Presented at
Black Hat Asia 2017,
March 31, 2017, 3:30 p.m.
(30 minutes)
<div>One of the central points of failure is an email address. We use email addresses used to get access to our bank accounts, social networks and much more. For SMB and Enterprise, email addresses are the most often targeted entry point for advanced persistent threat (APT) attacks.</div><div><br></div><div>But how good are we are at protecting our email accounts? </div><div><br></div><div>There's always a compromise between security and usability. There were times when you would need to obtain all the information about smtp/pop/imap servers and enter them in order to configure your email account. Now it is as simple as just typing your email and password. But when you rely on technology that simplifies your life, it is always complex and sophisticated inside and there is always a huge risk of failure in implementation. chance of failure to implement it.</div><div><br></div><div>In our presentation we will disclose severe vulnerabilities of mail clients as well as software services that could lead an attacker to take over access to sensitive user information - sometimes including usernames and passwords. </div><div><br></div><div>We'll also demonstrate how improper email client implementation can leak user credentials and what software developers, server administrators and users can do to prevent it.</div><div><br></div><div>Attendees will see a live data feed with popular email client names and who's leaking what. At the final part of our presentation we'll talk about other attacks and what power attackers can potentially get in the case of vulnerable client implementations.</div>
Presenters:
-
Maxim Goncharov
- Senior Threat Scientist, Shape Security
Maxim Goncharov is a Threat Analyst with 15 years working experience in the field of computer security. He is currently a Senior Threat Scientist at Shape Security. He is equipped with knowledge in research and development of threat analytics systems, producing white papers based on research work and presenting these research results at security conferences. Maxim participates as speaker at various security conferences and training seminars regarding the topic of cybercrime and related issues (e.g.cyberterrorism, cybersecurity, underground economy, etc.), like PacSec,Power of Community, DeepSec, VB, APWG. He performs underground research and the development of secure analytics tools are some of the most important parts of his day- to-day work.
-
Ilya Nesterov
- Engineering Manager, Shape Security
Ilya Nesterov is currently an engineering manager at Shape Security. Prior to Shape, Ilya worked at F5 Networks, and earned his master's degree from Tomsk Polytechnic University. His interests include, but are not limited to, modern Web Application security threats and countermeasures, botnets, malware infrastructure, exploits and honeypot development. Ilya also works as an independent security researcher and is a speaker on security topics.
Links:
Similar Presentations: