start	end	text
41340	45640	Thanks for tuning into our talk. I'm Spencer Cureton, and with me is Alan Sagenovic.
45640	52720	We are on the abuse operations team at Heroku, where we keep users from doing bad things on, to, and from the platform.
52920	55820	We're like mall cops for our corner of the internet.
56360	60120	This talk focuses on abuse and how we hunt for it on Heroku.
60580	65380	So Heroku is a platform as a service that was purchased by Salesforce about 10 years ago.
65380	72900	It provides an easy interface to quickly go from idea to online application without having to manage and configure the underlying infrastructure.
73400	80400	So to put it simply, we run anyone's code on the internet as directed from unknown sources millions of times a day.
81140	84260	Okay, we are RCE as a service.
84340	91980	The part of Heroku we're talking about is referred to as the free tier, or the common runtime, where all you need is an email address to create an account.
91980	96160	Heroku has other offerings that are not like this, but we won't be talking about them today.
96200	101420	Our focus will be on how we defend the common runtime from abusive bad actors.
102540	105680	So just defining abuse is a challenge within itself.
106000	109940	We define abuse as the unintended monetization of anything.
110240	118300	So if you have a free service, a free trial, or any offering that has an angle to extract value, somebody is already trying to figure out a way to make money off of it.
118300	124980	It's a very fine line between a business trying to get off the ground and an abuser trying to take advantage of your services.
125140	127620	Sometimes it's obvious, like theft of resources.
127860	129400	Other times it's not so clear.
129600	131740	For example, think about a social media poll.
131740	137220	It's intended for honest input, but it's gameable because it's not one person, one vote.
137240	138920	It's one account, one vote.
138920	142380	So the person in control of the most accounts wins.
142380	147460	The problem isn't new, the scams aren't new, but we see them leveraging more and more of the cloud.
147780	151480	And we feel like we have a unique perspective that we would like to share.
152640	161500	So in a more practical layer, we see a portion of this bigger abuse picture realized through misuse, malice, and crime on our platform.
161960	168160	Legal documents like the Acceptable Use Policy, the AUP, provide a list of prohibited content and prohibited actions.
168160	174640	So it's the list of don'ts for users to follow, and also acts as a set of guidelines for our team to uphold.
175180	178340	Obviously, this can't cover every type of abuse activity.
178360	184840	And even if it did, it would act as a laundry list for an abuser to know what kind of badness could be performed from the platform.
185440	188580	Let's look at how we group violations of the AUP.
189060	192340	There are unintentional and intentional violations.
192340	200580	Now, unintentional could be a customer that deploys a poorly written app that consumes more than its share of resources, and now they've become a noisy neighbor.
201000	206400	So think about like a runaway web scraper. Not malicious, but kind of like they were accidentally jerks.
206880	211140	Then we have the intentional abusers, and these are the folks that make this job really interesting.
211480	217040	They have skills that range from script pity to rogue advanced developer, which we call our apex actors.
218160	223600	Skids will be skids and deploy code found on GitHub, YouTube, or whatever their buddy gave them to run.
223860	230520	At times, we'll get what feels like a swarm of abuse centered around a particular app, like a proxy kit or a peer-to-peer app.
230780	239420	Then there are the quick and loud abusers that could care less about being detected and will attempt to stand up a DDoS farm and attack a target as quickly as possible.
239880	244740	Now, the actors that are patient, skilled, and criminal are the more dangerous group.
244740	248740	These actors attempt to iterate past our detection capabilities.
248740	254540	They may try to social engineer support staff in order to gain insight into how they were detected after being suspended,
254540	257960	and will try anything to maximize their use of the platform.
258160	262660	Now, these users are not exploiting technical vulnerabilities within the platform.
262740	265980	They take advantage of gaps in business logic.
265980	269020	So technically, everything's working as designed.
269200	272100	The majority are not too advanced, but are very persistent.
272100	277700	So if you like to think about APT, small lowercase a, big capital P.
277760	279700	And again, financially motivated.
279860	283740	Now, persistent here means that after an account has been suspended,
283740	291060	the same actor will try to create a new account with a different email address or a sub-inbox variant of the original email address.
