Akamai’s director of emergency response will provide a summary of the activity he’s seen over the past year in the eCommerce sector. How has the adversary space changed? What new attack vectors have we seen? Methods for successfully countering recent attacks like Account Checkers using Akamai’s Kona Site Defender service. See Mike Smith's Edge Presentation: http://www.akamai.com/html/custconf/edgetv-security.html#security-trends The Akamai Edge Conference is a gathering of the industry revolutionaries who are committed to creating leading edge experiences, realizing the full potential of what is possible in a Faster Forward World. From customer innovation stories, industry panels, technical labs, partner and government forums to Web security and developers' tracks, there’s something for everyone at Edge 2013. Learn more at http://www.akamai.com/edge

2. Trends in Security for the Commerce and Travel Industry
Michael Smith, CSIRT Director, Akamai

3. Akamai Customer Security Incident Response Team
•
•
•
•
•
•
•
•
•
Incident Response for 30% of the web
We only do web, DNS, and the infrastructure
No: APT, endpoints, email, Active Directory
Lots of:
Threat intelligence
OSINT
Coordination with peer CERT/CSIRT
Discussions with policy-makers
Customer outreach
©2013 AKAMAI | FASTER FORWARDTM

4. From the News
©2013 AKAMAI | FASTER FORWARDTM

5. How It All Started
“My shipping address changed by itself.”
©2013 AKAMAI | FASTER FORWARDTM

6. First Hours: What We Found
Same shipping address for multiple customers
Same email domain for multiple customers
Multiple shipping address changes from a small set of IP addresses
Script on Pastebin with many breadcrumbs
Lots of things via googledorking
Mike: “Why is this stuff all in Vietnamese?”
©2013 AKAMAI | FASTER FORWARDTM

7. Phishing Site
Chaotic Actor
Phishing Email
Internet User
©2013 AKAMAI | FASTER FORWARDTM

8. Chaotic Actor
Account Checker
Proxy Servers
Internet User
Legitimate
Shopping Sites
©2013 AKAMAI | FASTER FORWARDTM

9. Indicators
Shipping address changes for multiple users
Email address change for multiple users
Vietnamese accounts (used for testing)
Increase in failed logins from limited set of IP addresses
Being listed in a tool
©2013 AKAMAI | FASTER FORWARDTM

10. Mitigations
Rate Controls
User Validation Module
Database queries for address and email domains
Better workflow for email and shipping address changes
Site-generated passwords
©2013 AKAMAI | FASTER FORWARDTM

11. Questions?
©2013 AKAMAI | FASTER FORWARDTM