Case Files from 20 Years of Business Logic Flaws
summary
Summarizes real-world incidents at companies like Citibank, First American Financial, McDonald’s, Nordstrom and Signet/Jared, focusing on business logic flaws that static/dynamic code-analysis tools miss. Presents taxonomies of business logic vulnerabilities plus concrete scenarios and exploit patterns for each case.
AI-written summary · about
chapters (25)
- 0:00Intro
- 2:23Design Flaws
- 5:02Business Logic Flow
- 7:36Why Flaws Emerge
- 8:54Attackers Are Evolving
- 12:30Token Affinity
- 13:22Adversarial Mindset
- 16:59Durability
- 17:23Bidding Portal
- 18:52Direct Object Reference
- 21:12Critical Announcements
- 22:27Uber
- 25:08New Relic
- 26:03Zoom ATO
- 28:58Parameter Manual Manipulation
- 29:44SEC Lists
- 30:03Payload
- 30:35Auto Repeaters
- 31:00Bounty Hunters
- 31:51Detecting Logic Flaws
- 33:09Defender Mindset
- 34:51Common Traits
- 36:27Identity Providers
- 39:06Summary
- 42:50Comments
related talks
42mBusiness Processes from an Attacker’s Perspective
40mThe Resilience Business Case: Three Case Studies
13mStandard Classification: Back to Basics: Looking for subtle bugs in beginne...
45mCode Red: The Business Impact of Code Quality
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders
50mTelling Fairy Tales to the Board: Turn Attack Graphs into Business Stories
50mCracking the Code to Secure Software
31mConstructive Assurance Cases for Cybersecurity