The Life of Breached Data & The Dark Side of Security
-
Upload
jarrod-overson -
Category
Technology
-
view
312 -
download
0
Transcript of The Life of Breached Data & The Dark Side of Security
![Page 1: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/1.jpg)
The Life of Breached Data & The Dark Side of Security.
Jarrod Overson @jsoverson QCon SF 2016
![Page 2: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/2.jpg)
![Page 3: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/3.jpg)
![Page 4: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/4.jpg)
![Page 5: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/5.jpg)
![Page 6: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/6.jpg)
![Page 7: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/7.jpg)
It's more than just massive breaches from large companies, too.
![Page 8: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/8.jpg)
It's small continuous, streams of exploitable data
![Page 9: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/9.jpg)
![Page 10: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/10.jpg)
2.2 BillionLeaked credentials in 2016 alone
![Page 11: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/11.jpg)
Every breach adds a piece of you to a criminal's database.
Passwords, emails, names, security questions & answers, addresses, and more
![Page 12: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/12.jpg)
![Page 13: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/13.jpg)
Traditional security is like flossing.
We know we're supposed to care, but is it really that important?
![Page 14: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/14.jpg)
OWASP Top 10A1 – Injection
A2 – Broken Authentication and Session Management
A3 – Cross-Site Scripting (XSS)
A4 – Insecure Direct Object References
A5 – Security Misconfiguration
A6 – Sensitive Data Exposure
A7 – Missing Function Level Access Control
A8 – Cross-Site Request Forgery (CSRF)
A9 – Using Known Vulnerable Components
A10 – Unvalidated Redirects and Forwards
![Page 15: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/15.jpg)
OWASP Automated ThreatsOAT-020 Account Aggregation OAT-006 Expediting
OAT-019 Account Creation OAT-004 Fingerprinting
OAT-003 Ad Fraud OAT-018 Footprinting
OAT-009 CAPTCHA Bypass OAT-005 Scalping
OAT-010 Card Cracking OAT-011 Scraping
OAT-001 Carding OAT-016 Skewing
OAT-012 Cashing Out OAT-013 Sniping
OAT-007 Credential Cracking OAT-017 Spamming
OAT-008 Credential Stuffing OAT-002 Token Cracking
OAT-015 Denial of Service OAT-014 Vulnerability Scanning
![Page 16: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/16.jpg)
These attacks aren't cost effective unless automated
BY�EVIL��ROBOTS
![Page 17: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/17.jpg)
Our user-friendly APIs enable our attackers
![Page 18: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/18.jpg)
Not just these APIs
![Page 19: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/19.jpg)
The APIs we expose unintentionally.
![Page 20: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/20.jpg)
The APIs we expose unintentionally.
![Page 21: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/21.jpg)
The APIs we expose unintentionally.
![Page 22: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/22.jpg)
When you read about breaches, what do you do?
![Page 23: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/23.jpg)
Even if you have the most secure site in the world,
you don't usually protect against legitimate user logins.
![Page 24: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/24.jpg)
If your users were robots, could you tell?
![Page 25: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/25.jpg)
![Page 26: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/26.jpg)
What percentage of traffic is from bots?
![Page 27: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/27.jpg)
95%( Current record for automation against a login page, via Shape Security )
What percentage of traffic is from bots?
![Page 28: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/28.jpg)
Why?
![Page 29: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/29.jpg)
Do you… For example
Store a type of currency? actual money, point values, gift cards
Sell goods? physical, digital, services
Have unique PII? health care, social networks
Have user generated content? forums, social networks, blogs, comments
Have time sensitive features? tickets, flash sales, reservations
Pay for digitally validated behavior? ad clicks, reviews, "uber for X"
![Page 30: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/30.jpg)
If you have value, there is value in exploiting you.
![Page 31: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/31.jpg)
Targeted Fraud can take many forms.
![Page 32: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/32.jpg)
But we have captchas!
![Page 33: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/33.jpg)
But captchas don't work.
![Page 34: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/34.jpg)
Estimated 200 million+ hours spent every year deciphering squiggly letters.
Luis Von Ahn, creator of captcha
*
*
![Page 35: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/35.jpg)
Services have been made making captcha bypass even easier.
![Page 36: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/36.jpg)
Services have been made making captcha bypass even easier.
![Page 37: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/37.jpg)
Ever wonder where these ads go?
![Page 38: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/38.jpg)
There's big money in "Work from Home Data Entry" jobs
![Page 39: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/39.jpg)
So we seek alternatives.
