Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Elie Bursztein
FACADE High-Precision Insider Threat Detection Using Contrastive Learning | Black Hat USE 25 talk
Available Media Available Media Github Slides (pdf) Slides (Online) Conference Black Hat USE 25 (BH25) - 2025 Authors Alex Kantchelian , Elie Bursztein , Casper Neo , While insider threats are a critical risk to organizations, little is publicly known about how to detect those attacks effectively. To help address this gap, we present FACADE: Fast and Accurate Contextual Anomaly DEtection, Google’s internal AI system for detecting malicious insiders.
On the consequences of the AI workforce entering the market
In this post, I'll explore the potential societal consequences of the advent of generative AI (GenAI), which includes large language models (LLMs), text to image generation models (TIG) and other generative AI models that produce high-quality content based on human instruction (prompts).
Building Safe End-to-End Encrypted Services for Business - a Google Workspace perspective
Using end-to-end encrypted services is quickly becoming a critical component of how enterprises meet regulations and ensure data sovereignty. While using end-to-end encryption has a lot of upsides, so far it also came with significant tradeoffs – the most significant being that the smart and security features users are accustomed to (e.g smart search, malware scanning) are unavailable due to the fact that they rely on massively complex server-side systems to operate.
Who is targeted by email-based phishing and malware? Measuring factors that differentiate risk
Available Media Conference Internet Measurement Conference 2020 Authors Camelia Simoiu , Ali Zand , Kurt Thomas , Elie Bursztein Citation As technologies to defend against phishing and malware often impose an additional financial and usability cost on users (such as security keys), a question remains as to who should adopt these heightened protections.
5 useful tips to bulletproof your credit cards against identity theft
Authors Elie Bursztein Date July 2016 - Reading time 5.0 min read Here are the 5 ways I bulletproof my credit cards against identity theft, and you can use them yourself very easily. As a bonus, at the end of the post I have added an experimental step to defend against the recent chip downgrading attack. 1. Don't be an easy mark: never share a photo of your credit card on a social network This tip might seem obvious but people still do share a photo of their credit card on social networks.
Security Boulevard
The “Right to be Forgotten” (RTBF) is a landmark European ruling that governs the delisting of personal information from search results. This ruling establishes a right to privacy, whereby individuals can request that search engines delist URLs across the Internet that contain “inaccurate, inadequate, irrelevant or excessive” information uncovered by queries containing the name of the requester.
Deconstructing the Phishing Campaigns that Target Gmail Users
Download Slides (Pdf) • Slides (Online) Conference Black Hat USA 2019 Authors Elie Bursztein, Daniela Oliveira With over 1.4 billion active users and million of companies entrusting it to handle their email, Gmail has a unique vantage point on how phishing groups operate. In this talk we look into Gmail telemetry to illuminate the differences between phishing groups in terms of tactics and targets.
Security Boulevard
For South Asian women, a major hurdle to their meaningful participation online is their ability to ensure their safety. This post illustrates this challenge by recounting the safety and privacy challenges faced by women across India, Pakistan, and Bangladesh, who talked to us about their online experiences. Overall, we find that women in the region face unique risks due to the influence of patriarchal norms and because fewer women are online.
Understanding the online safety and privacy challenges faced by South Asian women
For South Asian women, a major hurdle to their meaningful participation online is their ability to ensure their safety. This post illustrates this challenge by recounting the safety and privacy challenges faced by women across India, Pakistan, and Bangladesh, who talked to us about their online experiences. Overall, we find that women in the region face unique risks due to the influence of patriarchal norms and because fewer women are online.
Cutting Edge TensorFlow - Keras Tuner: hypertuning for humans
Keras Tuner is a hypertuning framework made for humans. It aims at making the life of AI practitioners, hypertuner algorithm creators and model designers as simple as possible by providing them with a clean and easy to use API for hypertuning. Keras Tuner makes moving from a base model to a hypertuned one quick and easy by only requiring you to change a few lines of code.
They Don't Leave Us Alone Anywhere We Go - Gender and Digital Abuse in South Asia
Download Publication • Bibtex Conference CHI Conference on Human Factors in Computing Systems 2019 Authors Nithya Sambasivan , Amna Batool , Nova Ahmed , Tara Matthews , Kurt Thomas , Laura Sanely Gaytán-Lugo , David Nemer , Elie Bursztein , Elizabeth Churchill , Sunny Consolvo Award Best Paper Award South Asia faces one of the largest gender gaps online globally, and online safety is one of the main barriers to gender-equitable Internet access.
Security Boulevard
On February 5th, for Safer Internet Day, our team launched its first public-facing system, called Password Checkup . Password checkup allows users to check, in a privacy-preserving manner, whether their username and password matches one of the more than 4B+ credentials exposed by third-party data breaches of which Google is aware. This launch success vastly exceeded our wildest expectations, with over 650,000 users installing our chrome extension in the first three weeks following the release.
