https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=Vitaly+McLain 2026-06-01T20:33:16Z User contributions MediaWiki 1.27.2 https://wiki.owasp.org/index.php?title=Chicago&diff=189818 2015-02-17T20:45:17Z

<p>Vitaly McLain: /* Agenda */</p> <hr /> <div><br /> == Next Chapter Meeting: February 18th, 2015==<br /> <br /> The next OWASP Chicago chapter will be on '''February 18th, 2015''' from 6:00PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''The event is free but [https://owaspchicago.eventbrite.com registration is required].''' This is how your name gets to the security folks downstairs. You do not need to be an OWASP member to attend. You do '''not''' need the actual ticket but you will need to sign in with security in the lobby of the building. The event is on the 7th floor.<br /> <br /> The general schedule is as follows:<br /> * 6:00PM - 6:30PM - Refreshments and pizza @ Cafeteria<br /> * 6:30PM - 6:45PM - Organizational Updates @ Auditorium<br /> * 6:45PM - Talks or Workshops @ Auditorium<br /> <br /> ==Agenda==<br /> <br /> <br /> * ''' Application Security Automation and Governance''' by Michael Allen<br /> * '''Android Application Security: Common Pitfalls and How To Avoid Them''' by Drew Suarez<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in application security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements. Our mailing list is at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> We are in the process of setting up a Meetup group to help publicize and track events.<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:matt.konda@owasp.org Matt Konda].<br /> <br /> Also, we collaborate closely with the [https://www.owasp.org/index.php/Chicago_Suburbs Chicago Suburbs Chapter].<br /> <br /> == Presentation History ==<br /> <br /> Introducing [https://github.com/dmayer/idb idb]: Simplified Blackbox iOS App Pentesting by Daniel Mayer<br /> <br /> Tips for Building a Successful Application Security Program by Clint Pollock<br /> <br /> You Will Perish In Flames: Simple Rules For Safely Handling Crypto by Thomas Ptacek<br /> <br /> A9: Discovering Vulnerable Components with [https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency-Check] by Steve Springett<br /> <br /> How to Get the Most Out of Your Security Consulting Experience by Erin Ptacek<br /> <br /> Repsheet: A Behavior Based Approach to Web Application Security by Aaron Bedra<br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]<br /> <br /> <br /> [http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only Thomas Ptacek, Matasano Security<br /> <br /> [http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review<br /> Cory Scott, ABN AMRO<br /> <br /> [https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage John Steven, Cigital<br /> <br /> [http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough Jeff Jarmoc, Dell SecureWorks and Zack Fasel, Dubsec Labs<br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * John Downey<br /> * Aaron Bedra<br /> * Matt Konda<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> <br /> <br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=189060 2015-02-05T04:56:40Z

<p>Vitaly McLain: </p> <hr /> <div><br /> == Next Chapter Meeting: February 18th, 2015==<br /> <br /> The next OWASP Chicago chapter will be on '''February 18th, 2015''' from 6:00PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''The event is free but [https://owaspchicago.eventbrite.com registration is required].''' This is how your name gets to the security folks downstairs. You do not need to be an OWASP member to attend. You do '''not''' need the actual ticket but you will need to sign in with security in the lobby of the building. The event is on the 7th floor.<br /> <br /> The general schedule is as follows:<br /> * 6:00PM - 6:30PM - Refreshments and pizza @ Cafeteria<br /> * 6:30PM - 6:45PM - Organizational Updates @ Auditorium<br /> * 6:45PM - Talks or Workshops @ Auditorium<br /> <br /> ==Agenda==<br /> <br /> <br /> * ''' Application Security Automation and Governance''' by Michael Allen<br /> * TBD<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in application security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements. Our mailing list is at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> We are in the process of setting up a Meetup group to help publicize and track events.<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:matt.konda@owasp.org Matt Konda].<br /> <br /> Also, we collaborate closely with the [https://www.owasp.org/index.php/Chicago_Suburbs Chicago Suburbs Chapter].<br /> <br /> == Presentation History ==<br /> <br /> Introducing [https://github.com/dmayer/idb idb]: Simplified Blackbox iOS App Pentesting by Daniel Mayer<br /> <br /> Tips for Building a Successful Application Security Program by Clint Pollock<br /> <br /> You Will Perish In Flames: Simple Rules For Safely Handling Crypto by Thomas Ptacek<br /> <br /> A9: Discovering Vulnerable Components with [https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency-Check] by Steve Springett<br /> <br /> How to Get the Most Out of Your Security Consulting Experience by Erin Ptacek<br /> <br /> Repsheet: A Behavior Based Approach to Web Application Security by Aaron Bedra<br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]<br /> <br /> <br /> [http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only Thomas Ptacek, Matasano Security<br /> <br /> [http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review<br /> Cory Scott, ABN AMRO<br /> <br /> [https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage John Steven, Cigital<br /> <br /> [http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough Jeff Jarmoc, Dell SecureWorks and Zack Fasel, Dubsec Labs<br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * John Downey<br /> * Aaron Bedra<br /> * Matt Konda<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> <br /> <br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=186714 2014-12-09T06:14:09Z

