50 Shades of AppSec
CC Attribution - NonCommercial - ShareAlike 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal and non-commercial purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this
Hunt, Troy
The AppSec industry is enormously diverse and it only continues to diverge as we put more software into more things with more connections. It’s an industry that’s fluctuating between the sophisticated to the absurd, the intelligent to the primitive and the scary to the outright hilarious. There’s valuable lessons to be taken away from these events and applied in our future security efforts. In this talk I’m going to cover a broad spectrum of what’s happening in our industry – an entire 50 shades of it in only 45 minutes – and you’ll get a sense of just how challenging it’s becoming for those of us working in AppSec to keep ahead of the attacks. I’ll cover everything from the social aspects of hacking through to some of the more obscure attacks and the increasing challenges we have as defenders.
 So a quick tutorial on how to DDoS. Now before I start I'd just like to say I'm not responsible for anything you do with the information I've provided in this video for you. So if you're going to DDoS someone with this information which I've given you, I'm not responsible for nothing, absolutely nothing you do. So yeah now that I've got that out of the way let's get started. So what we've got to do is we've got a load up command prompt. I like my color green. Then what we want to do is we want to type ping and then I've got a bunch of random IPs here. So ping and then just paste it or you can type out Python T, Python AL and then the amount of packets. So this is the command it pings them and this is the IP or ping. This is how long you want it to do it for. So I've put a limited time, this is how many packets you want to send right here. So let's just hit that and as you can see it's already began the process of DDoS and the IP. Now there's one thing I'd just like to say like when you do this sometimes it will come up with like a timeout message. This means that the IP could be wrong or in fact your connection is not strong enough to send packets or could just be a general error because like it could do all of this and then just say timeout and then carry on. So it could just be like the ping's not actually sent. So once you're done you hit control C and send 43 packets, they receive 43 packets, they lost nothing on your computer so 0% lost. So basically they must have a strong connection. You've got to do this for a while with this method. So like go outside and play YDDoS and then what's going on. I'm also putting new on YouTube as well. Alright, who liked that? How did DDoS with ping? Is it good? I'm not responsible if you're going to DDoS anyone with ping. Do you like the bit where he goes just go out and play while you're DDoSing. Gives you a little bit of a sense of how sophisticated some of our cyber hackers might be. So we see a lot of this sort of stuff from Anonymous and the like and I saw this come up the other day so this was after the Paris attacks and Anonymous decided they're going to take down ISIS which is a worthy objective and there was this story about we're going to take them down. You've got to remember Anonymous a lot of the time are these kids with a bit of spare time in their hands but what I liked about this article was the number one rated comment on it. Isn't that awesome? It's funny because it's true. Moving on, this talk is about 50 shades of app sec and the idea is that application security is a really broad space and there's a lot of crazy stuff that happens. There's a lot of really interesting things that happen and a lot of things we can learn from it particularly as developers and software engineers and all this sort of thing and it's really interesting to sort of see some of the stuff that's happening out there in terms of what is built, how things get compromised and how some of these malicious actors actually behave. So here's where I thought I'd start and there's going to be 50 different things going to show you. Look, there's a 50 shades bit. It's not a salacious sort of thing. You've got to see 50 different interesting things. I want to start here. Democratization of hacking. So let me talk a little bit about what I mean by this. This is about how anybody can become a hacker. So it's becoming really, really easy for anyone to start breaking the systems. I want to give you an example. You know, so this kid here, a couple of years ago, this kid hacked the Xbox. We know he hacked the Xbox because the news headlines tell us. But he did actually hack the Xbox. He managed to fat finger the controller and elevate privilege to circumvent parental controls. This is serious, right? His dad's a security guy. His dad was pretty happy about the whole thing. He's now on the Microsoft security researchers Hall of Fame. This is a five-year-old kid, not the dad. The kid got a bugbunny. Look how excited he is. He's like, yes, I'm breaking the Xbox. But this is proper hacking in so far as he could reproduce it as well. It wasn't just like a one-off. He figured out how to actually escalate privilege. He's five years old. It makes the rest of us somewhat kind of failure sometimes. I haven't even hacked an Xbox yet. Anyway, five years old. So this is the point, right, with anybody being able to be a hacker. Now that one, in a way, is kind of simple. Although I don't know, it's Microsoft and the Xbox, and he's five years old. Anyway, we'll move fast that. If you wanted to hack stuff, you could go and get a browser plugin like this. It's called Bishop. So there's a browser plugin that just runs in the background. So you browse around the web. And as you're browsing around, it looks for vulnerabilities in the sites that you're using. The news site, your bank, whoever it might be. And it looks for things like exposed version control, misconfigured admin, and it does it all automatically. So when all you need is a browser plugin, anyone can be a hacker. It is that easy. Now you might then decide that you actually want to get a little bit more serious about it and actually learn how to hack. And you can find tutorials online like this. And what they do here is they find a website that's got a query string with an integer. They add a single quote and load the page. And when they do that, they get a SQL exception. So it's probably a SQL injection risk. All you got to do after finding that is you copy the URL and you paste it into this free software called Havage. And then you click the analyze button, and now you have all the data. And it is literally that fast. It is really, really simple. Really available software. You just find a URL with an ID in the query string. A lot of sites are at risk of that. This is exactly the sort of thing that happened to TalkTalk. I mean, I assume that was big news here because it was big news even in Australia. It was kids who managed to use tools like this, and they knew how to copy and paste. And that was about the extent of their security prowess. Now just in case you don't want to hack yourself, but you'd like someone else to hack for you, you can go and use a hacking service. It goes like this. Find professional hackers for hire. Now what struck me with this is that this is not a dark website. This is out there in the clear. It's kind of a nicely designed site. Lots of smiling stock photos. Everybody looks very happy. This is a very mainstream sort of site. It's even got HTTPS. It's quite nice. You can go and start a project for free. A project usually involves something like compromising your significant other's email in order to figure out if they're having an affair. That's what they mean by project. Now the interesting thing is, is that because it is so easy for anyone to become a hacker, we start getting a lot of this. We start getting hacktivists. There's a bit of a confusing term, and everyone's got a different idea about what a hacktivist is. But I really like this definition. And this is it. Literally 30 minutes ago, I was sitting there waiting for my talk, and I'm reading the news. And Nissan has been hacked. Distributed denial of service. Maybe we don't call it a hack, but they've been taken offline by anonymous. Anonymous has taken Nissan down. You know why they took Nissan down? Because of the whales. That is the reason. It's in the news at the moment. Nissan is offline because anonymous doesn't like the fact that Japan is knocking off some whales. That's fair enough. It's not Nissan's fault, though, but still. So that's where we are. And by the way, if you don't follow Swift on security, that is an awesome account. It's got really, really interesting stuff in it. So let me give you an example of this. This whole sort of opportunism. So this was an Aussie site a few years ago. And as we can see, it was hacked by anonymous. And government continues to blah, blah, blah, blah, blah, the rest of it doesn't really matter, because it's all sort of pointless ranting. It is Op Australia, Op Trapp wire, Op Freer Science. It'll be what Op they want it to be in order to make up something that seems like they had a good reason to break into it. So they thought this was a government site. And it turns out that it was an NGO. And it was an NGO to help people with disabilities become rehabilitated. And frankly, I think in this case, Kath has probably even been a little reserved. I might have used some stronger words. You know, this is crazy. It's an NGO trying to help people. And they've knocked them offline because it was there. That's about the extent of it. Now the problem that that creates is that you end up with situations like this. So you end up with kids, either legally kids or they are younger than us, therefore they are kids going to jail. So these guys are from LullSec. They had a lot of infamy in about 2011. They're both turning up at court with their mums, right? Because this is what happens when you're a kid and you get court hacking. You get your mum to take you to court. Have a look at the expression on the mum's faces too. They are seriously pissed. These kids are grounded like just forever. Also maybe going to jail. Different story. But this is the thing. They are just innocent kids and for all the sort of dark masks and green writing and binary images that you see every time when the news breaks, you notice that every news article they have three things. The hackers that are the stock photos, they have hoodies, they have Guy Fawkes masks and then they have binary somewhere in the image. And green, lots of green. That's hack a talk. Now thinking about hacktivists as well. So I mentioned talk talk. When the talk talk incident broke, one of the first news stories I saw was a detective said we think that they are Russian Islamist cyber jihadis. There is a news story about this. I swear to God. Russian Islamist cyber jihadis which is just like the perfect storm of scary terms. Now as it turns out, it was a 15 year old kid in his bedroom in Ireland. I assume in his bedroom because we're asking a hack from him when he's 15. It's not like you go to work and do it. So they arrested a 15 year old, arrested two 16 year olds and then there was this really old guy like 20 years old. And that's what it took to break into talk talk. And that was obviously a really massive story and it did some serious damage. But it was just kids with free time. That's what it takes to break into a lot of our systems today. Now the problem is even kids with free time, once they break into systems, we get into this realm of criminal activity. And that's why these kids are turning up the court here because it's a serious crime when you break into these systems and pull data out. Now the thing about cyber hacking for one of the better term is that as a crime, it's pretty safe. Like you think about it, go back 20 years. If you decided that you wanted to be a criminal and you might break into a service station, you might try and rob a bank, someone might actually smack you in the head with a baseball bat. Other parts of the world, America, they may shoot you. You were at serious risk. It is a high risk venture. But you hack online and it's like the kids, right? They're just in their bedrooms. So there's a very, very low risk of getting caught if you're involved in criminal hacking. So this is a real problem. And I'll give you some examples of the sort of criminal hacking we see. So we see stuff like this and this is sort of really kind of a name criminal hacking. This is a pasted-in-paste goal. Still an isolated data for the LULs. Want you database off the internet, send Bitcoin. So what these guys have done is they've broken into a system. They've published the data and they're trying to hold the company for ransom saying we will remove you from the internet if you pay us money. And as ridiculous as this sounds, this is what professional organisations are also doing when actually medicine happened. They said, hey, you can sign up for our service and pay us a few hundred bucks and we'll remove you from the internet. I mean, don't worry about the fact it was torrented like hundreds of thousands of times, we'll work it out. We'll try and remove you from the internet. So in this case, they're saying give us Bitcoin and we'll take the stuff offline. Then we see things like this, which is give us Bitcoin and we'll put more stuff online. So they're appealing to a different demographic. And we see a lot of this sort of thing where what they're doing is saying we have got some data from a system, we will give you more data if you pay some money. So this appeals to a certain criminal element. Now does everyone remember when seven million Dropbox accounts got hacked? Because I don't. Because it didn't happen. They just make it up. So they make it up and they seed these data dumps and very often it is on the likes of a pace bin, they seed them with data dumps from other places, so they will take a whole set of data and then they're just rebranded. And I know this because when I use a system like my have been poised and I search for accounts to try and figure out if something is legitimate, I see the same accounts appear over and over again. So the Dropbox.com hack was the same as the Snapchat hack, which was the same as the Facebook user hack and the Twitter hack and the data just gets rebranded as a different attack. Now I don't know how many people actually pay for this. How many people do actually throw them a Bitcoin, which is a few hundred pounds, like a Bitcoin is not cheap these days. A lot cheaper than it was though. So they throw them a few hundred pounds, but even as only one or two people it is such a low overhead thing to actually create this sort of criminal activity. Now another interesting one that we saw recently was this. And this looks like it's got a fold in it because it does. This is actually a physical piece of paper that was sent out to businesses and this went to a pizza place in New York as well as a whole bunch of other organizations and it is an extortion racket. So what they're saying is give us Bitcoin or we're going to do bad things to you. We're going to do things like make reports of mercury contamination or marijuana grow operations, possibly terrorist training activities in your pizza place as well. Not quite sure how that works, but let's just assume that that is a thing. So they were threatening reputation damage if money wasn't paid. And what I saw there is it kind of reminded me of Pulp Fiction. A lot of you have probably seen Pulp Fiction start of the movie. They're talking about a guy goes into a bank, he's got a phone, he says give me money or I'm going to tell the other guy on the other end of the phone to kill a little girl. You don't know if there's a little girl. You don't know if any of this is going to happen. But it's a threat and one Bitcoin, you