|
larrymccowen (November 30, 1999 at 12:00 am)
Don't wanna watch the whole thing? List of important points...
# [01:48] Years ago cybercriminals were teenagers writing viruses and worms, today they are organized crime looking for stealing money.
# [03:19] Intermediate goals to stealing money are data theft, extortion and malware distribution.
# [04:02] Russian Business Network (RBN) is an example of organized cybercrime.
larrymccowen (November 30, 1999 at 12:00 am)
# [09:00] Attack #1: SQL Injection.
# [16:30] Preventing SQL injections.
# [17:00] Dont blacklist (filter) characters in queries. Whitelist (allow) well-defined set of safe values for each field.
# [18:30] Take a look at mod_security if you use Apache web server. Mod_security is a Web Application Firewall. It allows you to define a set of rules the web application must follow.
larrymccowen (November 30, 1999 at 12:00 am)
# [19:30] Prepared statements and bind variables help to avoid SQL injections.
# [23:00] Other mitigations strategies include - limiting web application users privileges on the sql server, hardenining database server and host operating system.
# [23:45] Second order SQL injections (link to pdf) abuse data that is already in the database.
larrymccowen (November 30, 1999 at 12:00 am)
# [23:55] Blind SQL injection (link to pdf) is a technique to reverse engineer the structure of the database.
# [24:25] Attack #2: Cross-Site Request Forgery (XSRF).
# [26:00] How XSRF Works.
# [31:30] Drive-By-Pharming (pdf) is an XSRF technique where the attacker changes DNS settings of a users broadband router (fact - 50% of home users do not change default router password).
# [34:00] Preventing XSRF.
djnuller (November 30, 1999 at 12:00 am)
Noby Gonna Watch This Video Finnish
Zoza15 (November 30, 1999 at 12:00 am)
That might be true, But nerds Got more brains than you can imagine...
So stop insulting those people...
metallicp (November 30, 1999 at 12:00 am)
informative presentation !
thanx for the post
frvfilms (November 30, 1999 at 12:00 am)
beautiful,
Rmac550 (November 30, 1999 at 12:00 am)
I didnt know that youtube videos can be this long. whoever watched the entire thing is a nerd and has no life
SsLiquid (November 30, 1999 at 12:00 am)
ah yes precisely. the botnets circut the anual cyber trial used for the wire transfer and then the malware alarm constitutes money made through various ransom notes written to established firms. hahaha what the fuck is this dude talking about. i fell asleep before this even started |