<p>Vitaly McLain: /* Agenda */</p> <hr /> <div><br /> == Next Chapter Meeting: December 10th, 2014==<br /> <br /> The next OWASP Chicago chapter will be on '''December 10th, 2014''' from 6:00PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''The event is free but [https://owaspchicago.eventbrite.com registration is required].''' This is how your name gets to the security folks downstairs. You do not need to be an OWASP member to attend. You do '''not''' need the actual ticket. Just sign up here: [https://owaspchicago.eventbrite.com https://owaspchicago.eventbrite.com]<br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments and pizza @ Cafeteria<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> ==Agenda==<br /> <br /> * '''Introducing idb: Simplified Blackbox iOS App Pentesting''' by Daniel Mayer - A review of common iOS mobile app flaws and an intro to [https://github.com/dmayer/idb idb], a tool to help assess them. <br /> * '''Tips for Building a Successful Application Security Program''' by Clint Pollock<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> You Will Perish In Flames: Simple Rules For Safely Handling Crypto by Thomas Ptacek<br /> <br /> A9: Discovering Vulnerable Components with [https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency-Check] by Steve Springett<br /> <br /> How to Get the Most Out of Your Security Consulting Experience by Erin Ptacek<br /> <br /> Repsheet: A Behavior Based Approach to Web Application Security by Aaron Bedra<br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> * Matt Konda - Developer Outreach Ambassador<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=186343 2014-12-02T05:02:12Z

<p>Vitaly McLain: </p> <hr /> <div><br /> == Next Chapter Meeting: December 10th, 2014==<br /> <br /> The next OWASP Chicago chapter will be on '''December 10th, 2014''' from 6:00PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''The event is free but [https://owaspchicago.eventbrite.com registration is required].''' This is how your name gets to the security folks downstairs. You do not need to be an OWASP member to attend. You do '''not''' need the actual ticket. Just sign up here: [https://owaspchicago.eventbrite.com https://owaspchicago.eventbrite.com]<br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments and pizza @ Cafeteria<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> ==Agenda==<br /> <br /> * '''Introducing idb: Simplified Blackbox iOS App Pentesting''' by Daniel Mayer - A review of common iOS mobile app flaws and an intro to [https://github.com/dmayer/idb idb], a tool to help assess them. <br /> * TBA<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> You Will Perish In Flames: Simple Rules For Safely Handling Crypto by Thomas Ptacek<br /> <br /> A9: Discovering Vulnerable Components with [https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency-Check] by Steve Springett<br /> <br /> How to Get the Most Out of Your Security Consulting Experience by Erin Ptacek<br /> <br /> Repsheet: A Behavior Based Approach to Web Application Security by Aaron Bedra<br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> * Matt Konda - Developer Outreach Ambassador<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=186342 2014-12-02T03:57:14Z

<p>Vitaly McLain: </p> <hr /> <div><br /> == Next Chapter Meeting: December 10th, 2014==<br /> <br /> The next OWASP Chicago chapter will be on '''December 10th, 2014''' from 6:00PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''The event is free but [https://owaspchicago.eventbrite.com registration is required].''' This is how your name gets to the security folks downstairs. You do not need to be an OWASP member to attend. You do '''not''' need the actual ticket. Just sign up here: [https://owaspchicago.eventbrite.com https://owaspchicago.eventbrite.com]<br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments and pizza @ Cafeteria<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> ==Agenda==<br /> <br /> * '''Introducing idb: Simplified Blackbox iOS App Pentesting''' by Daniel Mayer - A review of common iOS mobile app flaws and a tool to help assess them. <br /> * TBA<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> You Will Perish In Flames: Simple Rules For Safely Handling Crypto by Thomas Ptacek<br /> <br /> A9: Discovering Vulnerable Components with [https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency-Check] by Steve Springett<br /> <br /> How to Get the Most Out of Your Security Consulting Experience by Erin Ptacek<br /> <br /> Repsheet: A Behavior Based Approach to Web Application Security by Aaron Bedra<br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> * Matt Konda - Developer Outreach Ambassador<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=HTTP_Strict_Transport_Security&diff=172804 2014-04-15T21:15:10Z

