FROC2010 Abstract Zusman - Revision history

Dc at 20:49, 12 May 2010

2010-05-12T20:49:12Z

Dc at 22:36, 7 May 2010

2010-05-07T22:36:49Z

Dc at 22:31, 7 May 2010

2010-05-07T22:31:45Z

Dc: ssl mitm abstract & bios

2010-05-07T22:29:06Z

ssl mitm abstract & bios

New page

==The Presentation: " Advanced MITM Techniques for Security Testers"==

HTTP proxies such as WebScarab, Paros, and Burp make it easy to inspect and intercept normal web application traffic. But what can you do when your web application isn't "normal"? Maybe the client is not a standard web browser with configurable proxy settings. Maybe an ActiveX object is used to send non-HTTP traffic. Perhaps the application can't even be installed on a personal computer, but instead resides on a mobile or embedded device. In these situations, having the right proxy tools and a computer running Linux can be the difference between zero vulnerability findings and uncovering critical design flaws in a short period of time.

This presentation will cover advanced "man in the middle" techniques that can be used to intercept any TCP stream (including those protected with SSL/TLS) using a new transparent TCP proxy developed by Intrepidus Group. These techniques can be used to uncover server and client side bugs that might otherwise go unnoticed without a lengthy reverse engineering project. In addition to discussing tools and techniques, this presentation will also discuss real world programming flaws and vulnerabilities they've been used to uncover.

==The Speakers==

===Rajendra Umadas===

Rajendra Umadas is a Consultant with the Intrepidus Group. Mr. Umadas recently graduated Summa Cum-Laude from The Polytechnic Institute of NYU with a BS in Computer Engineering. At NYU:Poly, Mr. Umadas pursued a highly expansive computer security curriculum. He is just as comfortable sniffing out a memory corruption bug as he is assessing the risk management decisions of large projects.

Coupled with Mr. Umadas' fresh academic outlook on security, he obtained a no-nonsense business sense of security while working in an Information Risk Management arm of a large investment bank. Corporate governance, segregation of duties, and SOX compliance were all daily concerns for Mr. Umadas.

Mr. Umadas is eager to establish his own niche in the security world where he will be the catalyst of some very major innovation. With his strong academics, proven real world experience, and never-say-no attitude; it is only a matter of time.

===Aaron Rhodes===

Aaron is a Principal Consultant with the Intrepidus Group, specializing in network and application penetration testing. Over the past 8 years, Aaron has served clients in the finance, insurance, telecommunications, energy, medical and retail environments.

Prior to joining Intrepidus Group, Aaron served as a Technical Lead in Symantec's consulting service group (formerly @Stake), providing security assessments and actionable recommendations to Symantec's customers. Aaron has also led security engineering teams servicing large government networks, developed software for intrusion detection, and served as part of US Air Force Information Warfare Aggressor Teams conducting red team exercises.

[[http://www.owasp.org/index.php/Front_Range_OWASP_Conference_2010#tab=Agenda|Back to Conference Agenda]]

← Older revision		Revision as of 20:49, 12 May 2010
Line 36:		Line 36:
	the OWASP foundation.		the OWASP foundation.

−	[[Front_Range_OWASP_Conference_2010#tab=Agenda\|Back to Conference Agenda]]	+	[http://www.owasp.org/index.php/Front_Range_OWASP_Conference_2010#tab=Agenda Back to Conference Agenda]

← Older revision		Revision as of 22:36, 7 May 2010
Line 1:		Line 1:
−	==The Presentation: " Advanced MITM Techniques for Security Testers"==	+	==The Presentation: "Advanced MITM Techniques for Security Testers"==

	HTTP proxies such as WebScarab, Paros, and Burp make it easy to inspect and intercept normal web application traffic. But what can you do when your web application isn't "normal"? Maybe the client is not a standard web browser with configurable proxy settings. Maybe an ActiveX object is used to send non-HTTP traffic. Perhaps the application can't even be installed on a personal computer, but instead resides on a mobile or embedded device. In these situations, having the right proxy tools and a computer running Linux can be the difference between zero vulnerability findings and uncovering critical design flaws in a short period of time.		HTTP proxies such as WebScarab, Paros, and Burp make it easy to inspect and intercept normal web application traffic. But what can you do when your web application isn't "normal"? Maybe the client is not a standard web browser with configurable proxy settings. Maybe an ActiveX object is used to send non-HTTP traffic. Perhaps the application can't even be installed on a personal computer, but instead resides on a mobile or embedded device. In these situations, having the right proxy tools and a computer running Linux can be the difference between zero vulnerability findings and uncovering critical design flaws in a short period of time.

← Older revision		Revision as of 22:31, 7 May 2010
Line 21:		Line 21:
	Prior to joining Intrepidus Group, Aaron served as a Technical Lead in Symantec's consulting service group (formerly @Stake), providing security assessments and actionable recommendations to Symantec's customers. Aaron has also led security engineering teams servicing large government networks, developed software for intrusion detection, and served as part of US Air Force Information Warfare Aggressor Teams conducting red team exercises.		Prior to joining Intrepidus Group, Aaron served as a Technical Lead in Symantec's consulting service group (formerly @Stake), providing security assessments and actionable recommendations to Symantec's customers. Aaron has also led security engineering teams servicing large government networks, developed software for intrusion detection, and served as part of US Air Force Information Warfare Aggressor Teams conducting red team exercises.

		+	===Mike Zusman===
		+	Mike Zusman is a Principal Consultant with the Intrepidus Group. Prior
		+	to joining Intrepidus Group, Mike held the positions of Escalation
		+	Engineer at Whale Communications (a Microsoft subsidiary), Security
		+	Program Manager at Automatic Data Processing, and lead architect and
		+	developer at a number of smaller firms. In addition to his corporate
		+	experience, Mike is an independent security researcher, and has
		+	responsibly disclosed a number of critical vulnerabilities to commercial
		+	software vendors. He has spoken at a number of top industry events
		+	including CanSecWest, Defcon, Black Hat and regional OWASP events. Mike
		+	also speaks and teaches about information security at NYU/Polytechnic
		+	University. Mike brings 11 years of security, technology, and business
		+	experience to Intrepidus Group. He is a CISSP and an active member of
		+	the OWASP foundation.

−	[[~~http://www.owasp.org/index.php/~~Front_Range_OWASP_Conference_2010#tab=Agenda\|Back to Conference Agenda]]	+	[[Front_Range_OWASP_Conference_2010#tab=Agenda\|Back to Conference Agenda]]