This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "BeNeLux OWASP Day 2016"
(more beautifying) |
|||
(20 intermediate revisions by one other user not shown) | |||
Line 6: | Line 6: | ||
<!-- First tab --> | <!-- First tab --> | ||
= Information = | = Information = | ||
+ | |||
+ | <div style="text-align: center;"><font size=18> Looking for the [https://www.owasp.org/index.php/BeNeLux_OWASP_Day_2016-2 OWASP BeNeLux 2016 2nd edition in Belgium]? </font></div> | ||
== OWASP BeNeLux Announcement == | == OWASP BeNeLux Announcement == | ||
Line 116: | Line 118: | ||
|- | |- | ||
| 09h30 - 11h00 || Training | | 09h30 - 11h00 || Training | ||
− | | rowspan="7" style="width:100px;" | Application Security Primer by Martin Knobloch | + | | rowspan="7" style="width:100px;" | [[BeNeLux_OWASP_Day_2016#Application_Security_Primer | Application Security Primer]] by [[BeNeLux_OWASP_Day_2016#Martin_Knobloch | Martin Knobloch]] |
− | | rowspan="7" style="width:100px;" | Hands-on Threat Modeling by Sebastien Deleersnyder | + | | rowspan="7" style="width:100px;" | [[BeNeLux_OWASP_Day_2016#Hands-on_Threat_Modeling | Hands-on Threat Modeling]] by [[BeNeLux_OWASP_Day_2016#Sebastien_Deleersnyder | Sebastien Deleersnyder]] |
− | | rowspan="7" style="width:100px;" | Security Shepherd by | + | | rowspan="7" style="width:100px;" | [[BeNeLux_OWASP_Day_2016#Security_Shepherd | Security Shepherd]] by [[BeNeLux_OWASP_Day_2016#Pol_Mac_Cana | Pol Mac Cana]] |
− | | rowspan="7" style="width:100px;" | O-saft by Torsten Gigler | + | | rowspan="7" style="width:100px;" | [[BeNeLux_OWASP_Day_2016#O-saft | O-saft]] by [[BeNeLux_OWASP_Day_2016#Torsten_Gigler | Torsten Gigler]] |
|- | |- | ||
| 11h00 - 11h30 || ''Coffee Break'' | | 11h00 - 11h30 || ''Coffee Break'' | ||
Line 134: | Line 136: | ||
|} | |} | ||
− | == | + | == Trainings == |
− | === | + | === Application Security Primer === |
This workshop is an introduction into (web) application security with hands-on labs, using OWASP documentation and tooling. You will be introduced into the security mindset, discus the OWASP TopTen 2013 and learn basic skills in how to find vulnerabilities in web applications. All tools and documentation are provided during the training. | This workshop is an introduction into (web) application security with hands-on labs, using OWASP documentation and tooling. You will be introduced into the security mindset, discus the OWASP TopTen 2013 and learn basic skills in how to find vulnerabilities in web applications. All tools and documentation are provided during the training. | ||
As this is an hands-on workshop, please bring your own laptop! | As this is an hands-on workshop, please bring your own laptop! | ||
− | + | ====Prerequisites for this workshop==== | |
− | ===Prerequisites for this workshop=== | ||
:Laptop with Virtualbox or VMware | :Laptop with Virtualbox or VMware | ||
:Basic understanding of HTTP and web application testing/development | :Basic understanding of HTTP and web application testing/development | ||
:An open mind | :An open mind | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | == Hands-on Threat Modeling | + | === Hands-on Threat Modeling === |
− | |||
This is a 1 day, trainer-led, on-site, Threat Modeling course. The training material and hands-on workshops include real live Use Cases. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on: | This is a 1 day, trainer-led, on-site, Threat Modeling course. The training material and hands-on workshops include real live Use Cases. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on: | ||
* B2B web and mobile applications, sharing the same REST backend | * B2B web and mobile applications, sharing the same REST backend | ||
Line 161: | Line 156: | ||
This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications and databases. The students should bring their own laptop to the course. | This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications and databases. The students should bring their own laptop to the course. | ||
− | ==== Course topics (1 day) ==== | + | ==== Course topics (1 day) ==== |
− | |||
Threat modeling introduction | Threat modeling introduction | ||
*Threat modeling in a secure development lifecycle | *Threat modeling in a secure development lifecycle | ||
