50 Shades of AppSec

on YouTube ↗43m

" summary

A rapid tour of concrete failures and exploits: easy tools like Bishop browser plug-in and copy‑paste tutorials enable child hackers and phishing; marketplaces such as hackerlist dot com and Pastebin dumps monetize breaches; extortion demands for one Bitcoin extortion surface; awful implementations (Bet Fair birthdate resets, credentials in JavaScript, sitemap with users and passwords) and SQL injection still common keep recurring; appliances fail (LIFX bulbs leaking Wi‑Fi, even a connected toilet vulnerability) and many hacks work because builders ship insecure defaults.

AI-written summary · about

" chapters (15)

1. 0:00Intro
2. 0:53Opening Keynote
3. 1:47democratization of hacking
4. 4:17activist hacking
5. 6:31criminal hacking
6. 8:50extortion
7. 10:45criminals
8. 14:33password reset
9. 18:14Sagal injection
10. 19:51User experience
11. 23:35Guidance
12. 28:52Users
13. 31:54Social Media
14. 34:20Governments
15. 37:26Physical World

" related talks

• 59m50 Shades of AppSecTroy Hunt · NDC Sydney 2016
• 46mHow to hack a node app?Asim Hussain · The Rolling Scopes Conference 2018
• 01h 24mCode Red: Navigating the Minefield of Security Programming BlundersGregg Jaskiewicz · ACCU 2024
• 59mMaking Hacking Childs PlayTroy Hunt · NDC Sydney 2016
• 30mHow to hack a web app?Asim Hussain · Render Conference 2018
• 35mInside a hacker’s mindMaria Shoaib · Øredev 2019
• 44mNight of the living vulnerabilitiesS. Zanero, R. Clapis · Codemotion Amsterdam 2018
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019