Trends in Security for the Commerce and Travel Industry
Michael Smith, CSIRT Director, Akamai
Akamai Customer Security Incident Response Team
•
•
•
•
•
•
•
•
•

Incident Response for 30% of the web
We only do web, DN...
From the News

©2013 AKAMAI | FASTER FORWARDTM
How It All Started

“My shipping address changed by itself.”

©2013 AKAMAI | FASTER FORWARDTM
First Hours: What We Found
Same shipping address for multiple customers
Same email domain for multiple customers
Multiple ...
Phishing Site

Chaotic Actor
Phishing Email

Internet User

©2013 AKAMAI | FASTER FORWARDTM
Chaotic Actor

Account Checker

Proxy Servers

Internet User

Legitimate
Shopping Sites

©2013 AKAMAI | FASTER FORWARDTM
Indicators
Shipping address changes for multiple users
Email address change for multiple users
Vietnamese accounts (used f...
Mitigations
Rate Controls
User Validation Module
Database queries for address and email domains
Better workflow for email ...
Questions?

©2013 AKAMAI | FASTER FORWARDTM
Trends in Security for the Commerce and Travel Industry - Mike Smith, Akamai
Upcoming SlideShare
Loading in …5
×

Trends in Security for the Commerce and Travel Industry - Mike Smith, Akamai

1,098 views

Published on

Akamai’s director of emergency response will provide a summary of the activity he’s seen over the past year in the eCommerce sector. How has the adversary space changed? What new attack vectors have we seen? Methods for successfully countering recent attacks like Account Checkers using Akamai’s Kona Site Defender service. See Mike Smith's Edge Presentation: http://www.akamai.com/html/custconf/edgetv-security.html#security-trends

The Akamai Edge Conference is a gathering of the industry revolutionaries who are committed to creating leading edge experiences, realizing the full potential of what is possible in a Faster Forward World. From customer innovation stories, industry panels, technical labs, partner and government forums to Web security and developers' tracks, there’s something for everyone at Edge 2013.

Learn more at http://www.akamai.com/edge

Published in: Business, Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
1,098
On SlideShare
0
From Embeds
0
Number of Embeds
21
Actions
Shares
0
Downloads
9
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Trends in Security for the Commerce and Travel Industry - Mike Smith, Akamai

  1. 1. Trends in Security for the Commerce and Travel Industry Michael Smith, CSIRT Director, Akamai
  2. 2. Akamai Customer Security Incident Response Team • • • • • • • • • Incident Response for 30% of the web We only do web, DNS, and the infrastructure No: APT, endpoints, email, Active Directory Lots of: Threat intelligence OSINT Coordination with peer CERT/CSIRT Discussions with policy-makers Customer outreach ©2013 AKAMAI | FASTER FORWARDTM
  3. 3. From the News ©2013 AKAMAI | FASTER FORWARDTM
  4. 4. How It All Started “My shipping address changed by itself.” ©2013 AKAMAI | FASTER FORWARDTM
  5. 5. First Hours: What We Found Same shipping address for multiple customers Same email domain for multiple customers Multiple shipping address changes from a small set of IP addresses Script on Pastebin with many breadcrumbs Lots of things via googledorking Mike: “Why is this stuff all in Vietnamese?” ©2013 AKAMAI | FASTER FORWARDTM
  6. 6. Phishing Site Chaotic Actor Phishing Email Internet User ©2013 AKAMAI | FASTER FORWARDTM
  7. 7. Chaotic Actor Account Checker Proxy Servers Internet User Legitimate Shopping Sites ©2013 AKAMAI | FASTER FORWARDTM
  8. 8. Indicators Shipping address changes for multiple users Email address change for multiple users Vietnamese accounts (used for testing) Increase in failed logins from limited set of IP addresses Being listed in a tool ©2013 AKAMAI | FASTER FORWARDTM
  9. 9. Mitigations Rate Controls User Validation Module Database queries for address and email domains Better workflow for email and shipping address changes Site-generated passwords ©2013 AKAMAI | FASTER FORWARDTM
  10. 10. Questions? ©2013 AKAMAI | FASTER FORWARDTM

×