The Life of Breached Data & The Dark Side of Security. Jarrod - - PowerPoint PPT Presentation

▶
the life of breached data the dark side of security
SMART_READER_LITE
LIVE PREVIEW

The Life of Breached Data & The Dark Side of Security. Jarrod - - PowerPoint PPT Presentation

Feb 18, 2024 230 likes •1.07k views

The Life of Breached Data & The Dark Side of Security. Jarrod Overson @jsoverson QCon SF 2016 It's more than just massive breaches from large companies, too. It's small continuous, streams of exploitable data 2.2 Billion Leaked

slide-1
SLIDE 1

The Life of Breached Data & The Dark Side of Security.

Jarrod Overson @jsoverson QCon SF 2016

slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7

It's more than just massive breaches from large companies, too.

slide-8
SLIDE 8

It's small continuous, streams of exploitable data

slide-9
SLIDE 9
slide-10
SLIDE 10

2.2 Billion


Leaked credentials in 2016 alone

slide-11
SLIDE 11

Every breach adds a piece of you to a criminal's database.

Passwords, emails, names, security questions & answers, addresses, and more

slide-12
SLIDE 12
slide-13
SLIDE 13

Traditional security is like flossing. We know we're supposed to care, but is it really that important?

slide-14
SLIDE 14

OWASP Top 10

A1 – Injection A2 – Broken Authentication and Session Management A3 – Cross-Site Scripting (XSS) A4 – Insecure Direct Object References A5 – Security Misconfiguration A6 – Sensitive Data Exposure A7 – Missing Function Level Access Control A8 – Cross-Site Request Forgery (CSRF) A9 – Using Known Vulnerable Components A10 – Unvalidated Redirects and Forwards

slide-15
SLIDE 15

OWASP Automated Threats

OAT-020 Account Aggregation OAT-006 Expediting OAT-019 Account Creation OAT-004 Fingerprinting OAT-003 Ad Fraud OAT-018 Footprinting OAT-009 CAPTCHA Bypass OAT-005 Scalping OAT-010 Card Cracking OAT-011 Scraping OAT-001 Carding OAT-016 Skewing OAT-012 Cashing Out OAT-013 Sniping OAT-007 Credential Cracking OAT-017 Spamming OAT-008 Credential Stuffing OAT-002 Token Cracking OAT-015 Denial of Service OAT-014 Vulnerability Scanning

slide-16
SLIDE 16

These attacks aren't cost effective unless automated

BYEVIL ROBOTS

slide-17
SLIDE 17

Our user-friendly APIs enable our attackers

slide-18
SLIDE 18

Not just these APIs

slide-19
SLIDE 19

The APIs we expose unintentionally.

slide-20
SLIDE 20

The APIs we expose unintentionally.

slide-21
SLIDE 21

The APIs we expose unintentionally.

slide-22
SLIDE 22

When you read about breaches, what do you do?

slide-23
SLIDE 23

Even if you have the most secure site in the world, you don't usually protect against legitimate user logins.

slide-24
SLIDE 24

If your users were robots, could you tell?

slide-25
SLIDE 25
slide-26
SLIDE 26

What percentage of traffic is from bots?

slide-27
SLIDE 27

95%

( Current record for automation against a login page, via Shape Security )

What percentage of traffic is from bots?

slide-28
SLIDE 28

Why?

slide-29
SLIDE 29

Do you…

For example

Store a type of currency? actual money, point values, gift cards Sell goods? physical, digital, services Have unique PII? health care, social networks Have user generated content? forums, social networks, blogs, comments Have time sensitive features? tickets, flash sales, reservations Pay for digitally validated behavior? ad clicks, reviews, "uber for X"

slide-30
SLIDE 30

If you have value, there is value in exploiting you.

slide-31
SLIDE 31

Targeted Fraud can take many forms.

slide-32
SLIDE 32

But we have captchas!

slide-33
SLIDE 33

But captchas don't work.

slide-34
SLIDE 34

Estimated 200 million+ hours spent every year deciphering squiggly letters.