Line 216: | Line 210: | ||
After each hands-on workshop, the results are discussed, and the students receive a documented solution. | After each hands-on workshop, the results are discussed, and the students receive a documented solution. | ||
− | = | + | === Security Shepherd === |
− | |||
− | |||
− | == Security Shepherd | ||
− | |||
Want to learn the basics of Web App pen testing? Or would you prefer to develop new advanced pen testing tricks? Join the us for the lightning Security Shepherd Web Application training session that will bring attendees up to speed on all the latest and greatest security testing techniques that are a concern in the industry today. Compete against other participants and solve increasingly complex security puzzles derived from real world security threats. Attendees will leave with a real familiarity of web application pen testing best practice, terminology, workflow's and commonly used tool kits.<br> | Want to learn the basics of Web App pen testing? Or would you prefer to develop new advanced pen testing tricks? Join the us for the lightning Security Shepherd Web Application training session that will bring attendees up to speed on all the latest and greatest security testing techniques that are a concern in the industry today. Compete against other participants and solve increasingly complex security puzzles derived from real world security threats. Attendees will leave with a real familiarity of web application pen testing best practice, terminology, workflow's and commonly used tool kits.<br> | ||
− | ===Prerequisites=== | + | ====Prerequisites==== |
A Laptop Capable of Connecting to Internet on the day | A Laptop Capable of Connecting to Internet on the day | ||
You should have Java, | You should have Java, | ||
Java Installed, OWASP ZAP / Burpsuite Downloaded or Installed, Firefox is the browser of choice. | Java Installed, OWASP ZAP / Burpsuite Downloaded or Installed, Firefox is the browser of choice. | ||
− | |||
− | |||
− | == O-saft | + | === O-saft === |
− | |||
The use of SSL/TLS to protect the transport of data has become very common today. On the other hand it does not work pretty 'out of the box'. Furthermore it has more and more secuirty issues. As a consequence it often does not protect as assumed. It is often difficult to understand, what are the root causes of the issues, and how to detect and | The use of SSL/TLS to protect the transport of data has become very common today. On the other hand it does not work pretty 'out of the box'. Furthermore it has more and more secuirty issues. As a consequence it often does not protect as assumed. It is often difficult to understand, what are the root causes of the issues, and how to detect and | ||
finally avoid or fix them.<br> | finally avoid or fix them.<br> | ||
Line 245: | Line 232: | ||
The purpose of this course is to provide a tool set for checking TLS/SSL to the participants, and teach the participants how and when to use which tool, and why some tools do not provide complete results (e.g. protocols, ciphers). The course is about analysing TLS/SSL from a client-site view. It will not go into the details of fuzzing or even breaking TLS/SSL, or exploiting vulnerabilities. Mostly we will analyse HTTPS, furthermore we will provide some examples for protocols using STARTTLS, too (e.g. SMTP).<br> | The purpose of this course is to provide a tool set for checking TLS/SSL to the participants, and teach the participants how and when to use which tool, and why some tools do not provide complete results (e.g. protocols, ciphers). The course is about analysing TLS/SSL from a client-site view. It will not go into the details of fuzzing or even breaking TLS/SSL, or exploiting vulnerabilities. Mostly we will analyse HTTPS, furthermore we will provide some examples for protocols using STARTTLS, too (e.g. SMTP).<br> | ||
Additionally it will give system architects, administrator, or operational people, hints how to set-up and configure TLS/SSL in a proper secure way. | Additionally it will give system architects, administrator, or operational people, hints how to set-up and configure TLS/SSL in a proper secure way. | ||
− | |||
