34:55This recording is not available yet.
Categories
Security Operations & Incident ResponseDetection & HuntingIdentity & AccessNetwork Security & Zero TrustSecure Access & SASE
Vendors and tools discussed
About this session
Luke Jennings, VP of R&D at Push Security and a former EDR designer, argues that the industry has moved from a network-perimeter era through an endpoint era into an identity-perimeter era, where attackers log in rather than hack in. He demonstrates a browser-in-the-middle phishing attack against Okta with EvilNoVNC that captures the one-time code and session cookies, then shows what persistence and lateral movement look like in SaaS: personal API keys in Shortcut, Google Drive sharing links, ghost logins in Expensify and a rewritten SAML configuration that turns a trusted app into a watering hole. He explains why EDR, proxies and email gateways see little of this, since the action happens inside the browser and phishing kits abuse anti-bot checks such as Cloudflare Turnstile. The core of the talk is a practical tour of browser extensions as a telemetry and detection layer, with code samples for enumerating extensions, catching HTML-smuggled downloads, logging link observations, clicks and screenshots, querying SaaS APIs in the user's context, and flagging weak passwords. A short Q&A covers managed browsers and password tracking.
In the previous decade we saw a huge pivot to endpoint based attacks, which the security industry was initially ill prepared for. In particular, common intrusion detection approaches of the past had been largely network sensor focused and were not well suited to dealing with endpoint focused attacks. This led to the explosion of endpoint-orientated approaches which eventually led to the creation of the entire EDR market. Fast-forward to the current decade and we are in the midst of a rapid shift towards identity-based attacks and SaaS attack techniques due partly to the increasing difficulty of endpoint attacks and partly to the ever increasing attack surface posed by SaaS usage and spiraling numbers of cloud identities. These attacks rarely touch the endpoint and so security teams are facing a loss of visibility once again. This talk covers what identity attacks are, why browsers are now the frontline, and how browser extensions provide unique detection capabilities, including code examples
Key takeaways
- Treat account takeover as the primary initial-access threat: attacker-in-the-middle phishing and infostealers steal session cookies, so MFA alone does not stop them.
- After an identity compromise, hunt for persistence in downstream SaaS apps (personal API keys, sharing links, secondary login methods, altered SAML settings), not just the IdP session.
- Use a browser extension's background service worker to subscribe to download, navigation and request events; it catches HTML smuggling and phishing kits that evade proxies and link detonation.
- Log link observations, clicks and page screenshots from content scripts so IR can answer who else saw a phishing link, even when it was not delivered by corporate email.
- Query SaaS APIs from inside the user's browser session to surface data admin APIs do not expose, and ship events to your SIEM over HTTP or Chrome native messaging.
Speakers
Luke Jennings
Luke Jennings is a security researcher from the UK. He spent most of his early career focused on red teaming and offensive security research at MWR, before moving on to developing new detection and response techniques and designing EDR software as… Read moreRead less
Luke Jennings is a security researcher from the UK. He spent most of his early career focused on red teaming and offensive security research at MWR, before moving on to developing new detection and response techniques and designing EDR software as the Chief Research Officer for Countercept. He has now pivoted away from the endpoint to focusing on emerging identity attacks as VP of R&D at Push Security.