<p>Vitaly McLain: Make values consistent and set to about a year</p> <hr /> <div>&lt;br&gt;<br /> == Description ==<br /> <br /> HTTP Strict Transport Security (HSTS) is an opt-in security enhancement that is specified by a web application through the use of a special response header. Once a supported browser receives this header that browser will prevent any communications from being sent over HTTP to the specified domain and will instead send all communications over HTTPS. It also prevents HTTPS click through prompts on browsers.<br /> <br /> &lt;br&gt;<br /> <br /> The specification has been released and published end of 2012 as RFC 6797 (HTTP Strict Transport Security (HSTS)) by the IETF. (Reference see in the links at the bottom.)<br /> <br /> == Examples ==<br /> <br /> Example of the HTTP strict transport security header <br /> <br /> Strict-Transport-Security: max-age=31536000<br /> <br /> If all subdomains are HTTPS too then the following header is applicable:<br /> <br /> Strict-Transport-Security: max-age=31536000; includeSubDomains<br /> <br /> == Browser Support ==<br /> <br /> {| width=&quot;400&quot; cellspacing=&quot;1&quot; cellpadding=&quot;1&quot; border=&quot;1&quot;<br /> |-<br /> | '''Browser'''&lt;br&gt;<br /> | '''Support Introduced'''&lt;br&gt;<br /> |-<br /> | Internet Explorer &lt;br&gt;<br /> | no support as of IE 10 (tested on 2013-01-01)&lt;br&gt;<br /> |-<br /> | Firefox&lt;br&gt;<br /> | 4&lt;br&gt;<br /> |-<br /> | Opera&lt;br&gt;<br /> | 12&lt;br&gt;<br /> |-<br /> | Safari&lt;br&gt;<br /> | Mavericks (Mac OS X 10.9)&lt;br&gt;<br /> |-<br /> | Chrome&lt;br&gt;<br /> | 4.0.211.0&lt;br&gt;<br /> |}<br /> <br /> &lt;br&gt;<br /> <br /> == Server Side ==<br /> <br /> The web server side needs to inject the HSTS header. <br /> <br /> For HTTP sites on the same domain it is [http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec#section-6.1 not recommended] to add a HSTS header but to do a permanent redirect (301 status code) to the HTTPS site.<br /> <br /> An Apache HTTPd example that will permanently redirect a URL to the identical URL with a HTTPS scheme, is as follows:<br /> <br /> &lt;VirtualHost *:80&gt;<br /> ServerAlias *<br /> RewriteEngine On<br /> RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [redirect=301]<br /> &lt;/VirtualHost&gt;<br /> <br /> On the HTTPS site configuration the following is needed to add the header as [http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec#section-6.1 recommended by the standard]:<br /> Header set Strict-Transport-Security &quot;max-age=31536000; includeSubDomains&quot;<br /> <br /> The following links show how to set response headers in other web servers:<br /> * [http://wiki.nginx.org/HttpHeadersModule NGINX]<br /> * [http://redmine.lighttpd.net/wiki/lighttpd/Docs:ModSetEnv#Options Lighttpd]<br /> * [http://httpd.apache.org/docs/2.2/mod/mod_headers.html HTTPd]<br /> <br /> ==== IIS ====<br /> Whilst [http://technet.microsoft.com/en-us/library/cc753133(WS.10).aspx custom headers] can be configured in IIS without any extensions, it is not possible to restrict these headers to secure transport channels [http://tools.ietf.org/html/rfc6797#section-7.2 as per the HSTS specification]. HSTS has been implemented as per the specification as an [http://hstsiis.codeplex.com/ open source IIS module].<br /> <br /> == Threats ==<br /> <br /> HSTS addresses the following threats:<br /> * User bookmarks or manually types http://example.com and is subject to a man-in-the-middle attacker<br /> ** HSTS automatically upgrades HTTP requests to HTTPS for the target domain<br /> * Web application that is intended to be purely HTTPS inadvertently contains HTTP links or serves content over HTTP<br /> ** HSTS automatically upgrades HTTP requests to HTTPS for the target domain<br /> * A man-in-the-middle attacker attempts to intercept traffic from a victim user using an invalid certificate and hopes the user will accept the bad certificate<br /> ** HSTS does not allow a user to override the invalid certificate message<br /> <br /> <br /> == Links ==<br /> <br /> [http://dev.chromium.org/sts Chromium Projects/HSTS]<br /> <br /> [http://tools.ietf.org/html/rfc6797 HSTS Spec]<br /> <br /> [http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security Wikipedia]<br /> <br /> [https://developer.mozilla.org/en/Security/HTTP_Strict_Transport_Security Mozilla Developer Network]<br /> <br /> [https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet OWASP TLS Protection Cheat Sheet]<br /> <br /> [https://developer.mozilla.org/en/Security/HTTP_Strict_Transport_Security Firefox STS Support]<br /> <br /> [http://lists.w3.org/Archives/Public/public-webapps/2009JulSep/1148.html Google Chrome STS Support]<br /> <br /> [http://www.thoughtcrime.org/software/sslstrip/ Moxie Marlinspike's Black Hat 2009 talk on sslstrip, that demonstrates why you need HSTS]<br /> <br /> [[Category:Control|Control]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=165077 2013-12-23T21:20:47Z