291100	295060	We'll cover a few campaigns during the show and tell section of this talk.
296400	301460	Overall, we define our team, Abuse Operations, as a specialized DFIR team
301460	305440	that requires a wide view across the business as shown in this slide.
305580	312680	Our goal is to push bad actors from the platform and put a spotlight on abuse patterns for engineering teams and the business to address.
312700	318620	In order to identify those bad actors and stay on top of them, we need to be proactive and hunt.
318660	322780	Now I'll hand it over to Alan to discuss the art of the hunt. Alan?
323180	329120	Hi, thank you, Spencer. I'm Alan. I'm Akam on the Discord, if you want to find me later.
329640	335420	Now, we're quickly going to breeze through this, how we hunt, mostly just to give better context around the next section,
335420	340340	which is really going to be the meat of it. Now, there's a lot on these slides. I'm not going to talk about every point.
340340	343060	Just kind of the more interesting stuff, the more pertinent stuff.
343060	349380	If you want to hear the philosophy behind this, go look at the talk that we did at that other conference that happened a little earlier this week.
350360	358000	Besides, I think that you guys at the Blue Team Village probably do some semblance of this already.
358000	365100	So we gather suspicious indicators from any of a number of different places, as you can see listed.
365160	374540	For example, an app with an abnormally high CPU would generate some sort of event-based alarm that would give us a hint to go look at it.
374540	380320	On the slide, as you can see, there's a short list of some of the indicators that we collect of the various places we collect them from.
380320	388240	Now, because we're highly instrumented, and because Heroku runs on Heroku, this is how we can actually gain home-field advantage,
388240	391040	by putting these internal and external indicators together.
391040	395620	Now, for this moment, just understand that the indicators that we're getting are considered really low-value.
395620	400180	By themselves, they don't have any kind of context, or rarely enough context to actually make a decision.
401800	408200	Now, given a starting suspicious indicator or two, we form some sort of hypothesis about the intent of the actor.
408200	412580	We start looking at related indicators and try to prove or disprove that hypothesis.
412620	419740	Now, each of these indicators is not proof of intent of any kind individually, but as you can see by this list,
419740	423080	you can see that they collectively start making a really strong case.
423080	428320	Collection of low-value indicators does become a very good footprint of malicious activity.
430380	435120	To increase the confidence of what we're looking at, we keep asking that question, what else you got?
435120	441980	For instance, a face-rolled email address, like the one shown, is a pretty good indicator that the user doesn't really value the account.
442020	445060	Same with app names, if they got a face-rolled app name, too.
445060	449720	Rumor is a great indicator of badness, though, because it could be just for discarding it.
449720	450940	Test, discard.
450960	455120	However, a face-rolled email address with a collection of face-rolled app names,
455700	460600	in addition to multiple attempts to verify a credit card, is worth a deeper look.
463490	465110	We try to establish intent.
465410	468590	There are two goals here. One is to determine what the actor is trying to do.
468590	472010	And the other is to determine what the actor is trying to do before they do it.
472030	477810	Now, the key piece here is that goal number two is something that we reserve for actors that we've actually seen before.
477810	480030	Actors that have tried to do something bad before.
480030	483630	This is how we avoid a situation of doing pre-crime.
483630	488350	We don't want to necessarily kick people off the platform before they've done bad.
488350	492950	But if we have indicators that they are a same returning actor that has already been declared persona non grata,
492950	495030	then maybe we want to know as early as possible.
495030	496490	Now, there is an exception to this.
496550	499630	There is software that we don't let people deploy to the platform.
499790	505710	But we're not talking about that in any great degree, although we'll mention it later in contrast to other things.
507930	511690	Now, making the decision and taking the action is kind of the crux of the matter.
512010	516510	We've collected a bunch of indicators that give us a good idea of what they're trying to do.
516510	522670	So we take the action. If the intent is bad, then the action is suspension, evidence collection, so on and so forth.
522670	526970	If it's not bad, watch lists, allow lists, or false positive checks.
