Internet Fraud and Protection

[Eugen]

As the number of Internet users grows, the number of scammers trying to make money on these users increases. An interesting feature of online fraud is that many methods are not a violation of the law in explicit form, and this does not allow prosecutors to prosecute crooks. This article analyzes the most common forms of online fraud and how to protect against it.

Cybersquatting

Cybersquatting (from the English. Cybersquatting) is a popular on the Internet and "almost legal" way of making money. It is based on an analysis of market news in order to identify the names of companies and brands of new products for which domain names of the same name have not yet been registered. Having discovered such a brand, the cybersquatter registers the domain name for itself in the hope of reselling it subsequently to the company owning the corresponding brand.
In general, the earnings of a cybersquatter are based on the following components:

• 1. selling the domain name to the brand owner - in this case, the profit is due to the difference between the cost of registering the domain name (which is about 10-15 dollars per year) and the “buyback” paid by the company;

• 2. blackmail of the brand owner, which may be based on threats to create a fake company website with information defaming its honor and dignity, or containing incorrect information about the goods;

• 3. earnings on banner advertising.

In some sources, cybersquatting is classified by direction, highlighting industry, brand, name and geographical. According to the laws of various countries (including Russian), cybersquatting is illegal, since a registered trademark or brand takes precedence over a domain name, and the trademark owner has legal grounds for a lawsuit.

Protection. Protecting yourself from cybersquatting is quite simple - Wikipedia even describes the special term “protective cybersquatting”. Protection consists of proactive registration of all domain names that are consonant with the name of a company or brand.

Typesquatting

Typesquatting is a type of cybersquatting based on the registration of domain names that differ from the names of untwisted domains with typos or a domain zone (the term is derived from the English type - print). Naturally, in order to achieve high efficiency, the typsquatter must analyze the statistics of typical user typos. An experiment was conducted with the popular domain names yandex.ru and rambler.ru to search for examples of typosquatting. The very first attempts to make a typo in the address made it possible to find the sites of typsquatters: https://www.yadex.ru , https://www.yadex.com/ , https://www.andex.ru/ , Link is not valid - deleted, Link is not valid. Earnings from the taisk squatter make profit from advertising posted on the website, paid redirect to certain resources or from the sale of a domain name to the owner of a consonant name. Unlike classical cybersquatting, it is impossible to prosecute a typsquatter.

Protection. The best form of protection is the analysis of a domain name for possible typos and registration of 3-5 main options with a redirect to the main domain

Phishing

Phishing is one of the most common types of fraud on the Internet. The term is derived from the English phrase “password fishing” (literally “password digging”) and in the classical interpretation means misleading the user using a fake site that visually mimics the site of a bank or other Internet system involving user identification. The main task of the phisher is to lure the user to such a trap site and somehow convince him to provide identification data. To solve this problem, phishers usually use one of the following methods:

• 1.spam - its typical idea is to frighten the user with some problems that require the user to immediately authorize to perform certain operations (unlocking an account, rolling back erroneous transactions, etc.). In such a letter there is a link to a fake website, and visually a similar link is usually indistinguishable from the real one. A simpler form of phishing is the sending of fake letters on behalf of a bank or a service provider asking for details of the account number, username / password and other personal data by sending them to the specified address;

• 2.Advertising certain goods that can be purchased in the online store, and the advertisement must provide a link to the store’s website. The technique is similar to the previous one - instead of the store’s website, the user can go to the phishers website or to the website of the one-day shop created by scammers;

• 3.Application of a trojan (for example, the Trojan.Win32.DNSChanger class) or cross-site scripting to redirect the user to the phishing site when trying to access a legitimate site. The simplest implementation of this method is to modify the Hosts file, and more complex methods are based on the use of rootkits, Trojan SPI / LSP providers or modification of system settings - for example, reconfiguring the browser to work through a Trojan proxy server or changing the provider’s DNS server in the settings TCP / IP to the Trojan DNS server.

Recently, a new form of phishing has been reported more and more frequently - fishing out scanned copies of his documents from a user. In particular, having a photocopy of the passport and sample signature, it is theoretically possible to arrange a loan on behalf of the user. It is not difficult to get scanned copies of documents of a trusting user - for example, sending him a message that he won the lottery is an N-thousandth visitor to Site X, etc.

