Session: Cyber Security Trends in Gaming MAX SCHUMACHER

[Music] next up I would like to welcome Max from cloudfare who's going to be talking about cyber security Trends in gaming good morning everybody thank you so much for being here my name is Max I work as a solution engineer at Cloud flare and that really means that I help customers with all of their technical questions and I'm here to talk to you to uh about a couple of cyber security Trends so in terms of the agenda I'd

like to go through fishing and the persistent thread it poses I'll give you a couple of security recommendations I think these are really things that you can apply to any organization that you're part of and also partially to your your personal uh let's say cyber security setup and then we'll have a last section on dos you know distributed denial of service attacks and in total we'll have around 20 minutes together so I wanted to start with these three games and you know I think they have a lot in common so for example there are some of the all-time greatest titles in my opinion great series I personally uh remember the release of halflife 2 quite well uh incredibly it's been already 20 years at this point it came out in 2004 so I'm dating myself a little bit here but that was really magical and I hope halflife 3 uh is just around the corner and of course GT ga uh

it was GTA 2 back back in my day let's say but unfortunately aside from being great they also have something else in common which is they've all suffered data leaks right so in all three cases source code the IP of the game itself was leaked at one point in time and you know I think that's incredibly unfortunate because so many people put their hearts into making games they are there are very large groups of people that are involved over a long period of time making it work and then if it leaks it uh sort of destroys the release it uh is is really a catastroph for a catastrophe for the entire organization because it takes a village to make a great game right so you have a distributed uh group of people they're all over the world you have the developers the artists the investors um making it all work and and

the data loss we see isn't necessarily always due to you know malicious intent from the outside but it's also negligence and just a lack of awareness of these security best practices and now that workforces are much more distributed it's also simply a large challenge to make it work to uh make this collaboration safe even though we're no longer in the same building in many many cases and with that I would like to turn your attention to uh fishing attacks I I love this little illustration with the fishing hook here um so a fishing attack is really an example of a social engineering uh attack right so basically the attacker tries to misuse your trust to say uh this is a brand that you know this is a login page that looks familiar and they want to get credentials to then use them maliciously

um and for a little bit of interactivity I would like to invite you to take out your phones and go check uh this website here we'll have about you know 20 seconds maybe to try it out or 30 seconds uh so this is a project created by security researcher Troy hunt and what he does is he collects the uh leaks that have occurred and that have been published right so whenever there was an organization that uh suffered a leak it's being aggregated here and you know don't worry this is not in itself a fishing attack uh if you just put in your email address you will find out whether your email was in any of those leaks and it's um I think astonishing to see the numbers we see here at the bottom of the screen how many pages were uh impacted and uh really how many entries were in those databases it's really also a testament as a sort of first recommendation to never reuse a password right so you you

might have hundreds of online accounts if uh you use the same password in multiple of them if a single one gets leaked potentially all the other ones are vulnerable so hope you got to try out the site and it's not too shocking but this really affects a lot of people and so in regards to fishing I mean we really have multiple different channels and attack vectors that occur here so email is the most common one but SMS uh is also uh really really uh common and we have uh QR codes being abused for fishing as sort of a new vector and what we see as the result of fishing when it succeeds is that really the accounts are taken over um and IP can be very easily stolen right so source code assets this kind of thing but of course also the personally identifiable data uh for players which I think if you follow the gaming news is

something that we we've all seen uh occur in multiple multiple times uh the other part of just stealing data outright is the uh installation of malware which then in the end might be used to you know collect and steal further data so there's a close link between the two so cloudflare itself uh I mean obviously is a provider for Security Solutions but is also Al an organization that faces a lot of attacks right so people try to break into our systems and many of the recommendations I'm about to show you are are also based on our own experience but this uh is an example here of a fishing attack that was uh based on text messages and launched against the company and basically employees were identified they received these messages with a link in them and were redirected to this you know pretty realistic looking page and the attempt was to real credentials and and break

