Lonestar Application Security Conference 2010 - Revision history

Jsokol at 23:59, 14 December 2010

2010-12-14T23:59:58Z

Jsokol at 23:57, 14 December 2010

2010-12-14T23:57:21Z

Jsokol at 23:55, 14 December 2010

2010-12-14T23:55:12Z

Jsokol at 23:53, 14 December 2010

2010-12-14T23:53:35Z

Jsokol at 23:51, 14 December 2010

2010-12-14T23:51:54Z

Jsokol at 23:49, 14 December 2010

2010-12-14T23:49:46Z

Jsokol at 20:24, 18 November 2010

2010-11-18T20:24:27Z

Jsokol at 20:21, 18 November 2010

2010-11-18T20:21:10Z

Jsokol at 18:47, 2 November 2010

2010-11-02T18:47:31Z

Jsokol at 18:15, 2 November 2010

2010-11-02T18:15:23Z

@@ Line 116: / Line 116: @@
 '''<font color=red>Robert Hansen and Josh Sokol</font>'''<br>
 '''<font color=brown>HTTPS Can Byte Me</font>'''<br>
 <br>
 HTTPS was created to protect confidentiality and prove integrity of content passed over the web. It has essentially become the de-facto standard for internet commerce transport security. Over the years a number of exploits have attacked the principle, underlying PKI infrastructure and overall design of HTTPS. This presentation will drive another nail in the HTTPS coffin through a number of new exploitation techniques leveraging man-in-the-middle attacks; the goal of which is to break confidentiality and integrity of HTTPS traffic. The impact of these flaws suggests a need for changes in the ways we protect the transmission of data online.<br>
@@ Line 121: / Line 122: @@
 '''<font color=red>Samy Kamkar</font>'''<br>
 '''<font color=brown>[http://www.owasp.org/images/6/61/LASCON2010_Kamkar.pdf How I Met Your Girlfriend]</font>'''<br>
 <br>
 How I Met Your Girlfriend: The discovery and execution of entirely new classes of attacks executed from the Web in order to meet your girlfriend. This includes newly discovered attacks inclduing HTML5 client-side XSS (without XSS hitting the server!), PHP session hijacking and weak random numbers (accurately guessing PHP session cookies), browser protocol confusion (turning a browser into an SMTP server), firewall and NAT penetration via Javascript (turning your router against you), remote iPhone Google Maps hijacking (iPhone penetration combined with HTTP man-in-the-middle), extracting extremely accurate geolocation information from a Web browser (not using IP geolocation), and more.<br>

@@ Line 95: / Line 95: @@
 == Keynote ==
 '''<font color=red>Matt Tesauro</font>'''<br>
 '''Video:''' [http://vimeo.com/17822489 Link]<br>
+<br>
 == Technical Track ==
 '''<font color=red>James Flom</font>'''<br>
@@ Line 132: / Line 133: @@
 '''<font color=red>Joe Jarzombek</font>'''<br>
 '''<font color=brown>Mitigating Business Risks with Application Security</font>'''<br>
 <br>
 With today’s global IT software supply chain, project management and software/systems engineering processes must explicitly address security risks posed by exploitable software.  Traditionally, these disciplines have not clearly and directly focused on software security risks that can be passed from projects to the organization.  Software security assurance processes and practices span development and acquisition and can be used to enhance project management and quality assurance activities.  Mr. Jarzombek explains the critical need for adherence to the practices, guidelines, rules, and principles used to build security into every phase of software development.<br>
@@ Line 137: / Line 139: @@
 '''<font color=red>Michael Howard</font>'''<br>
 '''<font color=brown>Everything useful I learned about software security, I learned at Microsoft!</font>'''<br>
 <br>
 In this talk, Michael will discuss some of the things he has learned over the last 10 years working on software security at Microsoft. The Wins. The Losses, but most importantly, the Wisdom learned!<br>

← Older revision		Revision as of 23:55, 14 December 2010
Line 92:		Line 92:

	==== Sessions ====		==== Sessions ====
		+
		+	== Keynote ==
		+	'''<font color=red>Matt Tesauro</font>'''<br>
		+	'''Video:''' [http://vimeo.com/17822489 Link]<br>

	== Technical Track ==		== Technical Track ==

@@ Line 3: / Line 3: @@
 [[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]]
 ===== SAVE THE DATE: LASCON 2011 is happening on October 28th, 2011 in Austin, TX =====
@@ Line 11: / Line 12: @@
 ==== Welcome  ====
 {| style="width: 100%;"

← Older revision		Revision as of 23:51, 14 December 2010
Line 11:		Line 11:

	==== Welcome ====		==== Welcome ====
		+
		+	Please see the Sessions page for the Powerpoints and Videos from LASCON 2010.

