joaquim espinhara & ulisses albuquerque · 2017-10-15 · joaquim espinhara & ulisses...
TRANSCRIPT
![Page 1: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/1.jpg)
SMART SECURITY ON DEMAND
USING ONLINE ACTIVITY AS DIGITAL FINGERPRINTS TO CREATE A BETTER SPEAR PHISHER Joaquim Espinhara & Ulisses Albuquerque
![Page 2: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/2.jpg)
Agenda
Introduction Motivation Background HowStuffWorks µphisher Demo Future Work Conclusion
2
![Page 3: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/3.jpg)
About Us
Joaquim Espinhara – Security Consultant at Trustwave Spiderlabs
Ulisses Albuquerque – Coder for offense & defense… as long as it’s fun! – Lab Manager at Trustwave Spiderlabs
3
![Page 4: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/4.jpg)
© 2012
INTRODUCTION
![Page 5: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/5.jpg)
© 2012
OUR MOTIVATION
![Page 6: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/6.jpg)
Our Motivation
Why? Tools available
6
![Page 7: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/7.jpg)
© 2012
BACKGROUND
![Page 8: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/8.jpg)
Background
Social Networks Social Engineering Data Pre-processing Natural Language Processing (NLP)
8
![Page 9: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/9.jpg)
Background
9
Social Networks
Others
![Page 10: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/10.jpg)
Background
Communication channel for keeping in touch with someone (Facebook, Twitter)
Media sharing (Instagram) Specialized networks (GetGlue, TripIt, LastFM, Linkedin)
10
Social Networks
![Page 11: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/11.jpg)
Background
Phishing
11 http://www.d00med.net/uploads/0d832c77559a2070a766f899e7eg783.png
Social Engineering
![Page 12: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/12.jpg)
Background
What is it? How do we use it?
12
Data Pre-processing
![Page 13: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/13.jpg)
Background
Data Pre-processing Flow
13
Data Pre-processing
Raw data set
"Had lunch with @urma and
@jespinhara today #tgif #lunch"
Data cleaning
"Had lunch with @urma and @jespinhara
today"
Data integration
"Had lunch with @urma and @jespinhara
today"
Data normalization
"Had lunch with @urma and
@jespinhara today (2013-06-05)"
![Page 14: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/14.jpg)
© 2012
HOWSTUFFWORKS
![Page 15: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/15.jpg)
HOWSTUFFWORKS
15
Our Approach
Identifying the subject to profile
Collecting social
network data
Analyzing and building the profile
![Page 16: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/16.jpg)
HOWSTUFFWORKS – Our Approach
16
The Unknown Subject (Unsub)
Joaquim Espinhara
(Target)
@jespinhara (Twitter)
joaquim.espinhara (Facebook)
uid=12345 (LinkedIn)
![Page 17: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/17.jpg)
HOWSTUFFWORKS – Our Approach
17
Data Collection
Social Network IDs Official APIs Web Scraping OAuth
![Page 18: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/18.jpg)
HOWSTUFFWORKS – Our Approach
18
Data Collection - Twitter
Application ID (µphisher)
User ID (@jespinhara)
Twitter @urma @effffn
@SpiderLabs
![Page 19: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/19.jpg)
© 2012
µPHISHER
![Page 20: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/20.jpg)
µphisher
20
Reference implementation
Goals – Validate potential unsub content (Defense) – Assisted textual content input (Attack)
![Page 21: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/21.jpg)
µphisher
21
Reference implementation
Web Application Console Application Twitter only (for now) Open Source (GPLv3)
![Page 22: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/22.jpg)
µphisher
22
Reference implementation
µphisher Ruby on Rails
MongoDB + Mongoid
DelayedJob
OAuth
treat (Stanford
NLP)
![Page 23: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/23.jpg)
Unsub Registration Demo
23
![Page 24: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/24.jpg)
µphisher
24
Reference implementation
Authentication Unsub Registration
Data Source Registration Data Collection Work Set
Definition Work Set Analysis Unsub Profile
![Page 25: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/25.jpg)
© 2012
DEMO (FINGERS CROSSED)
![Page 26: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/26.jpg)
New Profile Demo
26
![Page 27: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/27.jpg)
Assisted Input Demo
27
![Page 28: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/28.jpg)
µphisher
How to use forged content?
Personal email screenshot
![Page 29: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/29.jpg)
µphisher – Future Work
29
Coming Soon
Support for additional data sources Topic clustering customized per data source More metrics and feedback for assisted input Usability (UX help very much needed)
![Page 30: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/30.jpg)
© 2012
CONCLUSION
![Page 31: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/31.jpg)
© 2012
HTTPS://GITHUB.COM/URMA/MICROPHISHER Download, test, & contribute – any feedback is welcome
![Page 32: Joaquim Espinhara & Ulisses Albuquerque · 2017-10-15 · Joaquim Espinhara & Ulisses Albuquerque . Agenda Introduction Motivation Background HowStuffWorks µphisher Demo ... MongoDB](https://reader036.vdocuments.mx/reader036/viewer/2022062920/5f02a6127e708231d40550e6/html5/thumbnails/32.jpg)
Thank You!