Something Something Cyber
summary
Live demos show passwords harvested by guessing and social engineering, a Hackertyper gag that matches Hollywood code, and a real-world CDN compromise emulated with Fiddler man-in-the-middle that injects a payload into sites. The defense is subresource integrity (SRI) with SHA hashes but it breaks in IE/Edge. Scams dump CVVs and 43,000 pathology reports via open directory listings, StrawberryNet leaks billing names client-side, VINs act as API keys for Nissan Leafs, and SQL injection via automated tools extracts user tables in seconds.
AI-written summary · about
chapters (11)
- 0:00Start
- 9:31Using Cloudflare Cdn
- 14:37Failed To Find a Valid Digest in the Integrity Attribute for the Resource
- 16:52Browser Support
- 18:32Twitter Verification
- 21:14How the Scam Works
- 28:43What a Google Dork
- 32:35Express Checkout
- 36:35Sequel Injection
- 43:13A Month Later They Still Hadn't Fixed It It Will Still Expose this Was Private Disclosure Responsible Disclosure and after a Month I Said Okay Look I Have Seen Enough There Is Risk from this a Privacy Risk with People Pulling Back Data Other Risks in Terms of I Think Most Nissan Leaf Owners Would Not Actually Want Someone Else Controlling a Physical Part of Their Car Which Is What the Climate Control Is So I Published a Blog Post and that's the Blog Post You See Here and Then They Pulled the Service Straight Away It Just Disappeared and It Went Offline for Quite some Time and Eventually It Came Back Online and They Had a New App and this Is the App Now Does Anyone See Anything in this App At All Unusual in Case You'Re Not Seeing It Read from the Bottom Up this Is the Real App this Is What They Put Out There in the App Store
- 1:00:44So I'Ve Been Doing Training Here this Week We Did a Two Day Workshop on Monday and Tuesday I'Ll Be Back Here in January Doing another Workshop As Well Actually for the Same Organizers of this Event and Just Spending a Couple of Days Sort Of Going through the Way these Risks Work and the Way Attacks Occur Makes a Fundamental Difference and It's Just Two Days Then You Take that You Use that for Dozens of Projects over Many Many Years so that's that's My Answer I Honestly Think that Definitely the Best Possible Thing You Can Do Is Develop a Training We'Re out of Time
