was the first time we actually did
some live forensics
on a device that was running
some kind of adware
foreign
now
the most suspicious one from the whole
cluster of apps installed
was a coupons app and this was in the
times of covid kovi just stuck just to
hit a lot of people were fired they
needed cash and we have an app
that was promising
500 at Best Buy here in Walmart
it was like an instant sell basically
for a lot of people
and it was not the only one there were
multiple
coupon apps you would have to keep it on
your phone for I think 60 days I can't
remember correctly for 30 days
and you could use the coupon after that
a lot of people obviously forget that
they could drip in the benefits after
one month so they will just just leave
it in there it was very small I mean
you you couldn't
it wouldn't hurt anybody
well it's first which proved to be
natural and inside the app
a whole react native layer was unpacked
and it wasn't only like that innocent
looking coupon it was a whole react
native app that downloaded a secondary
payload
from a command and control server
inside Firebase
and
the secondary payload can contain the
webview and inside the webview they
would render video ads 24 7. without
stopping and this is what basically led
to the high data usage it wasn't drainer
Bots that made it into the news
but it's not it was something very close
it appeared after drainerbot basically
and
um
they after visiting the C2 and tapping
gently on their door we find something
more worrying the guys were also
preparing to deliver
proper malware
so no more games they wanted to get into
the big boys business although I still
think that adware pays way better than
malware
the next one was called rainbow mix
because
they were all over the place just like
the rainbow all of the colors
uh
on all of the stores around 300 apps
there's more underneath the GIF but I
mean I couldn't get it get all of them
on the
inside the inside this presentation and
they did out of context ads as well you
just
play with your phone and you would get
these random ads and if you look closely
you can see that they were actually
spoofing
the name of the application so let's
wait a bit
there we go that's YouTube for whoever
doesn't know
just some small time tempering and
editing the icon of the app of the
activity that was being instantiated and
people would think oh wow like Google
got so greedy oh my God they're showing
me all of the others all the time it was
actually them and the traffic wasn't
that big actually but having 300 apps
that flew under the radar generate more
traffic and more Revenue than having one
app that would just make you rich like
instantly overnight and this is one of
the biggest mistakes that uh bad guys do
they get greedy
and not like a medium-sized operation
just Flander the radar and
mix with every everybody else
and make more money on the long term
than an instant hit that would make you
a billionaire overnight
and
they saw that the interesting part about
rainbow mix was that they set on the
Play Store long enough to accumulate
reviews and all of them had this
interesting c-shaped distribution
a lot of they would have a lot of good
reviews initially
and app as people install them they will
start popping in the the bad reviews
and this led to this characteristic like
very polarized uh type of of review
pattern and
they managed to do this
via a very simple trick all the bad
people
uh know it the
Google play Team doesn't want you to
know this battery can you guess it
it's Packers
they would use Packers
to obfuscate the entirety
of their of their bad code
although
they couldn't hide their bad intent
they had an intent receiver
registered inside
Google's namespace
trying to somehow blend in
and of course you want gonna you're not
gonna see this kind of of intent
receivers from a legitimate SDK antenna
at any point
basically whenever you would install
remove replace
uh scan for the Wi-Fi's uh boot your
phone basically do anything on your
phone
this bad bad guy would pop up
it's a
wrapper around the this com.tmus.a
class
and
whenever this was invoked
it would get some
instructions from the command and
control server and display the ad and
fraud
Google iron Source Unity whatever they
have like the flavor of the month every
time
um
the C2 was a hacked
web page because I could find this
domain name somewhere on quora when
somebody was asking hey guys how do I do
whatever python stuff I that guy wanted
to do and somebody gave a link to API to
python example.com they hacked the third
it has a blogs a blog spot I think no or
WordPress and
uh
turn it into the main command and
control Channel
and now we're gonna turn around
and talk about
the big guys because up until them it
was the except of Eve uh we talked about
small time Crooks that were just blend
in and we squashed them and fortunately
we managed to kind of shut down this
annoying trend of having out of context
ads all the time and interrupting uh
your boxing habits these guys however
they did around 80 percent of AD traffic
on CTV
CTV for whoever doesn't know
means connected TV it's all of those
Smart TVs that are
rolling right now it's roku's it's
Philips Samsung
and so on Apple TV for example is a
a good example of a connected TV
and they would hide
inside
the
how can you call it the anonymity
provided by the implementation of the
CTV
add verification system inside the CTV
world we have something called server
side ad injection
and you have two types of displaying the
ads you have the typical ones as you see
on YouTube so you load the clip and
then it starts to buffer the clip and
then it stops and it starts to buffer
the ads and then you see the ad the
AdSense and you resume the playback of
the clip and sometimes this can be a bit
heavy on the CPU and annoying especially
if you have a better Network server side
that injection however creates a
continuous streams stream of of playback
and you can
uh you you won't see any kind of
buffering or interruption or changes in
complex compression or whatever because
it is so streamlined and
the server side ad injection server
would communicate
to that dsps to the advertisers
and announce that hey
11 million people saw our ads today
trust us it's for real and then the
DSP is an Advertiser would have to
talk back to us and say hey did these
guys like really show 11 million ads
today
and we would say yes because at the same
time the same server would talk with an
Android control botnet that was around
500 000 to 1 million strong
and
somehow spoof all of the Impressions
impression pixels that were being
sent to us and they turned this to a
whole art they even made an SDK and they
would take legitimate games and embed it
inside the legitimate games
and they would manage to spoof
billions of requests basically
the apps or on the Play store some of
them were quite unique some of them were
Shameless rip-offs of other games for
example
uh uh the slink pack 3D challenge that
we see over here was the clone of disc
Wars for example so they took the game
from here they put it and they added
their own SDK
and even then though we had they had
like a total of 500 000 installs they
would still make way more money than all
of the legitimate apps and it it started
as a very simple clicker and as we
started blocking them and detecting them
they add in more and more and more
layers
um for persistence they use the same
alarm based persistence that I talked
before like job scheduler rescheduling
jobs all the time in order to persist in
the background and not be shut down by
Android
they have an obfuscated Communication
channel with a C2 the key is right here
in case you still want to do some
analysis the work was pulled from the C2
every 30 seconds so every 30 seconds you
get a new payload all the time and the
payload included 10 URLs to click so
they could click billions every day and
raking billions at the end of the day if
they wanted to
and the most interesting part is that as
we started blocking them because we are
fingerprinting the devices we're upping
up our game
they started implementing their own TLS
library in order to spoof the TLs stack
of the actual connected TV devices so
they built an okay HTTP 3 interceptor
and you can see right here this is the
legitimate default Interceptor from
okhdtp3 this was the changed one
and they even had the corner case for
Roku where they would send a stream of
bytes
that was characteristic to Roku devices
in order to again trick any kind of
sensors that would fingerprint them they
would get the
ciphers to use the user agent and any
other headers programmatically from the
command and control server and it almost
tricked us but fortunately in the
meantime
we found them we found the C2 who
communicated with everybody involved
from Amazon where they had their
infrastructure and all that and we shut
them down for good and the operation
went dark just like that overnight
before that at their Peak more than four
thousand five
300 CTV apps were being spoofed
1 million infected devices
one year of activity where they did that
continuously and they really really
really wrecked the big bucks
I'm Gabby and
thank you for having the patience to
listen to me or anything about that
fraud and about how everybody can make
way more money by about going dark but
remember that at the end of the day it
is our duty to do the right thing and to
not go for the lowest hanging fruit out
there thank you
foreign
[Applause]