programming-talkscurated list on GitHubRecommends
Under “Security”
Ichthyology: Phishing as a Science 00:24:28 by **Karla Burnett** (2017) A
0:00 / 0:00
#phishing#socialengineering#blackhat
Ichthyology: Phishing as a Science
Black Hat
281K subscribers • 47 videos on Hallway • Conference channel
- Recommended by 4 people: 3 on Hacker News and 1 curated list.
- A classic. People kept recommending it from 2019 to 2025.
- Presented by Karla Burnett, security engineer
Intermediate. Assumes working knowledge.
37K views9 years ago4 recommendations
SecurityWeb and application securityExploits and vulnerabilities
Karla Burnett presents real-world phishing campaigns run against a tech company, analyzing bypass techniques and evidence-based prevention methods.
In this talk we'll cover the psychology of phishing, then walk through a series of real-world attacks conducted against a Bay Area tech company - including conversion rates for each attack, and ways in which existing protections were bypassed. We'll cover recent technological advancements in this area, then combine these with our case studies to provide evidence-based techniques on how to prevent, not just mitigate, credential phishing. By Karla Burnett Full Abstract & Presentation Materials: blackhat.com/us-17/briefings.html#ichthyology-phishing-as-a-…Why it's here
4 people recommend thisWhat people say. Recommended as an eye-opening talk demonstrating that human training cannot stop phishing, and only hardware security keys work.
dmbaggetton Hacker News • Recommends
On “Should Failing Phish Tests Be a Fireable Offense?”
Phishing is frankly an embarrassment for the mainstream security community. The temptation is to "blame the stupid users" -- but the truth is that even a script kiddie can take a real email from a mainstream brand, "Save As HTML...", change one link, and resend... and snare even sophisticated victims. This BlackHat talk ( link to this video ) shows just how easy it is to phish even users who think they are too good to be fooled. At Inky ( link ) we're using a combination of computer vision, anomaly detection, and domain-specific hacks to identify zero-day phishing emails "from first principles" (as I like to say). And it works! But the pushback from the security establishment is impressive. I like to…
procincton Hacker News • Recommends
On “Can Apple change ads?”
Maybe if you’re referring to regular phishing sure, but spear phishing is specifically designed so it won’t go to your junk email and will look like something made for them personally, there won’t be any spelling mistakes, it will have been sent from a likely email source, it will most likely contain some personal information. The right phish at the right time could catch just about anyone out. There’s a great talk at Black Hat about how Stripe trains staff against these sorts of phishing campaigns and these are highly technical people and they still click the links. link to this video
x0x0on Hacker News • Recommends
On “We all dodged a bullet”
I watched a presentation from Stripe internal eng that was given I forget where. An internal engineer there who did a bunch of security work phished like half of her own company (testing, obviously). Her conclusion, in a really well-done talk, was that it was impossible. No human measures will reduce it given her success at a very disciplined, highly security conscious place. The only thing that works is yubikeys which prevent this type of credential + 2fa theft phishing attack. edit: karla burnette / talk link to this video
SpaethCoon Hacker News • Mentions
On “Google: Security Keys Neutralized Employee Phishing”
This is where it comes down to user behavior. One of the security engineers from Stripe gave a talk about this at Blackhat last year -- she had phishing campaigns that had users ignore that autofill didn't work and manually copied/pasted their password manager credentials into the phishing sites. link to this video