1
00:00:00,935 --> 00:00:01,890
- So we have a really
interesting talk for you.

2
00:00:01,890 --> 00:00:04,631
We're gonna find out why
you aren't able to buy PS5

3
00:00:04,631 --> 00:00:07,522
or a graphics card or
any other in demand item.

4
00:00:07,522 --> 00:00:09,330
We have a first time speaker

5
00:00:09,330 --> 00:00:12,300
and first time at DEFCON
member up here, Arik Atar.

6
00:00:12,300 --> 00:00:14,483
Please give him a warm welcome.

7
00:00:14,483 --> 00:00:17,650
(audience applauding)

8
00:00:20,310 --> 00:00:21,543
- Thank you very much.

9
00:00:23,430 --> 00:00:26,580
So every time you buy anything online,

10
00:00:26,580 --> 00:00:28,541
especially if it's a limited stock item,

11
00:00:28,541 --> 00:00:33,420
you compete against bot and
most likely to lose miserably.

12
00:00:33,420 --> 00:00:34,950
You probably can relate with the statement

13
00:00:34,950 --> 00:00:37,020
if you'd ever try to get your hands

14
00:00:37,020 --> 00:00:39,810
on a Xbox or PS5 console,

15
00:00:39,810 --> 00:00:42,870
and couldn't quite understand
why the stock is always out,

16
00:00:42,870 --> 00:00:44,909
even three minutes after restock.

17
00:00:44,909 --> 00:00:47,729
Maybe when you scroll
down on your social feed,

18
00:00:47,729 --> 00:00:51,300
you've seen your favorite
artist concert tickets sold

19
00:00:51,300 --> 00:00:53,640
by four, five times of the original price

20
00:00:53,640 --> 00:00:54,791
and wondered how come.

21
00:00:54,791 --> 00:00:57,660
Maybe even on your way here to DEFCON,

22
00:00:57,660 --> 00:00:59,596
when you tried to book
yourself a flight ticket,

23
00:00:59,596 --> 00:01:02,069
you watched how the prices goes up,

24
00:01:02,069 --> 00:01:05,043
even for flight that were just published.

25
00:01:05,880 --> 00:01:08,193
Bot operators are to blame.

26
00:01:09,330 --> 00:01:11,520
Every bot can simulate thousands

27
00:01:11,520 --> 00:01:13,407
of human-like web interactions.

28
00:01:13,407 --> 00:01:17,580
They will buy anything you
want before you even Google it.

29
00:01:17,580 --> 00:01:19,050
They will schedule appointments

30
00:01:19,050 --> 00:01:22,200
with government services
that you will pay for later.

31
00:01:22,200 --> 00:01:25,470
They will win at every online
auction that you will attend

32
00:01:25,470 --> 00:01:27,270
and they will fake positive reviews

33
00:01:27,270 --> 00:01:30,712
that will (indistinct) by
your bullshit detectors

34
00:01:30,712 --> 00:01:32,012
into buying scam products.

35
00:01:32,850 --> 00:01:34,290
Even when you asleep,

36
00:01:34,290 --> 00:01:36,660
there's a really good chance
that the bot is trying

37
00:01:36,660 --> 00:01:41,280
to log his way into one
of your 200 plus accounts

38
00:01:41,280 --> 00:01:43,563
while to enumerate your password.

39
00:01:44,820 --> 00:01:49,183
Bots are responsible for
77% of the global hacking

40
00:01:49,183 --> 00:01:50,610
and fraud activities.

41
00:01:50,610 --> 00:01:52,470
That comes up to almost a quarter

42
00:01:52,470 --> 00:01:54,696
of the total internet traffic.

43
00:01:54,696 --> 00:01:56,495
Regardless if we like it or not,

44
00:01:56,495 --> 00:01:59,520
malicious automation is here to stay.

45
00:01:59,520 --> 00:02:03,060
It serves tens of thousands
of underground hackers

46
00:02:03,060 --> 00:02:06,813
and drive millions of
dollars worth of economies.

47
00:02:09,720 --> 00:02:11,730
In the next 40 minutes,

48
00:02:11,730 --> 00:02:13,650
I will give you a deep dive

49
00:02:13,650 --> 00:02:15,323
into the fascinating architecture

50
00:02:15,323 --> 00:02:19,800
and techniques that being
used by threat actors

51
00:02:19,800 --> 00:02:23,970
by bot operators when they
trying to crack their way

52
00:02:23,970 --> 00:02:26,640
into your password or log in

53
00:02:26,640 --> 00:02:30,273
and steal away your stock form your cart.

54
00:02:31,860 --> 00:02:33,544
So a little bit about myself.

55
00:02:33,544 --> 00:02:38,544
My dad served two decades
is the Israeli police force

56
00:02:39,450 --> 00:02:43,533
as the head of in fraud
investigation department.

57
00:02:44,368 --> 00:02:46,710
During this time, he got the chance

58
00:02:46,710 --> 00:02:50,370
to investigate the most
fascinating criminals

59
00:02:50,370 --> 00:02:52,440
that hack the financial system

60
00:02:52,440 --> 00:02:54,330
during what is considered now,

61
00:02:54,330 --> 00:02:57,930
then the era of financial fraud.

62
00:02:57,930 --> 00:03:00,990
Among all of those people,
were also the ex-husband

63
00:03:00,990 --> 00:03:02,760
of my mother,

64
00:03:02,760 --> 00:03:04,830
which 20 years later led me

65
00:03:04,830 --> 00:03:07,860
to the most awkward how
met mother conversation

66
00:03:07,860 --> 00:03:09,333
that you can ever imagine.

67
00:03:10,740 --> 00:03:13,500
And of course, growing
up with a detective dad

68
00:03:13,500 --> 00:03:15,592
wasn't always an easy task here.

69
00:03:15,592 --> 00:03:20,010
You can see really authentic
photo of me and my dad

70
00:03:20,010 --> 00:03:21,840
having a "where have you been last night",

71
00:03:21,840 --> 00:03:23,958
casual conversation on Saturday,

72
00:03:23,958 --> 00:03:26,202
but on the good part,

73
00:03:26,202 --> 00:03:29,100
I got a chance to hear a lot of stories,

74
00:03:29,100 --> 00:03:32,010
fascinating stories about criminals

75
00:03:32,010 --> 00:03:36,540
and those financial
fraudsters, their courage,

76
00:03:36,540 --> 00:03:41,540
and their creativity and their
ability to flex their mind

77
00:03:41,550 --> 00:03:42,874
and to hack into systems.

78
00:03:42,874 --> 00:03:46,740
That was the characteristics
that I found in myself.

79
00:03:46,740 --> 00:03:49,050
And this was what shaped my point of view

80
00:03:49,050 --> 00:03:51,450
as a cybersecurity researcher.

81
00:03:51,450 --> 00:03:53,640
That research from the hacker perspective

82
00:03:53,640 --> 00:03:56,163
and not from the defender perspective.

83
00:03:57,060 --> 00:03:59,190
And indeed in the last five years,

84
00:03:59,190 --> 00:04:00,420
I spent most of my time,

85
00:04:00,420 --> 00:04:04,470
under 64 different hacking
avatar different identities

86
00:04:04,470 --> 00:04:08,182
on a dark net, deep web
and open web sources,

87
00:04:08,182 --> 00:04:11,670
collecting intelligence for
the companies I work for.

88
00:04:11,670 --> 00:04:13,500
I started my way in Bright Data.

89
00:04:13,500 --> 00:04:15,720
Some of you will know
it as Luminati networks.

90
00:04:15,720 --> 00:04:16,553
Some of you,

91
00:04:16,553 --> 00:04:19,590
the older ones will know it as whole VPN.

92
00:04:19,590 --> 00:04:23,859
In Bright Data, I was in
charge of doing a investigation

93
00:04:23,859 --> 00:04:26,490
upon high profile clients

94
00:04:26,490 --> 00:04:30,150
that tried to misuse residential proxy IPs

95
00:04:30,150 --> 00:04:32,340
for a cyber activity

96
00:04:32,340 --> 00:04:33,390
for cyber attacks,

97
00:04:33,390 --> 00:04:36,510
did those frauds and
all this kind of stuff.

98
00:04:36,510 --> 00:04:39,120
I had to carry a lot
of investigation there,

99
00:04:39,120 --> 00:04:40,620
but the most interesting one

100
00:04:40,620 --> 00:04:43,080
was a three months investigation

101
00:04:43,080 --> 00:04:45,190
after a 21 year old from Latvia

102
00:04:46,411 --> 00:04:49,115
that basically simulated 30,000

103
00:04:49,115 --> 00:04:53,280
very popular gaming platform users,

104
00:04:53,280 --> 00:04:55,830
using 30,000 concurrent session.

105
00:04:55,830 --> 00:04:59,939
Every time he was collecting
through the bots users,

106
00:04:59,939 --> 00:05:04,939
the gaming coins, centralized
them in specific avatar,

107
00:05:05,010 --> 00:05:06,390
went to the gaming shop,

108
00:05:06,390 --> 00:05:10,367
bought some skin, and sold
every sold for $6,000.

109
00:05:11,935 --> 00:05:15,097
This kid made in three weeks,

110
00:05:15,097 --> 00:05:17,313
$1.6 million,

111
00:05:19,140 --> 00:05:21,570
just from selling sold skins

112
00:05:21,570 --> 00:05:23,529
of a popular gaming platform.

113
00:05:23,529 --> 00:05:27,870
In 2020, I moved to the
defender side to Perimeter X,

114
00:05:27,870 --> 00:05:32,343
which two weeks ago, max
merged with human security.

115
00:05:33,720 --> 00:05:37,110
There, I basically mapped
the threat landscape

116
00:05:37,110 --> 00:05:40,350
of any threat actor that is trying

117
00:05:40,350 --> 00:05:43,320
to hurt our appliance

118
00:05:43,320 --> 00:05:45,150
and basically did a lot

119
00:05:45,150 --> 00:05:47,580
of proactive threat intelligence activity

120
00:05:47,580 --> 00:05:49,050
like credential honey pots

121
00:05:49,050 --> 00:05:52,410
that were reposted by other crackers,

122
00:05:52,410 --> 00:05:54,413
that didn't know it's honey pot,

123
00:05:54,413 --> 00:05:57,390
all hunting down malwares
and info stealers

124
00:05:57,390 --> 00:05:59,670
that ran in the wild at
least a year and a half

125
00:05:59,670 --> 00:06:02,253
before discovered by antiviruses.

