Beste CCC Podcasts (2024)

Web security is increasingly an opt-in approach, leaving developers with both the opportunity and the responsibility to protect their applications. This talk will explore why and how developers can secure their sites against evolving threats.We'll delve into the nuances of cross-site leaks (xs-leaks) and discuss the Cross-Origin Resource Policy (CO…

1
Modern solutions against Cross-Site Attacks (god2024) 27:11

Play Pause

2h ago27:11

27:11

Web security is increasingly an opt-in approach, leaving developers with both the opportunity and the responsibility to protect their applications. This talk will explore why and how developers can secure their sites against evolving threats.We'll delve into the nuances of cross-site leaks (xs-leaks) and discuss the Cross-Origin Resource Policy (CO…

1
Modern solutions against Cross-Site Attacks (god2024) 27:11

3h ago27:11

27:11

Web security is increasingly an opt-in approach, leaving developers with both the opportunity and the responsibility to protect their applications. This talk will explore why and how developers can secure their sites against evolving threats.We'll delve into the nuances of cross-site leaks (xs-leaks) and discuss the Cross-Origin Resource Policy (CO…

1
Double-Edged Crime: How Browser Extension Fingerprinting Might Endanger Users and Extensions Alike (god2024) 23:43

4h ago23:43

23:43

Browser extensions are powerful tools that enhance the web browsing experience, offering their users a wide range of functionalities. However, these features can also introduce security and privacy issues for their users, mainly through a technique known as extension fingerprinting — where malicious websites track users based on the extensions they…

1
Double-Edged Crime: How Browser Extension Fingerprinting Might Endanger Users and Extensions Alike (god2024) 23:43

2h ago23:43

23:43

Browser extensions are powerful tools that enhance the web browsing experience, offering their users a wide range of functionalities. However, these features can also introduce security and privacy issues for their users, mainly through a technique known as extension fingerprinting — where malicious websites track users based on the extensions they…

1
Double-Edged Crime: How Browser Extension Fingerprinting Might Endanger Users and Extensions Alike (god2024) 23:43

2h ago23:43

23:43

Browser extensions are powerful tools that enhance the web browsing experience, offering their users a wide range of functionalities. However, these features can also introduce security and privacy issues for their users, mainly through a technique known as extension fingerprinting — where malicious websites track users based on the extensions they…

1
Protecting Web Applications with Project Foxhound (god2024) 11:31

3h ago11:31

11:31

Recent developments in web technologies have seen a paradigm shift from monolithic server-based applications to REST-based microservices with feature-rich browser-based frontends. This progression has brought with it novel classes of security flaws. In this talk we review how client-side variants of injection vulnerabilities such as cross-site scri…

1
Protecting Web Applications with Project Foxhound (god2024) 11:31

1h ago11:31

11:31

Recent developments in web technologies have seen a paradigm shift from monolithic server-based applications to REST-based microservices with feature-rich browser-based frontends. This progression has brought with it novel classes of security flaws. In this talk we review how client-side variants of injection vulnerabilities such as cross-site scri…

1
Protecting Web Applications with Project Foxhound (god2024) 11:31

1h ago11:31

11:31

Recent developments in web technologies have seen a paradigm shift from monolithic server-based applications to REST-based microservices with feature-rich browser-based frontends. This progression has brought with it novel classes of security flaws. In this talk we review how client-side variants of injection vulnerabilities such as cross-site scri…

1
SSRF: Attacks, Defense and Status Quo (god2024) 10:25

2h ago10:25

10:25

Web apps use Server-Side Requests to request data from other servers, e.g., for link previews. However, they are exploited by attackers who might request internal resources or non-public services. This attack is called Server-Side Request Forgery (SSRF).The talk explains what SSRF is, how it can be used to exploit servers, and how to defend against…

1
SSRF: Attacks, Defense and Status Quo (god2024) 10:25

2h ago10:25

10:25

Web apps use Server-Side Requests to request data from other servers, e.g., for link previews. However, they are exploited by attackers who might request internal resources or non-public services. This attack is called Server-Side Request Forgery (SSRF).The talk explains what SSRF is, how it can be used to exploit servers, and how to defend against…

1
SSRF: Attacks, Defense and Status Quo (god2024) 10:25

3h ago10:25

10:25

Web apps use Server-Side Requests to request data from other servers, e.g., for link previews. However, they are exploited by attackers who might request internal resources or non-public services. This attack is called Server-Side Request Forgery (SSRF).The talk explains what SSRF is, how it can be used to exploit servers, and how to defend against…

1
„Well, What Would You Say if I Said That You Could?” – Scanning for Vulnerabilities Without Getting Into Trouble (god2024) 27:07

