OWASP Israel 2010 02 - Revision history

Ofer Maor at 12:11, 9 February 2010

2010-02-09T12:11:55Z

Ofer Maor at 22:13, 6 February 2010

2010-02-06T22:13:58Z

Ofer Maor at 22:13, 6 February 2010

2010-02-06T22:13:22Z

Ofer Maor at 22:12, 6 February 2010

2010-02-06T22:12:58Z

Ofer Maor at 22:09, 6 February 2010

2010-02-06T22:09:51Z

Ofer Maor at 22:08, 6 February 2010

2010-02-06T22:08:57Z

Ofer Maor at 22:08, 6 February 2010

2010-02-06T22:08:19Z

Ofer Maor at 22:02, 6 February 2010

2010-02-06T22:02:27Z

Ofer Maor at 22:01, 6 February 2010

2010-02-06T22:01:41Z

Ofer Maor at 22:01, 6 February 2010

2010-02-06T22:01:13Z

@@ Line 21: / Line 21: @@
 '''Ofer Maor, Hacktics'''
-== 17:10 - 17:50&nbsp;: Cloud Security Topics  ==
+== 17:10 - 17:20&nbsp;: Opening Notes  ==
 '''Shalom Carmel, Venera'''
@@ Line 32: / Line 36: @@
 *Regulation in the Cloud - Is It Feasible?
-== 17:50 - 18:25&nbsp;: SaaS as a Security Hazard: The Google Docs Example  ==
+== 18:00 - 18:35&nbsp;: SaaS as a Security Hazard: The Google Docs Example  ==
 '''Ofer Shezaf, Better Place'''
@@ Line 40: / Line 44: @@
 In this presentation we will discuss the security risks unique to SaaS (Software as a service) and some past attacks on such services. We will than dissect the security implications of using Google sites (which includes Google docs and Gmail) as an example for a SaaS. We will go over a checklist of things to examine in a SaaS before subscribing to ensure that it provides sufficient security and will discuss the solutions offered (or not) by Google to the items listed.
-== 18:25 - 19:00&nbsp;: SAML  ==
+== 18:35 - 19:10&nbsp;: SAML  ==
 '''David Movshovitz'''
@@ Line 46: / Line 50: @@
 SAML is one of the protocols that have been developed to secure web services, and has been become very popular especially to implement Web SSO and SaaS SSO. In the lecture we will describe the principals of the protocol and demonstrate how it is used to implement Web SSO.
-== 19:00 - 19:30&nbsp;: XSHM - Cross Site History Manipulation  ==
+== 19:10 - 19:40&nbsp;: XSHM - Cross Site History Manipulation  ==
 '''Alex Roichman, Checkmarx'''

@@ Line 54: / Line 54: @@
 == '''Map'''  ==
-[[File:http://www.owasp.org/images/0/0d/Amdocs_parking_map.png]]
+[[File:Amdocs_parking_map.png]]
 [[Category:Israel]]

@@ Line 54: / Line 54: @@
 == '''Map'''  ==
-[[File:/images/0/0d/Amdocs_parking_map.png]]
+[[File:http://www.owasp.org/images/0/0d/Amdocs_parking_map.png]]
 [[Category:Israel]]

← Older revision		Revision as of 22:12, 6 February 2010
Line 51:		Line 51:

	In this presentation I will introduce a newly discovered SOP (Same Origin Policy) security breach identified as Cross-Site History Manipulation (XSHM). Cross-Site History Manipulation breach is based on our research findings that the client-side browser history object is not properly partitioned on a per-site basis. Manipulating browser history may lead to SOP compromising, allow bi-directional CSRF and other exploitations such as: user privacy violation, login status detection, resource mapping, sensitive information inferring, users' activity tracking and URL parameter stealing. In the presentation I will show how XSHM can be executed, what applications are vulnerable to it, how to detect the flaw and consequently remediate it.'''<u><br></u>'''		In this presentation I will introduce a newly discovered SOP (Same Origin Policy) security breach identified as Cross-Site History Manipulation (XSHM). Cross-Site History Manipulation breach is based on our research findings that the client-side browser history object is not properly partitioned on a per-site basis. Manipulating browser history may lead to SOP compromising, allow bi-directional CSRF and other exploitations such as: user privacy violation, login status detection, resource mapping, sensitive information inferring, users' activity tracking and URL parameter stealing. In the presentation I will show how XSHM can be executed, what applications are vulnerable to it, how to detect the flaw and consequently remediate it.'''<u><br></u>'''
		+
		+
		+	== '''Map''' ==
		+	[[File:/images/0/0d/Amdocs_parking_map.png]]
		+

	[[Category:Israel]]		[[Category:Israel]]

@@ Line 5: / Line 5: @@
 <br>
 The guard at the entrance will have a list of everybody who confirmed.<BR>
 '''You will not be allowed into Amdocs premises without confirming arrival.'''<BR>

