Psychology and Security Demotivating Persistent Attackers Jarrod - - PowerPoint PPT Presentation

▶
psychology and security
SMART_READER_LITE
LIVE PREVIEW

Psychology and Security Demotivating Persistent Attackers Jarrod - - PowerPoint PPT Presentation

Sep 27, 2022 263 likes •864 views

Psychology and Security Demotivating Persistent Attackers Jarrod Overson - @jsoverson Director of Engineering, Shape Security QConSF 2018 HOW DO YOU ENGAGE WITH ATTACKERS WHILE WHILE UNDER ATTACK? HOW DO YOU KNOW YOU ARE UNDER ATTACK?

slide-1
SLIDE 1

Psychology and Security

Demotivating Persistent Attackers

Jarrod Overson - @jsoverson Director of Engineering, Shape Security QConSF 2018

slide-2
SLIDE 2

HOW DO YOU

ENGAGE WITH

ATTACKERS 


WHILE

UNDER ATTACK?

WHILE

slide-3
SLIDE 3

HOW DO YOU

KNOW YOU

ARE UNDER

ATTACK?

IN THE FIRST PLACE?

ATTACK

slide-4
SLIDE 4

1

The economics of attacks

2

Flipping the economics in your favor

3

Case Studies Imitation attacks and attacker sophistication

slide-5
SLIDE 5

IN THE BEGINNING,

ACCESS

WAS GIVEN TO

EVERYONE & EVERYTHING

slide-6
SLIDE 6

THE MORE WALLS

WE PUT UP

THE HARDER IT

BECAME TO TELL

HUMANS AND

ATTACKERS APART

slide-7
SLIDE 7
slide-8
SLIDE 8

TO AFFECT BEHAVIOR,

YOU NEED TO 


REMOVE THE


INCENTIVES.

INCENTIVE

slide-9
SLIDE 9

MANUAL ATTACKS AUTOMATED ATTACKS

Sufficient when value is high Can’t scale when value per attack is reduced Can’t scale when cost per attack is increased Sufficient when value is low

slide-10
SLIDE 10

Decrease value Increase cost

THE SECRET TO DEFEATING ATTACKERS

slide-11
SLIDE 11

Increase value Decrease cost

THE SECRET TO HAPPY USERS

slide-12
SLIDE 12

1

The economics of attacks

2

Flipping the economics in your favor

3

Case Studies Attacker sophistication & where we are

slide-13
SLIDE 13

Attack Detail: Credential Stuffing

slide-14
SLIDE 14

Data Breach Credential Spill Credential Stuffing Account Takeover Fraud

FROM DATA BREACH TO DAMAGE

slide-15
SLIDE 15

Data Breach Credential Spill Credential Stuffing Account Takeover Fraud

Outside your control

slide-16
SLIDE 16

Data Breach Credential Spill Credential Stuffing Account Takeover Fraud

Within your control

slide-17
SLIDE 17

Your web applications and APIs are the battlefield.

slide-18
SLIDE 18

CREDENTIAL STUFFING A STEP BY STEP GUIDE

1

Get Credentials

2

Automate Login

3 4

Defeat Automation Defenses Distribute Globally

cre·den·\al stuff·ing

/krəˈden(t)SHəl ˈstəfiNG/ The automated replay of breached username/password pairs across many sites in order to take over accounts where passwords have been reused.

slide-19
SLIDE 19
  • 1. Get Credentials

CREDENTIAL STUFFING

1

slide-20
SLIDE 20
  • 1. Get Credentials
  • 2. Automate Login

CREDENTIAL STUFFING

2

slide-21
SLIDE 21
  • 1. Get Credentials
  • 2. Automate Login

CREDENTIAL STUFFING

2

slide-22
SLIDE 22
  • 1. Get Credentials
  • 2. Automate Login

CREDENTIAL STUFFING

2

slide-23
SLIDE 23
  • 1. Get Credentials
  • 2. Automate Login
  • 3. Defeat Defenses

CREDENTIAL STUFFING

3

slide-24
SLIDE 24
  • 1. Get Credentials
  • 2. Automate Login
  • 3. Defeat Defenses

CREDENTIAL STUFFING

3

slide-25
SLIDE 25
  • 1. Get Credentials
  • 2. Automate Login
  • 3. Defeat Defenses

CREDENTIAL STUFFING

3

slide-26
SLIDE 26
  • 1. Get Credentials
  • 2. Automate Login
  • 3. Defeat Defenses

CREDENTIAL STUFFING

3

slide-27
SLIDE 27
  • 1. Get Credentials
  • 2. Automate Login
  • 3. Defeat Defenses
  • 4. Distribute

