Slide 1
Slide 1 text
Digital Cat & Mouse:
Strategies to Outsmart
Scrapers, Phishers and
Thieves
Paul Conroy / @conroyp
Slide 2
Slide 2 text
From Dublin, Ireland
Started playing with the web 30+ years ago
(Notepad, Frontpage & Geocities!)
CTO at Square1
conroyp.com / @conroyp
Paul Conroy
๐ด
๐
๐ฎ๐ช
Slide 3
Slide 3 text
Threat Landscape
โ Infrastructure security issues
โ 0-day exploits
โ Database exfiltration
Slide 4
Slide 4 text
https://xkcd.com/538/
Threat Landscape
โ Infrastructure security issues
โ 0-day exploits
โ Database exfiltration
Slide 5
Slide 5 text
https://xkcd.com/538/
Threat Landscape
โ Infrastructure security issues
โ 0-day exploits
โ Database exfiltration
Slide 6
Slide 6 text
Creative Sabotage
Slide 7
Slide 7 text
Boom Time
โ Popular property site in Ireland
โ 2 main players in the market, we recently became #1
โ Height of property boom - lots of new competitors
โ Most fail - difficult to get agents to upload to new site!
Slide 8
Slide 8 text
http://dublincoastaldevelopment.com/
Slide 9
Slide 9 text
http://dublincoastaldevelopment.com/
Slide 10
Slide 10 text
http://dublincoastaldevelopment.com/
๐ณ๐ฑ
Slide 11
Slide 11 text
http://dublincoastaldevelopment.com/
๐ณ๐ฑ ๐ฐ๐ฐ
Slide 12
Slide 12 text
๐จ
Slide 13
Slide 13 text
๐จ
Slide 14
Slide 14 text
๐จ
Slide 15
Slide 15 text
๐จ ๐จ๐ผ
Slide 16
Slide 16 text
๐จ ๐จ๐ผ
๐ธ
Slide 17
Slide 17 text
๐จ ๐จ๐ผ
Them Us
Slide 18
Slide 18 text
๐จ๐ผ
๐จ
๐ฉ๐ผ
๐ด
๐ฉ๐ฆฐ
Them Us
Slide 19
Slide 19 text
๐จ๐ผ
๐จ
๐ฉ๐ผ
๐ด
๐ฉ๐ฆฐ
Them Them
Slide 20
Slide 20 text
What are our options?
Slide 21
Slide 21 text
What are our options?
๐ Ask them nicely to stop
Slide 22
Slide 22 text
What are our options?
๐ Ask them nicely to stop
๐งโ Go to courtโฆ โณ๐ฐ๐ฐ๐ฐ
Slide 23
Slide 23 text
What are our options?
๐ Ask them nicely to stop
๐งโ Go to courtโฆ โณ๐ฐ๐ฐ๐ฐ
๐ฉ๐ป Technical countermeasures
Slide 24
Slide 24 text
No content
Slide 25
Slide 25 text
๐ฎ๐ช
๐ฎ๐ช
๐ฎ๐ช
๐ณ๐ฑ
๐ณ๐ฑ
๐ณ๐ฑ
๐ณ๐ฑ
๐ฎ๐ช
๐ฎ๐ช
๐ฎ๐ช
Slide 26
Slide 26 text
No content
Slide 27
Slide 27 text
No content
Slide 28
Slide 28 text
No content
Slide 29
Slide 29 text
No content
Slide 30
Slide 30 text
No content
Slide 31
Slide 31 text
Them Us
Slide 32
Slide 32 text
๐จ๐ผ
๐จ
๐ฉ๐ผ
๐ด
๐ฉ๐ฆฐ
Them Us
Slide 33
Slide 33 text
Them
๐ก
๐ก
๐ก
๐ก
๐คฌ
Us
Slide 34
Slide 34 text
No content
Slide 35
Slide 35 text
No content
Slide 36
Slide 36 text
No content
Slide 37
Slide 37 text
No content
Slide 38
Slide 38 text
No content
Slide 39
Slide 39 text
The Result?
Slide 40
Slide 40 text
The Result?
