BeNeLux OWASP Day 2016

Looking for the OWASP BeNeLux 2016 2nd edition in Belgium?

OWASP BeNeLux Announcement

We are proud to announce the dates of the next edition of BeNeLux OWASP Day! The event will take place on 17 and 18 March 2016, in Belval Campus, in Esch-sur-Alzette - Luxembourg. More information on the venue can be found here.
Don't wait and register now!

Confirmed speakers Conference

The OWASP BeNeLux Program Committee

Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium
Martin Knobloch, OWASP Netherlands
Jocelyn Aubert, OWASP Luxembourg

Tweet!

Event tag is #owaspbnl16

Donate to OWASP BeNeLux

Donate

Trainingday is March 17th

Location

The training venue is at the same location as the conference venue, i.e. Maison du Savoir on the 4th floor.

Agenda

Time	Description	Room 4.320	Room 4.350	Room 4.360	Room 4.400
08h30 - 9h30	Registration
09h30 - 11h00	Training	Application Security Primer by Martin Knobloch	Hands-on Threat Modeling by Sebastien Deleersnyder	Security Shepherd by Pol Mac Cana	O-saft by Torsten Gigler
11h00 - 11h30	Coffee Break
11h30 - 13h00	Training
13h00 - 14h00	Lunch
14h00 - 15h30	Training
15h30 - 16h00	Coffee Break
16h00 - 17h30	Training

Trainings

Application Security Primer

This workshop is an introduction into (web) application security with hands-on labs, using OWASP documentation and tooling. You will be introduced into the security mindset, discus the OWASP TopTen 2013 and learn basic skills in how to find vulnerabilities in web applications. All tools and documentation are provided during the training. As this is an hands-on workshop, please bring your own laptop!

Prerequisites for this workshop

Laptop with Virtualbox or VMware

Basic understanding of HTTP and web application testing/development

An open mind

Hands-on Threat Modeling

This is a 1 day, trainer-led, on-site, Threat Modeling course. The training material and hands-on workshops include real live Use Cases. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:

B2B web and mobile applications, sharing the same REST backend
An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.

Threat modeling allows you to consider, document, and discuss the security implications of designs in the context of their planned operational environment and in a structured fashion. Threat modeling also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model.

This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications and databases. The students should bring their own laptop to the course.

Course topics (1 day)

Threat modeling introduction

Threat modeling in a secure development lifecycle
What is threat modeling
Why threat modeling?
Threat modeling stages
Diagrams
Identify threats
Addressing threats
Document a threat model

Diagrams – what are you building?

Understanding context
Doomsday scenarios
Data flow diagrams
Trust Boundaries
Hands-on: diagram B2B web and mobile applications, sharing the same REST backend

Identifying threats – what can go wrong?

STRIDE introduction
Spoofing threats
Tampering threats
Repudiation threats
Information disclosure threats
Denial of service threats
Elevation of privilege threats
Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Addressing each threat

Mitigation patterns
Authentication: mitigating spoofing
Integrity: mitigating tampering
Non-repudiation: mitigating repudiation
Confidentiality: mitigating information disclosure
Availability: mitigating denial of service
Authorization: mitigating elevation of privilege

Threat modeling tools

General tools
Open-Source tools
Commercial tools

The course students receive the following package as part of the course:

Hand-outs of the presentations
Work sheets of the use cases,
Detailed solution descriptions of the use cases
Template to document a threat model
Template to calculate risk levels of identified threats

The students should bring their own laptop

Threat Modeling – real life use cases

As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world. In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build a threat model. Using this methodology for the hands on workshops we provide our students with a robust training experience and the templates to incorporate threat modeling best practices in their daily work. The students will be challenged to perform the threat modeling in groups of 3 to 4 people performing the different stages of threat modeling on:

B2B web and mobile applications, sharing the same REST backend
An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

After each hands-on workshop, the results are discussed, and the students receive a documented solution.

Security Shepherd

Want to learn the basics of Web App pen testing? Or would you prefer to develop new advanced pen testing tricks? Join the us for the lightning Security Shepherd Web Application training session that will bring attendees up to speed on all the latest and greatest security testing techniques that are a concern in the industry today. Compete against other participants and solve increasingly complex security puzzles derived from real world security threats. Attendees will leave with a real familiarity of web application pen testing best practice, terminology, workflow's and commonly used tool kits.