3h ago27:07

27:07

The need for comprehensive measurements of security and privacy risks on the Web is undeniable as it helps developers in focusing on emerging trends in security. However, large-scale scans for server-side vulnerabilities remains a sensitive topic, due to their potential to harm servers, disrupt services, and incur financial losses. Even smaller, si…

1
„Well, What Would You Say if I Said That You Could?” – Scanning for Vulnerabilities Without Getting Into Trouble (god2024) 27:07

2h ago27:07

27:07

The need for comprehensive measurements of security and privacy risks on the Web is undeniable as it helps developers in focusing on emerging trends in security. However, large-scale scans for server-side vulnerabilities remains a sensitive topic, due to their potential to harm servers, disrupt services, and incur financial losses. Even smaller, si…

1
„Well, What Would You Say if I Said That You Could?” – Scanning for Vulnerabilities Without Getting Into Trouble (god2024) 27:07

3h ago27:07

27:07

The need for comprehensive measurements of security and privacy risks on the Web is undeniable as it helps developers in focusing on emerging trends in security. However, large-scale scans for server-side vulnerabilities remains a sensitive topic, due to their potential to harm servers, disrupt services, and incur financial losses. Even smaller, si…

1
SAP from an Attacker's Perspective – Common Vulnerabilities and Pitfalls (god2024) 22:35

3h ago22:35

22:35

As organizations increasingly rely on SAP systems to manage critical business processes, the security of these environments is an increasing challenge for companies and has also been recognized by the OWASP Core Business Application Security (CBAS) project. This talk will explore the security of SAP systems from an attacker's perspective, uncoverin…

1
SAP from an Attacker's Perspective – Common Vulnerabilities and Pitfalls (god2024) 22:35

3h ago22:35

22:35

As organizations increasingly rely on SAP systems to manage critical business processes, the security of these environments is an increasing challenge for companies and has also been recognized by the OWASP Core Business Application Security (CBAS) project. This talk will explore the security of SAP systems from an attacker's perspective, uncoverin…

1
SAP from an Attacker's Perspective – Common Vulnerabilities and Pitfalls (god2024) 22:35

2h ago22:35

22:35

As organizations increasingly rely on SAP systems to manage critical business processes, the security of these environments is an increasing challenge for companies and has also been recognized by the OWASP Core Business Application Security (CBAS) project. This talk will explore the security of SAP systems from an attacker's perspective, uncoverin…

1
Network Fingerprinting for Securing User Accounts - Opportunities and Challenges (god2024) 25:00

4h ago25:00

25:00

Network fingerprinting exists for a while and some methods such as JA3 have achieved wide adoption across the industry. Introducing network fingerprinting into login flows can help you stave off attackers. However, there are various challenges that you need to overcome: technical, organizational and regulatory.In this talk we will take a look at th…

1
Network Fingerprinting for Securing User Accounts - Opportunities and Challenges (god2024) 25:00

2h ago25:00

25:00

Network fingerprinting exists for a while and some methods such as JA3 have achieved wide adoption across the industry. Introducing network fingerprinting into login flows can help you stave off attackers. However, there are various challenges that you need to overcome: technical, organizational and regulatory.In this talk we will take a look at th…

1
Network Fingerprinting for Securing User Accounts - Opportunities and Challenges (god2024) 25:00

2h ago25:00

25:00

Network fingerprinting exists for a while and some methods such as JA3 have achieved wide adoption across the industry. Introducing network fingerprinting into login flows can help you stave off attackers. However, there are various challenges that you need to overcome: technical, organizational and regulatory.In this talk we will take a look at th…

1
The Debian OpenSSL bug and other Public Private Keys (god2024) 21:50

2h ago21:50

21:50

In early 2024, hundreds of DKIM setups still used cryptographic keys vulnerable to a bug from 2008 in Debian's OpenSSL package. Vulnerable hosts included prominent names like Cisco, Oracle, Skype, and Github.In 2022, it was discovered that printers generated TLS keys that could be trivially broken with an over 300-year-old algorithm by Pierre de Fe…

1
The Debian OpenSSL bug and other Public Private Keys (god2024) 21:50

1h ago21:50

21:50

In early 2024, hundreds of DKIM setups still used cryptographic keys vulnerable to a bug from 2008 in Debian's OpenSSL package. Vulnerable hosts included prominent names like Cisco, Oracle, Skype, and Github.In 2022, it was discovered that printers generated TLS keys that could be trivially broken with an over 300-year-old algorithm by Pierre de Fe…

