Get Rich or Die Trying"Making money on the Web, the black hat way"

Arian Evans
Director of Operations
WhiteHat Security

Blackhat Tokyo
09.20081

Arian Evans
Director of Operations
WhiteHat Security© 2008 WhiteHat Security, Inc. | Page 2
2

Arian Evans
Director of Operations
WhiteHat Security

Leads a team of security engineers
assessing over 700 websites annually.

© 2008 WhiteHat Security, Inc. | Page 2
2

Arian Evans
Director of Operations
WhiteHat Security

Leads a team of security engineers
assessing over 700 websites annually.
10 years in ecommerce and enterprise
web application security.

© 2008 WhiteHat Security, Inc. | Page 2
2

Arian Evans
Director of Operations
WhiteHat Security

Leads a team of security engineers
assessing over 700 websites annually.
10 years in ecommerce and enterprise
web application security.
Worked on organized crime hacking
incident response with the Center forInternet Security, NIST, the FBI, theSecret Service, and many commercialorganizations.

© 2008 WhiteHat Security, Inc. | Page 2
2

Arian Evans
Director of Operations
WhiteHat Security

Leads a team of security engineers
assessing over 700 websites annually.
10 years in ecommerce and enterprise
web application security.
Worked on organized crime hacking
incident response with the Center forInternet Security, NIST, the FBI, theSecret Service, and many commercialorganizations.
Researches and discloses new attack
techniques and vulnerabilities in Web
application software, includingcommercial platforms like Cisco andNokia.

© 2008 WhiteHat Security, Inc. | Page 2
2

Arian Evans
Director of Operations
WhiteHat Security

Leads a team of security engineers
assessing over 700 websites annually.
10 years in ecommerce and enterprise
web application security.
Worked on organized crime hacking
incident response with the Center forInternet Security, NIST, the FBI, theSecret Service, and many commercialorganizations.
Researches and discloses new attack
techniques and vulnerabilities in Web
application software, includingcommercial platforms like Cisco andNokia.
Arian is a frequent speaker at industry
conferences including Black Hat,
OWASP, RSA, WASC, and softwaredeveloper events.

© 2008 WhiteHat Security, Inc. | Page 2
2

Arian Evans
Director of Operations
WhiteHat Security

Leads a team of security engineers
assessing over 700 websites annually.
10 years in ecommerce and enterprise
web application security.
Worked on organized crime hacking
incident response with the Center forInternet Security, NIST, the FBI, theSecret Service, and many commercialorganizations.
Researches and discloses new attack
techniques and vulnerabilities in Web
application software, includingcommercial platforms like Cisco andNokia.
Arian is a frequent speaker at industry
conferences including Black Hat,
OWASP, RSA, WASC, and softwaredeveloper events.
Contributing author of "Hacking
Exposed: Web Applications."© 2008 WhiteHat Security, Inc. | Page 22

3WhiteHat Sentinel• Unlimited Assessments – customer controlled andexpert managed – the ability to scan websites no matter
how big or how often they change• Coverage – authenticated scans to identify technicalvulnerabilities and custom testing to uncover businesslogical flaws• Virtually Eliminate False Positives – Operations Teamverifies results and assigns the appropriate severity andthreat rating• Development and QA – WhiteHat Satellite Applianceallows us to service intranet accessible systems
remotely• Improvement & Refinement – real-world scans enable
fast and efficient updates© 2008 WhiteHat Security, Inc.
3

The other half of the Top Ten

Percentage likelihood that a website has a particularvulnerability by class4The other half of the Top Ten

Percentage likelihood that a website has a particularvulnerability by class
4

5

5

5

QA overlooks them55

QA overlooks themTests what software should do, not what it can be made to do55

QA overlooks themTests what software should do, not what it can be made to do

Scanners can’t identify them55

QA overlooks themTests what software should do, not what it can be made to do

Scanners can’t identify them
Lack intelligence and don’t know if something worked (or not)5

5

QA overlooks themTests what software should do, not what it can be made to do

Scanners can’t identify them
Lack intelligence and don’t know if something worked (or not)

WAFs / IDSs can’t defend them55

QA overlooks themTests what software should do, not what it can be made to do

Scanners can’t identify them
Lack intelligence and don’t know if something worked (or not)

WAFs / IDSs can’t defend them
All the HTTP requests appear completely normal

55

QA overlooks themTests what software should do, not what it can be made to do

Scanners can’t identify them
Lack intelligence and don’t know if something worked (or not)

WAFs / IDSs can’t defend them
All the HTTP requests appear completely normal

Business logic flaws = $$$5

5

QA overlooks themTests what software should do, not what it can be made to do

Scanners can’t identify them
Lack intelligence and don’t know if something worked (or not)

WAFs / IDSs can’t defend them
All the HTTP requests appear completely normal

Business logic flaws = $$$3-5 years XSS, SQLi, and CSRF probably on the way out5Web-based online polls are an
extremely common way tocapture or sway public opinion.
No niche is too big or too narrow.

6Online Ballot Stuffing for Fameand Fortune
Web-based online polls are an
extremely common way tocapture or sway public opinion.
No niche is too big or too narrow.

6

7

In response to an Austin
beagle winning theWestminster Dog Show, theAustin American Statesman
newspaper held on online poll
(Austin's Best in Show) for
Central Texas (grouped bybreed). Thousands submitted
photos and voted on theirfavorite underdogs.

STATESMAN DOG SHOW
http://www.statesman.com/life/content/life/other/dogshow.html
7

7

In response to an Austin
beagle winning theWestminster Dog Show, theAustin American Statesman
newspaper held on online poll
(Austin's Best in Show) for
Central Texas (grouped bybreed). Thousands submitted
photos and voted on theirfavorite underdogs.
Prize: Bragging rights

STATESMAN DOG SHOW
http://www.statesman.com/life/content/life/other/dogshow.html
7

7

In response to an Austin
beagle winning theWestminster Dog Show, theAustin American Statesman
newspaper held on online poll
(Austin's Best in Show) for
Central Texas (grouped bybreed). Thousands submitted
photos and voted on theirfavorite underdogs.
Prize: Bragging rights
Winning the contest was all about percentages, not total
votes...
STATESMAN DOG SHOW
http://www.statesman.com/life/content/life/other/dogshow.html
78

How I Lost a Contest Involving Chihuahuas
http://ha.ckers.org/blog/20080709/how-i-lost-a-contest-involving-chihuahuas/
88

3 ways to cheat

How I Lost a Contest Involving Chihuahuas
http://ha.ckers.org/blog/20080709/how-i-lost-a-contest-involving-chihuahuas/
88

3 ways to cheat
1. Overwhelming the positive votes

How I Lost a Contest Involving Chihuahuas
http://ha.ckers.org/blog/20080709/how-i-lost-a-contest-involving-chihuahuas/
88

3 ways to cheat
1. Overwhelming the positive votes
2. Overwhelming the negative votes towards competitors

How I Lost a Contest Involving Chihuahuas
http://ha.ckers.org/blog/20080709/how-i-lost-a-contest-involving-chihuahuas/
88

3 ways to cheat
1. Overwhelming the positive votes
2. Overwhelming the negative votes towards competitors
3. At the last minute create a new dog and give it apositive vote - no chance of negative votes and you'll
win at 100% positive.