know, you don't want to give it away, but if you just paid one Bitcoin to make this go away, it's not a whole lot of money. And inevitably people did pay it. We see people pay extortion records. So we've seen extortion records like this for Ashley Madison as well. After the data came out, very easy just to do a mail merge on 30 million people, you've only got to get a very tiny slice of that to give you a Bitcoin and you've done quite well. So what do cyber criminals do with their money when they get it? They go to Rio and buy hookers. And this is one of the things that they were doing after compromising routers there. So have a think about how this works. And this is an attack that does happen a bit. The router bit anyway. So what they do is they find a cross-site request for drew risk in the firmware of a router. So imagine you go to a website somewhere. It could just be a normal everyday website. Could be infected with some malicious ads, which does happen quite a bit. And when you load the ad, it makes a post request to 192.101, whatever the default router IP is. And that post request says change the DNS records of the router so that we get host names resolving at the attacker's service rather than the legitimate service. And then when you can do that, you can route every single request to a legitimate host name to say Fishing Page. So you go to your bank, but it's not actually going to your bank. It's going off to the hacker's Fishing Page. They compromised a huge number of people using attacks like this. Now it does pain me to see criminals being successful. But it excites me to see them failing. And we've seen some really interesting things in terms of the way criminals come undone online. So give me an example. This is a Stack Overflow question. How can I connect to a tall, hidden service using curl and PHP? And the example the guy gives here are very, very specific. And what ended up happening was it was discovered that this was a question asked by a guy called Ross Orbrit. Yeah, Ross Orbrit was also known as the Dread Pirate Roberts. And he was also known as the founder of the underground drug market called Silk Road. And he was using Stack Overflow to ask about how do I connect to my underground drug market? Using an email address that was traceable to him. And this was one of the pieces of evidence that eventually got him caught. He was also trying to kill people. So none of that really worked out too well for him. He probably won't be ever coming out of jail. He made tens of millions of dollars in Bitcoin from running this Bad Stack Overflow question brought him undone. So moving on, here's another good example. So this guy was in the news quite a bit a while ago, Jihadi John. Now he was in Syria chopping people's heads off and making videos about it and creating much fear and alarm. And what was unusual about Jihadi John is he had this strong British accent, which is not sort of the demographic you tend to get from this kind of actor. So everyone's trying to figure out, like, who is he? Who is this Jihadi John? Because obviously he spent time here in the UK. And then the feds found some interesting activity. They found that a Syrian IP address was buying web design software from a UK store. Apparently that's an unusual traffic pattern. Not only were they buying web design software, but they were using a student ID to get a discount when they bought the software. So this is the guy. Muhammad Mwazi, he is Jihadi John and they brought him undone because he was buying some sort of web software using his ID to get some stupid discount. You know, like, use a VPN at least. So as terrifying as some of these guys are, some of them are also kind of stupid, which is good news for us, you know, as the good guys. Now speaking of doing stupid things. Has anyone seen this? So here's what happened here. This is a sort of, I guess, inflammatory sign. And basically what was happening is there was a hacktivist group known as Cabin Crew going around owning Texas law enforcement. Now I've not been to Texas, but I don't reckon they got a whole sense of humor about kids coming and owning their stuff. So anyway, what these guys decided to do, this guy, Wurma, Wurma and Cabin Crew, he's obviously trying to, you know, sort of rub them up a little bit in terms of upsetting the law enforcement. And he goes to his girlfriend and he says, hey, I've got this good idea, right? Print this sign out, get a low cut top, lean over, and then with your iPhone, take a photo of it. And then we'll put that on the sites that we compromise. Now who knows what goes on to a photo when you take it with an iPhone? Metadata, geotag data, down to about seven decimal places of latitude and longitude. So the cops now have this, right? So they have the photo, they have the Latin long. And as it turns out, it was down in Australia where this particular lady was. And I can only imagine that they've got the Latin long and they've got the photo. And they've sort of got a rough idea of the area. And then they have to go around and try and somehow match it up. The mime boggles. But they did match it up. And it was this lady here. And this guy is Worma. And what strikes me with this is how normal they look. Like they're just, you know, you'd pass them in the street and go, just two normal people. Like he doesn't even have a hoodie, right? So they're just very normal people. And it sort of goes to that point again of anyone being able to be a hacker. You can just be a perfectly normal couple. And then, you know, behind closed doors, you're sort of online cyber jihadi, or maybe just cyber hacktivist. So it's a curious thing. Anyone doing this sort of thing can easily become a hacker. And when you look at this and you go, all of these people are really, really easily breaking into our things. You got to ask the question, is this the problem? Do we make it too easy? So we as the developers, are we building systems that are too easy to break into? So that got me curious. And I had a bit of a look around. I thought, let's see if we can find some of the ways that people are breaking into our systems. And I found a login form. Now, you can Google that text and you will find this. It is real. It exists. This is not fabricated. It's not as bad as it looks in a way. I mean, it doesn't make password reset easy. You just go, OK. I remember my mobile number. That's cool. If you do need to password reset, you basically have to change your phone number, which is problematic. You then can't give it to anyone either, because it's a secret, right? So you can't give your secrets out to anybody else. But this is a system. Somebody designed this and I thought it was a good idea. I don't even know why you bother with a password. Like, can't they just do a substring or something and just go, OK, here we go. One less step. This was another one. This one was from the UK, vet fair. I have a lot of UK examples, very coincidentally. But what happened with vet fair, I was watching the Twitters one day and there was a journalist having an online argument with vet fair. And what the journalist was saying was, I went to vet fair and I went to reset my password. And all I did was enter my email address and my birth date and then set a new password. So not receive an email with a unique link in it that's time limited with a nonce and does all the things that a reset's meant to do, I just did it all in the browser. And vet fair is going, no, you can't do that. That's not how it works. And they're arguing with the guy. And vet fair was really obnoxious about it. It was likely that they were going to delete it. So I screen capped it so they had a backup, which is now on my website. But they were being really obnoxious about the whole thing. And anyway, then the penny drops and vet fair realizes, oh shit, we can actually do this. You can actually reset it this way. So they say to the journalist, you shouldn't share your username with anyone. And the journalist going, but it's my email address. That's how I get email. So vet fair says, well, you shouldn't share your birth date with anyone. And the guy's like cake and presents and things like that. And the thing is, this is legitimate. I ended up going through and recording. So I can't believe I do this. Oh man, they actually did this. So I recorded the whole thing and put in the blog post. And interestingly, I showed this example at a Keynote in Amsterdam last year. And after I did the talk, I came at the stage and this guy came up to me and he gave me his card and it was vet fair security. And I'm like, oh shit, I'm in so much trouble. But the interesting thing is he was really cool. He said, thank you so much for writing that. We knew this was stupid, but marketing. Anyone ever hear this, but marketing? Marketing would like to do it this way for usability. There is some business reason. And it's often only after there's a bit of social pressure to get the organization to do the right thing that they change. And the people there know that it's stupid, but they've been asked to do it and here we are. So another good example I found. So you can see a problem with this one. Now this is JavaScript on an HTML page. It's a login form. Now you're laughing, but consider the virtues for a moment as well. Number one, latency. No latency. No server post backs. Scalability. You could have a million people log on at once. It wouldn't matter, right? The thing would scale very, very well. But this is a login form. People do this. This is a sitemap. This is one that I found. It is legitimate. I saw it firsthand. And let me explain what's going on here just in case it isn't immediately obvious. So this is a sitemap which is meant to be an index of all the resources on the site. And someone in all their wisdom has said, you know what? People are a resource. So what we'll do is for each person in the database we will make a node in the sitemap and we will put their email address and their password. And this is what was in their sitemap. This is legitimate. It's not fabricated. So when we do things like that, we do make it enormously easy on attackers. I mean, ridiculously easy. It's like, do you know how to view source? Yes. So that's really super easy stuff. But we also see stuff like this. Now some of you may recognize this as a SQL command and some SQL syntax. Some of you may also recognize this as a SQL injection risk because you can put whatever you want in that TXT email field and the text value will be appended into that statement. So for example, I could go and sign up on this website and I could say a single quote which would close off the string value of email, semi colon which would close the SQL statement, drop table login table, and then I'll just make a little dash dash in there as well to comment out that other single quote that's going to be appended to the end. And if the web app had the rights of DBO on the target database, and frankly if you're doing this, you're probably going to screw that up as well, the log on table would be dropped. And I explained this to someone once and they said, aha, but that would not comply to an email pattern and there's a regular expression validator on the email. Okay, so on the end of it, I'll put at.com. Done. Job done. Now the reason I showed this is because I show this to people and they go, oh yeah, but SQL injection, like this was a problem before, right? Like this is something we used to get wrong. And these days we're all doing entity framework and ORMs and even stored procedures. All of these things give us a lot of good protection against SQL injection. This is a tutorial that was written last year. It's up on the web, it's still up there, it's about how to do password resets. It has a very long comment from an Australian guy saying maybe you shouldn't do this, but it is still up there and it hasn't been changed. So people go to these resources and they copy and paste the code and they build their systems and these things just keep propagating. So that remains a problem. We still have a problem with the way we're building our systems. Now I also think we have a problem with the way we're setting things up for users. We're setting users up for failure. I'll give you a good example of that. This is Lego. If you want to create a user account on Lego, it's a typical sort of login form, but they give you a little bit of advice here. This is not good. Don't do this. Now I can get by the fact that they say big and small letters instead of upper and lower case, they're probably targeting kids, right? Kids will know what big letters are and small letters are. But this is not the message I want to give to kids either. We want to start teaching our kids how to create good passwords. Hey, if you want to teach your kid how to create a good password, teach them a pass phrase. That's so much better than something that is short, so it's easy to remember. Yet this is what we do. Now as bad as the advice is that we give to kids, we're also giving bad advice to adults. Another British example. Now this was curious because what Virgin Media were doing is they had a JavaScript file with all the words you weren't allowed to use, which was enormously entertaining reading because you could download the file and go, I hadn't thought of it that way before. All these different words of which wankers was one. And it made me curious as to why they would be blocking particular terms from the password. Because it's not like when the hashing algorithm sees wankers, it goes, oh, and gets embarrassed. It doesn't work that way. Hashing algorithms don't care. So there are humans at Virgin Media seeing these passwords, which tells you something about the way they're creating them. Also tells you something about the way they may be asking for them. They're handling the passwords insecurely. That's the only reason this happens. Now security also becomes quite complex when we look at things like security questions and answers. And it becomes complex insofar as it's hard to write good ones. It's hard to write a good security question and provide answers. And we see it screwed up quite a bit. Now this is not good. This is a pub trivia question, right? So this is not a good security question. Anything that you can Google is not a good security question or as it may be a good security answer. And this is the problem because anyone can figure out what that is if you choose that particular value. Frankly, things like color aren't very good either. Red, green, blue, okay, there's half our audience. And then you can pick a few others and you pretty much guess pretty quickly. So these ones are very easily discoverable. But sometimes we see security questions that are almost impossible to create answers for. I'm pretty sure that wasn't the dog's name. This is ridiculous. We really struggle with security questions. For the most part, security questions are probably more pain than what they are actual good. So these are really problematic and it's just amusing to see how many times people get this wrong. And at the end of the day, it's one of us colloquially as a developer that's sitting down there writing this code, writing these questions. And that got me thinking if maybe it was a problem with the way we're teaching developers. So are we teaching them the wrong things? Are they learning to be insecure by default? So I thought what I should do is go around and find some interesting resources in terms of some of the education we're giving technology professionals. And here's one of the first things I found. Can we have some audio back, please? Let's try that again. Audio. So here's the first things I found. Hey, what's up, YouTube? This is Next Gen Hacker 101 and today I'll be teaching you guys how to view other computers' IP addresses. All right, what you do is you type in tracer t and then space. All right, this is a cool thing. Tracer t and then