<p>Vitaly McLain: Minor clean-up for now</p> <hr /> <div><br /> == Next Chapter Meeting: ???==<br /> <br /> The next OWASP Chicago chapter will be on '''TBA''' from 6:00PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''The event is free but [https://owaspchicago.eventbrite.com registration is required].''' This is how your name gets to the security folks downstairs. You do not need to be an OWASP member to attend. You do '''not''' need the actual ticket. Just sign up here: [https://owaspchicago.eventbrite.com https://owaspchicago.eventbrite.com]<br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments and pizza @ Cafeteria<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> ==Agenda==<br /> <br /> TBA<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> You Will Perish In Flames: Simple Rules For Safely Handling Crypto by Thomas Ptacek<br /> <br /> A9: Discovering Vulnerable Components with [https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency-Check] by Steve Springett<br /> <br /> How to Get the Most Out of Your Security Consulting Experience by Erin Ptacek<br /> <br /> Repsheet: A Behavior Based Approach to Web Application Security by Aaron Bedra<br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> * Matt Konda - Developer Outreach Ambassador<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=164593 2013-12-12T20:40:28Z

<p>Vitaly McLain: Meeting updates + chapter leader update</p> <hr /> <div><br /> == Next Chapter Meeting: December 18th, 2013==<br /> <br /> The next OWASP Chicago chapter will be on '''December 18th, 2013''' from 6:00PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''The event is free but [https://owaspchicago.eventbrite.com registration is required].''' This is how your name gets to the security folks downstairs. You do not need to be an OWASP member to attend. You do '''not''' need the actual ticket. Just sign up here: [https://owaspchicago.eventbrite.com https://owaspchicago.eventbrite.com]<br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments and pizza @ Cafeteria<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> ==Agenda==<br /> <br /> * '''You Will Perish In Flames: Simple Rules For Safely Handling Crypto''' by Thomas Ptacek<br /> * '''A9: Discovering Vulnerable Components with [https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency-Check]''' by Steve Springett<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> How to Get the Most Out of Your Security Consulting Experience by Erin Ptacek<br /> <br /> Repsheet: A Behavior Based Approach to Web Application Security by Aaron Bedra<br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> * Matt Konda - Developer Outreach Ambassador<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=164280 2013-12-04T04:44:08Z

<p>Vitaly McLain: December meeting info</p> <hr /> <div><br /> == Next Chapter Meeting: December 18th, 2013==<br /> <br /> The next OWASP Chicago chapter will be on '''December 18th, 2013''' from 6:00PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''The event is free but [https://owaspchicago.eventbrite.com registration is required].''' This is how your name gets to the security folks downstairs. You do '''not''' need the actual ticket. Just sign up here (works on mobile, too): [https://owaspchicago.eventbrite.com https://owaspchicago.eventbrite.com]<br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments (and likely pizza!) @ Cafeteria<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> Stay tuned to this page for more information.<br /> <br /> ==Agenda==<br /> <br /> '''You Will Perish In Flames: Simple Rules For Safely Handling Crypto''' by Thomas Ptacek<br /> <br /> ...and one more talk to be announced.<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> How to Get the Most Out of Your Security Consulting Experience by Erin Ptacek<br /> <br /> Repsheet: A Behavior Based Approach to Web Application Security by Aaron Bedra<br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=156724 2013-08-13T04:27:39Z

