So we have a really interesting talk for you, we're going to find out why you aren't able
to buy a PS5 or a graphics card or any other in demand item.
We have a first time speaker and first time at DEF CON member up here, Eric Attar, please
give him a warm welcome.
Thank you very much.
So every time you buy anything online, especially if it's a limited stock item, you compete
against both and most likely to lose miserably.
You probably can relate with the statement, if you ever tried to get your hands on an
Xbox or PS5 console, you couldn't quite understand why the stock is always out even three minutes
after restock.
Maybe when you scroll down on your social feed, you've seen your favorite unassisted
console tickets sold by four or five times of their original price and wondered how come.
Maybe even on your way here to DEF CON when you try to book yourself a flying ticket,
you watch how the prices go up, even for flights that were just published.
Bot operators are to blame.
Every bot can simulate thousands of human-like web interactions.
They will buy anything you want before you even Google it.
They will schedule appointments with government services that you will pay for later.
They will win at every online auction that you will attend and they will fake positive
reviews that will lullaby your bullshittiness.
Bot operators are responsible for 77% of the global hacking and fraud activities.
That comes up to almost a quarter of the total internet traffic.
Regardless if we like it or not, malicious automation is here to stay.
It serves tens of thousands of underground hackers and drives millions of dollars worth
of economies.
In the next 40 minutes, I will give you a deep dive into the fascinating architecture
and techniques that are being used by threat actors, by bot operators, when they're trying
to crack their way into your password or log in and steal away your stock from you.
I'll start with a brief introduction to my father.
My father was a policeman.
He served in the Israeli police force for two decades.
He was the head of the fraud investigation department.
During this time, he got the chance to investigate the most fascinating criminals that hacked
the financial system during what is now considered the era of financial fraud.
He was also the head of the Israel Police Department.
were also the ex-husband of my mother which 20 years later led me to the most awkward
how i met your mother conversation that you can ever imagine and of course growing up with a
detective dad wasn't always an easy task you can see a really authentic photo of me and my
dad having their where have you been last night casual conversation on saturday but on the good
part i got a chance to hear a lot of stories fascinating stories about criminals and those
financial fraudsters their courage and their creativity and their ability to flex their mind
and to hack into systems that was the characteristics that i found in myself and this
was what shaped my point of view as a cyber security researcher that research from the
hacker perspective or not from the defender perspective
and indeed in the last five years i spent most of my time under 64 different hacking avatar different
identities on a darknet deep web and open web sources collecting intelligence for the companies
i worked for i started my way in by data some of you will know it as luminati networks some of you
the older ones will know it as hola vpn in bright data i was in charge of doing a investigation upon
some of our clients that try to misuse residential proxy ips for a cyber activity for cyber attacks
ddos frauds and all this kind of stuff i had to carry a lot of investigation there but the most
interesting one was a three-month investigation after a 21 year old from latvia that basically
simulated 30 000 very popular platform gaming platform users using 30 000 concurrent session
at every time he was collecting through the bots users the coins the gaming coins centralized them
in specific avatar went to the gaming shop bought some skins swords and sold every sword for six
thousand dollars this kid made in three weeks one 1.6 million dollars
just from selling sword skins of a popular gaming platform in 2020 i moved to the
uh defender side to parameter x which two weeks ago max merged with human security
there i basically mapped the landscape the threat landscape of any threat actor that is trying to
hurt our clients and basically did a lot of proactive threat intelligence activity like
credential honeypots that were reposted by other crackers that didn't know it's a honeypot
or hunting down
malwares and infostills that went in the wild at least a year and a half before discovered by
anti-viruses so a lot of this experience i'm going to take the most meaningful insights there and
share it to you our agenda for today first i'm going to define what is exactly top performing
because it's really arbitrary a title there afterwards we're going in the first part of
the talk talk about account crackers specifically the
most important part of the talk is the fact that it's a very interesting topic
because it's a very interesting topic and it's also trying to steal your accounts if you ever
lost an account to an hacker you'll find it very interesting the second part will be dedicated to
retail scalping which means using bots to hack the stock of specific retail product to buy it
to buy all the stock and to sell it to you after three times of its original price lately lastly we'll
have a summary of all the ttps we went through and we'll talk about the future of malaysian awesome
