How My Botnet Purchased Millions of Dollars in Cars
Michael Schrenk explores how my botnet purchased millions of dollars in cars at DEF CON 21, examining automotive-security and practical defenses.
Summary
Architecture and Background
How my Botnet Purchased Millions of Dollars in Cars and Defeated the Russian Hackers MICHAEL SCHRENK This is the true story of a botnet that created a competitive advantage for a car dealership. This dealership found a website that offered returned lease vehicles—great cars for their inventory—but bad web design and heavy competition from other automotive dealerships made the website useless.
Vulnerability Analysis
In response, a botnet was developed to make automotive purchases with machine precision. With the bot, they could acquire any cars they wanted, without interference from competing dealerships.
Exploitation and Demonstrations
During its one-year life, this botnet autonomously acquired many millions of dollars in cars. Along the way, it successfully adjusted to competition from a similar bot developed by Russian hackers while maintaining a sufficiently low profile to "stay below the radar" of everyone involved.
Remediation and Defensive Strategies
Michael Schrenk (@mgschrenk) is a Las Vegas based webbot developer, online entrepreneur and writer, who has developed commercial botnets and webbots since 1995. He is the author of "Webbots, Spiders, and Screen Scrapers, 2nd Edition (2012, No Starch Press, San Francisco). Mike has presented talks at DEF CON 10, 11, 15 and 17 and wrote about DEF CON 5 for Computer World Magazine. Facebook: Materials:
Related talks
Main Stage·48 min
Charlie Miller · Chris Valasek
Charlie Miller and Chris Valasek details adventures in Automotive Networks and Control Units CHARLIE MILLER SECURITY ENGINEER, TWITTER CHRIS VALASEK DIRECTOR OF SECURITY INTELLIGENCE AT IOACTIVE, INC.
Main Stage·1 hr 45 min
Kurt Opsahl · Nate Cardozo · Mark Jaycox · Yan Zhu · Eva Galperin
Kurt Opsahl and Nate Cardozo explores ask the eff: the year in digital civil liberties at DEF CON 22, examining automotive-security and practical defenses.
Main Stage·44 min
Joshua Corman · Nicholas J Percoco
The Cavalry Year[0] & a Path Forward for Public Safety Joshua Corman CTO, SONATYPE Nicholas J Percoco VP STRATEGIC SERVICES, RAPID7 At DEF CON 21, The Cavalry was born.