<p>Vitaly McLain: </p> <hr /> <div><br /> == Next Chapter Meeting: August 21st, 2013==<br /> <br /> The next OWASP Chicago chapter will be on '''August 21st, 2013''' from 6PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''The event is free but [https://owaspchicago.eventbrite.com RSVP is required]. This is how your name gets to the security folks downstairs. You do not need the actual ticket. Just sign up here (works on mobile, too): [https://owaspchicago.eventbrite.com https://owaspchicago.eventbrite.com]<br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments @ Cafeteria (possible food this time around, will update)<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> Stay tuned to this page for more information.<br /> <br /> ==Agenda==<br /> <br /> '''How to Get the Most Out of Your Security Consulting Experience''' by Erin Ptacek<br /> <br /> '''Repsheet: A Behavior Based Approach to Web Application Security''' by Aaron Bedra<br /> <br /> ...and one more talk to be announced.<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=156723 2013-08-13T04:25:51Z

<p>Vitaly McLain: RSVP info</p> <hr /> <div><br /> == Next Chapter Meeting: August 21st, 2013==<br /> <br /> The next OWASP Chicago chapter will be on '''August 21st, 2013''' from 6PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''The event is free but [https://owaspchicago.eventbrite.com RSVP is required]. This is how your name gets to the security folks downstairs. You do not need the actual ticket. Just [https://owaspchicago.eventbrite.com sign up].'''<br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments @ Cafeteria (possible food this time around, will update)<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> Stay tuned to this page for more information.<br /> <br /> ==Agenda==<br /> <br /> '''How to Get the Most Out of Your Security Consulting Experience''' by Erin Ptacek<br /> <br /> '''Repsheet: A Behavior Based Approach to Web Application Security''' by Aaron Bedra<br /> <br /> ...and one more talk to be announced.<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=156722 2013-08-13T04:19:29Z

<p>Vitaly McLain: Agenda update</p> <hr /> <div><br /> == Next Chapter Meeting: August 21st, 2013==<br /> <br /> The next OWASP Chicago chapter will be on '''August 21st, 2013''' from 6PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''SPEAKERS NEEDED!''' Please [mailto:vitaly.mclain+owasp@gmail.com contact me] as soon as possible. Any topic is welcome.<br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> An RSVP link will be here soon! Please save the date.<br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments @ Cafeteria (possible food this time around, will update)<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> Stay tuned to this page for more information.<br /> <br /> ==Agenda==<br /> <br /> '''How to Get the Most Out of Your Security Consulting Experience''' by Erin Ptacek<br /> <br /> '''Repsheet: A Behavior Based Approach to Web Application Security''' by Aaron Bedra<br /> <br /> ...and one more talk to be announced.<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=156454 2013-08-06T04:13:03Z

<p>Vitaly McLain: Clean-up for next event</p> <hr /> <div><br /> == Next Chapter Meeting: August 21st, 2013==<br /> <br /> The next OWASP Chicago chapter will be on '''August 21st, 2013''' from 6PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''SPEAKERS NEEDED!''' Please [mailto:vitaly.mclain+owasp@gmail.com contact me] as soon as possible. Any topic is welcome.<br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> An RSVP link will be here soon! Please save the date.<br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments @ Cafeteria (possible food this time around, will update)<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> Stay tuned to this page for more information.<br /> <br /> ==Agenda==<br /> <br /> Coming soon...<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> <br /> Forget About BYOD: Develop a Realistic Mobile Security Policy by Tom Bain<br /> <br /> Android Internals: From Forensics to Vulnerabilities by Drew Suarez<br /> <br /> An Application Pen Tester’s Intro to Android Internals by Tom Palarz<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=149899 2013-04-15T19:28:23Z

