Phish-Back: How to turn the problem into a solution

The talk opens with the problem of stolen credentials, which remain a leading initial access route despite security training, phishing simulations, dark web monitoring and MFA. The speaker, a former SOC manager, describes an incident in which a handful of employees gave up valid logins to a phishing email, and attackers then reached a newly opened subsidiary that had not enabled MFA, all within about a day.

The proposed countermeasure, called Phish-Back, places a convincing decoy login portal among the real VPN gateways so that attackers who test stolen credentials against it reveal themselves early. The main difficulties are making the decoy pass fingerprinting by internet scanners, which compare response hashes, headers and page structure, and reproducing the exotic endpoints, languages and HTTP methods that a real product exposes. The speaker also stresses choosing a domain name that blends into the target's external footprint, and filtering the heavy background noise of internet traffic with checks such as password policy, name patterns, leaked-password lookups and validation against the directory before any account is reset.

Across roughly 50 portals deployed at about 20 large organisations over a year and a half, the speaker reports 2.3 billion login attempts and 257 valid credentials that had no dark web exposure. The takeaway is that the approach only works with careful execution and strict filtering, and that dark web monitoring alone is far from exhaustive.