Upcoming next is Nick Ascoli.
Nick is a cybersecurity researcher and a founder of Fortress.
And he has led security research and OSINT investigations,
which uncovered several large-scale cybercrime operations.
Apart from that, Nick has been a guest speaker in multiple conferences
and has been on the cybersecurity conferences front for a very long time.
Right. The topic that Nick will be covering is Leakonomics 101.
And the last year in data leaks.
Now, this looks like a very interesting topic,
because data leaks have been happening on a very frequent basis.
Let's hope we are not in the leak list.
All right. Have a good one.
Please welcome Nick on the stage.
Hello, test. Hi, everyone.
So I'm Nick Ascoli. My talk is Leakonomics 101.
The last year in data leaks.
It's going to be a year in review from last August, basically, to this August.
And also, I just learned someone else used the term leakonomics in a talk recently.
So I thought I invented it. I did not.
So I apologize to the original inventor of the word.
But this is Leakonomics 2 then, and theirs was Leakonomics 1.
So I'm Nick Ascoli, founder and CEO of a company called Fortrace.
I've held several threat research roles in my past,
and I also volunteer my OSINT free time at a group called the Traverse Project,
which is a counter-human trafficking group.
It's very cool if anyone has some free time and is very into OSINT.
It's a really good group to get involved with, and I'm happy to make some intros.
And that's my email and my Twitter or X and Mastodon,
so you can find me there and connect and ask me questions or yell at me.
So before we get into the juicy bits of the actual events of the last year,
I just want to quickly clarify that there is a difference between a data leak and a data breach.
There is a small but significant difference, even though the outcome is often the same.
These terms get used interchangeably a lot in the media,
and I'm guilty of using them interchangeably at times too.
It's very common and easy to do.
But simply put, a data leak is when sensitive data is publicly accessible.
It's exposed somewhere.
It's like if I had a file on display here that you could all see,
a physical document that you are all looking at, that is a data leak.
It's not a breach. It's just you guys can look at it if you want,
and that data is, in theory, leaking.
A data breach is a successful attempt to steal sensitive data from a company's digital infrastructure.
Not always sensitive data, but the idea is data is being taken from a spot instead of simply observed where it lies,
even if the outcome is the same.
So by its nature, in the event of a data leak, the data itself, regardless of where it came from,
is publicly accessible. Anyone can look at it. You get the idea.
In a data breach, not necessarily the case.
The leak can result in a breach. A breach does not necessarily mean the data was public in the first place.
Common leak scenarios that we'll go over are like misconfigured web apps,
API vulnerabilities, file systems being made public and indexed by search engines,
and then breach scenarios are the ones we're all intimately familiar with at this point,
internal compromises, campaigns, post-exploitation frameworks, that stuff.
The common root of a data leak is an accident.
An overwhelming majority of the ones that we'll cover today,
the origin of them was an accident, a misconfiguration, a vulnerability, something in the public,
usually something relatively simple that led to the data getting out there.
And in a data breach, there is intention.
There is an actor acting with intention to find the data,
and then occasionally they'll leak it out afterwards.
Oftentimes they'll keep it for their own use.
But the outcome can be the same in most cases.
The organization's sensitive data has been accessed by an unauthorized third party.
So a small distinction, but important to make.
And in the trends of data leaks recently, a lot of the high-impact and high-profile ones that we'll talk about here
did not involve anything beyond a Shodan query, or poking around on a public Jenkins server,
or the right Google dork.
This is not complicated stuff.
People are not writing ODAs to find the larger leaks that we've heard of this year,
which is emblematic of this sort of front-loading of reconnaissance that people are doing,
and bad guys are doing too, because why go through some complicated internal campaign
when the right Google dork will net you the same result of the data you're looking for in the first place.
So the crown jewels are online now.
And to that point, the crown jewels that we're talking about here,
as is typical with data leak, is user records, usernames and passwords,
sometimes sensitive IP of a company.
And back in the day, when some of us got started in the industry,
crown jewels were sitting inside the company,
usually well beyond the firewall or behind the firewall,
DLP'd away from everything else so that if it ever moved on the wire, you'd detect it,
sitting on an app server on the intranet, cannot be pinged from the intranet.
