Beyond takeover: stories from a hacked account

© 2017 Imperva, Inc. All rights reserved.
Beyond Takeover Stories from a Hacked Account
Itsik Mantin, Luda Lazar
July 2017

• Itsik Mantin
• Director of Security Research at Imperva
• 16 years experience in the security industry
• Holds an M.Sc. in Applied Math and Computer
Science
• Luda Lazar
• Cyber Threat Researcher
• 4 years of industry experience, mostly reverse
engineering and security technology
• Holds B. Sc. in Computer Science
Speakers

Acknowledgments
• Tammer Ghattas
• Jwana Yakub
• Thinkst (providers of Canarytokens)

Phishing
1

Social Attacks
• 43% of breaches involved social attacks

Phishing
• 80% of finance-motivated breaches
involve phishing
• 5-15% click-rate (varying between
industries)
Click-rate (per vertical)

Phishing Objectives
• Identity theft
• Fraudulent transactionsFraud
• Steal secret data
• Espionage
• Steal contacts
Data theft
• Spamming/phishing
• Malware distribution
• Site/person promotion
Account abuse

Phishing
Phishing mail Fake website
Credential
stealing
Malware
download

The Phishing Ecosystem
Home-
made
Do-it-
yourself
Managed
services
Fraud
Data theftAccount abuse

Research Objectives
Credential
theft and
account
takeover
Relation to
breaches
Dynamics of
phishing
attack
Attackers’
practices
Setup and
maintenance
of accounts
Account
monitoring
Credentials
leakage
Collection
and analysis
of data
Disclosing the accounts’
credentials to phishing
campaigns
Maintain
personal online
accounts
Use Canarytokens to
track attackers’
activity in the
accounts
Collect and analyze
results

The Research
11
2

Our “Bait” Network
Management
Account
30 Groups of
accounts
60 Singular
email accounts

Make Accounts Authentic

Account Monitoring
Activity

Trace Login Attempts

Tracking Account Activity
Activity

Canarytokens
• Canarytokens toolkit created by Thinkst Applied Research
• Decoys – documents and services that trigger alerts when accessed

• Web bugs (URLs) – alert when URL is requested
• Microsoft Word Documents – alert when a document is opened
• Windows folders (ZIP archives) – alert when someone browsed a folder in File Explorer
Canarytokens - Decoys Types

Credentials Leakage
• OpenPhish feed and PhishTank database - sources for zero-day phishing sites
• We invite attackers by leaking our accounts credentials to phishing campaigns

Leakage Rounds
Credentials
Leakage
Round ..
Credentials
Leakage
Round 3
Credentials
Leakage
Round 2
Credentials
Leakage
Round 1
Round Steps

From Takeover to Exploitation
3

1
44%
Not
Penetrated
56%
Account Penetration Statistics
Repeated
penetration
34%One-time
penetration
66%
One time/Repetitive penetration
1
23%
2
77%
Access to data
88 from 200
credentials were
used by the
attackers
30 of 88 accounts
were penetrated
repeatedly (99
penetrations in total)
23% of penetrated
accounts triggered
114 Canarytokens
alerts
61% of
Canarytokens
triggered during
repetitive
penetration

Takeover may not be Immediate

Timely Detection Can Stop the Next Breach
56% of credentials
were not exploited
54% exploitations happened
after more than 24 hours

60%25%
Exploration of a Hacked Account
Time between login and last alert
Login

Password Reuse Practices
Leak a
lead
account
credentials
All accounts
in “bait”
group have
the same
password
Tracked
the activity
for all
group
accounts

Propagation to other accounts
16% of attackers reused credentials to propagate to the other accounts

4
Attacker Practices

Inside your Inbox

What do attackers look for?
1
25%
2
75%

Where did an Attacker Search for Information?
70%
18%
12%

Effectiveness of Traps
• Web bugs (URLs) – alert when URL is requested
• Microsoft Word Documents – alert when a document is opened
• Windows folders (ZIP archives) – alert when someone browsed a folder in File Explorer

Account Abuse
• 12% of accounts were used for further malicious activity

Story Time - Full account takeover

Manual or Automatic?
Selective Data Access Discontinuous Access Quick First Access to Data
74% of primary Canarytokens triggered in first 3 minutes after login

Covering Tracks

Covering the tracks – Attackers’ Practices
17%
15%
13%
3%
2%
Covered tracks
Delete sign-in alerts from the Inbox
Delete sent emails and failure notice messages
Mark messages as unread
Delete sign-in alert permanently

Spotting Attackers
5

Spotting Attackers – Anonymous Access
39…
Tor, proxies or hosting services
• 187 logins from 167 IP addresses and 18 countries

Geographic Distribution of Attackers
All accesses Excluding anonymous accesses

Stories from the Hacked Account
6

First Story: Launch Spear Phishing Attack
One of the world's largest
telecommunications operators

Investigating Incident
• Something is wrong…

Investigating Incident
• Step 1: Search evidences

Investigating incident
• Step 2: Analysis of evidences

Investigating incident
pedro……@yahoo.com

Our Investigation
• Step 3: Attribution
pedro……@yahoo.com

Second Story: In the Crosshairs of Inheritance Scammers
Ms. Judith Chan
Emma
(Our Account)

“…an opportunity like this only comes once in a lifetime”
Ms. Judith Chan

Judith Chan
The Strategy
51

What next? Agreement Letter

The End of the Scam

Summary and Conclusion
7

Summary
When credentials leak,
takeover does not always
happen (44% only)
When it does, it is not always
immediate (46% of hacked
accounts)
of attackers searched for
sensitive data inside the
honey accounts of the attacks were used for
launching further attacks
Password reuse was detected
in (only) 16% of the attacks
Of the attacks seem to use
automation

Conclusions
• The Phishing threat is here to stay
• Large numbers of stolen credentials + manual labor  attackers don’t even use them all
(automation?)
• Quick detection and mitigation of credential theft can reduce the account hacking probability by 54%
• Attackers are sometimes as sloppy as their victims (or they don’t care about being identified)
• Password reuse is less reused by attackers than what is commonly believed

Human is Human
Attackers
• Fell into our phishing scams…
• Left clear tracks in most
accounts
• Were sloppy and left hints for
their identity
Users
• Security training and education is
important but people will continue
make mistakes, fall into social
engineering and give the attackers
the road in
• Users will continue being the
weakest and least predictable part of
the organization

CISO Takeaways
• Password reuse is dangerous and might provide the attacker’s road to within the organization
• Attackers are after data. Credentials, financial data, business data
• Assume credentials of users are stolen
For applications
• Deploy phishing detection solution to detect
credentials theft in time
• Deploy account takeover protection
For the enterprise network
• Assume attackers are already in
• Protect your business critical data as close as possible
to the data

Get the Report
Read the full research report “Beyond Takeover - Stories from a Hacked
Account” here:
https://www.imperva.com/DefenseCenter/HackerIntelligenceReports

Beyond takeover: stories from a hacked account

Beyond takeover: stories from a hacked account

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Beyond takeover: stories from a hacked account

Semelhante a Beyond takeover: stories from a hacked account (20)

Mais de Imperva

Mais de Imperva (20)

Último

Último (20)

Beyond takeover: stories from a hacked account