into the system as I mentioned what's becoming more important uh with uh you know now the pandemic is over but uh it was a time when QR codes were starting to be used much more frequently to get your restaurant items to to check into places to scan badges um and of course within emails as well right so these tend to be pretty hard to detect on an auto in an automatic fashion but we've seen multiple examples of uh QR codes being abused here where uh people think they go to a trustworthy page but they're actually redirected to a to a fishing page so that's also something to look out for because it's an angle that attackers have uh discovered for themselves and service providers they often use QR codes to have something simple and fast but unfortunately one of the prices they pay is this additional security issue uh and really I think one of the most important messages I want you would like you to take home is that the vast

vast majority of all cyber incidents we see in the world start with fishing right so 91% is the statistic here uh so even if further down the line there are other kinds of attacks the starting point is very often fishing so this uh email as a channel is something incredibly important to protect and the threat is unrelenting right we see dramatic growth uh even though fishing has been around for 25 years or longer right so this is uh not going away anytime soon one of the things that we can offer is to effectively filter uh problematic messages so they to avoid them hitting the inboxes of employees uh in the first place right so to to scan those messages to use the thread intelligence that's available to us and uh one aspect or feature that I like is this idea of taking a site and effectively opening it in a safe environment in a kind of

sandbox something we call remote browser isolation which you can uh sort of think of as a remote detonation right so for this attack Vector of installing malware it's very nice if you can open problematic sites away from employee machines as promised I would like to go through a couple of security recommendations I think most of them you can very easily apply uh to your or own organiz ation and as I said also uh for your personal setup and these are often hard one lessons that come from the fact that you know we are being attacked and we need to find ways to protect ourselves so hackers log in they don't break in right so they steal the credentials and uh zero trust is this industry term that has uh been around for a few years now that describes this idea of anything that's happening

internally any access to internal systems should be checked it should be treated as malicious in the sense that we need to know who is the person making the request is the device they're using okay where are they doing where where where are they and where's the request coming from and of course um do they have the right to do what they're trying to do and I think the the contrast to a VPN base system is that uh the visibility is really there in every single request so everything is logged and can then be used for for further investigations which contrast to this model of uh once you've logged in you you can do whatever you want no no matter uh who you are right so I think that's a really healthy uh mindset to to adopt for for these internal applications and then the third point on the slide and really also the visualization are these Hardware keys I'm carrying them myself I think uh

that's a fast and easy uh gain for your security posture it's uh effectively this idea that even if someone in the organization Falls for a fishing attack in order to actually log in they will need this hardware token to get into the system right so the second Factor part of a multiactor authentication setup uh is a is a great gain for the security posture uh and so this has helped us as an organization tremendously there are multiple vendors we work with ubo but uh this is really a something that you can do in your organization but also personally so I carry two keys because I really believe in this hardware token setup and then as a you know large software company we are also uh you know there's always the problem of is there maybe a vulnerability is there a problem in the system that needs to be fixed and what we've set up a few years ago is

this public bug Bounty program and so what that means is white hat hackers people you know cyber security professionals who don't have malicious intent they can go to this page so I have the URL posted there to get all the rules and see exactly how it works and this is an opportunity for them to be paid right so if they find a vulnerability they they get money uh it's a way to get recognition and uh of course it just clarifies this entire interaction so it's it's a great thing for our security stands to have run this program for many years we happen to work with hacker one there other providers but I think this is a really good idea to adopt for any organization that builds internet facing software and technology is not going to be sufficient right so aside from putting Solutions in place we also need to think about what kind of culture Mak makes it easier to have a good security

stance and we internally have this this notion of you should always be able to speak up right so one of the worst scenarios is something happens somebody loses their credentials they click on the wrong link and then they are afraid that if they talk about it they will be punished so it's maybe they try to cover their tracks they try to make it go away and this is very very bad because now we have this festering wound that uh you know might come back to bite us so as an organization I want to encourage you to to Really uh let people speak up and say something happened I'm sorry it was you know didn't have any malicious intent uh but we need to fix this and then the security team can step in and actually get to work um and that sometimes means that you know we might see a marketing page it looks a little bit problematic but uh we don't know exactly is it a Cyber attack people employees ought to be able to

