SINGAPORE--(BUSINESS WIRE)--Kaspersky Lab has published the results of an investigation into Genesis, an e-shop that is trading over 60,000 stolen and legitimate digital identities, making successful credit card fraud that much easier to conduct. This marketplace as well as other malicious tools involve abusing the machine-learning based anti-fraud approach of ‘digital masks,’ a unique, trusted customer profile based on known device and behavior characteristics.
Every time someone enters financial, payment and personal information in an online transaction, advanced, analytic, machine learning anti-fraud solutions match that person against something called a digital mask. These masks are unique to each user and combine the fingerprints of devices and browsers commonly used to make payments/bank online (i.e. screen and OS information, a range of browser data like headers, time zone, installed plugins, window size, etc.) with advanced analytics and machine learning (the individual user’s cookies, online and computer behavior, etc.). That way, the financial organizations’ anti-fraud teams can determine whether it is truly that person entering their credentials, or a malicious carder trying to buy goods using a stolen card, and either approve or deny the transaction, or send it on for further analysis.
However, the digital mask can be copied or created from scratch, and Kaspersky Lab’s investigation has found that cybercriminals are actively using such digital doppelgangers to bypass advanced anti-fraud measures. In February 2019, Kaspersky Lab research uncovered the Genesis Darknet marketplace – an online shop selling stolen digital masks and user accounts at prices ranging from $5 to $200 each. Its customers simply buy previously stolen digital masks together with stolen logins and passwords to online shops and payment services, and then launch them through a browser and proxy connection to mimic real user activity. If they have the legitimate user’s account credentials, the attacker can then access their online accounts or make new, trusted transactions in their name.
“We see a clear trend of carding fraud increasing around the world,” said Sergey Lozhkin, security researcher, Kaspersky Lab. “While the industry invests heavily in anti-fraud measures, digital doppelgangers are hard to catch. An alternative way to prevent the spread of this malicious activity is to shut down the fraudsters’ infrastructure. That is why we urge law enforcement agencies across the world to pay extra attention to this issue and join the fight.”
Other tools enable attackers to create from scratch their own unique digital masks that won’t trigger anti-fraud solutions. Kaspersky Lab researchers have investigated one such tool, a special Tenebris browser with an embedded configuration generator to develop unique fingerprints. Once created, the carder can simply launch the mask through a browser and proxy connection and conduct any operations online.
In order to enhance security, Kaspersky Lab recommends businesses implement the following measures:
- Enable multi-factor authentication at every stage of user validation processes.
- Consider introducing new methods of additional verification, such as biometrics.
- Harness the most advanced analytics for user behavior.
- Integrate Threat Intelligence feeds into SIEM and other security controls in order to get access to the most relevant and up-to-date threat data, and to prepare for possible future attacks.
A blog summarizing the Digital Doppelgangers threat can be found on Securelist.
About Kaspersky Lab
Kaspersky Lab is a global cybersecurity
company, which has been operating in the market for over 21 years.
Kaspersky Lab’s deep threat intelligence and security expertise is
constantly transforming into next-generation security solutions and
services to protect businesses, critical infrastructure, governments and
consumers around the globe. The company’s comprehensive security
portfolio includes leading endpoint protection and a number of
specialized security solutions and services to fight sophisticated and
evolving digital threats. Over 400 million users are protected by
Kaspersky Lab technologies and we help 270,000 corporate clients protect
what matters most to them. Learn more at www.kaspersky.com.