Security Boulevard
This post considers the perception clash that exists between what users perceive to be their most valuable accounts (email and social networks) and those they think they should protect the most (online banking). This perception disconnect is potentially harmful, as it may lead users to invest their limited willingness to secure accounts into the wrong type of accounts.
Security Boulevard
A critical part of child sexual abuse criminal world is the creation and distribution of child sexual abuse imagery (CSAI) on the Internet. To combat this crime efficiently and illuminate current defense short-coming, it is vital to understand how CSAI content is disseminated on the Internet. Despite the importance of the topic very little work was done on the subject so far.
Security Boulevard
This post looks at two-factor authentication adoption in the wild, highlights the disparity of support between the various categories of websites, and illuminates how fragmented the two factor ecosystem is in terms of standard adoption.
Security Boulevard
This post provides an overview of the impact of the Twitter 2018 accounts purge through the lens of its impact on 16k of Twitter’s most popular accounts. Overall, we found that on average, popular accounts lost 2.8 percent of their followers bases due to the purge. In terms of raw numbers, this represents a collective loss of over half a billion followers (546M).
Concerns about usb security are real: 48% of people do plug-in usb drives found in parking lots
If you attend any security conference, you will inevitably hear pentesters boasting that they can break into any company by dropping malicious USB drives in the companys parking lot. This anecdote is so famous that it was the featured in the TV show Mister Robot in episode 6. This left us wondering---does this attack actually work or is it merely a myth?
Attacks against machine learning — an overview - Security Boulevard
This blog post survey the attacks techniques that target AI (artificial intelligence) systems and how to protect against them. At a high level, attacks against classifiers can be broken down into three types: This post explores each of these classes of attack in turn, providing concrete examples and discussing potential mitigation techniques.
Security Boulevard
This post looks at the main difficulty faced while using a classifier to block attacks: handling mistakes and uncertainty such that the overall system remains secure and usable. This is the third post in a series of four that is dedicated to providing a concise overview of how to use artificial intelligence (AI) to build robust anti-abuse protections. The first post explained why AI is key to building robust protection that meet user expectations and defeat increasingly sophisticated attacks.
How to successfully harness AI to combat fraud and abuse
While machine learning is integral to innumerable anti-abuse systems including spam and phishing detection, the road to reap its benefits is paved with numerous abuse-specific challenges. Drawing from concrete examples this session will discuss how these challenges are addressed at Google and providea roadmap to anyone interested in applying machine learning to fraud and abuse problems.
Security Boulevard
This post explains why artificial intelligence (AI) is the key to building anti-abuse defenses that keep up with user expectations and combat increasingly sophisticated attacks. This is the first post of a series of four posts dedicated to provide a concise overview of how to harness AI to build robust anti-abuse protections. The remaining three posts will delve into the top 10 anti-abuse specific challenges encountered while applying AI to abuse fighting, and how to overcome them.
Taking down Gooligan: part 2 - inner workings
This post provides an in-depth analysis of the inner workings of Gooligan, the infamous Android OAuth stealing botnet. This is the second post of a series dedicated to the hunt and takedown of Gooligan that we did at Google, in collaboration with Check Point, in November 2016. The first post recounts Gooligan’s origin story and provides an overview of how it works. The final post discusses Gooligan’s various monetization schemas and its take down.
Taking down Gooligan: part 1 - overview
This series of posts recounts how, in November 2016, we hunted for and took down Gooligan, the infamous Android OAuth stealing botnet. What makes Gooligan special is its weaponization of OAuth tokens, something that was never observed in mainstream crimeware before. At its peak, Gooligan had hijacked over 1M OAuth tokens in an attempt to perform fraudulent Play store installs and reviews.
Taking down Gooligan: part 2 — inner workings - Security Boulevard
This post provides an in-depth analysis of the inner workings of Gooligan, the infamous Android OAuth stealing botnet. This is the second post of a series dedicated to the hunt and takedown of Gooligan that we did at Google, in collaboration with Check Point, in November 2016. The first post recounts Gooligan’s origin story and provides an overview of how it works. The final post discusses Gooligan’s various monetization schemas and its take down.
Taking down Gooligan: part 1 — overview - Security Boulevard
This series of posts recounts how, in November 2016, we hunted for and took down Gooligan, the infamous Android OAuth stealing botnet. What makes Gooligan special is its weaponization of OAuth tokens, something that was never observed in mainstream crimeware before. At its peak, Gooligan had hijacked over 1M OAuth tokens in an attempt to perform fraudulent Play store installs and reviews.
Hunting down Gooligan — retrospective analysis - Security Boulevard
This talk provides a retrospective on how during 2017 Check Point and Google jointly hunted down Gooligan – one of the largest Android botnets at the time. Beside its scale what makes Gooligan a worthwhile case-study is its heavy reliance on stolen oauth tokens to attack Google Play’s API, an approach previously unheard of in malware. This talk starts by providing an in-depth analysis of how Gooligan’s kill-chain works from infection and exploitation to system-wide compromise.