How I Lost a Contest Involving Chihuahuas
http://ha.ckers.org/blog/20080709/how-i-lost-a-contest-involving-chihuahuas/
88

3 ways to cheat
1. Overwhelming the positive votes
2. Overwhelming the negative votes towards competitors
3. At the last minute create a new dog and give it apositive vote - no chance of negative votes and you'll
win at 100% positive.
Robert “RSnake” Hansenʼs girlfriendʼs
co-worker asks him to help her
chihuahua “Tiny” win the contest.

How I Lost a Contest Involving Chihuahuas
http://ha.ckers.org/blog/20080709/how-i-lost-a-contest-involving-chihuahuas/
88

3 ways to cheat
1. Overwhelming the positive votes
2. Overwhelming the negative votes towards competitors
3. At the last minute create a new dog and give it apositive vote - no chance of negative votes and you'll
win at 100% positive.
Robert “RSnake” Hansenʼs girlfriendʼs
co-worker asks him to help her
chihuahua “Tiny” win the contest.
RSnake fires up Burp proxy...
How I Lost a Contest Involving Chihuahuas
http://ha.ckers.org/blog/20080709/how-i-lost-a-contest-involving-chihuahuas/89Burp Proxy
http://portswigger.net/proxy/99Taking the path of least resistanceattempts #1 - submits 2,000 votes

Burp Proxy
http://portswigger.net/proxy/99Taking the path of least resistanceattempts #1 - submits 2,000 votes

Burp Proxy
http://portswigger.net/proxy/

RSnake boosts Tiny into 1st...
9

10

10

10

“ChooChoo” pwns Tiny with technique #2
During the last minutes of the contest the competition
submitted 450+ negative votes, which still made Tiny thewinner in total by more than 2:1, however as a percentage
of positive to negative, Tiny lost by a landslide.

10

10

“ChooChoo” pwns Tiny with technique #2
During the last minutes of the contest the competition
submitted 450+ negative votes, which still made Tiny thewinner in total by more than 2:1, however as a percentage
of positive to negative, Tiny lost by a landslide.

Win
Loss!
10

Completely Automated Public
Turing test to tell Computers
and Humans Apart. Used forprotection against bots.

11

Solving CAPTCHA’s for Cash

Completely Automated Public
Turing test to tell Computers
and Humans Apart. Used forprotection against bots.

11

12

12

12

Spammers want to defeat CAPTCHAs to register for free
online accounts on Gmail, YahooMail, Windows Live
Mail, MySpace, FaceBook, etc. for spam distribution.
As CAPTCHA technology has become more ubiquitous amarket has emerged for those who can successfully
defeat the security measures in any manner possible.
CAPTCHA solving done in 3 ways...

12

13

1) Flawed Implementation• Not enough entropy in the answers• i.e. “what is 4 + 1?”• The same answers can be replayed
multiple times
CAPTCHA Effectiveness Test
1) Test should be administered where the human and the server are remote over a network.
2) Test should be simple for humans to pass.
3) Test should be solvable by humans in less than a several seconds.
4) Test should only be solvable by the human to which it was presented.
5) Test should be hard for computer to pass6) Knowledge of previous questions, answers, results, or combination thereof should not
impact the predictability of following tests.
7) Test should not discriminate against humans with visual or hearing impairments.
8) Test should not possess a geographic, cultural, or language bias.
CAPTCHA Effectiveness Test
http://jeremiahgrossman.blogspot.com/2006/09/captcha-effectiveness-test.html
http://i32.tinypic.com/2upqp6s.jpg
13142) OCRA Low-cost Attack on a Microsoft CAPTCHA“Our attack has achieved a segmentation success rate of 92%, andthis implies that the MSN scheme can be broken with an overall(segmentation and then recognition) success rate of more than 60%.”

A Low-cost automated attacks on Yahoo CAPTCHAs“Our second attack achieved a segmentation success rate ofaround 33.4% on this latest scheme. As a result, we estimate that
this scheme could be broken with an overall success rate of about
25.9%. Our results show that spammers never had to employ cheap
human labour to pass Yahoo CAPTCHAs. Rather, they could rely on
low-cost automated attacks. ”
Jeff Yan and Ahmad Salah El Ahmad
School of Computing Science, Newcastle University, England
Low-cost automated attacks on Yahoo CAPTCHAs
http://homepages.cs.ncl.ac.uk/jeff.yan/yahoo.htm
A Low-cost Attack on a Microsoft CAPTCHA
http://homepages.cs.ncl.ac.uk/jeff.yan/msn.htm
14153) Mechanical Turk / “The Turk”
Content Website(porn, games, etc.)

Target Website

User

Request content

Request CAPTCHA protected process
Use must answer CAPTCHA to view content

User CAPTCHA answer

Provide user with requested content

Relay CAPTCHA answer to the process

Pass / FailPC stripper helps spam to spread
http://news.bbc.co.uk/2/hi/technology/7067962.stm
Solving and creating captchas with free porn
http://www.boingboing.net/2004/01/27/solving-and-creating.html
15

16

Solving CAPTCHAs for Cashhttp://ha.ckers.org/blog/20070427/solving-captchas-for-cash/
web visum (vision, in latin) is your eyes for the web
http://www.webvisum.com/
16

16

RSnake is contacted by a Romanian CAPTCHA Solver...
“300-500 CAPTCHAs per person perhour. The clients pay between $9-15
per 1000 CAPTCHAs solved. The
team works around 12 hours a day
per person. That means they cansolve somewhere around 4800
CAPTCHAs per day per person, and,depending on how hard the
CAPTCHAs are, that can run you
around $50 per day per person (hisestimate).”Solving CAPTCHAs for Cashhttp://ha.ckers.org/blog/20070427/solving-captchas-for-cash/
web visum (vision, in latin) is your eyes for the web
http://www.webvisum.com/
16

17

Hello,
I’m from VietNam
We have a group with 20 person. We working some site
rabot, rubl, look…
Our rate just 4$ for per 1000 captcha solved.
We hope work you
Best Regard,
QuangHung17

18

Hi!!! Hope you are doing well. We the leading Data
processing company in Bangladesh. Presently we areprocessing 100000+ captcha per day by our 30
operators. We have a well set up and We can give the law
rate for the captcha solving.
Our rate $2 per 1000
captcha.yahoo,hotmail,mayspace,gmail, facebook etc.
We just wanna make the relationship for long terms. canwe go forward? Thank you.
Best Regards
shakilur rahaman shohe

18

19

Babu Says:
Dear Sir,
I am interested to work for data enty. Please call me
0171-3335000

19

Everyone forgets theirpassword(s) eventually and toease customer support costs,
password recovery features areheavily relied upon.

