AppSec Israel 2016 Presentations - Revision history

Avi Douglen: /* The Unwanted Sons - Formalizing and Demonstrating WAF Bypass Methods for the REST of the Top 10 */

2016-10-18T06:57:35Z

‎The Unwanted Sons - Formalizing and Demonstrating WAF Bypass Methods for the REST of the Top 10

Avi Douglen: /* The Dark Side of Search Engine Optimization */

2016-10-02T08:17:10Z

‎The Dark Side of Search Engine Optimization

Avi Douglen: added more slidedecks

2016-09-29T08:29:20Z

added more slidedecks

Avi Douglen: Added presentations

2016-09-27T08:07:48Z

Added presentations

Avi Douglen at 13:10, 16 September 2016

2016-09-16T13:10:07Z

Avi Douglen: /* Java Hurdling: Obstacles and Techniques in Java Client Penetration-testing */

2016-09-16T13:07:01Z

‎Java Hurdling: Obstacles and Techniques in Java Client Penetration-testing

Avi Douglen: /* Hacking RF based IoT Systems */

2016-09-13T13:33:57Z

‎Hacking RF based IoT Systems

Avi Douglen: /* The Ways Hackers Are Taking To Win The Mobile Malware Battle */

2016-09-07T06:08:25Z

‎The Ways Hackers Are Taking To Win The Mobile Malware Battle

Avi Douglen at 12:11, 5 September 2016

2016-09-05T12:11:24Z

Avi Douglen: /* Could a few lines of code it all up?? */

2016-09-04T15:54:13Z

‎Could a few lines of code it all up??

@@ Line 326: / Line 326: @@
 '''צאצאים לא רצויים - פירמול לטכניקות חדשות למעקף WAF לשאר ההתקפות הנפוצות של OWASP TOP 10''' <br />
 ''''' Shay Chen, CEO, Effective Security '''''    <br />
 The once uncommon application-level protection mechanisms are EVERYWHERE these days, and sooner or later, you'll have to face them.

@@ Line 288: / Line 288: @@
 '''הצד האפל של קידום אתרים במנועי חיפוש''' <br />
 ''''' Or Katz, Principal Security Researcher, Akamai  '''''    <br />
 Search engines optimization (SEO) is a technique being used by web sites owners in order to improve visibility and traffic to their web site. Legitimate SEO activity will use optimization techniques such as: changing structure and textual usage of the web site pages, publication in social media and web forums that will referrer relevant users.

@@ Line 65: / Line 65: @@
 '''איך להרוס HTTPS עם PAC"ל חבלה''' <br />
 ''''' Amit Klein, VP Security Research, SafeBreach '''''    <br />
 You're in a potentially malicious network (free WiFi, guest network, or maybe your own corporate LAN). You're a security conscious netizen so you restrict yourself to HTTPS (browsing to HSTS sites and/or using a "Force TLS/SSL" browser extension). All your traffic is protected from the first byte. Or is it?
@@ Line 223: / Line 225: @@
 === NodeJS Security Done Right - The tips and tricks they won’t teach you in school  ===
 ''''' Liran Tal, R&D Team Leader, Hewlett Packard Enterprise '''''    <br />
 NodeJS, and JavaScript at large are quickly taking over software whether it is GitHub’s statistics for projects growth, the IoT industry, ChatOps projects written in JavaScript and Enterprises adoption is growing as well.
@@ Line 304: / Line 308: @@
 '''האיום של התקפות Cross-Site Search מתקדמות''' <br />
 ''''' Dr. Nethanel Gelernter, Cyberpion & The College of Management Academic Studies '''''    <br />
 Cross-site search (XS-search) is a practical timing side-channel attack that allows the extraction of sensitive information from web-services. The attack exploits inflation techniques to efficiently distinguish between search requests that yield results and requests that do not. This work focuses on the response inflation technique that increases the size of the response; as the difference in the sizes of the responses increases, it becomes easier to distinguish between them. We begin with browser-based XS-search attack and demonstrate its use in extracting users' private data from Gmail and Facebook. The browser-based XS-search attack exploits the differences in the sizes of HTTP responses, and works even when significant inflation of the response is impossible. This part also involves algorithmic improvements compared to previous work. When there is no leakage of information via the timing side channel it is possible to use second-order (SO) XS-search, a novel type of attack that allows the attacker to significantly increase the difference in the sizes of the responses by planting maliciously crafted record into the storage. SO XS-search attacks can be used to extract sensitive information such as email content of Gmail and Yahoo! users, and search history of Bing users.