==== Technical requirements ==== | ==== Technical requirements ==== | ||
The participants should bring their own laptop with any operating system (recommended is Linux) and at least following tools installed: | The participants should bring their own laptop with any operating system (recommended is Linux) and at least following tools installed: | ||
Line 254: | Line 240: | ||
* python (2.7) optional<br> | * python (2.7) optional<br> | ||
Optional, for smooth testing, a local SSL-enabled (SSLv2, SSLv3, TLS) web server should be running on the laptop (i.e. OWASP-BWA). | Optional, for smooth testing, a local SSL-enabled (SSLv2, SSLv3, TLS) web server should be running on the laptop (i.e. OWASP-BWA). | ||
− | + | ||
+ | |||
+ | |||
+ | == Trainers == | ||
+ | ===Martin Knobloch=== | ||
+ | Martin is Principal Consultant at Nixu BeNeLux (https://www.nixu.com/en/nixubenelux). His main working area is (software) security in general, from awareness to implementation. In his daily work, he is responsible for education in application security matters, advise and implementation of application security measures. | ||
+ | In2006, Martin got involved in OWASP when attending his first OWASP conference. He became a member of the OWASP Netherland Chapter board in 2007. He has contributed to several OWASP projects and is co-organizer of the OWASP BeNeLux-Day conference since 2008. Martin has been chair of the Global Education Committee from 2008 until the ending of the Global Committees. | ||
+ | Futher, Martin is the conference chair of the OWASP AppSec-Eu/Research 2015 conference in Amsterdam, the Netherlands and involved in the AppSec-Eu 2016 among other activities as CfT Co-Chair. | ||
+ | Martin is a frequent speaker at universities, hacker spaces and various conferences. | ||
+ | |||
+ | === Sebastien Deleersnyder === | ||
+ | Sebastien Deleersnyder, managing partner and application security consultant at [http://www.toreon.com Toreon] will share his practical threat model experience. Sebastien led engagements in the domain of ICT-security, Web and Mobile Security with several customers including BNP Paribas Fortis, Atos Worldline, KBC, Nationale Nederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post , Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, served as vice-chair of the global OWASP Foundation Board and performed several public presentations on Web Application, Mobile and Web Services Security. Furthermore, Sebastien co-founded the yearly BruCON conference. | ||
+ | |||
+ | ===Pol Mac Cana=== | ||
+ | Paul is currently working as a Security Technical Team Lead and has over 6 years experience in infoSec. He has contributed to the OWASP Security Shepherd Project since its inception and has given training session utilising the tool to universities and educational bodies for a number of years. He received his MSc. in Information Security and Digital Forensics from ITB in Dublin | ||
=== Torsten Gigler === | === Torsten Gigler === | ||
− | + | Torsten Gigler is Internernal Security Advisor in a large scale enterprise >15 years (ICT-Infrastructure- and Application Security). He has been volunteering for OWASP since more than 3 years: since 2 years co-developer of O-Saft, contributed to the Transport Layer Protection Cheat Sheet (Cipher Section), project leader 'OWASP Top 10 für Entwickler' / OWASP Top 10 for Developers, contributed to the German translation of OWASP-Top-10 2013, supported the Top_10_2013-Project: Review, Wiki. | |
+ | |||
<!-- Fifth tab --> | <!-- Fifth tab --> | ||
Line 269: | Line 270: | ||
{| class="wikitable" | {| class="wikitable" | ||
! width="120pt" | Time | ! width="120pt" | Time | ||
− | ! width=" | + | ! width="190pt" | Speaker !! Topic |
+ | ! width="140pt" | Presentation | ||
|- | |- | ||
| 08h30 - 09h10 | | 08h30 - 09h10 | ||
− | | colspan=" | + | | colspan="3" style="text-align: center; background: grey; color: white" | ''Registration'' |
|- | |- | ||
− | | 09h15 - 10h00 || [[BeNeLux_OWASP_Day_2016#Julie_Gommes |Julie Gommes]] || [[BeNeLux_OWASP_Day_2016#Gamers,_You're_the_new_Botnets | Gamers, You're the new Botnets]] | + | | 09h15 - 10h00 || [[BeNeLux_OWASP_Day_2016#Julie_Gommes |Julie Gommes]] |
+ | || [[BeNeLux_OWASP_Day_2016#Gamers,_You're_the_new_Botnets | Gamers, You're the new Botnets]] | ||