๐
Results updated next morning
Slide 41
Slide 41 text
The Result?
๐
Results updated next morning
๐ Filled with obvious nonsense
Slide 42
Slide 42 text
The Result?
๐
Results updated next morning
๐ Filled with obvious nonsense
๐คฃ Relentlessly mocked on social media
Slide 43
Slide 43 text
The Result?
๐
Results updated next morning
๐ Filled with obvious nonsense
๐คฃ Relentlessly mocked on social media
โ Stopped scraping us - flawless victory!
Slide 44
Slide 44 text
The Result?
๐
Results updated next morning
๐ Filled with obvious nonsense
๐คฃ Relentlessly mocked on social media
โ Stopped scraping us - flawless victory!
๐ฅณ ๐ ๐
Slide 45
Slide 45 text
Flawless Victory! (almost)
Slide 46
Slide 46 text
Flawless Victory! (almost)
Slide 47
Slide 47 text
๐ฆพ Developer doing local testing
๐ Weak (non-existent..) code review
๐ FTP to production
๐ณ Noticed internally (mid-victory lap)
๐คฌ Rapid change in dev processes
Flawless Victory! (almost)
Slide 48
Slide 48 text
๐ฆพ Developer doing local testing
๐ Weak (non-existent..) code review
๐ FTP to production
๐ณ Noticed internally (mid-victory lap)
๐คฌ Rapid change in dev processes
Flawless Victory! (almost)
Slide 49
Slide 49 text
No content
Slide 50
Slide 50 text
No content
Slide 51
Slide 51 text
https://blog.cloudflare.com/ai-labyrinth/
Slide 52
Slide 52 text
No content
Slide 53
Slide 53 text
No content
Slide 54
Slide 54 text
Bandwidth Hogs
Slide 55
Slide 55 text
โ Property websites need to be
attractive - strong imagery
โ Images make up about 60% of a
siteโs payload
โ Bandwidth is expensive!
Slide 56
Slide 56 text
No content
Slide 57
Slide 57 text
๐ฅ๐ฅ
Slide 58
Slide 58 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
Slide 59
Slide 59 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
Slide 60
Slide 60 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
โ Estate agents hated it - lots of
complaints!
โ Needed to be more subtle
Slide 61
Slide 61 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
โ Estate agents hated it - lots of
complaints!
โ Needed to be more subtle
Slide 62
Slide 62 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
โ Estate agents hated it - lots of
complaints!
โ Needed to be more subtle
Slide 63
Slide 63 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
โ Estate agents hated it - lots of
complaints!
โ Needed to be more subtle
Slide 64
Slide 64 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
โ Estate agents hated it - lots of
complaints!
โ Needed to be more subtle
Slide 65
Slide 65 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
โ Estate agents hated it - lots of
complaints!
โ Needed to be more subtle
Slide 66
Slide 66 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
โ Estate agents hated it - lots of
complaints!
โ Needed to be more subtle
Slide 67
Slide 67 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
โ Estate agents hated it - lots of
complaints!
โ Needed to be more subtle
Slide 68
Slide 68 text
โ Watermarking each image
โ Aggressive - visible, central
โ Obvious on other sites that the original
lives elsewhere
โ Estate agents hated it - lots of
complaints!
โ Needed to be more subtle
Slide 69
Slide 69 text
Devolving into an arms race
We need a more technical solution!
Slide 70
Slide 70 text
No content
Slide 71
Slide 71 text
โ Competitors quickly got frustrated
โ Poor user experience
โ Stopped hotlinking us
Slide 72
Slide 72 text
โ Competitors quickly got frustrated
โ Poor user experience
โ Stopped hotlinking us
โ They targeted other competitors
Slide 73
Slide 73 text
โ Competitors quickly got frustrated
โ Poor user experience
โ Stopped hotlinking us
โ They targeted other competitors
๐๐ง๐ฆ
Slide 74
Slide 74 text
Signed URLs
โ More browser restrictions on sharing of referral URLs
โ Application generates URL with signature
โ Typically includes timestamp and a shared secret
โ Server validates it
Slide 75
Slide 75 text
Signed URLs
โ More browser restrictions on sharing of referral URLs
โ Application generates URL with signature
โ Typically includes timestamp and a shared secret
โ Server validates it
Slide 76
Slide 76 text
๐ง๐ป Image is in
cache already?
