2.9M UK people employed in Retail £381Bn UK Retail Sales $1.2T Mckinsey prediction for economic value of IoT to Retailers 553 EE Retail Stores in the UK…and growing Source: Retail Economics 2018 / Adobe Digital Insights & Mckinsey 82% Of sales still in-store $12Bn Revenue increase to Retail through 5G by 2021
Sessi on repla y Full cookie support JavaScript support Browser fingerprint spoofing Recorded human behavior IP Blocking / Rate Limiting Multiple IPs Low request rate Single IP HTTP Anomaly Detection Browser Fingerprinting User Behavior Analysis BOT SOPHISTICATION Evasions and mitigations SIMPLE SOPHISTICATED
Attackers pull data during a data breach Stolen credentials are sold on the dark web Fraudsters purchase stolen credentials Stolen credentials are tested on other websites
role of credential stuffing • Identify target website with high account value • Purchase list of stolen credentials on dark web • Build or rent a botnet to automate validation • Build or buy software tools to evade detection • Purchase compromised account for target site • Use purchased account credentials to login • Perform fraudulent transactions using compromised account OBJECTIVES • Validate list of stolen credentials against login page of target website • Resell validated account credentials on dark web Bot management • Mitigates attack earlier in the kill chain to reduce incidence of downstream fraud SOLUTIONS Fraud prevention • Pros: knows individual users • Cons: high cost, account already compromised
IMPACT Ponemon Institute – The Costs of Credential Stuffing Number of accounts targeted per credential stuffing attack Ponemon—The Cost of Credential Stuffing, Oct 2017 Other annualized costs related to credential stuffing
SIGN IN BA G LOGIN CREATE ACCOUNT Website GIFT CARD SIGN IN BA G URLs Desktop login Shopping cart Create account Account balance Cart API SIGN IN BA G SIGN IN BA G Login API Mobile app Clients Desktop browser Mobile browser 3rd party Attacker
September 2018. Once DENY mode was enabled, the bots disappeared. Eventually, the bad actors returned when they discovered a vulnerable API to verify user profiles and promptly launched their attack. When the attack was discovered, the customer onboarded the new endpoint onto the Akamai platform for protection. Bot Requests 13,663,754 IP Address A total of 78,269 IP addresses were detected sending potentially malicious requests User Agent Attackers rotated through 754 user agent strings during the observed period. Countries 68% of blocked requests originate from within the US. The rest of the traffic was split amongst 191 other countries Exploratory probe in an attempt to discover if Bot Migration is still in place. Traffic subsides shortly after. Possible attempt to obfuscation by attacking protected endpoints while simultaneously hitting the new vulnerable API. Human Logins 2,439,702 New endpoint configured once the attack was discovered. Averaging 2.1 million requests per day.
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 1,253,061 Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 366,102 Mozilla/5.0 (iPhone; CPU iPhone OS 10_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/10.2 Mobile/14C92 Safari/604.1 288,476 Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/10.0.2 Mobile/14A456 Safari/604.1 288,152 Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1 288,065 • Out of the 754 User-Agents used, 85% of the traffic came from 45 User-Agents that appear to be iPhone devices • Each User-Agent was used to generate an average of 275,000 requests over a span of 5 days • All the fake iPhone requests originated from non-cellular networks, suggesting this is malicious traffic
Telemetry Indicates Advanced Bot 13,171,043 ▪ No Behavioral Telemetry Received 1,584,711 ▪ Session Cookie Missing 10,082 ▪ Behavioral Telemetry Invalid 7,081 ▪ Session Cookie Replay 1,843 • The most advanced bots will send behavior telemetry in an attempt to appear human • Analyzing this telemetry with machine learning algorithms allows Akamai to separate the bots from legitimate human users
of largest financial asset management companies, this organization sees high bot traffic, including financial aggregators as well as credential stuffing and other fraud-related activities. Result Dramatic reduction in account takeovers to 1-3 per month and fraud-related losses to $1-2k per day—across all login endpoints Solution Behavioral-based bot detections deployed in deny in front of every consumer login endpoint Problem 8,000 account takeovers a month across multiple login endpoints, leading to $100k per day in direct fraud-related losses
Pearl, Curl Javascript Engines Headless Browser A LOOK AT THE MOST COMPLEX ATTACKS Attack tool sophistication Attack Deployment Sophistication Automated Browsers w/Human Imitation Network Detections • IP Address • Country of origin • Rate of requests Pros • Simple to implement • Can be done within a WAF
Pearl, Curl Javascript Engines Headless Browser A LOOK AT THE MOST COMPLEX ATTACKS Automated Browsers w/Human Imitation Header Detections • User-Agent • Missing headers • Header order Pros • Simple to implement • Can be done within a WAF Attack tool sophistication Attack Deployment Sophistication
Pearl, Curl Javascript Engines Headless Browser A LOOK AT THE MOST COMPLEX ATTACKS Automated Browsers w/Human Imitation Browser Fingerprinting • Checks to see if client can process .js • Compares browser characteristics with User-Agent Pros • Identifies basic scripts • Isn’t as complex as other solutions Attack tool sophistication Attack Deployment Sophistication