Prerequisites

A Laptop Capable of Connecting to Internet on the day You should have Java, Java Installed, OWASP ZAP / Burpsuite Downloaded or Installed, Firefox is the browser of choice.

O-saft

The use of SSL/TLS to protect the transport of data has become very common today. On the other hand it does not work pretty 'out of the box'. Furthermore it has more and more secuirty issues. As a consequence it often does not protect as assumed. It is often difficult to understand, what are the root causes of the issues, and how to detect and finally avoid or fix them.
This training will give a brief introduction to SSL, how it works i. g., what issues are related to the protocol, the PKI used, and the known vulnerabilities including potential attacks and provide tools to check for these issues. The main focus will be on SSL/TLS used in HTTPS. Other usages i.e. SSL for SMTP are a small subset. As a round-up there will be recommendations how to configure and maintain TLS securely.

Course Topics

The main part of the course will be a hands-on-training showing by example how to check the established TLS/SSL connection (including ciphers) to a web server and show how to analyse the provided certificate. Various tools will be explained. It will be demonstrated how these tools can be used to detect weaknesses in the TLS/SSL connection and such.
The explained tools are for example: openssl, sslscan, testssl.sh, o-saft, and some more, as well as some online checking tools like ssllabs.com. We show what are these tools useful for, what they can do, and what they cannot. Finally we show how the OWASP tool o-saft can be used to cover most of the previous shown techniques and how to use its advanced features like:

checking for ciphers
checking for special SSL settings
check multiple servers at a time
customizing the results
customizing o-saft itself
or simple debugging of various SSL connection problems.

The purpose of this course is to provide a tool set for checking TLS/SSL to the participants, and teach the participants how and when to use which tool, and why some tools do not provide complete results (e.g. protocols, ciphers). The course is about analysing TLS/SSL from a client-site view. It will not go into the details of fuzzing or even breaking TLS/SSL, or exploiting vulnerabilities. Mostly we will analyse HTTPS, furthermore we will provide some examples for protocols using STARTTLS, too (e.g. SMTP).
Additionally it will give system architects, administrator, or operational people, hints how to set-up and configure TLS/SSL in a proper secure way.

Technical requirements

The participants should bring their own laptop with any operating system (recommended is Linux) and at least following tools installed:

openssl (1.0.1e or newer)
perl (5.8 or newer), on windows system Strawberry perl is recommended
Net::SSLeay (1.53 or newer), IO::Socket::SSL (1.37 or newer)
Tcl (8.5) optional, on a windows system ActiveTcl (8.6) is recommended
python (2.7) optional

Optional, for smooth testing, a local SSL-enabled (SSLv2, SSLv3, TLS) web server should be running on the laptop (i.e. OWASP-BWA).

Trainers

Martin Knobloch

Martin is Principal Consultant at Nixu BeNeLux (https://www.nixu.com/en/nixubenelux). His main working area is (software) security in general, from awareness to implementation. In his daily work, he is responsible for education in application security matters, advise and implementation of application security measures. In2006, Martin got involved in OWASP when attending his first OWASP conference. He became a member of the OWASP Netherland Chapter board in 2007. He has contributed to several OWASP projects and is co-organizer of the OWASP BeNeLux-Day conference since 2008. Martin has been chair of the Global Education Committee from 2008 until the ending of the Global Committees. Futher, Martin is the conference chair of the OWASP AppSec-Eu/Research 2015 conference in Amsterdam, the Netherlands and involved in the AppSec-Eu 2016 among other activities as CfT Co-Chair. Martin is a frequent speaker at universities, hacker spaces and various conferences.

Sebastien Deleersnyder

Sebastien Deleersnyder, managing partner and application security consultant at Toreon will share his practical threat model experience. Sebastien led engagements in the domain of ICT-security, Web and Mobile Security with several customers including BNP Paribas Fortis, Atos Worldline, KBC, Nationale Nederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post , Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, served as vice-chair of the global OWASP Foundation Board and performed several public presentations on Web Application, Mobile and Web Services Security. Furthermore, Sebastien co-founded the yearly BruCON conference.