Retrieve image
from cache
Nginx +
LUA scripting
Decode sig
Extract timestamp
Check vs shared secret
Return image
Yes
No
Request: /img/house.jpg?sig=abc1234
Shared secret
Valid
sig?
Add cache
headers to image
Yes
No
Error image
Slide 77
Slide 77 text
IP Restrictions
โ Mobile network in Ireland grouping user IPs
โ Threat detection was counting IPs per account
โ Think again about rate limiting strategies
โ 1 IP != 1 Person
Slide 78
Slide 78 text
IP Restrictions
โ Mobile network in Ireland grouping user IPs
โ Threat detection was counting IPs per account
โ Think again about rate limiting strategies
โ 1 IP != 1 Person
Slide 79
Slide 79 text
Phishing Expedition
Slide 80
Slide 80 text
Real Estate scams, very popular
Beautiful photos, low price
Owner โnot available right nowโ
Wire the money now, itโs yours!
Slide 81
Slide 81 text
Real Estate scams, very popular
Beautiful photos, low price
Owner โnot available right nowโ
Wire the money now, itโs yours!
Slide 82
Slide 82 text
Real Estate scams, very popular
Beautiful photos, low price
Owner โnot available right nowโ
Wire the money now, itโs yours!
Slide 83
Slide 83 text
Real Estate scams, very popular
Beautiful photos, low price
Owner โnot available right nowโ
Wire the money now, itโs yours!
Slide 84
Slide 84 text
Real Estate scams, very popular
Beautiful photos, low price
Owner โnot available right nowโ
Wire the money now, itโs yours!
Let your users help you out!
Slide 85
Slide 85 text
๐ง
Slide 86
Slide 86 text
๐ง
Username & password
Slide 87
Slide 87 text
๐ง
Username & password
Platform access
Slide 88
Slide 88 text
๐ง
Username & password
๐ดโ
Slide 89
Slide 89 text
๐ง
Username & password
Error message
๐ดโ
Slide 90
Slide 90 text
๐ง
Username & password
Error message
๐ดโ
๐
Slide 91
Slide 91 text
๐ดโ
๐
Slide 92
Slide 92 text
๐ดโ
๐
Slide 93
Slide 93 text
๐ดโ
๐
Slide 94
Slide 94 text
๐ดโ
๐
Slide 95
Slide 95 text
๐ดโ
๐
Slide 96
Slide 96 text
๐ดโ
๐
Slide 97
Slide 97 text
๐ดโ
๐
Slide 98
Slide 98 text
๐ดโ
๐
Slide 99
Slide 99 text
โ Got smarter over time
โ Copy css and js files - no more hotlinking
Slide 100
Slide 100 text
โ Got smarter over time
โ Copy css and js files - no more hotlinking
โ Didnโt get them allโฆ
Slide 101
Slide 101 text
โ Got smarter over time
โ Copy css and js files - no more hotlinking
โ Didnโt get them allโฆ
Slide 102
Slide 102 text
No content
Slide 103
Slide 103 text
Honeypot
โ Tempting to nuke the site immediately
โ Set up a honeypot
โ Seemingly-real credentials
โ Track when they are used to log in
โ Check for other logins from the same
device
Slide 104
Slide 104 text
No content
Slide 105
Slide 105 text
https://www.haveibeenpwned.com/
โ User education - checking URLs
โ Two Factor Authentication
โ HaveIBeenPwned.com
Slide 106
Slide 106 text
No content
Slide 107
Slide 107 text
No content
Slide 108
Slide 108 text
โ User education - checking URLs
โ Two Factor Authentication
โ HaveIBeenPwned.com
โ Ugly emails
๐ฌ
https://www.haveibeenpwned.com/
Slide 109
Slide 109 text
Black Sunday Hack
Slide 110
Slide 110 text
โ 1990s US, Pay TV taking off - sports & movies
โ More expensive for bars - charge $20 entry to
customers for events
โ Card encryption cracked - thriving black
market in cloned decoders
Slide 111
Slide 111 text
๐บ
๐จ๐ผ
Slide 112
Slide 112 text
๐บ
๐จ๐ผ ๐ดโ
Slide 113
Slide 113 text
๐บ
๐บ
๐จ๐ผ ๐ดโ
Slide 114
Slide 114 text
๐บ
๐บ
๐จ๐ผ ๐ดโ
Slide 115