126
00:06:03,720 --> 00:06:06,240
So a lot of this experience,

127
00:06:06,240 --> 00:06:10,170
I'm going to take the most
meaningful insight there

128
00:06:10,170 --> 00:06:11,700
and share it to you.

129
00:06:11,700 --> 00:06:12,780
Our agenda for today.

130
00:06:12,780 --> 00:06:14,010
First, I'm going to define

131
00:06:14,010 --> 00:06:16,110
what is exactly top performing

132
00:06:16,110 --> 00:06:18,750
'cause it's really arbitrary titled there.

133
00:06:18,750 --> 00:06:22,080
Afterwards, we're going in
the first part of the talk,

134
00:06:22,080 --> 00:06:24,600
talk about account crackers,

135
00:06:24,600 --> 00:06:28,080
specifically those who are
trying to steal your accounts,

136
00:06:28,080 --> 00:06:29,580
if you ever lost an account to a hacker,

137
00:06:29,580 --> 00:06:31,620
you'll find it very interesting.

138
00:06:31,620 --> 00:06:34,590
The second part will be
dedicated to retail scalping,

139
00:06:34,590 --> 00:06:37,620
which means using bots to hack the stock

140
00:06:37,620 --> 00:06:39,690
of specific retail product,

141
00:06:39,690 --> 00:06:42,690
to buy all the stock and to sell it to you

142
00:06:42,690 --> 00:06:45,599
at three times of its original price.

143
00:06:45,599 --> 00:06:50,599
Lastly, we'll have a summary
of all the TTPs we went through

144
00:06:51,480 --> 00:06:54,490
and we'll talk about the
future of malicious automations

145
00:06:56,071 --> 00:06:56,904
And after the talk will be over,

146
00:06:56,904 --> 00:07:00,000
I'm gonna have of course a Q
and A personal session here.

147
00:07:00,000 --> 00:07:02,917
So I promise not to answer like a bot.

148
00:07:02,917 --> 00:07:04,620
So like I said,

149
00:07:04,620 --> 00:07:06,420
we're going to focus on two use cases

150
00:07:06,420 --> 00:07:09,840
since the whole malicious
automation world is enormous.

151
00:07:09,840 --> 00:07:13,080
First is going to be counter
using credential Brute-force.

152
00:07:13,080 --> 00:07:15,570
And the second one is retail
scaling using automation

153
00:07:15,570 --> 00:07:16,927
to buy retail stock.

154
00:07:16,927 --> 00:07:21,480
I've defined top
performing as those hackers

155
00:07:21,480 --> 00:07:24,180
who maintain a sustainable business model,

156
00:07:24,180 --> 00:07:27,090
meaning we are not aiming
into hit and runners here.

157
00:07:27,090 --> 00:07:29,280
We're talking about those
who are making a living

158
00:07:29,280 --> 00:07:30,990
out of their operation.

159
00:07:30,990 --> 00:07:33,128
They should be at least six
month of online presence

160
00:07:33,128 --> 00:07:38,100
to these hackers and they
should belong to the top 20%.

161
00:07:38,100 --> 00:07:39,630
And I'm going to clarify this one

162
00:07:39,630 --> 00:07:41,541
because the hacking distribution...

163
00:07:41,541 --> 00:07:44,700
the hacking skill distribution,

164
00:07:44,700 --> 00:07:46,078
among application hackers,

165
00:07:46,078 --> 00:07:50,220
pretty much applied to the 20/80 law,

166
00:07:50,220 --> 00:07:54,120
which means that while 80%
of the hackers out there,

167
00:07:54,120 --> 00:07:57,210
making only 20% of the successful logins,

168
00:07:57,210 --> 00:08:00,690
the rest 20% are making actually 80%

169
00:08:00,690 --> 00:08:03,030
of the successful logins or checkouts.

170
00:08:03,030 --> 00:08:06,900
So I'm going to focus on
that specifically 20%,

171
00:08:06,900 --> 00:08:08,820
which means I'm not going
to specifically talk

172
00:08:08,820 --> 00:08:11,580
about the most common tools on techniques,

173
00:08:11,580 --> 00:08:13,050
but those who are rare,

174
00:08:13,050 --> 00:08:14,763
but serve the top performers.

175
00:08:16,918 --> 00:08:18,036
So let's jump in.

176
00:08:18,036 --> 00:08:20,253
First we'll do the Brute-force.

177
00:08:25,260 --> 00:08:29,070
So there are many
Brute-force tool out there.

178
00:08:29,070 --> 00:08:32,130
There are all purpose
is practically the same,

179
00:08:32,130 --> 00:08:34,440
is to camouflage all
the concurrent sessions

180
00:08:34,440 --> 00:08:35,640
into real login.

181
00:08:35,640 --> 00:08:38,850
And they all do it by
performed as a one stop shop

182
00:08:38,850 --> 00:08:40,380
for the cracker architecture,

183
00:08:40,380 --> 00:08:41,850
which means that all the components

184
00:08:41,850 --> 00:08:43,190
of the architectures
I'm going to talk about

185
00:08:43,190 --> 00:08:44,400
in the next slide,

186
00:08:44,400 --> 00:08:46,740
come all together in this
dashboard that you can see

187
00:08:46,740 --> 00:08:48,139
of Open Bullet.

188
00:08:48,139 --> 00:08:52,080
While there are many tools out there.

189
00:08:52,080 --> 00:08:53,010
One of them,

190
00:08:53,010 --> 00:08:57,420
their popularity has
went exponentially high

191
00:08:57,420 --> 00:08:58,800
in the last three years.

192
00:08:58,800 --> 00:09:00,360
His name is Open Bullet.

193
00:09:00,360 --> 00:09:03,210
It's an open source tool

194
00:09:03,210 --> 00:09:06,870
that like other many cracking tools,

195
00:09:06,870 --> 00:09:08,760
developed from web testing

196
00:09:08,760 --> 00:09:11,400
that went into Open Bullet.

197
00:09:11,400 --> 00:09:14,370
And from there to Black
Bullet and Cyber Bullet.

198
00:09:14,370 --> 00:09:17,070
Now all of the three, works
under the same principles,

199
00:09:17,070 --> 00:09:20,700
but they have different
integration capabilities

200
00:09:20,700 --> 00:09:21,963
with other hacking tools.

201
00:09:22,830 --> 00:09:24,780
And practically, this will be the oven

202
00:09:24,780 --> 00:09:27,058
that will cook the whole...

203
00:09:27,058 --> 00:09:30,741
that will bake this whole
cake that the hacker is doing.

204
00:09:30,741 --> 00:09:31,817
Now that they have the oven.

205
00:09:31,817 --> 00:09:34,200
I need a recipe of the attack

206
00:09:34,200 --> 00:09:35,570
and that will be the configured self.

207
00:09:35,570 --> 00:09:37,953
It will be the script
that runs or everything.

208
00:09:38,844 --> 00:09:43,844
Every config can be roughly
divided to three main parts.

209
00:09:44,790 --> 00:09:48,540
The first part that you can
see on the right upper right,

210
00:09:48,540 --> 00:09:53,010
is the part that the defines
the path of the attack itself.

211
00:09:53,010 --> 00:09:55,410
It will include all the headers
and the static variables

212
00:09:55,410 --> 00:09:58,980
that will repeat with every
user that will use this attack,

213
00:09:58,980 --> 00:09:59,883
specifically.

214
00:10:00,930 --> 00:10:03,666
The second one will be the authentication,

215
00:10:03,666 --> 00:10:04,890
the login itself to the account.

216
00:10:04,890 --> 00:10:05,910
This is where you can find

217
00:10:05,910 --> 00:10:07,710
the payload manipulation techniques,

218
00:10:07,710 --> 00:10:09,737
the cookie replay attack methods,

219
00:10:09,737 --> 00:10:12,510
legit services, spoofing,

220
00:10:12,510 --> 00:10:16,770
or API spoofing, in which
hacker finds out a API

221
00:10:16,770 --> 00:10:19,860
that's supposed to communicate
with legit third party.

222
00:10:19,860 --> 00:10:22,680
And he writes on it to make a logins

223
00:10:22,680 --> 00:10:25,923
because this path is not
regulated by the sat target site.

224
00:10:27,210 --> 00:10:30,780
The last path of the part
of every attack config

225
00:10:30,780 --> 00:10:32,850
will be the capture.

226
00:10:32,850 --> 00:10:35,370
And this is what you can see
right there in the middle.

227
00:10:35,370 --> 00:10:40,350
After the login is made,
as part of the same attack,

228
00:10:40,350 --> 00:10:41,790
it will go to your account

229
00:10:41,790 --> 00:10:45,090
and will try to figure out
what essence do you have.

230
00:10:45,090 --> 00:10:46,740
Here you can see a checklist

231
00:10:46,740 --> 00:10:49,440
of very popular streaming services.

232
00:10:49,440 --> 00:10:54,440
So we check what kind of
programs the hacked account has

233
00:10:55,170 --> 00:10:57,990
on his subscription.

234
00:10:57,990 --> 00:11:00,570
And this is how the hacker knows, later,

235
00:11:00,570 --> 00:11:02,580
how to price this stolen account

236
00:11:02,580 --> 00:11:04,800
because stolen account
that has credit card,

237
00:11:04,800 --> 00:11:06,790
worth much more than the one that don't

238
00:11:08,648 --> 00:11:11,460
and right in bottom,

239
00:11:11,460 --> 00:11:15,162
you can see an ad of config developer

240
00:11:15,162 --> 00:11:18,120
that published it in an underground forum.

241
00:11:18,120 --> 00:11:19,580
You can see it stands.

242
00:11:19,580 --> 00:11:20,413
It talks about CPM.

243
00:11:20,413 --> 00:11:24,480
CPM stands for credential per
minute or combo per minute,

244
00:11:24,480 --> 00:11:26,790
which means this is the
highest amount of credential

245
00:11:26,790 --> 00:11:31,790
that you can try repair
specific path, specific config.