It was an application server hosting all of a company's internal files or databases,
only to be accessed from other intranet-focused applications.
The crown jewels of today, at least in some of what we'll talk about,
are in SharePoint Online. They're on the internet.
They're accessible by anyone with an internet-connected toaster
because someone clicked ShareView URL on a SharePoint directory or a Google Drive or something.
And the CASB you have set up isn't connected to the tenant because someone else set it up.
It's like a shadow IT thing.
And the forward proxy that you should have turned on is disabled,
so you're not seeing the connections to it from your accounting department.
That's the idea.
The sort of era of digital transformation and everyone moving everything to microservices
or to cloud-hosted storage solutions has enabled a lot of application backends and databases
to be sitting on the internet instead of sitting on the intranet.
So the timeline we're going to talk about today is DEF CON to DEF CON,
so last August to this August.
And I might not hit your favorite data leaks, but I'm trying to hit the trends,
so these are my favorite data leaks.
You might have others. We can talk about them later.
And the major categories we're going to go over are hard-coded creds being found in public code
on, like, the GitHubs, GitLabs, and BitBuckets of the world.
API misconfigurations or API vulnerabilities.
Cloud and bucket misconfigurations or, honestly, in a lot of cases, lack of configuration,
where some of these are public by default.
Ransomware leak pages, which is sort of the breach-to-leak pipeline.
And then insider incidents.
So the hard-coded creds in public code is as simple as it sounds, right?
These are creds that someone committed to a Git repository.
Oftentimes, in a lot of the cases we'll look at, it's like a vendor of a vendor hired a dev shop
and they accidentally have their repos public,
and one of the devs committed a secret to a repo that has no stars.
It's, like, totally off in, you know, nowhere land.
But someone finds it, finds a hard-coded credential, and then uses it for something.
And the obvious place to use the credential first is where it was intended,
but the more interesting places are to plug it into admin portals, which we see a lot of people do.
Throwing them in AWS, you know, tenant logins,
throwing them in, like, ADP or Workday to get HR data or text information,
and then throwing them into suites where there'd be tickets, internal documentation,
all the sort of internal things that IT teams are worried about,
or even better, plugging them into, like, Okta to see, you know, if you can get through that,
you can get into anything that's connected to it, which is very helpful.
So, the two big ones, the two big hard-coded credential incidents
that I think are most emblematic of the trend
are Atlassian, which was relatively small,
but done by a group called SiegeSec, which has been very active this year,
especially recently. They've been on an absolute tear.
They're the furry hacker group, they call themselves.
They found hard-coded creds in a public repo that they used to log into Envoy.
The creds worked in Envoy.
And Envoy is like a badge management system.
That's part of what they offer. So they got the employee information
of all of the offices and all of the people going to and from there.
The records of that were emails, phone numbers, full name,
and what they claim is lots more.
And when I say record, by the way, when we're talking about records here,
think of it like a row in a spreadsheet.
In some cases it's as little as a name in an email,
and in some cases it's everything about the user,
their identity information, all the sort of federated stuff
that you would see when you're in AD,
or whatever the database we're looking at is storing.
Now with Toyota, this was a lot more records.
This was closer to 300,000 customer records,
which was management numbers, email addresses, and a bunch of other stuff
that Toyota has not talked about. But this was the same situation,
which is a development subcontractor left an access key
in a repo that they accidentally had public for years.
It was since 2017, which is very common.
This is long before GitHub started asking you
to not put secrets in your code.
They found it in September of 2022,
and those were two of the big ones. There's been a lot more of these,
but a lot of them are smaller in size, and I'm kind of trying to ramp up
in terms of the level of interestingness.
API misconfigs or API vulnerabilities
have been hugely popular this year with people
exchanging data, especially in volume.
One of the most common ones that is
in an overwhelming majority of these cases is BOLA,
Broken Object Level Authorization, which is just when you adjust
the query parameter of a legitimate request to an API
to get something else. So you figure out what the pattern is
for user IDs or for whatever it is that the parameter you're looking at does,
iterate through all of them, and download as much of whatever the database is
as you can. And the instances of those that were particularly
large, and then there's a small one, but it was a fun one,
WhatsApp had 500 million phone numbers
pulled over what was a presumed API vulnerability.