Slide 115 text
โ Critical bit of the process to copy
โ Odd updates - not breaking pirated cards
โ No obvious functionality
โ Pirates copied them faithfully
๐บ
๐จ๐ผ
Slide 116
Slide 116 text
No content
Slide 117
Slide 117 text
No content
Slide 118
Slide 118 text
No content
Slide 119
Slide 119 text
No content
Slide 120
Slide 120 text
No content
Slide 121
Slide 121 text
No content
Slide 122
Slide 122 text
No content
Slide 123
Slide 123 text
No content
Slide 124
Slide 124 text
No content
Slide 125
Slide 125 text
No content
Slide 126
Slide 126 text
No content
Slide 127
Slide 127 text
No content
Slide 128
Slide 128 text
No content
Slide 129
Slide 129 text
No content
Slide 130
Slide 130 text
Pieces combined to make programme that could run on the card!
Slide 131
Slide 131 text
Pieces combined to make programme that could run on the card!
Overwrote part of internal card memory, sending machines into boot loop
Slide 132
Slide 132 text
Pieces combined to make programme that could run on the card!
98% of pirate cards effectively bricked overnight
Overwrote part of internal card memory, sending machines into boot loop
Slide 133
Slide 133 text
Pieces combined to make programme that could run on the card!
98% of pirate cards effectively bricked overnight
Overwrote part of internal card memory, sending machines into boot loop
Slide 134
Slide 134 text
Pieces combined to make programme that could run on the card!
98% of pirate cards effectively bricked overnight
Overwrote part of internal card memory, sending machines into boot loop
Developers took a small victory lapโฆ
Slide 135
Slide 135 text
Pieces combined to make programme that could run on the card!
98% of pirate cards effectively bricked overnight
Overwrote part of internal card memory, sending machines into boot loop
Developers took a small victory lapโฆ
Slide 136
Slide 136 text
No content
Slide 137
Slide 137 text
No content
Slide 138
Slide 138 text
No content
Slide 139
Slide 139 text
No content
Slide 140
Slide 140 text
Strategies
โ Tarpit - slow your adversary down, slow-responding code.
โ Honeypot - give them credentials that seem legit, but can be used to trace them.
โ Fake data - share data that looks good to machines, but needs a lot of human effort
to clean up.
โ Swiss cheese defence - one layer is rarely enough.
โ Patience can be a virtue when building a counter-attack.
Slide 141
Slide 141 text
Takeaways
๐ฅท Know your adversary - what are they trying to do?
๐ต Monitoring - how are they trying to do it?
โฐ Immediate block vs longer-term counter-attack
๐ฎ Know the law! Counter-hacking can get you in trouble in some areas
Slide 142
Slide 142 text
Takeaways
๐ฅท Know your adversary - what are they trying to do?
๐ต Monitoring - how are they trying to do it?
โฐ Immediate block vs longer-term counter-attack
๐ฎ Know the law! Counter-hacking can get you in trouble in some areas
๐ฆ Lace up your running shoes!
Slide 143
Slide 143 text
โ Revisting the Black Sunday Hack
https://blog.codinghorror.com/revisiting-the-black-sunday-hack/
โ Dublin Coastal Development Launch Site (Irish state broadcaster news coverage)
http://dublincoastaldevelopment.com/โจ
https://www.rte.ie/archives/2016/0925/818719-artificial-islands-for-dublin-bay/
โ Cloudflare AI Labyrinth
https://blog.cloudflare.com/ai-labyrinth/
โ HaveIBeenPwned.com
https://www.haveibeenpwned.com
Further Reading