The life of breached data and the attack lifecycle
•
0 likes•401 views
OWASP RTP Presentation on Data breaches, credential spills, the lifespan of data, credential stuffing, the attack lifecycle, and what you can do to protect yourself or your users.
Report
Share
More Related Content
What's hot
What's hot (20)
Similar to The life of breached data and the attack lifecycle
Similar to The life of breached data and the attack lifecycle (20)
More from Jarrod Overson
More from Jarrod Overson (16)
Recently uploaded
Recently uploaded (20)
The life of breached data and the attack lifecycle
- 1. The Life of Breached Data August 2018 Jarrod Overson, Director of Engineering at Shape Security The Dark Side of Security
- 9. It’s more than just mega-breaches from large companies Web forums contributed many spills in 2017 Though web forums contributed a smaller number of credentials
- 10. 5+ Billion Leaked credentials in 2016 and 2017 alone
- 11. Jarrod Overson a.k.a. “I’m not a security guy” @jsoverson everywhere
- 12. Every breach adds a piece of you to a criminal's database. Passwords, emails, names, security questions & answers, addresses, and more
- 13. The downstream path from breach to fraud Fraud & Exploitation Account Takeovers Credential Stuffing Attacks Credential SpillsData Breaches Within your controlOutside of your control
- 14. Credential stuffing attacks Bank 0 + = Retailer x Bank y Airline z bob@gmail.com:p@ssw0rd1 ✅ ❌ ✅ sally@yahoo.com:qwerypoiu ❌ ✅ ❌ donna@company.com:norah2012 ✅ ❌ ❌
- 15. The tiers of attacker sophistication Tier 1 - The original attacker Tier 2 - The attacker’s private network Tier 3 - The dark web Tier 4 - Public
- 16. Credential spills decrease in value over time CredentialSpillValue Day 0 Data Breach Tier 1 attacks Attacker Tier 2 attacks Attacker’s Associates Tier 3 attacks Dark Web Day 456 Avg time before breach is reported Tier 4 attacks Public
- 17. What percentage of traffic is from bots?
- 18. 89%
- 19. 91%
- 20. 95%
- 21. 98%
- 22. What percentage of traffic is from bots? 99.8% ( Current record for automation against a login page, via Shape Security )
- 23. Why?
- 24. If you have value, there is value in attacking you.
- 25. - Store any actual or virtual currency? - Sell goods? - Have ANY unique PII? - Have user generated content? - Have time sensitive features? - Pay for digitally validated behavior? - Have a social aspect to your service? Do you…
- 26. But we have CAPTCHAs!
- 27. But CAPTCHAs don’t work
- 31. Have you ever seen an ad like this?
- 32. There is big money in “work from home data entry” jobs
- 33. So we seek alternatives
- 34. Often they rely on behavioral analysis
- 35. Sometimes they rely on kittens
- 36. Others still rely on death metal
- 37. Some are very high profile
- 38. How are attacks automated?
- 45. Once you detect an attacker, they are easy to block. Right?
- 46. One attacker from one machine can be blocked by IP.
- 47. Many attackers sound dangerous but aren't as common as they are made out to be.
- 48. One attacker using proxies to look like thousands of users across the globe is difficult to detect and block.
- 49. Spikes of traffic look perfectly normal most of the time. selenium
- 50. Devices leave fingerprints that can be traced selenium
- 51. And tools are made to leave no fingerprints
- 52. Lots of tools
- 54. We can’t patch our way through this.
- 55. How would you react if you went from…How would you react if you went from … Legitimate traffic
- 56. To this To this Automation detected and blocked Legitimate traffic
- 57. To this Automation detected and blocked Legitimate traffic To this
- 58. How do you protect you?
- 59. Make every password unique. Really.
- 60. • LastPass • 1Password • Any locally encrypted db Use a password manager. Use a password manager. LastPass, 1Password, any locally encrypted database.
- 61. Use a base password + a site specific string. For example: "hyatt small blue cup" Use a password algorithm
- 62. Turn on Multi-Factor Authentication.
- 63. How do you protect your users?
- 64. Throw away the myth that the biggest risk to your users is a weak password. The biggest and most prevalent risk is a reused password.
- 65. Don't add unnecessary password rules 8 char minimum, >64 char maximum, allow ANY character (including spaces)
- 66. Don't expire passwords unless necessary Expire when accounts are compromised or a user's credentials are leaked.
- 67. Do prevent users from using common passwords • 123456 • password • 12345678 • qwerty • 12345 • 123456789 • football • 1234 • 1234567 • baseball • welcome • 1234567890 • abc123 • 111111 • 1qaz2wsx • dragon • master • monkey • letmein • login • princess • qwertyuiop • solo • passw0rd Maintain and use a banned password list
- 68. Check against spilled credentials
- 70. How do you protect your business?
- 71. Use single flows for important transactions. Reduce the attack surface area as much as possible. Login widget Old login flow Regular Login Login at CC entry 2.x login Login on shopping cart VS Login
- 72. Ask and be ready for tough questions You may need to re-evaluate costs & value with new parameters.
- 73. Get help. You're not alone. Reduce the attack surface area as much as possible. - Helen Keller
- 74. The Life of Breached Data August 2018 Jarrod Overson, Director of Engineering at Shape Security The Dark Side of Security