The Hacker's Guide to NOT Getting Hacked

The Hacker’s Guide to
NOT Getting Hacked
Jakub Kaluzny

About Me
▪ Sucked at games, started hacking
▪ Maths & Algo background
▪ Dev at European Space Agency
▪ Security Consultant in EU and AU
▪ Sometimes I have interesting
projects:
▪ Printers, ATMs
▪ FOREX trading software
▪ Online banking systems
▪ Voice biometrics
▪ Published research at BlackHat,
HackInTheBox, OWASP AppSec,
Zeronights, AusCERT, BSides

Attack surface – WHERE
Threat modelling – WHAT
Threat actors - WHO
Attack vectors – HOW
MITIGATION
Using phone in cafes
Phone theft
Opportunistic pickpocketer
Pick it up when you go to the toilet
KEEP THE PHONE WITH YOU
Threat Modelling

Your assets
▪ Devices:
▪ Phone
▪ Computer
▪ IoT
▪ Home router
▪ Accounts:
▪ SIM card
▪ Mail
▪ Social Media
▪ Bank
▪ Finances:
▪ Bank
▪ Paypal / similar
▪ SIM credit line
▪ Amazon/Uber/Netflix/any
service
▪ Information / Identity:
▪ Documents, scans
▪ Private data / nudes

OPPORTUNISTIC
Most threats are

Level of paranoia
99% people
▪ Log in to their bank
account on a public
computer
▪ Have one password
▪ Travel to China, use
public wi-fi,
▪ Leave phone & wallet on
the beach, enjoy a swim
Security conscious
▪ Log in to their bank only
on phone / their own
computer
▪ Use password manager
▪ Keep their phone with
them all time
▪ Take only one card and
use a phone cheap
enough to not cry when
you loose it
Security paranoid
▪ Use 2-FA, distribute
money between multiple
accounts
▪ Use 30-char passwords
▪ Take a burner phone,
destroy it afterwards
▪ Don’t go further than 5
seconds from the bag

Your assets
▪ Devices:
▪ Phone
▪ Computer
▪ IoT
▪ Home router
▪ Accounts:
▪ SIM card
▪ Mail
▪ Social Media
▪ Bank
▪ Finances:
▪ Bank
▪ Paypal / similar
▪ SIM credit line
▪ Amazon/Uber/Netflix/any service
▪ Information / Identity:
▪ Documents, scans
▪ Private data / nudes
▪ OTHER
▪ Your brain

General scams/hacks
▪ Buying crypto wallets on ebay
▪ SMS, phone call
▪ Fake anti-virus scam
▪ Fake ads on ATM
▪ Gumtree
▪ Fake hacked webcam
▪ Fake FB/Tinder nudes
▪ Premium line call back
▪ Facebook - friends asking for money
▪ Ebay hijacked accounts
▪ FBI / police locking your computer
▪ “top Google ad" scam

General scams/hacks
▪ SMS, phone call
▪ Fake ads on ATM
▪ Gumtree
▪ “top Google ad" scam
▪ lost phone scam - check location

General scams/hacks
▪ SMS, phone call
▪ Fake ads on ATM
▪ Gumtree
▪ “Top Google ad" scam

General scams/hacks
▪ SMS, phone call
▪ Fake ads on ATM
▪ Gumtree
▪ “Top Google ad" scam
▪ lost phone scam - check location

PHONE threats
▪ THROW AWAY OLD PHONES
▪ DO NOT GIVE IT TO YOUR GRANDMA

PHONE threats
▪ NEVER INSTALL APPS FROM UNKNOWN SOURCES

PHONE threats
▪ If you do, check the permissions

PHONE threats
▪ DO NOT CONNECT TO PUBLIC WIFIS

PHONE threats
This is NOT a Tesla hack:
▪ Tricked Android 4.4 user to
connect to fake McD Wi-Fi
▪ Redirected him to a fake
website
▪ Tricked him into installing
malicious app from
unknown sources
▪ The app used a public
exploit toolbox (Kingroot)
to root Android 4.4 device

PHONE threats
▪ Enable backups
▪ Enable screenlock!
▪ Enable encryption!!

