DEF CON 31 Highlights RDP Honeypots, NFC Fraud Risks and Censorship

Aug 22, 2023 · Original article ↗

Summary

A DEF CON 31 recap highlights a PyRDP honeypot used to study RDP attackers, risks involving NFC payments and tags, and discussions of internet censorship and social-engineering trends.

Key points

GoSecure researchers described using the open-source PyRDP honeypot to observe malicious actors using RDP over three years; the tool can collect credentials and system details.
The article says NFC transaction signals may be intercepted by someone within range, potentially exposing financial details, personal information, or credentials.
It describes how malicious or altered NFC tags could deliver malware when scanned.
The recap notes analysts plan to monitor ATM and point-of-sale hardware vulnerabilities and discussions of related actors on darknet and messaging platforms.
Conference trends mentioned include phishing that impersonates old school or college friends, misuse of company swag to enter secure locations, and tap-to-pay and RFID hacking.
A censorship panel discussed targeted measures against individuals or network blocks, rather than shutting down an entire ISP, and the role of a proposed UN cybercrime treaty.

Article Details

Topic: Analyst perspectives on DefCon 31, including PyRDP, internet censorship, NFC payment fraud, and current hacking and social engineering trends.

People

Mikko HyppönenSpeaker at DefCon 31 whose talk covered cyber actors and recent Russian cyber activities.

Tools

PyRDPA pair of brilliant scientists from a Montreal organization, GoSecure, set up a RDP honeypot (PyRDP) to attract malicious actors to use it to study them.

Countries

ChinaRussia, China, and Iran are all building their own internet, separate from the world grid.IranRussia, China, and Iran are all building their own internet, separate from the world grid.RussiaRussia, China, and Iran are all building their own internet, separate from the world grid.