automations and after the talk will be over i'm going to have of course a q a personal session
here so i promise not to answer like a bot so like i said we're going to focus on two use cases since
the whole malicious automation world is enormous uh first is going to be accountable using
credential brute force and the second one is retail scalping using automation to buy stock
retail stock and i've defined top performing as those hackers who maintain a sustainable business
model meaning we are not aiming into hit and runners here we're talking about those who are
making a living out of their operation there should be at least six months of online presence
to these hackers and they should belong to the top 20 percent and i'm going to clarify this one
because the hacking distribution the hacking skill distribution among application hackers
are pretty much applied to the 2080 law which means that while all 80 percent of the hackers
outbound making only 20 percent of the successful logins the rest 20 percent are making actually 80
percent of the successful logins or checkouts so i'm going to focus on that specifically 20
which means i'm not going to specifically talk about the most common tools on two techniques but
those who are rare but serves the top performers here so let's jump in first we'll do the brute
force
so there are many brute force tool out there they're all purpose is practically the same
is to camouflage all the concurrent sessions into real login and they all do it by performed as a
one-stop shop for the cracker architecture which means that all the components of the
architectures i'm going to talk about in the next slides come all together in this dashboard that
you can see of open bullet and while there are many tools out there one of them they are per
His purple popularity has went exponentially high in the last few years. His name is open bullet. It's an open source
tool that like other
many cracking tools developed from web testing that went
Into open bullet and from there to black bullet and cyber bullets now all of the free works under the same principles
but they have different
integration
capabilities with other hacking tools and
and practically this will be the open that will
Cook the whole a it will bake this whole cake that the hacker is doing now that they have the open
I need a recipe of the attack and that will be the config itself. It will be the script that runs or everything and
Every config can be roughly divided into three main parts the first part that you can see on the right
upper height right is the the part that
Defines the path of the attack
Itself it will include all the headers and the static variables that will repeat with every user that will use this attack
specifically
The second one will be the authentication the login itself to the account
This is where you can find the payload manipulation techniques the rip cookie replay attack
methods legit services spoofing or API spoofing in which a hacker finds out a API that's supposed to communicate with legit
third party and he rides on it to make a
Login because this path is not regulated by the target site
the last path of every the part of every attack config will be the capture and this is what you can see right there in
the middle
After the login is made the first as part of the same attack
It will go to your account and it will try to figure out what essence do you have?
here you can see a checklist of
very popular streaming services, so we check what kind of
programs the hack tech has on is there of course a
Subscription and this is how the hacker knows later
How to price this stolen account because stolen count that has credit card worth much more than the one that don't
and and the left and the right and the bottom you can see an ad of
Config developer that published it in the underground form you can see a stand it talks about CPM CPM
Stands for credentials per minute or combo per minute which means this is the highest amount of credential that you can
try repair a
specific path specific config
And it tells you it depends on your proxy services and your go recapture services
So it depends like the number you can attempt depends on other architectural components that we'll talk about in the next slide
Also, it's mentioning that it has a capture of credit card and gift card. This is a CC and CG you see at the bottom
It means that these a specific script can tell you exactly
What is the the essence inside there?
It's a can't assign the account, but you as a hack need to go and figure it out and log in yourself
Of course is limiting to it five copies
And it's doing the French air pricing in order for that not to be spread too much and not being patched by security companies
So now we have the tool we have the receipt, but we don't have any case
And the cake starts with the credentials to themselves
It's commonly to believe in the cyber security community that credential are easy to get but they
Need to go for some steps in order to get them like paying a little bit or going to the darknet
While the truth the awful truth is really out there the screenshot that you are seeing right now
It's from a marketplace that you can find on Google and you everyone can sign up and have access to all of these credentials
This is almost 11 billion credentials
If you ever found your email all the email address and have I been pwned it's practically we're going to be here
This is a compilation of all the data breach from the last 10 years
11 billion credentials for the use of many hackers that are keep
Recycling those credential again and again again. So how can knows that of course?
