Webinar #224. Workbook. Presenter: Kevin Morison

Transcription

1 Webinar #224 Workbook Presenter: Kevin Morison 1

2 1 CONTENTS 2 Webinar Summary Webinar Notes Webinar Focus (0:27) Resource Speaker (01:08) Overview (04:18) How the Criminals Got Here (10:18) Liberty Reserve Second Life World of Warcraft Important Terms (12:02) Coins (13:38) Bitcoin Transaction Model (14:42) Wallets (17:56) Exchanges (19:43) Know Your Customer / Know Your Transaction (22:43) Case Studies (25:20) Sextortion Case Study Coincheck Case Study Tumblers and Anonymizers (31:56) Anonymized Coins (33:55) Cryptocrime (36:08) Physical Crimes (36:25) Tools that Facilitate Crime (37:00) Theft of Cryptocurrency (40:43) Theft of Resources (44:41) Cryptocurrency Actors (47:16) Wrap Up (52:19) Q&A Exercise Answer Key

3 2 WEBINAR SUMMARY As cryptocurrencies like Bitcoin and Ethereum become more popular and even integrated into our lives, the bad guys are also on the lookout on how to exploit these innovations for their benefit. Coming from a primer last week that discussed the basics of cryptocurrency, its history, how it works, and the different cryptocurrencies available and their characteristics, MS-ISAC s Stacey Wright and Eugene Kipniss are back to further unpack concepts and cases related to cryptocurrency. Eugene is the Senior Program Specialist for the MS-ISAC while Stacey is the Senior Intel Program Manager for the Center of Internet Security of MS-ISAC. Together, they will go for an in-depth look into the dark side of cryptocurrency. Some of the points that they expounded on this webinar include: A short refresher from the first part of the webinar that provides an overview of cryptocurrency. The first few cases of criminality in cryptocurrency in the mid-2000s as witnessed with Liberty Reserve, Second Life, and World of Warcraft being used for money laundering and other underground activities. A glimpse of the top fifteen cryptocurrency players today and how much each is valued at. A snapshot of the Bitcoin transaction model explaining how people utilize the system through wallets and transactions, and how the blockchain operates. What exchanges are and how they facilitate the circulation and trade of cryptocurrencies. Maker and Taker fees which are paid to the miners to make transactions possible. The Know Your Customer / Know Your Transaction (KYC/KYT) rule that is used in the financial industry to verify identities as well as prevent money laundering and other malicious activities. A sample of the types of personal information that might be required by an exchange for their KYC/KYT rule. Case studies featuring how cybercriminals were able to siphon money from individuals through: o A Sextortion scheme that sent malicious threats to individuals which can only be averted through payment via Bitcoin. 3

4 o The Coincheck case that bulk transferred coins from one wallet to another. What tumblers and anonymizers are and how they enable cybercriminals to circulate and use ill-gotten coins without being traced. Two anonymized cryptocurrencies Dash and Monera, that makes it difficult to determine the sender/owner of coins and allows recirculation of tainted coins. The four categories of cryptocrimes namely: o Physical crimes in the real world such as robbery or kidnapping is done to obtain cryptocurrency related information. o Tools that facilitate crime as ransomware or money laundering that pools revenues through cryptocurrency for the cybercriminals. o Theft of currency or wallet where coin investors/owners are targeted so their cryptocurrency funds are transferred to the cybercriminals. o Theft of resources where cybercriminals utilize your personal computing power to do the mining for them through compromised websites or malware. The various cryptocurrency players and their dynamics in the arena including: o North Korea's Lazarus Group, a Nation-State player that's behind multiple cryptocurrency heists, scams, and malware. o Venezuela as a Nation-State player that looks at leveraging cryptocurrencies for economic improvement. o Insiders who are people stealing power, resources, and equipment to enrich themselves through cryptocurrency mining o And the positive players like tech geeks, investors, financial firms and citizens who want to harness the potential of cryptocurrency. A snapshot of Bitcoin s dark market share. The laws and policies being put in place to regulate cryptocurrency. Expected developments on how cryptocurrency will be exploited by cybercriminals. Stacey and Eugene took questions from the audience and explained topics like: o Tracing whom an account belongs to o Cryptocurrency being used by narcotics organizations o The continued use of Second Life and World of Warcraft o Resources on cryptocurrencies and crimes related to it o The use of anonymizer in the sextortion case o Best practices for agencies who want to take on the investigation on crypto-related crimes 4