246
00:11:33,786 --> 00:11:34,619
And it tells you,

247
00:11:34,619 --> 00:11:35,910
it depends on your proxy services

248
00:11:35,910 --> 00:11:37,350
and your recapture services.

249
00:11:37,350 --> 00:11:38,980
So it depends,

250
00:11:38,980 --> 00:11:40,140
like the number you can attempt depends

251
00:11:40,140 --> 00:11:42,330
on other architecture components

252
00:11:42,330 --> 00:11:44,730
that we'll talk about in the next slide.

253
00:11:44,730 --> 00:11:46,860
Also, it's mentioning
that it has a capture

254
00:11:46,860 --> 00:11:48,600
of credit card and gift card.

255
00:11:48,600 --> 00:11:51,180
This is the CC and GC
you see at the bottom.

256
00:11:51,180 --> 00:11:54,925
It means that this specific
script can tell you exactly

257
00:11:54,925 --> 00:11:59,925
what is the essence inside the account,

258
00:12:01,170 --> 00:12:04,350
but you as a hacker need
to go and figure it out

259
00:12:04,350 --> 00:12:05,760
and log in yourself.

260
00:12:05,760 --> 00:12:07,950
Of course, it's limiting to five copies

261
00:12:07,950 --> 00:12:10,628
and it's doing the (indistinct) pricing

262
00:12:10,628 --> 00:12:12,150
in order for that not
to be spread too much

263
00:12:12,150 --> 00:12:14,350
and not being patched
by security companies.

264
00:12:15,780 --> 00:12:18,931
So now we have the tool,
we have the receipt,

265
00:12:18,931 --> 00:12:21,420
but we don't have any cake.

266
00:12:21,420 --> 00:12:24,450
And the cake starts with
the credentials to themself.

267
00:12:24,450 --> 00:12:26,910
It's common to believe in
the cybersecurity community.

268
00:12:26,910 --> 00:12:28,950
That credential are easy to get,

269
00:12:28,950 --> 00:12:32,340
but need to go through some
steps in order to get them,

270
00:12:32,340 --> 00:12:35,444
like paying a little bit
or going to the dark net,

271
00:12:35,444 --> 00:12:37,110
while the truth, the awful truth is,

272
00:12:37,110 --> 00:12:38,820
they are really out there.

273
00:12:38,820 --> 00:12:41,070
The screenshot that you
are seeing right now,

274
00:12:41,070 --> 00:12:43,430
is from a marketplace that
you can find on Google

275
00:12:43,430 --> 00:12:45,578
and everyone can sign up and have access

276
00:12:45,578 --> 00:12:47,520
to all of these credentials.

277
00:12:47,520 --> 00:12:50,193
This is almost 11 billion credentials.

278
00:12:50,193 --> 00:12:52,371
If you ever found your email,

279
00:12:52,371 --> 00:12:55,890
all the email address
and have it been pawned,

280
00:12:55,890 --> 00:12:57,420
it's practically gonna be here.

281
00:12:57,420 --> 00:12:59,820
This is a compilation
of all the data breach

282
00:12:59,820 --> 00:13:01,680
from the last 10 years.

283
00:13:01,680 --> 00:13:04,980
11 billion credentials for
the use of many hackers

284
00:13:04,980 --> 00:13:08,130
that are keep recycling
those credential again

285
00:13:08,130 --> 00:13:09,300
and again and again.

286
00:13:09,300 --> 00:13:13,394
So hacker knows that, of course,
this is their playground,

287
00:13:13,394 --> 00:13:16,426
and they keep collecting
those combos all the time,

288
00:13:16,426 --> 00:13:19,320
running them from VPS virtual service,

289
00:13:19,320 --> 00:13:21,495
that has much more capability when...

290
00:13:21,495 --> 00:13:25,560
And of course establishing my SQL server

291
00:13:25,560 --> 00:13:28,620
in which they can use for
creating reach data sets

292
00:13:28,620 --> 00:13:31,410
that will later be used
for cracking your password.

293
00:13:31,410 --> 00:13:33,159
Now we'll touch it later.

294
00:13:33,159 --> 00:13:34,200
Of course,

295
00:13:34,200 --> 00:13:35,940
this database can be shared

296
00:13:35,940 --> 00:13:39,240
among several specific hacking groups,

297
00:13:39,240 --> 00:13:41,820
or it can be privately used.

298
00:13:41,820 --> 00:13:45,990
But the biggest (indistinct)
is that most of the people

299
00:13:45,990 --> 00:13:49,140
in this crowd also are
reusing the same password

300
00:13:49,140 --> 00:13:50,700
across different services.

301
00:13:50,700 --> 00:13:52,080
And hackers knows that.

302
00:13:52,080 --> 00:13:55,050
So they're creating the
tables that create your email,

303
00:13:55,050 --> 00:13:58,890
your password, and all
of your last passwords.

304
00:13:58,890 --> 00:14:02,223
So we can be used later on
when they try to Brute-force.

305
00:14:04,650 --> 00:14:07,260
So it's really nice that
I have a lot of credential

306
00:14:07,260 --> 00:14:08,790
and 11 billion is really nice,

307
00:14:08,790 --> 00:14:12,210
but I cant do attack with 11
billion key credentials because

308
00:14:12,210 --> 00:14:14,033
I will go bankrupt as a hacker.

309
00:14:14,033 --> 00:14:19,033
So the next step it's not
necessarily in which it's a step

310
00:14:19,130 --> 00:14:22,861
in which we will go
and do mail validation.

311
00:14:22,861 --> 00:14:24,720
Mail validation, practically,

312
00:14:24,720 --> 00:14:27,570
it's a process in which they
go and clean non-relevant users

313
00:14:27,570 --> 00:14:29,443
that are not signed up to the target site

314
00:14:29,443 --> 00:14:32,760
because there's no
logic targeting accounts

315
00:14:32,760 --> 00:14:34,165
that don't really exist

316
00:14:34,165 --> 00:14:37,759
and they do it mainly
with using two techniques.

317
00:14:37,759 --> 00:14:39,600
The first one will try

318
00:14:39,600 --> 00:14:42,907
to figure out using the website itself.

319
00:14:42,907 --> 00:14:45,150
It will be an Open Bullet config

320
00:14:45,150 --> 00:14:48,927
that will be marked as
VM, Valid Mail config.

321
00:14:48,927 --> 00:14:51,960
And you can find many of
those online for free,

322
00:14:51,960 --> 00:14:53,640
and they will go to the target site

323
00:14:53,640 --> 00:14:56,730
and they will do forgot
password with the victim email,

324
00:14:56,730 --> 00:14:58,380
and they will check the response.

325
00:14:58,380 --> 00:14:59,610
If the response...

326
00:14:59,610 --> 00:15:02,310
this email does not match to our records,

327
00:15:02,310 --> 00:15:05,190
then I should not attack it as a hacker.

328
00:15:05,190 --> 00:15:07,020
So I will put it on the panel list

329
00:15:07,020 --> 00:15:10,527
and I will filter out more my target list.

330
00:15:10,527 --> 00:15:13,890
But if I get, "Hey, we
sent you a recent link

331
00:15:13,890 --> 00:15:15,115
to this email."

332
00:15:15,115 --> 00:15:17,263
That means that this practical...

333
00:15:17,263 --> 00:15:20,850
This user is signed up

334
00:15:20,850 --> 00:15:23,130
and this is why it will be later

335
00:15:23,130 --> 00:15:27,090
on the targeted as a Brute-force attack.

336
00:15:27,090 --> 00:15:31,230
The other path that
can go is most stealth,

337
00:15:31,230 --> 00:15:34,766
and it will use an exploited
unregulated API path

338
00:15:34,766 --> 00:15:39,766
that will practically, they
will check using this API path.

339
00:15:39,780 --> 00:15:42,810
If the email is signed up or not depend

340
00:15:42,810 --> 00:15:44,070
on the request that they will get,

341
00:15:44,070 --> 00:15:46,110
if it's 400 or 3, ban.

342
00:15:46,110 --> 00:15:50,094
But if it's something else,
leave it in the site itself.

343
00:15:50,094 --> 00:15:52,650
Now we have everything that we need to do,

344
00:15:52,650 --> 00:15:55,770
but we don't want to guess
all the possible combination.

345
00:15:55,770 --> 00:15:57,350
We want to be precise as hackers.

346
00:15:57,350 --> 00:16:00,750
And we want to aim directly
to the point, like a sniper,

347
00:16:00,750 --> 00:16:02,700
not just shooting like
Arnold Schwarzenegger

348
00:16:02,700 --> 00:16:04,136
in one of his movies.

349
00:16:04,136 --> 00:16:07,230
And this is the precondition

350
00:16:07,230 --> 00:16:09,393
before doing the enumeration itself.

351
00:16:11,700 --> 00:16:13,257
There are two predictabilities

352
00:16:13,257 --> 00:16:16,050
that make our password really predictable

353
00:16:16,050 --> 00:16:17,790
into hacker's eyes.

354
00:16:17,790 --> 00:16:18,687
First...

355
00:16:18,687 --> 00:16:22,167
The first type will be involved
with the pattern itself.

356
00:16:22,167 --> 00:16:25,110
Every target site has a password policy.

357
00:16:25,110 --> 00:16:26,427
Like you can see right here,

358
00:16:26,427 --> 00:16:29,463
but most of the people when
they sign up to account,

359
00:16:29,463 --> 00:16:31,720
the last thing that they want to do is

360
00:16:31,720 --> 00:16:33,870
to think creative about new password

361
00:16:33,870 --> 00:16:35,550
that they will have to remember.

362
00:16:35,550 --> 00:16:36,960
Most of the people will just go

363
00:16:36,960 --> 00:16:38,410
by the simplest (indistinct),

364
00:16:39,690 --> 00:16:41,610
which means that our hacker doesn't need

365
00:16:41,610 --> 00:16:43,080
to try all the combination.

366
00:16:43,080 --> 00:16:45,662
You can just go for the most common one.

367
00:16:45,662 --> 00:16:49,737
Let's just say I'm supposed
to do 8 to 100 characters,

368
00:16:49,737 --> 00:16:52,170
most of the people will use 8 to 10.

