Belgium Events 2012

These are the 2012 events of the OWASP Belgium Chapter.

Previous year: 2011. Next year: 2013.

Previous Meeting (26th of September 2012) in Ghent

WHEN

26th of September 2012 (18h00 - 21h00)

WHERE

Hosted by PWC.

Co-organized with the ISSA (Information Systems Security Association)

Address:
PWC Ghent (Wilson) - Club
Wilsonplein 5G
B - 9000 GENT

Routemap: http://www.pwc.be/en/map/index.jhtml

Parking facilities at the Ghent South station.

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome
  
• 18h30 - 19h30: Introducing the Smartphone Penetration Testing Framework (by Georgia Weidman, Bulb Security LLC)
  

As smartphones enter the workplace, sharing the network and accessing sensitive data, it is crucial to be able to assess the security posture of these devices in much the same way we perform penetration tests on workstations and servers. However, smartphones have unique attack vectors that are not currently covered by available industry tools. The smartphone penetration testing framework, the result of a DARPA Cyber Fast Track project, aims to provide an open source toolkit that addresses the many facets of assessing the security posture of these devices. We will look at the functionality of the framework including information gathering, exploitation, social engineering, and post exploitation through both a traditional IP network and through the mobile modem, showing how this framework can be leveraged by security teams and penetration testers to gain an understanding of the security posture of the smartphones in an organization. We will also show how to use the framework through a command line console, a graphical user interface, and a smartphone based app. Demonstrations of the framework assessing multiple smartphone platforms will be shown.

Georgia Weidman is a penetration tester, security researcher, and trainer. She holds a Master of Science degree in computer science, secure software engineering, and information security as well as holding CISSP, CEH, NIST 4011, and OSCP certifications. Her work in the field of smartphone exploitation has been featured in print and on television internationally. She has presented her research at conferences around the world including Shmoocon, Hacker Halted, Security Zone, and Bsides. Georgia has delivered highly technical security training for conferences, schools, and corporate clients to excellent reviews. Building on her experience, Georgia recently founded Bulb Security LLC a security consulting firm specializing in security assessments/penetration testing, security training, and research/development. She was awarded a DARPA Cyber Fast Track grant to continue her work in mobile device security.

• 19h30 - 19h45: Break
  
• 19h45 - 20h45: Why your security products suck... (by Joe McCray, StrategicSec)
  

Joe McCray will be demonstrating a series of advanced hacking techniques focused on the areas of IDS/IPS/Web Application Firewall Bypass, SRP bypass and several other ways to defeat popular security mechanisms.

Bring your laptop, and hack with him. Joe will bring a wireless access point and allow the attendees to play with the security products as well.

Let's hack!!!!

• 20h45 - 21h15: Discussion: pentesting, legal aspects (by Steven Wierckx , pstestware)
  

Steven will set the scope, everyone is invited for discussion.

• 21h15 - 21h45: Closing Drink
  

REGISTRATION

Please register via https://owasp-belgium-2012-09-26.eventbrite.com

PRESENTATIONS

The slides are available online!

• Owasp presentation (PDF)
  

• Introducing the Smartphone Penetration Testing Framework (by Georgia Weidman, Bulb Security LLC) - (PPT)
  

• Why your security products suck... (by Joe McCray, StrategicSec) (ZIP)
  

• Pentesting Legal Aspects (Panel discussion by Steven Wierckx, PS Testware) (PPT)
  

COVERAGE

Follow what they say about us...

• ihackforfun.eu
  

Previous Meeting (12th of September 2012) in Leuven

WHEN

12th of September 2012 (18h00 - 21h00)

WHERE

Hosted by Distrinet Research Group (K.U.Leuven).

Co-organized with the IWT-project SPION (security and privacy in online social networks)

Address:
Department of Computer Science (auditorium 00.225)
Celestijnenlaan 200 A
3001 Heverlee

Routemap: http://distrinet.cs.kuleuven.be/about/route/

PROGRAM

Pre-program:

• 14h00 - 18h00: First SPION Technical Workshop
  

Attendees of the OWASP Chapter are kindly invited to join the SPION technical workshop, collocated with the chapter meeting. Participation is free, but registration is mandatory.

