Casino Royale: a Deep Exploration of Illegal Online Gambling
Total Page:16
File Type:pdf, Size:1020Kb
Casino Royale: A Deep Exploration of Illegal Online Gambling Hao Yang, Kun Du Yubao Zhang Shuang Hao Tsinghua University University of Delaware University of Texas at Dallas {yang-h16,dk15}@mails.tsinghua.edu.cn [email protected] [email protected] Zhou Li Mingxuan Liu Haining Wang University of California, Irvine Tsinghua University Virginia Tech [email protected] [email protected] [email protected] Haixin Duan* Yazhou Shi, Xiaodong Su, Jianping Wu Tsinghua University Guang Liu, Zhifeng Geng Tsinghua University Beijing National Research Center Baidu Inc [email protected] for Information Science and {shiyazhou,suxiaodong}@baidu.com Technology {liuguang03,gengzhifeng}@baidu.com [email protected] ABSTRACT third-party live chat services, and network infrastructures. The popularity of online gambling could bring negative social Our findings shed the light on the ecosystem of online gam- impact, and many countries ban or restrict online gambling. bling and help the security community thwart illegal online Taking China for example, online gambling violates Chinese gambling. laws and hence is illegal. However, illegal online gambling websites are still thriving despite strict restrictions, since CCS CONCEPTS they are able to make tremendous illicit profits by trapping • Security and privacy → Web application security. and cheating online players. In this paper, we conduct the first deep analysis on illegal online gambling targeting Chi- KEYWORDS nese to unveil its profit chain. After successfully identifying Illegal Online Gambling, SVM, Web-based Measurement more than 967,954 suspicious illegal gambling websites, we ACM Reference Format: inspect these illegal gambling websites from five aspects, Hao Yang, Kun Du, Yubao Zhang, Shuang Hao, Zhou Li, Mingxuan including webpage structure similarity, SEO (Search Engine Liu, Haining Wang, Haixin Duan*, Yazhou Shi, Xiaodong Su, Guang Optimization) methods, the abuse of Internet infrastructure, Liu, Zhifeng Geng, and Jianping Wu. 2019. Casino Royale: A Deep third-party online payment, and gambling group. Then we Exploration of Illegal Online Gambling. In 2019 Annual Computer conduct a measurement study on the profit chain of illegal on- Security Applications Conference (ACSAC ’19), December 9–13, 2019, line gambling, investigating the upstream and downstream San Juan, PR, USA. ACM, New York, NY, USA, 14 pages. https: of these illegal gambling websites. We mainly focus on pro- //doi.org/10.1145/3359789.3359817 motion strategies, third-party online payment, the abuse of 1 INTRODUCTION Permission to make digital or hard copies of all or part of this work for Online gambling has been thriving in the last two decades, personal or classroom use is granted without fee provided that copies and it has become one of the most popular and lucrative are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights businesses on the Internet. However, its thriving popularity for components of this work owned by others than the author(s) must brings negative impacts and unprecedented challenges for be honored. Abstracting with credit is permitted. To copy otherwise, or regulations. The problem could be further exacerbated due to republish, to post on servers or to redistribute to lists, requires prior specific its high-speed instant gratification and high level of privacy permission and/or a fee. Request permissions from [email protected]. offered, as well as the abuse of trust in legal payment systems, ACSAC ’19, December 9–13, 2019, San Juan, PR, USA resulting in pathological gambling. Moreover, the largely © 2019 Copyright held by the owner/author(s). Publication rights licensed to ACM. unsupervised electronic fund transfers of online gambling ACM ISBN 978-1-4503-7628-0/19/12...$15.00 can be easily exploited by criminals to launder significant https://doi.org/10.1145/3359789.3359817 amounts of money. The legal status of online gambling varies from different gambling websites can enhance their credibility and attract countries and regions around the world. Although online more victims. gambling is legal in most of European Union countries and (3) Abuse of third-party cloud storage. The third-party several nations in the Caribbean, there are still many coun- cloud storage services are widely abused for hosting web tries that restrict or ban online gambling. Illegal online gam- resources of illegal gambling websites, especially images and bling websites are those that target users living in gambling videos. We find that a number of illegal gambling websites prohibited countries. Taking China for example, according to host their images in image hosting services like Sinaimg (http: Chinese laws, operating