Jeff Morin: Type Conversion Errors: How A Little Data Type Can Do A Whole Lot Of Damage Black Hat Briefings, USA 2007 [Audio] Presentations From The Security Conference. podcast

Content provided by Black Hat/ CMP Media, Inc. and Jeff Moss. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Black Hat/ CMP Media, Inc. and Jeff Moss or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://podcastplayer.com/legal.

Black Hat Briefings, USA 2007 [Audio] Presentations from the security conference. «
Jeff Morin: Type Conversion Errors: How a Little Data Type Can Do a Whole Lot of Damage

20y ago 10:25

MP3•Episode home

Archived series ("Inactive feed" status)

When? This feed was archived on December 06, 2025 19:12 (14d ago). Last successful fetch was on August 02, 2022 21:09 (3+ y ago)

Why? Inactive feed status. Our servers were unable to retrieve a valid podcast feed for a sustained period.

What now? You might be able to find a more up-to-date version using the search function. This series will no longer be checked for updates. If you believe this to be in error, please check if the publisher's feed link below is valid and contact support to request the feed be restored or if you have any other concerns about this.

In the realm of application testing, one of the major, but most often overlooked vulnerabilities, is that of type conversion errors. These errors result from input variable values being used throughout the many areas and codebases that make up the application, and in doing so, are potentially treated as different data types throughout the processing. The application functions correctly and without issue because the values of the input variable are anticipated, even though they are treated in different areas as different data types. The issue arises then when a value is input into one of these variables that is crafted in such a way as to be successfully manipulated by some data types, while failing others, resulting in the application behaving in unanticipated and potentially dangerous ways. These vulnerabilities are much more difficult to identify than simple error-based SQL injection or XSS as they don't readily display success or failure, rather can manifest themselves in other areas or at a later time. This also makes them very dangerous in that the application behaves in completely unanticipated ways, potentially resulting in circumvented authentication and authorization, Denial of Service, elevated privileges, etc.
This talk explores the security pitfalls that result from type conversion errors, how to identify them, and proposes some solutions for identification going forward.

89 episodes

#Tech #Blackhat Briefings And Training #Blackhat Usa 2006 #Black Hat Vegas #Blackhat Vegas #Hacking #Computer Security #Speeches #Presentations #Spoken Word #Video #Audio #Tech News #Jeff Moss #Podcasting #Conventions