The program of this workshop on security and privacy in online social networks can be found at http://people.cs.kuleuven.be/~frank.piessens/TechnicalWorkshop.html

The agenda:

• 18h00 - 19h00: Pizza buffet with SPION demos on the side
  
• 19h00 - 19h15: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
  
• 19h15 - 20h00: You Are What You Include: Remote JavaScript Inclusions (by Steven Van Acker, DistriNet, KU Leuven)
  

JavaScript is used by web developers to enhance the interactivity of their sites, offload work to the users' browsers and improve their sites' responsiveness and user-friendliness, making web pages feel and behave like traditional desktop applications. An important feature of JavaScript, is the ability to combine multiple libraries from local and remote sources into the same page, under the same namespace. While this enables the creation of more advanced web applications, it also allows for a malicious JavaScript provider to steal data from other scripts and from the page itself. Today, when developers include remote JavaScript libraries, they trust that the remote providers will not abuse the power bestowed upon them.

In this talk, we report on a large-scale crawl of more than three million pages of the top 10,000 Alexa sites, and identify the trust relationships of these sites with their library providers. We also identify four, previously unknown, types of vulnerabilities that attackers could use to attack popular web sites. Lastly, we review some proposed ways of protecting a web application from malicious remote scripts and show that some of them may not be as effective as previously thought.

Steven Van Acker is PhD student at DistriNet (KU Leuven). As web application security researcher, he studies among others secure containment solutions for untrusted JavaScript, and conducts large scale security assessments across the Internet. He also actively creates and maintains wargames at OverTheWire.org and HackitoErgoSum.org CTFs.

• 20h00 - 20h15: Break
  
• 20h15 - 21h00: Modern Information Gathering (by Dave van Stein, KZA bv)
  

Nowadays sharing information is becoming normal and hackers use this to their advantage. This talk will try to provide insight in the amount of information that anonymous attackers can retrieve about your systems (and users) by showing some of the possibilities of tools freely available.

Dave van Stein is a security consultant at KZA bv. He has more than 11 years of experience in software and acceptance testing and started specializing in Web Application Security in the beginning of 2008. Over the years Dave has gained experience with many open source and commercial testing tools. Dave is active in the Dutch OWASP chapter and he is both ISEB/ISTQB-certified and EC-Council 'Certified Ethical Hacker'.

REGISTRATION

Please register via http://owasp-belgium-2012-09-12.eventbrite.com/

PRESENTATIONS

The slides are available online!

• Owasp update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board) (ppt)
  

• You Are What You Include: Remote JavaScript Inclusions (by Steven Van Acker, DistriNet, KU Leuven) (ppt)
  

• Modern Information Gathering (by Dave van Stein, KZA bv) (pdf)
  

COVERAGE

Follow what they say about us...

• /dev/random blog
  
• Erik Vanderhasselt's blog
  

Previous Meeting (6th of March 2012) in Leuven

WHEN

6th of March 2012 18h-21h00

WHERE

Hosted by Distrinet Research Group (K.U.Leuven).

Co-organized with SecAppDev 2012

Address:
Department of Computer Science (auditorium 00.225)
Celestijnenlaan 200 A
3001 Heverlee

Routemap: http://distrinet.cs.kuleuven.be/about/route/

PROGRAM

The agenda:

• 18h00 - 18h45: Welcome & Pizzas
  
• 18h45 - 19h00: OWASP Update (PPT) (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
  
• 19h00 - 20h00: Common iOS Pitfalls vs. OWASP's iGoat (PPT) (by Ken van Wyk, KRvW Associates)
  

In this session, Ken will spotlight and demonstrate several security "gotchas" in Apple's iOS platform (iPhone and iPad). He'll then introduce the OWASP iGoat tool and demonstrate how it can be used (and extended) to help train iOS coders. Like the other OWASP *Goat tools, iGoat is a great learning platform that can help iOS developers internalize the big issues they face in building bulletproof apps. Ken is the project leader for iGoat, and we're always looking for contributors.