online gambling websites or proxies //www.sinaimg.cn/) and Alicdn (http://www.alicdn.com/). is not permitted. However, there are a spate of online gam- Our observation shows that online third-party storage bling websites targeting Chinese via various kinds of illegal providers can serve as a pinch point for detecting illegal advertisements [12]. Most of these illegal online gambling gambling websites while being abused by illegal gambling websites are operated outside of China (e.g., Philippines) be- websites. cause of restrictive laws in China [7]. Moreover, abusing (4) Promotion strategies. Illegal Gambling websites can- the support from legal third-party online payment channels not promote their websites by using traditional SEO (Search makes illegal online gambling websites more trustworthy Engine Optimization) methods due to their illegitimacy. Our and hence attracting more players. work reveals three promoting strategies for illegal gambling In this paper, we attempt to answer the following two websites, including gambling navigation1, porn websites, and questions: (1) how do miscreants operate illegal gambling blackhat SEO. We further disclose several options on how websites? and (2) with different roles in operating gambling illegal gambling websites conduct blackhat SEO and attract websites, how are they orchestrated? To this end, we conduct potential victims. an empirical study on illegal gambling websites that target Contributions. We summarize our major contributions of Chinese. We first develop a detection system to identify il- this work as follows: legal gambling websites with the help of unlimited query interface of Baidu’s search engine [5], and we successfully • A systematic analysis of online illegal gambling cate- identify 967,954 illegal gambling websites. Then we exam- gories, their promotion strategies, and their network ine the identified illegal gambling websites and investigate infrastructures. This can help us to understand how how migrants operate these gambling websites, including operators control a mass of illegal online gambling their promotion strategies, payment systems, and customer websites. service applications. • The first measurement on the abuse of online third- party payment, outsourcing live chat services, and Findings. We disclose the following strategies on which third-party cloud storage services by illegal gambling miscreants operate illegal gambling sites. websites, (1) Abuse of online payment. We find that illegal gam- • The first measurement on promotion strategies em- bling websites stealthily employ legitimate online payment ployed by illegal gambling websites. The disclosure of channels for their illegal transactions. This is due to the boost their promotion strategies will help the security com- of online third-party payment systems, including Alipay [3] munity to seek a more effective method to detect these and WeChat Pay [35] in China. Although these popular third- websites. party online payment systems have no intention to provide financial support for gambling business in China, there are Roadmap. The rest of this paper is organized as follows. still many malicious financial proxies that can abuse these In Section 2, we present the background and motivation online payment systems to support their illegal services. Ac- for our research. In Section 3, we detail the system archi- tually we find that more than 322 small online third-party tecture and detection methods we used. In Section 4, we payment companies that provide illegal financial services describe our measurement study on gambling websites. In and support transactions for online gambling websites by Section 5, we present two case studies about payment change abusing normal Alipay and WeChat Pay channels. and withdrawal in gambling websites, showing how they (2) Abuse of outsourcing live chat services. We notice evade detection and cheat users. In Section 6, we survey that most gambling websites prefer to outsource live chat related work. Finally, in Section 7, we conclude the paper. services, instead of running their owns. In total, we find 8,387 abused outsourcing live chat services, and the most abused 2 BACKGROUND one is Provider Support [25], a typical outsourcing customer In this section, we present an overview of illegal online gam- service provider. By outsourcing customer services, illegal bling business, including how an illegal online gmabling 1Gambling websites link to each other. However, for illegal websites (e.g., contents about drugs and arms purchase and sale), they cannot reach good rank- ing in search result pages because their content is forbidden in certain countries and regions. So, illegal websites abuse whitehat SEO methods to manipulate search results deliber- ately by keyword stuffing,