5 3 WEBINAR NOTES 3.1 WEBINAR FOCUS (0:27) A deeper look into the criminal aspects of cryptocurrencies and block chains An in-depth look at the four types of crimes currently associated with cryptocurrencies, the no-longer-theoretical 51% attack on the blockchain, The impact these crimes have on the cyber threat landscape What the future holds and what it means to you, as well as some of the resources that can help you in dealing with this new technology In partnership with MS-ISAC o Designated and funded by DHS as the key resource for cyber threat prevention, protection, response and recovery for the nation s state, local, tribal, and territorial (SLTT) governments o Serves as a central resource for situational awareness and incident response for governments 3.2 RESOURCE SPEAKER (01:08) Eugene Kipnis o Senior Program Specialist for the MS-ISAC Works on the Stakeholder Engagement team with our nation s State, Local, Territorial, and Tribal (SLTT) governments in order to provide them with access to the many MS-ISAC services and information products which support organizational security posture and awareness Focuses on managing the accounts of hundreds of MS-ISAC member governments and organizations across the Northeastern and Midwestern US Co-chairs the MS-ISAC s Education and Awareness working group that focuses on bringing cybersecurity knowledge to both end-users and IT staff alike Stacey A. Wright o Senior Intel Program Manager at the Center for Internet Security (CIS), where she runs the Intel Team for the Multi-State Information Sharing and Analysis Center (MS-ISAC) The Intel Team focuses on providing strategic, operational, and tactical cyber threat intelligence on State, Local, Territorial, and Tribal (SLTT) government cyber issues 5

6 Dedicated to providing comprehensive, actionable intelligence analysis o Previously the Cyber Intelligence Analyst for the Federal Bureau of Investigation Albany Division Legends Important Remember! Exercise/Self-reflect Reference Case Study Quoted Checklist Poll Question 6

7 3.3 OVERVIEW (04:18) The seedy underbelly of the hype and fast money o Where stuff goes wrong a little bit Disclaimer: Not legal, financial, or investment advice What is MS-ISAC o Designated by DHS as the key resource for cyber threat prevention, protection, response and recovery for the nation s state, local, tribal, and territorial (SLTT) governments Refresher o Types of currency Commodity Currency goods, products Fiat Currency government-issued currencies with stable values Virtual Currency unregulated digital money o Cryptocurrency A subset of virtual currency Where encryption techniques are used to regulate the generation and verification of transactions o History of Cryptocurrency Have been around since 1996 Around the early 2000s were created for gaming systems (Runescape, Second Life and World of Warcraft) 2006: Liberty Reserve Digital currency backed by USD/gold 2008: Bitcoin started 2009: Bitcoin mining started 2012: European Central Bank virtual currency definition 2013: Financial Crimes Enforcement Network (FinCEN) virtual currency definition as money services businesses March 18, 2013: Published guidelines about the regulation of people using virtual currency Ensuring record-keeping Preventing money-laundering 2015: Ethereum mining started 3.4 HOW THE CRIMINALS GOT HERE (10:18) LIBERTY RESERVE o Based in Costa Rica 7

8 o Shut down in 2013 due to money-laundering SECOND LIFE Exercise 1: Second Life s currency is called o Used for money laundering o Used for cross-border traveling o You can withdraw on the ATM pulling from Linden Dollars account o Allowed individuals to move money without being tied to a financial institution WORLD OF WARCRAFT o Gold coins let you buy products in the real world o People play World of Warcraft to earn gold which can be used in the real world o Some higher-level players may hire people to play the game o A criminal underground 3.5 IMPORTANT TERMS (12:02) Capital B Bitcoin the Bitcoin Network, source code and/or general technology behind the network Lowercase b bitcoin a unit of account on the Bitcoin Network o Can be broken down into extremely small pieces to be exchanged Blockchain distributed, public ledger containing the history of all transactions on the Bitcoin Network Altcoin alternatives cryptocurrencies to bitcoin (and maybe ether) Miners users (using computer power and their time) who validate, clear and record transactions on the Blockchain, for new bitcoins 3.6 COINS (13:38) Bitcoin Top player Market cap: $144,455,255,124: Total value of all the coins in the Bitcoin System 17.1 million bitcoins in circulation 1 bitcoin = $8,400 (as of July 24, 2018) 10-minute transaction time Ethereum Second largest player 8