space. Now what you want to do is you want to type the site you want to view. So you want to go HTTP, semicolon, slash, slash, and then we'll not semicolon, the little dot, dot, and then the website. So let's just say Google. Oops. So let's just say we want to see how many IPs are looking at Google right now. And like at this exact moment, we're going to find how many people are looking at Google, what their IPs are, and what their connection speed is. Here we go. So you type in tracer t, space, and then the website, HTTP dot, dot, slash, slash, and then the website, I'm doing Google. You want to go ahead and do that as an example. And then you enter it. And here we go. Here they come. One, two, three, four, five, six, seven, eight, nine, ten. And hold it. All right, people are currently using Google and looking at it. It's a bit of a slow day on Google, that one. No doubt. Just one pro tip as well. When you are looking for tutorials, and particularly video training, if their voice hasn't broken, do proceed with caution. Treat as suspicious. Be good on the kid for having a go. And the same for the kid in the first video. Maybe they're doing wonderful things now, who knows. But when you hear a kid, you kind of expect it to be maybe not the best advice, right? But the problem is that you can go to professional training resources and find other really bad advice. So here's one that has, as part of the course, little exercise where you need to encrypt a credit card. It gives you an example of how you might encrypt that credit card. For those of you who are perhaps not familiar with base 64, the problem with base 64 encoding is base 64 decoding. It's encoding, right? You encode and then you decode. There is no private key. It's not encryption. But this was in an actual professional learning resource. So that's problematic. Some of the professional training is questionable, let's be honest. A lot of the way other people learn as well though is via Stack Overflow. And there was a question there a little while ago. The question was, how do I securely store passwords in my system? How can I encrypt it? Now, this was one of the answers. And I'll sort of give you a bit of a hint about what's going on here if it's not immediately obvious. What the guy here has said is what you're going to do is you get the password and then for each character in the password, you take the ASCII value of each character and then you add five. And you just do this for each character and then the output of that is what you then save into the database. And then guess how you decrypt? Right? You get each character and then you get the ASCII value and you decrease by five. Now, this was one of the answers. The next answer said you base 64 encrypt it. Same as last slide. And then there was another answer which basically said the same thing, but they said, no, no, no, we've got a more secure way. What you do is you get each character and you add 13. And then to decrypt, you take away 13. Now, fortunately, Stack Overflow tends to filter this stuff out and it did disappear. I may have screen capped some of them and put them on a blog just beforehand because it was kind of interesting. But one of the things that also struck me as very interesting with this is how quickly these answers appeared after the question. Now, think about that for a moment. How do you get a block of code like that very, very quickly? They weren't sitting down and writing it by hand. They were going to their systems and going, I've done this before. I don't know what I can do. I'm going to copy this and paste it into my answer. Think about this. We all have passwords in other people's systems stored this way, guaranteed. At best, we all probably still have passwords stored as plain text. Maybe in virgin. So this stuff keeps happening. And this is really quite a problematic thing, but we can learn an awful lot as well by looking at the questions people ask on forums. We can learn a lot about the way organizations are implementing their security. So we can learn things like this. I so hope that's not my bank. I really do. And it's just amazing to see this stuff out there. And you see so many examples where just at first glance, we all go, oh my God, what are you thinking? But it also made me realize that security is confusing. Stuff like this is confusing. Obviously, the guy is confused as to why this is a bad idea. Even things like whether you should use PGP or Wingdings is confusing. Come on, a slight little buildings and airplanes and cars. That's encrypted, right? You can't figure out what it is. I like the last sentence. I just bought a laptop so I can install my own stuff with my Wingdings encryption. And people do this. I wonder if we've got passwords stored as Wingdings. How do you even store passwords as a Wingding? I've got no idea. Now, I don't want to just blame us. And again, this is a colloquial us because it is developers that build these systems and we've all done stupid things with code before. It happens. I also do want to blame the users. And I think we all probably like to blame users. Any of you who've had sort of a help desk role before has probably had to deal with users that we'd probably rather forget. And they do do some crazy things. And we can see it evidenced in examples like this. Now, whose Twitter account is this? This was a few years ago. And this was Burger King's Twitter account. And apparently, the whopper has flopped and they have become McDonald's. Now, this was when Twitter got hacked. Remember when Twitter got hacked? No, I didn't really do that. Even though the news headlines say that because you open up the news headlines and they say Burger King's Twitter is hacked. That is one possibility. But probably more likely possibility is Burger King just had a really crap password. Or they did something really stupid. And you still see it to this day all the time. Such and such Twitter hacked. And that's never what it actually is. It is bad password practices. Almost every time. It's either that or phishing. Falling victim to a page which says, please log into your Twitter. And they just go, yeah, okay, here's your stuff. Curiously, Burger King's follow account went up massively when that happened. They had like 90,000 followers. Within 24 hours, they had 120,000 followers. I'm not necessarily saying this is good social media advice. However, it did get a lot of attention. So it makes you wonder, right? So how are people losing their passwords so easily? Because we see this stuff all the time. I saw this with Tesla last year as well. It happened to them too. Another one that happened to last year was TV5Mond in France. So TV5Mond had their Twitter hacked. So they go and they interview this reporter at TV5Mond because they're trying to figure out how on earth this could have happened. And the guy's sitting there at his desk in front of the wall behind him with his passwords on the wall. So the penny dropped and they went, oh man, look what we've done. That wasn't good. You know what we'll do? We'll come back the next day. We'll do another interview. So they interview this other guy. This is how Twitter gets hacked. Post-it notes. But you know, the other thing it says is that in these incidents, there's no multi-step verification as well. So you should be able to lose your Twitter password and not have someone take over your Twitter account. And think about this for all your social media accounts and every account that's important to you. Could you publicly post your password and not have your account owned? So clearly they are missing something pretty serious. I do think though that we give mixed and confusing messages, we encourage people to do bad things security-wise just by the design of a lot of our apps. So for example, what if you wanted to queue our barcode scanner for Android? Now don't worry. OK, the barcode scanner does need your calendar, your contacts, and your location. I assume it's trying to schedule when it should do the scan and it has to look at your calendar or something. I don't know. Like why would you ask for this stuff? It's massively invasive and it could well be malware. Here's the problem. When a user goes to download this app, what do you reckon the one thing they see on the screen is? It's accept. It's like what is the thing that is getting between me and achieving the objective that I came here for? Just that button. So we build these systems and again colloquially we. We build systems that ask for excessive permissions. We build systems that throw security warnings all over the place and then tell users just to accept it. There's really bad news. And the thing is security is confusing to consumers. They see things that look legitimate and then they take it as gospel. A good example is if you're going to buy an HDMI cable, would you get one that had antivirus protection? Now, buying HDMI cables is confusing at the best of times. But can you imagine, let's say one of your parents, say you've got non-technical parents and they're at the shop and they're like looking at two, they're trying to decide, well, this one's got antivirus. What are you going to do? Someone wrote this and decided this was a good idea and it's in shops, which is kind of scary. Now, as bad as that is, I also think we give very bad messaging to people. And particularly when you look at the messaging that comes via social media, you see some really, really crazy security advice. So I saw one just a couple of months ago, this one from Tu, social media site. And the guy here has said, hey, you're accepting credit cards over HTTP. And Tu tried to make them feel a little bit more comfortable about their security prowess by directing them to the VeriSign logo. We have a VeriSign bitmap on our page, Ergo, we are secure. Please enter your credentials into an insecure page. And this is a proper official account, giving consumers this sort of advice. One a little bit closer to home for you guys, British guests. Someone had complained that they couldn't paste in their password from their password manager. And this is apparently why you can't do it. Now, I am not sure what the security certificate is. This is the first thing. Like, is it they take away your SSL? How does this work if they allow pasting? But I love this last sentence, leave us open to a brute force of take. Now, have a think about this, right? Because what they're saying is, you shouldn't be able to paste passwords into the field. And the best I could come up with is like a Chinese sweatshop, right? It's just thousands and thousands of people all going, control C, control V, control C, control V. I don't know. Doesn't make any sense. Another one a little closer to the UK. This is EE. Now, EE is responding to people who have queries and saying, please send us all your sensitive information over Twitter using DM, where it will sit in our Twitter account, which may be hijacked at some time because we know why now, may be emailed to them as a notification in security. But more than that, think about the conditioning side of people. If you created an account called EE-support-help, whatever is available, EE-help 2, probably doesn't even matter. You put the logo on, doesn't matter that it's not verified, and you just started replying to people like Jay Shepherd. With this message, how many people would just go reply and then send their sensitive data? A lot of them would. And these practices, even though that's a legitimate account, verified account, mind you, Tesla was verified when they got taken over as well. So assuming this was actually their intention, it's just setting a really, really bad precedent. Now, some of you may remember a few years ago, Tesco and I had a little chat, and they sent me some advice about how they stored passwords. This baffles me to this day. If anyone knows how this actually works, if there is anyone from Tesco here, please come and tell me. But this was their response when we discovered that they were emailing passwords around. And again, this is enormously confusing because they are giving this feedback to consumers. People are getting these messages and they're going, oh, okay, now I understand, it's fine that you email it, because it's automatically copied and blah, blah, blah, blah, blah. So that's the communications we're giving people. Now, there was another thing that happened last year as well, which was kind of interesting, in many ways a lot less humorous, although some funny aspects. And this was the Ashley Madison hack. So Ashley Madison was a really, really serious security incident, and we learned an awful lot from it. So basically what happened, August last year, hackers broke into Ashley Madison and they said, we have stolen all of your things, shut the service down, or we're going to publish all the data publicly. And there are a couple of things that the hackers weren't too happy about. So one of the things that they didn't like is that if you were a member of Ashley Madison, hypothetically, I'm not saying any of you are, hypothetically, and you then wanted to leave and you wanted them to delete your data, you had to pay them $19, permanent delete fee it was. And what the hackers found is when they broke into the system, the way that Ashley Madison did the permanent delete is in the membership records, they zeroed out all the personal identifiable data. Okay, so your name, your address, your email, all that sort of thing. But when you paid, you now had a payment record that had a foreign key to the membership record, and your payment record had your name, your email address, everything on there. So these guys had to break into the system to discover that, but they were quite right. Ashley Madison was charging people for something which they weren't delivering on. So they were upset about that. They were upset also about the very existence of the site because as the slogan here says, life is short, have an affair. So clearly they had a moral dilemma, the hackers that is, and they thought, okay, we've got to take these guys down. So they took them down and they published all the data and it just got torrented massively, very, very quickly. It's all over the place. It is never going to get back into the can. That genie has well and truly popped. Anyone can go and download all the Ashley Madison data now very, very easily. Now, because we're so broadly distributed, a lot of people started monetizing it. So we saw stuff like this. So this was a service where you could search for people in the Ashley Madison data breach. And then when you found them, it would return all of the information they had in there. So here we have things like the name, obviously, I've obfuscated a lot of this, phone number, address, everything. It also included things like credit card transactions. So you could get a really high degree of confidence that someone actually deliberately had a site there and then what their activity was. Now, I also have this system, my HavocmPone system, and I let people search for their own data and it would only say yes or no. In there, not in there, but only if I knew that they owned it. But these guys were just making it a free-for-all. And you might look at this and go, well, why would you do this? Like, what is the value proposition of standing up a service like this? And it helps to understand when you see it in context. All right, ads. I'm monetizing via ads. Top one, easy cheating on you. Reverse search. So, you know, Clare, or the contextual, I'll give them that much. I also saw that rotate over divorce lawyers, so they were trying to sell divorce lawyers there. As you can see on the right-hand side of the screen, GPS trackers, maybe you should track your significant other. The one down the bottom right is sexually transmitted disease tests. Because if you're on Ashley Madison, that may be something you want to consider. Although, curiously, it