@@ Line 3: / Line 3: @@
 The [https://appsecil2016.sched.org/ full schedule can be found and subscribed to here].
 __TOC__
@@ Line 32: / Line 34: @@
 ''''' Amit Ashbel, Director of Product Marketing & Cyber Security Evangelist, Checkmarx '''''    <br />
 ''''' Erez Yalon, Application Security Lead, Checkmarx '''''    <br />
 March 2016. An anonymous open source developer decides to remove his code (left-pad) from a public repository.
@@ Line 76: / Line 80: @@
 === Don't Feed the Hippos! ===
 ''''' Martin Knobloch, Principal Consultant, Nixu '''''    <br />
 The security community is trying to solve insecurity caused by bugs and flaws in software for many years now, but with what success?
@@ Line 127: / Line 133: @@
 '''האקינג של מערכות IoT מבוססות RF''' <br />
 ''''' Erez Metula, Application Security Expert, AppSec Labs (Founder) '''''    <br />
 We often encounter IoT (Internet of Things) systems during our work as penetration testers and security consultants. We know how to assess the security of the server side API, the associated mobile apps, the web apps and so on - but what about the device itself (the "thing")? Moreover, what happens if the device is not using traditional HTTP/S request, or does not even "speak" plain old TCP/IP?
@@ Line 151: / Line 159: @@
 ''''' Elena Kravchenko, ADM BU Security Lead, Security & Trust Office, HPE Software '''''    <br />
 ''''' Efrat Wasserman, ADM Senior Program manager, SRL, HPE Software ''''' <br/>
 There are many different security development lifecycles (SDLC) frameworks in the modern world. However, a fully implemented SDLC program is often represented as heavy, time-consuming and not suitable to Agile development methodology. We’d like to break the myth and show how a very comprehensive security program, managed by a dedicated security office, can be successfully integrated in agile development project on a real case example.
@@ Line 189: / Line 198: @@
 === Java Hurdling: Obstacles and Techniques in Java Client Penetration-testing ===
 ''''' Tal Melamed, Technical Leader, AppSec Labs '''''    <br />
 Testing Java client applications is not always straightforward as testing web applications. Even under experienced hands, there might be obstacles coming your way; what if you cannot use a proxy? How do you MitM? What if you just can't? How do you modify the app to your benefit?
@@ Line 241: / Line 252: @@
 === Putting the "I" in Code Review - Turning Code Review Interactive ===
-''''' Tamir Shavro,	Seeker R&D Manager, Synopsys '''''    <br />
+''''' Tamir Shavro, Seeker R&D Manager, Synopsys '''''    <br />
 Everybody knows that manual code review can be a tedious and lengthy effort, with complexity growing exponentially with the size of the code. However, understanding code flow and focusing on relevant parts can become much easier when employing interactive debugging techniques. This allows combining the best of penetration testing and code review benefits to achieve maximum results in the most efficient manner. In this talk we will explain and demonstrate this eye-opening technique for effectively performing a manual code review on a live system using a debugger and provide a quick starter kit for implementing this technique.
@@ Line 330: / Line 343: @@
 === The Ways Hackers Are Taking To Win The Mobile Malware Battle ===
 ''''' Yair Amit, CTO & Co-founder, Skycure '''''    <br />
 In the proverbial game of cat-and-mouse between endpoint security vendors and malware writers, malware attacks have recently grown more sophisticated. More enterprises are losing ground to hackers, who are able to outmaneuver static and runtime solutions by constantly changing their attack strategies. The team that uncovered iOS malicious profiles, WiFiGate, HTTP Request Hijacking, No iOS Zone and Invisible Profiles are taking it upon themselves to coach developers and organizations on how to regain control, and turn the tables on the hackers behind next-generation mobile malware.

