Don't worry, your credit card details are safe. BTW your kid is missing!
summary
Finds multiple real flaws in cloudkids.no using a web proxy and simple tools: Fiddler, Tamper Data/Tamper Chrome and browser devtools. Discovers outdated OpenSSL with 36 known CVEs, session cookies valid for 60 days without Secure or HttpOnly, API tokens with repeated halves (≈96 bits) that never change, missing auth checks enabling enumeration of tens of thousands of parents and photo IDs, password change endpoint that skips current password, persistent XSS plus CSRF + XSS exfiltration to steal cookies and take over accounts. Vendor fixes issues after Friday disclosure.
AI-written summary · about
chapters (15)
- 0:00Start
- 11:15Lesson 2
- 16:41Lesson 3
- 17:48Lesson 4
- 21:21Contact vendor
- 24:53Lesson 5
- 25:48Lesson 6
- 31:41Lesson 7
- 33:25Lesson 8
- 38:52Lesson 9
- 40:51Lesson 10
- 44:07What evil can be done...
- 46:04What to do
- 49:08How do you prevent disaster?
- 53:20Are Norwegian online kindergarten services secure?
related talks
59m50 Shades of AppSec
01h 11mThere Was Not a Breach; There Was a Blog
09mI thought we did things right until I went looking - Security errors in Norwegian websites
59mMaking Hacking Childs Play
46mKeynote: Lessons From 11 Billion Breached Records
01h 00mHack to the Future
28mCookie Crumbles: Unveiling Web Session Integrity Vulnerabilities
21mSecurity is Everyone's Responsibility