際際滷

際際滷Share a Scribd company logo
Deanonymization and total espionage
Dmitry 束Bo0oM損 Boomov
Tits and
kittens.
Hopefully, now
you like my
report.
Deanonymization
Passive Active
Password retrieval
Password retrieval
Getting information from email
Getting information from email
Getting information from email
Getting information from phone. Viber
Getting information from phone. Whatsapp
Getting information from phone. Banks
Getting information from phone. Banks
Getting information from phone
Getting information from phone
http://numbuster.com/
Find friends
 Anonist
Apps
https://developers.facebook.com/
Apps
https://vk.com/editapp?act=create
Apps
Demo: bo0om.ru/zn2014/vk/1/
Online users
https://letters.yandex.ru/promo
Clickjacking
Clickjacking
Demo: bo0om.ru/zn2014/vk/2/
Clickjacking
Demo: bo0om.ru/zn2014/vk/3/
CSRF + XSS + BUGS = PROFIT
Click, click
Click, click
<a href='tel://1234567890'>Click me</a>
Callback
Callback
Thx @black2fan ;)
Social detector
Demo: bo0om.ru/zn2014/sd/
ate of birth
Nicknames
Nicknames
Friends and relatives
Friends and relatives
Friends and relatives
Tinfoleak
http://vicenteaguileradiaz.com/tools/
Exif
Analytics
Analytics
Bo0oM - Deanonymization and total espionage (ZeroNights, 2014)
Banners
Social buttons
BIG DATA
http://bo0om.ru/zn2014/wtf/
GEO
https://maps.google.com/locationhistory/
Cookie Matching
Specifically, when creating a new cookie, it uses the following storage mechanisms when available:
- Standard HTTP Cookies
- Local Shared Objects (Flash Cookies)
- Silverlight Isolated Storage
- Storing cookies in RGB values of auto-generated, force-
cached PNGs using HTML5 Canvas tag to read pixels (cookies)
back out
- Storing cookies in Web History
- Storing cookies in HTTP ETags
- Storing cookies in Web cache
- window.name caching
- Internet Explorer userData storage
- HTML5 Session Storage
- HTML5 Local Storage
- HTML5 Global Storage
- HTML5 Database Storage via SQLite
- HTML5 IndexedDB
- Java JNLP PersistenceService
- Java CVE-2013-0422 exploit (applet sandbox escaping)
http://samy.pl/evercookie/
Js: on
flash: on
Js: on
flash: on
Js: on
flash: on
Js: on
flash: on
Js: on
flash: on
Js: on
flash: on
Js: off
flash: off
Providers
http://imarker.ru/
Evil
Bo0oM - Deanonymization and total espionage (ZeroNights, 2014)
Twi: @i_bo0om

More Related Content

Bo0oM - Deanonymization and total espionage (ZeroNights, 2014)