The Backend Engineering Show with Hussein Nasser

By Hussein NasserTechnology

The Backend Engineering Show with Hussein Nasser episodes

May 04, 2021 This Python And NodeJS IP Address Validation Vulnerability is Severe, Watch out
Watch this if you are using IP Address validation in both NodeJS and Python, these two libraries strip leading zeros which can lead to server side request forgery. Let us discuss
Resources
https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/
https://www.bleepingcomputer.com/news/security/python-also-impacted-by-critical-ip-address-validation-vulnerability/

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses
17 min
May 04, 2021 These Hackers Snuck their Trojan through PING
In this video, I’ll discuss the Pingback attack, a new clever attack that uses both DLL files through Oracle Component Interface (OCI.dll) and ICMP protocol to deliver commands between the victim machines and the command center.

Resources
https://thehackernews.com/2021/05/new-pingback-malware-using-icmp.html
https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol
https://en.wikipedia.org/wiki/Oracle_Call_Interface

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses

20 min
May 02, 2021 Publish-Subscribe Pattern vs Message Queues vs Request Response (Detailed Discussions with Examples)
In this podcast I’ll explain the message queues, the request response pattern and the publish subscribe pattern. I will also illustrate the main differences between them and when to use over another.
0:00 Intro
0:30 Message Queues in 60 Seconds
1:24 When to Use Message Queues?
14:33 Request Response Pattern
20:00 Request Response Pros & Cons
24:11 Publish Subscribe Pattern in 60 Seconds
25:13 Publish Subscribe Pattern
31:49 Publish Subscribe Pattern Pros and Cons

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses
45 min
April 30, 2021 HTTP Code 502 Bad Gateway Explained (All its Possible Causes on the Backend)
502 Bad Gateway is one of the most infamous errors on the backend, it usually means “hey something wrong with your backend server” but it doesn’t really give enough information.

In this video,
I’ll go through details on why proxies and gateways like NGINX and HAProxy should consider throwing more fine detailed HTTP error codes. 502 Bad Gateway The server was acting as a gateway or proxy and received an invalid response from the upstream server.

0:00 intro
3:45 What Causes a 502 Bad Gateway?
8:00 Cloudflare HTTP error codes
13:00 Security Implications

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses
18 min
April 26, 2021 Technical Discussion on VPNs - How VPNs Work, their benefits, and What happens when VPNs are Hacked
In this episode I’ll talk about how VPN works, networking, IPSec and will also discuss the benefits of VPN and what happens when a VPN is hacked?
  * Intro 0:00
  * How Networking Works? 2:20
  * How VPN Works? 10:00
  * VPN Benefits 17:50
* What happens when VPN is hacked 20:20

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses
27 min
April 22, 2021 Let us discuss the Linux Kernel community and University of Minnesota situation
There is an ongoing situation with the Linux kernel community and the University of Minnesota Department of Computer Science & Engineering. We discuss this in this episode and I give my opinion

16 min
April 20, 2021 Auth0 Outage (Early report)
Auth0 went down on April/20/2021 and this is the early report. Let us discuss.
This incident affects: Auth0 US (PROD) (User Authentication, Machine to Machine Authentication, Multi-factor Authentication, Management API), Auth0 US (PREVIEW) (User Authentication, Machine to Machine Authentication, Multi-factor Authentication, Management API), and Management Dashboard (manage.auth0.com).
0:00 Update on Auth0 outage
6:00 Speculation of the outage
https://auth0.com/blog/how-we-store-data-in-the-cloud-at-auth0/#Redis
https://status.auth0.com/incidents/zvjzyc7912g5?u=v0zzz6jxvbv7
12 min
April 20, 2021 North Korean Hackers Hide Malicious Code within BMP image, Goes Undetected by AntiVirus software
Let us discuss the complexity behind this trojan hack, the multi-layer approach of hiding the RAT (remote access trojan) is absolutely genius.

https://en.wikipedia.org/wiki/HTML_Application https://en.wikipedia.org/wiki/Portable_Network_Graphics https://blog.malwarebytes.com/malwarebytes-news/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/
15 min
April 18, 2021 These New WhatsApp Vulnerabilities Can Leak Images, Voice Notes, and Chat by Opening an HTML message
Few vulnerabilities in WhatsApp for Andriod discovered that allow an attacker to send an HTML file attachment full access to the user's media, voice notes, pictures, and eventually chat messages (through TLS session resumption keys). In this video, we will discuss the scope of this attack. The vulnerabilities have been patched by facebook.
Full article from CENSUS labs discussing in detail how to carry POC attack. https://census-labs.com/news/2021/04/14/whatsapp-mitd-remote-exploitation-CVE-2021-24027/
22 min
April 17, 2021 A Look into Modern Leaky Abstractions - Postgres, MySQL, HTTP/2, TCP, ORMs GraphQL, N+1, Axios, git
Leaky abstractions occur when the consumer of the abstraction started asking questions about certain behavior which ends up with the need to understand the details behind the abstraction. Joel Spolsky coined this term and in this video I’d like to discuss this concept and provide few examples of my own experience towards leaky abstractions. Let us get on with the show.
6:00 Postgres Dead Tuples
7:25 MySQL Clustering
9:23 Axios HTTP Library
11:30 ORMs (N+1)
13:30 Beyond Abstractions
15:30 TCP
19:30 HTTP/2
27:00 Microservices
28:40 Index Only Scans Postgres
33:35 git
34:50 Summary

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses
38 min

About The Backend Engineering Show with Hussein Nasser

From the publisher's feed

Welcome to the Backend Engineering Show podcast with your host Hussein Nasser. If you like software engineering you’ve come to the right place. I discuss all sorts of software engineering technologies and news with specific focus on the backend. All opinions are my own.