Hello, welcome to the Thursday, August 3, 2017 edition of the Santernut Storm Center's Stormcast. My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

Many modern web applications are moving to NoSQL databases. Now, with that, there are some new threats that you need to be aware of.

Boyan has a nice diary today that builds on a talk that he gave at Zan Spire,

explaining how to attack these no-SQL databases.

Now, with SQL injection, an attacker is typically able to rewrite SQL commands.

No SQL works a little bit different.

You typically can't easily rewrite commands as you can do with SQL.

But on the other hand, you're typically dealing with complex data types.

The example that Boyan here has is JSON, and then by using JSON tricks, it is often possible

to have the input misinterpreted and essentially go back to what you had with a SQL injection just now with no SQL databases

and you are then able to retrieve data that you weren't supposed to retrieve or even update data

that you weren't supposed to be able to update. So pretty interesting diary I think pretty

cutting-edge stuff that Boyan is doing

here. If you are using any of these NoSQL databases, in particular the ones that deal directly

with JSON data, then take a look at his diary. Yesterday I talked about how a developer for the copyfish extension in Google Chrome fell

for a fishing attack and as a result, his Google developer account was hijacked and the extension

replaced with adware. Apparently this wasn't the only extension that happened to. The very popular web developer toolbar also was replaced with AdWare yesterday.

So if you have that installed, make sure that you have the uninfected, the clean version installed.

Apparently in this case, the developer was able to get his account back,

and that particular extension should be okay now. And Kasperski is writing about further developments

with Android banking malware. The latest case that they discovered was a further development of the

SVPeng Trojan. That particular Trojan has been known for a while now, actually for a couple

...