There are this is their playground and they keep collecting those combos all the time running them from VPS virtual servers that has much more
stack capability
When and and of course establishing mysql server in which they can use for creating rich
Datasets that will later to be used for cracking your password and I will attach it later
Of course, this database can be shared among several hacker
Specific hacking groups or it can be privately used
But the biggest SNT is that most of the people in this crowd also
Reusing the same password across different server
S and hackers knows that so they're creating the tables that create your email your
Password and all of last passwords so we can be used later on when they try to brute force
So it's really nice that I have a lot of credential and 11 billion is really nice
But I can't do attack with 11 billion credentials because I will go bankrupt as a hacker. So the next step it's not really
in which
It's a step in which they will go and do mail validation mail validation practically
It's a process in which they go and clean non-relevant users that are not signed up to the target site because there's no logic
Targeting accounts that don't really exist and they will do it mainly with using two techniques
The first one will try to figure out using the website itself
This will be an open bullet config that will be marked as VM valid mail config
And you can find many of those online for free and they will go to the target site
And they will do forgot password with the victim email and they will check the response if the response will be this
Email does not match to our records. Then I should not attack it as a hacker
So I will put it on the ban list and I will filter out more my a tablet a list
But if I get a and we sent you a recent link to this email
This is that means that this practical this
User is signed up and this is why it will be later on
targeted as a brute-force attack
the other path that can go is
Most stealth and it will use and exploit unregulated API path that will practically they will
check we're using this IP API path if the
Email is signed up or not depend on the request that they will get if it's 403 then but if it's something else
We leave it in the
site itself
And now we have everything that we need to do, but we don't want to guess all the possible combination
We want to be precise as actors and we want to aim directly to the point like a sniper
not just shooting like how much Watson against one of the movies and
This is the pre condition before doing the enumeration itself
There are two predictability that make our password really predictable into hackers eyes first the
The type the first type will be involved with the pattern itself
Every target side has a password policy like you can see right here
But most of the people when they sign up to account
They don't the last thing that they want to go to do is to think creative about new password that they will have to remember
Most of the people would just go by the simplest
Roof out there which means that our hacker doesn't need to try all the combination if you can just go for the most common
one like let's just say I'm supposed to do eight to one
Hundred characters most of the people will use eight to ten so therefore I have no reason to enumerate more than that
uppercase and lowercase will usually be uppercase prefix, which is a
built-in feature in every brute force a
Tool out there and also the list were a number when you need to use a number
Most of the people we use one five or seven suffix in the password
Also, there are the creative people that use the keystrokes that are next to each other and
Different shapes and this is what helps them remember that but just so you know
It's a feature that exists in a lot of tools out there
So when they are doing the enumeration they will first try the keys that are next to each other
The next step part that we have of predictability is around involved around the content itself
This tax comes from the last year and Google's research about passwords and it involves 50%
backpacks
It's practically says that 50% of US adults are we using at least
Are using the same one password in at least 12 different services?