Luis Von Ahn, creator of captcha * *

slide-35
SLIDE 35

Services have been made making captcha bypass even easier.

slide-36
SLIDE 36

Services have been made making captcha bypass even easier.

slide-37
SLIDE 37

Ever wonder where these ads go?

slide-38
SLIDE 38

There's big money in "Work from Home Data Entry" jobs

slide-39
SLIDE 39

So we seek alternatives.

slide-40
SLIDE 40

Some rely on simple behavior analysis

slide-41
SLIDE 41

Some rely on kittens

slide-42
SLIDE 42

Some rely on a love for death metal

slide-43
SLIDE 43

Some are very high profile

slide-44
SLIDE 44

How?

slide-45
SLIDE 45

They use a lot of the same tools we already use.

slide-46
SLIDE 46
slide-47
SLIDE 47
slide-48
SLIDE 48
slide-49
SLIDE 49
slide-50
SLIDE 50
slide-51
SLIDE 51
slide-52
SLIDE 52

Once you detect an attacker, they are easy to block. Right?

slide-53
SLIDE 53

One attacker from one machine can be blocked by IP.

slide-54
SLIDE 54

Many attackers sound dangerous but aren't as common as they are made out to be.

slide-55
SLIDE 55

One attacker using proxies to look like thousands of users across the globe is difficult to detect and block.

slide-56
SLIDE 56

Spikes of traffic across many IPs are normal, except when they aren't

slide-57
SLIDE 57

The devices themselves leave fingerprints

slide-58
SLIDE 58

And tools are made to leave no fingerprints

slide-59
SLIDE 59

Lots of tools.

slide-60
SLIDE 60
slide-61
SLIDE 61

We can't patch our way through this.

slide-62
SLIDE 62

How would you react if you went from …

Legitimate traffic

slide-63
SLIDE 63

To this

Automation detected and blocked Legitimate traffic

slide-64
SLIDE 64

Automation detected and blocked Legitimate traffic

To this

slide-65
SLIDE 65

Automation detected and blocked Legitimate traffic

To this

slide-66
SLIDE 66

To get an idea, search for :

  • <your company, service, or CMS> fullz
  • <your company, service, or CMS> sentrymba
  • <your company, service, or CMS> carding
  • <your company, service, or CMS> <tool> tutorial

Not sure if you have a problem?

slide-67
SLIDE 67

How do you protect you?

slide-68
SLIDE 68

Make every password unique. Really.

slide-69
SLIDE 69
  • LastPass
  • 1Password
  • Any locally encrypted db

Use a password manager. Use a password manager.

LastPass, 1Password, any locally encrypted database.

slide-70
SLIDE 70

Use a base password + a site specific string. For example: "hyatt small blue cup"

Use a password algorithm

slide-71
SLIDE 71

Turn on Multi-Factor Authentication.

slide-72
SLIDE 72

How do you protect your users?

slide-73
SLIDE 73

First, throw away the myth that the primary risk to passwords is how crackable they are. The biggest risk to you and your users is reused passwords.

slide-74
SLIDE 74

Don't add unnecessary password rules

8 char minimum, >64 char maximum, allow ANY character (including spaces)

slide-75
SLIDE 75

Do prevent users from using common passwords

  • 123456
  • password
  • 12345678
  • qwerty
  • 12345
  • 123456789
  • football
  • 1234
  • 1234567
  • baseball
  • welcome
  • 1234567890
  • abc123
  • 111111
  • 1qaz2wsx
  • dragon
  • master
  • monkey
  • letmein
  • login
  • princess
  • qwertyuiop
  • solo
  • passw0rd

Maintain and use a banned password list

slide-76
SLIDE 76

Don't expire passwords unless necessary

Expire when accounts are compromised or a user's credentials are leaked.

slide-77
SLIDE 77

Offer Multi-Factor Authentication.

There any many options and services that make this easy and tolerable.

slide-78
SLIDE 78

How do you protect your business?

slide-79
SLIDE 79

Use single flows for important transactions.

Reduce the attack surface area as much as possible.

Login widget Old login flow Regular Login Login at CC entry 2.x login Login on shopping cart VS Login

slide-80
SLIDE 80

Ask and be ready for tough questions

You may need to re-evaluate costs & value with new parameters.

slide-81
SLIDE 81

Get help. You're not alone.

Reduce the attack surface area as much as possible.

  • Helen Keller
slide-82
SLIDE 82

The Life of Breached Data & The Dark Side of Security.

Jarrod Overson @jsoverson QCon SF 2016