Pol Mac Cana

Paul is currently working as a Security Technical Team Lead and has over 6 years experience in infoSec. He has contributed to the OWASP Security Shepherd Project since its inception and has given training session utilising the tool to universities and educational bodies for a number of years. He received his MSc. in Information Security and Digital Forensics from ITB in Dublin

Torsten Gigler

Torsten Gigler is Internernal Security Advisor in a large scale enterprise >15 years (ICT-Infrastructure- and Application Security). He has been volunteering for OWASP since more than 3 years: since 2 years co-developer of O-Saft, contributed to the Transport Layer Protection Cheat Sheet (Cipher Section), project leader 'OWASP Top 10 für Entwickler' / OWASP Top 10 for Developers, contributed to the German translation of OWASP-Top-10 2013, supported the Top_10_2013-Project: Review, Wiki.

Conferenceday is March 18th

The conference will take place at Maison du Savoir, 3rd floor, room 3.540.

Agenda

Time	Speaker	Topic	Presentation
08h30 - 09h10	Registration
09h15 - 10h00	Julie Gommes	Gamers, You're the new Botnets	Download PDF
10h00 - 10h45	Stefan Burgmair	OWASP Top 10 Privacy Risks	Download PDF project website
10h45 - 11h15	Morning Break
11h15 - 12h00	Erik Poll	LangSec meets State Machines	Download PDF
12h00 - 12h45	Arne Swinnen	The Tales of a Bug Bounty Hunter	Download PDF
12h45 - 13h45	Lunch
13h45 - 14h30	Glenn Ten Cate & Riccardo Ten Cate	OWASP Security Knowledge Framework (SKF)	Download PDF project website
14h30 - 15h15	Kevin Allix	Challenges in Android Malware Detection	Download PDF
15h15 - 15h45	Break
15h45 - 16h30	Christian Schneider & Alvaro Muñoz	Serial Killer: Silently Pwning your Java Endpoints	Download PDF
16h30 - 17h15	Michael Hamm	Experiences with Paste-Monitoring	Download PDF
17h15 - 17h30	OWASP Benelux 2016 organization	Closing Notes

Talks

Gamers, You're the New Botnets

Downloading, playing, downloading, playing, downloading, playing, downloading, playing, downloading, playing... that is really funny. You can try new games every day but the guys who share those games are not just happy and funny people doing that just for pleasure to share "games". Yeas, they're sharing games, but lot of other Tools they enjoy to play with... Let's talk about malwares, about botnets, about backdoors and about some computer which can win a "botnet award".

OWASP Top 10 Privacy Risks

There are lively discussions about how to protect personal data especially with the upcoming EU Data Protection Regulation that requires Privacy by Design. But still there was no independent description of privacy risks specifically for web applications available. Thus, companies lack guidance to identify and avoid privacy risks during systems development. Therefore the OWASP Top 10 Privacy Risks project developed a list of the top 10 privacy risks in web applications. The project covers technical and organizational aspects like missing encryption or insufficient transparency and results and practical countermeasures are presented in this session.

LangSec meets State Machines

Language-theoretic Security, or LangSec for short, provides useful insights into the root causes of an important class security flaws - namely flaws in handling input - and ways to avoid these. This talk will discuss the core ideas of LangSec and the relation with security research we have done at over the years, where we used state machines as a means to systematically investigate GSM, bank cards, internet banking tokens, and TLS.

The Tales of a Bug Bounty Hunter

Bug bounty hunting is the new black! During this technical talk, several interesting vulnerabilities identified in Instagram, the increasingly-popular photo-based social media platform, will be presented.
All vulnerabilities were disclosed responsibly via Facebook’s Public Bug Bounty program over the course of 2015 and 2016, and will be discussed in detail. Required advanced Mobile Security attack techniques for this Research, such as Binary Modification, Dynamic Hooking and Burp Suite Plugin Development will be covered, among other trickery.
The most interesting vulnerabilities were hybrid: Combinations of complementary vulnerabilities in different environments (e.g. Web and Mobile). All identified issues’ root causes will be mapped onto the Software Development Life Cycle (SDLC), to analyze where they could have been prevented from materializing. Last but not least, the monetary rewards offered by Facebook for each vulnerability and general Bug Bounty Hunting advice will be shared with the community.