1
The Debian OpenSSL bug and other Public Private Keys (god2024) 21:50

2h ago21:50

21:50

In early 2024, hundreds of DKIM setups still used cryptographic keys vulnerable to a bug from 2008 in Debian's OpenSSL package. Vulnerable hosts included prominent names like Cisco, Oracle, Skype, and Github.In 2022, it was discovered that printers generated TLS keys that could be trivially broken with an over 300-year-old algorithm by Pierre de Fe…

1
GenAI im Threat Modeling (god2024) 9:57

2h ago9:57

9:57

Viele Teams stehen vor der Herausforderung, beim Threat Modeling relevante Bedrohungen zu identifizieren, insbesondere wenn nur wenig Security-Expertise vorhanden ist. Die Auswahl und Bewertung von potenziellen Risiken kann für Nicht-Experten schwierig sein. Dieser Lightning Talk zeigt, wie Generative AI (GenAI) hier unterstützen kann, indem sie Be…

1
GenAI im Threat Modeling (god2024) 9:57

2h ago9:57

9:57

Viele Teams stehen vor der Herausforderung, beim Threat Modeling relevante Bedrohungen zu identifizieren, insbesondere wenn nur wenig Security-Expertise vorhanden ist. Die Auswahl und Bewertung von potenziellen Risiken kann für Nicht-Experten schwierig sein. Dieser Lightning Talk zeigt, wie Generative AI (GenAI) hier unterstützen kann, indem sie Be…

1
GenAI im Threat Modeling (god2024) 9:57

2h ago9:57

9:57

Viele Teams stehen vor der Herausforderung, beim Threat Modeling relevante Bedrohungen zu identifizieren, insbesondere wenn nur wenig Security-Expertise vorhanden ist. Die Auswahl und Bewertung von potenziellen Risiken kann für Nicht-Experten schwierig sein. Dieser Lightning Talk zeigt, wie Generative AI (GenAI) hier unterstützen kann, indem sie Be…

1
GenAI in the Battle of Security: Attacks, Defenses, and the Laws Shaping AI's Future (god2024) 28:56

2h ago28:56

28:56

The presentation explores the security challenges and opportunities posed by Generative AI (GenAI). While GenAI offers tremendous potential, it also has a darker side, such as its use in creating deepfakes that can spread misinformation, manipulate political events, or facilitate fraud, as demonstrated in a live deepfake example. Malicious variants…

1
GenAI in the Battle of Security: Attacks, Defenses, and the Laws Shaping AI's Future (god2024) 28:56

3h ago28:56

28:56

The presentation explores the security challenges and opportunities posed by Generative AI (GenAI). While GenAI offers tremendous potential, it also has a darker side, such as its use in creating deepfakes that can spread misinformation, manipulate political events, or facilitate fraud, as demonstrated in a live deepfake example. Malicious variants…

1
GenAI in the Battle of Security: Attacks, Defenses, and the Laws Shaping AI's Future (god2024) 28:56

2h ago28:56

28:56

The presentation explores the security challenges and opportunities posed by Generative AI (GenAI). While GenAI offers tremendous potential, it also has a darker side, such as its use in creating deepfakes that can spread misinformation, manipulate political events, or facilitate fraud, as demonstrated in a live deepfake example. Malicious variants…

1
Overview of OWASP AI Exchange: A Comprehensive Guide to AI Security (god2024) 21:46

2h ago21:46

21:46

The OWASP AI Exchange provides a comprehensive framework to address the evolving security challenges presented by AI systems. As artificial intelligence continues to transform industries, securing these systems against emerging threats has become a top priority. This presentation will offer an in-depth overview of the OWASP AI Exchange, focusing on…

1
Overview of OWASP AI Exchange: A Comprehensive Guide to AI Security (god2024) 21:46

3h ago21:46

21:46

The OWASP AI Exchange provides a comprehensive framework to address the evolving security challenges presented by AI systems. As artificial intelligence continues to transform industries, securing these systems against emerging threats has become a top priority. This presentation will offer an in-depth overview of the OWASP AI Exchange, focusing on…

1
Overview of OWASP AI Exchange: A Comprehensive Guide to AI Security (god2024) 21:46

1h ago21:46

21:46

The OWASP AI Exchange provides a comprehensive framework to address the evolving security challenges presented by AI systems. As artificial intelligence continues to transform industries, securing these systems against emerging threats has become a top priority. This presentation will offer an in-depth overview of the OWASP AI Exchange, focusing on…

1
NIS2 entmystifiziert - Was Unternehmen nun tun müssen (god2024) 23:14

3h ago23:14

23:14

Die NIS2-Richtlinie (Network and Information Security Directive) der Europäischen Union stellt eine Weiterentwicklung der bestehenden Cybersicherheitsanforderungen dar und zielt darauf ab, die Resilienz und Sicherheit kritischer Infrastrukturen in der EU zu stärken. In Deutschland liegt derzeit mit dem NIS2UmsuCG (NIS-2-Umsetzungs- und Cybersicherh…