9 Market cap: $48,269,314, million ethers in circulation 1 ether = $478 (as of July 24, 2018) 2.5-minute transaction time Other top altcoins/cryptocurrencies as of July 24, XRP $18,098,188, Bitcoin Cash $14,754,548, EOS $7,576,352, Stellar $5,581,413, Litecoin $5,043,841, Cardano $4,496,557, IOTA $2,738,596, Tether $2,502,888, TRON $2,479,906, Monero $2,286,671, NEO $2,257,183, Dash $2,057,456, Ethereum Classic $1,723,513, BITCOIN TRANSACTION MODEL (14:42) When you re sending bitcoin/cryptocurrency, you re not sending actual cryptocurrency Bitcoin: Bob and Alice o Bob has a private number or key that is associated with him and allows him to authorize transactions and send bitcoin o Bob also has a public address to allow others to send to him o Bob wants to send.5 bitcoin to Alice o He directs a transaction and authorizes it to Alice s public address o Transaction is signed and authorized by his private key o Transaction is broadcasted to network and verified by the miners o Once verified by the network and accepted, the bitcoin is associated with Alice s address Bitcoin s network is a distributed public ledger, a publicly viewable chain of transactions A blockchain Exercise 2: Each block is composed of these three components Block = + + Transactions are verified and bundled into a block then added to a chain of transactions 9

10 Exercise 3: are the digital fingerprint of the block Added to the transaction for security and integrity checking (the chain isn t tampered) Links the past block to the current one, making it difficult to commit fraud You don t just say send bitcoin, you re announcing the transaction and it is being verified 3.8 WALLETS (17:56) In cryptocurrency, wallets store the private key/s unique to your account which allows you to authorize transactions o Online wallet: Keys are stored with a trusted provider, most commonly an exchange o Software wallet: Stored in a local application on a device you own An app on your phone or computer o Hardware wallet: Stored offline on a dedicated hardware device o Paper wallet: Stored in a text format on paper or in another physical format o Hot wallet: Connected to the internet, less secure o Cold wallet: Not connected to the internet, hardware wallets are kept cold 3.9 EXCHANGES (19:43) Exercise 4: What are Exchanges? Buying and selling can be: o From fiat currency to crypto currency o From cryptocurrency to fiat currency From one type of cryptocurrency to another Other interesting facts o There is money in doing exchanges o Exchange dashboards looks like stock market or currency exchanges o One type of exchange is called Kraken Maker and Taker Fees 10

11 o Maker fees Fees associated with someone making posts in what they want to sell/buy but no one is doing it yet at the rate that they want o Taker fees Fees associated when you see something posted and you want to take that deal Fees go back to the exchanges and miner to help pay for the transaction and making it possible Exercise 5: What codes are Bitcoin using? and 3.10 KNOW YOUR CUSTOMER / KNOW YOUR TRANSACTION (22:43) A.k.a. KYC/KYT o The process of a business verifying the identity of its customer and transaction details to assess the potential risks of illegal intentions o To prevent money laundering and other malicious activities Kraken Tiers o Kraken Tier 1: Exercise 6: What details are needed for Kraken s first tier KYT/KYC rule? o Kraken Tier 2: Tier 1 + address verification o Kraken Tier 3: Exercise 7: What additional requirements are needed on top of the Tier 2 information for Tier 3 verification? Exchanges license to operate is geographically-based o In some areas, it is prohibited to access an exchange (e.g., Kraken prohibited to do business in the state of New York) o Those that do not adhere to KYC/KYT requirement are prohibited within the US 11

12 3.11 CASE STUDIES (25:20) SEXTORTION CASE STUDY o What happened? claiming that they know your username and password Tells you that a malware was placed in an adult site A video was made of you watching pornography with a recording from your device s camera They ll threaten that they ll send the video to your contacts ( , social media, etc.) Amount is provided with the payment to be made via Bitcoin to prevent the spread of the video Bitcoin address is provided Some people paid o Investigation Traced the Bitcoin addresses involved There is a different Bitcoin wallet attached for every single 200 transactions that go into one consolidated wallet The wallet contains $141,000 USD The wallet along with other wallets is then consolidated to another wallet that has over $1.5 Million USD Based on the dates of the transaction, the amount increased significantly since the sextortion was sent People were paying into the sextortion COINCHECK CASE STUDY o Coincheck is another exchange o What happened? 523 NEM Coins sent from a NEM address at Coincheck at 3 AM Coincheck hosted in Japan Coincheck, after 8 hours, noticed the abnormal decrease in the balance It was a hot wallet Someone gave access to a private key that allowed to easily transfer all of the NEM coins from the wallet to another location The NEM coins were transferred to 11 wallets 12