They didn't disclose exactly what it was. That allowed enumeration of
user records at a massive scale.
Their actual market share is like over a billion.
It's like 1.5 billion, I think, users of WhatsApp. It might be more now.
So 500 million records represents a significant
amount of that customer base. So these are
active, accurate phone numbers that are super...
A phone number doesn't sound that important, but it is massively
helpful for wide-ranging scam operations,
call operations, fraud operations
that involve legitimate phone numbers.
And now 500 fresh, active, real
people's phone numbers are out there in the wild so they don't have to guess so much anymore.
The T-Mobile one was huge also, and this is T-Mobile's
fourth major incident in the last several years.
This was 37 million records, also from
a vulnerable API, which I believe was Ebola
vulnerable also, which exposed T-Mobile
customer data, which was all the customer PII,
no usernames and passwords, luckily, but names,
addresses, dates of birth, phone numbers, plan information, the kind of stuff
that's really helpful for more commodity
scam operations. And then the U.S. Patent and Trademark
Office one was particularly interesting. This one was recent.
They had an internal API that was accidentally public-facing
and over-permissioned.
And whoever accessed it used it to download 61,000
domicile addresses for patent applicants.
The interesting part there is a lot of people who apply for patents
are relatively important and also value
their privacy strongly. But when you file for a patent,
you have to provide the address of where you live
in addition to where you do business. So this is like the home
address of the people filing for intellectual property,
either independently or mostly on behalf of companies,
which was particularly interesting.
The next big topic is cloud and bucket misconfigurations, which this
has been a thing for years now and really hasn't
moved that much. You can still, with
a couple of very simple Google dorks, find
hordes of S3 buckets,
Azure spaces, GCP's
storage solution, DigitalOcean spaces, which is
a competitor to all of them. You can still find files
in a lot of those. This is actually a screenshot I took yesterday
while doing some last-minute changes to the slide, just so I had fresh stuff in it.
This was lit just in the first page of results
on Google, and this was actual... this is some kind of
database backup. These are INSERT INTO statements.
So some kind of database backup of user entries
into this company's database. The first one is admin-admin,
the second one is test, and then all the ones under that were
users, and it was several hundred of them.
So just scraping the surface of what's out there.
Some of the bigger cloud and bucket misconfig incidents
of the last year, Lugzotica
being definitely the larger of all of them,
which was the actor behind it
on breach forums hinted at it being a
bucket, an exposed bucket, or some flavor of exposed storage
that had all of the... from a Lugzotica
vendor. And Lugzotica makes
all the sunglasses that we all wear. They're like the monopoly
of sunglasses companies. So their customers are
everyone, anyone who's bought sunglasses. So this was the
customer PII of every retail customer of Lugzotica
going back a long time. It's 70 million, you know,
sales records. Truthfinder was 19
million records, and finally we're getting into the space of passwords,
emails, usernames, being in the
leaks, which is where cred stuffing starts
becoming very useful when those leaks get public
with fresh passwords and fresh emails, this case
being a ton of them. 19 million functional usernames
and passwords, which a lot of PIs, I just
imagine that's a job that a lot of older gentlemen would
have, and they also have a tendency to reuse
creds in a lot of places. I don't mean to, you know, I'm sorry if you're an
older gentleman in the crowd, but I'm sure you don't reuse creds, but your
friends might. It's very common. So
they downloaded the database
misconfigured, way over permissioned,
and Truthfinder is a background check application. So
not only PIs, but tons and tons of corporate users,
lots and lots of background investigations going on in there, and also
people conducting background investigations value their
privacy. So this was a really interesting one. Capita
has had a really big year. They're in financial services. They had a
big ransomware incident that affected a lot of customers, and totally
separate from that, a researcher that I'm sure you guys are familiar with,
Kevin Beaumont, found an S3 bucket that had
a massive internal file repository of like 655
gigs of files, which Capita
initially was like, those are supposed to be out there, okay? This is an app,
it's supposed to be public, this is all intentional. And then
Kevin posted some files that had hard-coded creds written
into them, it was like code documentation, and then
it disappeared immediately, and they never spoke on it again.
