Exposing Security Flaws in Trading Technologies
summary
Scans of 30 websites (7 crypto), 17 desktop, 34 mobile platforms reveal concrete failures: Wireshark captures show plaintext FIX/proprietary protocols and unencrypted credentials, 64% of desktop apps expose partial or full channels, 21% of mobile apps store passwords unhashed, and trading data and session tokens persist unencrypted. Built exploits include a TCP order pop‑up DoS and malicious DLL-backed indicators that create backdoors; automated attacks reliably crash or hijack clients and leak account and portfolio details.
AI-written summary · about
chapters (7)
- 0:00Start
- 2:09San Jose.ca Trading software
- 8:42DEMO
- 24:00Base64 != encryption
- 25:38San Jose.ca Trading data stored unencrypted
- 27:30San Jose,CA Weak password policies
- 30:22San Jose, CA Hardcoded secrets
related talks
55mBreaking and Fixing Web Application Security
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs
24mBitcoin Web Application Security
45mThe Top 10 Web Hacks of 2014
43m50 Shades of AppSec
31mHow I hacked 30 mobile banking apps & the future of API Security
30mHow to hack a web app?
57mSomething Something Security