13 As it is a public ledger, everyone can see the content of the wallets All eleven wallets tagged coincheck stolen funds do not accept trades owner is a hacker Not so anonymous even if they don t exactly know who you are To pull money out of something like this, tumblers and anonymizers are utilized 3.12 TUMBLERS AND ANONYMIZERS (31:56) Money laundering for the cryptocurrency world They let you ignore the KYC/KYT rule Cycles the money into other types of cryptocurrencies that are more focused on anonymity Spreads the money into different wallets in different amounts Makes it difficult to trace the transaction Shapeshift o An anonymizer o Is not allowed to operate in the US o Refuses to follow KYC/KYT rule 3.13 ANONYMIZED COINS (33:55) Altcoins that are set up to have more anonymity and even closed structure to the blockchain so it s not possible to see individual transactions and who did them Monero o 16.3 million XMR o $140 o $2.3 billion Ring signatures outputs mixed with several decoys Makes it extremely difficult to determine the original sender of the Monero coins Wallet address never appears on public blockchain Cannot do address analysis based on the sender/receiver address Fungibility no tainted coins Doesn t show if wallets or currencies are involved in a crime In the top 15 altcoins list Dash 13

14 o 8.2 million DASH o $250 o $2 billion Coins mixed with others No attribution when mixing Fungibility no tainted coins 3.14 CRYPTOCRIME (36:08) Exercise 8: What are the Four Categories of Cryptocrimes 3.15 PHYSICAL CRIMES (36:25) Physical crimes in the real world related to cryptocurrency o Robbery o Coercion o Kidnapping 3.16 TOOLS THAT FACILITATE CRIME (37:00) Ransomware o Prevents user to access data in your computer or files by encryption o To get back access and data, you must adhere to their demands by paying through Bitcoin o E.g., WannaCry Easy copy and paste button to copy the bitcoin address Once you ve sent the money, they will unlock your files o A big moneymaker for criminals o MS-ISAC data recorded different variants of ransomware Money Laundering o To access the ill-gotten coins, they utilized anonymizers so the tainted coins are made usable Frauds, Scams, and Schemes o Fake Initial Coin Offerings (ICO) For new cryptocurrencies that are released Selling new coins to early backer in order to raise capital funds 14

15 E.g., Bee Coin Prior release, criminals posing as the originators of Bee Coin, sent out a hoax ICO with a different address that leads to the criminal s account People thought they were paying/investing into the system Money was just funneled to the criminal s account o Pump and Dump Scams Also present in the stock market Criminals lead people to purchase stocks or cryptocurrency at an elevated price to raise the market up They will sell the holdings ahead of time to profit from them 3.17 THEFT OF CRYPTOCURRENCY (40:43) Theft of Currency & Wallets o Trickbot A malware that got in your computer for opening a file/document/spam message or clicking on a link Places itself in the middle of a cryptocurrency transaction In the background, during copy paste, it would replace the published address with another wallet address You wouldn t catch this until your money has been sent and it didn t go where you expected it to go o My Big Coin Almost a Ponzi scheme Takes customer s funds and transfers it to the criminal s personal account Managed to get $6,000,000 from customers Theft of wallets o Coincheck (2018): $534 million o Mt.Gox (2014): $487 million 2006: A guy made an exchange online for Magic the Gathering playing cards Didn t work out as expected, closed the website but kept the domain (Mt.Gox Magic the Gathering Online Exchange) 2010: the guy went into cryptocurrency and created a bitcoin exchange Using the same domain Mt.Gox, he used it for bitcoin exchange 15