So another emblematic of the
S3 bucket issue that continues to run rampant.
And then Toyota, which we've
already mentioned, they had another big one this year, which was
2.5 million records. This one is particularly unique
of the 2023 leaks, because what was made
public was a database of T-Connect
activity for Lexus Japan, which had been
leaking for a very long time, and had
an interesting combination of, I'm
calling it PII, because you could put it together to an address, but
it was the ID numbers for vehicles that
Toyota used, and the real-time location of
all of the vehicles in the T-Connect suite, which was
all Lexus vehicles in Japan. And in Japan, Lexus
is, you know, those are luxury cars
bought in fleets by governments and companies, so
it doesn't take, you know, you don't have to be that creative to figure
out why the real-time location of
vehicles would be valuable for someone with nefarious intent
of wealthy people in Japan.
So that one was really unique and particularly problematic.
Basically, if you'd refresh the database, you're constantly getting the updated
geolocation of the cars. Another
one that is sort of in the leak-to-breach pipeline that ended up being
really big this year is ransomware leak pages, which have been
around for, you know, a little while, but particularly this year
ransomware groups really stepped up and invested
in their PR and put together, you know, kind of
nice-looking UIs for their leak data.
So what they do now, if you haven't seen these before, is
when they get hooks into a company,
they will make an entry for them on a public page.
This is also a screenshot I took two days ago
of the LockBit page. So this is the LockBit ransomware group.
When they get their hooks into your environment, they'll put
a timer, they'll put your domain, a timer, and a summary
of the files that they X-filled, which usually, if they spread far and wide enough,
is kind of everything. Like, they'll get their hands on
a ton of stuff inside the environment, and then they'll have
a timer on there for when you have to pay the ransom by,
which anyone can see. And sometimes, in that example in the bottom right
corner, which was for a school,
a price. So a price... it might have been a school or a bank.
A lot of these were schools, which is really bad and we'll
get into in a second. But that's been
an interesting development. And if you don't pay the ransom,
then all of the files are made publicly accessible to
anyone on the Internet. You can go to this Onion link
right now and download, anyone who hasn't paid the ransom,
all of their files. So this has been a pretty horrific
trend in the last year. And the victims
have been a lot of kids. So the ransomware
leak pages, some of the larger leak incidents
on the leak pages this year, a lot by the same
groups have been targeting education. The Colorado Department
of Higher Education, which hosts 800,000
students now, but this is also historical
data contained in the leak. And about 55,000
staff had a ransomware incident with a public leak page,
didn't pay the ransom, all of it's public, you can go download
it now. Which had student names, their social security
numbers, student IDs, and then a wide variety of
academic and disciplinary records for
the students, current and a lot of former.
The Minneapolis Public School System,
same deal, except what they said is
the impact is current and former students,
parents, staff, and vendors. And if you look
at the files contained in the exposure, which has been analyzed by a lot
of groups at this point, it is straight up everything.
The ransomware groups, X-filled, every
file this school had, it seems like.
And any piece of personal information you
could imagine a school would have about a student was made public
and was a part of this record. One of the
other larger ones was the LA Unified
School District, which is a big school district in LA County.
About half a million students currently and 74,000
staff, but lots of historical data in this one too.
The threat actor bought creds
on the dark web. Someone was selling remote access
creds in a small dump. They bought the
creds, logged into some remote access portal.
I don't know if it was... it's not clear in the reports if it was
SSH or RDP or what, but they bought creds.
Those creds got them remote access.
Relatively simply, nothing too complicated there. And then they deployed
the payload. Once they got in, it spread around
and the ransom was not paid and the files were
leaked. And also in a lot of cases, you'll find even if the ransom is paid,
these files end up finding their way onto the internet anyway.
Which contains student SSNs, student passports,
scans of students' passports, student assessments,
copies of driver license for anyone who parked on the
school property. Kind of another one of those
everything bunches. And then the same group
successfully targeted... the same group from several of these targeted
UK schools. And in the same leak
did like 14 of them. The size of them really
ranges widely. I couldn't get a confident number on it.
