Hourglass Model 2.0: Case Study of Southeast Asia Underground Services Abusing Global 2FA
summary
Hourglass Model 2.0 is a collection framework that maps four underground communication flows and turns marketplace chatter into operational leads; applied to a Southeast‑Asia SIM/SMS ecosystem it traces SIM vendors, SMS‑forwarding platforms and GSM farms that enable new‑account fraud by automating 2FA receipt and reselling aged accounts, referral credits, or goods bought with stolen cards. The report gives counts, price points, and workflows used in the wild and recommends verify tools/tactics, test detections, deploy in‑app MFA and share telemetry across merchants.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:39black hat Introduction: Hourglass Model 1.0
- 7:59black hat Hourglass Model 1.0: Scope
- 10:56Hourglass Model 2.0
- 17:12Case Study
- 18:36Research Plan
- 21:14Findings & Hypothesis
- 25:02blackhat Analysis: Fraud & Monetization Flow
- 29:56blackhat Analysis: Overall Workflow
- 33:16black hat Analysis: Overall 2FA Abuse
- 37:26black hat Hourglass 2.0 vs 2FA Methods
- 38:01black hat TLDR - Today's Key Takeaways
related talks
48m2FA2Furious: New Threats to MFA
30mAuthentication Strategies to Protect Your Customers and Your Brand from Sophisticated Attacks
30mFair game: the ethics of telco fraud
20mFraud fighting: leverage real-time network intelligence
40mPurple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up
25mAuthentication Beyond SMS
42mThe Old is New Again: An Intro to SMS Security and Why It’s Vital
36mBuilding Bulletproof 2FA with Twilio APIs