was basically just guys and fembots. So, I'm not quite sure how relevant that actually is. Some of the other links there towards the bottom left include links to things like spyware. And one of the links goes off to an app called Mspy. And Mspy was spyware that you could install as they represent it. They say you could put it on your kids' devices and make sure they're doing the right thing. In actual fact, most people were putting it on their significant others' devices or compromising someone else's devices and spying on all their activity. Mspy, earlier last year, was hacked. And all their data was leaked publicly. So now you've got this here as a result of Ashley Madison being hacked and all this personal data there, encouraging you to use the spyware tool, which was also hacked and leaked all the other personal data. And it just kind of makes your head spin how entwined all of these attacks are now becoming, because there's just so many of them. Now, in terms of monetizing the data, we also see things like this. So this was a company called Trustify. Trustify PI, Private Investigators. And they stood up a service that allowed you to search for anyone. And what they did is immediately after you searched, it sent an email to the person you searched for and suggested that they buy their Private Investigators services. How sleazy is that? That is terrible. And regardless of your ethical view on the whole thing, you still see issues are just enormous. So you've got a wife searching for a husband. And again, it was normally a wife searching for a husband, because it was mostly guys. And then the guy gets an email address, says, hey, someone's searching for you on Ashley Madison. You know, that would just be terrifying. But what's interesting about this is that this message was generated from a social icon on the page after the search. So what Trustify were doing was not only encouraging people to search and then sending email addresses to the person searched for, but then encouraging the searcher to share socially the fact that they had searched and that they had found their ex. Not only were they encouraging them to do it, but they even favorited it. They just Trustify favoriting it. Now, you might look at that and go, OK, well, that's a bit of, you know, people are going to search for their ex. It's a bit of, you know, screw you, you're on Ashley Madison. But they're also doing this. Man, with friends like these, hey, they're encouraging people to search for their friends. Same sort of thing. And again, they were selling private investigation services and making money out of it. But what a lot of this doesn't recognize is just how serious the incident was. And I got literally thousands of emails from people after this thing happened. And I got one like this. And I sort of highlighted the bit here that's really significant. I've contemplated suicide daily for the past week. My two beautiful children and wife are keeping me alive. And I had multiple emails like this where people were literally willing to kill themselves over the incident. Now, granted, look, they're having affairs. They're doing the wrong thing. They're always going to have some degree of problems. But Ashley Madison and the data breach was the catalyst to that. And some people did kill themselves afterwards. And I just thought this was curious for us, particularly as developers, because normally we think of users as these faceless things. We say users, not even, you know, people. But they are individuals out there that have lives and families. And in some cases like this, if we get it wrong, they may even die. So that was Ashley Madison. And that was a pretty unprecedented event. But I want to move on a bit and talk about security in physical things. And this is where it's getting really interesting, because we're seeing a lot of connected physical things and a lot of security incidents in physical things these days. But sometimes security in physical things can actually be a really simple concept, like this. That just wouldn't feature in your threat model, would it? You know, it's like you're worried about cyber jihadis, obviously, SQL injection, all that sort of thing. Envelope with a window. No, it wasn't even in there. And I just think this is a great example of how we can take this sort of digital world and do everything right. And then as soon as you print it, yep, it's all over. We just circumvented the whole thing. Now, we can also use the physical world to great effect to circumvent digital security. We can do things like this. So let me explain what's going on here for those who may not recognize RSA tokens. This is two-factor authentication. You have a token, which is seeded and then shows a unique number. And it's like 2FA that we have now in our phones, which is kind of two-step verification, because you often just have the one device. But this is generally a separate device. So you have the unique random number on the device, and you've got a PIN number just beneath that, or just above it on the white paper, which is obfuscated here. So what someone has done is to solve the problem of having to give everyone secure tokens or carry it around, they've gone, you know what we'll do? We'll just point a webcam at it, right? And then we will go to an address somewhere, but it may be publicly accessible, a lot of publicly accessible webcams. And then we'll have everything that we need in order to complete that second step of verification. It's cool. It's ingenious. I like that. I mean, don't do it. It's kind of cool. Another good example recently of physical security was this one. This was VTech. So VTech was a big story that broke a couple of months ago. A journalist got in touch with me and said, someone has given me a whole heap of data. I want you to help me verify it and see if it's legitimate, because a lot of this stuff is fabricated. And we sort of went through all the data and we discovered it was legitimate and discovered how it was collected. Now, what VTech does is VTech creates kids toys, a Hong Kong-based company, billion-dollar revenues. They're very large. And one of the toys they create is like, imagine if Fisher Price made an iPad, right? And it's going to be all colorful and cute and stuff like that. And the theory was that little Johnny could have an iPad or a VTech tablet. And little Mary could have one as well. And then they could talk to each other. And what parents obviously didn't realize in many cases is that the way this magic talking to each other happens when you're in completely different locations is the Internet. There's services, there's APIs behind it. So what happens is little Johnny and little Mary are signing up with their names. Okay, fair enough. Mary wants to know she's speaking to Johnny. With their birth dates, which is also kind of fair enough, because when you have kids creating social networks, they probably want to pick an age that's pretty similar. And their genders, again, kind of fair enough. Girls want to talk to girls, so on and so forth. But they had to create this data in the system. And the parents had to set up an account under which the kid could create theirs. So the parent had to create a whole bunch of data as well. And what it meant was that the data that was given to me had about 4 million parents in it and about 280,000 kids. And the kids' records had foreign keys to the parents. So you could literally pick the child that you wanted in terms of those attributes and then find them, because the parents' records had physical address and phone number and email address and everything you need in order to find them. And that was 280,000 records. And then VTech, in one of their announcements, said it's actually 6 million kids. So 6 million kids, 4 million adults. And all of this data has now just been made, fortunately not made public, because we think that the guy who broke into it only gave it to the journalist. The journalist only gave it to me. I certainly didn't give it to anyone. So hopefully that was the end of that. But it also leaked the photos as well. So not only could you pick the gender and the age of the kid, but you could actually pick exactly what they looked like. So VTech made serious, serious mistakes in the designs of their systems. So they did some things which were just obvious, although not entirely uncommon, so they had no HTTPS anywhere. They did other things that were kind of ridiculous. So when you logged in, the API that you hit returned a response that had the SQL statement that was run in the database. Why would you even... Maybe debugging, I don't know, but that's just the weirdest thing. They had direct object reference risks, which means you could load your record and it would pass a parameter. Your ID is number 257. If you asked for record 258, you'd get someone else's. 259, you'd get someone else's again. They made all these really big, big security mistakes. But they're moving on. They're now doing home security. This was CES last week. The journalist who wrote the story took this photo for me. He said, I thought you might find this amusing. I probably wouldn't buy this home security gear. It's probably not what you want. So this is what those guys are now doing. But of course, particularly at CES, there was a huge number of internet-connected things. IoT is everything these days. They want to connect all of the things. Apparently, your fridge and your toaster need to be able to chat where you're asleep. Or do whatever fridges and toasters are meant to do with each other. But we're seeing other things in the IoT world like this. This is LIFX. This is an Aussie invention. There are other light globes out there, connected light globes. LIFX is Aussie. And they're really neat, and I'd really like to have them if they weren't exorbitantly expensive. But basically, the way this works is you've got your smartphone, and you can change the color, and you can change how bright it is. You can set schedules and moods and all sorts of things. And it's all kind of geeky and cool. But LIFX had a vulnerability in their light bulbs. And here's the curious thing. People think about vulnerabilities in IoT, and they think about the risk to the device. And people would say, OK, my light bulb might get hacked. Think about that for a moment. My light bulb might get hacked. But do I really care if an adversary puts my home into disco mode? It makes everything flash. However, the vulnerability in LIFX didn't just allow them to put the home into disco mode. It leaked the Wi-Fi credentials of the home network. So this is a much broader issue. Just yesterday, I was reading about an internet-connected doorbell. You heard me right. An internet-connected doorbell did exactly the same thing. And there is an internet-connected kettle called the eye kettle that you could tell net into. Yes, you could tell net into your kettle and discover that there's a default pin on it. And you could actually de-auth the kettle, make it join your network, tell net into it, and then get the Wi-Fi credentials of the original network. So anyway, LIFX said, OK, we've had a vulnerability. And, you know, we're sorry we screwed up. We'd like you to run to patch your light bulbs. And I thought about the might like, is it USB? Like, do you plug it in? Or maybe you do it with a companion? I've got no idea. I have not yet come to the sort of realization of what it would take to patch a light bulb. And I think a lot of other people have either. But the other thing they said is, yes, we had this vulnerability, patch of things. But we're not aware of anyone having been owned by their light bulbs. And I thought that was curious because I also don't think we're quite at the point we were ready to accept that our light bulbs might be the attack vector into our home. And particularly when you think about the risk, right, the risk was disclosure of Wi-Fi credentials. So the exploit to that would be that your neighbor's torrenting over your network or something like that. And if you discovered your neighbor was doing that, would you say, I bet it's the bloody light bulbs that I put in the other day? We're not kind of at the point of accepting that yet. But in terms of connected things, it does get worse. Anyone got one of these? This is Elixil Satus. This is genuine. It's from Japan, like all good toilet things are. Now, I can't read any of this, so we're going to have to speculate a little bit about what's on there. So first screen top left, I assume, is some sort of a splash screen. LAUGHTER Middle screen, evidently, is a calendar. And this has me curious. It's some sort of event-driven data, as best I can tell, on the calendar. I'm not sure exactly what it is. But the right screen is a music player. And in case you can't read it from the back, this is genuine. You can Google this and find it. The toilet is playing. I can't get no satisfaction. LAUGHTER Now, I saw this a couple of years ago, and I had a talk, and I said, look, we're going to have to be a bit cautious here, because we may well find that there is a vulnerability in the toilet at some point. And wouldn't you believe it, there is. There's a security advisory from Trustwave. LAUGHTER This is terrifying! LAUGHTER Can you imagine an attacker activating the bidet while you're there on the toilet? I mentioned this in a talk, and someone said, yes, that's known as a backdoor attack. LAUGHTER On that note, thank you very much. APPLAUSE
 So a quick tutorial on how to DDoS.  Now before I start I'd just like to say I'm not responsible for anything you do with the  information I've provided in this video for you.  So if you're going to DDoS someone with this information which I've given you, I'm not  responsible for nothing, absolutely nothing you do.  So yeah now that I've got that out of the way let's get started.  So what we've got to do is we've got a load up command prompt.  I like my color green.  Then what we want to do is we want to type ping and then I've got a bunch of random IPs  here.  So ping and then just paste it or you can type out Python T, Python AL and then the  amount of packets.  So this is the command it pings them and this is the IP or ping.  This is how long you want it to do it for.  So I've put a limited time, this is how many packets you want to send right here.  So let's just hit that and as you can see it's already began the process of DDoS and  the IP.  Now there's one thing I'd just like to say like when you do this sometimes it will come  up with like a timeout message.  This means that the IP could be wrong or in fact your connection is not strong enough  to send packets or could just be a general error because like it could do all of this  and then just say timeout and then carry on.  So it could just be like the ping's not actually sent.  So once you're done you hit control C and send 43 packets, they receive 43 packets,  they lost nothing on your computer so 0% lost.  So basically they must have a strong connection.  You've got to do this for a while with this method.  So like go outside and play YDDoS and then what's going on.  I'm also putting new on YouTube as well.  Alright, who liked that?  How did DDoS with ping?  Is it good?  I'm not responsible if you're going to DDoS anyone with ping.  Do you like the bit where he goes just go out and play while you're DDoSing.  Gives you a little bit of a sense of how sophisticated some of our cyber hackers might be.  So we see a lot of this sort of stuff from Anonymous and the like and I saw this come  up the other day so this was after the Paris attacks and Anonymous decided they're going  to take down ISIS which is a worthy objective and there was this story about we're going  to take them down.  You've got to remember Anonymous a lot of the time are these kids with a bit of spare  time in their hands but what I liked about this article was the number one rated comment  on it.  