Anatomy of an Attack

KOUNT CONFIDENTIAL & PROPRIETARY

1. On December 27, 2012, a global top ten gamer website experienced a dramatic increase in the number of declined orders.

2. The decline rate went from the average of under 5% to over 35%

3. Kount detected and stopped a BOT attack that was attempting to infiltrate and fraudulently purchase goods on the website

4. The attack lasted approximately three days

5. During the attack and once the attack was over, the company’s website responded normally, as if nothing happened.

The Attack

The AttackThis line represents the upper limit of declines. This is calculated daily based on a 14-day trailing average of daily variations to 99%. Generally, this line is 3 standard deviations from the “decline mean” rate.

The AttackThis line represents the lower limit of declines. This is calculated daily based on a 14-day trailing average of daily variations to 99%. Generally, this line is 3 standard deviations from the “decline mean” rate.

The Attack

This line represents the decline rate mean. This is calculated daily based on a 14-day trailing average of daily variations to 99%. The decline rate averages between 3% - 6% based on rules applied by Blizzard.

The Attack

This line represents the actual decline rate.

The Attack

Note: since these lines are created from a 14-day trailing average, we see them increase as a result. These will return to normal ranges in time.

The AttackThis line represents actual # of approvals daily.

This line represents actual # of declines daily.

This line represents actual # of reviews daily.

Spike in sales on Christmas day, expected activity.No increase in declines, also expected activity.

Spike in declines over the next three days without corresponding increase in sales, unexpected, unusual activity.

The Attack

RANK EMAIL # TRANSACTIONS1 XUNAN1978@LIVE.COM 47622 DIABLOJINKA@LIVE.COM 13493 PEDERAKIS22@LIVE.COM 1243

The attack was centered around three main email addresses which may indicate that a “bot” was running from hijacked or dedicated machines…

Declined orders

The Attack

RANK IP ADDRESS TRANSACTIONS1 79.126.163.185 57392 79.126.172.135 1628

…and only two IP addresses

The AttackEach dot represents the number of attempts made per minute, sometimes averaging nearly two and a half attempts per second.

This line represents the running average of attempts per minute.

The Attack

From the email address XUNAN1978@LIVE.COM:

# TRANSATION DATE/TIME TRANSACTION COUNT1 12/27/2012 1:31:00 PM

1082 12/27/2012 1:32:00 PM

713 12/27/2012 1:33:00 PM

1004 12/27/2012 1:34:00 PM

415 12/27/2012 1:35:00 PM

856 12/27/2012 1:36:00 PM

The AttackWhere did these “orders” originate?

Macedonia

The Result

Kount responded to this attack exactly how it was designed.

• Detected the fraud, in real-time• Stopped the fraud, in real-time• Reported the fraud• Protected the customer• Kept exposure to fraud and fraud losses to ZERO $$$• All done automatically, without interrupting normal business activity• This type of fraud could not have been detected using old, look-up technology

• World’s largest online distributor of independent music- Helps artist sell to iTunes, Amazon and Facebook

• Paying out 75% commissions• Over $200 million in commissions paid• Fraudulent artists & affiliates• Charge backs/Fraud 2.5%+, $26,000 lost in one month• Reputation at stake with some partner brands

Case Study – CDBabySituation

Case Study - CDBaby

Fraudster posing as an artist post music for sale on CDBaby.com

Case Study - CDBaby

Fraudster joins CDBaby affiliate program, receives 75% commission

Case Study - CDBaby

Using stolen credit information, Fraudster purchases music from affiliate (Fraudster)

Case Study - CDBaby

Using stolen credit information, Fraudster purchases music from affiliate (Fraudster)

3Pays royalty to artist

Pays commission to affiliate (75%)

Pays fines, chargebacks

Case Study - CDBaby

• Reduced fraud by 96%• Results in less than 30 days

• Fraud losses average $850/mo.• NO loss in revenue• Enhanced marketing opportunities• Great relationship with iTunes

Questions

Don BushVP, Marketing, Kount208.489.3346don.bush@kount.com

Anatomy of an Attack

Technology

ShadyRAT: Anatomy of targeted attack

Gartner UK 2015 Anatomy of An Attack

The Anatomy of an Anonymous Attack

Anatomy of a Public Cloud Attack | CSA Orlando

Anatomy of a Database Attack - Oracle DBA – Tips and ...gavinsoorma.com/.../uploads/2011/03/anatomy_of_a_database_attack… · Anatomy of a Database Attack ... –Implementation

Slide 1 Vitaly Shmatikov CS 395T Anatomy of an Attack

Anatomy of a Hack An Exploration of the Effects of Asymmetric … · 2007-08-02 · Anatomy of a Hack An Exploration of the Effects of Asymmetric Attack eRisk Conference ... Logic

Anatomy of a Phishing Attack - mnin.org

Anatomy of an Web Application Attack June 2012 Terry Ray – VP WW Security Engineering

2010-11 The Anatomy of a Web Attack

Anatomy of a DDoS attackindex-of.es/Attacks/403 Forbidden Attack/Anatomy-of... · DDoS Attack Backﬁres: Targeted Site’s Performance Improves A few hours into the attack, the attacker’s

Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE · 2019-01-08 · ©2018 Dragos, Inc. All rights reserved. [Protected] Non-confidential content. October 12, 2018 Anatomy

Anatomy of an Enterprise Social Cyber Attack Part 2

Anatomy of an Attack: How to Defend Against a Multi-Stage Attack

ANATOMY OF AN ATTACK - TrapX Security · 2019-11-13 · Page _3 Page_2ABOUaT N222MM222YYYF ageCFOK3 ABOUT ANATOMY OF AN ATTACK The Anatomy of an Attack (AOA) Series highlights the

THE ANATOMY OF AN ENTERPRISE SOCIAL MEDIA CYBER ATTACK · Facebook, Twitter, Skype, and VKontakte as mediums for launching targeted malware and phishing schemes. THE ANATOMY OF AN

HACKERS & ATTACK ANATOMY - SNIA · ISE Proprietary HACKERS & ATTACK ANATOMY Geoff Gentry, Regional Director | ggentry@securityevaluators.com

RSA Anatomy of an Attack

1© Copyright 2011 EMC Corporation. All rights reserved. Anatomy of an Attack

Special Anatomy of an Attack Or Layered Security Failure