OWASP Security Knowledge Framework

Over 10 years of experience in web application security bundled into a single application.
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team.
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing
you how to prevent hackers gaining access and running exploits on your application.

We will be talking about:

Training your developers in writing secure code
Security support pre-development (Security by design, early feedback of possible security issues)
Security support post-development(Double check your code by means of the OWASP ASVS checklists )
Code examples for secure coding

Challenges in Android Malware Detection

What is the state of Malware detection for Android? This talk will present a landscape of Android Malware and techniques used to (try and) detect Malware, with a focus on the limitations of the state-of-the-art detection methods.

Serial Killer: Silently Pwning your Java Endpoints

In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees. The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application. The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start. Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process.

Experiences with Paste-Monitoring

Paste platforms like Pastebin.com provide the possibility to store and share text online. Often this kind of services are used by programmers but also abused by attackers to present their achievements. CIRCL acts as a fire brigade and monitor several of those paste platforms to early detect potential incidents and help the victims. The findings vary from lists of vulnerable or compromised websites, leaked credentials, database dumps, opportunistic announcements, stolen credit card details and many more. We will present the used techniques, and some key experiences with the findings and introduce the AIL framework - Framework for Analysis of Information Leaks. AIL is designed to analyse unstructured data and identify potential data leaks.

Speakers

Julie Gommes

Julie Gommes is a cybersecurity contractor, working in Paris on risk analysis, Security gap analysis, Security in project management, Audit, CISO support. She is also trainer for exposed professionals (journalists, lawyers, HR, employees of NGOs ...). https://fr.linkedin.com/in/juliegommes; Twitter : @JujuSete

Stefan Burgmair

Stefan Burgmair is a German security and privacy consultant at msg systems in Munich. He wrote his Master Thesis in information systems and management about the “Top 10 Privacy Risks for Web Applications” and continues to deliver key content for the project.

Erik Poll

Erik is Associate Professor in the Digital Security group of the Radboud University in Nijmegen. His research interests include smart cards, security protocols, the security of payment systems and smart grids, and formal methods that can improve security by providing a rigorous basis for design, analysis, andtesting.

Arne Swinnen

Arne Swinnen is an IT Security Consultant at NVISO, a Belgian Cyber Security Consulting firm. Arne specializes in Application Security and Digital Forensics. He co-organized the first edition of the Cyber Security Challenge Belgium in 2015, a National cyber security competition designed exclusively for Belgian students.
Arne was a speaker at Black Hat USA and BruCON in 2014, presenting novel anti-virus detection and evasion techniques (“One Packer to Rule Them All”). Since 2015, he is also listed on Facebook’s Bug Bounty Half of Fame.

Glenn Ten Cate

As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security.
His goal is to create an open-source software development life cycle with the tools and knowledge gathered over the years.

Riccardo Ten Cate

As a developer and penetration tester Riccardo specialises in web-application security and
has extensive knowledge in securing web applications in multiple coding languages.

Kevin Allix

After a Master degree obtained in 2007, Kevin Allix held operational positions for four years during which he deployed and ran network security equipments for dozens of customers, and built tools to help administrate one of the biggest french Video-on-Demand platform. In 2011, he joined the University of Luxembourg to start a PhD at the 'Centre for Security, Reliability and Trust'. He is now a Research Associate at SnT - uni.lu where he keeps focusing on Android malware detection.

Christian Schneider

Christian Schneider (@cschneider4711) writes software since the nineties, works as a freelance software developer since 1997, focuses on Java since 1999 and on IT-Security - especially Pentesting - since 2005. He enjoys writing articles about web application security as well as speaks and trains at conferences (OWASP AppSecEU, JAX, WJAX, WebTechCon, DevOpsCon, HackPra, RSA). He blogs at Christian-Schneider.net

Alvaro Muñoz

Alvaro Muñoz (@pwntester) works as Principal Security Researcher with HPE Security Fortify. He enjoys researching different programming languages and web application frameworks for vulnerabilities and unsafe APIs. Before joining the HPE research team, he worked as an Application Security Consultant helping enterprises to start and improve their application security programs. He blogs at pwntester.com

Michael Hamm

Works since 2000 in the field of security and since 2010 as CIRCL Operator.

Hosted and co-organized by