Isn't that awesome?  It's funny because it's true.  Moving on, this talk is about 50 shades of app sec and the idea is that application security  is a really broad space and there's a lot of crazy stuff that happens.  There's a lot of really interesting things that happen and a lot of things we can learn  from it particularly as developers and software engineers and all this sort of thing and it's  really interesting to sort of see some of the stuff that's happening out there in terms  of what is built, how things get compromised and how some of these malicious actors actually  behave.  So here's where I thought I'd start and there's going to be 50 different things going to show  you.  Look, there's a 50 shades bit.  It's not a salacious sort of thing.  You've got to see 50 different interesting things.  I want to start here.  Democratization of hacking.  So let me talk a little bit about what I mean by this.  This is about how anybody can become a hacker.  So it's becoming really, really easy for anyone to start breaking the systems.  I want to give you an example.  You know, so this kid here, a couple of years ago, this kid hacked the Xbox.  We know he hacked the Xbox because the news headlines tell us.  But he did actually hack the Xbox.  He managed to fat finger the controller and elevate privilege to circumvent parental controls.  This is serious, right?  His dad's a security guy.  His dad was pretty happy about the whole thing.  He's now on the Microsoft security researchers Hall of Fame.  This is a five-year-old kid, not the dad.  The kid got a bugbunny.  Look how excited he is.  He's like, yes, I'm breaking the Xbox.  But this is proper hacking in so far as he could reproduce it as well.  It wasn't just like a one-off.  He figured out how to actually escalate privilege.  He's five years old.  It makes the rest of us somewhat kind of failure sometimes.  I haven't even hacked an Xbox yet.  Anyway, five years old.  So this is the point, right, with anybody being able to be a hacker.  Now that one, in a way, is kind of simple.  Although I don't know, it's Microsoft and the Xbox, and he's five years old.  Anyway, we'll move fast that.  If you wanted to hack stuff, you could go and get a browser plugin like this.  It's called Bishop.  So there's a browser plugin that just runs in the background.  So you browse around the web.  And as you're browsing around, it looks for vulnerabilities in the sites that you're using.  The news site, your bank, whoever it might be.  And it looks for things like exposed version control, misconfigured admin, and it does  it all automatically.  So when all you need is a browser plugin, anyone can be a hacker.  It is that easy.  Now you might then decide that you actually want to get a little bit more serious about  it and actually learn how to hack.  And you can find tutorials online like this.  And what they do here is they find a website that's got a query string with an integer.  They add a single quote and load the page.  And when they do that, they get a SQL exception.  So it's probably a SQL injection risk.  All you got to do after finding that is you copy the URL and you paste it into this free  software called Havage.  And then you click the analyze button, and now you have all the data.  And it is literally that fast.  It is really, really simple.  Really available software.  You just find a URL with an ID in the query string.  A lot of sites are at risk of that.  This is exactly the sort of thing that happened to TalkTalk.  I mean, I assume that was big news here because it was big news even in Australia.  It was kids who managed to use tools like this, and they knew how to copy and paste.  And that was about the extent of their security prowess.  Now just in case you don't want to hack yourself, but you'd like someone else to hack for you,  you can go and use a hacking service.  It goes like this.  Find professional hackers for hire.  Now what struck me with this is that this is not a dark website.  This is out there in the clear.  It's kind of a nicely designed site.  Lots of smiling stock photos.  Everybody looks very happy.  This is a very mainstream sort of site.  It's even got HTTPS.  It's quite nice.  You can go and start a project for free.  A project usually involves something like compromising your significant other's email  in order to figure out if they're having an affair.  That's what they mean by project.  Now the interesting thing is, is that because it is so easy for anyone to become a hacker,  we start getting a lot of this.  We start getting hacktivists.  There's a bit of a confusing term, and everyone's got a different idea about what a hacktivist  is.  But I really like this definition.  And this is it.  Literally 30 minutes ago, I was sitting there waiting for my talk, and I'm reading the news.  And Nissan has been hacked.  Distributed denial of service.  Maybe we don't call it a hack, but they've been taken offline by anonymous.  Anonymous has taken Nissan down.  You know why they took Nissan down?  Because of the whales.  That is the reason.  It's in the news at the moment.  Nissan is offline because anonymous doesn't like the fact that Japan is knocking off some  whales.  That's fair enough.  It's not Nissan's fault, though, but still.  So that's where we are.  And by the way, if you don't follow Swift on security, that is an awesome account.  It's got really, really interesting stuff in it.  So let me give you an example of this.  This whole sort of opportunism.  So this was an Aussie site a few years ago.  And as we can see, it was hacked by anonymous.  And government continues to blah, blah, blah, blah, blah, the rest of it doesn't really matter,  because it's all sort of pointless ranting.  It is Op Australia, Op Trapp wire, Op Freer Science.  It'll be what Op they want it to be in order to make up something that seems like they  had a good reason to break into it.  So they thought this was a government site.  And it turns out that it was an NGO.  And it was an NGO to help people with disabilities become rehabilitated.  And frankly, I think in this case, Kath has probably even been a little reserved.  I might have used some stronger words.  You know, this is crazy.  It's an NGO trying to help people.  And they've knocked them offline because it was there.  That's about the extent of it.  Now the problem that that creates is that you end up with situations like this.  So you end up with kids, either legally kids or they are younger than us, therefore they  are kids going to jail.  So these guys are from LullSec.  They had a lot of infamy in about 2011.  They're both turning up at court with their mums, right?  Because this is what happens when you're a kid and you get court hacking.  You get your mum to take you to court.  Have a look at the expression on the mum's faces too.  They are seriously pissed.  These kids are grounded like just forever.  Also maybe going to jail.  Different story.  But this is the thing.  They are just innocent kids and for all the sort of dark masks and green writing and binary  images that you see every time when the news breaks, you notice that every news article  they have three things.  The hackers that are the stock photos, they have hoodies, they have Guy Fawkes masks and  then they have binary somewhere in the image.  And green, lots of green.  That's hack a talk.  Now thinking about hacktivists as well.  So I mentioned talk talk.  When the talk talk incident broke, one of the first news stories I saw was a detective  said we think that they are Russian Islamist cyber jihadis.  There is a news story about this.  I swear to God.  Russian Islamist cyber jihadis which is just like the perfect storm of scary terms.  Now as it turns out, it was a 15 year old kid in his bedroom in Ireland.  I assume in his bedroom because we're asking a hack from him when he's 15.  It's not like you go to work and do it.  So they arrested a 15 year old, arrested two 16 year olds and then there was this really  old guy like 20 years old.  And that's what it took to break into talk talk.  And that was obviously a really massive story and it did some serious damage.  But it was just kids with free time.  That's what it takes to break into a lot of our systems today.  Now the problem is even kids with free time, once they break into systems, we get into  this realm of criminal activity.  And that's why these kids are turning up the court here because it's a serious crime when  you break into these systems and pull data out.  Now the thing about cyber hacking for one of the better term is that as a crime, it's  pretty safe.  Like you think about it, go back 20 years.  If you decided that you wanted to be a criminal and you might break into a service station,  you might try and rob a bank, someone might actually smack you in the head with a baseball  bat.  Other parts of the world, America, they may shoot you.  You were at serious risk.  It is a high risk venture.  But you hack online and it's like the kids, right?  They're just in their bedrooms.  So there's a very, very low risk of getting caught if you're involved in criminal hacking.  So this is a real problem.  And I'll give you some examples of the sort of criminal hacking we see.  So we see stuff like this and this is sort of really kind of a name criminal hacking.  This is a pasted-in-paste goal.  Still an isolated data for the LULs.  Want you database off the internet, send Bitcoin.  So what these guys have done is they've broken into a system.  They've published the data and they're trying to hold the company for ransom saying we will  remove you from the internet if you pay us money.  And as ridiculous as this sounds, this is what professional organisations are also doing  when actually medicine happened.  They said, hey, you can sign up for our service and pay us a few hundred bucks and we'll remove  you from the internet.  I mean, don't worry about the fact it was torrented like hundreds of thousands of times,  we'll work it out.  We'll try and remove you from the internet.  So in this case, they're saying give us Bitcoin and we'll take the stuff offline.  Then we see things like this, which is give us Bitcoin and we'll put more stuff online.  So they're appealing to a different demographic.  And we see a lot of this sort of thing where what they're doing is saying we have got some  data from a system, we will give you more data if you pay some money.  So this appeals to a certain criminal element.  Now does everyone remember when seven million Dropbox accounts got hacked?  Because I don't.  Because it didn't happen.  They just make it up.  So they make it up and they seed these data dumps and very often it is on the likes of  a pace bin, they seed them with data dumps from other places, so they will take a whole  set of data and then they're just rebranded.  And I know this because when I use a system like my have been poised and I search for  accounts to try and figure out if something is legitimate, I see the same accounts appear  over and over again.  So the Dropbox.com hack was the same as the Snapchat hack, which was the same as the Facebook  user hack and the Twitter hack and the data just gets rebranded as a different attack.  Now I don't know how many people actually pay for this.  How many people do actually throw them a Bitcoin, which is a few hundred pounds, like a Bitcoin  is not cheap these days.  A lot cheaper than it was though.  So they throw them a few hundred pounds, but even as only one or two people it is such  a low overhead thing to actually create this sort of criminal activity.  Now another interesting one that we saw recently was this.  And this looks like it's got a fold in it because it does.  This is actually a physical piece of paper that was sent out to businesses and this went  to a pizza place in New York as well as a whole bunch of other organizations and it  is an extortion racket.  So what they're saying is give us Bitcoin or we're going to do bad things to you.  We're going to do things like make reports of mercury contamination or marijuana grow  operations, possibly terrorist training activities in your pizza place as well.  Not quite sure how that works, but let's just assume that that is a thing.  So they were threatening reputation damage if money wasn't paid.  And what I saw there is it kind of reminded me of Pulp Fiction.  A lot of you have probably seen Pulp Fiction start of the movie.  They're talking about a guy goes into a bank, he's got a phone, he says give me money or  I'm going to tell the other guy on the other end of the phone to kill a little girl.  You don't know if there's a little girl.  You don't know if any of this is going to happen.  But it's a threat and one Bitcoin, you know, you don't want to give it away, but if you  just paid one Bitcoin to make this go away, it's not a whole lot of money.  And inevitably people did pay it.  We see people pay extortion records.  So we've seen extortion records like this for Ashley Madison as well.  After the data came out, very easy just to do a mail merge on 30 million people, you've  only got to get a very tiny slice of that to give you a Bitcoin and you've done quite  well.  So what do cyber criminals do with their money when they get it?  They go to Rio and buy hookers.  And this is one of the things that they were doing after compromising routers there.  So have a think about how this works.  And this is an attack that does happen a bit.  The router bit anyway.  So what they do is they find a cross-site request for drew risk in the firmware of a  router.  So imagine you go to a website somewhere.  It could just be a normal everyday website.  Could be infected with some malicious ads, which does happen quite a bit.  And when you load the ad, it makes a post request to 192.101, whatever the default router IP  is.  And that post request says change the DNS records of the router so that we get host names  resolving at the attacker's service rather than the legitimate service.  And then when you can do that, you can route every single request to a legitimate host  name to say Fishing Page.  So you go to your bank, but it's not actually going to your bank.  It's going off to the hacker's Fishing Page.  They compromised a huge number of people using attacks like this.  Now it does pain me to see criminals being successful.  But it excites me to see them failing.  And we've seen some really interesting things in terms of the way criminals come undone  online.  So give me an example.  This is a Stack Overflow question.  How can I connect to a tall, hidden service using curl and PHP?  And the example the guy gives here are very, very specific.  And what ended up happening was it was discovered that this was a question asked by a guy called  Ross Orbrit.  Yeah, Ross Orbrit was also known as the Dread Pirate Roberts.  And he was also known as the founder of the underground drug market called Silk Road.  And he was using Stack Overflow to ask about how do I connect to my underground drug market?  Using an email address that was traceable to him.  And this was one of the pieces of evidence that eventually got him caught.  He was also trying to kill people.  So none of that really worked out too well for him.  He probably won't be ever coming out of jail.  He made tens of millions of dollars in Bitcoin from running this Bad Stack Overflow question  brought him undone.  So moving on, here's another good example.  So this guy was in the news quite a bit a while ago, Jihadi John.  Now he was in Syria chopping people's heads off and making videos about it and creating  much fear and alarm.  And what was unusual about Jihadi John is he had this strong British accent, which is  not sort of the demographic you tend to get from this kind of actor.  So everyone's trying to figure out, like, who is he?  Who is this Jihadi John?  Because obviously he spent time here in the UK.  