Showing Posts From
June 2018
-
Georgi Geshev Robert Miller - 13 Jun 2018
Chainspotting: Building Exploit Chains with Logic Bugs
A presentation explores the development of an exploit chain involving 11 logic bugs across 6 Android applications. The study demonstrates how logic vulnerabilities can be chained together to achieve malicious actions like silent APK installation. Techniques for discovering and exploiting logic bugs in Android systems are discussed, highlighting the challenges of complex vulnerability chaining.
- 13 Jun 2018
EQL Injection (not a typo) and Oracle Endeca
EQL injection is a novel attack technique targeting Oracle Endeca search functionality in e-commerce platforms. Attackers can exploit unsecured Endeca search parameters to extract sensitive product information or perform denial of service attacks. The vulnerability stems from improper input validation in Endeca search implementations.