20

Recover someone else’s
password - it’s a feature!
Everyone forgets theirpassword(s) eventually and toease customer support costs,
password recovery features areheavily relied upon.

20

21

Hijack a Sprint user's accounts

With just acell phone
number...

“change their billing address, order a whole bunch of cellphones sent to adrop location, and leave the victim paying the bill. There's also the stalker's wet
dream: add GPS tracking to their cellphone and secretly watch their every
movement from any computer.”
Flawed Security Lets Sprint Accounts Get Easily Hijacked
http://consumerist.com/tag/identity-theft/?i=376845&t=flawed-security-lets-sprint-accounts-get-easily-hijacked
21

22

22

23

23

24

24

24

Email preferred over secret questions

24

25

Heavy WebMail Adoption
ProviderYahoo Mail
Hotmail/Live
Gmail
AOL Mail
QQ.comNo. of Users (mm)
262.2
256.4
87.1
48.9
31.4

Web Mail Services Market Share (Comscore, Oct 2007)
http://500hats.typepad.com/500blogs/2008/03/web-mail-serv-1.html
25

26

China-based online “Password Recovery” services:
You pay them to hack into “your” account.
300 Yuan ($43) to break an overseas mailbox password,with 85% probability of success.
200 Yuan ($29) to break a domestic mailbox password,with 90% probability of success.
1000 Yuan ($143) to break a company’s mailbox
password (no success rate given).
Also on the menu:
passwords for 163, 126, QQ, Yahoo, Sohu, Sina, TOM,
Hotmail, MSN…etc.
Mailbox passwords for sale, Chinese hacker business or scam?
http://www.thedarkvisitor.com/2008/04/mailbox-passwords-for-sale-chinese-hacker-business-or-scam/
http://news.cnnb.com.cn/system/2008/04/14/005548493.shtml
26

27

Variable project-based pricing $150
(USD) minimum. They accept
Western Union.

Hire to Hack
http://www.hire2hack.net/

27

28

It’s All About Timing - Sensepost Research
http://www.sensepost.com/research/squeeza/vegas_2007_timing.pdf
28

28

Usernames are valuable too, especiallywhen theyʼre email addresses.

It’s All About Timing - Sensepost Research
http://www.sensepost.com/research/squeeza/vegas_2007_timing.pdf
28

28

Usernames are valuable too, especiallywhen theyʼre email addresses.
Phishers use login and password recovery screens tomine for valid email addresses using timing attacks.

It’s All About Timing - Sensepost Research
http://www.sensepost.com/research/squeeza/vegas_2007_timing.pdf
28

28

Usernames are valuable too, especiallywhen theyʼre email addresses.
Phishers use login and password recovery screens tomine for valid email addresses using timing attacks.
Many large ecommerce portals and social networks
consider valid email address disclosures a high severity
issue because of how their websites operate and what it
can lead to.

It’s All About Timing - Sensepost Research
http://www.sensepost.com/research/squeeza/vegas_2007_timing.pdf
28

28

Usernames are valuable too, especiallywhen theyʼre email addresses.
Phishers use login and password recovery screens tomine for valid email addresses using timing attacks.
Many large ecommerce portals and social networks
consider valid email address disclosures a high severity
issue because of how their websites operate and what it
can lead to.
Unfortunately the only tool we have to fight against
timing attacks is time. And time = money.
It’s All About Timing - Sensepost Research
http://www.sensepost.com/research/squeeza/vegas_2007_timing.pdf
28

eCoupons are used during
online checkout. The customer
enters a unique id and a
discount is applied to their order.

29

Monetizing eCoupons
eCoupons are used during
online checkout. The customer
enters a unique id and a
discount is applied to their order.

29

30

30

30

A large online retailer offered an
eCoupon program...

30

30

A large online retailer offered an
eCoupon program...
• Coupon (i.e. AmEx) worth between a couple dollars and several
hundred contained 16-digit IDs where large sections were static andthe rest sequential.

30

30

A large online retailer offered an
eCoupon program...
• Coupon (i.e. AmEx) worth between a couple dollars and several
hundred contained 16-digit IDs where large sections were static andthe rest sequential.
3400 0000 0000 009

30

30

A large online retailer offered an
eCoupon program...
• Coupon (i.e. AmEx) worth between a couple dollars and several
hundred contained 16-digit IDs where large sections were static andthe rest sequential.
3400 0000 0000 009
3400 0000 0000 109

30

30

A large online retailer offered an
eCoupon program...
• Coupon (i.e. AmEx) worth between a couple dollars and several
hundred contained 16-digit IDs where large sections were static andthe rest sequential.
3400 0000 0000 009
3400 0000 0000 109
3400 0000 0000 509

30

30

A large online retailer offered an
eCoupon program...
• Coupon (i.e. AmEx) worth between a couple dollars and several
hundred contained 16-digit IDs where large sections were static andthe rest sequential.
3400 0000 0000 009
3400 0000 0000 109
3400 0000 0000 509• Initially only 3 coupons were allowed to be applied to a single order,
until the program became popular with larger orders and the restriction
was removed.

30

30

A large online retailer offered an
eCoupon program...
• Coupon (i.e. AmEx) worth between a couple dollars and several
hundred contained 16-digit IDs where large sections were static andthe rest sequential.
3400 0000 0000 009
3400 0000 0000 109
3400 0000 0000 509• Initially only 3 coupons were allowed to be applied to a single order,
until the program became popular with larger orders and the restriction
was removed.

• Someone developed a script trying thousands of possible valid coupon
IDs. Orders of merchandise worth over $50,000 were bought for mere
dollars where 200 or more individual coupons applied.
30

31

31

31

The problem went unnoticed until...