Pearl, Curl Javascript Engines Headless Browser A LOOK AT THE MOST COMPLEX ATTACKS Automated Browsers w/Human Imitation Behavioral Detections (hybrid) • Uses both browser fingerprinting and human telemetry to create a single signature Pros • Identifies basic, moderate and some advanced bots • Starts to look at the user interaction Attack tool sophistication Attack Deployment Sophistication
Pearl, Curl Javascript Engines Headless Browser A LOOK AT THE MOST COMPLEX ATTACKS Automated Browsers w/Human Imitation Behavioral Detections (true) • Creates a unique signature based on human telemetry • Uses browser characteristics to identify Bot tools and improve machine learning Pros • Identifies basic, moderate and some advanced bots • Accurately identify humans Attack tool sophistication Attack Deployment Sophistication
Can be done within a WAP Pros • Customer experience • Detection quality • Risk score based • Not really Bot management • Possible privacy issues • Limited support and development Cons
need multiple levels of defence: • Bot solution & Web application firewall • Things you can do on your website: ◦ Implement a robust IAM solution; OWASP has great suggestions ◦ Make MFA mandatory but not via SMS text ◦ Not allow email addresses as usernames for authentication ◦ Add a third informational proof element to login pages, such customer ID or last name
January 2019 Janrain pioneered the Customer Identity landscape Named a Customer Identity and Access Management (CIAM) leader in 2017 Forrester Wave™ Report Named as the overall leader in 2018 Customer Identity Leadership Compass Giving end-users control and choice over their data and how it is used Accelerating sustained compliance of GDPR for their customers Enhancing digital trust
and privacy, while improving end user engagement and thus brand loyalty Reducing friction in the registration journey; by scaling & performing without latency and allowing customers to bring their own identity Customer Identity & Access Management consists of three key capabilities delivered as a service Offloading & simplifying the management of customer profiles, opt- ins, logins and registrations while de- siloing identity architecture Protecting & securing end user data and password INTRODUCING: AKAMAI IDENTITY CLOUD Formally Janrain
ECONOMY • 3.8B out of 7.5B people are digitally connected • 5M mobile applications • 1.2B websites • 6.4B connected things MARKETING TO ONE • 4000 marketing companies in 49 categories • Multiple views of customer • Unpersonalised campaigns DATA GOVERNANCE • 1000s of silos of customer data • 100s of consumer data protection regulations • Up to 4% WW annual turnover in penalties for non- compliance IDENTITY SECURITY • 4.5M breached identities per day • 7B breached identities since 2013 • >80% f/bad actors • >60% f/compromised credentials
engagement and brand loyalty Secure your customer identities & protect against identity fraud Identity Cloud consists of three key functions delivered as a service: Optimise user experience & marketing efforts Manage your online customer identities HOW IDENTITY CLOUD HELPS Understanding Customer Identity and Access Management
Offload authentication and self-registration • Reduce friction allowing consumers to bring their own identity (e.g social) • Allow customers to move seamlessly across properties • Flexible user experience • Customer Support Representative Screens
trust • Ability to lock down data access by attribute and application • Standards compliant, working against vendor lock in • Strong Customer Authentication SECURING Your online customer Identities ABAC Authorisation Secure Edge
Store • Ability to store attributes without compromise • Identity Analytics • Internationalisation and version control OPTIMISING Your online customer experience Identity Consent Profile Identity Analytics
Sustained performance during high-traffic events Secure Edge circumventing millions of attacks Broadest compliance with certifications & attestations Identity proofing services Flexible directory schema . Fine-grained privacy & data governance Bulk and event- driven data integrations Real-time data identity analytics API-centric for App Developers THE IDENTITY CLOUD DIFFERENCE What sets Akamai apart from the competition?
owner • Offload and simplify—offload identification to the edge, put your identity store in the cloud, de-silo your identity architecture, and simplify access policy enforcement • Better performance / security for your IAM infrastructure Security owner • Compliance with GDPR and other regional data privacy regulations • Better security for your end users—strong data protection, threat intelligence to detect account compromise, behavioral analysis to detect automated attacks Business owner • Improve end user experience—better performance, less unnecessary friction, and a more personalised experience • Improve revenues through better cross sell and upsell with better customer insight
consumer spending Household Clothes Health First 20 Years Next 20 Years £30tr Personalised Drugs Netflix / Food delivery Grocery delivery Autonomous Cars Buying properties Listings, mortgage comparison Tickets Restaurant reviews Symptoms New Kinds of Business
£ £ £ £ £ £ £ £ £ Homegrown Solution Can’t Tailor Campaigns Marketing to One or Many? Adding New Channels Takes Months Multiple Logons (Friction) Multiple Data Stores Can’t See Trends No Identity Platform….Is this the Impact on Your Business?
to Cardless Customer Loyalty SaaS Platform Reduced Security Footprint Easier GDPR Compliance Cleaner Data Collection API First Business New Channels Instantaneously Single View of Change
zlatchfo
frankvandijk
katarinadahlin
morganepeng
skoyamalab
uxyall
marktimemedia
lemiorhan
aleyda
nikkihalliwell
addyosmani
ammeep
![[email protected]](https://files.speakerdeck.com/presentations/eafc8e16c13043418870d64f773ba3e9/slide_74.jpg){kind=link}
