The security issue that killed a financial product launch
summary
A payment widget implemented as a browser extension that injects prepaid card numbers stores usable card data in the user page before any gateway encryption so another tester can reveal hidden form fields with a simple extension and reuse those numbers. Professional pen tests and 18 months of development all miss this because they assume server side security. The exploit is reproduced six to eight times on record, the launch is canceled, and a $1,000 bounty is paid.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 2:32Payday lender product context
- 5:40Testing approach and reassurances
- 8:09Payment security vulnerabilities
- 10:45Discovery and disbelief
- 12:11Legal concerns and verification
- 12:58Product launch cancellation
- 13:39Outcome and takeaways
related talks
24mBitcoin Web Application Security
29mThe Smörgåsbord of web app hacking
33mAPI-Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web
53mOpening Keynote – Dr. Katie Paxton-Fear
27mCommon Application Security Mistakes that Enable Automated Attacks
30mTargeted Web Skimming on E-Commerce Sites
15mJumpstart Security & Penetration Testing APIs
38mMission mPOSsible