Inside the Breach: Secrets Exposed

on YouTube ↗59m

" summary

Catalog of breaches shows 15 billion breached records aggregated, Ticketek leaks contain 17.6 million email addresses, and Snowflake intrusions expose corporate backups. Demonstrations include a Grindr account takeover using password‑reset tokens leaked in HTTP responses and a Mailchimp phishing flow that yields an API key to dump a 16,000‑subscriber list. Analysis shows services leaking emails, bcrypt hashes, 2FA secrets (Sproutable) and criminal marketplaces and forums selling data; recommended mitigation: passkeys are non‑fishable.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 3:33Breach scale and Have I Been Pwned
3. 10:36Non-disclosure problem
4. 14:09All breaches preventable
5. 20:26Phishing lessons learned
6. 32:10Passkeys and resistant auth
7. 35:18Breach aggregation dangers
8. 39:10Hacking forums and leak sites
9. 43:08Truth in breach records
10. 47:31Spoutable security failure case
11. 52:31Q&A

" related talks

• 01h 00mHow I Met Your DataTroy Hunt · NDC Sydney 2024
• 57mLessons From Billions of Breached RecordsTroy Hunt · Security Visionaries 2022
• 48mLessons From Billions of Breached RecordsTroy Hunt · GOTO Copenhagen 2022
• 46mKeynote: Lessons From 11 Billion Breached RecordsTroy Hunt · Black Hat Asia 2021
• 47mLessons From Billions of Breached RecordsTroy Hunt · Security Visionaries 2022
• 25mTopics of Interest: An Attackers View on APAC's 2021 Three Major BreachesRic Campo · OWASP 20th Anniversary 2021
• 22mDevSecOps - The Story of 3 Security BreachesYash Kadakia · SREday London 2022
• 24mLessons from API Breaches: Securing Your Digital InfrastructureJeremy Snyder · apidays Australia 2023