Difference between revisions of "BeNeLux OWASP Day 2010"

• Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle.

• This course aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.

• If you are interested in participating in the hands on portion of the course, please bring a laptop.

How to get here:

Agenda:

• Welcome and OWASP Update (by Eoin Keary, OWASP Board, E&Y and Seba Deleersnyder, OWASP Board, SAIT Zenitel)
• Combined Web and VoIP attacks (by Radu State, University of Luxembourg)
• Privacy of file sharing service (by N Nikiforakis, Katholieke Universiteit Leuven)
• Clickjacking: an empirical study with an automated testing/detection system (by Marco Balduzzi, Eurecom)

Clickjacking recently received new media attentions: Thousands of Facebook users have fallen victims of a worm that uses clickjacking techniques to propagate.

In a clickjacking attack, a malicious page is constructed (or a benign page is hijacked) to trick the user into performing unintended clicks that are advantageous for the attacker, such as propagating a web worm, stealing confidential information or abusing of the user session.

However it is currently unclear to what extent clickjacking is being used by attackers in the wild and how significant the attack is for the security of Internet users.

In this talk, we presents a solution we designed for studying the prevalence of clickjacking on the Internet and for detecting possible malicious pages in an automated fashion. We deployed our system over 10 distinct virtual machines to test more then a million unique web-pages in two months. From the analysis of our experimental results we discuss the clickjacking phenomenon and its future implications.

• tbd (by Walter Belgers, Madison Gurkha)

..

Co-Author, Editor/team lead of the OWASP Code Review guide.

Nick holds a BSc in Computer Science and a MSc on Distributed Systems from the University of Crete in Greece. He worked for 3 years as a research assistant in the Distributed Computing Systems group at the Foundation of Research and Technology in Crete where he did research in network data visualization, authentication schemes using mobile devices and phishing countermeasures. In the past, Nick has presented his work in academic conferences as well as hacking conventions. His work can be found online at www.securitee.org.

At OWASP, Martin is board member of the OWASP Netherlands Chapter and member of the Global Education Committee.