Threatmetrix Cybersource Epayments Summit 2009
This document was uploaded by user and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this DMCA report form. Report DMCA
Overview
Download & View Threatmetrix Cybersource Epayments Summit 2009 as PDF for free.
More details
- Words: 455
- Pages: 9
Online Fraud Prevention Technology Trends
Title Page Picture Representing Topic
Alisdair Faulkner VP Products ThreatMetrix, Inc.
Evolution of Online Fraud Attacks • In 2007 11% of influenza viruses were found to be resistant to Tamiflu • One year later, 99% were found to be resistant What does this mean for fraud in next 2-3 years?
Compromised Identities and Devices: a ‘perfect storm’
You can’t trust the person if you can’t trust the device – – – –
12 million active 200 million profiled 100,000 new devices per day Global top-3 countries • US • China • Brazil
– Compromised PCs used to steal Credit Card details – What’s new is that botnet drones are also facilitating transactions Botnets and Proxies make IP Velocity and Geolocation Ineffective
Case Study: Voice Top-Ups With IP Intelligence [Fraud stopped on 5th try] Created 12/9/2008 5:28 12/9/2008 5:26 12/9/2008 5:24 12/9/2008 5:22 12/9/2008 5:19
Account Login lehung truyen2 truyen4 hungkt16 jtungss
IP Address 216.127.92.39 216.127.92.39 216.127.92.39 216.127.92.39 216.127.92.39
IP Geo US US US US US
Cookies Enabled no no no no no
Javascript Enabled no no no no no
Payment Dollars 20 20 20 20 20
Payment Currency usd usd usd usd usd
Payment Response Reject Accept Accept Accept Accept
With Device Intelligence [Fraud Stopped 1st time] Created 12/9/2008 5:28 12/9/2008 5:26 12/9/2008 5:24 12/9/2008 5:22 12/9/2008 5:19
Account Login lehung truyen2 truyen4 hungkt16 jtungss
Device ID cc4fa496c54511dd800000163e119596 cc4fa496c54511dd800000163e119596 cc4fa496c54511dd800000163e119596 cc4fa496c54511dd800000163e119596 cc4fa496c54511dd800000163e119596
Proxy Ip 216.127.92.39 216.127.92.39 216.127.92.39 216.127.92.39 216.127.92.39
Proxy Ip Geo US US US US US
Proxy Type hidden hidden hidden hidden hidden
True IP 58.187.21.118 58.187.21.118 58.187.21.118 58.187.21.118 58.187.21.118
True Ip Geo VN VN VN VN VN
Technology Comparison
Different ways to detect proxies? Techniques to identify devices?
True IP and Instant Proxy Identification Standard Proxy Attribution
Instant Proxy Attribution
IP Reputation
Proxy Bypass True IP / True Geo TimeZone / Geo HTTP Fingerprinting TCP/IP Fingerprinting Packet Fingerprinting Content Encoding
• Net of capture problem • IP address moving target • Easy to subvert • First-time protection • Instantaneous detection • Risk classification • Hard to subvert
Packet-Level Device Identification
Standard Identification
Deep Packet Inspection
Browser Profiling Browser Tagging IP Geolocation
LE B I RT E BV U S 210.123.30.15
Proxy Bypass Subversion Resistant True IP / True Geo TimeZone / Geo HTTP Fingerprinting TCP/IP Fingerprinting CPU Time-stamping Botnet Detection IP Forensics Real-Time Matching Strategies
Considerations How should you be thinking about the composition of technologies as you evolve your operations? • • • • •
No silver bullet Device identification requires a holistic view of the device Look for real-time solution Subversion resistant Flexible and able to integrate with existing work flow
Title Page Picture Representing Topic
Alisdair Faulkner VP Products ThreatMetrix, Inc.
Evolution of Online Fraud Attacks • In 2007 11% of influenza viruses were found to be resistant to Tamiflu • One year later, 99% were found to be resistant What does this mean for fraud in next 2-3 years?
Compromised Identities and Devices: a ‘perfect storm’
You can’t trust the person if you can’t trust the device – – – –
12 million active 200 million profiled 100,000 new devices per day Global top-3 countries • US • China • Brazil
– Compromised PCs used to steal Credit Card details – What’s new is that botnet drones are also facilitating transactions Botnets and Proxies make IP Velocity and Geolocation Ineffective
Case Study: Voice Top-Ups With IP Intelligence [Fraud stopped on 5th try] Created 12/9/2008 5:28 12/9/2008 5:26 12/9/2008 5:24 12/9/2008 5:22 12/9/2008 5:19
Account Login lehung truyen2 truyen4 hungkt16 jtungss
IP Address 216.127.92.39 216.127.92.39 216.127.92.39 216.127.92.39 216.127.92.39
IP Geo US US US US US
Cookies Enabled no no no no no
Javascript Enabled no no no no no
Payment Dollars 20 20 20 20 20
Payment Currency usd usd usd usd usd
Payment Response Reject Accept Accept Accept Accept
With Device Intelligence [Fraud Stopped 1st time] Created 12/9/2008 5:28 12/9/2008 5:26 12/9/2008 5:24 12/9/2008 5:22 12/9/2008 5:19
Account Login lehung truyen2 truyen4 hungkt16 jtungss
Device ID cc4fa496c54511dd800000163e119596 cc4fa496c54511dd800000163e119596 cc4fa496c54511dd800000163e119596 cc4fa496c54511dd800000163e119596 cc4fa496c54511dd800000163e119596
Proxy Ip 216.127.92.39 216.127.92.39 216.127.92.39 216.127.92.39 216.127.92.39
Proxy Ip Geo US US US US US
Proxy Type hidden hidden hidden hidden hidden
True IP 58.187.21.118 58.187.21.118 58.187.21.118 58.187.21.118 58.187.21.118
True Ip Geo VN VN VN VN VN
Technology Comparison
Different ways to detect proxies? Techniques to identify devices?
True IP and Instant Proxy Identification Standard Proxy Attribution
Instant Proxy Attribution
IP Reputation
Proxy Bypass True IP / True Geo TimeZone / Geo HTTP Fingerprinting TCP/IP Fingerprinting Packet Fingerprinting Content Encoding
• Net of capture problem • IP address moving target • Easy to subvert • First-time protection • Instantaneous detection • Risk classification • Hard to subvert
Packet-Level Device Identification
Standard Identification
Deep Packet Inspection
Browser Profiling Browser Tagging IP Geolocation
LE B I RT E BV U S 210.123.30.15
Proxy Bypass Subversion Resistant True IP / True Geo TimeZone / Geo HTTP Fingerprinting TCP/IP Fingerprinting CPU Time-stamping Botnet Detection IP Forensics Real-Time Matching Strategies
Considerations How should you be thinking about the composition of technologies as you evolve your operations? • • • • •
No silver bullet Device identification requires a holistic view of the device Look for real-time solution Subversion resistant Flexible and able to integrate with existing work flow
Related Documents
Threatmetrix Cybersource Epayments Summit 2009
December 2019 4
Jimmy Stki Summit 2009
May 2020 7
Emktg Summit 2009
June 2020 8
Stki Summit 2009
December 2019 9
Copenhagen Climate Summit 2009
June 2020 19
Global Mental Health Summit,2009
June 2020 3More Documents from "Om Prakash Yadav"
Threatmetrix Cybersource Epayments Summit 2009
December 2019 4