Difference between revisions of "BeNeLux OWASP Day 2010"

Part of the BeNeLux OWASP Day 2010

• Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle.

• This course aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.

• If you are interested in participating in the hands on portion of the course, please bring a laptop.

How to get here:

Clickjacking recently received new media attentions: Thousands of Facebook users have fallen victims of a worm that uses clickjacking techniques to propagate.

In a clickjacking attack, a malicious page is constructed (or a benign page is hijacked) to trick the user into performing unintended clicks that are advantageous for the attacker, such as propagating a web worm, stealing confidential information or abusing of the user session.

However it is currently unclear to what extent clickjacking is being used by attackers in the wild and how significant the attack is for the security of Internet users.

In this talk, we presents a solution we designed for studying the prevalence of clickjacking on the Internet and for detecting possible malicious pages in an automated fashion. We deployed our system over 10 distinct virtual machines to test more then a million unique web-pages in two months. From the analysis of our experimental results we discuss the clickjacking phenomenon and its future implications.

File sharing services are used daily by tens of thousands of people as a way of sharing files. Almost all such services, use a security-through-obscurity method of hiding the files of one user from others. For each uploaded file, the user is given a secret URL which supposedly cannot be guessed. The user can then share his uploaded file by sharing this URL with other users of his choice. Unfortunately though, a number of file sharing services are incorrectly implemented allowing an attacker to guess valid URLs of millions of files and thus allowing him to enumerate their file database and access all of the uploaded files. In this paper, we study some of these services and we record their incorrect implementations. We design automatic enumerators for two such services and a privacy-classifying module which characterises an uploaded file as private or public. Using this technique we gain access to thousands of private files ranging from private and company documents to personal photographs. We present a taxonomy of the private files found and ways that the users and services can protect themselves against such attacks.

Insiders who write code, whether they are developers working for an enterprise or contributors to an open source project, have an almost unlimited number of ways to put chinks in the armor of their software. Many times, these holes are put in place for seemingly good reasons—to facilitate easy debugging, make working from home easier, or as a failsafe in case other mechanisms for interfacing with the system fail. Worse still, malicious insiders can plant logic bombs or insert backdoors so that they can embezzle funds, steal private information, or exact revenge if they become disgruntled.

Whether unintentional or malicious, code that performs questionable behavior or permits unauthorized access can be introduced with relative ease and can persist in a code base almost indefinitely without being discovered. Until it's too late. In this talk, we discuss techniques for applying static analysis to program source code to assist auditors hunting for backdoors, logic bombs, and other threats introduced by insiders. We give detailed examples of insider threats that have been uncovered in real software systems, outline possible motives for malicious insiders, and discuss how external stimuli like layoffs are increasing the attention paid to insider threats. We conclude the talk with results of applying the detection techniques discussed in this talk to real-world software.

Casback is a name given to progams where participants will earn points for every net euro/dollar in purchases made. There are many ways this can go wrong. We will revisit the design, architecture of common Cashback systems on every operational level. We will take one particular interesting Payback program as an example and show how NOT to deploy. Death by a thousand cuts.

Beware : Hilarity will ensue.

Botnets are a hot debated topic, with much controversies on how to fight them. Recently there was headline news regarding the takedown of the Bredolab botnet, which caused a lot of discussion and contained a lot of conflicting views on the subject. During this presentation the facts of this Bredolab botnet takedown will be discussed, alongside the views of a Cybercriminal on how to setup your own botnet. You will be given a crash-course Cybercrime in 30 minutes.

Voice over IP is the current de facto technology for delivering voice data in both enterprise and service provider infrastructure. Although , security threats specific to VoIP signalling have been known for a while, few is known about cross-layer attacks in which Web enabled VoIP devices allow for efficient attacks against the VoIP infrastructure and general IT networks .

This talk will give a short introduction to VoIP and continue with a series of attacks that leverage SIP as efficient transport vehicle for billing attacks , disclosure attacks and network penetration. The talk will show how one single phone call can compromise even the best secured and hardened network perimeter .

Social Networking Sites (SNS) and Web 2.0 platforms have been growing rapidly over the past few years, with multi-millions utilizing these platforms on a daily basis. In this talk, we will present some of the threats that SNS introduces to the corporate environment.

An attacker has an easy job. They need only find one security hole, and they've broken the system. The system, application and network administrators :have a much harder task. They have to find not just one, but each and every one of the holes. Preferably before the bad guys do.

And, these holes can be at several different layers. In the presentation, we will look at those layers (system level, application level, but also user :level) and observe what goes wrong and how to fix it. The observations come from the daily work at Madison Gurkha.

Examples of problems are lack of patches, problems during the development phase, susceptibility to social engineering attacks and more.

Radu has held positions as Research Engineer and Senior Engineer at INRIA-LORIA and has been working as Senior Researcher at the University of Luxembourg, FSTC-CSC Research Unit from October 2008 to September 2010. Radu's research activity will be on one side investigate interoperability aspects to supply security components in the area of ubiquitous computing and on the other side set up a project specific interoperability research lab in close cooperation with industry.

Nick holds a BSc in Computer Science and a MSc on Distributed Systems from the University of Crete in Greece. He worked for 3 years as a research assistant in the Distributed Computing Systems group at the Foundation of Research and Technology in Crete where he did research in network data visualization, authentication schemes using mobile devices and phishing countermeasures. In the past, Nick has presented his work in academic conferences as well as hacking conventions. His work can be found online at www.securitee.org.

Marco Balduzzi is an IT security specialist with several years of experience as engineer and consultant for different international companies located in Milan, Munich and Nice. At the moment, he is a PhD researcher in EURECOM and a proud member of the International Secure System Lab. He designs systems for the detection of botnets/malware, the analysis of web threats and the security of cloud computing.
Marco owns a MSc in Computer Engineering from the University of Bergamo and is a co-founder of the Bergamo Linux User Group. He contributed to several Free Software projects (e.g. Nast) and has been involved in many underground non-profit organizations.

At OWASP, Martin is board member of the OWASP Netherlands Chapter and member of the Global Education Committee.

has conducted projects in all areas of information security, in diverse environments, utilizing a wide range of professional tools. Some of his notable projects have focused on: complex penetration testing, comprehensive White Box audits, network security, policy and procedure formulation, manual and automated security testing, security evaluation of products, leading secure software development lifecycles, infrastructure security audits, risk assessments, PCI and PA-DSS consulting, and more.