16 He sold the domain and the exchange before things start to go bad The most famous case until Coincheck There were arrests, investors lost money o Bitfinex (2016): $72 million o NiceHash (2017): $63 million o Bithump (2018): $31 million 3.18 THEFT OF RESOURCES (44:41) Illicit Cryptocurrency Mining / Cryptojacking o First Type - Coinhive 2016: People were asked to look at advertisements as it s how malware get into one s computer Websites that host ads to monetize didn t make money because ads were blocked 2017: Coinhive was found and introduced the idea of making people visiting your website mine cryptocurrency for the website owner (not a lot, but almost equivalent to making advertisement) When the website is closed, the visitors stop mining and you move on to the next one Users not aware that their computers are being used to mine cryptocurrency o Second type: Compromised websites through Coinhive Bad guys got hold of website and compromised it Users mine cryptocurrency when you re on the compromised website The mined cryptocurrency goes to the bad guys account It is not the website doing it, they re not knowingly involved o Third Type: Malware Malware getting into the computer, to the server Computer and server resources being used for cryptocurrency mining for the cybercriminals Equipment gets used/abused and increases electric bill because the processor is working non-stop 3.19 CRYPTOCURRENCY ACTORS (47:16) Give at least three samples of types of cryptocurrency actors 16

17 Nation-States o Venezuela Price increase from an inflation rate of 41% in 2013 to 481% in 2016 Expected to hit 1 Million percent inflation this year As of July 2018: 41,838% inflation rate Fiat currency isn't accepted and is pretty much worthless Pushed for Petro Backed by the government of Venezuela ICO exchanging fiat money for Petro cryptocurrency Funds raised from the ICO will allow the government to operate Every Petro coin is backed with a barrel of oil A commodity-based cryptocurrency Illegal in the United States as the government of Venezuela is seen as condoning state-sponsored terrorism o North Korea Lazarus Group Behind the Sony Pictures hack Compromises from banks around the world Bangladesh Cyber Heist (stolen $81 Million USD) Responsible for WannaCry Started targeting cryptocurrency through exchanges, malware, and campaigns after crypto wallets Bithump exchange (February 2017) HaoBoa campaign malware campaign (February 2018) Insiders o People stealing power, resources, and equipment at their offices and places of employment to make themselves richer through cryptocurrency mining Harvard student used a 14,000-core supercomputer to mine Dogecoin In his computer project lab center Student banned from doing a project there Government employee mines bitcoin at work New York City punished an employee for doing so Federal Reserve employee mined bitcoins using Fed s Server Not everyone interested in cryptocurrency is a bad person, they can be 17

18 Citizens Tech Geeks Investors Financial Firms 3.20 WRAP UP (52:19) Dark Market Share of Bitcoin o Value of transactions going to the Dark Market are going up o The number of transactions have gone down Source: Chainalysis Cryptocrime Report, January Laws, Regulations, & Policies Fact and Circumstances Test: the way in which it s sold, promised, and behaves is the key deciding factor. Bitcoin and Ether are not securities SEC, June 14, 2018 Visa, Mastercard, and other credit card providers are getting involved Considering fees as in ATMs for pulling out funds FinCEN active in preventing money laundering through cryptocurrency What s Next? We ll see a progressive shift in 2018 towards the criminal use of cryptocurrencies other than Bitcoin, making it generally more challenging for law enforcement to counter Rob Wainwright, Executive Director of Europol, January 2 Malware with additional purposes E.g., Crypto mining + Theft of login and other important credentials Cryptojacking-as-a-Service No need to be a tech expert to do cryptojacking You may pay someone to do it for you Illegal blockchains 18

19 Blockgeeks.com Blockchain and Cryptocurrencies: Technical Background Computer Security Resource Center: Overview of Cryptocurrency and Blockchain Technology For questions and clarifications, contact: Stacey A. Wright Director of Cyber Intelligence Eugene Kipniss Senior Program Specialist 19

