IT security, technology, threat intelligence. Emilio Casbas: noviembre 2015

martes, 24 de noviembre de 2015

Massive campaign of FAKE sites pretending to be official e-commerce shops of luxury brands

A massive campaign of luxury brands being spread among FAKE e-commerce shops has been spotted in the wild with the proximity to the black Friday and Christmas seasons.

This campaign has been unveiled thanks to research involved with the desenmascara.me project. Currently Desenmascara.me is the only online tool able to let you know whether a website is fake or not, and I am working in a yet simplest tool, (thanks to the API available) to avoid users being lured by the online counterfeiters.

Recently Google published a research about the underground market fueling for-profit abuse, where you can see a full example of the underground value chain required to make money from spamming knock off luxury products.

The below table from the research paper presented called my attention:

Framing dependencies introduced by underground comoditization

as we can see the profit centers are divided based on different kind of threats. And while almost all of them are included in the plethora amount of source intelligence providers available nowadays, there is one threat which is not included yet and the revenue for the bad actors is almost the same as the infamous Zeus banking trojan.

Another thing which called my attention from the research paper was the lack of quantitative data. While we can have a full picture of how the blackmarket is structured, we are unaware of the luxury and fashion brands being targeted by this threat known as: online counterfeit. Therefore i will show below some examples of how the FAKE websites are looking and the kind of brands being targeted by this blackmarket.

So far the desenmascara.me project is able to detect more than 120 different brands and it has collected more than 2.600 FAKE websites targeting them. As one picture is worth a thousand words, below is only a small extract of the FAKE websites being flagged as such by desenmascara.me: