You Can’t Hide: How a Device Can Give Away a Fraudster’s Secrets.
summary
System detects residential VPNs by reading raw TCP/TLS packet features at layer 4 — spotting consistent MSS cropping (example 1440 → 1378) after replacing the ALB with a network load balancer and a custom packet inspector, and enforces certificate pinning to defeat HTTP proxies. Device re-use is caught by combining selfie liveness checks with photo sensor pattern noise (PRNU) extracted via wavelet denoise and correlation; matches are accelerated with a BK-tree index. Pipeline runs at ~2 billion requests/day and blocks fraudulent payouts.
AI-written summary · about
chapters (7)
- 0:00Fraud detection at Edo
- 5:09Ad fraud impact
- 6:36VPN detection challenges
- 13:22Device identifier resets
- 14:52Face verification for fraud
- 17:04Camera sensor fingerprints
- 27:24Fraud prevention strategies
related talks
37mFraud prevention in the age of online privacy
40mGet Rich or Get Hunted Trying: Uncovering Large Scale Fraud Operations
42mCracking the Code: Decoding Anti-Bot Systems!
38mTunnelCrack: Leaking VPN Traffic by Manipulating Routing Tables
52mFlying Under the Radar - New Security Evasion Techniques
30mNetwork Technocracy: A Tale of Monitoring, Spoofing, Intercepting and Social Engineering
44mNetsec is Dead(?): Modern Network Fingerprinting for...
52mWhere, how, and why is SSL traffic on mobile getting intercepted?