Applying Fuzzy Hashing to Phishing Page Identification

•

0 j'aime•217 vues

Adrian Hada in Bucharest, Romania on November 8-9th 2018 at DefCamp #9. The slides and other presentations can be found on https://def.camp/archive

Technologie

1© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
APPLYING FUZZY
HASHING TO
PHISHING PAGE
IDENTIFICATION
Adrian Hada, Senior Security Researcher

2© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
ABOUT ME
• Senior Security Researcher
• Mostly malware & honeypots
• Sometimes phishing
• @ht_adrian

3© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
PHISHING
• We all know what it is
• Users know(?) what it is

4© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
IP/DOMAIN REPUTATION

5© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
VISUAL HASHING

6© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
VISUAL HASHING
Rendering Failures

7© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
VISUAL HASHING
Templates

8© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
PHISHING PROCESS
Template
DeployProfit

9© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
HTML TEMPLATE

10© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
FUZZY HASHES

11© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
CLUSTERING

12© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |

Contenu connexe

Similaire à Applying Fuzzy Hashing to Phishing Page Identification

CASB — Your new best friend for safe cloud adoption?

Digital Transformation EXPO Event Series

Kondo-ing API Authorization

Nordic APIs

Slides from my presentation on personal branding and LinkedIn, delivered 05 June, 2018 at Silicon Slopes in Lehi, Utah. The first part focuses on creating a powerful personal brand that aligns with your business interests. The second part is all about how to make sure your LinkedIn profile is optimized and aligned with your personal brand, how to make meaningful, high quality connections, and create compelling content.

Personal Branding for LinkedIn at Silicon Slopes

Josh Steimle

APIdays London 2019 - Why the Financial Industry Needs Intelligent API Securi...

apidays

Move and Secure Your Data

Delphix

Drupalgeddon 2 – Yet Another Weapon for the Attacker

DefCamp

DBAs are tasked with the most crucial job —protect the data. Secure it, back it up, and ensure production databases are available. DevOps data demands just don’t rank—especially if they crunch production performance. But times are changing. Today’s DBAs are increasingly expected to help refresh growing non-production environments fast and without hiccups or disclosing sensitive fields. It means reevaluating both their role and their processes.

Confessions of a DBA: “I always avoid requests from DevOps” and Other Admissions

Delphix

Confessions of DBA Webinar

Sam Molmud

Webinar: Insights from CYREN's Q1 2015 Cyber Threats Trend Report

Cyren, Inc

Identity Live Sydney 2018 Keynote Presentation

ForgeRock

Cloud Ramps Up at DOD--Here's What You Need to Know

immixGroup

Cisco Girls IT Day

Patrice D'Eramo

As data breaches continue to rise, more and more organizations are realizing they need to do more to protect access to privileged accounts and systems, to mitigate the risk of cyberattacks and meet industry security standards. Cybercriminals are succeeding in fraud techniques such as ransomware and cryptocurrency mining because of lax controls around privileged access. Traditional approaches to privileged access and credential management often leave organizations exposed because their focus is too narrow. This webcast will outline the “Four Pitfalls of Privilege” to highlight some of the most common challenges that organizations face, and how they can address and overcome them.

The Four Pitfalls of Privilege: Defend Critical Accounts & Systems Against Cy...

Bomgar

Join author, speaker, and marketing insights leader Mathew Sweezey to unpack the relentless changes in the marketing automation landscape. See how marketing automation is becoming more contextual for leads that expect customized, just-in-time messaging; more connected across multiple platforms and devices; and more complex. You’ll learn how to leverage Automation 2.0 with tools and strategies that will keep you ahead of these constant changes...and ahead of your competitors. Join this webinar to learn how to: Execute modern messaging: right message, right time, right person Utilize a connected marketing strategy across all channels Master the complexities of marketing automation Put the power of Automation 2.0 on your side

The Future of Marketing Automation is More

Alex Ortiz

Presentación Jeff Brown, HP en VI Summit País Digital 2018

PAÍS DIGITAL

Marketing Your Open Source Project (All Things Open 2018)

Amazon Web Services

DevOps needs to consider many different aspects of software quality, including security. The term DevSecOps was developed to highlight that security is a focus of the pipeline, not a second-class citizen. Fortunately, we can define done for our pipeline so that it includes security. Continuous integration can invoke static analysis tools to test for security errors and check if we are using components with known vulnerabilities. Automated deployments and virtualization make dynamic environments available for testing in a production-like setting. Regression tests can drive traffic through proxies for security analysis. From the code to the systems where we deploy the software, the process can be designed to make sure that we follow security best practices, and not produce insecure software. Participants will learn how to construct a definition of done that focuses on security in a DevOps pipeline. They will see how to define security practices that build confidence that they are doing DevSecOps, and how those practices and criteria might mature over time.