527750	534190	And sometimes it's not easy to determine what the intent is, in which case we'll throw it back out of the stack.
534190	537870	We'll examine it again should it pop up again in a fresh alert.
539090	541810	We investigate for more indicators.
542470	546650	Now, really the question here is, have we found all the accounts that are associated with the badness?
546810	552950	And have we found all the indicators associated with all the accounts that point to the badness?
552950	557290	We cycle this a couple of different times to make certain that we've got as big a view as possible,
557290	562070	even retroactively, so we can pick up early starts, early campaigns, so on and so forth.
562070	567050	And this is all done to strengthen our ability to do automation.
570150	573970	Automation is... we're doing it because, obviously, we never want to see the same abuse again,
573970	577410	and this is how we reduce all the toil of all the things that we do.
577590	582930	The automation of the footprint includes the alerting and the actioning on a subset of indicators,
582930	585230	including what we call a partial match.
586990	589570	And then we do it all over again.
589810	591910	Now, some of that requires a little bit more.
592110	596370	But in a nutshell, if you're a visual learner, here's what the loop looks like.
597490	600370	Okay? Let's go next.
600810	605390	Within our tooling, we have... is where our codified indicators live.
605390	609830	So we take the indicators that we've identified, and it could be something as simple as a substring match
609830	612730	on a registration of an email address.
612730	616950	Or it could be something more complex, like a Levenstein distance to a particular word,
616950	618470	or any of these kinds of things.
618470	623350	And we codify them as, literally, as code into any of these tooling.
623350	628230	Now, the column on the left, we have an event collection agent, similar to a classic SEM.
628230	632630	We have database query tools that'll run automatically or manually when we need to check stuff.
632630	634270	And we have malware analysis tools.
634270	639610	So we'll do our queries within those tools so that we can actually get these indicators,
639610	641310	these codified indicators out.
642210	646110	Now, we also have, as everybody, we have a ticket system.
646110	649930	Now, the ticket system is not normally considered part of the tooling in a lot of cases.
649930	655750	We like to consider it part of the tooling because our ever-increasing goal to reduce Toro
655750	661550	means that we also have to automate ticketing where it makes sense or where it's possible as well.
661550	663150	And we have our suspension tools.
663230	667210	Suspend at various levels, but the really important thing there is that they're set up in such a way
667210	671550	that they have business rules and guardrails so that we don't accidentally suspend the entire world
671550	673070	if we make a mistake.
674190	676690	Now, we track two general types of activities.
676690	679670	We track campaigns and prohibited softwares, as we previously said.
679670	684370	Campaigns track actors, or sometimes they're victims, whatever makes more sense.
684370	689550	And it also tracks the custom software that they might write to be able to do the things that they're trying to do.
690230	694750	Whereas prohibited software is tracking malware, tracking C2, tracking known abusive software,
694750	699370	including the stuff that has a deploy to Heroku button sitting in GitHub.
700670	703410	Now, ultimately, we're looking to track actors.
703610	708010	There doesn't seem to be a great way to do this, and we're building up towards more of that.
708010	716010	But what we found is that actors really do end up being a collection of TTPs codified as a constellation of indicators,
716010	717730	and we call that a footprint.
717890	720850	Now, footprints can overlap, partially or fully.
721230	725990	And how we implement footprint detection is how we detect actor behavior changes,
725990	727890	and multiple actors doing the same thing.
727910	733190	Tracking footprints is kind of difficult, though, and we're looking to be improving the process as we go on this year
734330	736230	so we can speed up this whole loop.
736230	741510	But even today, with what we have, we can detect pivots.
741930	745710	A pivot is what we call a change to a TTP of a returning actor.
745710	747850	Now, different from a pen tester pivot.
748210	752110	If a footprint is a collection of indicators, then given enough of them,
752210	756550	a partial match usually indicates a change in behavior of the same actor.
757190	758390	Actors are people, too.
758430	763050	When an actor gets suspended, they do have this tendency to test how by isolating for variables
763050	767270	and making very small changes over time until they get it working again.