20 4 Q&A Q: From a law enforcement investigator, as they're working a case where a third-party owner took all of the coins and nano-pooled. Do you know if I'm able to find out who owns the account that the currency went into? (59:12) A - Stacey: This is not work we do because we are not directly involved with law enforcement. I can tell you law enforcement has some resources that may be able to assist. I'm assuming that you've tried just plain-old googling the wallet because a lot of times that can actually get you an answer. Believe it or not, people post their addresses with their wallet IDs all the time. If that hasn't gotten you anywhere, please us directly, I will put you in touch with the law enforcement resources I know of who are doing that type of thing on a daily basis and would be able to better help. Q: Do you know whether narcotics organizations are currently using bitcoin and other cryptocurrencies to hide their proceeds or do you think it would be done in the future? (1:00:16) A - Eugene: There have been a lot of documented court cases and convictions such as those involving the silk road, an online brokerage for drugs and illicit activity where they have utilized cryptocurrency for digital payment structures and receipt of funds. That's actually been documented very well in that case. I suggest reading more into that. Again, it's the Silk Road, the website, it's a very big federal case. Stacey: From what I've heard and read online with these open-court cases, the arrests, quite a few criminal actors in drugs that are in a whole bunch of different things are using cryptocurrency in the hopes that they are more anonymous and harder for law enforcement to chase. That's why we kind of want to get the word out that there are some ways to do it, you have to be careful and you have to be a little bit good at it. It's easier to do that I think a lot of people think it might be. 20

21 Q: Are people still using Second Life and World of Warcraft to illicitly transfer funds? (1:01:36) A - Stacey: I can't speak to whether they're doing it today. I cannot imagine that they've ever stopped. I've seen enough transactions where that has occurred on those two platforms as well as the others and they still have millions of users. I can't imagine anybody has stopped using it. Q: Are there books that you would specifically recommend on this topic that maybe you've used as a resource for your own research and for this presentation? (1:02:03) A - Eugene: From the basic stuff on blockchain and cryptocurrency most of the research out there is available online. You can actually read white papers or releases that describe the technology behind individual cryptocurrencies. They usually have a community or core website that will try to promote each currency. I know for Bitcoin, you can go out there and find the white paper. Ethereum, Dash, Monero. A lot of my research I even went to those sites, just right out there. They want to evangelize that information. Those resources I pointed to, I like NIST a lot, they're a trusted government resource that evaluates and creates standards for technology and I like to use their materials when possible. Their paper is only a draft paper at this point but it's a pretty nice comprehensive guide to the technology. I can't speak to the crime side as much. Stacey: I will say I attend law enforcement conferences so that's where I picked up some of the crimes, some of the stuff that we're doing here, that criminal side because we're seeing it come into the MS-ISAC. I listen to a lot of podcasts, it's really hard to stay current on this type of work if you're reading off of books because they don't stay just as current this environment. But there are some really great podcasts out there that talk about bitcoins and blockchains and all of them. And if you want to learn more about this, some of those podcasts and those 101 introductions are really great places too. 21

22 Q: Was the other website that you mentioned blockgeeks.com? (1:03:52) A - Stacey: Yes. Q: In the sextortion case was an anonymizer used prior to the consolidated wallet? (1:04:02) A - Stacey: Not that we can tell. We have been able to follow it to an end wallet as far as we can tell. That data, the analyst polled today, this morning, about 11 AM Eastern time and you can still see that money sitting there. Q: Are there any best practices that agencies can adopt in terms of building up their own capabilities for investigating crypto-related crimes? (1:04:27) A - Stacey: I'd start with the basics of finding someone to work it. Somebody who finds this interesting in the first place. Who is going to be willing to do some of the research that it takes to really become an expert at this or at least a little more knowledgeable? And there are resources, some of them are a little bit more restrictive, some of them are like blockchain alliance that is willing to work with law enforcement and they're trying to promote the better side of the community. You can get involved in resources like that. In terms of building it up within your own organization, I think once you have somebody dedicated to it, it's a matter of making sure they stay involved in the community and giving them the time and resources to actually make this part of their job, which I know for most departments is a really difficult thing to do. 22

23 5 EXERCISE ANSWER KEY Exercise 1: Linden Dollars Exercise 2: Block = transactions + hash + nonce Exercise 3: Hashes Exercise 4: A platform that acts as an intermediary between buyers and sellers of cryptocurrency; A place where buyers can say that they will buy cryptocurrency for a price and sellers to sell their cryptocurrency Exercise 5: BTC/XBT Exercise 6: full name, DOB, country, phone number Exercise 7: government ID, proof of residence, SSN Exercise 8: Physical Crimes Exercise 9: Tools that Facilitate Crime Theft of Cryptocurrency Theft of Resources Nation-States Citizens Tech Geeks Investors Financial Firms Cybercriminals Criminals Insiders ### 23