Ichthyology: Phishing as a Science
ฝัง
- เผยแพร่เมื่อ 12 ก.ย. 2024
- In this talk we'll cover the psychology of phishing, then walk through a series of real-world attacks conducted against a Bay Area tech company - including conversion rates for each attack, and ways in which existing protections were bypassed. We'll cover recent technological advancements in this area, then combine these with our case studies to provide evidence-based techniques on how to prevent, not just mitigate, credential phishing.
By Karla Burnett
Full Abstract & Presentation Materials:
www.blackhat.c...
Anyone who tries to raise phishing awareness in the public or at work should have this broadcasted at least once annually. It's really beyond all the techniques the phishing awareness campaign teaches us.
Great talk! You can't blame users. The web's trust model for authenticity needs fixing.
Well, sometimes you can.
This was well-presented and very informative, thanks Karla!
Nice presentation Karla. The only point that I might've missed is how many employees are at your company (ie. sample size)?
During the first campaign, around 200 people, these days closer to 800
Well presented. Thank you Karla.
Great talk, wish they included the questions though!
This 0day called "human being" for sure is a nasty one. Great talk!
no patching it either:P
If only everyone would just ban all non-DKIM mail, that would help. Thanks for the excellent talk.
So informative! Thank you for all of the insight and hard work that you put into this talk to make my life on the internet more secure!
really good speaker and informative.
Good talk! :)
Interesting topic and very well presented.
Excellent talk, nicely done
She's great.
Perfect!
How do i get into this field?
Post from the Heart ^_^
Does anyone know the presenter's name?
Her name is : Karla Burnett
Don't cut her questions wth!?
unfortunately most of the talks I've seen from Black Hat have the Q&A sections cut...
Ahhh... so what company does she work for? :)
for more phishing research, right? XDXD
Does anybody have any info on how to actually do this
I am in love with this girl :o
busty-ka tumblr com great presentation, and accent haha
Mike Chaves her accent is confusing to me, she's Australian but cuts in and out of an American accent. I'm Australian also
she is the ideal "boyish" girlfriend
Pretty sure she's done some voice-training. And I gotta say, it has paid off in spades, the clarity and lack of distraction in the delivery would have made any public speaker proud. (Not denigrating the content, which was also an excellent composition.)
I have over 10000 emails... not one fake...
Her accent is a cross between British English and American English...
It's Australian
Strip user rights and only allow admins to use their admin account for administrative activities. Privilege of least blah blah. Tons of ways to mitigate post-phish.
What if the admins get phished? :-D
If they are using two separate accounts. One for admin. rights for only when they need to use it and one for regular user rights for email, internet browsing, etc. They should not lose their administrative credentials due to any sort of phishing.
How would the admin credentials be phished at that point? They should only be putting those credentials into 100% verified and valid portals or forms.
I'm guessing I didn't clarify by what I meant enough in the original post.
+dragon1000204395
"real men run as root"
Reminds me on this save email client built into the bash. It protects root from getting infected mails opened.
"ReadMail -RealFast" or in short "rm -rf"
Interesting, but I don't like how they always skew results to give a wow factor when they have a terrible demographic for the "science", especially if it was executed in her own workplace with people she personally knew. If it is companies/engineers they are targeting. Try getting permissions of multiple and different companies to run a phishing simulation. There are plenty of ways to do this sort of test. IMO this is just bad science
I ran the campaigns using only information that could be found publicly (e.g. scraped email addresses, security policy and services we've talked about externally), but Jimmy is right that I have a lot more insight into the psychology of the company than an outsider would. You would of course expect conversion rates to be lower for someone external, but with rates so high for an internal actor, I don't think they'd be zero for an external one.
Jimmy's also correct that I'm not doing real science, I'm using the term colloquially - the sample sizes are far too small to be anything but indicative. If you'd like hard science, Lorrie Cranor has some great research on user security, but it focuses on less targeted and sophisticated phishing attacks than my work did.
+Karla Burnett I don't know what to say. You are a realy realy nice, smart, skilled, humorous, person. I thought that right after the video. And then you showed such a constructive and friendly attitude in this comment. You are realy great.
You said we are all just human. I hope it's ok that many of us think you are great not only in your professional fields and as a person.
Well
I didn't write it, but you know, what I would have want to write so badly.
wow gril
I HATE STRIPE!!! Stupidest payment company EVER! Don't even have phone support! Smh
Marry Me
These are the *attractive* women.
It's an asset if you're a hacker. Some guys see the pretty lady and ignore that she's actually doing something she shouldn't. Damn hormones.
God I want me a hacker girlfriend to bounce ideas off and who doesnt complain she doesnt understand half of what Im saying,as oposed to the "geniuses" Ive been involved with so far,wich Im pretty sure combined IQ legit does not exceed low triple digits...Being a jock /nerd hybrid does have its drawbacks for sure