Hourglass Model 2.0
Asia-based underground services abusing global 2FA

AgendaHourglass Model 1.0
Hourglass Model 2.0 (let’s hope it is more useful)• Generate cyber threat intelligence reports• Actions

Case Study:• Discovery• Findings• Analysis• Conclusion: Rethink 2FASpecial Thanks
Q&AAnna Chung
Cybercrime Researcher +7 years
International Relation background
LEGO Fan

Introduction: Hourglass Model 1.0

Cybercrime actors initiate attacks
by hiring hackers, purchasing
tools, exploits/malwares, andcustomized obfuscation services.

Threat actors who sell, purchase,and trade results of successful
intrusion, such as login
credentials, PII, shells.

Malicious actors develop and provide
hacking tools and services for money.

Used login credentials and dataset
being resell again in the undergroundmarket.

Hourglass Model 1.0: Scope• Online activities only
• Any geolocation• Cyber threat intelligence focus, not legal analysis• Collection still need to abide by law and user policies!!

Hourglass Model 1.0: Definition of Terms

Marketplace: where communication or money flow are exchanged in
the virtual world. It can be IRCs, forums, Deep and Dark Webs.
Mastermind: Threat actors with business plan and targets in mind, but
still need technical assistance and others to execute the attacks.
PII: Personally identifiable information. Any information that can beused to distinguish one person from another and can be used for deanonymizing anonymous data can be considered PII.

Hourglass Model 2.0• Mastermind Profile• Credibility• Connections• Targets• Strategy• Timing• Process / Status• Victim• Potential buyers• Scale and type ofcompromised data• Damage / Impact
evaluation••••Hacking tools
Hacking services
Fraud tactics
Manuals / Tutorials• Reoccurring damage• Mitigation effectiveness• Alternative monetization
approachesHourglass Model 2.0

Assess Current Status:- Verify if the tools or tactics can actually cause
damage- Evaluate if current detection system will betriggered.

Mitigation Planning- Identify loss and impact scope-Implement mitigation plan
Mitigation Evaluation- Use marketplace discussion and reaction toevaluate the effectiveness.

Case Study
Random Discovery: Southeast Asian SIM card somehow used for abusingglobal eCommerce and social media

Research Plan
• Known Information:• Targets/Victims• Underground Services• Research Focus:• Identify keywords and other marketplaces to explore• More threat actors discuss similar topics• Other related underground services and goods• Price and availability• Pricing strategy• Tutorials• Potential buyers• Monetization workflow

Findings

Analysis I: Fraud & Monetization Flow

Collect Stolen
Payment Info

Fraudulent Phones/ Emails

Receive Referrals

Resell Referrals toOthers

Request Services/Online Purchase

Resell Rides orGoods to Others

Create NewAccounts
Let Account Age

Ad Fraud

Resell Aged
Account to Bypass
Detection

Defraud Targeted
e-Commerce
PlatformAnalysis II: Overall Workflow

Mastermind
2FA code

Freelancers

Outsource

Buy
Numbers
SIMvendors

Sign Up
Request Verification

Targeted
eCommerce

Outsource

Buy
Numbers

SMSforwarding
Platform

Sign Up/
Pass 2FA

Information Flow
Money Flow

Analysis III: Other 2FA Abuse
2FA “Spamming”• Via Email• Via SMS

Commonly Used 2FA

Deep-dive: Cellphone-based 2FA

Authentication via two independent components
1.
Something you knowa.
E.g username/password combination, PIN
2.
Something you havea.
Non-online banking: Mostly token-based(device you already own, e.g cellphone)b.
Online banking: Mostly smartcard-based(device which is usually provided for bybank)

Exemplary authentication usage: Gmail, Instagram, iTunes purchases(optional)●
Token-based → Usually via cellphonea.
SMS: (SMS-based authentication, e.g. TAN codes)b.
In-App (e.g. Google Authenticator, DUO)
Risks of 2FA via SMS:●Can be gamed by “SIM swap” (phone number redirect)●
Cell phone providers/systems can be interceptedRe-evaluating Existing 2FA Methods
Deep-dive: Existing cellphone-based 2FA methods
Suggested criteria for evaluating
existing 2FA methods
1.

Accuracy/Security: How accurate and secure is
the 2FA system? (e.g. false/positive rates becauseof e.g. 2FA text message code reuse?)

1.

Online services’ expertise + costs: How
technologically advanced is the deployed 2FA
method and what are its costs (Cost can be a main
driver to mitigate accuracy/security issues)

1.

Usability: How easy is it for consumers to interact
with the chosen 2FA method?

1.

Usabilitya.
Consumer perspective: Usually 2-3 min authentication process isregarded as “acceptable” by average user.
b.
Need for balancing usability with security of chosen 2FA method

1.

Accuracy/Securitya.
Preferred: In-app verification (e.g. DUO/Google Authenticator) → notaffected by SIM swap attacks + increased attacker hurdle (costs forbuying device + need for hacking “authentication account”, e.g. Gmail
for Google Authenticator)b.
If SMS-based: No reuse of SMS 2FA codes + limited number ofattempts to enter correct 2FA SMS code2.

Online services’ expertise + costsa.
Online services should invest in “2FA alliance models” to explore
securer 2FA verification methodsb.
Methods should not bear additional costs on online services norconsumers

Hourglass 2.0 vs 2FA Methods
Recommendation:
Online services should adapt Hourglass 2.0 “Mastermind” knowledge transfer
approach by educating their industry & consumers on 2FA authenticator apps
1. Consumers need to be educated by online services on how to use in-app 2FA••Video tutorialBrowser notification during account setup

2. Larger online services need to invite smaller/medium-sized online services to2FA alliances••

Facilitate 2FA technical knowledge transfer
Shared educational resources for consumers

TLDR – Today’s Key Takeaways• Effective cyber defense decision relies on external threat
intelligence and internal data analysis.
• Hourglass model aims to help researchers maximize theinformation collected from marketplace information• Use the findings to build hypothesis and evaluate existing systemand policy• Adversary will not disappear, so...use them!

Special Thanks…to Nina Liguda - 2FA Sectionwww.linkedin.com/in/nliguda

Q&A