369
00:16:52,170 --> 00:16:54,754
So therefore I have no reason
to enumerate more than that.

370
00:16:54,754 --> 00:16:58,380
Uppercase and lowercase will
usually be uppercase prefix,

371
00:16:58,380 --> 00:17:00,900
which is a built in feature

372
00:17:00,900 --> 00:17:04,557
in every Brute-force tool out there.

373
00:17:04,557 --> 00:17:07,989
And also when you need to use a number,

374
00:17:07,989 --> 00:17:11,730
most of the people will
use 1, 5, or 7 suffix

375
00:17:11,730 --> 00:17:13,170
in the password.

376
00:17:13,170 --> 00:17:15,060
Also, there are the creative people

377
00:17:15,060 --> 00:17:17,805
that use the key strokes
that are next to each other

378
00:17:17,805 --> 00:17:19,860
and creating different shapes.

379
00:17:19,860 --> 00:17:22,311
And this is what helps them remember that.

380
00:17:22,311 --> 00:17:23,430
But just so you know,

381
00:17:23,430 --> 00:17:26,970
it's a feature that exists
in a lot of tools out there.

382
00:17:26,970 --> 00:17:28,830
So when they are doing the enumeration,

383
00:17:28,830 --> 00:17:32,343
they will first try the keys
that next to each other.

384
00:17:33,360 --> 00:17:36,660
The next part that we
have of predictability

385
00:17:36,660 --> 00:17:39,040
is involve around the content itself.

386
00:17:39,040 --> 00:17:43,800
These stats comes from the
last year Google's research

387
00:17:43,800 --> 00:17:47,189
about passwords and it involves 50%...

388
00:17:47,189 --> 00:17:52,110
Practically says that 50%
of US adults are reusing...

389
00:17:52,110 --> 00:17:54,840
At least are using the same password

390
00:17:54,840 --> 00:17:57,485
in at least 12 different services.

391
00:17:57,485 --> 00:18:00,840
33% will use their pet's name.

392
00:18:00,840 --> 00:18:05,553
And this is where it all
comes to a big one workflow.

393
00:18:06,930 --> 00:18:10,350
First, the hacker will
go back to the table

394
00:18:10,350 --> 00:18:12,967
that I've talked about in the last slides,

395
00:18:12,967 --> 00:18:16,140
where they have the username
and they have the password

396
00:18:16,140 --> 00:18:21,140
and they will enrich those data
sets with the victim's PII.

397
00:18:22,380 --> 00:18:25,710
It's really easy to do that
using open source repositories

398
00:18:25,710 --> 00:18:29,670
out there that just looking up accounts

399
00:18:29,670 --> 00:18:31,980
that are related to the specific email,

400
00:18:31,980 --> 00:18:35,640
social media accounts, and
extract from specific places,

401
00:18:35,640 --> 00:18:38,430
these data points like
education institutions,

402
00:18:38,430 --> 00:18:39,780
spouse names, birthdays,

403
00:18:39,780 --> 00:18:42,581
everything are totally
available out there.

404
00:18:42,581 --> 00:18:45,450
As you can see, they're
using a password generator

405
00:18:45,450 --> 00:18:46,980
that has these capabilities,

406
00:18:46,980 --> 00:18:49,200
like you can see they're used password

407
00:18:49,200 --> 00:18:50,820
or birth date or postcode.

408
00:18:50,820 --> 00:18:54,360
All those will be used for
doing smart enumeration,

409
00:18:54,360 --> 00:18:56,941
not just one that goes off run randomly.

410
00:18:56,941 --> 00:19:00,025
And the enumeration at
the end will be depend

411
00:19:00,025 --> 00:19:01,772
on three things.

412
00:19:01,772 --> 00:19:06,630
The victim PII like its pet's
name, wife name, birthday,

413
00:19:06,630 --> 00:19:07,630
and stuff like that.

414
00:19:08,750 --> 00:19:09,758
Bridge passwords,

415
00:19:09,758 --> 00:19:11,250
all the passwords they could ever found

416
00:19:11,250 --> 00:19:13,200
in the past that being breached

417
00:19:13,200 --> 00:19:15,840
and outside in the underground forums

418
00:19:15,840 --> 00:19:18,150
and the password policy predictabilities

419
00:19:18,150 --> 00:19:19,770
that we talked about,

420
00:19:19,770 --> 00:19:21,720
and this is how they can turn one email

421
00:19:21,720 --> 00:19:24,540
into large combination of passwords.

422
00:19:24,540 --> 00:19:28,088
That has really good chance
of hitting the target.

423
00:19:28,088 --> 00:19:31,110
Now that I have everything,

424
00:19:31,110 --> 00:19:35,190
if I try to log in from
specific IP address,

425
00:19:35,190 --> 00:19:39,660
I can manage to do a top
like maximum three logins

426
00:19:39,660 --> 00:19:40,980
before I get blocked.

427
00:19:40,980 --> 00:19:44,280
So in order to bypass this IP rate limit,

428
00:19:44,280 --> 00:19:47,360
hackers are used to using
many IPS, many proxies.

429
00:19:47,360 --> 00:19:49,800
Those are connected with the service,

430
00:19:49,800 --> 00:19:51,637
it's called proxy network.

431
00:19:51,637 --> 00:19:54,390
And this service is actually managing

432
00:19:54,390 --> 00:19:56,587
the whole proxy operation for them.

433
00:19:56,587 --> 00:20:01,020
I dearly recommend you to
learn about proxy networks

434
00:20:01,020 --> 00:20:02,311
and their capabilities.

435
00:20:02,311 --> 00:20:06,930
It's really the one most
common attack factor

436
00:20:06,930 --> 00:20:09,210
of all cyber attacks out there.

437
00:20:09,210 --> 00:20:11,002
Specifically malicious automation,

438
00:20:11,002 --> 00:20:15,150
and also it serve them as
its hide their true IP,

439
00:20:15,150 --> 00:20:16,110
which is really important

440
00:20:16,110 --> 00:20:19,680
since cracking into
accounts is a criminal act

441
00:20:19,680 --> 00:20:22,473
in most US states,

442
00:20:23,760 --> 00:20:28,590
of course, using a network
allows the whole outsource

443
00:20:28,590 --> 00:20:30,450
of the proximal operation,

444
00:20:30,450 --> 00:20:33,480
which means the doesn't
need to go with proxy list

445
00:20:33,480 --> 00:20:35,850
and then check, which one
of the IPS got banned,

446
00:20:35,850 --> 00:20:38,730
which one is really not working well.

447
00:20:38,730 --> 00:20:40,020
And then replace it.

448
00:20:40,020 --> 00:20:42,980
He saves this time while
connecting through API

449
00:20:42,980 --> 00:20:45,840
of specific server to proxy network

450
00:20:45,840 --> 00:20:49,560
that does everything even
rotate the request itself

451
00:20:51,300 --> 00:20:54,033
when capture pops up.

452
00:20:55,260 --> 00:20:57,540
So here we can see
everything comes up together

453
00:20:57,540 --> 00:21:00,519
through the same kind of cycle.

454
00:21:00,519 --> 00:21:03,780
It goes from the left bottom.

455
00:21:03,780 --> 00:21:05,610
We can see the attacker Dell,

456
00:21:05,610 --> 00:21:07,860
he will use the mail validation,

457
00:21:07,860 --> 00:21:08,693
we talked about

458
00:21:08,693 --> 00:21:09,540
through the username.

459
00:21:09,540 --> 00:21:12,270
The password will go
through Wordlist generation

460
00:21:12,270 --> 00:21:15,990
that will set a specific type of password

461
00:21:15,990 --> 00:21:17,850
that will be customized

462
00:21:17,850 --> 00:21:19,530
to the specific user.

463
00:21:19,530 --> 00:21:22,020
From then the request will be connected

464
00:21:22,020 --> 00:21:23,010
through the super proxy,

465
00:21:23,010 --> 00:21:25,860
which is the entry point
of the crop proxy network.

466
00:21:25,860 --> 00:21:27,758
The super proxy server will use different

467
00:21:27,758 --> 00:21:31,173
and thousands of load balances
to spread those accounts.

468
00:21:31,173 --> 00:21:34,260
Those request among different devices,

469
00:21:34,260 --> 00:21:35,692
real devices of real people,

470
00:21:35,692 --> 00:21:38,460
which will make the
target side really hard

471
00:21:38,460 --> 00:21:40,429
to block those requests afterwards.

472
00:21:40,429 --> 00:21:43,530
And with the successful logins

473
00:21:43,530 --> 00:21:46,410
that he manage to do using the capture,

474
00:21:46,410 --> 00:21:48,000
he knows what their essence,

475
00:21:48,000 --> 00:21:51,518
and then he gives back
to these prospects 10%.

476
00:21:51,518 --> 00:21:56,160
Prospects means the
people that following him,

477
00:21:56,160 --> 00:21:57,120
following his activity,

478
00:21:57,120 --> 00:21:59,108
but didn't bought anything yet.

479
00:21:59,108 --> 00:22:01,410
In front of him, he has the challenge

480
00:22:01,410 --> 00:22:03,390
of gaining their credibility.

481
00:22:03,390 --> 00:22:05,250
So this is why he's acting just like

482
00:22:05,250 --> 00:22:06,930
a premium business model.

483
00:22:06,930 --> 00:22:09,783
He gives them 10% of the
valid access account,

484
00:22:09,783 --> 00:22:14,670
the ones that he manage to break
into, he gives it for free,

485
00:22:14,670 --> 00:22:16,770
and this is how it create
more and more people

486
00:22:16,770 --> 00:22:19,170
and more and more
attention on the dark net.

487
00:22:19,170 --> 00:22:23,721
90% will go over different
digital marketplaces,

488
00:22:23,721 --> 00:22:27,000
like selling stock, (indistinct) shop

489
00:22:27,000 --> 00:22:28,420
and this kind of services

490
00:22:29,264 --> 00:22:30,900
that are practically
marketplaces that are legit,

491
00:22:30,900 --> 00:22:33,663
but are being misused
by hackers all the time.

492
00:22:35,054 --> 00:22:36,059
And the last phase

493
00:22:36,059 --> 00:22:40,050
with all of the account they
didn't manage to break into

494
00:22:40,050 --> 00:22:42,090
because they didn't
guess the right password.