But student SSN information, student passport scans,
salary and bank information for employees
was in the leaked data. So schools have been hit
really hard this year by ransomware groups
and a lot of that data has ended up on the internet
because a lot of them are mandated to not
pay the ransom and are also very
under-resourced in terms of backups and budget.
So the last category to get into is the
insider events. There have only been a couple
really compelling ones this year. The example we have here
is someone posting CIA intelligence briefs in a
Minecraft Discord group, which was a really fun one
that happened this year.
They're responding to someone in a thread who said they're not
overly sensitive and they said, here, have some leaked documents.
So these showed up in a group
Discord gaming channel where a bunch of people were talking about military
stuff. This guy worked... he was an Air National Guard
intelligence officer with a lot...
access to way more intelligence data
and SOPs than he probably should have been
permissioned to. People in the group said they were
very impressed with how he was able to predict world events
going on. Turns out he had access to all these files and then
eventually he just starts sharing them with the group and they find their way
into actual nation-state adversaries'
hands. So that one was hundreds of
classified files from the Air National Guard
intelligence officer, originally posted to
his gaming Discord for clout, which worked
but then he was arrested for espionage, which means his clout
is not as valuable anymore.
The classified files had intel briefs, human collection SOPs,
strategic intelligence on the current stuff going on, the current
war in Ukraine, and a bunch of other stuff. Those are just the
more high-level categories. Now, Tesla, I put an asterisk on
because this is not really a leak in the traditional sense
and not the kind we're talking about, but insider
whistleblower files also typically find their way
onto the Internet after being shared around and this has been shared with
a lot of journalists, but I haven't seen the files show up anywhere yet.
So, asterisk there. But the data was leaked
this year. This was a disgruntled ex-employee which Tesla
claims was denied a promotion and that's why he got
mad. He leaked a bunch of
internal files to a German news outlet and they contained safety
complaints around Tesla's full self-driving software
and safety concerns about all flavor of
automated driving that Tesla was doing
and contained internal guidance, which ended up being something the media
latched onto a lot, which was very controversial, is guidance
instructing employees who were diagnosing these issues or
answering the phones not to write
anything down about the issues, but specifically
to, if you do feel like something has to be
written down, get lawyers involved, but mostly just try and keep the person
on the phone and have nothing, no e-mails,
no text, nothing in the ticketing systems so that
the issues aren't, you know, there's no paper trail associated
with them. And then there was also apparently
several files that contained 100,000 current and former
employment records for employees and contractors of
Tesla which had names, socials, salary information,
e-mails, bank details, and a couple other categories on everyone
up to and including the CEO. A couple
honorable mentions that didn't fit into the categories that we
talked about were the TSA. This was a Jenkins
server that had creds on it. The person who uncovered this did an amazing
write-up on it. You definitely should just look up TSA no-flylist
leak and you'll find it. This is something they just found
while poking around on Shodan. Logged into the Jenkins server
and there was a file called nofly.csv.
Downloaded the file, one and a half million names of the TSA no-flylist.
So, this is the time we're living in.
Names, aliases, and birthdays of the TSA
no-flylist. Another interesting pair
is even though the Breach Forums leak itself was small,
Raid Forums went down after the founder was arrested,
you know, a while ago. And then Exposed Forum... well, then Breach
Forums got very popular with the Exodus of Raid Forum users
and Exposed Forum... okay, so
Raid Forum collapses. Breach Forum gets popular.
Breach Forum collapses after the arrest of its admin.
Exposed Forum leaks the Raid Forums user
DB on their forum, which starts just like
a leak war between all of the different forums.
Oni Forum spins up, which then leaks the Breach Forums
user database, the old Breach Forums user database
on their forum. And now all of these forums still, I mean
except Raid Forums, still sort of come and go from the public
different admins take over. But right now
if you go on the new Oni Forums or Breach Forums
or any of the still active ones
you'll see a lot of leaks of other
criminal community or dark web community or hacker
forum sort of leaks. They're just getting
each other's databases and leaking them out there. Which the only
really compelling part about those records is
like the username and password combos are useful, but
these are probably people who don't reuse credentials too often
but the emails associated with them ended up being
a lot of people's personal emails when registering these
accounts on old aliases before
they maybe developed any sort of good
security sort of
I don't know what the term I'm looking for is, but any
OPSEC. Thank you. Any sort of OPSEC
in their operations. So that one is really interesting and probably
the reason that the war continues because people are reusing each other's
old credentials to access the admin
portals of the various forums. And I'm sure this will continue
for many, many months. It's still active now.