A Definition of Done for DevSecOps

Gene Gotimer

This talk was presented at NoVA UX event on August 21, 2019. One year ago Jim Lane joined Virtru, a data protection and privacy organization in Washington DC, to build out UX as a discipline in a seven-year-old security company. In his talk Jim outlines establishing a charter, hiring a team, establishing user-centered product development process, choosing tools for scale and speed, and design strategy.

Bootstrapping UX

Jim Lane

As security practitioners, we often get caught up worrying about protecting against the latest threat or patching the latest zero-day, however we should spend at least an equal amount of time understanding the data risks of our users and how to offer both better visibility into endpoint data usage, as well as guidance into good data protection practices. There are a number of different products and vendors that touch on these aspects, but there is no one-stop shop for data protection, and likely never will be. DLP, or Data Loss Prevention, can look at known content types for matches and take protective actions. However, most DLP deployments never moved beyond monitoring due to over-blocking or false positive concerns. Endpoint employee monitoring can take good forensic information, even screenshots to recreate evidence of either inappropriate data usage, or other significant events, though these types of technology are often cumbersome, hard to realize the value and present some serious privacy and ethical concerns. EDR or Endpoint Detection and Response is very threat-focused, with a severe limit on data visibility, and often does little more than capture a checksum of a file, with no content inspection or awareness. UEBA, or User and Entity Behavior Analytics, can often be deployed in conjunction with SIEM or log management capabilities to get a better contextual view of your organization, however, you must first have some semblance of “normal” or a baseline before you can uncover abnormal. Organizations should begin building the case for stronger endpoint data visibility. This improved data visibility must be easy to use, fast to provide actionable answers, not impede other endpoint security capabilities, and most importantly provide the financial impact of endpoint data and the decisions that users make with that data.

Making the Case for Stronger Endpoint Data Visibility

dianadvo

Preventing Fraud and Building an End-to-End Data Science Hub at Feedzai with ...

Elasticsearch

Similaire à Applying Fuzzy Hashing to Phishing Page Identification (20)

CASB — Your new best friend for safe cloud adoption?

Kondo-ing API Authorization

Personal Branding for LinkedIn at Silicon Slopes

APIdays London 2019 - Why the Financial Industry Needs Intelligent API Securi...

Move and Secure Your Data

Drupalgeddon 2 – Yet Another Weapon for the Attacker

Confessions of a DBA: “I always avoid requests from DevOps” and Other Admissions

Confessions of DBA Webinar

Webinar: Insights from CYREN's Q1 2015 Cyber Threats Trend Report

Identity Live Sydney 2018 Keynote Presentation

Cloud Ramps Up at DOD--Here's What You Need to Know

Cisco Girls IT Day

The Four Pitfalls of Privilege: Defend Critical Accounts & Systems Against Cy...

The Future of Marketing Automation is More

Presentación Jeff Brown, HP en VI Summit País Digital 2018

Marketing Your Open Source Project (All Things Open 2018)

A Definition of Done for DevSecOps

Bootstrapping UX

Making the Case for Stronger Endpoint Data Visibility

Preventing Fraud and Building an End-to-End Data Science Hub at Feedzai with ...

Plus de DefCamp

Remote Yacht Hacking

DefCamp

Mobile, IoT, Clouds… It’s time to hire your own risk manager!

DefCamp

The Charter of Trust

DefCamp

Internet Balkanization: Why Are We Raising Borders Online?

DefCamp

Bridging the gap between CyberSecurity R&D and UX

DefCamp

Secure and privacy-preserving data transmission and processing using homomorp...

DefCamp

Economical Denial of Sustainability in the Cloud (EDOS)

DefCamp

Trust, but verify – Bypassing MFA

DefCamp

Threat Hunting: From Platitudes to Practical Application

DefCamp

Building application security with 0 money down

DefCamp

Implementation of information security techniques on modern android based Kio...

DefCamp

Lattice based Merkle for post-quantum epoch

DefCamp

The challenge of building a secure and safe digital environment in healthcare

DefCamp

Timing attacks against web applications: Are they still practical?

DefCamp

Tor .onions: The Good, The Rotten and The Misconfigured

DefCamp

Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...

DefCamp

We will charge you. How to [b]reach vendor’s network using EV charging station.

DefCamp

Connect & Inspire Cyber Security

DefCamp

The lions and the watering hole

DefCamp

Catch Me If You Can - Finding APTs in your network

DefCamp

Plus de DefCamp (20)

Remote Yacht Hacking

Mobile, IoT, Clouds… It’s time to hire your own risk manager!

The Charter of Trust

Internet Balkanization: Why Are We Raising Borders Online?