report that and uh have it treated right so we encourage everybody to uh look into this paranoid but blame-free culture I think that's a big win and and not really a technology solution okay now I wanted to shift gears a little bit uh and talk about the continu continuous bane of Dos attacks it's a big topic for us so a Dos attack is effectively an approach of an attacker to overload a system in order to make it no longer be available for legitimate users an analogy I always like to use is uh you imagine you have a pizza restaurant you know in 10 minutes it can bake 10 or 15 pizzas somebody walks in uh orders 2,000 pizzas the kitchen gets to work the oven is running and then after half an hour it turns out hey actually this was not a

real order uh and uh what that implies is a lot of cost was created right to to make all of these pizzas but then also all of the legitimate users who were ordering at the same time didn't get served right so it's sort of a double price to pay dudos attacks are very easy to start it's uh really maybe the easiest uh attack and we we see them as something that keeps uh keeps growing massively so in q1 of 2024 alone we have F you know we have defended against 4 and a half million dos attacks and you see this distinction between the different layers of the network stack right hdp uh and uh the the lower level networking stack right so if you have any kind of realtime interactive game like a shooter uh you probably work with UDP um and really the core message here is incredible growth and incredible

volume on this slide we can also see a little bit of a distinction that also DNS which is often underappreciated as a Target uh also sees a massive amount of dto attacks coming in and DNS you know it always sounds a little bit boring because it works in the background but if DNS doesn't work nothing works right so it really really has to be protected on the the far left on the screen here we see the distribution of attacks by industry and unfortunately in our experience and using our internal data we can say that uh the gaming industry is the most targeted in the most recent poll we've seen so this uh is is very persistent and uh we shouldn't expect it to go away anytime soon it's a topic for anybody who runs uh games that are internet facing so two Trends to talk about to look a

little bit into the future so on the one hand we have an really really substantial increase in the volume of Dos attacks because new tech techniques are used and we see uh the sophistication of those attacks going up so what I would encourage you to to look at here is the uh you know the the jump we see in the growth uh because of this this new approach is really tremendous right so almost 800% year-over-year growth you need very substantial infrastructure to protect against this kind of attack and uh you know it's often iot devices that get hacked and then run these dos attacks uh in the background and so you know what is your fridge doing at night you know who knows whether it's participating in one of those attacks a recent campaign against us also shows this right so that somebody wanted to take down Cloud flare and we see this incredible growth because uh protocol vulnerability was uh you know

abused and the the peak here is 200 million requests per second right so this is really incredible uh on average we treat 55 million HTP requests a second so these are just astounding numbers in terms of the sophistication attackers make use of generative Ai and they hide themselves so it becomes much more difficult to identify Who are the attackers uh and who is working in concert so that that's certainly a trend that happens at the same time what you can do as an organization is to adopt a negative and positive security model at the same time meaning you explicitly Define what you accept and you also reject certain amount of traffic right so if you don't operate in a given country you can block the traffic from there and I can basically promise dos is something that will uh be a topic for

every organization so it's good to be prepared for it and to have run books so the team knows how to react the day it happens and to have alerts set up that can tell us uh when adidos attack is occurring because as I said they're incredibly easy to launch and so uh we should expect to see more of them in the future we have set up this website Cloud flare radar uh it's free and there's also API access and it's uh I encourage you to to to look into it it's a way to see attacks going on and see traffic flows happening so this is a a fun website that we were able to build because of the system we've set up so on this uh map here we see every single blue point is a city where Cloud FL is present right so we have these over 300 data centers set up which gets us very very close to all almost all internet users around the globe and we treat the attacks where they occur right so this is something to to build

off and at the very bottom of the screen you see here we also now have a presence an office presence in Dubai we treat about 20% of all internet traffic which gives us this deep visibility uh and and thread intelligence that we share with our customers and with that I want to invite you to make Cloud flare part of your team uh please come see us at the booth uh we're right over there and uh if you want at that link you can can sign up so thank you so much for your attention and have a wonderful day thank you [Music]