Learning from High Profile Failures
summary
Three case studies show concrete failures and fixes: a Java web framework allows RCE via Content-Type/Disposition headers and an enterprise leak exposes 145.5 million records after a 60‑day patch lag; a dating site stores passwords with bcrypt then MD5 and source code release turns years of brute force into days, leaking full profiles; an airline’s CDN‑tampered JS executes a stored XSS that steals payment data from 380,000 users over 15 days. Remedies: Snyk dependency scanner, strict CORS, avoid weak hashing.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:09Cybersecurity
- 2:44Useful terminology
- 4:51N-Day Vulnerabilities
- 7:17Alice Agency
- 8:12Static Analysis
- 9:58Dependency Scanner
- 15:13MD5 vs. BCrypt
- 16:30Privacy
- 18:20Collaboration
- 19:00International Airlines
- 21:46Cross-Site Scripting
related talks
40m5 AppSec Stories, And What We Can Learn From Them
46mLive hacking: Breaking into your Java web app
19mCritical Security Mistakes in Frontend Applications
55mBreaking and Fixing Web Application Security
34mThe State of Web Security
58mModern web application bugs
41mLive Hacking: Breaking into Your Web App
46mHow to hack a node app?