![Page 40: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/40.jpg)
Some rely on simple behavior analysis
![Page 41: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/41.jpg)
Some rely on kittens
![Page 42: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/42.jpg)
Some rely on a love for death metal
![Page 43: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/43.jpg)
Some are very high profile
![Page 44: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/44.jpg)
How?
![Page 45: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/45.jpg)
They use a lot of the same tools we already use.
![Page 46: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/46.jpg)
![Page 47: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/47.jpg)
![Page 48: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/48.jpg)
![Page 49: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/49.jpg)
![Page 50: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/50.jpg)
![Page 51: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/51.jpg)
![Page 52: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/52.jpg)
Once you detect an attacker, they are easy to block.
Right?
![Page 53: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/53.jpg)
One attacker from one machine can be blocked by IP.
![Page 54: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/54.jpg)
Many attackers sound dangerous but aren't as common as they are made out to be.
![Page 55: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/55.jpg)
One attacker using proxies to look like thousands of users across the globe
is difficult to detect and block.
![Page 56: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/56.jpg)
Spikes of traffic across many IPs are normal, except when they aren't
![Page 57: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/57.jpg)
The devices themselves leave fingerprints
![Page 58: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/58.jpg)
And tools are made to leave no fingerprints
![Page 59: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/59.jpg)
Lots of tools.
![Page 60: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/60.jpg)
![Page 61: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/61.jpg)
We can't patch our way through this.
![Page 62: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/62.jpg)
How would you react if you went from …
Legitimate traffic
![Page 63: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/63.jpg)
To this
Automation detected and blockedLegitimate traffic
![Page 64: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/64.jpg)
Automation detected and blockedLegitimate traffic
To this
![Page 65: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/65.jpg)
Automation detected and blockedLegitimate traffic
To this
![Page 66: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/66.jpg)
To get an idea, search for :
• <your company, service, or CMS> fullz
• <your company, service, or CMS> sentrymba
• <your company, service, or CMS> carding
• <your company, service, or CMS> <tool> tutorial
Not sure if you have a problem?
![Page 67: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/67.jpg)
How do you protect you?
![Page 68: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/68.jpg)
Make every password unique. Really.
![Page 69: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/69.jpg)
• LastPass
• 1Password
• Any locally encrypted db
Use a password manager.Use a password manager.
LastPass, 1Password, any locally encrypted database.
![Page 70: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/70.jpg)
Use a base password + a site specific string.
For example: "hyatt small blue cup"
Use a password algorithm
![Page 71: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/71.jpg)
Turn on Multi-Factor Authentication.
![Page 72: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/72.jpg)
How do you protect your users?
![Page 73: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/73.jpg)
First, throw away the myth that the primary risk to passwords is how crackable they are.
The biggest risk to you and your users is reused passwords.
![Page 74: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/74.jpg)
Don't add unnecessary password rules
8 char minimum, >64 char maximum, allow ANY character (including spaces)
![Page 75: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/75.jpg)
Do prevent users from using common passwords
• 123456 • password • 12345678 • qwerty • 12345 • 123456789 • football • 1234
• 1234567 • baseball • welcome • 1234567890 • abc123 • 111111 • 1qaz2wsx • dragon
• master • monkey • letmein • login • princess • qwertyuiop • solo • passw0rd
Maintain and use a banned password list
![Page 76: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/76.jpg)
Don't expire passwords unless necessary
Expire when accounts are compromised or a user's credentials are leaked.
![Page 77: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/77.jpg)
Offer Multi-Factor Authentication.
There any many options and services that make this easy and tolerable.
![Page 78: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/78.jpg)
How do you protect your business?
![Page 79: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/79.jpg)
Use single flows for important transactions.
Reduce the attack surface area as much as possible.
Login widget
Old login flow
Regular Login
Login at CC entry
2.x login
Login on shopping cart
VS Login
![Page 80: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/80.jpg)
Ask and be ready for tough questions
You may need to re-evaluate costs & value with new parameters.
![Page 81: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/81.jpg)
Get help. You're not alone.
Reduce the attack surface area as much as possible.- Helen Keller
![Page 82: The Life of Breached Data & The Dark Side of Security](https://reader030.fdocuments.in/reader030/viewer/2022032710/58a0c2191a28ab6d018b46c3/html5/thumbnails/82.jpg)
The Life of Breached Data & The Dark Side of Security.
Jarrod Overson @jsoverson QCon SF 2016