So I called it Leakonomics 101. So in the spirit
of academic, the theme of academia
I'm going to do senior superlatives for the
leaks. If you guys don't know what superlatives are, they're like
awards you give to students, like most popular
best dressed, that sort of thing. This might be funny
it might not, but I'm going to try, okay? So the most
unique leak of the year was definitely
Toyota's car one. This one was wild.
2.1 something million
live locations of vehicles
is undeniably one of the most unique data leaks we've
seen in the last year.
The Class Clown Award, and this is not nice, but
I'll say something nice about them later, is definitely T-Mobile
because they've had so many of these major incidents
in the last couple years, which leads
me to the Best Friends Award, which I think goes
to Toyota and T-Mobile. Toyota had two
big ones this year, and T-Mobile has had a lot
in the last year. And then the most likely
to do it again award, and this is not going to be T-Mobile, I'm not going to
pick on them again, but any guesses? Who's most likely
to have another big data leak? Tesla?
That's one vote. TSA? That's a
good one. Actually, it was T-Mobile.
I couldn't have predicted that. But it's fun
to laugh at them, but I'm sure they're very stressed out, and
the security staff, this is a laugh with them, because I'm
sure they've been begging for more budget to prevent all of these incidents, but
pour one out for the team at T-Mobile, it's definitely
not a fun time to be in that
security operation. Most likely to be famous
is the clout garnered by the DoD guy,
which I think he succeeded in.
In his community, he was very popular
and very famous for a minute there.
Best dressed is definitely
going to none other than Luxottica, just because they make beautiful sunglasses
that we all wear. Okay, a little
wrap-up of just the leaks we talked about.
There's a lot that I didn't get to talk about, there's a lot that happened this year,
but in just what we've discussed, we saw about
630 million total records.
And these are not necessarily unique, all of them, I'm sure in the range
of hundreds of millions were unique, but these are records
ranging from, like I said, individual things like fields of
phone numbers, emails, or large combinations of
very much identifiable information.
30 plus major leaks are what we covered,
which contained within them, in terms of what is
practically usable immediately, was about 20 million
fresh username, email, and password combos,
which, like I said, immediately usable and valuable in adversarial
operations, and you see bad guys
doing that quite a bit now. 1.4 million
social security numbers, which is overwhelmingly
from the student leaks, so that's a lot of
minors' social security numbers, and probably
in the at least tens or hundreds of thousands of passports, because
those were leaked from there as well, and driver's licenses of
mostly minors. And in terms of...
I called it leakonomics, which would infer that there's an
economic component to this, but honestly, the only
money figure that would be interesting is how much money it costs to
clean up what happened, because the leakers
in all of the cases where someone just posted the data
except for the WhatsApp one, where they posted bundles
of phone numbers, these are free. People post these
online for internet points.
If you go on any of the popular hacking forums now,
and you go to the leaks page, you'll see stuff every day
of varying levels of integrity, but
mostly people are not selling this stuff.
They find it, they give it away for clout among
their group or on their forum, so they're not making money
off this. They're doing lots and lots of
very quantifiable damage, but
in terms of the economics
behind it, they're not making a whole lot of cash,
the raw leakers themselves. And then another fun little
number is something I read in the Bitdefender report from this year
is 40% of security professionals have been instructed not to
report breaches and leaks, so it's also overwhelmingly
likely that this is a very, very, very small flavor
of what actually happened and is just the stuff that ended up
very much in the public eye. But in terms of
record counts, username and password combos, and
potentially money that was made, I'm sure it's a lot larger than
this. So some predictions for the future.
This is based on actions GitHub took and the
rise in DevSecOps products
and trying to move security left in the
development pipeline is hopefully a steady decline
in hard-coded cred problems. There's lots still
out there that you could go find right now on
any of the Git sites, but
new ones are less frequent. You're less
often going to come by those because GitHub will
attempt to stop commits that it thinks has secrets in it
and will warn you of that, and most people are putting stuff on
GitHub. But all the old stuff is still out there.