@@ Line 25: / Line 25: @@
 <br><u>Technical Level:</u> Intermediate / Advanced
-<br><u>Language:</u> Hebrew, English
+<br><u>Language:</u> Hebrew
 <br>
@@ Line 54: / Line 54: @@
 <br><u>Technical Level:</u> Introduction
-<br><u>Language:</u> English
+<br><u>Language:</u> Hebrew
 <br>
@@ Line 144: / Line 144: @@
 <br><u>Technical Level:</u> Advanced
-<br><u>Language:</u> Hebrew, English
+<br><u>Language:</u> Hebrew
 <br>
@@ Line 236: / Line 236: @@
 <br><u>Technical Level:</u> Introduction
-<br><u>Language:</u> Hebrew, English
+<br><u>Language:</u> Hebrew
 <br>
@@ Line 251: / Line 251: @@
 <br><u>Technical Level:</u> Advanced
-<br><u>Language:</u> Hebrew, English
+<br><u>Language:</u> Hebrew
 <br>
@@ Line 264: / Line 264: @@
 <br><u>Technical Level:</u> Intermediate
-<br><u>Language:</u> Hebrew, English
+<br><u>Language:</u> Hebrew
 <br>

@@ Line 189: / Line 189: @@
 === Java Hurdling: Obstacles and Techniques in Java Client Penetration-testing ===
 ''''' Tal Melamed, Technical Leader, AppSec Labs '''''    <br />
-Testing Client applications is not always straightforward as testing web applications. There might be obstacles coming your way: what is the communication protocol? how do you MitM? how do you modify code? and many more.
+Testing Java client applications is not always straightforward as testing web applications. Even under experienced hands, there might be obstacles coming your way; what if you cannot use a proxy? How do you MitM? What if you just can't? How do you modify the app to your benefit?
-Fortunately, Java is still Java. This lecture will follow the events of a real case of pen-testing a Java client application ; what tools and techniques can be used in order to overcome hurdles, all the way to the finish line.
+Fortunately, Java is still Java. This lecture is based on a true story, and will follow an interesting case of pen-testing a known product; what tools and techniques can be used in order to jump over hurdles, all the way to the finish line.
-The lecture aims to enrich the pentester's toolbox as well as mind, when facing a Java Client Application; MitM-ing, Patching and Run-time manipulations are only some of the discussed cases.
+The lecture aims to enrich the pentester's toolbox as well as mind, when facing Java client applications; MitM-ing, run-time manipulations and patching the code are only some of the discussed cases.
 <br><u>Speaker Bio</u>
@@ Line 204: / Line 206: @@
 <br><u>Technical Level:</u> Intermediate / Advanced
-<br><u>Language:</u> Hebrew, English
+<br><u>Language:</u> Hebrew
 <br>

@@ Line 124: / Line 124: @@
 <br>
-=== Hacking RF based IoT Systems ===
+=== Hacking The IoT (Internet of Things) - PenTesting RF Operated Devices ===
 '''האקינג של מערכות IoT מבוססות RF''' <br />
 ''''' Erez Metula, Application Security Expert, AppSec Labs (Founder) '''''    <br />

@@ Line 31: / Line 31: @@
 === Could a few lines of code <F!#ck> it all up?? ===
 ''''' Amit Ashbel, Director of Product Marketing & Cyber Security Evangelist, Checkmarx '''''    <br />
 March 2016. An anonymous open source developer decides to remove his code (left-pad) from a public repository.
@@ Line 47: / Line 48: @@
 Amit has been with the security community for more than a decade where he has taken on multiple tasks and responsibilities, including technical and Senior Product lead positions. Amit adds valuable product knowledge including experience with a wide range of security platforms and familiarity with emerging threats. Amit also speaks at high profile events and conferences such as BlackHat, Defcon, OWASP and others.
 <br><u>Technical Level:</u> Introduction