31

31

The problem went unnoticed until...
• A system capacity planning exercise uncovered CPU
utilization during the night was spiking at 90%+, where
during normal peak usage it was never that high.

31

31

The problem went unnoticed until...
• A system capacity planning exercise uncovered CPU
utilization during the night was spiking at 90%+, where
during normal peak usage it was never that high.

• The FBI investigated, but the products were sent to a
non-existent address.

31

31

The problem went unnoticed until...
• A system capacity planning exercise uncovered CPU
utilization during the night was spiking at 90%+, where
during normal peak usage it was never that high.

• The FBI investigated, but the products were sent to a
non-existent address.

• Apparently the person colluded with a mail carrier whointercepted the merchandise.

31

31

The problem went unnoticed until...
• A system capacity planning exercise uncovered CPU
utilization during the night was spiking at 90%+, where
during normal peak usage it was never that high.

• The FBI investigated, but the products were sent to a
non-existent address.

• Apparently the person colluded with a mail carrier whointercepted the merchandise.
Coupons are not currency, only a tool for marketing.
Instead investigated by the Secret Service and now
they face counts of mail fraud.

31

"Micro-deposits" of a random
few cents ($0.01 - $2.00) areused to verify financial accounts
and routing numbers arecorrect and to verify that
customers received it.

32Real life: Office Space Hack
"Micro-deposits" of a random
few cents ($0.01 - $2.00) areused to verify financial accounts
and routing numbers arecorrect and to verify that
customers received it.

32

33

Michael Largent, 22, of Plumas Lake, California allegedly...
Opened 58,000 brokerage accounts“used fake names, addresses and Social
Security numbers for the brokerage accounts.
Largent allegedly favored cartoon charactersfor the names, including Johnny Blaze, Kingof the Hill patriarch Hank Hill, and Rusty
Shackelford. That last name is doubly-fake -it's the alias commonly used by the paranoid
exterminator Dale Gribble on King of the Hill.”

Linked to a dozen online bankaccounts including Capital
One, Bancorp Metabank,
Greendot and Skylight.
Man Allegedly Bilks E-trade, Schwab of $50,000 by Collecting Lots of Free 'Micro-Deposits'
http://blog.wired.com/27bstroke6/2008/05/man-allegedly-b.html
33

34

34

34

Google's Checkout: $8,225

34

34

Google's Checkout: $8,225

E*TRADE, Schwab: $50,225

34

34

Google's Checkout: $8,225

E*TRADE, Schwab: $50,225
Profited using pre-paid debit cards

34

34

Google's Checkout: $8,225

E*TRADE, Schwab: $50,225
Profited using pre-paid debit cards
Faces four counts each of computer fraud, wire fraud
and mail fraud.

34

34

Google's Checkout: $8,225

E*TRADE, Schwab: $50,225
Profited using pre-paid debit cards
Faces four counts each of computer fraud, wire fraud
and mail fraud.

Snared by the U.S. Patriot Act

34

Application Service Providers(ASP) offer hosting for banks,
credit unions, and otherfinancial services companies.
ASPs are attractive targets
because instead of hacking asingle financial institution, an
attacker could compromise
dozens/hundreds/thousands.

35

“You’re a hacker!?
Can you hack a bank?”
Application Service Providers(ASP) offer hosting for banks,
credit unions, and otherfinancial services companies.
ASPs are attractive targets
because instead of hacking asingle financial institution, an
attacker could compromise
dozens/hundreds/thousands.

35

36

The System• An ASP provides hosting for banks, credit unions, andother financial services companies. ASPs are attractive
targets because instead of focusing on one back at atime, an attack could compromise dozens/hundreds/
thousands at a time with the same vulnerability.

• The banking application had three important URL
parameters: client_id, bank_id, and acct_id. To the
ASP, each of their clients has an unique ID, eachpotentially with several different banking websites, andeach bank having any number of customer bankaccounts.
http://website/app.cgi?client_id=10&bank_id=100&acct_id=1000
36

37

How to hack 600 banks...

37

37

How to hack 600 banks...

http://website/app.cgi?client_id=10&bank_id=100&acct_id=1000
37

37

How to hack 600 banks...
• We changed the acct_id to an arbitrary yet valid account #,and the error said, “Account #X belongs to Bank #Y”

http://website/app.cgi?client_id=10&bank_id=100&acct_id=1000
37

37

How to hack 600 banks...
• We changed the acct_id to an arbitrary yet valid account #,and the error said, “Account #X belongs to Bank #Y”• We then changed the bank_id to #Y, and an error said,“Bank #Y belong to Client #Z”

http://website/app.cgi?client_id=10&bank_id=100&acct_id=1000
37

37

How to hack 600 banks...
• We changed the acct_id to an arbitrary yet valid account #,and the error said, “Account #X belongs to Bank #Y”• We then changed the bank_id to #Y, and an error said,“Bank #Y belong to Client #Z”• We changed the client_id to #Z, and you could drop into
anyone elseʼs bank account, on any bank, on any client.

http://website/app.cgi?client_id=10&bank_id=100&acct_id=1000
37

37

How to hack 600 banks...
• We changed the acct_id to an arbitrary yet valid account #,and the error said, “Account #X belongs to Bank #Y”• We then changed the bank_id to #Y, and an error said,“Bank #Y belong to Client #Z”• We changed the client_id to #Z, and you could drop into
anyone elseʼs bank account, on any bank, on any client.

Success!!!

http://website/app.cgi?client_id=10&bank_id=100&acct_id=1000
37

37

How to hack 600 banks...
• We changed the acct_id to an arbitrary yet valid account #,and the error said, “Account #X belongs to Bank #Y”• We then changed the bank_id to #Y, and an error said,“Bank #Y belong to Client #Z”• We changed the client_id to #Z, and you could drop into
anyone elseʼs bank account, on any bank, on any client.

Success!!!
No notion of “authorization”

http://website/app.cgi?client_id=10&bank_id=100&acct_id=1000
37

37

How to hack 600 banks...
• We changed the acct_id to an arbitrary yet valid account #,and the error said, “Account #X belongs to Bank #Y”• We then changed the bank_id to #Y, and an error said,“Bank #Y belong to Client #Z”• We changed the client_id to #Z, and you could drop into
anyone elseʼs bank account, on any bank, on any client.