So even though hopefully volume decreases, it
certainly doesn't mean impact will, because someone gets
a hold of the right old credential that's been out there for a couple years
that has access to a database that has hundreds of thousands
or millions of usernames and passwords, and even though it's less incidents,
still very high impact of the ones that do happen.
I'm sure this has already kind of happened in a couple very small
incidents, but I'm assuming a couple major
LLM app backends will leak conversation data
and the secrets embedded within, which
again has only happened in small flavors so far, but a lot of
these apps are spinning up haphazardly
with mostly microservice infrastructure,
which the services are talking to each other on the internet,
so this kind of stuff is very much built with
internet accessibility in mind,
and I'm sure the conversation data and the
secrets or corporate information or personal information
embedded in those conversations, if present in
a public bucket of some kind, will be very interesting.
And then honestly, a lot of the same.
Most of the issues I talked about have been around
in some form for a while,
but most of them vary in popularity, it comes and
goes in trends based on what technology is being adopted
rapidly, but I don't think 2024
will... I don't see any of these trends
declining in a major way, except for hopefully hard-coded
secrets. And to use
buzzwords improperly, shift-left is what you
hear about when you think about DevSecOps, but in terms of
what all of this means in understanding
adversarial operations, bad guys
have shifted left in the sense that
exfilling the crown jewels in the actual exfiltration
stage of the MITRE ATT&CK framework is not so
necessary when the crown jewels can be found
just on the internet. So again, like I said before,
why maintain complicated infrastructure
and burn your TTPs
several times in a campaign
when the right Google search finds something that
maybe two years ago wasn't on SharePoint Online, but now it is.
So bad guys take note of this and
you see a lot of groups front-loading recon
in their campaigns instead of
doing a smaller amount of recon. It makes a lot of sense to front-load
recon when more and more stuff is on the internet.
And in terms of the techniques that are in the... this is like
basically what was previously the pre-ATT&CK matrix, but is now
bulked into the MITRE ATT&CK matrix at large.
The recon phase and resource development,
well, mostly the recon phase is what made up the
pre-ATT&CK matrix, is now part of the main matrix. And of all the
leaks we talked about, these are the categories that are relevant.
It's not that many. And in terms of technical
complexity, these are very much so on the lower end.
So these are the ones employed in the actual leaks
that we saw. So what can you do
as a person who might be concerned about leaking data
or finding it before it becomes problematic? And honestly,
the easiest thing is whether you have several people on your team,
if you have a dedicated red team, which is
rare, but if you have at least a few people
working on cyber defense in some manner with some
titles, rotating defenders to do the searching
on Shodan, the common Google dorks for exposed
buckets, and you can target these searches very much to just look
for your stuff. You don't have to look at the internet at large, but
target your infrastructure, target tools you think you're using,
and look for data or even better, honey tokens,
that if in some flavor of public data set
would mean something is leaking from inside you or
from a contractor or vendor
that you know handles your data. And automate it
to the extent that you can. Automate it so that you're
spending less time looking for the
sources to connect
and more looking at the data that is present on them to see
if it's actually a problem. And then an easy way to do this
if you have less defense resources
and you're like, I couldn't possibly spend any time running Google dorks,
we have so much going on internally, then a
simple executive level exercise is running a
tabletop with whoever is relevant,
legal parties, crisis management, to
understand what are you going to do
when a data leak impacts you or when it's your
infrastructure or a third party of yours. A tabletop is
a low tech exercise where you're just sort of running
through the scenario, mostly verbally. And these are
super helpful in understanding and preparing
for an internal or external data leak
and having sort of leadership on board with
understanding that A, it's very likely your data will be present
in one or you'll leak something eventually. And B, these are not
really things that people have playbooks to respond
to commonly. So it's smart to get ahead of
at least the low tech approach of understanding procedurally
what to do when it does happen. So that's it.
That's the end of my talk. Thank you guys for coming. And I'll open the floor
for questions. I have some extra time. So I can do it from here.
