Keynote: Lessons From 11 Billion Breached Records
summary
Creator of Have I Been Pwned processes 11 billion records and now accepts data from FBI, HTCU and BKA, cataloguing incidents such as TalkTalk’s £77M impact tied to a 17‑year‑old, a 2.7 billion combo list (Collection #1) of email:password pairs, and a 1.3M Australian Red Cross dump including blood types. Security gaps include an insecure direct object reference in a kids’ GPS watch API that lets attackers enumerate families and enable remote listening enabled on children’s devices, plus trivial failures like a biometric padlock removable by one screw.
AI-written summary · about
chapters (17)
- 0:00Introduction to HIBP
- 2:22Data breaches and HIBP growth
- 6:01Law enforcement data
- 6:54Perception vs reality of hackers
- 10:55The TalkTalk breach example
- 13:47Low-hanging fruit security
- 16:42Data footprint and sensitivity
- 18:33History of passwords
- 21:54Password complexity issues
- 25:38Modern password guidance
- 28:16Credential stuffing and education
- 30:15Phishing and legit communication
- 32:56IoT security example
- 36:08API vulnerabilities
- 39:04Demo of API exploit
- 41:41Insecure devices
- 43:30Responsible disclosure challenges
related talks
48mLessons From Billions of Breached Records
47mLessons From Billions of Breached Records
57mLessons From Billions of Breached Records
59mInside the Breach: Secrets Exposed
01h 00mKeynote: How I Met Your Data
01h 02mI’m Pwned. You’re Pwned. We’re All Pwned
01h 00mHack to the Future
25mTopics of Interest: An Attackers View on APAC's 2021 Three Major Breaches