Success!!!
No notion of “authorization”
First pass at the fix commented out the error in theHTML, while the “real” fix would go in at someunspecified time in the future.
http://website/app.cgi?client_id=10&bank_id=100&acct_id=1000
37

38

Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
http://research.corsaire.com/whitepapers/technical.html
38

38

Reverse Money Transfer

Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
http://research.corsaire.com/whitepapers/technical.html
38

38

Reverse Money Transfer
Normal: $10,000 from Account A to Account B

Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
http://research.corsaire.com/whitepapers/technical.html
38

38

Reverse Money Transfer
Normal: $10,000 from Account A to Account B
A = A - ($10,000)

Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
http://research.corsaire.com/whitepapers/technical.html
38

38

Reverse Money Transfer
Normal: $10,000 from Account A to Account B
A = A - ($10,000)
B = B + ($10,000)

Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
http://research.corsaire.com/whitepapers/technical.html
38

38

Reverse Money Transfer
Normal: $10,000 from Account A to Account B
A = A - ($10,000)
B = B + ($10,000)
Negative: -$10,000 from Account A to Account B

Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
http://research.corsaire.com/whitepapers/technical.html
38

38

Reverse Money Transfer
Normal: $10,000 from Account A to Account B
A = A - ($10,000)
B = B + ($10,000)
Negative: -$10,000 from Account A to Account B
A = A - (-$10,000)

Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
http://research.corsaire.com/whitepapers/technical.html
38

38

Reverse Money Transfer
Normal: $10,000 from Account A to Account B
A = A - ($10,000)
B = B + ($10,000)
Negative: -$10,000 from Account A to Account B
A = A - (-$10,000)
B = B + (-$10,000)

Breaking the Bank (Vulnerabilities in Numeric Processing within Financial Applications)
http://research.corsaire.com/whitepapers/technical.html
38

39“Back-end business controls
will prevent these issues.”
ASP Security Contact

39

39

“Back-end business controls
will prevent these issues.”
ASP Security Contacta few weeks later...
39

40

40

40

40

40

a couple months later...
40

41$70,000 illegally wired to an eastern
european country.

41

41

$70,000 illegally wired to an eastern
european country.
Money not recoverable.

41

41

$70,000 illegally wired to an eastern
european country.
Money not recoverable.
ASP lost a customer.

41

41

$70,000 illegally wired to an eastern
european country.
Money not recoverable.
ASP lost a customer.
Other customers affected: unknown

41

People order things online, thenchange their minds, and cancel.

42

When back-end ordercancellation procedures are alittle too slow
People order things online, thenchange their minds, and cancel.

42

43

Woman admits fleecing shopping network of more than $412,000
http://www.theregister.co.uk/2007/10/30/website_fraud_guilty_plea/
http://consumerist.com/consumer/crime/woman-exploited-bug-on-qvc-website-to-steal-over-400k-in-merchandise-317045.php
http://www.msnbc.msn.com/id/21534526/
4343Quantina Moore-Perry, 33, of Greensboro, N.C.,

Woman admits fleecing shopping network of more than $412,000
http://www.theregister.co.uk/2007/10/30/website_fraud_guilty_plea/
http://consumerist.com/consumer/crime/woman-exploited-bug-on-qvc-website-to-steal-over-400k-in-merchandise-317045.php
http://www.msnbc.msn.com/id/21534526/
4343Quantina Moore-Perry, 33, of Greensboro, N.C.,
Ordered (then cancelled) over 1,800 items online
at QVC including handbags, housewares, jewelry
and electronics

Woman admits fleecing shopping network of more than $412,000
http://www.theregister.co.uk/2007/10/30/website_fraud_guilty_plea/
http://consumerist.com/consumer/crime/woman-exploited-bug-on-qvc-website-to-steal-over-400k-in-merchandise-317045.php
http://www.msnbc.msn.com/id/21534526/
4343Quantina Moore-Perry, 33, of Greensboro, N.C.,
Ordered (then cancelled) over 1,800 items online
at QVC including handbags, housewares, jewelry
and electronics

Products were shipped anyway

Woman admits fleecing shopping network of more than $412,000
http://www.theregister.co.uk/2007/10/30/website_fraud_guilty_plea/
http://consumerist.com/consumer/crime/woman-exploited-bug-on-qvc-website-to-steal-over-400k-in-merchandise-317045.php
http://www.msnbc.msn.com/id/21534526/
4343Quantina Moore-Perry, 33, of Greensboro, N.C.,
Ordered (then cancelled) over 1,800 items online
at QVC including handbags, housewares, jewelry
and electronics

Products were shipped anyway

Auctioned off on eBay

Woman admits fleecing shopping network of more than $412,000
http://www.theregister.co.uk/2007/10/30/website_fraud_guilty_plea/
http://consumerist.com/consumer/crime/woman-exploited-bug-on-qvc-website-to-steal-over-400k-in-merchandise-317045.php
http://www.msnbc.msn.com/id/21534526/
4343Quantina Moore-Perry, 33, of Greensboro, N.C.,
Ordered (then cancelled) over 1,800 items online
at QVC including handbags, housewares, jewelry
and electronics

Products were shipped anyway

Auctioned off on eBay

Profited $412,000
Woman admits fleecing shopping network of more than $412,000
http://www.theregister.co.uk/2007/10/30/website_fraud_guilty_plea/
http://consumerist.com/consumer/crime/woman-exploited-bug-on-qvc-website-to-steal-over-400k-in-merchandise-317045.php
http://www.msnbc.msn.com/id/21534526/
4344“QVC became aware of the
problem after being
contacted by two people
who bought the items, still in
QVC packaging, on the
online auction site.”
Pleaded guilty in federal court to wire fraud.

44

45

FTC - Unordered Merchandise
http://www.ftc.gov/bcp/edu/pubs/consumer/products/pro15.shtm
45

Online merchants andadvertisers enlist the services ofaffiliate networks to drive traffic
and/or customers to theirwebsites in exchange for ashare of the revenue generate.

46

Affiliate Scams

Online merchants andadvertisers enlist the services ofaffiliate networks to drive traffic
and/or customers to theirwebsites in exchange for ashare of the revenue generate.

46

47

The players
Merchant: Pays commissions to affiliates for customer
clicks, account sign-ups, purchases, etc.
Affiliate: Collects commissions for driving customers
towards merchants in the form of cost per-click (CPC)or cost per-acquisition (CPA).
Customer: The person who buys stuff or signs-up for
promotions.
Affiliate Network: Technology framework connecting
and monitoring the merchant, affiliate, and customer.

47

48

48

48

48

49

49

49

The way itʼs supposed to work...