And then the feds found some interesting activity.  They found that a Syrian IP address was buying web design software from a UK store.  Apparently that's an unusual traffic pattern.  Not only were they buying web design software, but they were using a student ID to get a  discount when they bought the software.  So this is the guy.  Muhammad Mwazi, he is Jihadi John and they brought him undone because he was buying some  sort of web software using his ID to get some stupid discount.  You know, like, use a VPN at least.  So as terrifying as some of these guys are, some of them are also kind of stupid, which  is good news for us, you know, as the good guys.  Now speaking of doing stupid things.  Has anyone seen this?  So here's what happened here.  This is a sort of, I guess, inflammatory sign.  And basically what was happening is there was a hacktivist group known as Cabin Crew  going around owning Texas law enforcement.  Now I've not been to Texas, but I don't reckon they got a whole sense of humor about kids  coming and owning their stuff.  So anyway, what these guys decided to do, this guy, Wurma, Wurma and Cabin Crew, he's  obviously trying to, you know, sort of rub them up a little bit in terms of upsetting  the law enforcement.  And he goes to his girlfriend and he says, hey, I've got this good idea, right?  Print this sign out, get a low cut top, lean over, and then with your iPhone, take a photo  of it.  And then we'll put that on the sites that we compromise.  Now who knows what goes on to a photo when you take it with an iPhone?  Metadata, geotag data, down to about seven decimal places of latitude and longitude.  So the cops now have this, right?  So they have the photo, they have the Latin long.  And as it turns out, it was down in Australia where this particular lady was.  And I can only imagine that they've got the Latin long and they've got the photo.  And they've sort of got a rough idea of the area.  And then they have to go around and try and somehow match it up.  The mime boggles.  But they did match it up.  And it was this lady here.  And this guy is Worma.  And what strikes me with this is how normal they look.  Like they're just, you know, you'd pass them in the street and go, just two normal people.  Like he doesn't even have a hoodie, right?  So they're just very normal people.  And it sort of goes to that point again of anyone being able to be a hacker.  You can just be a perfectly normal couple.  And then, you know, behind closed doors, you're sort of online cyber jihadi, or maybe just  cyber hacktivist.  So it's a curious thing.  Anyone doing this sort of thing can easily become a hacker.  And when you look at this and you go, all of these people are really, really easily breaking  into our things.  You got to ask the question, is this the problem?  Do we make it too easy?  So we as the developers, are we building systems that are too easy to break into?  So that got me curious.  And I had a bit of a look around.  I thought, let's see if we can find some of the ways that people are breaking into our  systems.  And I found a login form.  Now, you can Google that text and you will find this.  It is real.  It exists.  This is not fabricated.  It's not as bad as it looks in a way.  I mean, it doesn't make password reset easy.  You just go, OK.  I remember my mobile number.  That's cool.  If you do need to password reset, you basically have to change your phone number, which is  problematic.  You then can't give it to anyone either, because it's a secret, right?  So you can't give your secrets out to anybody else.  But this is a system.  Somebody designed this and I thought it was a good idea.  I don't even know why you bother with a password.  Like, can't they just do a substring or something and just go, OK, here we go.  One less step.  This was another one.  This one was from the UK, vet fair.  I have a lot of UK examples, very coincidentally.  But what happened with vet fair, I was watching the Twitters one day and there was a journalist  having an online argument with vet fair.  And what the journalist was saying was, I went to vet fair and I went to reset my password.  And all I did was enter my email address and my birth date and then set a new password.  So not receive an email with a unique link in it that's time limited with a nonce and  does all the things that a reset's meant to do, I just did it all in the browser.  And vet fair is going, no, you can't do that.  That's not how it works.  And they're arguing with the guy.  And vet fair was really obnoxious about it.  It was likely that they were going to delete it.  So I screen capped it so they had a backup, which is now on my website.  But they were being really obnoxious about the whole thing.  And anyway, then the penny drops and vet fair realizes, oh shit, we can actually do this.  You can actually reset it this way.  So they say to the journalist, you shouldn't share your username with anyone.  And the journalist going, but it's my email address.  That's how I get email.  So vet fair says, well, you shouldn't share your birth date with anyone.  And the guy's like cake and presents and things like that.  And the thing is, this is legitimate.  I ended up going through and recording.  So I can't believe I do this.  Oh man, they actually did this.  So I recorded the whole thing and put in the blog post.  And interestingly, I showed this example at a Keynote in Amsterdam last year.  And after I did the talk, I came at the stage and this guy came up to me and he gave me  his card and it was vet fair security.  And I'm like, oh shit, I'm in so much trouble.  But the interesting thing is he was really cool.  He said, thank you so much for writing that.  We knew this was stupid, but marketing.  Anyone ever hear this, but marketing?  Marketing would like to do it this way for usability.  There is some business reason.  And it's often only after there's a bit of social pressure to get the organization to  do the right thing that they change.  And the people there know that it's stupid, but they've been asked to do it and here we  are.  So another good example I found.  So you can see a problem with this one.  Now this is JavaScript on an HTML page.  It's a login form.  Now you're laughing, but consider the virtues for a moment as well.  Number one, latency.  No latency.  No server post backs.  Scalability.  You could have a million people log on at once.  It wouldn't matter, right?  The thing would scale very, very well.  But this is a login form.  People do this.  This is a sitemap.  This is one that I found.  It is legitimate.  I saw it firsthand.  And let me explain what's going on here just in case it isn't immediately obvious.  So this is a sitemap which is meant to be an index of all the resources on the site.  And someone in all their wisdom has said, you know what?  People are a resource.  So what we'll do is for each person in the database we will make a node in the sitemap  and we will put their email address and their password.  And this is what was in their sitemap.  This is legitimate.  It's not fabricated.  So when we do things like that, we do make it enormously easy on attackers.  I mean, ridiculously easy.  It's like, do you know how to view source?  Yes.  So that's really super easy stuff.  But we also see stuff like this.  Now some of you may recognize this as a SQL command and some SQL syntax.  Some of you may also recognize this as a SQL injection risk because you can put whatever  you want in that TXT email field and the text value will be appended into that statement.  So for example, I could go and sign up on this website and I could say a single quote  which would close off the string value of email, semi colon which would close the SQL  statement, drop table login table, and then I'll just make a little dash dash in there  as well to comment out that other single quote that's going to be appended to the end.  And if the web app had the rights of DBO on the target database, and frankly if you're  doing this, you're probably going to screw that up as well, the log on table would be  dropped.  And I explained this to someone once and they said, aha, but that would not comply to an  email pattern and there's a regular expression validator on the email.  Okay, so on the end of it, I'll put at.com.  Done.  Job done.  Now the reason I showed this is because I show this to people and they go, oh yeah,  but SQL injection, like this was a problem before, right?  Like this is something we used to get wrong.  And these days we're all doing entity framework and ORMs and even stored procedures.  All of these things give us a lot of good protection against SQL injection.  This is a tutorial that was written last year.  It's up on the web, it's still up there, it's about how to do password resets.  It has a very long comment from an Australian guy saying maybe you shouldn't do this, but  it is still up there and it hasn't been changed.  So people go to these resources and they copy and paste the code and they build their systems  and these things just keep propagating.  So that remains a problem.  We still have a problem with the way we're building our systems.  Now I also think we have a problem with the way we're setting things up for users.  We're setting users up for failure.  I'll give you a good example of that.  This is Lego.  If you want to create a user account on Lego, it's a typical sort of login form, but they  give you a little bit of advice here.  This is not good.  Don't do this.  Now I can get by the fact that they say big and small letters instead of upper and lower  case, they're probably targeting kids, right?  Kids will know what big letters are and small letters are.  But this is not the message I want to give to kids either.  We want to start teaching our kids how to create good passwords.  Hey, if you want to teach your kid how to create a good password, teach them a pass  phrase.  That's so much better than something that is short, so it's easy to remember.  Yet this is what we do.  Now as bad as the advice is that we give to kids, we're also giving bad advice to adults.  Another British example.  Now this was curious because what Virgin Media were doing is they had a JavaScript file with  all the words you weren't allowed to use, which was enormously entertaining reading  because you could download the file and go, I hadn't thought of it that way before.  All these different words of which wankers was one.  And it made me curious as to why they would be blocking particular terms from the password.  Because it's not like when the hashing algorithm sees wankers, it goes, oh, and gets embarrassed.  It doesn't work that way.  Hashing algorithms don't care.  So there are humans at Virgin Media seeing these passwords, which tells you something  about the way they're creating them.  Also tells you something about the way they may be asking for them.  They're handling the passwords insecurely.  That's the only reason this happens.  Now security also becomes quite complex when we look at things like security questions  and answers.  And it becomes complex insofar as it's hard to write good ones.  It's hard to write a good security question and provide answers.  And we see it screwed up quite a bit.  Now this is not good.  This is a pub trivia question, right?  So this is not a good security question.  Anything that you can Google is not a good security question or as it may be a good security  answer.  And this is the problem because anyone can figure out what that is if you choose that  particular value.  Frankly, things like color aren't very good either.  Red, green, blue, okay, there's half our audience.  And then you can pick a few others and you pretty much guess pretty quickly.  So these ones are very easily discoverable.  But sometimes we see security questions that are almost impossible to create answers for.  I'm pretty sure that wasn't the dog's name.  This is ridiculous.  We really struggle with security questions.  For the most part, security questions are probably more pain than what they are actual  good.  So these are really problematic and it's just amusing to see how many times people get this  wrong.  And at the end of the day, it's one of us colloquially as a developer that's sitting  down there writing this code, writing these questions.  And that got me thinking if maybe it was a problem with the way we're teaching developers.  So are we teaching them the wrong things?  Are they learning to be insecure by default?  So I thought what I should do is go around and find some interesting resources in terms  of some of the education we're giving technology professionals.  And here's one of the first things I found.  Can we have some audio back, please?  Let's try that again.  Audio.  So here's the first things I found.  Hey, what's up, YouTube?  This is Next Gen Hacker 101 and today I'll be teaching you guys how to view other computers'  IP addresses.  All right, what you do is you type in tracer t and then space.  All right, this is a cool thing.  Tracer t and then space.  Now what you want to do is you want to type the site you want to view.  So you want to go HTTP, semicolon, slash, slash, and then we'll not semicolon, the  little dot, dot, and then the website.  So let's just say Google.  Oops.  So let's just say we want to see how many IPs are looking at Google right now.  And like at this exact moment, we're going to find how many people are looking at Google,  what their IPs are, and what their connection speed is.  Here we go.  So you type in tracer t, space, and then the website, HTTP dot, dot, slash, slash,  and then the website, I'm doing Google.  You want to go ahead and do that as an example.  And then you enter it.  And here we go.  Here they come.  One, two, three, four, five, six, seven, eight, nine, ten.  And hold it.  All right, people are currently using Google and looking at it.  It's a bit of a slow day on Google, that one.  No doubt.  Just one pro tip as well.  When you are looking for tutorials, and particularly video training, if their voice hasn't broken,  do proceed with caution.  Treat as suspicious.  Be good on the kid for having a go.  And the same for the kid in the first video.  Maybe they're doing wonderful things now, who knows.  But when you hear a kid, you kind of expect it to be maybe not the best advice, right?  But the problem is that you can go to professional training resources and find other really bad advice.  So here's one that has, as part of the course, little exercise where you need to encrypt a credit card.  It gives you an example of how you might encrypt that credit card.  For those of you who are perhaps not familiar with base 64, the problem with base 64 encoding is base 64 decoding.  It's encoding, right?  You encode and then you decode.  There is no private key.  It's not encryption.  But this was in an actual professional learning resource.  So that's problematic.  Some of the professional training is questionable, let's be honest.  A lot of the way other people learn as well though is via Stack Overflow.  And there was a question there a little while ago.  The question was, how do I securely store passwords in my system?  How can I encrypt it?  Now, this was one of the answers.  And I'll sort of give you a bit of a hint about what's going on here if it's not immediately obvious.  What the guy here has said is what you're going to do is you get the password and then for each character in the password,  you take the ASCII value of each character and then you add five.  And you just do this for each character and then the output of that is what you then save into the database.  And then guess how you decrypt?  Right?  You get each character and then you get the ASCII value and you decrease by five.  Now, this was one of the answers.  The next answer said you base 64 encrypt it.  Same as last slide.  