Talks

Pwned as intended: weaponizing documentation at scale

Researcher: Zakhar Fedotkin

Conferences

We've all heard of well-known misconfigurations causing breaches - but what about those nobody even realised are dangerous? Websites are now built from dozens of infrastructure components, each accompanied by copious vendor guidance. Each system may be secure in isolation but vulnerable when deployed, and vendors 'patch' vulnerabilities by adding notes to docs that nobody actually reads - their way of saying it's your problem now.

In this session, I'll share novel techniques backed up by real-world case studies with impacts including arbitrary read/write access to cloud storage, disclosure of sensitive secrets including encryption keys, widespread XSS, cache-poisoning, and severe single-request DoS attacks.

You don't need a bug to compromise that system - you just need to understand it.