Protection. Most phishing techniques are based on trust - therefore, the main defense against them is the principle of “trust, but verify”. The practical implementation of this principle is based on a set of simple rules:

• 1. Banks never ask for credit card numbers, PIN-codes for them and other personal data from customers. This information is initially known to the bank and if clarification is needed, then in any case the bank representatives will offer the user to come to the bank with the necessary documents, but they will never demand to send them, say, by mail;

• 2. Do not click on the links provided in spam emails. If the link is visually similar to the right one, then this does not mean that it leads to the correct site;

• 3. Any lottery is based on the principle of "many play, win units," respectively, the bulk of the players pay off the costs of prizes. Therefore, if the user did not buy lottery tickets or otherwise did not pay for participation in the lottery, but suddenly receives a message about the win, then this is probably a fraud

• 4. should be wary of advertising products whose price is much lower than the price in other stores;

• 5. In the case of working with online stores, simple control should be carried out: how long the store’s domain is registered, whether the store has an office, legal address, phone numbers, etc. (Naturally, such information is simple enough to verify). If such contact information is not indicated on the site, then it is better not to deal with such a store.

As a general rule, it should also be mentioned that in no case should you enter credit card numbers on unfamiliar sites. For example, the vast majority of legitimate online stores in our country use the services of companies such as Assist ([DLMURL="https://www.assist.ru/"] ASSIST - an electronic payment provider [/ DLMURL]) and do not request bank card details directly from customers.

Payment system fraud

Various methods of fraud with payment systems and express payment systems can often be classified as a form of phishing. However, due to the particular prevalence, we will consider this form of fraud in more detail. From the point of view of implementation, there are a lot of options, in particular:

• 1.magical wallets - the principle of deception is that with the help of spam or a specially created website, an attacker describes a vulnerability or an “undocumented feature” of the system that allows you to make a profit by transferring a certain amount to the specified wallet. In the description of the method it is reported that after some time the money will be returned, for example, in double amount. Naturally, there is no vulnerability and the attacker receives money;

• 2. fake electronic money exchangers and payment services of various services;

• 3. begging is usually spam (by mail and in various forums) asking for money to be transferred for urgent surgery to save a child, repair or restore a temple, help an orphanage, and other similar things;

• 4. fake letters or messages on ICQ on behalf of the user with a request to borrow a small amount of money. A typical scheme is the theft of passwords from a user's PC using a Trojan program, the capture of email and ICQ, and the subsequent sending of a request to borrow money;

• 5. various pyramids using payment systems;

• 6. fraudulent online banks - as a rule, offer to invest electronic money on very favorable terms, after which the user does not receive any money or interest;

• 7. fraudulent labor exchanges, offering for a small fee to find a prestigious job (of course, that they receive money, but do not provide anything in return). Fraud systems of remote work are similarly arranged: the applicant is promised remote work, but they are offered to pay 10-15 dollars for “paperwork” or another operation.

• 8. various online lotteries, casinos and other types of gambling;

• 9. obtaining a loan from individuals - the borrower is trying to get as many loans as possible, and then disappears.

This list contains only the main forms of fraud, but they have one thing in common - an attempt to fetch money from a user. The problem is compounded by the fact that electronic payment is difficult to trace, and the insignificance of the amounts often does not allow to initiate a criminal case.

Protection. One of the main methods of protection can be based on the axiom used by many economic security services - "any prepayment is suspicious." Therefore, a request to make a certain payment for services without an agreement signed by the parties is potentially dangerous - in case of fraud it is almost impossible to return money in such a situation. In addition, a number of simple rules should be followed:

• 1. having received from a friend a request to lend money by e-mail or ICQ, you should definitely check whether he has the indicated wallet and if he asked about it;

• 2. It must be borne in mind that there are no magic wallets or miraculous ways of enrichment. This is an obvious fact, however, the number of deceived users is growing every day;

• 3. Before payment, you should use the protective schemes offered by electronic payment systems. The classic example is WebMoney Arbitration - a system in which reviews and complaints of its users are recorded.

Hoax programs

Hoax programs are not pure Trojan horses. Their task is to mislead the user in order to obtain financial benefits. By the principle of action, several varieties of Hoax can be distinguished:

• 1. paid programs for hacking something, cheating payment systems or online casinos. A similar program can usually be downloaded and run in demo mode, it has a website and documentation. In case of launch, the user sees the program interface, and the documentation indicates that the functionality of the program is supposedly blocked in demo mode. After payment, one of two things happens: either the program disappears, or an activation key is sent to the victim, after entering which the program either simulates the process of hacking something, or simply displays a message that hacking something is bad and that it was a rally. There are dozens of examples of such programs. For example, the author came across a regular random number generator (Hoax.Win32.Delf.m), the creator of which claimed that the licensed version for $ 7 could guess the numbers in the online casino roulette;
  
  
  

• 2. Activation code generators. Usually these Hoax are essentially Trojans offering to enter the number of an inactive express payment card for its “cloning”. The principle of operation of such a trojan is reduced to sending the entered data to the attacker and simulating the “cloning” process for a time sufficient for the attacker to activate the card;
  
  
  

• 3. Virus and antivirus simulators. The most popular of them is Hoax.Win32.Renos, which imitates malware infection on a computer and strongly recommends downloading an anti-spyware. The most interesting thing is that the latest versions of Renos secretly download and install the advertised "anti-spyware", which theoretically is simply obliged to alert the user. However, based on the fact that the author has fixed 371 modifications of Renos, it is safe to say that, apparently, this business is profitable and trusting users still come across.
  
