Hack to the Future
summary
Built a public breach index now holding 7.86 billion records and shows breaches overlap (adult fanfiction leak: 186,000 records, 79% already seen), demonstrates simple failures that expose data, and proves fixes that work: add a security.txt, enable Content-Security-Policy with report-uri to block and log Magecart injections (report service sees ~700 million reports/day), warns about VIN-as-secret in connected cars, insecure direct object references in kids’ watches, and a padlock defeated by an exposed screw.
AI-written summary · about
chapters (16)
- 0:00Start
- 22:32Content Security Policy
- 24:07Report Uri Directive
- 26:00British Airways
- 27:02Connected Car
- 39:04What I Have Done on this Site Is if I Have a Look at the Response Headers of this Homepage and I Go There in My Response Headers I'Ve Set X Xss Protection to Zero Now What We Can Talk about Here Is the Browser's Native Xss Auditor So this Is Built into Chrome and It Helps Protect against Cross-Site Scripting every Now and Then Someone Turns It Off So What We'Re GonNa See Now Is Not the Default Position of Chrome It's What Happens When You Turn It Off Very Often People Turn It Off because They'Re Trying To Do Really Really Screwy Things They Get an Error They Go To Stack Overflow That Copy and Paste the Answer and Here We Are Turned Off
- 41:31So this Is What Will Happen if You Haven't Turned It Off and What Happens this Time Is this Chrome Literally Kills the Entire Page It Says Error Blocked by Xss Auditor and the Reason That Does this Is that if It Doesn't Kill the Entire Page and a Duck Just Does What Exercise Protection One Does Someone Can Always Pass a Piece of Script in the Url Which Is Also Contained Legitimately in the Source Code and Effectively Disable that Script and You Don't Want that because You Don't Want some Arbitrary Third Person Being Able To Disable Bits and Pieces of Javascript on Your Page
- 42:42Because You Do Want To Know about this Stuff like if Someone Is Actually Triggering off the Xss Order to on Your Web Site You Want To Know about It because It's Probably Something You'Re GonNa Have To Fix So To See this One in Action I'M Going To Open Up Fiddler because We Won't Be Able To See the Network Requests in Chrome It's GonNa Kill the Page before that Shows and I'M GonNa Say Hey Run Search That's Going To Go through Fiddler It Fails I Can Then Go Over to Here into My Inspectors into the Raw Request and We Can See that that Posted Off To Demo It Report Uri
- 43:06I Can Then Go Over to Here into My Inspectors into the Raw Request and We Can See that that Posted Off To Demo It Report Uri It's Posted a Json Payload so I Can Go to the Json Tab Have a Look at It There and this Is What Would Be Sent to You so You'Ve Got Everything That You Need There in Order To Actually Figure Out What Happened in Case It's a Bit Small for those of You in the Back That Is Just the Entire Request Url That Contains the Reflected Xss
- 43:23And this Is What Would Be Sent to You so You'Ve Got Everything That You Need There in Order To Actually Figure Out What Happened in Case It's a Bit Small for those of You in the Back That Is Just the Entire Request Url That Contains the Reflected Xss so You Can Take that Information You Can Go to Your Website and You Can Say Oh I'Ve Got a Problem Here because I'Ve Got Untrusted Data in the Url It's Being Reflected in Here It's Firing the Xss Auditor Not Only Is It a Potential Vulnerability but It's Actually Killing the Page for Anyone Using Chrome Now like Csp That's Totally Free As Well that's Built into the Browser and all You Got To Do Is To Specify Report Uri and Send Your Reports You Can Report to Us at Report Eurocom You Can Build Your Own Reporting in Point and Point There
- 44:39There Are Parents That Are Very Worried about Their Children Being Kidnapped or Going Missing or Something like this so They Buy Gps Tracking Watches so these Are Watches That Have a 3g Sim Card They Can Communicate over the Web and They Can Do Things like Send the Location of the Child They Got a Gps Built into Them They Can Hit an Api They Can Say Hey You Know a Little Johnny Little Mary this Is Where They Are They'Re Wandering around They'Re Safe You Know They'Re at School They'Ve Got Features To Do Things like the Child Can Call the Parent if They'Re in Distress or Something like that the Parent Can Call the Child
- 47:34It Is an Exceptionally Cheap Watch and the Challenge Then Is You'Ve Got this One Manufacturer Making the Watch Shipping It around the World and Then You'Ve Got All these Different Companies around the World Building Their Own Software on Top of It So Building Their Own Api Layer and Then Building Their Own Web Interfaces so the Security of those Two Things Is Really at the Mercy of Lots of Different Small-Time Companies Building the Software Now this Is the Tick-Tock Track Which Is a Gator What We Wanted To Do Is Have a Look at How It Communicates Backwards and Forwards so One of the Things That Ken Did Is He Had a Look at How You Retrieve Family Information Now There's this Whole Concept of a Family like the Family Owns the Child the Family Has Control over the Child Their Location on this Sort of Thing
- 52:56We Asked that the Media Treat the Situation for What It Is a Group of Hackers Who Have Found an Issue in Our Security and Took the Findings to the Media and an Actor Self-Promotion Now the Chronology of It Was Private Disclosures Service Goes Offline the Thing Is Safe Then There's Public Disclosure this Is the Way the Security Industry Works Yet Organizations at the Receiving End of this That Don't Understand that Yet Is Still Shipping Devices to Our Kids Connected to the Internet View It like this So One of the Really Big Problems We'Ve Got in this Industry Is the Inability of the Organization's Building Software and Hardware Products To Deal with Vulnerability Disclosure
- 53:24So One of the Really Big Problems We'Ve Got in this Industry Is the Inability of the Organization's Building Software and Hardware Products To Deal with Vulnerability Disclosure and I Want To Leave You with One Final Example that Which I Think Is Just the Perfect Epitome of What I'M Talking about There's a Biometric Padlock Now There's a Youtube Account Called the Lock Picking Lawyer and this Is Actually a Really Cool Youtube Account So this Guy Goes and Does Physical Penetration Tests on Padlocks and Everything from like Using Bolt Cutters To See How Much Force It Takes To Break It Through to Picks and Things like this
- 53:44Now There's a Youtube Account Called the Lock Picking Lawyer and this Is Actually a Really Cool Youtube Account So this Guy Goes and Does Physical Penetration Tests on Padlocks and Everything from like Using Bolt Cutters To See How Much Force It Takes To Break It Through to Picks and Things like this So Anyway He Finds this Padlock and the Value Proposition Is You Don't Need a Pin You Don't Need a Key You Just Need Something That You Always Have on You Which Is Your Fingers
- 55:49And I Said Source and Then I Pulled It from an External Location and You'Re Saying Aha What if the Attacker Actually Creates a Script Block and They Put that Same Script in the Script Block When You Have a Content Security Policy by Default You Can't Have What's Called Unsafe Inline Script and an Unsafe Inline Script Is either Script Block or an Html Element with Javascript Events on It Unchanged on Blur at Such at Cetera so You Can't Have that if You Still Want To Have Your Own Script Blocks