Thanks. Any questions? Yes?
I'm sorry. I can't hear you very well.
Are you asking
why it's free?
Potentially, yes. Some of the leaks are less valuable than others.
But generally the fact that the data was given away for free
doesn't always correlate directly with its impact. More the likelihood
that someone will buy it or someone is willing to buy it.
Like a more advanced adversary
group will just collect the data themselves. They don't need to buy it
off the shelf. The low tech, more commodity adversary groups
that don't have as much money will buy
cheaper dumps before they come on the market.
The kind of data that's present in these leaks is usually
employed in wide sweeping campaigns
by more commodity adversary groups or individual
operators. Which is, I'm sure, part of the reason why the economics
behind it are so odd and people don't pay money for it.
Some are more valuable than others. A lot of groups have no use for phone
numbers, but have a lot of use for fresh logins and passwords
that they can start spraying in external portals.
It's kind of a complicated answer, but...
Yes, basically.
Yes.
Yes.
Do you mean things you can do to get people to change passwords?
Oh, I don't know why they would want you to change your passwords.
Wouldn't they want you to not change your passwords?
Yeah, I don't know. That's not an adversary, then. That's a friend.
That's someone helping you out.
I might be misunderstanding your question, though.
I'm not sure.
Any other questions?
It depends.
The Pentagon files? I don't think so.
I don't think you can download classified stuff if you're just some guy
not in a SCIF.
Some of it, there's mixed...
I'm not a lawyer, but I have asked lawyers this question several times
because most of my work is dealing in the world of leaking data.
And the answers range from
it's a gray area to
if it is accessible with an IP address from anywhere
it's not blocked from any sort of connection
then it is public domain, the information
and is legally treated as public domain.
That said, I still wouldn't just download every leak you see
because I'm sure
it is a lot more complicated than that.
Companies commercially download these leaks all the time
for use in their tools
and in their operations defensively
but as long as you're buying the information
or hopefully obtaining it for free with a defensive intent
no one is going to come after you for it, most likely.
But the answer is, it depends sort of
if the data is classified, then yeah, definitely not
but some of it is definitely public domain.
Yes?
Yeah, I think the GDPR question is good
so the question was, are any of these companies being held accountable
and would a GDPR being enforced
I guess in the US broadly be helpful
in preventing these in the future?
And to answer that question, definitely. If you had to have controls in place
to make sure that these data sets, usernames and passwords
classified data, regulated data was not public
then I'm sure it would have a positive impact.
It might not fix everything because this still happens
and a lot of the companies we talked about do have a lot of business
some of them headquarters in GDPR enforced areas
so it certainly would not fix the problem
but I don't see it hurting necessarily.
And then what was the second question?
Oh right, are they being held accountable?
Yeah, mostly no
sometimes yes, but in a lot of cases
with the nature of the data ending up being
public domain, I mean honestly a lot of these are from the last year
and sometimes for the enforcement body
to investigate the case and issue a fine
is well over a year. So these are pretty fresh
I could see a few of them definitely being enforced
and massive fines being levied
but for a lot of them, like the ransomware leak ones especially, definitely not.
You're a victim of a
crime at that point
but of the ones I talked about
I don't think any fines have been levied yet. I might have missed the news about it
but I'm sure a few will at least.
Yes, of course.
There is a difference, yes. The more clear web ones
are usually where you see someone posting a massive
database of like, here's all the usernames and passwords
for this delete my tweets app that a bunch of people
use to clear their Twitters. But when you start
getting into the invite only groups, the groups on Telegram
things you have to be invited to
or have to weasel your way into
or they're specifically invite only
generally they're not dealing in volume quite as much as they are
quality. So they're not so interested in
showing off to each other for clout. They're more interested
in whatever their mission is
and sharing information relevant to the mission.
So it's a lot more like fidelity over volume
whereas on the forums it's like, I popped 500 million creds
that's like, you know, it's
totally different motives.
Yeah, and you'll see both on both
but mostly it's like
it's sort of like quality and quantity differences between
the more narrow groups. Gotcha.
Alright, I'm cut off in time but if you guys have any more questions I'll be in the room over there.
Thank you.