Beyond Takeover: Attacker’s in. Now what?
summary
Maintains 57 fake identities for six months, feeds their credentials into live phishing kits and public phishing-as-a-service feeds, and monitors hits with Canarytokens. Results show 44% of leakages led to logins, 46% of those occur within 24 hours, only 23% show any data access, average attacker session is about ten minutes, 16% attempt password reuse to pivot, 12% repurpose accounts for spam or further phishing, and attackers mostly probe manually, favoring quick web-URL checks (68%) over Word docs (25%) or ZIPs (7%).
AI-written summary · about
chapters (25)
- 0:00Intro
- 1:35Phish the Phishers
- 3:15Social Attacks
- 4:18Account Takeover Objectives
- 6:38The Phishing Ecosystem
- 7:53Research Objectives
- 8:25The Research Process
- 9:36Our Baits Network
- 10:45Make Accounts Authentic
- 12:10Account Monitoring
- 12:30Trace Login Attempts
- 16:08Credential Leakage
- 18:21Account Penetration
- 21:25Access Time
- 23:26Password Reuse Practices
- 28:07Effectiveness of Traps
- 29:40Account Abuse
- 31:06Story Time - Full account takeover
- 31:49Manual or Automated?
- 35:04Covering the tracks
- 36:26Geo Distribution
- 39:12Investigating incident
- 43:06Conclusions
- 44:14Human is Human
- 45:48CISO Takeaways
related talks
26mIntegrating Identity and Fraud
29mBecoming You: A Glimpse Into Credential Abuse
32mFriend or Replicant: How Attackers Automate and Disguise Themselves
31mLog In Through the Front Door: Automating Defense Against...
40mYou have a security problem - your users
40mWeb Attacks and Fraud: Lessons Learned from the Deep End of the Pool
45mApplying Past Lessons for Intel-Driven Identity Threat Detection
41m📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️