From Cyber Lemons to Lemonade: A Refreshing Take on Exposed Data

The speaker, a former federal agent who now teaches SANS courses, argues that exposed data is already part of attackers' routines. Citing a government analysis of breaches, he notes that valid credentials were the starting point in more than half of them. He covers the legal and ethical questions around breach data, including recent Justice Department guidance that emphasizes intent and passive collection, and explains where he personally draws the line on buying stolen data.

He describes the main categories: raw breach dumps, combo lists of deduplicated credentials, marketing datasets, and infostealer logs taken from infected machines. He reviews where this material is sold or shared, from paid lookup services with limited search to criminal marketplaces selling remote access. For very large files, he recommends command-line tools and building an index with a fast search utility, and he advises caution because stolen data often carries malware.

Real cases show practical uses: matching leaked password hashes to explain a wave of account takeovers, tracing a help desk social engineering attempt to a public breach, and finding a contractor credential and a VPN key in infostealer output so affected organizations could be warned early. He closes by pointing to monitoring, archived web pages, and torrent catalogs as sources, with the takeaway that defenders benefit most by learning about exposure before attackers act.