One of the things I noticed in the last two very public breaches that
have worked this way was that the criminals had actually registered a
reasonably good-sounding domain that looked sort of almost credible and
bought a TLS search for it as well.
So if you were just first, if you were just glancing through the code,
it would look quite, it would look sensible,
wouldn't it?
Yeah.
We've actually seen those before where they
registered domain name that's just really,
really close to the merchants, probably one letter off,
they substitute an I for an L or something like that,
and reading through the code, oh, that's just going to them,
that's going to them, and it looks all legitimate.
And so that's the type of social engineering attack
really that attackers just use.
They use in a phishing tool where they'll send emails from a very similar
domain so people think they're getting a message from HR,
and they get right in.
So forensically, this is changing the way you do forensics?
You're not imaging systems in the same way.
You're looking at what's sent to the consumer's browser and
working out how that's got corrupted.
A lot of times with an e-commerce attack, we're not going onsite as much.
A lot of times, these websites are hosted in giant data centers.
Sometimes the merchant doesn't even know where they're website really is,
and it can be spread across cloud servers.
Every single data operating center has their own policies.
Some let a forensic analyst in.
Some say, if you want in here, go get a court order; otherwise,
we're not letting you in.
Yeah, so talk to me about how you do forensics for cloud-based e-comm systems.