495
00:22:42,090 --> 00:22:43,350
He will do combo recycling.

496
00:22:43,350 --> 00:22:46,230
He will release it again
in some kind of forum,

497
00:22:46,230 --> 00:22:48,330
harvesting all the credits, all the likes,

498
00:22:48,330 --> 00:22:50,490
which will (indistinct) later in money

499
00:22:50,490 --> 00:22:52,740
in the same marketplace of the same forum.

500
00:22:52,740 --> 00:22:55,200
So it's actually beneficial for him.

501
00:22:55,200 --> 00:22:56,040
And from this point,

502
00:22:56,040 --> 00:22:58,380
it will be picked up by other cracker

503
00:22:58,380 --> 00:23:01,143
that will go from the
same phase all over again.

504
00:23:03,480 --> 00:23:06,540
And this is why I call
a sustainable cracking.

505
00:23:06,540 --> 00:23:09,120
Here we did a actual (indistinct).

506
00:23:09,120 --> 00:23:10,800
We did a honey pot

507
00:23:10,800 --> 00:23:13,846
that actually demonstrated
the capabilities

508
00:23:13,846 --> 00:23:16,830
of hacker on the underground forums.

509
00:23:16,830 --> 00:23:19,170
We faked 50 credentials.

510
00:23:19,170 --> 00:23:20,970
We marked them on our end.

511
00:23:20,970 --> 00:23:23,956
We post them one time into
one hacking marketplace.

512
00:23:23,956 --> 00:23:26,171
And we waited for the logs...

513
00:23:26,171 --> 00:23:28,233
the request,

514
00:23:28,233 --> 00:23:32,280
the first malicious
automation Open Bullet request

515
00:23:32,280 --> 00:23:34,740
that we've seen came
after only two minutes

516
00:23:34,740 --> 00:23:37,189
from the moment I pressed post.

517
00:23:37,189 --> 00:23:40,145
Overall, we had 50 repost.

518
00:23:40,145 --> 00:23:42,990
When hacker sees this,
they say, "Hey, it's nice.

519
00:23:42,990 --> 00:23:45,390
I will repost it on other platform."

520
00:23:45,390 --> 00:23:49,320
So we had another 15
website that were exposed

521
00:23:49,320 --> 00:23:51,690
in this whole operation.

522
00:23:51,690 --> 00:23:54,450
50 repost after the first 24 hours.

523
00:23:54,450 --> 00:23:57,720
Overall, we have 600
attackers that took part

524
00:23:57,720 --> 00:24:01,179
on this party without the will or knowing.

525
00:24:01,179 --> 00:24:05,250
And this is basically
how we can demonstrate

526
00:24:05,250 --> 00:24:07,050
and see it from both sides

527
00:24:07,050 --> 00:24:10,533
while using simple social
engineering techniques on there.

528
00:24:12,450 --> 00:24:17,070
So from ATO, from stealing accounts,

529
00:24:17,070 --> 00:24:20,460
let's talk about the bots
that are using those accounts

530
00:24:20,460 --> 00:24:23,643
exactly afterwards in product release.

531
00:24:24,480 --> 00:24:25,869
And we'll take you,

532
00:24:25,869 --> 00:24:27,769
I will give you one minute intro there

533
00:24:29,850 --> 00:24:32,340
because scalping is used to believe

534
00:24:32,340 --> 00:24:34,833
to be only a thing of PS5 or sneakers,

535
00:24:36,722 --> 00:24:38,940
but basically it affects
all of us in matters

536
00:24:38,940 --> 00:24:41,220
that we can't even imagine.

537
00:24:41,220 --> 00:24:43,350
We have two groups of scalping out there.

538
00:24:43,350 --> 00:24:46,074
The first one would be
the limited edition.

539
00:24:46,074 --> 00:24:49,273
Those are the classic one,
the sneaker marketplace, GPUs,

540
00:24:49,273 --> 00:24:52,590
PS5, NFTs, tickets for
concert for flight tickets.

541
00:24:52,590 --> 00:24:55,740
All of them are being sold
and buy both all the time with

542
00:24:55,740 --> 00:24:58,200
using bots, but we have the second part,

543
00:24:58,200 --> 00:24:59,250
which is really interesting.

544
00:24:59,250 --> 00:25:01,500
The opportunistic scalping,

545
00:25:01,500 --> 00:25:04,590
which mean those who
rely on standard demand,

546
00:25:04,590 --> 00:25:06,660
but temporary low supply.

547
00:25:06,660 --> 00:25:08,400
We've all seen it with the COVID mask

548
00:25:08,400 --> 00:25:09,810
in the beginning of the pandemic,

549
00:25:09,810 --> 00:25:12,900
when it costs something like (indistinct)

550
00:25:12,900 --> 00:25:15,055
at times more than it cost right now,

551
00:25:15,055 --> 00:25:17,670
we had it on with the baby formula,

552
00:25:17,670 --> 00:25:18,632
which one...

553
00:25:18,632 --> 00:25:20,516
during the last year,

554
00:25:20,516 --> 00:25:24,390
one big baby formula factory was shut down

555
00:25:24,390 --> 00:25:27,390
because of violation of health regulation,

556
00:25:27,390 --> 00:25:29,670
which cause a temporary low supply.

557
00:25:29,670 --> 00:25:31,800
And I've seen a lot of both operators

558
00:25:31,800 --> 00:25:32,987
out there in (indistinct),

559
00:25:34,128 --> 00:25:37,170
but the fact that they
switch sneakers or PS5

560
00:25:37,170 --> 00:25:39,194
in that moment to buying day before

561
00:25:39,194 --> 00:25:43,173
through a Facebook marketplace.

562
00:25:44,010 --> 00:25:45,810
And the last thing that we are seeing

563
00:25:45,810 --> 00:25:48,240
is government services, appointments,

564
00:25:48,240 --> 00:25:53,240
specifically passport or visa
at embassies around the world,

565
00:25:55,470 --> 00:25:57,780
a visa appointment in Israel,

566
00:25:57,780 --> 00:25:59,250
you will have to least a year

567
00:25:59,250 --> 00:26:02,793
because of that pandemic
of bots right there.

568
00:26:03,930 --> 00:26:05,700
So let's talk about retail,

569
00:26:05,700 --> 00:26:08,403
the ones that buying the PS5 consoles,

570
00:26:09,240 --> 00:26:11,400
the first thing that
they will use in order

571
00:26:11,400 --> 00:26:14,880
to increase their success
rate will be aged accounts.

572
00:26:14,880 --> 00:26:17,040
Aged accounts are digital
accounts that exist

573
00:26:17,040 --> 00:26:18,630
at least a six month.

574
00:26:18,630 --> 00:26:20,010
And sometimes even more,

575
00:26:20,010 --> 00:26:21,840
sometimes it comes to a year.

576
00:26:21,840 --> 00:26:22,950
The more, the better,

577
00:26:22,950 --> 00:26:24,630
the more the price will be up

578
00:26:24,630 --> 00:26:26,120
because the value will be higher

579
00:26:26,120 --> 00:26:28,230
in the perspective of the hacker.

580
00:26:28,230 --> 00:26:29,284
And why is that so?

581
00:26:29,284 --> 00:26:31,910
Because age accounts are practically...

582
00:26:31,910 --> 00:26:34,483
have lower security standards.

583
00:26:34,483 --> 00:26:37,680
The more we go through time,

584
00:26:37,680 --> 00:26:39,870
the more the target
site, eCommerce site know

585
00:26:39,870 --> 00:26:41,170
and understand the hackers

586
00:26:42,486 --> 00:26:44,221
and they're doing much more adjustment

587
00:26:44,221 --> 00:26:45,090
of security measurements.

588
00:26:45,090 --> 00:26:50,010
So therefore age account
has less strict thresholds

589
00:26:50,010 --> 00:26:53,370
and less strict regulation

590
00:26:53,370 --> 00:26:55,903
under the compliance of
the target site itself.

591
00:26:55,903 --> 00:26:59,106
And this is why they have
much higher success rate.

592
00:26:59,106 --> 00:27:02,250
This is by the way where account takeover

593
00:27:02,250 --> 00:27:03,300
and bots are connected

594
00:27:03,300 --> 00:27:06,330
because those accounts
are being bought usually

595
00:27:06,330 --> 00:27:09,666
from account crackers.

596
00:27:09,666 --> 00:27:12,452
The next thing that will be used here

597
00:27:12,452 --> 00:27:14,370
is the Cook group itself,

598
00:27:14,370 --> 00:27:16,650
which is the community of the scalpers

599
00:27:16,650 --> 00:27:19,220
that involves an focus

600
00:27:19,220 --> 00:27:20,917
of specific retail product.

601
00:27:20,917 --> 00:27:23,161
And sometimes even specific bot.

602
00:27:23,161 --> 00:27:26,263
This is a basically the online community,

603
00:27:26,263 --> 00:27:28,920
which serves as a knowledge base

604
00:27:28,920 --> 00:27:31,320
since scalping and buying product online

605
00:27:31,320 --> 00:27:33,990
is really complex operation.

606
00:27:33,990 --> 00:27:35,430
And you need a lot of knowledge

607
00:27:35,430 --> 00:27:37,070
and a lot of different fields,`

608
00:27:37,070 --> 00:27:39,720
So Cook group will be the answer for that.

609
00:27:39,720 --> 00:27:42,690
These groups are exclusive,
not open to anyone,

610
00:27:42,690 --> 00:27:44,040
cost a lot of money,

611
00:27:44,040 --> 00:27:46,710
and they will have limited
amount of people inside.

612
00:27:46,710 --> 00:27:48,584
So, in order to get access,

613
00:27:48,584 --> 00:27:50,940
it will take some time
to most of the beginners,

614
00:27:50,940 --> 00:27:53,702
but this is how most
of the scalpers begins.

615
00:27:53,702 --> 00:27:57,780
In these Cook groups,
they will do group buys

616
00:27:57,780 --> 00:28:00,720
of product and therefore
reduce their expenses,

617
00:28:00,720 --> 00:28:02,220
or they will shelve some tricks

618
00:28:02,220 --> 00:28:05,218
that will practically
make them most successful.