Bridging the gap between CyberSecurity R&D and UX

Secure and privacy-preserving data transmission and processing using homomorp...

Economical Denial of Sustainability in the Cloud (EDOS)

Trust, but verify – Bypassing MFA

Threat Hunting: From Platitudes to Practical Application

Building application security with 0 money down

Implementation of information security techniques on modern android based Kio...

Lattice based Merkle for post-quantum epoch

The challenge of building a secure and safe digital environment in healthcare

Timing attacks against web applications: Are they still practical?

Tor .onions: The Good, The Rotten and The Misconfigured

Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...

We will charge you. How to [b]reach vendor’s network using EV charging station.

Connect & Inspire Cyber Security

The lions and the watering hole

Catch Me If You Can - Finding APTs in your network

Dernier

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Zilliz

Vector Search -An Introduction in Oracle Database 23ai.pptx

Remote DBA Services

💉💊+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHABI}}+971581248768 +971581248768 Mtp-Kit (500MG) Prices » Dubai [(+971581248768**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Maya Whatsapp +971581248768 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971581248768''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971581248768' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Cl

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

Understanding the FAA Part 107 License ..

Christopher Logan Kennedy

presentation ICT roal in 21st century education

jfdjdjcjdnsjd

Effective data discovery is crucial for maintaining compliance and mitigating risks in today's rapidly evolving privacy landscape. However, traditional manual approaches often struggle to keep pace with the growing volume and complexity of data. Join us for an insightful webinar where industry leaders from TrustArc and Privya will share their expertise on leveraging AI-powered solutions to revolutionize data discovery. You'll learn how to: - Effortlessly maintain a comprehensive, up-to-date data inventory - Harness code scanning insights to gain complete visibility into data flows leveraging the advantages of code scanning over DB scanning - Simplify compliance by leveraging Privya's integration with TrustArc - Implement proven strategies to mitigate third-party risks Our panel of experts will discuss real-world case studies and share practical strategies for overcoming common data discovery challenges. They'll also explore the latest trends and innovations in AI-driven data management, and how these technologies can help organizations stay ahead of the curve in an ever-changing privacy landscape.

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc

CNIC Information System with Pakdata Cf In Pakistan

danishmna97

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

Passkeys: Developing APIs to enable passwordless authentication Cody Salas, Sr Developer Advocate | Solutions Architect - Yubico Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...

apidays

Tracing the root cause of a performance issue requires a lot of patience, experience, and focus. It’s so hard that we sometimes attempt to guess by trying out tentative fixes, but that usually results in frustration, messy code, and a considerable waste of time and money. This talk explains how to correctly zoom in on a performance bottleneck using three levels of profiling: distributed tracing, metrics, and method profiling. After we learn to read the JVM profiler output as a flame graph, we explore a series of bottlenecks typical for backend systems, like connection/thread pool starvation, invisible aspects, blocking code, hot CPU methods, lock contention, and Virtual Thread pinning, and we learn to trace them even if they occur in library code you are not familiar with. Attend this talk and prepare for the performance issues that will eventually hit any successful system. About authorWith two decades of experience, Victor is a Java Champion working as a trainer for top companies in Europe. Five thousands developers in 120 companies attended his workshops, so he gets to debate every week the challenges that various projects struggle with. In return, Victor summarizes key points from these workshops in conference talks and online meetups for the European Software Crafters, the world’s largest developer community around architecture, refactoring, and testing. Discover how Victor can help you on victorrentea.ro : company training catalog, consultancy and YouTube playlists.

Finding Java's Hidden Performance Traps @ DevoxxUK 2024

Victor Rentea

EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER

MadyBayot

Strategies for Landing an Oracle DBA Job as a Fresher

Remote DBA Services

Dubai, known for its towering skyscrapers, luxurious lifestyle, and relentless pursuit of innovation, often finds itself in the global spotlight. However, amidst the glitz and glamour, the emirate faces its own set of challenges, including the occasional threat of flooding. In recent years, Dubai has experienced sporadic but significant floods, disrupting normalcy and posing unique challenges to its infrastructure. Among the critical nodes in this bustling metropolis is the Dubai International Airport, a vital hub connecting the world. This article delves into the intersection of Dubai flood events and the resilience demonstrated by the Dubai International Airport in the face of such challenges.

Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf

Orbitshub

Webinar Recording: https://www.panagenda.com/webinars/why-teams-call-analytics-is-critical-to-your-entire-business Nothing is as frustrating and noticeable as being in an important call and being unable to see or hear the other person. Not surprising then, that issues with Teams calls are among the most common problems users call their helpdesk for. Having in depth insight into everything relevant going on at the user’s device, local network, ISP and Microsoft itself during the call is crucial for good Microsoft Teams Call quality support. To ensure a quick and adequate solution and to ensure your users get the most out of their Microsoft 365. But did you know that ‘bad calls’ are also an excellent indicator of other problems arising? Precisely because it is so noticeable!? Like the canary in the mine, bad calls can be early indicators of problems. Problems that might otherwise not have been noticed for a while but can have a big impact on productivity and satisfaction. Join this session by Christoph Adler to learn how true Microsoft Teams call quality analytics helped other organizations troubleshoot bad calls and identify and fix problems that impacted Teams calls or the use of Microsoft365 in general. See what it can do to keep your users happy and productive! In this session we will cover - Why CQD data alone is not enough to troubleshoot call problems - The importance of attributing call problems to the right call participant - What call quality analytics can do to help you quickly find, fix-, and prevent problems - Why having retrospective detailed insights matters - Real life examples of how others have used Microsoft Teams call quality monitoring to problem shoot problems with their ISP, network, device health and more.

Why Teams call analytics are critical to your entire business

panagenda

Dubai, often portrayed as a shimmering oasis in the desert, faces its own set of challenges, including the occasional threat of flooding. Despite its reputation for opulence and modernity, the emirate is not immune to the forces of nature. In recent years, Dubai has experienced sporadic but significant floods, testing the resilience of its infrastructure and communities. Among the critical lifelines in this bustling metropolis is the Dubai International Airport, a bustling hub that connects the city to the world. This article explores the intersection of Dubai flood events and the resilience demonstrated by the Dubai International Airport in the face of such challenges.

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

Orbitshub

How to Troubleshoot Apps for the Modern Connected Worker

ThousandEyes

Following the popularity of “Cloud Revolution: Exploring the New Wave of Serverless Spatial Data,” we’re thrilled to announce this much-anticipated encore webinar. In this sequel, we’ll dive deeper into the Cloud-Native realm by uncovering practical applications and FME support for these new formats, including COGs, COPC, FlatGeoBuf, GeoParquet, STAC, and ZARR. Building on the foundation laid by industry leaders Michelle Roby of Radiant Earth and Chris Holmes of Planet in the first webinar, this second part offers an in-depth look at the real-world application and behind-the-scenes dynamics of these cutting-edge formats. We will spotlight specific use-cases and workflows, showcasing their efficiency and relevance in practical scenarios. Discover the vast possibilities each format holds, highlighted through detailed discussions and demonstrations. Our expert speakers will dissect the key aspects and provide critical takeaways for effective use, ensuring attendees leave with a thorough understanding of how to apply these formats in their own projects. Elevate your understanding of how FME supports these cutting-edge technologies, enhancing your ability to manage, share, and analyze spatial data. Whether you’re building on knowledge from our initial session or are new to the serverless spatial data landscape, this webinar is your gateway to mastering cloud-native formats in your workflows.

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Safe Software

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

Edi Saputra

Three things you will take away from the session: • How to run an effective tenant-to-tenant migration • Best practices for before, during, and after migration • Tips for using migration as a springboard to prepare for Copilot in Microsoft 365 Main ideas: Migration Overview: The presentation covers the current reality of cross-tenant migrations, the triggers, phases, best practices, and benefits of a successful tenant migration Considerations: When considering a migration, it is important to consider the migration scope, performance, customization, flexibility, user-friendly interface, automation, monitoring, support, training, scalability, data integrity, data security, cost, and licensing structure Next Wave: The next wave of change includes the launch of Copilot, which requires businesses to be prepared for upcoming changes related to Copilot and the cloud, and to consolidate data and tighten governance ShareGate: ShareGate can help with pre-migration analysis, configurable migration tool, and automated, end-user driven collaborative governance

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

sammart93

MS Copilot expands with MS Graph connectors

Nanddeep Nachan

Dernier (20)

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Vector Search -An Introduction in Oracle Database 23ai.pptx

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

Understanding the FAA Part 107 License ..

presentation ICT roal in 21st century education

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

CNIC Information System with Pakdata Cf In Pakistan

Boost Fertility New Invention Ups Success Rates.pdf

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...

Finding Java's Hidden Performance Traps @ DevoxxUK 2024

EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER

Strategies for Landing an Oracle DBA Job as a Fresher

Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf

Why Teams call analytics are critical to your entire business

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

How to Troubleshoot Apps for the Modern Connected Worker

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

MS Copilot expands with MS Graph connectors

Applying Fuzzy Hashing to Phishing Page Identification

Recommandé

Recommandé

Contenu connexe

Similaire à Applying Fuzzy Hashing to Phishing Page Identification

Similaire à Applying Fuzzy Hashing to Phishing Page Identification (20)

Plus de DefCamp

Plus de DefCamp (20)

Dernier

Dernier (20)

Applying Fuzzy Hashing to Phishing Page Identification