767570	773750	So from a threshold detection, like shown, works really well as an accurate way to detect their return
773750	775610	and still take some action.
776010	780170	Then updating the footprint with the new indicators, reflecting the change,
780170	782450	just keeps that footprint accurate.
782450	786790	And this is designed to make it difficult for a persistent actor to regain that foothold.
786890	790350	And it frustrates the heck out of them, and that's always a pleasure.
791110	793350	We also have what we call a splash.
793970	796930	When we block a particular actor under a footprint,
796930	801030	sometimes what we'll see is that we'll see a whole bunch of different footprints
801030	806510	or different partial footprint matches against that actor's footprint.
806510	809850	And we call this a splash. It's like slapping a mud puddle.
810070	813830	It's a whole bunch of different actors that are suddenly trying to get back onto the platform
813830	818650	that have actually all been hiding under the same TTP umbrella, the same footprint.
819150	821550	Sometimes they don't even know that they're doing it.
821550	825470	Now, they're trying to... often it turns out that they're sharing TTPs,
825470	827910	they're sharing techniques of doing things on the platform
827910	832170	through everything from YouTube videos to forums to whatever.
832830	835890	And sometimes when we find the source of those,
835890	840430	if they're doing really particular badness, you know, phishing attacks and stuff like that,
840430	843750	and watching them discuss how they're going to make changes,
843750	846310	if we can keep on top of those changes and add them to the footprint
846310	851250	before they're actually even deployed, then we can keep on top of them as well.
851250	853490	Shout out to our fantastic Threat Intel team.
853490	857530	They kind of help us find all that extra info if that is the need.
857930	861430	Now, when we have all that tooling in place,
861430	863350	when pivot detection is working and designed,
863350	867490	and when we manage to stop the actor, sometimes even before they've begun,
867490	869910	then they only have two choices.
869910	873530	They can either go somewhere else, or they can entirely retool.
874410	877110	Retooling requires them to change everything,
877110	880770	because we've got footprints for nearly everything that they're doing.
880770	882930	I don't want to say absolutely everything. We don't know.
882930	884590	But pretty damn close.
884990	888130	Now, this makes them indistinguishable from a new actor.
888130	891690	But honestly, we don't really care at that point.
891690	894930	If we end up being a show-up actor, so be it.
894930	896470	We'll track them as a new actor.
896470	899510	Sometimes they've actually retooled to the point where they decide to do something completely different
899510	901350	than what they've been doing before.
902890	904430	Now, we don't usually...
905390	908410	Because we're pretty thorough in our collection,
908410	912370	sometimes we still find evidence that a new actor is actually an old actor retooled,
912370	914970	and that's kind of fascinating for different reasons.
914970	919610	And when we find that evidence, we can still put it together and make great work of that.
919610	923010	And sometimes that little tenuous link, as you probably know,
923010	925350	is something that's really, really simple.
925350	927790	Something as simple as putting a couple of numbers,
927790	930790	the same 1, 2, 3, 4 numbers in there,
931690	934470	constantly using four dots in their email address.
934850	940290	Now, given that as our hunt loop, let's go back to Spencer for the show and tell.
942190	943790	All right. Thanks, Alan.
944190	946930	Let's look at a few campaigns that have touched our hearts.
946970	949530	And, well, we'd like to think we've touched theirs, too.
950230	954210	The first actor appeared on our radar by spinning up 100 apps per user account
954210	957690	across multiple accounts, all from free email providers.
957850	960010	So a user account is limited to running five apps
960010	963830	until they verify their account by adding a payment method, like the credit card.
963830	966090	After that, 100 apps is the new max.
966190	972110	So here we have new accounts immediately adding a credit card and going full tilt to 100 apps.
972570	975510	That's not normal. Normal users don't do this.
975510	979150	That activity stands out and gets on our radar fast.
979170	982890	And to top things off, fraudulent credit cards were used to verify each account.
982890	985110	And all of the apps were identical.
986210	991970	So we inspected one of the apps and saw that they were running a Tor hidden service accessible through SSH.
991990	995730	Here's a screenshot of the script that would run once their app was deployed.
