Welcome to the Security Weekly Podcast Network, your all-in-one source for the latest in cybersecurity! This feed features a diverse lineup of shows, including Application Security Weekly, Business Security Weekly, Paul's Security Weekly, Enterprise Security Weekly, and Security Weekly News. Whether you're a cybersecurity professional, business leader, or tech enthusiast, we cover all angles of the cybersecurity landscape. Tune in for in-depth panel discussions, expert guest interviews, and ...
…
continue reading
Content provided by Black Hat/ CMP Media, Inc. and Jeff Moss. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Black Hat/ CMP Media, Inc. and Jeff Moss or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.
Player FM - Podcast App
Go offline with the Player FM app!
Go offline with the Player FM app!
Ariel Waissbein: Timing attacks for recovering private entries from database engines
MP3•Episode home
Manage episode 153226766 series 1085097
Content provided by Black Hat/ CMP Media, Inc. and Jeff Moss. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Black Hat/ CMP Media, Inc. and Jeff Moss or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.
Dynamic content for Web applications is typically managed through database engines, including registration information, credit cards medical records and other private information. The web applications typically interface with web users and allow them to make only certain queries from the database while they safeguard the privacy where expected, for example, they may allow to add data in a column of the database but not to view the complete contents of this column. We will describe a new technique that allows executing a timing attack which recovers entries from a private column in a database and only requires the ability to insert data in this private column. During the presentation, we will show the experiments that lead us to developing exploit code for the MySQL engine that demonstrates this technique, give details for the audience to understand the underlying algorithm, analyze the results and discuss future work. We will also discuss how to protect from or detect this exploit.
…
continue reading
89 episodes
Ariel Waissbein: Timing attacks for recovering private entries from database engines
Black Hat Briefings, USA 2007 [Audio] Presentations from the security conference.
MP3•Episode home
Manage episode 153226766 series 1085097
Content provided by Black Hat/ CMP Media, Inc. and Jeff Moss. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Black Hat/ CMP Media, Inc. and Jeff Moss or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.
Dynamic content for Web applications is typically managed through database engines, including registration information, credit cards medical records and other private information. The web applications typically interface with web users and allow them to make only certain queries from the database while they safeguard the privacy where expected, for example, they may allow to add data in a column of the database but not to view the complete contents of this column. We will describe a new technique that allows executing a timing attack which recovers entries from a private column in a database and only requires the ability to insert data in this private column. During the presentation, we will show the experiments that lead us to developing exploit code for the MySQL engine that demonstrates this technique, give details for the audience to understand the underlying algorithm, analyze the results and discuss future work. We will also discuss how to protect from or detect this exploit.
…
continue reading
89 episodes
All episodes
×Welcome to Player FM!
Player FM is scanning the web for high-quality podcasts for you to enjoy right now. It's the best podcast app and works on Android, iPhone, and the web. Signup to sync subscriptions across devices.