619
00:28:05,218 --> 00:28:08,280
And the third thing that they
will use is the bot itself,

620
00:28:08,280 --> 00:28:10,710
which is practically
the most overrated part

621
00:28:10,710 --> 00:28:13,980
of the component because it's practically,

622
00:28:13,980 --> 00:28:17,611
every bot has a specific
model for every target site.

623
00:28:17,611 --> 00:28:20,220
There can be a specific
bot that is really good...

624
00:28:20,220 --> 00:28:22,410
His model is really
good for specific sites,

625
00:28:22,410 --> 00:28:24,409
but really bad for other sites.

626
00:28:24,409 --> 00:28:25,950
And therefore...

627
00:28:25,950 --> 00:28:28,136
and also if it's good for a specific site

628
00:28:28,136 --> 00:28:29,580
on specific launch,

629
00:28:29,580 --> 00:28:30,990
it doesn't mean that

630
00:28:30,990 --> 00:28:32,880
in a week it will be the same situation.

631
00:28:32,880 --> 00:28:35,370
It can be patched easily by the detection

632
00:28:35,370 --> 00:28:37,495
of the antibody solution
of the target site.

633
00:28:37,495 --> 00:28:40,410
So, therefore the bot
itself has different...

634
00:28:40,410 --> 00:28:44,425
The prices are various between
$400 to $6,000 a month.

635
00:28:44,425 --> 00:28:48,330
And again, limited amount
of API keys out there,

636
00:28:48,330 --> 00:28:49,344
very exclusive,

637
00:28:49,344 --> 00:28:52,710
but top performers will use several bots

638
00:28:52,710 --> 00:28:54,840
for the same reasons
that I just mentioned.

639
00:28:54,840 --> 00:28:56,460
They will do several products.

640
00:28:56,460 --> 00:28:57,870
They will do several sites

641
00:28:57,870 --> 00:29:00,066
and therefore they will use several bots.

642
00:29:00,066 --> 00:29:04,722
And in order to keep yourself
on top of that main...

643
00:29:04,722 --> 00:29:09,390
just huge operation, you will
have to use a bot manager

644
00:29:09,390 --> 00:29:12,600
and a bot manager is
practically a one stop shop

645
00:29:12,600 --> 00:29:14,430
for all of the bots you are using.

646
00:29:14,430 --> 00:29:17,143
The most common one out there is AYCD,

647
00:29:17,143 --> 00:29:20,850
which practically gives
12 different bot tools

648
00:29:20,850 --> 00:29:22,050
for scalpers,

649
00:29:22,050 --> 00:29:23,871
from creating fake credit cards

650
00:29:23,871 --> 00:29:27,870
to generating emails
addresses that you can use

651
00:29:27,870 --> 00:29:28,950
for fake signups.

652
00:29:28,950 --> 00:29:32,453
Everything they will need
to use is right over there.

653
00:29:32,453 --> 00:29:35,280
And we have the fourth thing

654
00:29:35,280 --> 00:29:37,920
will be the product
release monitoring service.

655
00:29:37,920 --> 00:29:41,937
Whenever you want to know when
there's news restock of PS5,

656
00:29:41,937 --> 00:29:44,880
you will practically go
manually and search PS5.

657
00:29:44,880 --> 00:29:46,218
This cost a lot of time.

658
00:29:46,218 --> 00:29:49,140
This is practically one of
the reason that you will lose

659
00:29:49,140 --> 00:29:50,130
to a bot.

660
00:29:50,130 --> 00:29:51,810
A bot won't do it himself.

661
00:29:51,810 --> 00:29:54,138
He will wait for a third party service,

662
00:29:54,138 --> 00:29:58,230
which is basically a web
crawler that goes every second

663
00:29:58,230 --> 00:30:01,577
to the target site and check PS5 exist,

664
00:30:01,577 --> 00:30:04,350
PS5 exist, PS5 exist.

665
00:30:04,350 --> 00:30:05,389
Whenever PS5 has exist,

666
00:30:05,389 --> 00:30:09,030
He will go back with the
P ID, the product ID,

667
00:30:09,030 --> 00:30:11,790
and he will tell the bot
exactly where to go for.

668
00:30:11,790 --> 00:30:14,396
And we'll show you this
in the two slides for now,

669
00:30:14,396 --> 00:30:17,105
but this one is the most important.

670
00:30:17,105 --> 00:30:20,250
One of the most important
components in the architecture.

671
00:30:20,250 --> 00:30:22,074
As you can see on the right bottom,

672
00:30:22,074 --> 00:30:24,570
the two tweets of heat monitors,

673
00:30:24,570 --> 00:30:26,823
one of the most notorious

674
00:30:26,823 --> 00:30:29,614
product release monitors out there,

675
00:30:29,614 --> 00:30:32,220
you can see basically they are bragging

676
00:30:32,220 --> 00:30:35,730
about the fact that they
spot product release

677
00:30:35,730 --> 00:30:38,460
and they competitor missed it totally.

678
00:30:38,460 --> 00:30:39,990
And on the total right,

679
00:30:39,990 --> 00:30:42,120
they are bragging about the
fact that they were faster

680
00:30:42,120 --> 00:30:45,522
from their competitors in 1.4 seconds,

681
00:30:45,522 --> 00:30:48,120
which might sounds like a little,

682
00:30:48,120 --> 00:30:49,530
but in the world of bots,

683
00:30:49,530 --> 00:30:51,114
this is forever an eternity.

684
00:30:51,114 --> 00:30:54,210
Which practically makes the whole function

685
00:30:54,210 --> 00:30:57,750
of a product monitoring service.

686
00:30:57,750 --> 00:30:59,880
It serves exactly like the gun what we see

687
00:30:59,880 --> 00:31:01,770
on the Olympics competitions.

688
00:31:01,770 --> 00:31:03,120
It tells the bot exactly when

689
00:31:03,120 --> 00:31:06,240
to start the competition again,

690
00:31:06,240 --> 00:31:08,063
to the PS5 unit.

691
00:31:08,063 --> 00:31:10,050
And now we have all of this.

692
00:31:10,050 --> 00:31:11,130
It's really nice,

693
00:31:11,130 --> 00:31:15,600
but we want to use better stack
than what we have on our PC.

694
00:31:15,600 --> 00:31:16,590
The scalper...

695
00:31:16,590 --> 00:31:20,370
The top performance
scalper will put some money

696
00:31:20,370 --> 00:31:23,819
and we will rent dedicated server.

697
00:31:23,819 --> 00:31:26,760
Dedicated server means
that it's not shared

698
00:31:26,760 --> 00:31:28,770
with other scalpers.

699
00:31:28,770 --> 00:31:31,350
And you don't want to be share resources

700
00:31:31,350 --> 00:31:33,360
when you are playing a zero sum game.

701
00:31:33,360 --> 00:31:35,484
When every PS5 console that I will buy,

702
00:31:35,484 --> 00:31:38,093
my scalper friend won't buy.

703
00:31:38,093 --> 00:31:39,875
I don't want to share any resources.

704
00:31:39,875 --> 00:31:44,010
This is why the service is
dedicated and not shared,

705
00:31:44,010 --> 00:31:46,607
and also bare metal and not VPS.

706
00:31:46,607 --> 00:31:48,030
They are physical,

707
00:31:48,030 --> 00:31:48,863
they exist,

708
00:31:48,863 --> 00:31:51,522
and they're geographically located

709
00:31:51,522 --> 00:31:54,360
around the target site service.

710
00:31:54,360 --> 00:31:56,220
So, they will minimize the ping time.

711
00:31:56,220 --> 00:31:59,178
Just like you hear about
FinTech companies that does that

712
00:31:59,178 --> 00:32:02,460
in order to get closer to the stock market

713
00:32:02,460 --> 00:32:06,840
or for any kind of financial institution,

714
00:32:06,840 --> 00:32:08,280
they need to work with

715
00:32:08,280 --> 00:32:10,890
that this is exactly
what scalpers are doing.

716
00:32:10,890 --> 00:32:14,580
They will choose specific geolocation

717
00:32:14,580 --> 00:32:17,700
that are physically
close to the target site,

718
00:32:17,700 --> 00:32:19,329
so they can know exactly...

719
00:32:19,329 --> 00:32:21,303
Can be first before you.

720
00:32:23,850 --> 00:32:25,590
And the last thing that will be here

721
00:32:25,590 --> 00:32:27,851
from the dedicated server itself,

722
00:32:27,851 --> 00:32:29,981
they will spread all of those

723
00:32:29,981 --> 00:32:34,981
requests through different proxy IPs.

724
00:32:35,220 --> 00:32:36,990
This time, unlike crackers,

725
00:32:36,990 --> 00:32:39,990
they will not use just
residential PCs IPs,

726
00:32:39,990 --> 00:32:41,760
they will use mobile.

727
00:32:41,760 --> 00:32:42,690
Why mobile?

728
00:32:42,690 --> 00:32:44,910
Mobile has different thresholds.

729
00:32:44,910 --> 00:32:48,360
The amount of action you can
do from a five inch screen

730
00:32:48,360 --> 00:32:50,490
is much higher than the amount of actions

731
00:32:50,490 --> 00:32:53,220
that you can do using
your keyboard and mouse.

732
00:32:53,220 --> 00:32:54,397
As a result, every target site,

733
00:32:54,397 --> 00:32:57,840
every eCommerce site that
you are a certain with,

734
00:32:57,840 --> 00:32:59,700
will have different threshold,

735
00:32:59,700 --> 00:33:04,700
different amount of task
that you can do per IP.

736
00:33:04,943 --> 00:33:09,570
They're using emulation to
emulate the whole fingerprint

737
00:33:09,570 --> 00:33:11,520
of mobile and mobile IPs.

738
00:33:11,520 --> 00:33:14,760
So they can do much more task,

739
00:33:14,760 --> 00:33:19,230
much more quickly from
specifically geolocated pillars,

740
00:33:19,230 --> 00:33:21,280
proxy pillars that are located right now.

741
00:33:23,670 --> 00:33:27,036
So here is where everything
comes to one place.

742
00:33:27,036 --> 00:33:28,950
As you can see,

743
00:33:28,950 --> 00:33:32,550
our scalper here is connected
through remote connection.