CREDENTIAL STUFFING

4

slide-28
SLIDE 28

CREDENTIAL STUFFING

2 4 3 1

Combolists starting at $0 $50 per site configuration $1.39 per 1000 CAPTCHAs $2 for 1000 global IPs } Less than $200 for 100,000 ATO attempts

slide-29
SLIDE 29

1

The economics of attacks

2

Flipping the economics in your favor

3

Case Studies Attacker sophistication & where we are

slide-30
SLIDE 30

DETECTION MITIGATION vs

slide-31
SLIDE 31

Have multiple ways to detect bad actors

slide-32
SLIDE 32

Also have ways to detect when they’ve started to pry open your systems

slide-33
SLIDE 33

TARGET WHAT HURTS THE MOST

It’s not as simple as blocking a baddie. You need to target what will hurt the most.

slide-34
SLIDE 34

Planning

THE SOFTWARE DEVELOPMENT LIFECYCLE

What tools work, what don’t? What URLs need to be targeted? What dark web data do I need?

slide-35
SLIDE 35

Planning Development

THE SOFTWARE DEVELOPMENT LIFECYCLE

Investment in a framework of choice. Custom development against a site. Building in proxy/botnet hooks.

slide-36
SLIDE 36

Planning Development Testing

THE SOFTWARE DEVELOPMENT LIFECYCLE

Does it bypass protections?
 Does it handle edge case responses? Does it consume breach data properly?

slide-37
SLIDE 37

Planning Development Testing Integration

THE SOFTWARE DEVELOPMENT LIFECYCLE

Check integration with botnets. Ensure health checks work. Deploy to cloud services.

slide-38
SLIDE 38

Planning Development Testing Integration Release

THE SOFTWARE DEVELOPMENT LIFECYCLE

Initiate Attack

slide-39
SLIDE 39

Planning Development Testing Integration Release

THE SOFTWARE DEVELOPMENT LIFECYCLE

Cost incurring stages Value generation stage

slide-40
SLIDE 40

1

The economics of attacks

2

Flipping the economics in your favor

3

Case Studies Attacker sophistication & where we are

slide-41
SLIDE 41

Case Study 1 Damaging Reputation

slide-42
SLIDE 42

Scenario

vs

Well funded scraper Big US Bank

slide-43
SLIDE 43

The actor cycled through the softest targets

slide-44
SLIDE 44

Finally committed to one to dive deeper

The threat found prolonged success on iOS due to version lag

slide-45
SLIDE 45

Got around defenses regularly, though not durably

slide-46
SLIDE 46

Recognizing patterns in behavior

Sun Mon Tues Weds Thurs Fri Sat

slide-47
SLIDE 47

Analysis

2 4 3 1

Regular working schedule Actor’s consumers were notified upon success Failure was met with downstream frustration Prolonged failure provoked distress

slide-48
SLIDE 48

Plan of action

2 4 3 1

Target defense out of working schedule Turn on defenses when damage would be highest Turn off primary mitigation during working schedule Cycle through defenses even when still working

slide-49
SLIDE 49

Case Study 2 Github Kiddies

slide-50
SLIDE 50

Scenario

vs

Credential Stuffer and Account taker-overer Big US Retailer

slide-51
SLIDE 51

We were down to a fraction of our normal ability to detect We needed more data

slide-52
SLIDE 52

We had enough of a grip to deliver a targeted payload

slide-53
SLIDE 53

This allowed us to inspect the retooling effort in real time

slide-54
SLIDE 54

What we learned

slide-55
SLIDE 55

Analysis

2 4 3 1

Actor was a competent developer Still relied on community to get around problems Bypassed defenses via trial and error Actor was been lucky, not wildly skilled

slide-56
SLIDE 56

Plan of action

2 4 3 1

Build up defenses based on the tool he was using Provide variable feedback during retooling phase Turn on just enough to be infuriating. No more, no less Create new countermeasures that act differently during retooling phase

slide-57
SLIDE 57

1

Treat detection and mitigation separately.

2 3

Understand what is incentivizing your attackers.

Recap

4

Protect the data used to detect. Work with product to build app-level defenses.

slide-58
SLIDE 58

TacDcs is knowing what to do when there is something to do. Strategy is knowing what to do when there is nothing to do.

  • Savielly Tartakower
slide-59
SLIDE 59

Psychology and Security

Demotivating Persistent Attackers

Jarrod Overson - @jsoverson Director of Engineering, Shape Security QConSF 2018