And then there was another answer which basically said the same thing, but they said,  no, no, no, we've got a more secure way.  What you do is you get each character and you add 13.  And then to decrypt, you take away 13.  Now, fortunately, Stack Overflow tends to filter this stuff out and it did disappear.  I may have screen capped some of them and put them on a blog just beforehand  because it was kind of interesting.  But one of the things that also struck me as very interesting with this  is how quickly these answers appeared after the question.  Now, think about that for a moment.  How do you get a block of code like that very, very quickly?  They weren't sitting down and writing it by hand.  They were going to their systems and going, I've done this before.  I don't know what I can do.  I'm going to copy this and paste it into my answer.  Think about this. We all have passwords in other people's systems stored this way, guaranteed.  At best, we all probably still have passwords stored as plain text.  Maybe in virgin.  So this stuff keeps happening.  And this is really quite a problematic thing,  but we can learn an awful lot as well by looking at the questions people ask on forums.  We can learn a lot about the way organizations are implementing their security.  So we can learn things like this.  I so hope that's not my bank.  I really do.  And it's just amazing to see this stuff out there.  And you see so many examples where just at first glance, we all go,  oh my God, what are you thinking?  But it also made me realize that security is confusing.  Stuff like this is confusing.  Obviously, the guy is confused as to why this is a bad idea.  Even things like whether you should use PGP or Wingdings is confusing.  Come on, a slight little buildings and airplanes and cars.  That's encrypted, right?  You can't figure out what it is.  I like the last sentence.  I just bought a laptop so I can install my own stuff with my Wingdings encryption.  And people do this.  I wonder if we've got passwords stored as Wingdings.  How do you even store passwords as a Wingding?  I've got no idea.  Now, I don't want to just blame us.  And again, this is a colloquial us because it is developers that build these systems  and we've all done stupid things with code before.  It happens.  I also do want to blame the users.  And I think we all probably like to blame users.  Any of you who've had sort of a help desk role before  has probably had to deal with users that we'd probably rather forget.  And they do do some crazy things.  And we can see it evidenced in examples like this.  Now, whose Twitter account is this?  This was a few years ago.  And this was Burger King's Twitter account.  And apparently, the whopper has flopped and they have become McDonald's.  Now, this was when Twitter got hacked.  Remember when Twitter got hacked?  No, I didn't really do that.  Even though the news headlines say that because you open up the news headlines  and they say Burger King's Twitter is hacked.  That is one possibility.  But probably more likely possibility is Burger King just had a really crap password.  Or they did something really stupid.  And you still see it to this day all the time.  Such and such Twitter hacked.  And that's never what it actually is.  It is bad password practices.  Almost every time.  It's either that or phishing.  Falling victim to a page which says, please log into your Twitter.  And they just go, yeah, okay, here's your stuff.  Curiously, Burger King's follow account went up massively when that happened.  They had like 90,000 followers.  Within 24 hours, they had 120,000 followers.  I'm not necessarily saying this is good social media advice.  However, it did get a lot of attention.  So it makes you wonder, right?  So how are people losing their passwords so easily?  Because we see this stuff all the time.  I saw this with Tesla last year as well.  It happened to them too.  Another one that happened to last year was TV5Mond in France.  So TV5Mond had their Twitter hacked.  So they go and they interview this reporter at TV5Mond  because they're trying to figure out how on earth this could have happened.  And the guy's sitting there at his desk in front of the wall behind him  with his passwords on the wall.  So the penny dropped and they went, oh man, look what we've done.  That wasn't good.  You know what we'll do?  We'll come back the next day.  We'll do another interview.  So they interview this other guy.  This is how Twitter gets hacked.  Post-it notes.  But you know, the other thing it says is that in these incidents,  there's no multi-step verification as well.  So you should be able to lose your Twitter password  and not have someone take over your Twitter account.  And think about this for all your social media accounts  and every account that's important to you.  Could you publicly post your password and not have your account owned?  So clearly they are missing something pretty serious.  I do think though that we give mixed and confusing messages,  we encourage people to do bad things security-wise  just by the design of a lot of our apps.  So for example, what if you wanted to queue our barcode scanner for Android?  Now don't worry.  OK, the barcode scanner does need your calendar, your contacts, and your location.  I assume it's trying to schedule when it should do the scan  and it has to look at your calendar or something.  I don't know.  Like why would you ask for this stuff?  It's massively invasive and it could well be malware.  Here's the problem.  When a user goes to download this app,  what do you reckon the one thing they see on the screen is?  It's accept.  It's like what is the thing that is getting between me  and achieving the objective that I came here for?  Just that button.  So we build these systems and again colloquially we.  We build systems that ask for excessive permissions.  We build systems that throw security warnings all over the place  and then tell users just to accept it.  There's really bad news.  And the thing is security is confusing to consumers.  They see things that look legitimate and then they take it as gospel.  A good example is if you're going to buy an HDMI cable,  would you get one that had antivirus protection?  Now, buying HDMI cables is confusing at the best of times.  But can you imagine, let's say one of your parents,  say you've got non-technical parents and they're at the shop  and they're like looking at two, they're trying to decide,  well, this one's got antivirus.  What are you going to do?  Someone wrote this and decided this was a good idea  and it's in shops, which is kind of scary.  Now, as bad as that is,  I also think we give very bad messaging to people.  And particularly when you look at the messaging that comes  via social media, you see some really, really crazy security advice.  So I saw one just a couple of months ago,  this one from Tu, social media site.  And the guy here has said, hey, you're accepting credit cards over HTTP.  And Tu tried to make them feel a little bit more comfortable  about their security prowess by directing them to the VeriSign logo.  We have a VeriSign bitmap on our page, Ergo, we are secure.  Please enter your credentials into an insecure page.  And this is a proper official account,  giving consumers this sort of advice.  One a little bit closer to home for you guys, British guests.  Someone had complained that they couldn't paste in their password  from their password manager.  And this is apparently why you can't do it.  Now, I am not sure what the security certificate is.  This is the first thing.  Like, is it they take away your SSL?  How does this work if they allow pasting?  But I love this last sentence, leave us open to a brute force of take.  Now, have a think about this, right?  Because what they're saying is, you shouldn't be able to paste passwords into the field.  And the best I could come up with is like a Chinese sweatshop, right?  It's just thousands and thousands of people all going, control C, control V,  control C, control V.  I don't know.  Doesn't make any sense.  Another one a little closer to the UK.  This is EE.  Now, EE is responding to people who have queries and saying,  please send us all your sensitive information over Twitter using DM,  where it will sit in our Twitter account,  which may be hijacked at some time because we know why now,  may be emailed to them as a notification in security.  But more than that, think about the conditioning side of people.  If you created an account called EE-support-help,  whatever is available, EE-help 2, probably doesn't even matter.  You put the logo on, doesn't matter that it's not verified,  and you just started replying to people like Jay Shepherd.  With this message, how many people would just go reply and then send their sensitive data?  A lot of them would.  And these practices, even though that's a legitimate account, verified account,  mind you, Tesla was verified when they got taken over as well.  So assuming this was actually their intention,  it's just setting a really, really bad precedent.  Now, some of you may remember a few years ago,  Tesco and I had a little chat,  and they sent me some advice about how they stored passwords.  This baffles me to this day.  If anyone knows how this actually works,  if there is anyone from Tesco here, please come and tell me.  But this was their response when we discovered that they were emailing passwords around.  And again, this is enormously confusing  because they are giving this feedback to consumers.  People are getting these messages and they're going,  oh, okay, now I understand, it's fine that you email it,  because it's automatically copied and blah, blah, blah, blah, blah.  So that's the communications we're giving people.  Now, there was another thing that happened last year as well,  which was kind of interesting,  in many ways a lot less humorous, although some funny aspects.  And this was the Ashley Madison hack.  So Ashley Madison was a really, really serious security incident,  and we learned an awful lot from it.  So basically what happened, August last year,  hackers broke into Ashley Madison and they said,  we have stolen all of your things,  shut the service down,  or we're going to publish all the data publicly.  And there are a couple of things that the hackers weren't too happy about.  So one of the things that they didn't like  is that if you were a member of Ashley Madison,  hypothetically, I'm not saying any of you are, hypothetically,  and you then wanted to leave and you wanted them to delete your data,  you had to pay them $19, permanent delete fee it was.  And what the hackers found is when they broke into the system,  the way that Ashley Madison did the permanent delete  is in the membership records,  they zeroed out all the personal identifiable data.  Okay, so your name, your address, your email, all that sort of thing.  But when you paid,  you now had a payment record  that had a foreign key to the membership record,  and your payment record had your name, your email address,  everything on there.  So these guys had to break into the system to discover that,  but they were quite right.  Ashley Madison was charging people for something which they weren't delivering on.  So they were upset about that.  They were upset also about the very existence of the site  because as the slogan here says, life is short, have an affair.  So clearly they had a moral dilemma, the hackers that is,  and they thought, okay, we've got to take these guys down.  So they took them down and they published all the data  and it just got torrented massively, very, very quickly.  It's all over the place.  It is never going to get back into the can.  That genie has well and truly popped.  Anyone can go and download all the Ashley Madison data now very, very easily.  Now, because we're so broadly distributed,  a lot of people started monetizing it.  So we saw stuff like this.  So this was a service where you could search for people in the Ashley Madison data breach.  And then when you found them,  it would return all of the information they had in there.  So here we have things like the name, obviously, I've obfuscated a lot of this,  phone number, address, everything.  It also included things like credit card transactions.  So you could get a really high degree of confidence  that someone actually deliberately had a site there  and then what their activity was.  Now, I also have this system, my HavocmPone system,  and I let people search for their own data  and it would only say yes or no.  In there, not in there, but only if I knew that they owned it.  But these guys were just making it a free-for-all.  And you might look at this and go,  well, why would you do this?  Like, what is the value proposition of standing up a service like this?  And it helps to understand when you see it in context.  All right, ads.  I'm monetizing via ads. Top one, easy cheating on you.  Reverse search.  So, you know, Clare, or the contextual, I'll give them that much.  I also saw that rotate over divorce lawyers,  so they were trying to sell divorce lawyers there.  As you can see on the right-hand side of the screen,  GPS trackers, maybe you should track your significant other.  The one down the bottom right is sexually transmitted disease tests.  Because if you're on Ashley Madison,  that may be something you want to consider.  Although, curiously, it was basically just guys and fembots.  So, I'm not quite sure how relevant that actually is.  Some of the other links there towards the bottom left  include links to things like spyware.  And one of the links goes off to an app called Mspy.  And Mspy was spyware that you could install as they represent it.  They say you could put it on your kids' devices  and make sure they're doing the right thing.  In actual fact, most people were putting it on their significant others' devices  or compromising someone else's devices  and spying on all their activity.  Mspy, earlier last year, was hacked.  And all their data was leaked publicly.  So now you've got this here as a result of Ashley Madison being hacked  and all this personal data there,  encouraging you to use the spyware tool,  which was also hacked and leaked all the other personal data.  And it just kind of makes your head spin  how entwined all of these attacks are now becoming,  because there's just so many of them.  Now, in terms of monetizing the data,  we also see things like this.  So this was a company called Trustify.  Trustify PI, Private Investigators.  And they stood up a service that allowed you to search for anyone.  And what they did is immediately after you searched,  it sent an email to the person you searched for  and suggested that they buy their Private Investigators services.  How sleazy is that?  That is terrible.  And regardless of your ethical view on the whole thing,  you still see issues are just enormous.  So you've got a wife searching for a husband.  And again, it was normally a wife searching for a husband,  because it was mostly guys.  And then the guy gets an email address,  says, hey, someone's searching for you on Ashley Madison.  You know, that would just be terrifying.  But what's interesting about this is that this message was generated  from a social icon on the page after the search.  So what Trustify were doing was not only encouraging people to search  and then sending email addresses to the person searched for,  but then encouraging the searcher to share socially the fact that they had searched  and that they had found their ex.  Not only were they encouraging them to do it,  but they even favorited it.  They just Trustify favoriting it.  Now, you might look at that and go, OK, well, that's a bit of, you know,  people are going to search for their ex.  It's a bit of, you know, screw you, you're on Ashley Madison.  But they're also doing this.  Man, with friends like these, hey,  they're encouraging people to search for their friends.  Same sort of thing.  And again, they were selling private investigation services  and making money out of it.  But what a lot of this doesn't recognize is just how serious the incident was.  And I got literally thousands of emails from people after this thing happened.  And I got one like this.  And I sort of highlighted the bit here that's really significant.  I've contemplated suicide daily for the past week.  My two beautiful children and wife are keeping me alive.  And I had multiple emails like this where people were literally willing  to kill themselves over the incident.  Now, granted, look, they're having affairs.  They're doing the wrong thing.  They're always going to have some degree of problems.  But Ashley Madison and the data breach was the catalyst to that.  And some people did kill themselves afterwards.  And I just thought this was curious for us, particularly as developers,  because normally we think of users as these faceless things.  We say users, not even, you know, people.  But they are individuals out there that have lives and families.  And in some cases like this, if we get it wrong, they may even die.  So that was Ashley Madison.  And that was a pretty unprecedented event.  But I want to move on a bit and talk about security in physical things.  And this is where it's getting really interesting,  because we're seeing a lot of connected physical things  and a lot of security incidents in physical things these days.  But sometimes security in physical things can actually be a really simple concept,  like this.  That just wouldn't feature in your threat model, would it?  You know, it's like you're worried about cyber jihadis, obviously,  SQL injection, all that sort of thing.  Envelope with a window.  No, it wasn't even in there.  And I just think this is a great example of how we can take this sort of digital world  and do everything right.  And then as soon as you print it, yep, it's all over.  We just circumvented the whole thing.  Now, we can also use the physical world to great effect to circumvent digital security.  We can do things like this.  So let me explain what's going on here for those who may not recognize RSA tokens.  This is two-factor authentication.  You have a token, which is seeded and then shows a unique number.  And it's like 2FA that we have now in our phones,  which is kind of two-step verification,  because you often just have the one device.  But this is generally a separate device.  So you have the unique random number on the device,  and you've got a PIN number just beneath that,  or just above it on the white paper, which is obfuscated here.  So what someone has done is to solve the problem of having to give everyone secure tokens or carry it around,  they've gone, you know what we'll do?  We'll just point a webcam at it, right?  And then we will go to an address somewhere,  but it may be publicly accessible,  a lot of publicly accessible webcams.  And then we'll have everything that we need in order to complete that second step of verification.  It's cool. It's ingenious. I like that.  I mean, don't do it. It's kind of cool.  Another good example recently of physical security was this one.  This was VTech.  So VTech was a big story that broke a couple of months ago.  A journalist got in touch with me and said,  someone has given me a whole heap of data.  I want you to help me verify it and see if it's legitimate,  because a lot of this stuff is fabricated.  And we sort of went through all the data and we discovered it was legitimate  and discovered how it was collected.  Now, what VTech does is VTech creates kids toys,  a Hong Kong-based company, billion-dollar revenues.  They're very large.  And one of the toys they create is like,  imagine if Fisher Price made an iPad, right?  And it's going to be all colorful and cute and stuff like that.  And the theory was that little Johnny could have an iPad or a VTech tablet.  And little Mary could have one as well.  And then they could talk to each other.  And what parents obviously didn't realize in many cases  is that the way this magic talking to each other happens  when you're in completely different locations is the Internet.  There's services, there's APIs behind it.  So what happens is little Johnny and little Mary are signing up with their names.  Okay, fair enough.  Mary wants to know she's speaking to Johnny.  With their birth dates, which is also kind of fair enough,  because when you have kids creating social networks,  they probably want to pick an age that's pretty similar.  And their genders, again, kind of fair enough.  Girls want to talk to girls, so on and so forth.  But they had to create this data in the system.  And the parents had to set up an account under which the kid could create theirs.  So the parent had to create a whole bunch of data as well.  And what it meant was that the data that was given to me  had about 4 million parents in it and about 280,000 kids.  And the kids' records had foreign keys to the parents.  So you could literally pick the child that you wanted in terms of those attributes  and then find them, because the parents' records had physical address  and phone number and email address and everything you need in order to find them.  And that was 280,000 records.  And then VTech, in one of their announcements, said it's actually 6 million kids.  So 6 million kids, 4 million adults.  And all of this data has now just been made, fortunately not made public,  because we think that the guy who broke into it only gave it to the journalist.  The journalist only gave it to me. I certainly didn't give it to anyone.  So hopefully that was the end of that.  But it also leaked the photos as well.  So not only could you pick the gender and the age of the kid,  but you could actually pick exactly what they looked like.  So VTech made serious, serious mistakes in the designs of their systems.  So they did some things which were just obvious,  although not entirely uncommon, so they had no HTTPS anywhere.  They did other things that were kind of ridiculous.  So when you logged in, the API that you hit returned a response  that had the SQL statement that was run in the database.  Why would you even...  Maybe debugging, I don't know, but that's just the weirdest thing.  They had direct object reference risks, which means you could load your record  and it would pass a parameter. Your ID is number 257.  If you asked for record 258, you'd get someone else's.  259, you'd get someone else's again.  They made all these really big, big security mistakes.  But they're moving on. They're now doing home security.  This was CES last week.  The journalist who wrote the story took this photo for me.  He said, I thought you might find this amusing.  I probably wouldn't buy this home security gear.  It's probably not what you want.  So this is what those guys are now doing.  But of course, particularly at CES,  there was a huge number of internet-connected things.  IoT is everything these days. They want to connect all of the things.  Apparently, your fridge and your toaster need to be able to chat where you're asleep.  Or do whatever fridges and toasters are meant to do with each other.  But we're seeing other things in the IoT world like this.  This is LIFX. This is an Aussie invention.  There are other light globes out there, connected light globes.  LIFX is Aussie.  And they're really neat, and I'd really like to have them  if they weren't exorbitantly expensive.  But basically, the way this works is you've got your smartphone,  and you can change the color, and you can change how bright it is.  You can set schedules and moods and all sorts of things.  And it's all kind of geeky and cool.  But LIFX had a vulnerability in their light bulbs.  And here's the curious thing.  People think about vulnerabilities in IoT,  and they think about the risk to the device.  And people would say, OK, my light bulb might get hacked.  Think about that for a moment.  My light bulb might get hacked.  But do I really care if an adversary puts my home into disco mode?  It makes everything flash.  However, the vulnerability in LIFX didn't just allow them  to put the home into disco mode.  It leaked the Wi-Fi credentials of the home network.  So this is a much broader issue.  Just yesterday, I was reading about an internet-connected doorbell.  You heard me right.  An internet-connected doorbell did exactly the same thing.  And there is an internet-connected kettle called the eye kettle  that you could tell net into.  Yes, you could tell net into your kettle  and discover that there's a default pin on it.  And you could actually de-auth the kettle,  make it join your network, tell net into it,  and then get the Wi-Fi credentials of the original network.  So anyway, LIFX said, OK, we've had a vulnerability.  And, you know, we're sorry we screwed up.  We'd like you to run to patch your light bulbs.  And I thought about the might like, is it USB?  Like, do you plug it in?  Or maybe you do it with a companion?  I've got no idea.  I have not yet come to the sort of realization  of what it would take to patch a light bulb.  And I think a lot of other people have either.  But the other thing they said is, yes,  we had this vulnerability, patch of things.  But we're not aware of anyone having been owned by their light bulbs.  And I thought that was curious  because I also don't think we're quite at the point  we were ready to accept that our light bulbs  might be the attack vector into our home.  And particularly when you think about the risk, right,  the risk was disclosure of Wi-Fi credentials.  So the exploit to that would be that your neighbor's  torrenting over your network or something like that.  And if you discovered your neighbor was doing that,  would you say, I bet it's the bloody light bulbs  that I put in the other day?  We're not kind of at the point of accepting that yet.  But in terms of connected things, it does get worse.  Anyone got one of these?  This is Elixil Satus.  This is genuine.  It's from Japan, like all good toilet things are.  Now, I can't read any of this,  so we're going to have to speculate a little bit about what's on there.  So first screen top left, I assume, is some sort of a splash screen.  LAUGHTER  Middle screen, evidently, is a calendar.  And this has me curious.  It's some sort of event-driven data, as best I can tell, on the calendar.  I'm not sure exactly what it is.  But the right screen is a music player.  And in case you can't read it from the back, this is genuine.  You can Google this and find it.  The toilet is playing. I can't get no satisfaction.  LAUGHTER  Now, I saw this a couple of years ago, and I had a talk,  and I said, look, we're going to have to be a bit cautious here,  because we may well find that there is a vulnerability in the toilet at some point.  And wouldn't you believe it, there is.  There's a security advisory from Trustwave.  LAUGHTER  This is terrifying!  LAUGHTER  Can you imagine an attacker activating the bidet  while you're there on the toilet?  I mentioned this in a talk, and someone said, yes, that's known as a backdoor attack.  LAUGHTER  On that note, thank you very much.  APPLAUSE
50_Shades_of_AppSec_-_Troy_Hunt_0_71.png 50_Shades_of_AppSec_-_Troy_Hunt_72_143.png 50_Shades_of_AppSec_-_Troy_Hunt_144_263.png 50_Shades_of_AppSec_-_Troy_Hunt_264_899.png 50_Shades_of_AppSec_-_Troy_Hunt_900_983.png 50_Shades_of_AppSec_-_Troy_Hunt_984_1211.png 50_Shades_of_AppSec_-_Troy_Hunt_1212_1343.png 50_Shades_of_AppSec_-_Troy_Hunt_1344_1451.png 50_Shades_of_AppSec_-_Troy_Hunt_1452_1511.png 50_Shades_of_AppSec_-_Troy_Hunt_1512_4079.png 50_Shades_of_AppSec_-_Troy_Hunt_4080_4751.png 50_Shades_of_AppSec_-_Troy_Hunt_4752_5495.png 50_Shades_of_AppSec_-_Troy_Hunt_5496_5543.png 50_Shades_of_AppSec_-_Troy_Hunt_5544_5855.png 50_Shades_of_AppSec_-_Troy_Hunt_5856_6491.png 50_Shades_of_AppSec_-_Troy_Hunt_6492_6887.png 50_Shades_of_AppSec_-_Troy_Hunt_6888_7019.png 50_Shades_of_AppSec_-_Troy_Hunt_7020_7067.png 50_Shades_of_AppSec_-_Troy_Hunt_7068_7199.png 50_Shades_of_AppSec_-_Troy_Hunt_7200_7271.png 50_Shades_of_AppSec_-_Troy_Hunt_7272_7319.png 50_Shades_of_AppSec_-_Troy_Hunt_7320_7367.png 50_Shades_of_AppSec_-_Troy_Hunt_7368_7535.png 50_Shades_of_AppSec_-_Troy_Hunt_7536_7583.png 50_Shades_of_AppSec_-_Troy_Hunt_7584_8435.png 50_Shades_of_AppSec_-_Troy_Hunt_8436_9359.png 50_Shades_of_AppSec_-_Troy_Hunt_9360_9611.png 50_Shades_of_AppSec_-_Troy_Hunt_9612_9659.png 50_Shades_of_AppSec_-_Troy_Hunt_9660_9779.png 50_Shades_of_AppSec_-_Troy_Hunt_9780_9851.png 50_Shades_of_AppSec_-_Troy_Hunt_9852_9959.png 50_Shades_of_AppSec_-_Troy_Hunt_9960_10871.png 50_Shades_of_AppSec_-_Troy_Hunt_10872_12023.png 50_Shades_of_AppSec_-_Troy_Hunt_12024_12311.png 50_Shades_of_AppSec_-_Troy_Hunt_12312_13475.png 50_Shades_of_AppSec_-_Troy_Hunt_13476_14099.png 50_Shades_of_AppSec_-_Troy_Hunt_14100_14831.png 50_Shades_of_AppSec_-_Troy_Hunt_14832_17771.png 50_Shades_of_AppSec_-_Troy_Hunt_17772_19235.png 50_Shades_of_AppSec_-_Troy_Hunt_19236_20483.png 50_Shades_of_AppSec_-_Troy_Hunt_20484_21563.png 50_Shades_of_AppSec_-_Troy_Hunt_21564_22607.png 50_Shades_of_AppSec_-_Troy_Hunt_22608_24995.png 50_Shades_of_AppSec_-_Troy_Hunt_24996_26819.png 50_Shades_of_AppSec_-_Troy_Hunt_26820_27023.png 50_Shades_of_AppSec_-_Troy_Hunt_27024_28439.png 50_Shades_of_AppSec_-_Troy_Hunt_28440_29603.png 50_Shades_of_AppSec_-_Troy_Hunt_29604_30263.png 50_Shades_of_AppSec_-_Troy_Hunt_30264_32591.png 50_Shades_of_AppSec_-_Troy_Hunt_32592_33767.png 50_Shades_of_AppSec_-_Troy_Hunt_33768_34271.png 50_Shades_of_AppSec_-_Troy_Hunt_34272_35387.png 50_Shades_of_AppSec_-_Troy_Hunt_35388_38915.png 50_Shades_of_AppSec_-_Troy_Hunt_38916_39683.png 50_Shades_of_AppSec_-_Troy_Hunt_39684_40823.png 50_Shades_of_AppSec_-_Troy_Hunt_40824_43955.png 50_Shades_of_AppSec_-_Troy_Hunt_43956_44123.png 50_Shades_of_AppSec_-_Troy_Hunt_44124_45143.png 50_Shades_of_AppSec_-_Troy_Hunt_45144_47015.png 50_Shades_of_AppSec_-_Troy_Hunt_47016_48071.png 50_Shades_of_AppSec_-_Troy_Hunt_48072_49007.png 50_Shades_of_AppSec_-_Troy_Hunt_49008_49523.png 50_Shades_of_AppSec_-_Troy_Hunt_49524_49679.png 50_Shades_of_AppSec_-_Troy_Hunt_49680_49751.png 50_Shades_of_AppSec_-_Troy_Hunt_49752_49979.png 50_Shades_of_AppSec_-_Troy_Hunt_49980_51383.png 50_Shades_of_AppSec_-_Troy_Hunt_51384_51791.png 50_Shades_of_AppSec_-_Troy_Hunt_51792_52787.png 50_Shades_of_AppSec_-_Troy_Hunt_52788_53975.png 50_Shades_of_AppSec_-_Troy_Hunt_53976_57179.png 50_Shades_of_AppSec_-_Troy_Hunt_57180_57959.png 50_Shades_of_AppSec_-_Troy_Hunt_57960_59411.png 50_Shades_of_AppSec_-_Troy_Hunt_59412_61499.png 50_Shades_of_AppSec_-_Troy_Hunt_61500_61907.png 50_Shades_of_AppSec_-_Troy_Hunt_61908_62255.png 50_Shades_of_AppSec_-_Troy_Hunt_62256_62399.png 50_Shades_of_AppSec_-_Troy_Hunt_62400_63443.png 50_Shades_of_AppSec_-_Troy_Hunt_63444_65063.png 50_Shades_of_AppSec_-_Troy_Hunt_65064_65951.png 50_Shades_of_AppSec_-_Troy_Hunt_65952_66203.png 50_Shades_of_AppSec_-_Troy_Hunt_66204_67031.png 50_Shades_of_AppSec_-_Troy_Hunt_67032_68099.png 50_Shades_of_AppSec_-_Troy_Hunt_68100_69779.png 50_Shades_of_AppSec_-_Troy_Hunt_69780_70799.png 50_Shades_of_AppSec_-_Troy_Hunt_70800_71015.png 50_Shades_of_AppSec_-_Troy_Hunt_71016_73739.png 50_Shades_of_AppSec_-_Troy_Hunt_73740_75059.png 50_Shades_of_AppSec_-_Troy_Hunt_75060_77255.png 50_Shades_of_AppSec_-_Troy_Hunt_77256_79235.png 50_Shades_of_AppSec_-_Troy_Hunt_79236_79835.png 50_Shades_of_AppSec_-_Troy_Hunt_79836_81179.png 50_Shades_of_AppSec_-_Troy_Hunt_81180_81635.png 50_Shades_of_AppSec_-_Troy_Hunt_81636_82487.png 50_Shades_of_AppSec_-_Troy_Hunt_82488_83891.png 50_Shades_of_AppSec_-_Troy_Hunt_83892_88595.png 50_Shades_of_AppSec_-_Troy_Hunt_88596_89531.png 50_Shades_of_AppSec_-_Troy_Hunt_89532_93335.png 50_Shades_of_AppSec_-_Troy_Hunt_93336_93419.png 50_Shades_of_AppSec_-_Troy_Hunt_93420_93479.png 50_Shades_of_AppSec_-_Troy_Hunt_93480_95315.png 50_Shades_of_AppSec_-_Troy_Hunt_95316_95387.png