  
  

In addition to Hoax, one more form of software fraud is the sale of free software. The essence of this fraud is that in many online stores there is no control over whether the seller is the copyright holder of the software being sold.


Dynamic substitution of payment details

This method is based on the fact that most users, when paying bills using WebMoney or Yandex-Money, do not enter multi-valued accounts manually, but copy them through the clipboard. The account numbers of electronic payment systems are fairly easy to identify by format (prefix and number of digits) and dynamically change. This can be realized with the help of a simple program that will periodically analyze the contents of the clipboard and, if an account number is found, replace it. This technique is implemented in a large family of malicious programs of the Trojan-Spy.Win32.Webmoner class. In theory, more sophisticated account spoofing techniques are possible, for example, by filtering Internet traffic and dynamically modifying the contents of HTML pages.

Protection. The simplest protection is based on visual control of account numbers entered in the payment system, and their comparison with the required ones. In addition, most payment systems allow you to check the account number and establish who it belongs to and what, in the opinion of users, its reliability.

SMS voting and payment

The principle of this fraud is based on the recent appearance of payment systems by sending SMS to a special number. The principle of fraud is that on a certain Internet site the user is invited to send an SMS with the specified text to the specified short number under any pretext, it is usually suggested to vote for the site, pay for access to the closed section of the site or downloadable content, etc. The deception consists in not indicating the real value, which will be debited from the account of the user who sent the SMS. This moment distinguishes fraud from completely legal SMS-piggy banks, in which case the user is informed of the cost of SMS or is requested to set the amount manually.

Theft of user billing information

The theft of payment details is carried out using Trojan programs, often using rootkit technologies. The principle of operation of the Trojan program is based on the fact that most payment system sites are typical, and therefore, intercepting HTTP traffic, one can find completed forms for entering a credit card number and its PIN code. The most dangerous thing in this case is that such a Trojan program does not show its activity in any way and it is very difficult to detect it. An alternative technique for collecting such information is to use sniffers to intercept and analyze traffic - a similar scheme, for example, can be implemented in an Internet cafe. Finally, the third way to intercept credit card numbers and PIN codes, as well as any other confidential information, can be done using keyloggers or visual observation of the screen and keyboard.

Protection. First of all, protection comes down to the use of anti-virus packages, proactive defense systems and firewalls. When entering critical information, make sure that a secure connection is used (for example, the HTTPS protocol). In addition, you should refrain from entering confidential information on computers with public access.

Hacking sites and DDoS attacks

This direction is criminal in its purest form and is based on the fact that cybercriminals disrupt the functioning of an Internet resource with the subsequent extortion of money to stop the attack, information about the vulnerability discovered, or to guarantee that the site will not be cracked for a certain time.
Protection. It is very difficult to defend against a DDoS attack - to counter DDoS, specialized software products are used to filter traffic, and expensive tariff plans involving the rent of a dedicated server connected to a high-speed Internet channel (such a server is much more difficult to reboot).

Lock computer and user data

This method of extortion is based on:
on a reversible computer lock. Typical examples are Trojan.Win32.Agent.il (aka Trojan.Griven), Trojan.Win32.Krotten;
on encryption or reversible distortion of user data. The most famous example is the Gpcode trojan.
The above operations are performed on the affected computer using a Trojan, after which the user is invited to pay the attacker a certain amount for the “antidote”. Moreover, if in the event of damage to the settings of the operating system, as a rule, it is possible to restore the computer without any problems, then if asymmetric encryption is used, the creation of a decryptor utility and the selection of a key for decrypting files are required.

Conclusion

This article describes the currently popular methods of fraud on the Internet, however, it should be borne in mind that these are far from all the methods - the imagination of modern scammers is truly limitless. Effective technical measures to protect against fraud on the Internet and in the field of high technology do not exist, therefore, the main protection measure is user vigilance, as well as knowledge of the main technologies of fraud and methods of protection against it. Ideally, system administrators of companies make sense to educate users about the basics of information security. Similar events should, in theory, be carried out by Internet providers, for example, this could be the publication of fact-finding brochures for clients connecting to the Internet.

Source Internet Fraud and Protection

 

[Краев Евгений Леонидович]

Thanks, interesting!

 

[Матушкин Андрей Николаевич]

THANK!!!

 

[Плотников Юрий Михайлович]

Thank!

 

[Турабян Владимир]

Thank!