33% will use their pet's name and
This is where it all comes to a big one
workflow
First the hacker will use will go back to the table that I've talked about in their last slides
Where they have the username and they have the password and they will enrich
Those a database data sets with the victims PII
It's really easy to do that using open source repositories out there that just for looking up
Accounts that are related to the specific email social media accounts and extract from specific the places these data points like
Education institutions spouse names birthdays everything are totally available out there as any as you can see
They're using a password generator that has this capabilities
Like you can see there use password or birthdate or postcode all of those will be used for doing smart enumeration
not just one that goes off run that randomly and
The enumeration at the end will be
Depend on three things the victim PII like it specs name its wife name a
birthday and stuff like that bridge passwords all the password they could ever found in the in the past that being breached and outside
in the underground forms and the
Policy predictability is that we talked about and this is how they can turn one email into
Large combination of passwords that has really good chance of hitting the target
Now that I have everything if I try to log in from specific IP address
I can manage to do at least top like maximum three logins before I get blocked
So in order to bypass this a IP rate limit hackers are just using many IPs many
Proxies
Those are connected with the service that's called proxy network and this service is actually managing the whole proxy operation for them. I
Dearly recommend you to learn about proxy networks and their capabilities. It's really the one
most common attack factor of all cyber attacks out there
specifically malicious automation and
Also, it served them as its hideout true IP, which is really important since
Cracking into accounts is a criminal act in most United States
Of course using a network allows the whole
Outsource of the proxy operation
Which means the hacker doesn't need to go with the proxy list and then check which one of the IPs got banned
Which one is really not working well and then replace it. He says this time while connecting through API of specific server
to a proxy network that does everything
even rotate a
The request itself when capture capture pops up
So here we can see everything comes up together to the same kind of
cycle
It goes from the left bottom. We can see the attacker there
He will use the mail validation we talked about to the user name
The password will go through a wall this generation that will set a specific attack a type of password that will be
Customized to the specific user from then the request will be
Connected through the super proxy which is the entry point of the proxy network
The super proxy server will use different and thousands of load balancers to spread those accounts
Those are requests among different devices real devices of real people
which will make the target site really hard to block those requests afterwards and
With the successful logins that he managed to do
Using the capture he knows what their essence and then he gives back to these prospects 10%
prospects prospects means the people that
Following him following his activity, but didn't bought anything yet
In front of them he has the challenge of gaining their credibility
So this is why he's acting just like a freemium business model
It gives him 10 or 10 percent of the valid access account the ones that he managed to break into he gives it for free
And this is how it created more and more people and more and more attention on the dark.net
Now people central go over
a different
digital marketplaces
They like selling Stoppie at shop and this kind of services that practically
Marketplaces are legit, but I mean being misused by hackers all the time
and
the last phase
With all of their county he didn't manage to break into because it didn't get the right password
He would do combo recycling he will release it again
in some kind of form, harvesting all the credits,
all the likes, which were worth later money
in the same marketplace of the same form.
So it's actually beneficial for him.
And from this point, it will be picked up by other cracker
that will go from the same phase all over again.
And this is why I call it sustainable cracking.
Here we did, actually in ParametricX,
we did a honeypot that actually demonstrated
the capabilities of hacker on the underground forms.
We faked 50 credentials.
We marked them on our end.
We post them one time into one hacking marketplace.
And we waited for the logs, the request.
The first malicious automation open bullet request
that we've seen came after only two minutes
from the moment I pressed post.
Overall, we had 50 reposts.
It's when a hacker sees us, they say,
hey, it's nice.
I will repost it on other platform.
So we had another 15 websites that
were exposed in this whole operation,
50 reposts after the first 24 hours.
Overall, we have 600 attackers that
took part on this party without their will or knowing.
And this is basically how we can demonstrate and see it
from both sides while using simple social engineering
techniques on hackers there.
So from ATO, from stealing accounts,
let's talk about the bots that are using those accounts exactly
afterwards in product release.
And I will give you a one minute intro there.
Because scalping is used to believe to be only a thing
of PS5 or sneakers.
But basically, it affects all of us in matters
that we can't even imagine.
We have two groups of scalping out there.
The first one would be the limited edition.
Those are the classic one, the sneaker marketplace, GPUs, PS5,
NFTs, tickets for concert, for flying tickets.
All of them are being sold and bought all the time
with using bots.
But we have the second part, which
is really interesting, the opportunistic scalping,
which means those who rely on standard demand
but temporary low supply.
We've all seen it with the COVID mask
in the beginning of the pandemic when it costs something like.
It's six times more than it costs right now.
We had it with the baby formula, which during the last year,
one big baby formula factory was shut down
because of a violation of health regulation, which
caused a temporary low supply.
And I've seen a lot of bot operators out there
for the fact that they switched sneakers or PS5
in that moment to buying a baby formula, selling it
through a Facebook marketplace.
And the last thing that we're seeing right now
is government services, appointments, specifically
passport or visa embassies around the world.
A visa appointment in Israel, you
will have to wait at least a year because of that pandemic
of bots right there.
So let's talk about retail, the ones
that are buying the PS5 consoles.
The first thing that they will use,
in order to increase their success rate,
will be aged accounts.