744
00:33:32,550 --> 00:33:36,330
Usually it will be an
RDP remote protocol desk,

745
00:33:36,330 --> 00:33:38,340
remote desktop protocol

746
00:33:38,340 --> 00:33:40,232
of windows, but not necessarily,

747
00:33:40,232 --> 00:33:42,540
he will manage his operation,

748
00:33:42,540 --> 00:33:44,670
which will be on the dedicated server.

749
00:33:44,670 --> 00:33:46,050
Not only stack,

750
00:33:46,050 --> 00:33:48,540
the dedicated server will
constantly communicate

751
00:33:48,540 --> 00:33:49,530
with the price,

752
00:33:49,530 --> 00:33:52,620
with a product monitor service

753
00:33:52,620 --> 00:33:55,200
that he will see the mesh there.

754
00:33:55,200 --> 00:33:57,360
The product monitor will go all the time

755
00:33:57,360 --> 00:33:59,670
and will return once the product is...

756
00:33:59,670 --> 00:34:01,830
When the product is released to the site.

757
00:34:01,830 --> 00:34:03,330
He will come back with a P ID,

758
00:34:03,330 --> 00:34:07,710
which is basically a shortcut
to the product itself.

759
00:34:07,710 --> 00:34:10,530
And then the bot will go
directly while you are looking

760
00:34:10,530 --> 00:34:13,200
for the specific unit, he will go directly

761
00:34:13,200 --> 00:34:14,307
and will buy it before.

762
00:34:14,307 --> 00:34:19,307
Also all of this request will
come up from specific geos,

763
00:34:19,410 --> 00:34:21,390
unlike crackers, that doesn't really care

764
00:34:21,390 --> 00:34:24,210
about where the IP is located.

765
00:34:24,210 --> 00:34:26,520
Scalper has really
important high importance

766
00:34:26,520 --> 00:34:31,110
about where he choose to his exit proxies.

767
00:34:31,110 --> 00:34:34,770
He will usually located at
next to the target site,

768
00:34:34,770 --> 00:34:36,390
which basically most of the time

769
00:34:36,390 --> 00:34:38,347
will be (indistinct), Virginia,

770
00:34:38,347 --> 00:34:39,669
but not necessarily.

771
00:34:39,669 --> 00:34:44,100
And from there all the successful
checkouts that he made it

772
00:34:44,100 --> 00:34:47,206
to all the PS5 units that
he's supposed to get by mail,

773
00:34:47,206 --> 00:34:50,880
he will use a post proxy company

774
00:34:50,880 --> 00:34:54,390
that will use fake addresses
around United States.

775
00:34:54,390 --> 00:34:58,353
All of those PS5 will be sent
to different proxy addresses.

776
00:34:58,353 --> 00:34:59,280
And from there,

777
00:34:59,280 --> 00:35:02,176
it will be moved to his native country

778
00:35:02,176 --> 00:35:03,570
in which he located

779
00:35:03,570 --> 00:35:08,223
in which he will sell it by
600, 700 bucks for one unit.

780
00:35:10,020 --> 00:35:11,767
So where are we heading?

781
00:35:11,767 --> 00:35:15,630
I'm not a prophet and
not pretend to be one,

782
00:35:15,630 --> 00:35:17,709
but I know that there are several actors

783
00:35:17,709 --> 00:35:22,050
and factors that shape the
whole malicious automation world

784
00:35:22,050 --> 00:35:23,565
that keeps on going

785
00:35:23,565 --> 00:35:26,700
specifically because of Ukraine war

786
00:35:26,700 --> 00:35:28,440
and because of COVID.

787
00:35:28,440 --> 00:35:31,252
The first one thing that
we have to understand here

788
00:35:31,252 --> 00:35:32,880
is that the top performers,

789
00:35:32,880 --> 00:35:34,560
that 20% that we are talking about,

790
00:35:34,560 --> 00:35:38,850
are basically the early
adopters of new cracking tools

791
00:35:38,850 --> 00:35:40,140
and techniques,

792
00:35:40,140 --> 00:35:42,834
which means that whatever they're using

793
00:35:42,834 --> 00:35:46,110
will be what everybody will use in a year.

794
00:35:46,110 --> 00:35:50,460
Open Bullet, when it came out in May 2019,

795
00:35:50,460 --> 00:35:51,720
it was a niche at the beginning.

796
00:35:51,720 --> 00:35:54,510
Only few where hackers knew how

797
00:35:54,510 --> 00:35:58,020
to really develop a good config.

798
00:35:58,020 --> 00:35:59,853
Nowadays, it's a standard.

799
00:36:01,290 --> 00:36:05,137
You can rarely find a config developer

800
00:36:05,137 --> 00:36:07,445
that writes ATO script,

801
00:36:07,445 --> 00:36:10,380
that knows how to write
it in anything else

802
00:36:10,380 --> 00:36:13,470
than loli-script, the
language of Open Bullet.

803
00:36:13,470 --> 00:36:17,670
So it's really important for
us to understand those 20%

804
00:36:17,670 --> 00:36:21,090
and not just focus on
the average attacker,

805
00:36:21,090 --> 00:36:23,712
because as I said about
the hacking distribution

806
00:36:23,712 --> 00:36:25,560
is 20/80 low.

807
00:36:25,560 --> 00:36:26,880
There's no average hackers.

808
00:36:26,880 --> 00:36:28,840
It's either you are in the beginners

809
00:36:28,840 --> 00:36:33,540
or you will stay there in the
beginners or the mid range,

810
00:36:33,540 --> 00:36:36,234
or you will go to be a top
performer very, very quickly,

811
00:36:36,234 --> 00:36:38,220
if you have the right consistency

812
00:36:38,220 --> 00:36:39,879
and creativity and courage.

813
00:36:39,879 --> 00:36:41,730
And the second thing is

814
00:36:41,730 --> 00:36:44,130
that every retail supply chain bottleneck

815
00:36:44,130 --> 00:36:46,920
is a business opportunity
for bot operators,

816
00:36:46,920 --> 00:36:50,430
which means that now
they like the same kind

817
00:36:50,430 --> 00:36:53,790
of attack architecture
and scalping architecture

818
00:36:53,790 --> 00:36:57,450
that we've seen on sneakers
turn around against PS5

819
00:36:57,450 --> 00:36:58,470
and Xbox.

820
00:36:58,470 --> 00:37:00,600
It's the same thing that
we'll keep on seeing

821
00:37:00,600 --> 00:37:02,010
on other products.

822
00:37:02,010 --> 00:37:04,200
And I mentioned earlier, the baby formala,

823
00:37:04,200 --> 00:37:05,550
that was just an example,

824
00:37:05,550 --> 00:37:08,370
but we have many other cases going on,

825
00:37:08,370 --> 00:37:10,530
whatever you hear on the media

826
00:37:10,530 --> 00:37:12,618
about a supply chain coming up.

827
00:37:12,618 --> 00:37:13,980
First thing,

828
00:37:13,980 --> 00:37:16,920
think about the bots because
they will come afterwards

829
00:37:16,920 --> 00:37:20,040
because they will see that
the temporary low supply

830
00:37:20,040 --> 00:37:24,036
can drive them a lot of
profit when reselling it.

831
00:37:24,036 --> 00:37:25,110
In fact,

832
00:37:25,110 --> 00:37:30,110
if a bot had any physical
existence in this conference,

833
00:37:30,803 --> 00:37:33,936
it would practically take
over all the water supply

834
00:37:33,936 --> 00:37:38,463
and resell you every glass
of water for 70 bucks.

835
00:37:40,500 --> 00:37:43,860
So what differentiate the top performers

836
00:37:43,860 --> 00:37:46,083
from other threat actors?

837
00:37:48,300 --> 00:37:49,440
The first thing is

838
00:37:49,440 --> 00:37:51,450
that they will think
development operation,

839
00:37:51,450 --> 00:37:52,860
just like a startup.

840
00:37:52,860 --> 00:37:55,320
They will think about minimizing
the (indistinct) time.

841
00:37:55,320 --> 00:37:58,423
They'll think about
customizing their architectural

842
00:37:58,423 --> 00:38:01,830
around the architecture
of the target site.

843
00:38:01,830 --> 00:38:05,280
They will think about reducing
the architectural resources

844
00:38:05,280 --> 00:38:07,740
and increasing its efficiency.

845
00:38:07,740 --> 00:38:10,927
They won't like let's
just to say, for example,

846
00:38:10,927 --> 00:38:15,279
new scalper, they try to
get a PS5 will care the most

847
00:38:15,279 --> 00:38:17,460
about his bot.

848
00:38:17,460 --> 00:38:20,880
He will think that the bot
is the key success for that.

849
00:38:20,880 --> 00:38:24,960
But a top performer will
focus and do authentic work

850
00:38:24,960 --> 00:38:28,450
and figure out where is the
target site servicer located?

851
00:38:28,450 --> 00:38:31,880
And it will be, is all
architecture around it.

852
00:38:31,880 --> 00:38:34,770
He will use the same
ISP as the target site.

853
00:38:34,770 --> 00:38:38,250
So he will minimize again,
a little bit, few...

854
00:38:38,250 --> 00:38:41,070
Every millisecond matters in that aspect

855
00:38:41,070 --> 00:38:43,050
and he will think differently.

856
00:38:43,050 --> 00:38:45,180
And this is exactly
one main differentiator

857
00:38:45,180 --> 00:38:46,320
that we have there.

858
00:38:46,320 --> 00:38:48,630
The second one and really important one

859
00:38:48,630 --> 00:38:51,270
is they all use OSINTs,

860
00:38:51,270 --> 00:38:53,970
either as the cracker
that we've seen earlier

861
00:38:53,970 --> 00:38:55,740
that established a big data set,

862
00:38:55,740 --> 00:38:57,480
that includes all of us,

863
00:38:57,480 --> 00:39:00,810
all of our PII that can
be found on social media

864
00:39:00,810 --> 00:39:03,963
or either it's the bot operator,

865
00:39:07,022 --> 00:39:08,550
that's used product release monitor

866
00:39:08,550 --> 00:39:11,970
in order to figure out exactly
when the launch is happening.

867
00:39:11,970 --> 00:39:14,130
They're all making a preparation.