49

49

The way itʼs supposed to work...
1. Affiliate signs-up with an affiliate network and places
special links on their web page(s)

49

49

The way itʼs supposed to work...
1. Affiliate signs-up with an affiliate network and places
special links on their web page(s)<a href=”http://AffiliateNetwork/p?
program=50&affiliate_id=100/”>really cool product!</a>

49

49

The way itʼs supposed to work...
1. Affiliate signs-up with an affiliate network and places
special links on their web page(s)<a href=”http://AffiliateNetwork/p?
program=50&affiliate_id=100/”>really cool product!</a>2. When users click the link their browser is sent throughaffiliate network where they receive a special tracking cookie
and then redirected to the merchant page.

49

49

The way itʼs supposed to work...
1. Affiliate signs-up with an affiliate network and places
special links on their web page(s)<a href=”http://AffiliateNetwork/p?
program=50&affiliate_id=100/”>really cool product!</a>2. When users click the link their browser is sent throughaffiliate network where they receive a special tracking cookie
and then redirected to the merchant page.
Set-Cookie: AffiliateID=100

49

49

The way itʼs supposed to work...
1. Affiliate signs-up with an affiliate network and places
special links on their web page(s)<a href=”http://AffiliateNetwork/p?
program=50&affiliate_id=100/”>really cool product!</a>2. When users click the link their browser is sent throughaffiliate network where they receive a special tracking cookie
and then redirected to the merchant page.
Set-Cookie: AffiliateID=100
3.If the customer buys something within X time period (i.e.
affiliate cookie still exists) the affiliate receives a commission.

49

49

The way itʼs supposed to work...
1. Affiliate signs-up with an affiliate network and places
special links on their web page(s)<a href=”http://AffiliateNetwork/p?
program=50&affiliate_id=100/”>really cool product!</a>2. When users click the link their browser is sent throughaffiliate network where they receive a special tracking cookie
and then redirected to the merchant page.
Set-Cookie: AffiliateID=100
3.If the customer buys something within X time period (i.e.
affiliate cookie still exists) the affiliate receives a commission.
Using effective SEO tactics...
49

50

50

51

51

51

51

52

http://hubpages.com/hub/Google_Adsense_King_-_1_Million_Dollars_Check_-_Markus_Frind_Exclusive_Interview
52

53

53

53

53

53

“It was a check for 2 months because the first checkthey sent was so big it was rejected by his bank.”

53

54

Affiliate Programs Vulnerable to Cross-site Request Forgery Fraud
http://www.cgisecurity.org/2008/08/affiliate-progr.html
54

54

Cookie-Stuffing Circa 2002
Nothing besides pesky affiliate networks terms ofservice requires the user to actually “click a link” to becookied with an affiliate ID.
Instead of:<a href=”http://AffiliateNetwork/p?
program=50&affiliate_id=100/”>really cool product!</a>Use:<img src=”http://AffiliateNetwork/p?program=50&affiliate_id=100/”>

or:<iframe src=”http://AffiliateNetwork/p?
program=50&affiliate_id=100/” width=”0” height=”0”></iframe>
Affiliate Programs Vulnerable to Cross-site Request Forgery Fraud
http://www.cgisecurity.org/2008/08/affiliate-progr.html

Invisible!
54

Aggressive affiliates figure out they can post their code
anywhere online and not just on their own websites(message boards, guest books, social networks, etc).

55

http://www.blackhatworld.com/blackhat-seo/
http://www.gfy.com/
http://www.seoblackhat.com/forum/
55

Aggressive affiliates figure out they can post their code
anywhere online and not just on their own websites(message boards, guest books, social networks, etc).

55

By 2005, Merchants and Affiliate Networks got wise tocookie stuffing, start monitoring referers and conversion
rates, and began kicking out suspicious affiliates.
http://www.blackhatworld.com/blackhat-seo/
http://www.gfy.com/
http://www.seoblackhat.com/forum/
55

56

56

56

Cookie-Stuffing Circa 2007

56

56

Cookie-Stuffing Circa 2007
Affiliates start posting their code on SSL pages.

56

56

Cookie-Stuffing Circa 2007
Affiliates start posting their code on SSL pages.
“Clients SHOULD NOT include a Referer header field in a(non-secure) HTTP request if the referring page wastransferred with a secure protocol.” - RFC 2616

56

56

Cookie-Stuffing Circa 2007
Affiliates start posting their code on SSL pages.
“Clients SHOULD NOT include a Referer header field in a(non-secure) HTTP request if the referring page wastransferred with a secure protocol.” - RFC 2616

Bottom line: No referer is sent to the affiliate to be
tracked. FYI: Not every browser behaves this way, butthere are many other methods to do the same using
meta-refreshes and JavaScript.

56

56

Cookie-Stuffing Circa 2007
Affiliates start posting their code on SSL pages.
“Clients SHOULD NOT include a Referer header field in a(non-secure) HTTP request if the referring page wastransferred with a secure protocol.” - RFC 2616

Bottom line: No referer is sent to the affiliate to be
tracked. FYI: Not every browser behaves this way, butthere are many other methods to do the same using
meta-refreshes and JavaScript.
2008: DNS-Rebinding, GIFAR, Flash malware
56

57

57

57

Gaming customer referral incentives

57

57

Gaming customer referral incentives
1. A merchants marketing promotion pays affiliates $5 - 50
commission for each new user the refer who registers byentering a new credit card number. Often it’s not required thatthe user buy anything, perhaps only “participate”.

57

57

Gaming customer referral incentives
1. A merchants marketing promotion pays affiliates $5 - 50
commission for each new user the refer who registers byentering a new credit card number. Often it’s not required thatthe user buy anything, perhaps only “participate”.
2. Unscrupulous affiliates may register new bogus accounts
thousands of times a day with easily obtained one-time credit
card numbers. The merchant has no way of knowing that acredit card number is a one-time use card.

57

57

Gaming customer referral incentives
1. A merchants marketing promotion pays affiliates $5 - 50
commission for each new user the refer who registers byentering a new credit card number. Often it’s not required thatthe user buy anything, perhaps only “participate”.
2. Unscrupulous affiliates may register new bogus accounts
thousands of times a day with easily obtained one-time credit
card numbers. The merchant has no way of knowing that acredit card number is a one-time use card.
3.Sources say tens of thousands to hundreds of thousands ofdollars have been gleaned using this method in several
different marketing promotions.

57

58

58

58

Gaming referral revenue from purchases

58

58

Gaming referral revenue from purchases
1. Merchants pay affiliates a commissions for online referralpurchases.

58

58

Gaming referral revenue from purchases
1. Merchants pay affiliates a commissions for online referralpurchases.
2.Stolen credit card numbers are used to buy an item andshipped to the owner - therefore no fraud alert is issued andaffiliate is paid their commission.