+ | || [[Media:OWASPBNL_Gamers,_You're_the_new_Botnets.pdf | Download PDF]] | ||
|- | |- | ||
− | | 10h00 - 10h45 || [[BeNeLux_OWASP_Day_2016#Stefan_Burgmair |Stefan Burgmair]] || [[BeNeLux_OWASP_Day_2016#OWASP_Top_10_Privacy_Risks | OWASP Top 10 Privacy Risks]] | + | | 10h00 - 10h45 || [[BeNeLux_OWASP_Day_2016#Stefan_Burgmair |Stefan Burgmair]] |
+ | || [[BeNeLux_OWASP_Day_2016#OWASP_Top_10_Privacy_Risks | OWASP Top 10 Privacy Risks]] | ||
+ | || [[Media:OWASPBNL_OWASP_Top_10_Privacy_Risks.pdf| Download PDF]] <br> [[OWASP_Top_10_Privacy_Risks_Project | project website]] | ||
|- | |- | ||
| 10h45 - 11h15 | | 10h45 - 11h15 | ||
− | | colspan=" | + | | colspan="3" style="text-align: center;background: grey; color: white" | ''Morning Break'' |
|- | |- | ||
− | | 11h15 - 12h00 || [[BeNeLux_OWASP_Day_2016#Erik_Poll |Erik Poll]] || [[BeNeLux_OWASP_Day_2016#LangSec_meets_State_Machines | LangSec meets State Machines]] | + | | 11h15 - 12h00 || [[BeNeLux_OWASP_Day_2016#Erik_Poll |Erik Poll]] |
+ | || [[BeNeLux_OWASP_Day_2016#LangSec_meets_State_Machines | LangSec meets State Machines]] | ||
+ | || [[Media:OWASPBNL_LangSec_meets_state_machines.pdf | Download PDF ]] | ||
|- | |- | ||
− | | 12h00 - 12h45 || [[BeNeLux_OWASP_Day_2016#Arne_Swinnen |Arne Swinnen]] || [[BeNeLux_OWASP_Day_2016#The_Tales_of_a_Bug_Bounty_Hunter | The Tales of a Bug Bounty Hunter]] | + | | 12h00 - 12h45 || [[BeNeLux_OWASP_Day_2016#Arne_Swinnen |Arne Swinnen]] |
+ | || [[BeNeLux_OWASP_Day_2016#The_Tales_of_a_Bug_Bounty_Hunter | The Tales of a Bug Bounty Hunter]] | ||
+ | || [[Media:OWASPBNL_The_Tales_of_a_Bug_Bounty_Hunter.pdf | Download PDF ]] | ||
|- | |- | ||
| 12h45 - 13h45 | | 12h45 - 13h45 | ||
− | | colspan=" | + | | colspan="3" style="text-align: center;background: grey; color: white" | ''Lunch'' |
|- | |- | ||
− | | 13h45 - 14h30 || [[BeNeLux_OWASP_Day_2016#Glenn_Ten_Cate |Glenn Ten Cate]] & [[BeNeLux_OWASP_Day_2016#Riccardo_Ten_Cate | Riccardo Ten Cate ]] ||[[BeNeLux_OWASP_Day_2016# | + | | 13h45 - 14h30 || [[BeNeLux_OWASP_Day_2016#Glenn_Ten_Cate |Glenn Ten Cate]] & [[BeNeLux_OWASP_Day_2016#Riccardo_Ten_Cate | Riccardo Ten Cate ]] |
+ | || [[BeNeLux_OWASP_Day_2016#OWASP_Security_Knowledge_Framework | OWASP Security Knowledge Framework (SKF)]] | ||
+ | || [[Media:OWASPBLN_SKF.pdf| Download PDF]] <br> [[OWASP_Security_Knowledge_Framework | project website]] | ||
|- | |- | ||
− | | 14h30 - 15h15 || [[BeNeLux_OWASP_Day_2016#Kevin_Allix |Kevin Allix]] || [[BeNeLux_OWASP_Day_2016#Challenges_in_Android_Malware_Detection | Challenges in Android Malware Detection]] | + | | 14h30 - 15h15 || [[BeNeLux_OWASP_Day_2016#Kevin_Allix |Kevin Allix]] |
+ | || [[BeNeLux_OWASP_Day_2016#Challenges_in_Android_Malware_Detection | Challenges in Android Malware Detection]] | ||
+ | || [[Media:OWASPBNL_Challenges_in_Android_Malware_Detection.pdf | Download PDF]] | ||
|- | |- | ||
| 15h15 - 15h45 | | 15h15 - 15h45 | ||
− | | colspan=" | + | | colspan="3" style="text-align: center;background: grey; color: white" | ''Break'' |
|- | |- | ||
− | | 15h45 - 16h30 || [[BeNeLux_OWASP_Day_2016#Christian Schneider | Christian Schneider]] & Alvaro Muñoz || [[BeNeLux_OWASP_Day_2016#Serial_Killer:_Silently_Pwning_your_Java_Endpoints |Serial Killer: Silently Pwning your Java Endpoints]] | + | | 15h45 - 16h30 || [[BeNeLux_OWASP_Day_2016#Christian Schneider | Christian Schneider]] & [[BeNeLux_OWASP_Day_2016#Alvaro_Muñoz | Alvaro Muñoz]] |
+ | || [[BeNeLux_OWASP_Day_2016#Serial_Killer:_Silently_Pwning_your_Java_Endpoints |Serial Killer: Silently Pwning your Java Endpoints]] | ||
+ | || [[Media:OWASPBNL_ Java_Deserialization.pdf | Download PDF ]] | ||
|- | |- | ||
− | | 16h30 - 17h15 || [[BeNeLux_OWASP_Day_2016#Michael_Hamm | Michael Hamm]] || [[BeNeLux_OWASP_Day_2016#Experiences_with_Paste-Monitoring |Experiences with Paste-Monitoring]] | + | | 16h30 - 17h15 || [[BeNeLux_OWASP_Day_2016#Michael_Hamm | Michael Hamm]] |
+ | || [[BeNeLux_OWASP_Day_2016#Experiences_with_Paste-Monitoring |Experiences with Paste-Monitoring]] | ||
+ | || [[Media:OWASPBNL_Experiences_with_Paste-Monitoring.pdf | Download PDF ]] | ||
|- | |- | ||
| 17h15 - 17h30 || OWASP Benelux 2016 organization || '''Closing Notes''' | | 17h15 - 17h30 || OWASP Benelux 2016 organization || '''Closing Notes''' | ||