1
NIS2 entmystifiziert - Was Unternehmen nun tun müssen (god2024) 23:14

2h ago23:14

23:14

Die NIS2-Richtlinie (Network and Information Security Directive) der Europäischen Union stellt eine Weiterentwicklung der bestehenden Cybersicherheitsanforderungen dar und zielt darauf ab, die Resilienz und Sicherheit kritischer Infrastrukturen in der EU zu stärken. In Deutschland liegt derzeit mit dem NIS2UmsuCG (NIS-2-Umsetzungs- und Cybersicherh…

1
NIS2 entmystifiziert - Was Unternehmen nun tun müssen (god2024) 23:14

3h ago23:14

23:14

Die NIS2-Richtlinie (Network and Information Security Directive) der Europäischen Union stellt eine Weiterentwicklung der bestehenden Cybersicherheitsanforderungen dar und zielt darauf ab, die Resilienz und Sicherheit kritischer Infrastrukturen in der EU zu stärken. In Deutschland liegt derzeit mit dem NIS2UmsuCG (NIS-2-Umsetzungs- und Cybersicherh…

1
The Crucial Role of Web Protocols and Standards in Digital Wallet Ecosystems (god2024) 31:29

3h ago31:29

31:29

In the coming years, all EU member states will be required to provide their citizens with a digital identity wallet, as mandated by the European Union. The EU Digital Identity Wallet (EUDI Wallet) represents the largest implementation of its kind to date and brings with it significant challenges, particularly in terms of security, privacy, and inte…

1
The Crucial Role of Web Protocols and Standards in Digital Wallet Ecosystems (god2024) 31:29

3h ago31:29

31:29

In the coming years, all EU member states will be required to provide their citizens with a digital identity wallet, as mandated by the European Union. The EU Digital Identity Wallet (EUDI Wallet) represents the largest implementation of its kind to date and brings with it significant challenges, particularly in terms of security, privacy, and inte…

1
The Crucial Role of Web Protocols and Standards in Digital Wallet Ecosystems (god2024) 31:29

4h ago31:29

31:29

In the coming years, all EU member states will be required to provide their citizens with a digital identity wallet, as mandated by the European Union. The EU Digital Identity Wallet (EUDI Wallet) represents the largest implementation of its kind to date and brings with it significant challenges, particularly in terms of security, privacy, and inte…

1
How (Not) to Use OAuth in 2024 (god2024) 36:48

4h ago36:48

36:48

OAuth 2.0 has become the backbone of secure delegated authorization on the web, enabling users to grant third-party applications access to their data without revealing their credentials. It's also foundational for federated authentication via OpenID Connect and plays a critical role in emerging technologies like wallet ecosystems. However, despite …

1
How (Not) to Use OAuth in 2024 (god2024) 36:48

5h ago36:48

36:48

OAuth 2.0 has become the backbone of secure delegated authorization on the web, enabling users to grant third-party applications access to their data without revealing their credentials. It's also foundational for federated authentication via OpenID Connect and plays a critical role in emerging technologies like wallet ecosystems. However, despite …

1
How (Not) to Use OAuth in 2024 (god2024) 36:48

3h ago36:48

36:48

OAuth 2.0 has become the backbone of secure delegated authorization on the web, enabling users to grant third-party applications access to their data without revealing their credentials. It's also foundational for federated authentication via OpenID Connect and plays a critical role in emerging technologies like wallet ecosystems. However, despite …

1
OWASP Juice Shop 10th anniversary: Is it still fresh? (god2024) 31:59

4h ago31:59

31:59

Once upon a time, developers and security experts relied on mostly server-side rendered vulnerable applications to train their web hacking skills. In 2014 the Juice Shop entered the stage as one of the first Rich Internet Application representatives. What started as a personal pet project with two dozen hacking challenges, became an OWASP Flagship …

1
OWASP Juice Shop 10th anniversary: Is it still fresh? (god2024) 31:59

4h ago31:59

31:59

Once upon a time, developers and security experts relied on mostly server-side rendered vulnerable applications to train their web hacking skills. In 2014 the Juice Shop entered the stage as one of the first Rich Internet Application representatives. What started as a personal pet project with two dozen hacking challenges, became an OWASP Flagship …

1
OWASP Juice Shop 10th anniversary: Is it still fresh? (god2024) 31:59

4h ago31:59

31:59

Once upon a time, developers and security experts relied on mostly server-side rendered vulnerable applications to train their web hacking skills. In 2014 the Juice Shop entered the stage as one of the first Rich Internet Application representatives. What started as a personal pet project with two dozen hacking challenges, became an OWASP Flagship …