1. Asian Digital Thief : It’s not about faking the approval
MrX @ IDSECCONF2009

2. Agenda
• Intro
• Who are they?
• Prevention Methods
• Case Studies
• Conclusions
• Q&A

3. Intro

4. Intro
• Hi Tech = Lazy
• Cyber Crime Increased
• Internet Fraud Still Exist

5. Who are they?

6. Who are they?
• Credit Card Fraudster
• Suppliers (crackers/phisers/scammers)
• Proxy Providers
• Drop Point / Reshippers

7. Prevention Methods

8. Prevention Methods
• SSL
• AVS
• 3D Secure
• Automate Fraud Detection
• Blocking Transaction from High Risk Country
• System Hardening

9. SSL
• SSL is good, but it’s not everything.

10. AVS
• Definition
• Advantage
• Facts
– Not globally supported
– Still can bypassed
– System Abuse
• Solution

11. 3D Secure
• Definition
• Advantage
• Facts
– Weak Password
– Expensive
– Still can bypassed
– Miss configuration
– User vulnerable to phising attack
• Solution

12. Automate Fraud Detection
• Definition
• Advantage
• Facts
– Still can bypassed with proxies
– Easier for Fraudster
• Solution

13. Blocking Transaction from High Risk Country
• Definition
• Advantage
• Facts
– No Manual Check
– Drop Point
– Jump Shipment
• Solution

14. System Hardening
• Definition
• Advantage
• Facts
– OS & Network Hardening
– Backdooring Source Code
– “Cracked” Web Application
• Solution

15. Case Studies

16. Case Studies
• SSL is not everything
• 3D Secure
• Security Conference?

17. Conclusions

18. Conclusions
• 100% Secure System?
• Manual Check still needed
• Internet Fraud = Never Ending Crime

19. Q&A

20. • UAI
• Depkominfo
• Maxindo Mitra Solusi
• Nimhost

21. kthxbai!!