997990	1002930	We suspended the accounts and very soon the actor was back and we had their attention.
1004650	1009010	Soon after, we saw their underlying intent, mining Monero.
1009010	1013990	The apps were mining with LibXMR and sending all traffic through Tor.
1014630	1018790	Now after seeing this, we believe that the initial wave of apps that were running Tor
1018790	1023590	were really part of some capabilities testing, so some real live bad actor DevOps.
1024770	1027750	We continued to suspend the accounts and the actor would pivot,
1027750	1031390	each time trying to minimize their footprint to avoid detection.
1031410	1035810	So the top image is from an app that packed the Tor and mining binaries in a zip file,
1035810	1039790	which would then be unzipped with a unique passphrase at the time of deployment.
1039910	1044870	The bottom image is from a later pivot, this time using GPG encrypted payloads
1044870	1047470	with unique names and unique passphrases.
1047470	1051670	So decrypt, unpack, and mine, sending everything through Tor.
1052070	1054190	Now this user was really fast.
1054370	1060270	They appeared to be retooling their apps and back online within just four hours of being suspended.
1061630	1066990	And this type of activity at this scale threatened the performance of some of the shared resources.
1066990	1070210	Other customers were impacted due to these noisy neighbor situations,
1070210	1071950	so we had to stay on top of this actor.
1071950	1077030	But they were automating their operation and getting faster, mostly during our off hours.
1077150	1082030	So playing never-ending whack-a-mole was unsustainable and really a path toward team burnout.
1082710	1088370	So we took a step back and we looked at all of the data provided from this actor's use of the platform.
1088370	1089610	Home field advantage, right?
1089610	1094490	This turned into a list of indicators which we could use to form a TTP footprint.
1094950	1098030	The actual footprint is very close to what's on this slide.
1098250	1101310	As you can imagine, to make the most from cryptocurrency mining,
1101310	1104750	the actor needs to spread out across as many accounts as possible.
1105210	1109710	So to make it worth their time, they try to automate any part of their operation, like account creation.
1110050	1114250	That kind of automation generates patterns that we can use for detection.
1114250	1118650	In this case, we look for groups of accounts that signed up from an IP address,
1118650	1123130	that happened to be a Tor exit node, from a particular free email provider,
1123130	1127490	and had an email address that matched a certain naming pattern.
1127570	1130210	If a new account matched those three indicators,
1130210	1133650	we already have high confidence that it's an account controlled by this actor.
1133970	1138790	Next, the accounts would quickly create five apps, all with a positive size,
1138790	1142890	and they would leave the names as the default Heroku haiku.
1142890	1146790	Then sampling some of the apps, we could confirm if they had a GPG blob,
1146790	1151330	and if they had the startup script, which decrypted and unpacked the payload.
1151510	1154270	Again, normal users don't do this.
1155090	1158870	So when we joined these indicators together, the false positive rate was zero.
1158870	1160610	Very high confidence, right?
1160770	1166990	So now matching these 10 indicators, low value by themselves, gave us a high value decision.
1166990	1170290	We can now identify this actor without having to pick everything apart,
1170290	1172830	every time, on every pivot.
1173030	1176370	Just focus on what's different, which saved us a bunch of time,
1176370	1177930	while wasting the actors.
1178270	1181050	They soon gave up, and appeared to have left the platform.
1182350	1184090	Let's look at another campaign.
1184330	1187150	This actor came to our attention through a phishing report.
1187210	1189200	We suspended their account, and very soon,
1189590	1192110	we saw that the same phish was reported again,
1192110	1194230	so we tracked them as a campaign.
1194230	1198090	They were targeting customers of a specific insurance provider.
1198410	1202250	When inspecting one of their apps, we see the following directory structure,
1202250	1206370	which contains message-sending capabilities in the mailer.py file.
1206630	1208850	Here, they would use third-party messaging add-ons
1208850	1213010	to either distribute their messages or handle their loot.
1213730	1216250	We suspended the accounts and hunted for more,
1216250	1219710	and found an entirely different app used for the same campaign.