My other computer is your
computer
COMPUTER threats

COMPUTER threats
▪ Keep it up-to-date
▪ Use AV

COMPUTER threats
▪ Never install dodgy programs
▪ If unsure, use VirusTotal.com

COMPUTER threats
▪ Don’t connect to public Wi-Fis
▪ Never ignore security warnings
▪ Use VPN

COMPUTER threats
▪ Have backups
▪ Use full-disk encryption
▪ Lock workstation
▪ Have a strong password

COMPUTER threats
▪ Never plug in dodgy USB sticks

IOT THREATS
Why would anyone need a smart…

ROUTER threats
▪ Keep it up-to-date
▪ Choose WPA2 for Wi-Fi security
▪ Don’t share passwords

ACCOUNTS THREATS
“Give a man an 0day and he'll have access for a day, teach a man to phish and he'll
have access for life” – @thegrugq

ACCOUNTS threats
▪ Make a list of all your important accounts
▪ USE A PASSWORD MANAGER
The top 10 passwords on the 2017 list:
▪ 1. 123456 (Unchanged)
▪ 2. Password (Unchanged)
▪ 3. 12345678 (Up 1)
▪ 4. qwerty (Up 2)
▪ 5. 12345 (Down 2)
▪ 6. 123456789 (New)
▪ 7. letmein (New)
▪ 8. 1234567 (Unchanged)
▪ 9. football (Down 4)
▪ 10. iloveyou (New)

ACCOUNTS threats
▪ Do not reuse passwords

ACCOUNTS threats
Hardware
token
SMS Push U2F Biometrics No 2-FA
Password guess
/ theft
OK OK OK OK OK NO
Phishing ~NO ~NO OK ~OK ~OK NO
PC Malware NO ~OK ~OK ~NO ~NO NO
Phone Malware OK NO ~NO OK ~NO NO
SIM hijacking OK NO ~OK OK ~OK OK
OK GOOD VERY GOOD VERY GOOD ~OK NOT GOOD

ACCOUNTS threats
▪ For financial accounts: device with a screen - mobile push notifications (very good) or SMS
(good)
▪ For all other: U2F (very good), SMS (good)

ACCOUNTS threats
▪ If you are redirected to log in screen, check domain

ACCOUNTS threats
▪ Hack yourself: regularly go through forgotten password functionality

The system is as weak as its
weakest link
SIM card

SIM card threats
▪ Set additional security features
▪ Do not use and disable insecure features – sending and receiving messages via web
▪ Understand that sender (and caller) ID may be spoofed

SIM card threats
▪ Set SIM card PIN (stolen phone)
▪ Enable limits
▪ Disable premium services

With great power comes great
responsibility
MAIL threats

MAIL threats
▪ Usually e-mail access is enough to recover passwords to other services

Mail threats
▪ Confirm actions via second channel

Social media threats
▪ Don’t allow dodgy games / apps access your data
▪ Don’t publish pictures of your credit card
▪ Don’t trust strangers

ALWAYS CHECK AMOUNT AND
BENEFICIARY NUMBER
Bank account threats

▪ Enable alerts
▪ Check balance regularly
▪ Check access via other channels
▪ Keep bigger money on a separate account

▪ Set limits – for transactions, credit card, mobile payments
▪ Change credit card regularly
▪ Prefer to pay in cash, especially overseas
▪ Never let the waitress go away with your card

▪ Online shopping: use a separate card – a pre-paid with limits
▪ There is chargeback
▪ Pay via trusted gateways – e.g. paypal, rather than directly
▪ Do not enter your banking password on any website (POLi, Trustly) other than the bank itself

▪ Consider 3rd parties for alerting and monitoring… Nah

Other services threats
▪ Netlifx / Amazon / Uber etc. – keep track of those
▪ Change cards regularly

Identity threats
▪ Watermark scans
▪ Upload via webform, do not send via e-mail
▪ Paranoid: change ID regularly

Identity threats
▪ Do not keep scans, sensitive documents, nudes etc. online
▪ Encrypt them

Travel safe AND secure
Travel security

Travel security
▪ Do not use public chargers
▪ Consider a polarizing screen
▪ Cover your keyboard when typing passwords

Summary
Define attack
surface
Model
threats
Define level
of paranoia
Apply
changes
Review
regularly

The Hacker's Guide to NOT Getting Hacked

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (8)

Similar a The Hacker's Guide to NOT Getting Hacked

Similar a The Hacker's Guide to NOT Getting Hacked (20)

Más de Jakub Kałużny

Más de Jakub Kałużny (8)

Último

Último (20)

The Hacker's Guide to NOT Getting Hacked