Line 313: | Line 331: | ||
Let's talk about malwares, about botnets, about backdoors and about some computer which can win a "botnet award". | Let's talk about malwares, about botnets, about backdoors and about some computer which can win a "botnet award". | ||
− | === OWASP Top 10 Privacy Risks === | + | === [[OWASP_Top_10_Privacy_Risks_Project | OWASP Top 10 Privacy Risks]] === |
There are lively discussions about how to protect personal data especially with the upcoming EU Data Protection Regulation that requires Privacy by Design. But still there was no independent description of privacy risks specifically for web applications available. Thus, companies lack guidance to identify and avoid privacy risks during systems development. Therefore the OWASP Top 10 Privacy Risks project developed a list of the top 10 privacy risks in web applications. The project covers technical and organizational aspects like missing encryption or insufficient transparency and results and practical countermeasures are presented in this session. | There are lively discussions about how to protect personal data especially with the upcoming EU Data Protection Regulation that requires Privacy by Design. But still there was no independent description of privacy risks specifically for web applications available. Thus, companies lack guidance to identify and avoid privacy risks during systems development. Therefore the OWASP Top 10 Privacy Risks project developed a list of the top 10 privacy risks in web applications. The project covers technical and organizational aspects like missing encryption or insufficient transparency and results and practical countermeasures are presented in this session. | ||
Line 324: | Line 342: | ||
The most interesting vulnerabilities were hybrid: Combinations of complementary vulnerabilities in different environments (e.g. Web and Mobile). All identified issues’ root causes will be mapped onto the Software Development Life Cycle (SDLC), to analyze where they could have been prevented from materializing. Last but not least, the monetary rewards offered by Facebook for each vulnerability and general Bug Bounty Hunting advice will be shared with the community. | The most interesting vulnerabilities were hybrid: Combinations of complementary vulnerabilities in different environments (e.g. Web and Mobile). All identified issues’ root causes will be mapped onto the Software Development Life Cycle (SDLC), to analyze where they could have been prevented from materializing. Last but not least, the monetary rewards offered by Facebook for each vulnerability and general Bug Bounty Hunting advice will be shared with the community. | ||
− | === | + | === [[OWASP_Security_Knowledge_Framework | OWASP Security Knowledge Framework]] === |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
Over 10 years of experience in web application security bundled into a single application. <br/> | Over 10 years of experience in web application security bundled into a single application. <br/> | ||
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. <br/> | The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team. <br/> | ||
Line 349: | Line 357: | ||
<li>Code examples for secure coding</li> | <li>Code examples for secure coding</li> | ||
</ul> | </ul> | ||
+ | |||
+ | === Challenges in Android Malware Detection === | ||
+ | What is the state of Malware detection for Android? This talk will present a landscape of Android Malware and techniques used to (try and) detect Malware, with a focus on the limitations of the state-of-the-art detection methods. | ||
+ | |||
+ | === Serial Killer: Silently Pwning your Java Endpoints === | ||
+ | In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees. The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application. The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start. Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process. | ||
+ | |||
+ | === Experiences with Paste-Monitoring === | ||