@@ Line 3: / Line 3: @@
 Parking can be found at the adjacent unpaved parking lot. Please refer to map at bottom of page.
-'''PLEASE NOTE: YOU MUST CONFIRM YOUR ARRIVAL IN ADVANCE''' <br>
+<br>
 The guard at the entrance will have a list of everybody who confirmed.<BR>
 '''You will not be allowed into Amdocs premises without confirming arrival.'''<BR>

@@ Line 1: / Line 1: @@
-[[Category:Israel]]
+The meeting will be held at 16:45 on Tuesday, Feb 9th, 2010. <br>
-The meeting will be held at 17:00 on Tuesday, Feb 9th, 2010.
+Location: Amdocs Ra'anana, HaPnina St. 8 in Amdocs Auditorium. <br>
-Location: Amdocs Ra'anana, HaPnina St. 8 in Amdocs Auditorium.
+'''Ofer Maor, Hacktics'''
-'''PLEASE NOTE: YOU MUST CONFIRM YOUR ARRIVAL IN ADVANCE'''
+'''Shalom Carmel, Venera'''
-== '''Agenda''' ==
+*Short Introduction to XaaS
-== 16:45 - 17:05 : Gathering, Mingling & Refreshments ==
+== 17:50 - 18:25&nbsp;: SaaS as a Security Hazard: The Google Docs Example  ==
-== 17:05 - 17:10 : Opening Notes ==
+'''Ofer Shezaf, Better Place'''
-== 17:10 - 17:50 : Cloud Security Topics ==
+As the borderline between a web site and an application blurs, so does the division between the enterprise IT and the internet. More and more enterprises adapt core applications which are provided as a service over the Internet. Until recently those where limited to vertical applications such as salesforce.com for sales automation and monster.com for recruiting, both of which have already suffered major security issues that compromises customer data. Google software push has led to enterprise adaption of general purpose cloud services including office tools, mail and knowledge management, which presents an entirely new risk level.
-As more and more services move into the cloud, security of these resources becomes significant. In this lecture Shalom will review various topics relating to cloud security, including:
+In this presentation we will discuss the security risks unique to SaaS (Software as a service) and some past attacks on such services. We will than dissect the security implications of using Google sites (which includes Google docs and Gmail) as an example for a SaaS. We will go over a checklist of things to examine in a SaaS before subscribing to ensure that it provides sufficient security and will discuss the solutions offered (or not) by Google to the items listed.
-== 17:50 - 18:25 : SaaS as a Security Hazard: The Google Docs Example ==
+== 18:25 - 19:00&nbsp;: SAML  ==
-As the borderline between a web site and an application blurs, so does the division between the enterprise IT and the internet. More and more enterprises adapt core applications which are provided as a service over the Internet. Until recently those where limited to vertical applications such as  salesforce.com for sales automation and monster.com for recruiting, both of which have already suffered major security issues that compromises customer data. Google software push has led to enterprise adaption of general purpose cloud services including office tools, mail and knowledge management, which presents an entirely new risk level.
+'''David Movshovitz'''
-In this presentation we will discuss the security risks unique to SaaS (Software as a service) and some past attacks on such services. We will than dissect the security implications of using Google sites (which includes Google docs and Gmail) as an example for a SaaS. We will go over a checklist of things to examine in a SaaS before subscribing to ensure that it provides sufficient security and will discuss the solutions offered (or not) by Google to the items listed.
+SAML is one of the protocols that have been developed to secure web services, and has been become very popular especially to implement Web SSO and SaaS SSO. In the lecture we will describe the principals of the protocol and demonstrate how it is used to implement Web SSO.
-== 18:25 - 19:00 : SAML  ==
+== 19:00 - 19:30&nbsp;: XSHM - Cross Site History Manipulation  ==
-SAML is one of the protocols that have been developed to secure web services, and has been become very popular especially to implement Web SSO and SaaS SSO. In the lecture we will describe the principals of the protocol and demonstrate how it is used to implement Web SSO.
+'''Alex Roichman, Checkmarx'''
-== 19:00 - 19:30 : XSHM - Cross Site History Manipulation ==
+In this presentation I will introduce a newly discovered SOP (Same Origin Policy) security breach identified as Cross-Site History Manipulation (XSHM). Cross-Site History Manipulation breach is based on our research findings that the client-side browser history object is not properly partitioned on a per-site basis. Manipulating browser history may lead to SOP compromising, allow bi-directional CSRF and other exploitations such as: user privacy violation, login status detection, resource mapping, sensitive information inferring, users' activity tracking and URL parameter stealing. In the presentation I will show how XSHM can be executed, what applications are vulnerable to it, how to detect the flaw and consequently remediate it.'''<u><br></u>'''
-In this presentation I will introduce a newly discovered SOP (Same Origin
+[[Category:Israel]]