Insights about the first five years of Right to Be Forgotten requests at Google
The “Right to be Forgotten” (RTBF) is a landmark European ruling that governs the delisting of personal information from search results. This ruling establishes a right to privacy, whereby individuals can request that search engines delist URLs across the Internet that contain “inaccurate, inadequate, irrelevant or excessive” information uncovered by queries containing the name of the requester.
Inside Mirai the infamous IoT Botnet: A Retrospective Analysis
This post provides a retrospective analysis of Mirai — the infamous Internet-of-Things botnet that took down major websites via massive distributed denial-of-service using hundreds of thousands of compromised Internet-Of-Things devices. At its peak in September 2016, Mirai temporarily crippled several high-profile services such as OVH, Dyn, and Krebs on Security via massive distributed Denial of service attacks (DDoS).
Harnessing AI to combat fraud and abuse: part 1 - why AI is the key to robust defenses
This post explains why artificial intelligence (AI) is the key to building anti-abuse defenses that keep up with user expectations and combat increasingly sophisticated attacks. This is the first post of a series of four posts dedicated to provide a concise overview of how to harness AI to build robust anti-abuse protections. The remaining three posts will delve into the top 10 anti-abuse specific challenges encountered while applying AI to abuse fighting, and how to overcome them.
Understanding the prevalence of web traffic interception
This is a guest post by Elie Bursztein who writes about security and anti-abuse research. It was first published on his blog and has been lightly edited. This post summarizes how prevalent encrypted web traffic interception is and how it negatively affects online security according to a study published at NDSS 2017 authored by several researchers including the author of this post and Nick Sullivan of Cloudflare. We found that between 4% and 10% of the web’s encrypted traffic (HTTPS) is intercepted.
Targeted Attack Against Corporate Inboxes A Gmail Perspective
Millions of companies entrust Gmail to handle their emails. In this talk, we will discuss the nuances surrounding company-specific attacks and highlight the defenses we put in place to counter those threats. The insights shared will inform those looking to tackle the complex security challenges posed by email within their own organizations.
Attacks against machine learning - an overview
This blog post survey the attacks techniques that target AI (artificial intelligence) systems and how to protect against them. At a high level, attacks against classifiers can be broken down into three types: Adversarial inputs, which are specially crafted inputs that have been developed with the aim of being reliably misclassified in order to evade detection. Adversarial inputs include malicious documents designed to evade antivirus, and emails attempting to evade spam filters.
The bleak picture of two-factor authentication adoption in the wild
This post looks at two-factor authentication adoption in the wild, highlights the disparity of support between the various categories of websites, and illuminates how fragmented the two factor ecosystem is in terms of standard adoption.
Full(er) House: Exposing high-end poker cheating devices
This post exposes how real-world highly advanced poker cheating devices work. In 2015, I stumbled upon a post in an underground forum, discussing how someone was ripped off at a poker table by a very advanced poker cheating device. From what I understood at that time, the post being in Chinese, the device was able to remotely read card markings to inform the cheater who will win the next hand.
Full(er) House: Exposing high-end poker cheating devices
In 2015, I stumbled upon a post in an underground forum, discussing how someone was ripped off at a poker table by a very advanced poker cheating device. From what I understood at that time, the post being in Chinese, the device was able to remotely read card markings to inform the cheater who will win the next hand. Intrigued, I decided to follow the trail of this fabled device to see if people were indeed cheating at poker using devices that would fit naturally into a James Bond movie.
Does dropping usb drives really work?
Available Media Conference Black Hat USA 2016 Authors Elie Bursztein At every security conference you will inevitably hear hackers boasting that they can break into any company by dropping a malicious USB drive in the companys parking lot. This anecdote has even entered mainstream culture and was prominently featured in the Mister Robot TV series. However despite its popularity, there has been no rigorous study of whether the attack works or is merely an urban legend.
What are malicious USB keys and how to create a realistic one?
Dropping a malicious USB key in a parking lot is an effective attack vector, as demonstrated by our recent large-scale study. This blog post follows up on the study by showing how reliable and realistic-looking malicious USB keys can be created. After discussing the pros and cons of the three types of malicious USB keys, this post will walk you through how to create a spoofed HID keys like the one I demoed at the Blackhat conference during my talk on USB drop attacks (slides here and code here).
In-depth analysis of the lessons we learned while protecting Gmail users
This post provides an in-depth analysis of the lessons we learned while protecting Gmail users and their inboxes. We felt it was about time to share the key lessons we learned the hard way while protecting Gmail for over a decade, so everyone involved in building an online product can benefit from them. To that effect, with the help of various Gmail safety leaders and long-time engineers, I distilled these lessons into a 25-minute talk for Enigma called “Lessons learned while protecting Gmail”.
What tools do the fbi use when seizing computers or the curious case of the mouse jiggler device
How does the FBI manage to seize the content of servers and laptops when many of them use full disk encryption? While I always suspected they had some sort of equipment, until recently I was not able to figure out what it was. Then one day I stumbled upon a weird device on Amazon called a mouse jiggler, which turned out to be the first part of the answer.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Elie
Contact Elie, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack