handcrafted fraud and extortion manual strongaccountstrong hijacking in.pdfVIP

Handcrafted Fraud and Extortion: Manual Account Hijacking in the Wild Elie Bursztein Borbala Benko Daniel Margolis Tadek Pietraszek Andy Archer Allan Aquino Andreas Pitsillidis Stefan Savage Google, Inc University of California, San Diego {elieb, bbenko, dmargolis, tadek, archer, aaquino}@ {apitsill, savage}@ ABSTRACT In this paper, we explore the manual hijacking lifecycle as gleaned Online accounts are inherently valuable resources—both for the data from incidents that occurred at Google between 2011–2014. Our they contain and the reputation they accrue over time. Unsurpris- study consists of three components: we explore how criminals ingly, this value drives criminals to steal, or hijack, such accounts. acquire a victim’s credentials (Section 4); examine how criminals In this paper we focus on manual account hijacking—account hi- monetize account credentials (Section 5); and finally highlight the jacking performed manually by humans instead of botnets. We process Google used to ultimately restore control back to the victim describe the details of the hijacking workflow: the attack vectors, (Section 6). Based on our findings, we offer a set of best practices the exploitation phase, and post-hijacking remediation. Finally we for others to defend against manual hijacking and discuss many of share, as a large online company, which defense strategies we found the corner ca