868
00:39:14,130 --> 00:39:16,480
They know exactly where
everything is located

869
00:39:16,480 --> 00:39:17,980
and this mindset exactly

870
00:39:17,980 --> 00:39:20,446
with validating the bridge email

871
00:39:20,446 --> 00:39:24,030
and using a UX exploitation,

872
00:39:24,030 --> 00:39:27,690
all of this will practically
makes them in a different type

873
00:39:27,690 --> 00:39:28,523
of level.

874
00:39:30,640 --> 00:39:32,390
The third thing here,

875
00:39:35,953 --> 00:39:38,430
and this is the practically
the most important one,

876
00:39:38,430 --> 00:39:42,273
as I see it, from my last
five years of research.

877
00:39:45,561 --> 00:39:47,550
The scalper or hacker at all,

878
00:39:47,550 --> 00:39:51,376
biggest asset is not
his money, but his time.

879
00:39:51,376 --> 00:39:55,650
Most of the people think
the hackers who goes

880
00:39:55,650 --> 00:39:58,850
through a phase that is really
similar to normal people,

881
00:39:58,850 --> 00:40:02,818
where it's called the promotion products,

882
00:40:02,818 --> 00:40:06,900
the promotion products simply claim

883
00:40:06,900 --> 00:40:09,000
that every time you get a promotion,

884
00:40:09,000 --> 00:40:10,950
you get to do less and less,

885
00:40:10,950 --> 00:40:14,850
the thing that got you the
promotion from the first place.

886
00:40:14,850 --> 00:40:16,930
Which means for a hacker perspective,

887
00:40:16,930 --> 00:40:18,877
a lot of hackers are out there thinking,

888
00:40:18,877 --> 00:40:21,810
"Yeah, I can write a code
really well, I know how to hack.

889
00:40:21,810 --> 00:40:24,270
I'm going to do tons of money out there."

890
00:40:24,270 --> 00:40:26,010
And then they open up their own business

891
00:40:26,010 --> 00:40:27,810
and they begin to be client facing,

892
00:40:27,810 --> 00:40:30,210
which is something that
they never did before.

893
00:40:30,210 --> 00:40:32,228
All of the sudden they
need to do marketing

894
00:40:32,228 --> 00:40:34,230
in order to gain some credibility

895
00:40:34,230 --> 00:40:36,802
and really fully flood market.

896
00:40:36,802 --> 00:40:41,190
And they try to sell in a
one-on-one conversation.

897
00:40:41,190 --> 00:40:43,980
They try to understand,

898
00:40:43,980 --> 00:40:45,971
to explain to people their value.

899
00:40:45,971 --> 00:40:50,910
Later on they will do, of
course, customer support.

900
00:40:50,910 --> 00:40:54,030
And they will handle tickets of clients,

901
00:40:54,030 --> 00:40:55,590
which is something they, I believe,

902
00:40:55,590 --> 00:40:57,150
never thought it will happen.

903
00:40:57,150 --> 00:40:58,500
Here you can see in the right there

904
00:40:58,500 --> 00:40:59,970
in the middle of the left,

905
00:40:59,970 --> 00:41:02,970
a real message of a 18 year old hacker

906
00:41:02,970 --> 00:41:06,946
that they tried to do a
anti bot bypass solution.

907
00:41:06,946 --> 00:41:09,843
And this guy during exam
period actually mentioned

908
00:41:09,843 --> 00:41:13,538
that he won't be available
since he's have many exams.

909
00:41:13,538 --> 00:41:15,603
Of course, we took advantages of it

910
00:41:15,603 --> 00:41:18,466
and put 12 different detection logic,

911
00:41:18,466 --> 00:41:21,090
while he had his exam period.

912
00:41:21,090 --> 00:41:23,820
(evil laugh)

913
00:41:23,820 --> 00:41:25,080
And of course,

914
00:41:25,080 --> 00:41:27,690
so time is also something
that is really necessary.

915
00:41:27,690 --> 00:41:29,790
A lot of security companies
are thinking about,

916
00:41:29,790 --> 00:41:32,730
yeah, should make the
attack more expensive,

917
00:41:32,730 --> 00:41:33,750
so they went to...

918
00:41:33,750 --> 00:41:35,190
They will go on other site,

919
00:41:35,190 --> 00:41:39,690
but what's driven 13 out of the 13 hackers

920
00:41:39,690 --> 00:41:41,820
that I've tracked in the
last year and a half,

921
00:41:41,820 --> 00:41:43,020
wasn't their budget.

922
00:41:43,020 --> 00:41:44,010
It was their time

923
00:41:44,010 --> 00:41:46,830
and the fact that they needed
to remain on top of the thing

924
00:41:46,830 --> 00:41:51,120
and to keep handling all the
time with stuff like that.

925
00:41:51,120 --> 00:41:53,760
So the top performers
are doing a smart thing

926
00:41:53,760 --> 00:41:56,224
that we all need to do
in our personal life.

927
00:41:56,224 --> 00:41:59,571
First, they outsource
the code when needed.

928
00:41:59,571 --> 00:42:01,058
Whenever they can,

929
00:42:01,058 --> 00:42:04,110
whatever they can, they
will outsource outside.

930
00:42:04,110 --> 00:42:07,320
So they will keep their self,
the biggest S in their time,

931
00:42:07,320 --> 00:42:09,218
but they will keep under their control,

932
00:42:09,218 --> 00:42:10,830
the stuff that they will have to do,

933
00:42:10,830 --> 00:42:13,530
the debugging, the reverse
engineering of the payload.

934
00:42:13,530 --> 00:42:15,540
They will learn about
obfuscation techniques.

935
00:42:15,540 --> 00:42:17,340
They will learn about deobfuscation.

936
00:42:17,340 --> 00:42:19,200
They will be there in order

937
00:42:19,200 --> 00:42:22,440
to maintain their operation working

938
00:42:22,440 --> 00:42:23,793
and to handle problems.

939
00:42:23,793 --> 00:42:26,820
But all the rest of the
operation, like proxies,

940
00:42:26,820 --> 00:42:27,723
like wallies,

941
00:42:27,723 --> 00:42:29,370
like even credentials,

942
00:42:29,370 --> 00:42:31,187
they will use credential API in order

943
00:42:31,187 --> 00:42:33,780
to minimize their time.

944
00:42:33,780 --> 00:42:35,411
So all that will be outsourced,

945
00:42:35,411 --> 00:42:38,190
so they will have the maximum efficiency

946
00:42:38,190 --> 00:42:40,980
since hackers are most of
the time in this aspect,

947
00:42:40,980 --> 00:42:42,483
at least, works along.

948
00:42:44,610 --> 00:42:49,610
So basically what I want you
to go to leave this talk with.

949
00:42:49,890 --> 00:42:52,200
First, go to underground forums.

950
00:42:52,200 --> 00:42:54,840
If you haven't been
there, open up an avatar,

951
00:42:54,840 --> 00:42:57,060
start learning and be on the other side.

952
00:42:57,060 --> 00:43:00,060
It doesn't matter if you
were pen testers, white hats,

953
00:43:00,060 --> 00:43:01,260
amateur hackers.

954
00:43:01,260 --> 00:43:04,022
It doesn't matter every code
that you want to write down,

955
00:43:04,022 --> 00:43:09,000
somewhere, someone built
it, wrote it, made it,

956
00:43:09,000 --> 00:43:13,440
upgraded into the level of
art and uploaded online.

957
00:43:13,440 --> 00:43:15,540
I still find pen testers that trying

958
00:43:15,540 --> 00:43:16,473
to write down techniques

959
00:43:16,473 --> 00:43:19,253
that are being out spread all the time.

960
00:43:19,253 --> 00:43:22,320
So know your enemy, know the threat actor,

961
00:43:22,320 --> 00:43:23,850
because as we've seen here,

962
00:43:23,850 --> 00:43:26,703
they are collecting intelligence
about us all the time.

963
00:43:27,570 --> 00:43:29,870
The second thing that
is really important here

964
00:43:30,750 --> 00:43:34,020
is think like a threat intelligence

965
00:43:34,020 --> 00:43:36,570
and let's put it in a practical example.

966
00:43:36,570 --> 00:43:37,830
Okay.

967
00:43:37,830 --> 00:43:41,074
Let's just say a defender is
watching this talk right now

968
00:43:41,074 --> 00:43:43,350
on YouTube and he thinks to himself,

969
00:43:43,350 --> 00:43:44,400
as a defender,

970
00:43:44,400 --> 00:43:47,188
I should probably put
two factor authentication

971
00:43:47,188 --> 00:43:49,140
on my account.

972
00:43:49,140 --> 00:43:53,443
That's nice, but that's a
defender type of kind of mindset.

973
00:43:53,443 --> 00:43:55,980
If you want to walk from
the threat intelligence,

974
00:43:55,980 --> 00:43:59,550
think to yourself what nobody
is doing on their password.

975
00:43:59,550 --> 00:44:03,690
And there answer will
be putting space note.

976
00:44:03,690 --> 00:44:06,540
Nobody's using space
notes inside of password

977
00:44:06,540 --> 00:44:10,110
and any password generation
that I came across,

978
00:44:10,110 --> 00:44:13,050
none of them had the
possibility to add spaces

979
00:44:13,050 --> 00:44:14,790
because nobody do that.

980
00:44:14,790 --> 00:44:17,042
And no hacker that I've
met ever came across

981
00:44:17,042 --> 00:44:20,899
or thought about that
enumeration with space notes

982
00:44:20,899 --> 00:44:23,220
and the reason of that,

983
00:44:23,220 --> 00:44:25,950
he never seen that kind of password.

984
00:44:25,950 --> 00:44:30,117
So use spaces in your word
until everybody else will do it.

985
00:44:30,117 --> 00:44:32,069
And hacker will go for it too,

986
00:44:32,069 --> 00:44:36,273
but be there, hand them down,
know your enemy and stay safe.

987
00:44:37,556 --> 00:44:40,723
(audience applauding)

988
00:44:46,410 --> 00:44:47,243
Thank you very much.

989
00:44:47,243 --> 00:44:50,698
I will get questions if
you have anyone have here

990
00:44:50,698 --> 00:44:52,443
and thank you very much.

991
00:44:53,528 --> 00:44:56,695
(audience applauding)