WACCO 2024

Crypto-assets: a target, platform and vehicle of choice for cybercrime

Svetlana Abramova

Bio

Dr. Svetlana Abramova is a scientist at the Austrian Institute of Technology affiliated with the Financial Technologies research group of the Complexity Science Hub since May 2024. She obtained her Ph.D. at the Department of Computer Science of the University of Innsbruck, where she continued her academic career as a postdoctoral researcher and assistant professor before joining the AIT.

Abstract

Over the past years, crypto-assets have become pivotal elements in the evolving landscape of proft-driven cybercrime. They serve as a direct target of attacks, enable innovative crimes through emerging financial platforms and services, or are used as a preferred medium for illicit transactions and money laundering. This keynote will unveil an increasingly complex role crypto-assets play in cybercrime operations, highlight current challenges in combating financial crime and uncovering real-world perpetrators, and explore the effect of successful law enforcement actions on financial ecosystems. In the first part of this presentation, I will present the findings of interviews with Dutch hackers about their online and offline pathways into cybercrime, co-offending en desistence. Preliminary results show that the first (baby) steps in pathways into cybercrime include gaming, Google and YouTube. In the second part of this presentation, I will discuss two interventions we are currently using to deter starting cybercriminals.

Measuring the Unmeasurable: Estimating True Population of Hidden Online Communities

Jonah Gibbon, Tina Marjanov, Alice Hutchings and John Aston

The true size of hidden populations is an important aspect when staging interventions or devising policies, yet is inherently difficult to obtain due to its nature. In this paper we present a novel approach for hidden population estimation by leveraging activity measured on underground forums. The proposed method consists of two main components. First, we determine the overlap of populations across forums by evaluating users’ behavioural patterns. Subsequently, we employ a Bayesian model tailored for extrapolating data from multiple systems in order to estimate the actual population size. We estimate the true number of people participating in online discussion to be 2-8.3 times higher than observed on major cybercriminal forums, and 1.5-3.5 times higher than observed on extremist forums. Our research contributes to a deeper understanding of hidden populations and offers insights into the potential magnitude of participation in online forums beyond what is readily apparent.

The (Relative) Impact of Email Cues on the Perceived Threat of Phishing Attacks: A User Perspective on Phishing Deceptiveness

Pavlo Burda, Maria Eleni Kokkini, Luca Allodi and Nicola Zannone

User perception of phishing threats is fundamental for the uptake and effectiveness of many phishing countermeasures, including phishing reporting and awareness. Extant research focused on phishing victimization, but a clear understanding of the drivers influencing users’ perception of phishing threats is still missing. This work investigates the relationship between phishing cues and perceived email deceptiveness through an online questionnaire with 74 participants. By assessing email conditions varying on cues, participants judged the perceived deceptiveness of emails individually and relative to each other. Results reveal that impersonation-related cues increase the perceived email deceptiveness and that emails with persuasion-related cues rank as the most deceitful irrespectively of other cues. We discuss our findings w.r.t. the literature and their implications on practice and research.

Understanding crypter-as-a-service in a popular underground marketplace

Alejandro de la Cruz and Sergio Pastrana

Crypters are pieces of software whose main goal is to transform a target binary so it can avoid detection from Anti Viruses (AVs from now on) applications. They work similar to packers, by taking a malware binary M and applying a series of modifications, obfuscations and encryptions to output a binary M′ that evades one or more AVs. The goal is to remain fully undetected, or FUD in the hacking jargon, while maintaining its (often malicious) functionality. In line to the growth of commoditization in cybercrime, the crypter-as-a-service model has gained popularity, in response to the increased sophistication of detection mechanisms. In this business model, customers receive an initial crypter which is soon updated once becomes detected by anti-viruses. This paper provides the first study on an online underground market dedicated to crypter-asa-service. We compare the most relevant products in sale, analyzing the existent social network on the platform and comparing the different features that they provide. We also conduct an experiment as a case study, to validate the usage of one of the most popular crypters sold in the market, and compare the results before and after crypting binaries (both benign and malware), to show its effectiveness when evading antivirus engines.

Panel discussion

Towards Better Understanding of Cybercrime: The Role of Fine-Tuned LLMs in Translation

Veronica Valeros, Anna Širokova, Carlos Catania and Sebastián García

Understanding cybercrime communications is paramount for cybersecurity defence. This often involves translating communications into English for processing, interpreting, and generating timely intelligence. The problem is that translation is hard. Human translation is slow, expensive, and scarce. Machine translation is inaccurate and biased. We propose using fine-tuned Large Language Models (LLM) to generate translations that can accurately capture the nuances of cybercrime language. We apply our technique to public chats from the NoName057(16) Russian-speaking hacktivist group. Our results show that our fine-tuned LLM model is better, faster, more accurate, and able to capture nuances of the language. Our method shows it is possible to achieve high-fidelity translations and significantly reduce costs by a factor ranging from 430 to 23,000 compared to a human translator.

