Data Access Rights Exploits under New Privacy Laws presented at BSidesRoc 2019

by Amber Welch,

Summary : New privacy laws such as the GDPR and CCPA have greatly advanced individual data rights, although the ability to request access to all personal information held by a company has created new attack vectors for OSINT. These data access requests are usually managed by legal or compliance teams without security review, increasing the potential for phishing, social engineering, and “legal DDoS.” This talk covers regional personal data access options, how most companies respond to data access requests, and exploits for common privacy vulnerabilities. We’ll explore the psychology driving corporate responses to requests and ways to exploit these emotions, as well as the best targets for a weak privacy program. For the blue teamers, phishing detection and defense strategies will be presented. Rather than ignoring or fighting against the regulations, we’ll look at ways to use these laws to discourage, detect, and disrupt such attacks. We’ll consider strategies for working with legal teams, getting security review into the process, and conducting red team reviews on the data access mechanism. Best practices for identifying data subjects, minimizing the data released, and legally denying abusive requests will be covered. Key sections of the laws to know for exploits and defense will be highlighted.