Kenneth R. van Wyk is an internationally recognized information security expert and author of the O’Reilly and Associates books, Incident Response and Secure Coding. Ken provides consulting and training services through his company, KRvW Associates, LLC (http://www.KRvW.com). Ken has 22 years experience as an IT Security practitioner in the academic, military, and commercial sectors. He has held senior and executive technologist positions at Tekmark, Para-Protect, Science Applications International Corporation (SAIC), the U.S. Department of Defense, Carnegie Mellon University, and Lehigh University.

• 20h00 - 20h15: Break
  
• 20h15 - 21h15: Access Control Design Best Practices (PPT) (by Jim Manico, WhiteHat Security)
  

Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.

Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. Jim is a participant and project manager of the OWASP Developer Cheatsheet series. He is also the producer and host of the OWASP Podcast Series.

REGISTRATION

Please register via http://owasp-belgium-2012-03-06.eventbrite.com/

Previous Meeting (25th of January 2012) in Brussels

WHEN

25th of January 2012 18h-21h00

WHERE

Location is sponsored by Cisco Belgium.

Location: Cisco, Pegasus Park, De Kleetlaan, 6A, B-1831 Diegem. See directions.

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome & Sandwiches
  
• 18h30 - 18h45: OWASP Update (ppt) (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
  
• 18h45 - 19h45: devops, secops, devsec or *ops ? A gentle introduction to Devops(pdf) (by Kris Buytaert, Inuits)
  

This talk will summarize the different ideas behind devops, and will show that this goes beyond tooling and becomes a way of thinking, where ultimately everybody will stand together to support the business.

Some call this phenomenon devops, others hate the word and want to call it *ops or ops* , truth is that agile techniques used in development have an impact on the way operations organizes it work. Similar, operations and sysadmins are becoming programmers because of the virtualization and automation trend where everything is managed through an API. And security is imvolved everywhere.

Kris Buytaert is a long time Linux and Open Source Consultant. He's one of instigators of the devops movement, currently working for Inuits. Kris is the Co-Author of Virtualization with Xen, used to be the maintainer of the openMosix HOWTO and author of different technical publications. He is frequently speaking at, or organizing different international conferences. He spends most of his time working on Linux Clustering (both High Availability, Scalability and HPC), Virtualisation and Large Infrastructure Management projects hence trying to build infrastructures that can survive the 10th floor test, better known today as the cloud while actively promoting the devops idea ! His blog titled "Everything is a Freaking DNS Problem" can be found at http://www.krisbuytaert.be/blog/

• 19h45 - 20h00: Break
  
• 20h00 - 21h00: Hardening web applications against malware attacks (ppt) (by Erwin Geirnaert, Zion Security)
  

During this presentation we give an overview of how we can harden web applications against different types of attacks used by malware to bypass the existing security controls in the web application. We discuss the OWASP Top 10 and how malware can abuse these attacks and how the developer must implement a different strategy. We explain why (mobile) browser security is an important aspect of web application hardening and most importantly that the battle against malware is an ongoing battle. For every countermeasure the security industry develops to protect web applications and is used by a lot of companies today we will show how malware is being developed to bypass these solutions. To finalize we give some advice on how to protect against these malware attacks, using pro-active and detective controls.

Erwin Geirnaert founded ZION SECURITY in 2005 to help companies to protect against the latest threats, attacks against web applications. ZION SECURITY is nowadays a Belgian market leader in the field of security testing, vulnerability management, penetration testing and banking security. Erwin has more than 10 years of experience in web security, graduating with a Master of Science in Software Development from the University of Ghent. Erwin executes different types of projects for a lot of international software companies, financial institutions, telecom and web agencies. Specialist in executing code reviews in different development languages for critical applications, executing continuous penetration tests of their infrastructure and Internet applications. A specialist in J2EE security, .NET security and web services security. Erwin architects secure e-business projects for web agencies and software companies. He is a recognized application security expert and speaker at international events like Javapolis, OWASP, Eurostar.