A presentation at Agile Testing Days 2018 in in Potsdam, Germany by nicola sedgwick
the security issue that killed a financial product launch (that was missed by the professional penetration testers and security ‘experts’)
https://www.agiletestingdays.com https://twitter.com/nicolasedgwick http://www.nicola-sedgwick.com
Photo credit Rob Curran on Unsplash
Image credit https://internetbugbounty.org/
Photo credit Christian Dubovan on Unsplash
Photo credit Hello I'm Nik on Unsplash
Photo credit Sharon McCutcheon on Unsplash
Photo credit Cristian Newman on Unsplash
Photo credit Mihály Köles on Unsplash
Photo credit Luke van Zyl on Unsplash
Photo credit rawpixel on Unsplash
Photo credit Fancycrave on Unsplash
Photo credit Jon Tyson on Unsplash
Photo credit Patryk Sobczak on Unsplash
Photo credit Matt Botsford on Unsplash
credit https://www.owasp.org
Photo credit Adam Sherez on Unsplash
Photo credit John Carlisle on Unsplash
Photo credit Luke van Zyl on Unsplash
Photo credit Robert Hickerson on Unsp
Photo credit Ben Hershey on Unsplash
Photo credit Luo Lei on Unsplash
Photo credit Wim Arys on Unsplash
Photo credit Vladislav Klapin on Unspla
Photo credit Markus Spiske on Unsplash
Photo credit Hans-Peter Gauster on Unsplash
Photo credit rawpixel on Unsplash
Photo credit Jack Price-Burns on Unsplash
Photo credit Ben Hershey on Unsplash
Photo credit Jonathan Hoxmark on Unsplash
Photo credit Kai Pilger on Unsplash
Photo credit B J on Unsplash
Photo credit Mike Wilson on Unsplash
Photo credit Tine Ivanič on Unsplash
Photo credit eberhard grossgasteiger o
Photo credit Ales Nesetril on Unsplash
Photo credit Melinda Gimpel on Unsplash
Photo credit Ye Jinghan on Unsplash
Photo credit freestocks.org on Unsplash
Photo credit Jez Timms on Unsplash
Photo credit Stephanie Watters Flores on Unsplash
Photo credit Taskin Ashiq on Unsplash
Photo credit Brian Mann on Unsplash
• You already have the skill you need to find security issues … your brain! • Critical thinking skills are perfect for locating security problems. • Engage security assessment as part of architecture planning and throughout development. www.agiletestingdays.com |
nicolasedgwick | www.nicola-sedgwick.com
https://www.agiletestingdays.com
That was missed by the professional penetration testers and security 'experts'.
Security issues can be identified using the stock-and-trade critical thinking skills of a tester.
Some time ago I had the pleasure of taking part in a security bug hunt for a new financial product. This was a product ready to go to market, a product that had passed all penetration tests and was now being handed to a crowd of external testers for a final attempt to 'hack' the product.
Against all their confidence I was able to 'hack' that product and use funds to which I should not have had access. However, once I reported the vulnerability, I wasn't believed and I was asked to repeat the 'hack' multiple times until the 'experts' believed I was achieving what I was reporting - they simply couldn't believe that their penetration test result was wrong.
Like many security talks I will tell you all about the tool I used to perform this 'hack'; Unlike many security talks this is not a tool you can install, rent or puchase - because it's my brain, but your brain is capable of doing the same.
Key Learnings
The following resources were mentioned during the presentation or are useful additional information.
Source of free-to-use high resolution imagery
Here’s what was said about this presentation on social media.
for free. You
can too.