1219830	1222230	This time, it was a JavaScript React app,
1222230	1224210	which had some added functionality.
1224310	1226770	Like, now they were going after credit card information,
1226770	1228550	as well as credentials.
1229430	1232250	This screenshot shows the collection of credit card number,
1232250	1235170	expiration date, and CVV in French.
1237630	1240810	Really quick, I want to share these screenshots from another pivot,
1240810	1243310	where the actor repurposed somebody else's kit.
1243310	1245030	You can probably Google for some of these keywords,
1245030	1247470	and still find it out there somewhere on the internet.
1248770	1251650	We developed a TTP footprint for this actor.
1251650	1253450	This time, it was more app-focused,
1253450	1256550	since they didn't need to spread out across multiple accounts
1256550	1258710	to profit like the crypto-miner did.
1258950	1261210	We also used these unique indicators to update rules
1261210	1262910	in our detection and response tooling,
1262910	1265450	just whenever possible, whenever it was appropriate.
1265710	1268010	But this actor was still very persistent.
1268370	1269910	We want to break their spirit.
1269910	1271650	We don't want to help them improve their coding skills
1271650	1273330	as we go back and forth.
1273330	1275690	Typically, being in proximity to the sensitive information
1275690	1279550	that they were gathering is like being in proximity to toxic waste.
1279550	1282430	Unless you're the bad actor, then it has value.
1282430	1285470	But it's only valuable if the information is valid.
1285750	1288470	So considering this, we did our best to get that information
1288470	1291490	into the appropriate hands, so that passwords, payment information
1291490	1293770	could all get reset and nullified.
1293970	1296790	Let's strip the value and really waste their time.
1297290	1299490	Also, we found ways to notify the other service providers
1299490	1301070	that were used in the campaign,
1301070	1303470	which put even more pressure on this actor.
1303910	1306210	These two things disrupted their operations enough
1306210	1308910	that it appears to have pushed them from the platform.
1309330	1312350	But some of the external indicators that we used to track them,
1312350	1314150	like what you can find on EARLScan,
1314150	1317410	suggest that they're still active, just not on our platform.
1319170	1321570	The third campaign is from a couple of years ago.
1321570	1324170	It started as a DMCA takedown request,
1324170	1327930	claiming that a Heroku app was distributing a copyrighted e-book.
1330450	1333090	When we checked out the link that was reported,
1333090	1334990	the PDF was not the full e-book,
1334990	1338450	but had the same title and same cover art as the real book.
1338670	1341730	But it also had a link to download the book on another site.
1342150	1343430	Nothing weird there, right?
1343670	1345750	This screenshot is not from what was reported,
1345750	1347690	but it was from one of the other apps that we found
1347690	1349790	while researching this campaign.
1351290	1352750	When we investigate an app,
1352750	1354470	we're looking for just enough information
1354470	1356850	to establish intent with high confidence,
1356850	1359470	while hunting for unique indicators and general functionality.
1359970	1361230	Now, with an app like this,
1361230	1363230	we don't have enough time to become subject matter experts
1363230	1364710	and pick everything apart.
1364710	1368850	So we typically start with something like the index.php file,
1368850	1371750	or look for some other unique files that really stand out,
1371750	1372890	directories.
1373010	1375130	So in this case, these were some of the files
1375130	1376930	and directories that stood out.
1376990	1380170	func.php, the document generator PHP files,
1380170	1381610	and the keyw directory.
1381610	1385150	Now, func is Indonesian for function, by the way.
1385150	1387450	It's going to be important in a few seconds.
1387990	1391110	Let's see what's in the keyw directory first.
1391810	1393610	Lots of text files.
1395870	1398090	Lots of text files.
1399490	1402530	Each filled with lots of book titles,
1402530	1404270	from New York Times bestsellers
1404270	1407030	to obscure auto-wiring diagrams.
1407090	1409670	Now, these screenshots are just from one of the files.
1409970	1413270	Overall, this app had over 300,000 titles.
1414190	1416250	To understand how these titles are being used,
1416250	1420290	we went back to the root and searched for the keyw string in the PHP files.
