Third-Party Code: Where Data Breaches, Election Meddling, Ad Fraud Converge
summary
Examines a recent case where attackers used phishing redirects, dropped payloads, crypto‑mining, keyloggers and bloatware to compromise social media, mobile apps and news websites. Focuses on risks introduced by third‑party code suppliers who collect behavioral and sensitive data, and argues for accountability of those suppliers. Technologies named include phishing redirects, payload drops, crypto‑mining, keylogging and bloatware; intended audience is those familiar with website operations and DevSecOps/app security.
AI-written summary · about
chapters (17)
- 0:00RSAConference 2020
- 1:36Accountability for the digital world we inhabit
- 3:38Changing communication infrastructure
- 5:31Third-party Code: It's what makes the internet work
- 10:46What you see isn't what you get
- 12:37Deciphering the purpose of a digital footprint
- 14:40Third-party code used to target...
- 19:06Case in point
- 21:37Background
- 26:13How it worked: Trial & Error
- 28:07Sample attack...
- 30:00What we know about the domains
- 33:16Changing focus: Attribution
- 35:38Is digital compromise or manipulation illegal?
- 37:40Protecting consumers is a priority: 3ve & FBI
- 42:12Basic tenets to being a good corporate digital citizen
- 44:47Your Next Steps: Apply these learnings
related talks
30mGDPR and Third Party JS - Can It Be Done?
52mFlying Under the Radar - New Security Evasion Techniques
41mHackers vs. Devs - Attacking Dev Tools and Infrastructure
35mCYBERSECURITY! The good, the bad, and the hacked
52mLessons Learned from the Summer of Supply Chain Attacks
48mThe Five Most Dangerous New Attack Techniques
58mSocial Engineering: Hacking Humans
40mThe Canary in the Coalmine of Cybersecurity: Fraud as a Warning Sign