58

58

Gaming referral revenue from purchases
1. Merchants pay affiliates a commissions for online referralpurchases.
2.Stolen credit card numbers are used to buy an item andshipped to the owner - therefore no fraud alert is issued andaffiliate is paid their commission.
3. Days or weeks later the credit card owner receives theitems, reports the errors, disputes the purchase, and ships theitem back. Should the merchant wish to take back theircommission it is usually too late because the affiliate has been
paid and long gone with the money.

58

Insider: someone with a fiduciaryrole within a company. A corporate
executive, investment banker or
attorney. Not a hacker.

59Making Millions by Trading on
Semi-public Information
Insider: someone with a fiduciaryrole within a company. A corporate
executive, investment banker or
attorney. Not a hacker.

59

60

Getting the word out...
Business Wire provides a service where registered website users
receive a stream of up-to-date press releases. Press releases arefunneled to Business Wire by various organizations, which aresometimes embargoed temporarily because the information may affectthe value of a stock.
Press release files are uploaded to the Web server (Business Wire), but
not linked, until the embargo is lifted. At such time, the press release
Web pages are linked into the main website and users are notified with
URLs similar to the following:
http://website/press_release/08/29/2007/00001.html
http://website/press_release/08/29/2007/00002.html
http://website/press_release/08/29/2007/00003.html
Before granting read access to the press release Web page, the system
ensures the user is properly logged-in.

60

61

SEC Vs. The Estonian Spiders
http://www.webpronews.com/topnews/2005/11/02/sec-vs-the-estonian-spiders
61

61

Just because you can't see it doesn'tmean it's not there.

SEC Vs. The Estonian Spiders
http://www.webpronews.com/topnews/2005/11/02/sec-vs-the-estonian-spiders
61

61

Just because you can't see it doesn'tmean it's not there.
An Estonian financial firm, Lohmus Haavel & Viisemann, discoveredthat the press release Web page URLs were named in a predictablefashion.

SEC Vs. The Estonian Spiders
http://www.webpronews.com/topnews/2005/11/02/sec-vs-the-estonian-spiders
61

61

Just because you can't see it doesn'tmean it's not there.
An Estonian financial firm, Lohmus Haavel & Viisemann, discoveredthat the press release Web page URLs were named in a predictablefashion.
And, while links might not yet exist because the embargo was inplace, it didn’t mean a user couldn’t guess at the filename and gain
access to the file. This method worked because the only security
check Business Wire conducted was to ensure the user wasproperly logged-in, nothing more.

SEC Vs. The Estonian Spiders
http://www.webpronews.com/topnews/2005/11/02/sec-vs-the-estonian-spiders
61

61

Just because you can't see it doesn'tmean it's not there.
An Estonian financial firm, Lohmus Haavel & Viisemann, discoveredthat the press release Web page URLs were named in a predictablefashion.
And, while links might not yet exist because the embargo was inplace, it didn’t mean a user couldn’t guess at the filename and gain
access to the file. This method worked because the only security
check Business Wire conducted was to ensure the user wasproperly logged-in, nothing more.
According to the SEC, which began an investigation, Lohmus Haavel& Viisemann profited over $8 million by trading on the information
they obtained.
SEC Vs. The Estonian Spiders
http://www.webpronews.com/topnews/2005/11/02/sec-vs-the-estonian-spiders
61

62

Ukrainian Hacker Makes a Killing in Stock Market Fraud
http://blog.wired.com/27bstroke6/2008/02/ukrainian-hacke.html
Ukrainian hacker may get to keep profits
http://www.vnunet.com/vnunet/news/2209899/hacker-keep-profits62

62

A Ukrainian hacker breaks into Thomson
Financial and steals a gloomy results
announcement for IMS Health, hours before
its release to the stock market ...

Ukrainian Hacker Makes a Killing in Stock Market Fraud
http://blog.wired.com/27bstroke6/2008/02/ukrainian-hacke.html
Ukrainian hacker may get to keep profits
http://www.vnunet.com/vnunet/news/2209899/hacker-keep-profits62

62

A Ukrainian hacker breaks into Thomson
Financial and steals a gloomy results
announcement for IMS Health, hours before
its release to the stock market ...
• Hacker enters ~$42,000 in sell orders betting the stock will fall

Ukrainian Hacker Makes a Killing in Stock Market Fraud
http://blog.wired.com/27bstroke6/2008/02/ukrainian-hacke.html
Ukrainian hacker may get to keep profits
http://www.vnunet.com/vnunet/news/2209899/hacker-keep-profits62

62

A Ukrainian hacker breaks into Thomson
Financial and steals a gloomy results
announcement for IMS Health, hours before
its release to the stock market ...
• Hacker enters ~$42,000 in sell orders betting the stock will fall
• The stock fell sharply making the hacker ~$300,000

Ukrainian Hacker Makes a Killing in Stock Market Fraud
http://blog.wired.com/27bstroke6/2008/02/ukrainian-hacke.html
Ukrainian hacker may get to keep profits
http://www.vnunet.com/vnunet/news/2209899/hacker-keep-profits62

62

A Ukrainian hacker breaks into Thomson
Financial and steals a gloomy results
announcement for IMS Health, hours before
its release to the stock market ...
• Hacker enters ~$42,000 in sell orders betting the stock will fall
• The stock fell sharply making the hacker ~$300,000• Red flags appear and the SEC freezes the funds

Ukrainian Hacker Makes a Killing in Stock Market Fraud
http://blog.wired.com/27bstroke6/2008/02/ukrainian-hacke.html
Ukrainian hacker may get to keep profits
http://www.vnunet.com/vnunet/news/2209899/hacker-keep-profits62

62

A Ukrainian hacker breaks into Thomson
Financial and steals a gloomy results
announcement for IMS Health, hours before
its release to the stock market ...
• Hacker enters ~$42,000 in sell orders betting the stock will fall
• The stock fell sharply making the hacker ~$300,000• Red flags appear and the SEC freezes the funds• Funds are ordered to be released, “Dorozhko’s alleged ‘stealing andtrading’ or ‘hacking and trading’ does not amount to a violation” ofsecurities laws, Judge Naomi Reice Buchwald

Ukrainian Hacker Makes a Killing in Stock Market Fraud
http://blog.wired.com/27bstroke6/2008/02/ukrainian-hacke.html
Ukrainian hacker may get to keep profits
http://www.vnunet.com/vnunet/news/2209899/hacker-keep-profits62

62

A Ukrainian hacker breaks into Thomson
Financial and steals a gloomy results
announcement for IMS Health, hours before
its release to the stock market ...
• Hacker enters ~$42,000 in sell orders betting the stock will fall
• The stock fell sharply making the hacker ~$300,000• Red flags appear and the SEC freezes the funds• Funds are ordered to be released, “Dorozhko’s alleged ‘stealing andtrading’ or ‘hacking and trading’ does not amount to a violation” ofsecurities laws, Judge Naomi Reice Buchwald• The Times speculates that the DoJ has simply deemed the case not
worth pursuing - probably due to the difficulties involved in gaining
cooperation from local authorities to capture criminals in Ukraine.

