Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

breachinsider.com

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#31

Post by robotcookies »

Dictionary makers used to do something similar. They would make up words to detect if a competitor was copying them. Map makers before the internet also did this- make up places to detect copying.

I don't know if they still do this. I haven't seen a physical dictionary in a while. Now with online maps and navigation I don't think map data providers can afford the risk of a navigation system misdirecting someone due to an imaginary place.

But it's possible some of these things took a life of their own. Say someone saw a made up word and started using it because they thought it was real. Or a made up park name for an open area led someone to start using it and others to start calling it that. I don't know if that actually happened but it's possible.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#32

Post by Gaelan »

robotcookies wrote: post #31

Dictionary makers used to do something similar. They would make up words to detect if a competitor was copying them. Map makers before the internet also did this- make up places to detect copying. I don't know if they still do this. I haven't seen a physical dictionary in a while. Now with online maps and navigation I don't think map data providers can afford the risk of a navigation system misdirecting someone due t…

There was a story on here a while back about such a label actually spawning a small town.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#33

Post by pierrec »

Gaelan wrote: post #32
robotcookies wrote: post #31

Dictionary makers used to do something similar. They would make up words to detect if a competitor was copying them. Map makers before the internet also did this- make up places to detect copying. I don't know if they still do this. I haven't seen a physical dictionary in a while. Now with online maps and navigation I don't think map data providers can afford the risk of a navigation system misdirecting someone due t…

There was a story on here a while back about such a label actually spawning a small town.

https://news.ycombinator.com/item?id=10324499

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#34

Post by haggy »

5706906c06c wrote: post #29

I did a similar implementation in production using DigitalShadows. We basically created "honeywords" in the database at random, and then had DS monitor for those out in the wild. That included random lines in the source code that didn't do anything other than be used as IoCs.

This seems miserable to maintain. I feel like maintaining a code base with code in it that is simply there to be grepped in the wild would make it incredibly messy.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#35

Post by graystevens »

JimDabell wrote: post #14
graystevens wrote: post #5

Earlier quoted context omitted.

Creator here – There are a few ways we can detect a breach/leak using our Insiders. 1. The unique email address assigned to the Insider is contacted. We gather forensic evidence of the email along with any attachments. Useful to identify specific attacks against your users too. 2. An optional real mobile number assigned to your Insider is contacted. Again, we store all of the details, including the original SMS detai…

Any plans to work with credit bureaus? I just mentioned last week[0] that credit checks against canary records could be an effective way to combat identity theft. [0] https://twitter.com/JimDabell/status/935433996787384320

Would love to – We have quite a few cool features and interesting link ups that we would love to do, and this is certainly one of them.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#36

Post by tga »

gesman wrote: post #20

Any email or mobile number can and will receive spam. So you need your system to check every spam email, call and text and decide whether it’s a breach or spam.

I wouldn't expect a non dictionary secret email address to receive any traffic.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#37

Post by rpedela »

snowwolf wrote: post #11

Somewhat related, but anyone have any best practices or can recommend a service to protect your users who have been pwned in another sites data breach? Rate limiting login attempts for an email address or ip address is all well and good for protecting against brute force attacks, but when the attacker has the correct email and password combination already for the user, and access to massively distributed botnets, how…

AWS Cognito just announced some security features to help with that.

https://aws.amazon.com/about-aws/whats-new/2017/11/announcin...

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#39

Post by ExactoKnight »

eganist wrote: post #10

There's value here in detection of a breach that's already been monetized, but this isn't in the kill chain; it's long-after, so it appears reactive-only. Why should a non-massive company implement this rather than boosting and refining centralized logging and monitoring which can, if done right, provide far more immediate (even real time) notification of a breach? Your Wells Fargos of the world might do it because t…

The brilliance of this service is they don't even need to do any real work in keeping their dictionary that up to date, and they've been given a license to print money.

Re: Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

#40

Post by rayuela »

gesman wrote: post #17
norlys wrote: post #15

Earlier quoted context omitted.

I've read something about a method used by online banking services some time ago: They tracked the way the customer moves their mouse, calculated their arm lenghts etc. and when the movements were suspiciously different, the system assumes it's a fraud and logs them out.

I did similar project with Tensorflow. Mouse movements were captured then converted to images and DL model was trained to classify user or not user. It can also classify classes of users I.e. new portal users are moving mouse differently from users who are familiar with portal. To add - by itself it’s not a reliable indicator of yes/no. But rather another risk scoring input to overall identity detection system.

This is actually clever. Thanks for sharing the technique!
Post reply on HN