<p>Vitaly McLain: Talk updates</p> <hr /> <div><br /> == Next Chapter Meeting: April 17th, 2013 ==<br /> <br /> The next OWASP Chicago chapter will be on '''April 17th, 2013''' from 6PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> '''This is event is completely free and open to everyone, but you must RSVP.''' Please RSVP at the following EventBrite page so that security can let you into the building: https://owaspchicago.eventbrite.com/<br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments @ Cafeteria (possible food this time around, will update)<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> Stay tuned to this page for more information.<br /> <br /> ==Agenda==<br /> <br /> We have a bit of a mobile device theme this time, from both a corporate policy perspective and a deep dive into Android! <br /> <br /> * '''Forget About BYOD: Develop a Realistic Mobile Security Policy''' by Tom Bain<br /> <br /> &lt;i&gt;The buzz throughout the IT Security industry has been BYOD for the past two years, but mobile security is still often an afterthought relative to enterprise models.<br /> <br /> The reality is there is no silver bullet for dealing with mobile threats, developing your mobile security approach or even enforcing it as part of your overall security strategy. Organizations looking at developing an effective set of mobile security policies should be integrating mobile into the broader suite of security policies.<br /> <br /> As mobile devices have become part of the enterprise fabric today and not just a nice-to-have, its no longer option to silo mobile security. With over 60% of the workforce using smartphones specifically for business, the increased attack surface has opened the floodgates for a multitude of attacks.<br /> <br /> This presentation will provide an overview of the fundamental considerations, research-based recommendations and best practices across application, device and policy-based models.&lt;/i&gt;<br /> <br /> * '''Android Internals: From Forensics to Vulnerabilities''' by Drew Suarez - focusing largely on the OS, its design and layout, OS-level vulnerabilities, segueing into...<br /> <br /> * '''An Application Pen Tester’s Intro to Android Internals''' by Tom Palarz:<br /> <br /> ''This talk will be a grey-box exploration of the Android OS, that will be light on slides and heavier on demonstration. We will take some of the most popular tools used in assessing an Android app and point it at the OS instead to explore Internals from a black box perspective. For illustrative purposes, we will dig into Android Source Code to get a bit of a deeper understanding of what is going on under the hood.''<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=149194 2013-04-05T03:43:41Z

<p>Vitaly McLain: April 17th meeting info</p> <hr /> <div><br /> == Next Chapter Meeting: April 17th, 2013 ==<br /> <br /> The next OWASP Chicago chapter will be on '''April 17th, 2013''' from 6PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> '''This is event is completely free and open to everyone, but you must RSVP.''' Please RSVP at the following EventBrite page so that security can let you into the building: https://owaspchicago.eventbrite.com/<br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments @ Cafeteria<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> Stay tuned to this page for more information.<br /> <br /> ==Agenda==<br /> <br /> We have a bit of a mobile device theme this time, from both a corporate policy perspective and a deep dive into Android! <br /> <br /> * '''Forget About BYOD: Develop a Realistic Mobile Security Policy''' by Tom Bain<br /> <br /> * '''Android Internals: From Forensics to Vulnerabilities''' by Drew Suarez - focusing largely on the OS, its design and layout, OS-level vulnerabilities, segueing into...<br /> <br /> * '''An AppSec Guide to Android Internals''' by Tom Palarz - ...featuring more discussion on design, vulnerabilities, but also focusing on the app layer<br /> <br /> ...and perhaps a 4th talk! Stay tuned for more details as we firm things up.<br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> <br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain https://wiki.owasp.org/index.php?title=Chicago&diff=142051 2013-01-09T05:32:33Z