	{\| style="width: 100%;"		{\| style="width: 100%;"

← Older revision		Revision as of 23:49, 14 December 2010
Line 4:		Line 4:


−	===== LASCON is happening on October ~~29th~~, ~~2010~~ in Austin, TX =====	+	===== SAVE THE DATE: LASCON 2011 is happening on October 28th, 2011 in Austin, TX =====

	[http://guest.cvent.com/d/vdqf7g/4W Registration Link] \| Speaker List Posted! \| [http://twitter.com/LASCONATX Follow LASCONATX on Twitter] \| [http://www.norriscenters.com/Austin/ Norris Conference Center]		[http://guest.cvent.com/d/vdqf7g/4W Registration Link] \| Speaker List Posted! \| [http://twitter.com/LASCONATX Follow LASCONATX on Twitter] \| [http://www.norriscenters.com/Austin/ Norris Conference Center]

@@ Line 157: / Line 157: @@
 This presentation will illustrate ways to improve web security assessments by using advanced features in OWASP Webscarab and extending your options with automation using Python.<br>
 <br>
-'''<font color=red>Noa Bar-yosef, Rob Rachwald, and Amichai Shulman</font>'''<br>
+'''<font color=red>Noa Bar-yosef</font>'''<br>
-'''<font color=brown>Tell Me Your IP and I Will Tell You Who You Are</font>'''<br>
+'''<font color=brown>[http://www.owasp.org/images/7/7f/LASCON2010_BarYosef.pdf Tell Me Your IP and I Will Tell You Who You Are]</font>'''<br>
 <br>
 IP addresses have been traditionally considered an unreliable method for attack detection. The unreliability is attributed to the use of web proxies, NAT       and non-static IP addresses for end-stations. This session will demonstrate how information derived from IP addresses can in fact be used to dramatically       improve attack detection capabilities. The presentation will discuss attributes such as Geo Location, Reverse DNS Lookup, Anonymous Proxy lists and more. We    discuss how IP intelligence can be used to increase detection effectiveness (ratio of false positives to false negatives) by "ruling" on otherwise      indecisive anomalies. We also discuss certain scenarios in which IP intelligence is crucial for even detecting anomalies. The presentation is supported by corroborative evidence derived from actual log data and demonstrates some of the tools that can be used for analysis.<br>
@@ Line 208: / Line 208: @@
 <br>
 '''<font color=red>Pete Perfetti</font>''' has been working in information security for fifteen years. He has been involved in IT Security for the financial services  industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of  experience in both operations and security. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br>
 <br>
 '''<font color=red>Charlie Scott</font>''', CISSP, GSEC, GCIH, GCPM, has worked in information security for over ten years.  He joined the UT Austin Information Security Office as a Sr. Information Security Analyst in 2006, after working for the City of Austin and several Internet data centers.  He has a strong background in network and system security, and finds application security fun and challenging-especially in a distributed campus environment.  Charlie is currently pursuing his MS in Information Security Engineering.<br>
 <br>
 '''<font color=red>Josh Sokol</font>''', CISSP graduated from the University of Texas at Austin with a BS in Computer Science in 2002.  Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as the Information Security Program Owner at National Instruments.  In his current role, Josh manages all compliance, security architecture, risk management, and vulnerability management activies for NI.<br>

@@ Line 153: / Line 153: @@
 <br>
 '''<font color=red>Brad Causey</font>'''<br>
-'''<font color=brown>Automating Web Testing Beyond OWASP Webscarab Using Python</font>'''<br>
+'''<font color=brown>[http://www.owasp.org/images/5/55/LASCON2010_Causey.ppt Automating Web Testing Beyond OWASP Webscarab Using Python] ([http://www.owasp.org/images/3/33/LASCON2010_Causey_Python_files.zip Python Files])</font>'''<br>
 <br>
 This presentation will illustrate ways to improve web security assessments by using advanced features in OWASP Webscarab and extending your options with automation using Python.<br>

@@ Line 148: / Line 148: @@
 == OWASP Etc Track ==
 '''<font color=red>Dean Bushmiller</font>'''<br>
-'''<font color=brown>OWASP Top 10: What is it all about?</font>'''<br>
+'''<font color=brown>[http://www.owasp.org/images/6/63/LASCON2010_Bushmiller.pdf OWASP Top 10: What is it all about?]</font>'''<br>
 <br>
 Everyone knows exactly what the OWASP top ten security threats are, right? Well sort of... I ask people if they have heard of the top ten they say yes. I ask them to name a few they pause, then they blurt out 2-3. Then I ask them to explain those 2-3 and they look at me like a deer-in-the-headlights. I want to make sure that everyone who walks out of the presentation can clearly define the top ten and be able to communicate to another what each of the top ten vulnerabilites are.<br>

@@ Line 104: / Line 104: @@
 <br>
 '''<font color=red>Chris Eng</font>'''<br>
-'''<font color=brown>Deconstructing ColdFusion</font>'''<br>
+'''<font color=brown>[http://www.owasp.org/images/0/05/LASCON2010_Eng.pdf Deconstructing ColdFusion]</font>'''<br>
 <br>
 ColdFusion is a somewhat forgotten but still very prevalent web application development platform. This presentation is a technical survey of ColdFusion security that will be of interest mostly to code auditors, penetration testers, and developers.  In the talk, we'll cover the history of the ColdFusion platform and its relevance to today's security landscape.   We'll describe basics of ColdFusion markup, control flow, functions, and components and demonstrate how to identify common web application vulnerabilities in the source code. We'll also delve into ColdFusion J2EE internals, showing what CFML pages and components look like when compiled down to Java, and describing some of the unusual behavior we've observed at that level. We'll discuss open-source tools to aid reverse engineers in working with ColdFusion's proprietary classfile format.<br>