Ukrainian Hacker Makes a Killing in Stock Market Fraud
http://blog.wired.com/27bstroke6/2008/02/ukrainian-hacke.html
Ukrainian hacker may get to keep profits
http://www.vnunet.com/vnunet/news/2209899/hacker-keep-profits
62

63

63

63

Passive intelligence gathering
When online purchases are made, customers are usuallyprovided an order tracking ID - often (semi)-sequential.
320041132004123200413...

Pen-testers notoriously try to rotate URLs to gain accessto other people’s order information often containing PII:
http://foo/order_tracking?id=3200415
http://foo/order_tracking?id=3200416
http://foo/order_tracking?id=3200417
...

63

63

Passive intelligence gathering
When online purchases are made, customers are usuallyprovided an order tracking ID - often (semi)-sequential.
320041132004123200413...

Pen-testers notoriously try to rotate URLs to gain accessto other people’s order information often containing PII:
http://foo/order_tracking?id=3200415
http://foo/order_tracking?id=3200416
http://foo/order_tracking?id=3200417...

but we don’t care about PII, only the number itself...
63

64

64

64

The art of inference

64

64

The art of inference
If one could closely estimate how many “orders” apublic company was on track to process at the end of
a quarter, you may be able to infer (based upon
historical data) how well they are going to do (or how
the stock price will move).

64

64

The art of inference
If one could closely estimate how many “orders” apublic company was on track to process at the end of
a quarter, you may be able to infer (based upon
historical data) how well they are going to do (or how
the stock price will move).
Often these order numbers can be obtained without
actually fulfilling order, OR, order then cancel.

64

64

The art of inference
If one could closely estimate how many “orders” apublic company was on track to process at the end of
a quarter, you may be able to infer (based upon
historical data) how well they are going to do (or how
the stock price will move).
Often these order numbers can be obtained without
actually fulfilling order, OR, order then cancel.
Hopefully the items won’t show up anyway. :)

64

64

The art of inference
If one could closely estimate how many “orders” apublic company was on track to process at the end of
a quarter, you may be able to infer (based upon
historical data) how well they are going to do (or how
the stock price will move).
Often these order numbers can be obtained without
actually fulfilling order, OR, order then cancel.
Hopefully the items won’t show up anyway. :)320041864

64

The art of inference
If one could closely estimate how many “orders” apublic company was on track to process at the end of
a quarter, you may be able to infer (based upon
historical data) how well they are going to do (or how
the stock price will move).
Often these order numbers can be obtained without
actually fulfilling order, OR, order then cancel.
Hopefully the items won’t show up anyway. :)3200418320041964

64

The art of inference
If one could closely estimate how many “orders” apublic company was on track to process at the end of
a quarter, you may be able to infer (based upon
historical data) how well they are going to do (or how
the stock price will move).
Often these order numbers can be obtained without
actually fulfilling order, OR, order then cancel.
Hopefully the items won’t show up anyway. :)32004183200419320042064

64

The art of inference
If one could closely estimate how many “orders” apublic company was on track to process at the end of
a quarter, you may be able to infer (based upon
historical data) how well they are going to do (or how
the stock price will move).
Often these order numbers can be obtained without
actually fulfilling order, OR, order then cancel.
Hopefully the items won’t show up anyway. :)320041832004193200420
...

64

65

65

65

Business logic flaws = $$$

65

65

Business logic flaws = $$$Prime target for the bad guys

65

65

Business logic flaws = $$$Prime target for the bad guys

Test often, test everywhere

65

65

Business logic flaws = $$$Prime target for the bad guys

Test often, test everywhereNot all vulnerabilities can be identified in the design phase,by analyzing the code, or even during QA

65

65

Business logic flaws = $$$Prime target for the bad guys

Test often, test everywhereNot all vulnerabilities can be identified in the design phase,by analyzing the code, or even during QA

Detect attacks by profiling

65

65

Business logic flaws = $$$Prime target for the bad guys

Test often, test everywhereNot all vulnerabilities can be identified in the design phase,by analyzing the code, or even during QA

Detect attacks by profiling
HTTP requests appear legitimate, but active attacks willappear anomalous

65

66

66

66

Solving CAPTCHAs - $ four figures

66

66

Solving CAPTCHAs - $ four figures
Manipulating payment systems - $ five figures

66

66

Solving CAPTCHAs - $ four figures
Manipulating payment systems - $ five figures
Hacking Banks - $ high five figures

66

66

Solving CAPTCHAs - $ four figures
Manipulating payment systems - $ five figures
Hacking Banks - $ high five figures
Scamming eCommerce - $ six figures

66

66

Solving CAPTCHAs - $ four figures
Manipulating payment systems - $ five figures
Hacking Banks - $ high five figures
Scamming eCommerce - $ six figures
Exploiting Affiliate Networks - $ high six figures

66

66

Solving CAPTCHAs - $ four figures
Manipulating payment systems - $ five figures
Hacking Banks - $ high five figures
Scamming eCommerce - $ six figures
Exploiting Affiliate Networks - $ high six figures
Gaming the stock market - $ seven figures

66

66

Solving CAPTCHAs - $ four figures
Manipulating payment systems - $ five figures
Hacking Banks - $ high five figures
Scamming eCommerce - $ six figures
Exploiting Affiliate Networks - $ high six figures
Gaming the stock market - $ seven figures

Beating RSnake by hacking in achihuahua contest:

66

66

Solving CAPTCHAs - $ four figures
Manipulating payment systems - $ five figures
Hacking Banks - $ high five figures
Scamming eCommerce - $ six figures
Exploiting Affiliate Networks - $ high six figures
Gaming the stock market - $ seven figures

Beating RSnake by hacking in achihuahua contest:

PRICELESS
66

For more information: http://www.whitehatsec.com/

Arian Evans, Director of Operations
blog: http://www.anachronic.com/
arian@whitehatsec.com

67Thank You!
For more information: http://www.whitehatsec.com/

Arian Evans, Director of Operations
blog: http://www.anachronic.com/
arian@whitehatsec.com

67