Modern Cybercriminals Don't Hack In, They Log In
summary
The talk covers identity-focused attacks where attackers use leaked OAuth tokens, session cookies, or social-engineering at call centers to log in as legitimate users. It presents ways to strengthen identity policies by adding second-factor authorization (including Web3-adapted factors) and discusses preparing authentication mechanisms for post-quantum cryptographic threats.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 3:30Cibercriminales login only
- 5:59Secure company example
- 8:07SMS email false security
- 10:13Targeted attacks public info
- 12:45Email phishing 2025
- 13:49QR code attacks
- 16:40Tabnabbing session theft
- 18:24Tabnabbing demo
- 23:18Shoulder surfing Starbucks
- 24:40AI voice fraud
- 27:28Voice cloning fraud
- 29:57Pasquis passwordless auth
- 31:20Pasquis limitations
- 34:06Turing test humanity
- 37:18Digital identity evolution
- 40:27Authorization missing link
- 42:55Bank authorization example
- 43:57OpenID Connect risks
- 45:00Copilot document access
- 46:46Granular auth LATS
- 47:47Conclusion
related talks
16mInnovation in Authentication and More
37mCustomer Identity for Modern Apps and APIs
45mApplying Past Lessons for Intel-Driven Identity Threat Detection
40mModern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?
44mWhen Cybersecurity Is Not Just About Vulnerabilities
26mIntegrating Identity and Fraud
50mHacking Humans : Social Engineering Techniques and How to Protect Against Them
40mWeb Attacks and Fraud: Lessons Learned from the Deep End of the Pool