Hello, welcome to the Friday, July 31st, 2020 edition of the Sandcent, and at Storm Center's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

For the last year or so, most of the code I've written has been in Python, and well, one of the issues that I sort of noticed is that in

Python it's relatively easy to get SQL queries wrong meaning not to properly prepare them and

essentially end up with code that's vulnerable to a SQL injection. So little blog post today about this problem and, well, how to be a better coder and actually

do proper prepared statements in Python.

And CoFens, a company that's making anti-fishing email security solutions, has an interesting

write-up about a phishing attack that they have been observing that takes advantage of

Google Adservices.com. That's the legitimate domain that's being used by a lot of Google Ads.

So Co-Fent's presumption is that a lot of email gateways

will actually whitelist this domain and not flag it as suspicious. Now, once a user clicks on

that link, the Google Ad Services Code will redirect them just to the fishing page, and

as a result, the user will have no indication from their typical email security software

that they just clicked on anything malicious.

Of course, the assumption here is that Google AdServices.com, because it's often used for legitimate ads, is allowed in email gateways.

Personally, I would actually go to the opposite route.

Google AdServices.com is pretty much only used for advertisements, for user tracking, and as such, in particular, in emails, probably has

little value. I would just block it and remove any links that go to Google AdService.com,

in particular, since Google has a fairly spotty record lately with dealing with fishing and

the like, I personally reported some fishing links that

are hosted within various Google services in the last months. And the response has been

pretty slow in any of these cases. Maybe something to document a little bit better and write about, but that's

...