<p>Vitaly McLain: </p> <hr /> <div><br /> == Next Chapter Meeting: January 10th, 2013 ==<br /> <br /> The next OWASP Chicago chapter will be on '''January 10th, 2013''' from 6PM to approximately 9:30PM. Space for the meeting is being graciously provided by [http://www.morningstar.com/ Morningstar] at their [http://goo.gl/maps/wfqQ8 Chicago headquarters location] (22 West Washington Street, Chicago, IL 60602). <br /> <br /> '''Tell your friends!''' Many people just don't hear about these meetings and most people I ask say they heard about it from a friend or co-worker. <br /> <br /> '''This is event is completely free and open to everyone, but you must RSVP.''' Please RSVP at the following EventBrite page so that security can let you into the building: https://owaspchicago.eventbrite.com/<br /> <br /> When you arrive, you will need to sign in with security in the lobby of the building, who will direct you to the cafeteria for refreshments. We will then move to the Auditorium for talks. <br /> <br /> The schedule is as follows:<br /> <br /> * 6:00PM - 6:30PM - Refreshments @ Cafeteria - Light snacks. If you want food, you can bring your own and eat here. Food is not allowed in the auditorium.<br /> * 6:30PM - ~9:30PM - Talks! @ Auditorium<br /> <br /> Stay tuned to this page for more information.<br /> <br /> ==Agenda==<br /> <br /> This time, we will be doing short-format talks -- about 25-30 minutes each. There will be time for Q&amp;A.<br /> <br /> * '''Common Ruby on Rails Pitfalls''' by Matt Konda and Jonathan Claudius<br /> <br /> * '''Automation Domination''' by Brandon Spruth:<br /> <br /> ''You have either bought some really expensive static and/or dynamic web scanning tools, or you are looking to go on the &quot;cheap&quot; with some free ones. The next decision you will need to make will be either running these in scanning tools manually or dominate with automation! Our discussion will explore some popular options on how to best automate the implementation of your scanning tools, with Continuous Integration, OWASP Projects, and to Normalizing your scanning metrics/findings/vulnerabilities.<br /> ''<br /> <br /> * '''Content Security Policy (CSP)''' by Ben Toews<br /> <br /> * '''Basic Analysis of iOS applications''' by John Downey<br /> <br /> <br /> == General Information ==<br /> <br /> Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.<br /> <br /> Make sure you sign up for the mailing list to receive meeting announcements.<br /> <br /> We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-chicago<br /> <br /> Follow (and/or DM us) on Twitter: [https://twitter.com/owaspchicago @owaspchicago]<br /> <br /> If you have any questions about the Chicago chapter, please send an email to [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain].<br /> <br /> == Presentation Archives ==<br /> <br /> Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here]<br /> <br /> Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here]<br /> <br /> Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here]<br /> <br /> Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]&lt;BR&gt;<br /> <br /> Defeating Information Leak Prevention - Eric Monti - Presentation slides [https://www.owasp.org/images/4/4a/OWASP-CHI07-Defeating_Extrusion_Detection.pdf here]&lt;BR&gt;<br /> <br /> <br /> '''[http://wittys.com/owasp/OWASP_Chicago_Thomas_Ptacek.pdf]Webapps In Name Only'''<br /> Thomas Ptacek, Matasano Security<br /> <br /> Where modern network architecture meets legacy application design, we get &quot;The Port 80 Problem&quot;: vendors wrapping every conceivable network protocol in a series of POSTs and calling them &quot;safe&quot;. These &quot;Webapps In Name Only&quot; are a nightmare for application security specialists.<br /> <br /> In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:<br /> <br /> - Locating and Decompiling Java and .NET Code<br /> - Structure and Interpretation of Binary Protocols in HTTP<br /> - Protocol Debugging Tools<br /> - Web App Crypto Tricks<br /> <br /> '''[http://wittys.com/owasp/cscott-Stronger%20Web%20Authentication-v1.0.ppt]Token-less strong authentication for web applications: A Security Review'''<br /> Cory Scott, ABN AMRO<br /> <br /> A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement &quot;true&quot; two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions. <br /> <br /> '''[https://www.owasp.org/images/8/88/Secure_Password_Storage_%40OWASPChicago.pdf]Secure Password Storage'''<br /> John Steven, Cigital<br /> <br /> This talk discusses the pros and cons of the current practices such as salted-hashes, adaptive hashes and proposes an alternative solution for strengthening these existing practices. The talk will discuss the cryptographic properties of the current practices, but does not require a PhD in mathematics to understand the details.<br /> <br /> '''[http://www.offenseindepth.com/slides/Stripe_OWASP.pdf]Stripe CTF 2.0; A Walkthrough'''<br /> Jeff Jarmoc, Dell SecureWorks<br /> Zack Fasel, Dubsec Labs<br /> <br /> In this presentation, we walk through our solutions to Stripe CTF 2.0. Focus is on how we discovered the vulnerabilities, and how we went about finding and exploiting them.<br /> <br /> &lt;paypal&gt;Chicago&lt;/paypal&gt;<br /> <br /> ==== Chicago OWASP Chapter Leaders ====<br /> * [mailto:vitaly.mclain+owasp@gmail.com Vitaly McLain]<br /> * Mahmood Khan<br /> <br /> __NOTOC__<br /> &lt;headertabs/&gt;<br /> [[Category:OWASP Chapter]]<br /> [[Category:Illinois]]</div>

Vitaly McLain