1420290	1422750	Now, in this screenshot, we see that they were creating
1422750	1426270	sitemap XML files for each book index file.
1426610	1427370	Huh.
1428370	1431570	And they would make sitemaps for each book title.
1432010	1434410	These sitemaps would be sent to search engines
1436050	1436570	for...
1437290	1438590	Black Hat SEO!
1439270	1441570	We saw other tactics like cloaking,
1441570	1443670	where search engines would return different results
1443670	1445090	than a normal visitor.
1445450	1447890	Some apps would perform multiple redirects.
1447890	1449070	And then they would do link manipulation
1449070	1451290	by taking these long book titles, slicing them up,
1451290	1452510	creating a whole bunch of different links,
1452510	1454770	and sending them back out to the search engines.
1455410	1456930	And I'm sure there's more, but, I mean,
1456930	1458490	this was more than enough to establish intent.
1458490	1460870	We don't want this kind of activity on our platform.
1461490	1464210	Now, we had to see how widespread it was.
1465210	1467270	Turned out, there were thousands of accounts
1467270	1468890	participating in this campaign.
1469470	1472750	Many were found just by looking at patterns from the sign-up data,
1472750	1476170	like source IP and user-agent string combinations,
1476610	1479150	as well as the use of email sub-inboxing patterns
1479150	1480850	to create multiple accounts.
1480850	1482330	So, you know, like how you can move the dot around
1482330	1483690	in a Gmail account?
1484210	1485210	It's been fixed.
1485450	1488130	The overall campaign included a variety of apps
1488130	1490190	that were ultimately doing the same thing.
1490550	1492450	Some were even sniping orphaned subdomains
1492450	1495030	of reputable customers in order to boost their rankings
1495030	1496150	with the search engines.
1496210	1497550	It's been fixed as well.
1497670	1500750	So, abusing our systems to abuse the search engine algorithms.
1500810	1502870	I mean, it's just abuse all the way down.
1503450	1506030	Now, here's a quick look at some of the other indicators.
1506030	1509530	Now, we mentioned hunting within the sign-up data.
1509530	1512410	These accounts were created within the typical working hours
1512410	1514530	of the Indonesian time zone,
1514530	1517270	and only on five days out of the week.
1517510	1519350	They weren't non-stop sign-ups, but you see these bursts
1519350	1521790	of accounts being created a few times a day
1521790	1523250	within those working days.
1523390	1526650	Other fun indicators were typos and Indonesian words.
1526990	1529370	One that had me scratching my head at first was
1529370	1534070	S-U-K-S-E-S, which translates to how it sounds.
1534070	1535230	Success.
1535630	1538150	So, we successfully booted them from the platform.
1539490	1541810	Now, I wish we could dive deeper and share more,
1541810	1543850	but we want to briefly mention some of the lessons
1543850	1546790	that we've learned while fighting abuse on a platform.
1546870	1550550	First, demotivating a bad actor can be very effective
1550550	1552150	and satisfying.
1552610	1554870	Know your environment and hunt for internal indicators,
1554870	1557350	no matter how little value they appear to have,
1557350	1559750	because collectively they can show intent,
1559750	1562970	build confidence, and help make a high-value decision.
1562970	1565830	Also, check if there are ways to include external indicators,
1565830	1567790	like OSINT or threat intelligence,
1567790	1569110	and enrich that data.
1569450	1572690	For us, not focusing on things like suspension count,
1572690	1575570	but rather focusing on patterns that the bad actors were using
1575570	1577310	to take advantage of our services.
1577310	1579390	Those patterns are worth reporting back to the business
1579390	1581430	so they can be addressed and fixed,
1581430	1584190	and ultimately create a platform that's less hospitable
1584190	1585410	for abuse.
1586750	1588290	Thanks again for attending our talk.
1588290	1589510	If you're interested in more of this,
1589510	1592270	but maybe for more of a philosophical or business approach,
1592270	1593710	check out our Black Hat Talk.
1593710	1594590	Thank you.
1595510	1596890	Thank you.
1596910	1599350	Any questions in text talks in Track 1?