Innovation in the underworld: reducing the risk of ripper fraud

"It takes many good deeds to build a good reputation, and only one bad one to lose it." - Benjamin Franklin

Digital Shadows Analyst Team | 24 January 2017

Reputation is incredibly important for business. This also applies to cyber criminals who buy and sell goods and services in online marketplaces. Fraud between cyber criminals has always been an issue that limited the profitability of their malicious campaigns. Those who commit fraud, often known as “rippers,”  commonly engage in activities such as:

  • Selling dumps of fake social media credentials
  • Selling invalid or used stolen credit cards
  • Stealing money by not delivering promised goods

From the defender’s perspective, rippers can be beneficial. A 2009 Microsoft paper, argued that, in essence, cyber criminal markets are lemon markets where buyers can’t differentiate low and high quality goods, therefore providing a breeding ground for rippers. Every transaction within the market then comes with a “ripper tax” attached to it, decreasing profits for both legitimate buyers and sellers. This in turn, slows the market down and makes further cyberattacks less lucrative.

So if rippers are beneficial to defenders, why are we writing about this and why should you care? Because a new service has emerged that’s aimed at revealing rippers and reducing the problem of fraud so that cyber criminal marketplaces can flourish.

Ripper.cc

In June 2016, “Ripper[.]cc” came online looking to disrupt this niche. Ripper[.]cc is a database of rippers and currently contains close to one thousand ripper profiles. Visitors can create profiles including the ripper’s identities across multiple forums. The profiles include various contact and identification information, as well as the details of the specific scamming case (known as a “black”).

Ripper Homepage

Figure 1: The Ripper[.]cc front page

Ripper[.]cc is not the first attempt to shield the marketplace from ripper tax. Prior to Ripper[.]cc, a number of methods had been devised to minimize the risks associated with rippers with limited success:

1. First is the escrow system. A marketplace user (usually an administrator) trusted by both sides of a transaction will hold the buyer’s money until the transaction is confirmed. The escrow system is great at facilitating trust, but can be slow, inconvenient and requires a very trustworthy third party.

2. The second solution is blacklists. Most cyber criminal forums have an arbitration section and administrators can ban users for various reasons, being a ripper among them. This however does not stop a ripper from operating on other forums or interacting with “victims” directly (e.g. through jabber instant messaging).

Forum Blacklist
Figure 2: An example blacklist on a criminal forum (Source: https://f*ckav[.]ru/forumdisplay.php?f=55)

3. Finally, the service kidala[.]info (“kidala” is Russian for ripper) has been aggregating a database of rippers since 2005. It is useful because it offers a large amount of ripper information and is also independent from any forums. However, it has all of the limitations of forum blacklists. Furthermore, users have complained that the reporting is not always impartial and it is possible to remove the ripper status for money.

More than a facelift

While the UI of Ripper[.]cc is impressive, the creators of the service do not appear to have been satisfied with a more usable, cleaner-looking version of kidala. Ripper[.]cc offers Firefox and Chrome extensions, as well as a jabber (PsiPlus) plugin. These extensions seek to address the main issue with forum and kidala blacklists – the fact that they only exist on those individual platforms. The plugins highlight rippers present in the Ripper[.]cc database in the user’s browser and jabber chats, allowing customers to recognize rippers with ease.

 Ripper Plugin

Figure 3 (a, b): 2 examples of Ripper[.]cc in action. The top (a) is the jabber plugin and the bottom (b) is the browser extension (source: screenshots from Ripper[.]cc)

The extensions highlight known rippers either directly on the site’s page or within the PsiPlus application (Figure 3a). The browser extensions (Figure 3b) allow the customer to easily pivot to the profile on Ripper[.]cc revealing their identifying information, forum accounts and the reason they were blacklisted. The relevant data is fed to the extensions once every 30 or 60 minutes via the Ripper[.]cc  API.      

Taking a page from legitimate startups

The development  of the Ripper[.]cc service is of interest as it parallels with how legitimate technology startups develop their products. The initial idea for this service was discussed on exploit[.]in as early as mid-2015 (forum[.]exploit[.]in/index.php?showtopic=98556&st=0). The project’s “founders” officially revealed the service (Figure 4) in July 2016 via a forum post after having some difficulties recruiting programmers to develop it for them (see Figure 6). In the post, they invite customers to the forum and start a discussion about its features and problems.

Original Promotion of Ripper

Figure 4: Original promotion of the forum on exploit[.]in 

In this initial posting or “pitch” and subsequent discussions, clear similarities can be seen between this and legitimate technology startups. The founders plainly acknowledge their intention to displace the previous main player – kidala.info – and try to win customers over by promising better features. They also have to prove their credentials – in this case by saying that a number of well-known forums support this project and their existing reputation on these forums.

Just like real startups, monetization is brought up as a key consideration, with suggestions such as an advertising or a subscription-based payment model. While this is normally brought up by investors seeking to understand how they will make money, in this case, the potential customers are the ones who want to know. But not for the same reason. Without understanding how Ripper[.]cc makes money, the customers can’t trust it. Perhaps the plugins could be malicious or rippers could be added or removed for money. The team responds that source code will be open source and that, at least initially, advertising will provide the main income (indeed, ads can be seen on the site now ripper[.]cc/ads). Furthermore, trust is to be facilitated by including administrators from four well-known forums in the service’s arbitration team.

Ripper Reporting

Figure 5: English-language version of the site's reporting functionality (Source: Ripper[.]cc)

 

Interestingly, the team behind the service has bigger plans for the project, demonstrating their ambitions for “scaling up.” The site already has an English version (Figure 5) and they want it to become a universal service for finding rippers online – cyber criminal marketplaces are just their proof of concept. An escrow service (another possible income stream) and even a mobile application have also been considered (Figure 6).

 Ripper Recruitment

Figure 6: Discussion between one of the assumed founders of the project (user 2) and a programmer (user 1) that user 2 is trying to recruit to do some work on the project (Source: Publicly available Jabber chatlogs)

Despite a consistent number of profiles added to the site since July 2016 (Figure 7), it is currently unclear whether the popularity of the service will grow significantly. Although there is already evidence of its use across multiple marketplaces (including the four founding forums – see Figure 4).

 Ripper profile average age

Figure 7: Average age of ripper profiles on Ripper[.]cc

Ripper[.]cc is another example of the industrialization of hacking and the growing professionalism of cybercrime. If such a service becomes successful, it enables cyber criminals to significantly reduce the risks associated with rippers and the overall cybercrime economy can become more profitable allowing for further growth.