Aged accounts are digital accounts
that exist at least six months, and sometimes even more.
Sometimes it comes to a year.
The more the better, the more the price
will be up because their value will be higher
in the perspective of the hacker.
And why is that so?
Because aged accounts practically
have lower security standards.
The more we go through time, the more the target site,
e-commerce site, know and understand the hackers.
And they're doing much more adjustment
of security measurements.
So therefore, aged accounts has less strict thresholds
and less strict regulation under the compliance
of the target site itself.
And this is why they have much higher success rate.
This is, by the way, where account takeover and bots
are connected because those accounts are being bought
usually from account crackers.
And the next thing that we're seeing,
this will be used here, is the KU Group itself,
which is the community of the scalpers
that involves a focus of specific retail products
and sometimes even specific bots.
This is basically the online community
which serves as a knowledge base.
Since scalping and buying product online
is really complex operation, and you need a lot of knowledge
and a lot of different fields,
so KU Group will be the answer for that.
These groups are extremely important.
They're exclusive, not open to anyone,
cost a lot of money, and they will have limited amount
of people inside.
So in order to get access, it will take some time
to most of the beginners, but this is how most
of the scalpers begins.
In these KU Groups, they will do group buys of bot
and therefore reduce their expenses,
or they will share some tricks that will practically
make them more successful.
And the third thing that they will use is the bot itself,
which is practically the most overrated part
of the component, because it's practically,
every bot has a specific model for every target site.
There can be a specific bot that is really good,
his model is really good for specific sites,
but really bad for other sites.
And therefore, and also if it's good for a specific site
on a specific launch, it doesn't mean that in a week
it will be the same situation.
It can be patched easily by the detection
of the anti-bot solution of the target site.
So therefore, the bot itself has different, the project,
the prices are varies between $400 to $6,000 a month.
And again, limited amount of API keys out there,
very exclusive, but top performance,
we use several bots for the same reasons
that I just mentioned.
They will do several products, they will do several sites,
and therefore they will use several bots.
And in order to keep yourself on top of that,
or a main, like just huge operation,
you will have to use a bot manager.
And a bot manager is practically a one-stop-shop
for all of the bots you are using.
The most common one out there is AYCD,
which practically gives 12 different tools for scalpers
from creating fake credit cards to generating emails,
addresses that you can use for fake signups.
Everything they will need to use is right over there.
And we have, the fourth thing will be
the product release monitoring service.
Whenever you want to know
when there's a new restock of PS5,
you will practically go manually and search PS5.
This costs a lot of time.
This is practically one of the reasons
that you will lose to a bot.
A bot won't do it himself.
He will wait for a third-party service,
which is basically a web crawler
that goes every second to the target site,
and check, PS5 exists, PS5 exists, PS5 exists.
Whenever PS5 exists, he will go back with the PID,
the product ID,
and tell the bot exactly where to go for.
And we'll show you this in the two slides for now.
But this one is the most important,
one of the most important components in the architecture.
As you can see on the right bottom,
there are two tweets of heat monitors,
one of the most notorious product release monitors out there.
You can see basically they are bragging about the fact
that they spotted a product release
and their competitor missed it totally.
On the other right, they are bragging about the fact
that they were faster from their competitors in 1.4 seconds,
which might sound like a little,
but in the world of bots, this is forever and eternity,
which practically makes the whole function
of a product monitoring service,
it serves exactly like the gun
that we see on the Olympics competitions.
It tells the bot exactly when to start the competition again
to the PS5 unit.
All of this, it's really nice,
but we want to use better stack than what we have on our PC.
The scalper, the top performer scalper will put some money
and we will rent a dedicated server.
Dedicated server means that it's not shared
with other scalpers, and you don't want to share resources
when you are playing a zero sum game.
When every PS5 console that I will buy,
my friends, my scalper friend won't buy, I don't want to share
any more, any resources.
This is why the service is dedicated and not shared,
and also bare metal and not VPS.
They are physical, they exist, and they're located,
geographically located around the target site servers.
