Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

breachinsider.com

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#21

Post by graystevens »

eganist wrote: post #10

There's value here in detection of a breach that's already been monetized, but this isn't in the kill chain; it's long-after, so it appears reactive-only. Why should a non-massive company implement this rather than boosting and refining centralized logging and monitoring which can, if done right, provide far more immediate (even real time) notification of a breach? Your Wells Fargos of the world might do it because t…

I completely agree that preventative/proactive measures are always going to be better than something retrospective such as my service (although I’d argue that they complement each other nicely, of course).

In terms of why a mid-sized SaaS should go this route - I would like to think that Breach Insider is a slightly more cost-effective option. To do detection and correlation properly, you’re looking at a SIEM with the right logs and hopefully some well formed rules. However at this stage, I’d argue that to get the absolute most out of this, you’re looking at supporting & monitoring this with at least one dedicated employee, else all those logs will be wasted.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#22

Post by graystevens »

gesman wrote: post #20

Any email or mobile number can and will receive spam. So you need your system to check every spam email, call and text and decide whether it’s a breach or spam.

Completely agree, and that’s why our email addresses are formed in a way which shouldn’t be bruteforced/guessed to help reduce this. We’ve purchased a handful of our own domains that we monitor, rather than relying on any other suppliers.

In terms of mobile numbers, they are definitely prone to this, and that is why we make them optional - depends if you want to risk any false positive alarms. Some countries are more prone than others - US mobile get reused a lot it seems!

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#24

Post by graystevens »

JorgeGT wrote: post #9

This is a good idea. My only suggestion would be to whitelist addresses only, not domains, since it is sadly not uncommon that an email account is compromised, especially at large orgs.

That’s a very valid point - whitelisting DKIM domains was the quickest option as it is easily parsed and verified. Will certainly look into this.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#25

Post by graystevens »

voiper1 wrote: post #12

Any integration with Troy Hunt's haveibeenpwned to get notice from him?

That’s on the roadmap, as Troy sometimes get breaches personally handed to him. Ideally I’d like to be the one detecting the first of course :)

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#26

Post by erichurkman »

snowwolf wrote: post #19
chillydawg wrote: post #13

Earlier quoted context omitted.

You email the account owner and tell them they've tried to login from somewhere new and ask for their permission to allow the login. If the email has already been pwned, then, well...I don't know, it's game over really.

That does kind of confirm to the attacker that the credentials are valid on your system though. And do you do this for every different IP? Kind of annoying for users with dynamic IPs.

Every site (with a few rare exceptions) lets you confirm whether an email is a real account or not. You can block the reset password and login flows ("If you've entered a valid email address, we will email you instructions to reset your password" / "Your username and/or password is incorrect").

But every site still exposes it during the sign-up process ("You already have an account. Login here >"). Hiding it during the login flow is largely security theater leading to a poor user experience making people guess & check which email address they used for your service.

If you cannot do more advanced risk analysis: a) email the user after a few failed attempts, b) lock the account down for a period of time, c) lock that IP out from attempting any logins for a period of time, and most importantly, d) monitor lock outs. If an account is getting locked out frequently, be proactive and reach out. 99 out of 100 times it's the user struggling with things like your password requirements, but 1 out of 100 it might be an attacker.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#28

Post by macNchz »

mikejarema wrote: post #16
noja wrote: post #4

Cool. Like canary passwords but for identities. Not enough use of canary passwords people!

A quick Google didn't yield much for "canary passwords", but it sounds like monitoring for passwords as opposed to user email/details as described in the OP. Care to shed a bit more light on what you mean here and how to effectively use them?

I think he’s referring to the idea of having fake users in your database whose passwords should never be used to sign in. Someone successfully signing in with one of those accounts indicates that your user account credentials have been compromised.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#29

Post by 5706906c06c »

I did a similar implementation in production using DigitalShadows. We basically created "honeywords" in the database at random, and then had DS monitor for those out in the wild. That included random lines in the source code that didn't do anything other than be used as IoCs.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#30

Post by graystevens »

betatim wrote: post #27

Pretty cool idea. How long does it normally take for an alarm to happen after an email is sent to the insider's email address? I just emailed my insider about 5min ago and there is no alarm yet.

It should alert as soon as it hits our mail servers - let check its route and see what happened for you.. apologies.

Edit: Bug fixed, really sorry about that! I've sent an email to the insiders address, to give you an example alert.

Post reply on HN