(Research Talk) The Ephemeral Threat: Attacking Algorithmic Trading Systems powered by Deep Learning

Advije Rizvani, Giovanni Apruzzese and Laskov Pavel

We scrutinize the security of an application domain of Deep Learning (DL) overlooked by prior security research: time-series forecasting of financial predictions. Despite abundant efforts revealing the brittleness of DL models to adversarial perturbations, such efforts hardly envisioned practical adversarial threat models and assessed their effects on a DL-powered algorithmic trading system (ATS). In this work, we shed light on the vulnerability of ATS to adversarial perturbations launched by a constrained, but realistic, attacker. First, through an extensive literature review, we expose the limited attention given to DL security in the financial domain—which is naturally attractive for adversaries. Then, we formalize the concept of ephemeral perturbations (EP), which can be used to stage a novel type of attack tailored for DL-based ATS. Finally, we carry out an end-to-end evaluation of our proposed EP against a profitable ATS. Our results reveal that the introduction of small changes to the input stock-prices not only (i) induces the DL model to behave incorrectly—which is well-known; but also (ii) leads to the whole ATS to make suboptimal buy/sell decisions—which translate in a net-loss by the targeted organization. We will release our implementation.

Actionable Cyber Threat Intelligence using Knowledge Graphs and Large Language Models

Romy Fieblinger, Md Tanvirul Alam and Nidhi Rastogi

Cyber threats are constantly evolving. Extracting actionable insights from unstructured Cyber Threat Intelligence (CTI) data is essential to guide cybersecurity decisions. Increasingly, organizations like Microsoft, Trend Micro, and CrowdStrike are using generative AI to facilitate CTI extraction. This paper addresses the challenge of automating the extraction of actionable CTI using advancements in Large Language Models (LLMs) and Knowledge Graphs (KGs). We explore the application of state-of-the-art open-source LLMs, including the LLama-2 series, Mistral-7b-Instruct, and Zephyr for extracting meaningful triples from CTI texts. Our methodology evaluates various techniques such as prompt engineering, the guidance framework, and fine-tuning to optimize information extraction and structuring. The extracted data is then utilized to construct a Knowledge Graph, offering a structured and queryable representation of threat intelligence. Experimental results demonstrate the effectiveness of our approach in extracting relevant information, with guidance and fine-tuning showing superior performance over prompt engineering. However, while our methods prove effective in small-scale tests, applying LLMs to large-scale data for Knowledge Graph construction and Link Prediction presents ongoing challenges.

Panel discussion

A Methodology to Measure the "Cost" of CPS Attacks: Not all CPS Networks are Created Equal

Martin Rosso, Emmanuele Zambon, Luca Allodi and Jerry Den Hartog

Cyber-Physical Systems (CPS) are (connected) computer systems used to monitor and control physical processes using digital control programs. Cyberattacks against CPS can cause physical impact with potentially devastating consequences. While some past attacks required expert CPS knowledge (e.g., Stuxnet), other attacks could be done by anyone, solely with pure IT knowledge. Understanding what causes these differences is essential in effectively defending systems, but there is currently no way of qualifying let alone quantifying them. In this paper, we first define a notion of attack “cost” focusing on the required CPS-specific attacker knowledge. We then identify several context factors that may influence this cost and, finally, provide a methodology to analyze the relation between attack cost and CPS-context factors using past cyberattacks. To validate the methodology in a reproducible way, we apply it to publicly reported CPS incidents with physical impact. Though this constitutes only a small set of attacks, our methodology is able to find correlations between context factors and the attack cost, as well as significant differences in context factors between CPS domains.

Threat analysis and adversarial model for Smart Grids

Javier Sande Ríos, Jesús Canal Sánchez, Carmen Manzano Hernández and Sergio Pastrana

The power grid is a critical infrastructure that allows for the efficient and robust generation, transmission, delivery and consumption of electricity. In the recent years, the physical components have been equipped with computing and network devices, which optimizes the operation and maintenance of the grid. The cyber domain of this smart power grid opens a new plethora of threats, which adds to classical threats on the physical domain. Accordingly, different stakeholders including regulation bodies, industry and academy, are making increasing efforts to provide security mechanisms to mitigate and reduce cyber-risks. Despite these efforts, there have been various cyberattacks that have affected the smart grid, leading in some cases to catastrophic consequences, showcasing that the industry might not be prepared for attacks from high profile adversaries. At the same time, recent work shows a lack of agreement among grid practitioners and academic experts on the feasibility and consequences of academic-proposed threats. This is in part due to inadequate simulation models which do not evaluate threats based on attackers full capabilities and goals. To address this gap, in this work we first analyze the main attack surfaces of the smart grid, and then conduct a threat analysis from the adversarial model perspective, including different levels of knowledge, goals, motivations and capabilities. To validate the model, we provide real-world examples of the potential capabilities by studying known vulnerabilities in critical components, and then analyzing existing cyber-attacks that have affected the smart grid, either directly or indirectly.

Attacking Operational Technology Without Specialized Knowledge: The Unspecialized OT Threat Actor Profile

Stash Kempinski, Savio Sciancalepore, Emmanuele Zambon and Luca Allodi

Due to the unique characteristics of Operational Technology (OT), i.e., technology centered around cyberphysical activities, performing OT-related cyber-attacks is traditionally thought to require both specialized- and generic IT-related knowledge. However, in recent years, the need for specialized knowledge decreased, and OT-related cyberattacks became increasingly easier to perform. In this paper, we profile a new threat actor, referred to as the unspecialized OT attacker, who performs targeted, OT-related cyberattacks with at most basic generic knowledge. We show the relevance of this threat actor by identifying past OTrelated cyber-attacks that match this threat actor profile’s capabilities; we do so by mapping the types of tools used during these cyber-attacks and the knowledge required to use them. To further substantiate our analysis, we investigate readily-available tools that can assist threat actors in performing OT-related cyber-attacks. The combination of our findings highlights the present-day lowered entry level requirements to attack OT environments while limiting the scope of current assumptions.

Panel discussion