So they will minimize the ping time,
just like you hear about FinTech companies that does that
in order to get closer to the stock market
or for any kind of financial institution
they need to work with.
This is exactly what scalpers are doing.
They will choose specific geolocation
that are close, physically close to the target site
so they can know exactly, it can be first before you.
And the last thing that will be here,
from the dedicated server itself,
they will spread all of those requests
through different proxy IPs.
This time, unlike records, they will not
use just residential PCs, IPs, they will use mobile.
Why mobile?
Mobile has different thresholds.
The amount of action you can do from a five inch screen
is much higher than the amount of actions
that you can do using your keyboard and mouse.
As a result, every target site, every commerce site
that you are surfing with, will have different threshold,
different amount of tasks that you can do per IP.
They're using emulation,
emulating the whole fingerprint of mobile and mobile IPs
so they can do much more tasks much more quickly
from specifically geolocated peers,
proxy peers that are located right there.
So here is where everything comes to one place.
As you can see, our scalper here is connected
through remote connection.
Usually it will be an RDP remote protocol,
remote desktop protocol.
It will have multipleciendo of windows but not necessarily.
He will manage this operation,
which will be on the dedicated server and not on the stack.
The dedicated server will constantly communicate
with the product monitor service that you will see,
under mesh there.
The product monitor will go all the time
and will return once the product is released to the site.
It will come back with a PID which is basically a shortcut
to the product itself.
It will come back with a PID which is basically a shortcut to the product itself,
Then the bot will go directly while you were looking for the specific unit. They will go directly and we'll buy it before you
Also, all of this request will come up from specific geos unlike record
It doesn't really care about where the IP is located
Scalper has really important high importance about where he choose to his exit points exit proxies
It will usually located it next to the target site, which basically most of the time will be Ashburn, Virginia, but not necessarily
And from there all the successful
Checkouts that he made it to all the PS5 units that he's supposed to get by mail. He will use a
Post proxy company that will use fake addresses around the United States all of those
PS5 will be sent to different proxy addresses and from there
Which will be moved to his?
native
Country in which he located in which he will solve it by six hundred seven hundred bucks for one unit
So where are we heading?
I'm not a prophet and not pretend to be one, but I know that there are several actors and
Factors that shape the whole malicious automation world that keeps on going specifically
specifically because of Ukraine war and because of Kovac the first one thing is that we have to
Understand here is that the top performance at 20% of we are talking about basically the early adopters of new cracking
tools and techniques
Which means that whatever they are using will be what everybody will use in a year open bullet when it came out in May to
2019 it was a niche at the beginning only few where
Hackers knew how to really develop a good config
Nowadays, it's a standard you
Really that you can you can really find a config developer a developer that writes ATO
Scripts that knows how to write it in anything else than Loli Street the language of open bullet
So it's really important for us to understand those 20% and not just focus on the average
Attacker because as I said about the hacking distribution is 2080 low. There's no average accuracy
it's either you are in the beginners or in
Or you will stay there and they're beginners or the mid-range or you will go to be a top performer very very quickly
if you have the right consistency and creativity and courage and
The second thing is that every retail supply chain bottleneck is a business opportunity for both operators
Which means that what now they like just like the same kind of attack architecture and scalping architecture that we've seen on sneakers
Turn around again against ps5 and Xbox
It's the same thing that will keep on
Seeing on other products and I mentioned earlier the baby formula
That was just an example, but we have many other cases going on
Whatever you hear on the media about a supply chain coming up
First thing think about the bots because they will come afterwards because they will see that the temporary low supply can drive them a lot
of a profit when we selling it in fact if a retail board had any physical existence in this
Conference who would practically take over all the water supply and sell you and resell you every glass of water for 70 bucks
So what differentiates the top performance from other threat actors
The first thing is that they will think development operation just like a startup they will think about minimizing the pink time
they'll think about customating customating their architecture around the architecture of
The target site they will think about reducing the architectural resources and increasing the its efficiency
they want like they say it for example a
new
Sculpture they try to get a ps5 will care about the most about his bot
He will think that the bot is the key success for them
But at all performers will focus and do a awesome to walk and figure out where is the target site service allocated?
and it will be in the
is all architecture around it it will use the same ice piece as the target
side so he will minimize again a little bit few every millisecond matters in
that aspect and he will think differently and this is exactly one main
differentiator that we have there the second one and really important one is
there all you use Austin's either is the cracker that we've seen earlier that
establish a big data set that includes all of us all of our PII that can be
found on social media or either it's the the boat operator that use price that
use product release monitor in order to figure out exactly when the launch is
happening they're all making a preparation they know exactly where
everything is located and this my state mindset exactly with validating the
bridge email and using UX exploitation all this will practically makes them in
a different type of level
the third thing here and this is the practically the most important one as I
see it from my last five years of research and the scalper hacker at all
biggest asset is not his money but his time most of the people think the
hackers who goes for a phase that is really similar to normal people
and where it's called the production of a promotion products the production
the promotion products simply claim that every time you get a promotion you
get to do less and less the thing that got you the promotion from the first
place which means before a hacker perspective a lot of hackers are out
there thinking yeah I can write a code really well I know how to hack I'm going
to do tons of money out there and then they open up their own business and they
began to be client facing which is something that they never did before
all of the sudden they need to do marketing in order to gain some
credibility and really full of fraud market and they try to sell in a
one-on-one conversation they try to understand it to explain to people their
value and later on they will do of course a customer support and they will
handle tickets of clients which is something they I believe never thought
that will happen here you can see in the right there in the middle of the
left a real message of a 18 year old hacker that did try to do a antibody
by a solution and this guy during exam period actually I mentioned that he
won't be available since he's a have many exams of course we took advantages
of it and put 12 different detection logic while he had his exam period and
of course so time is also something this real necessary a lot of security
companies of think
about, yeah, I should make the attack more expensive, so they will go on the other side.
But what's driven 13 out of the 13 hackers that I've tracked in the last year and a half
wasn't their budget.
It was their time and the fact that they needed to remain on top of their thing and to keep
handling all the time with stuff like that.
So the top performers are doing a smart thing that we all need to do in our personal life.
First, they outsource the code when needed.
Whenever they can, whatever they can, they will outsource outside, so they will keep
themselves the biggest S in their time, but they will keep under their control the stuff
that they will have to do, the debugging, the reverse engineering of the payload.
They will learn about obfuscation techniques.
They will learn about deobfuscation.
They will be there in order to maintain their operation working and to handle problems,
but all the rest of the operation won't.
Like proxies, like wall lists, like even credentials.
They will use credential API in order to minimize their time.
So all of it will be outsourced so they will have the maximum efficiency since hackers
are most of the time, in this aspect at least, walks alone.
So basically, what I want you to leave this talk with, first go to underground forms.
If you haven't been there, open up in Avatar.
Start learning.
And be on the other side.
It doesn't matter if you are pen testers, white hats, amateur hackers.
It doesn't matter.
Every code that you want to write down, somewhere, someone built it, wrote it, made it, upgraded
into the level of art, and uploaded it online.
I still find pen testers that are trying to write down techniques that are being out there
spread all the time.
So know your enemy.
Know the threat actor, because as we've seen here, they are collecting intelligence about
us all the time.
The second thing that is really important here is think like a threat intelligence.
And let's put it in a practical example, okay?
Let's just say a defender is watching this talk right now on YouTube, and he thinks
to himself, as a defender, I should probably put a two-factor authentication on my account.
That's nice, but that's a defender type of kind of mindset.
If you want to work from the threat intelligence, that's a good idea.
If you want to work from the threat intelligence, think to yourself what nobody is doing on
their password.
And the answer will be putting space notes.
Nobody is using space notes inside of password.
And any password generation that I came across, none of them had the possibility to add spaces,
because nobody does that.
And no hacker that I've met ever came across or thought about that enumeration with space
notes.
And the reason of that...
He never seen that kind of thing.
He never heard of passwords.
So use spaces in your world until everybody else will do it, and a hacker will go for
it too.
But be there, hunt them down, know your enemy, and stay safe.
Thank you very much.
I will get questions if anyone have here, and thank you very much.