+ | Paste platforms like Pastebin.com provide the possibility to store and share text online. Often this kind of services are used by programmers but also abused by attackers to present their achievements. CIRCL acts as a fire brigade and monitor several of those paste platforms to early detect potential incidents and help the victims. The findings vary from lists of vulnerable or compromised websites, leaked credentials, database dumps, opportunistic announcements, stolen credit card details and many more. We will present the used techniques, and some key experiences with the findings and introduce the AIL framework - Framework for Analysis of Information Leaks. AIL is designed to analyse unstructured data and identify potential data leaks. | ||
+ | |||
== Speakers == | == Speakers == | ||
=== Julie Gommes=== | === Julie Gommes=== | ||
Line 362: | Line 380: | ||
Arne Swinnen is an IT Security Consultant at NVISO, a Belgian Cyber Security Consulting firm. Arne specializes in Application Security and Digital Forensics. He co-organized the first edition of the Cyber Security Challenge Belgium in 2015, a National cyber security competition designed exclusively for Belgian students.<br> | Arne Swinnen is an IT Security Consultant at NVISO, a Belgian Cyber Security Consulting firm. Arne specializes in Application Security and Digital Forensics. He co-organized the first edition of the Cyber Security Challenge Belgium in 2015, a National cyber security competition designed exclusively for Belgian students.<br> | ||
Arne was a speaker at Black Hat USA and BruCON in 2014, presenting novel anti-virus detection and evasion techniques (“One Packer to Rule Them All”). Since 2015, he is also listed on Facebook’s Bug Bounty Half of Fame''.<br> | Arne was a speaker at Black Hat USA and BruCON in 2014, presenting novel anti-virus detection and evasion techniques (“One Packer to Rule Them All”). Since 2015, he is also listed on Facebook’s Bug Bounty Half of Fame''.<br> | ||
− | |||
− | |||
− | |||
− | |||
=== Glenn Ten Cate === | === Glenn Ten Cate === | ||
Line 377: | Line 391: | ||
=== Kevin Allix === | === Kevin Allix === | ||
After a Master degree obtained in 2007, Kevin Allix held operational positions for four years during which he deployed and ran network security equipments for dozens of customers, and built tools to help administrate one of the biggest french Video-on-Demand platform. In 2011, he joined the University of Luxembourg to start a PhD at the 'Centre for Security, Reliability and Trust'. He is now a Research Associate at SnT - uni.lu where he keeps focusing on Android malware detection. | After a Master degree obtained in 2007, Kevin Allix held operational positions for four years during which he deployed and ran network security equipments for dozens of customers, and built tools to help administrate one of the biggest french Video-on-Demand platform. In 2011, he joined the University of Luxembourg to start a PhD at the 'Centre for Security, Reliability and Trust'. He is now a Research Associate at SnT - uni.lu where he keeps focusing on Android malware detection. | ||
+ | |||
+ | === Christian Schneider === | ||
+ | Christian Schneider (@cschneider4711) writes software since the nineties, works as a freelance software developer since 1997, focuses on Java since 1999 and on IT-Security - especially Pentesting - since 2005. He enjoys writing articles about web application security as well as speaks and trains at conferences (OWASP AppSecEU, JAX, WJAX, WebTechCon, DevOpsCon, HackPra, RSA). He blogs at [https://www.Christian-Schneider.net Christian-Schneider.net] | ||
+ | |||
+ | === Alvaro Muñoz === | ||
+ | Alvaro Muñoz (@pwntester) works as Principal Security Researcher with HPE Security Fortify. He enjoys researching different programming languages and web application frameworks for vulnerabilities and unsafe APIs. Before joining the HPE research team, he worked as an Application Security Consultant helping enterprises to start and improve their application security programs. He blogs at [http://www.pwntester.com pwntester.com] | ||
=== Michael Hamm === | === Michael Hamm === | ||
Line 393: | Line 413: | ||
:Phone: +352 26573281 | :Phone: +352 26573281 | ||
− | + | <!-- Seventh tab --> | |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | <!-- | ||
= Sponsor = | = Sponsor = |
Latest revision as of 19:40, 29 September 2016
OWASP BeNeLux Announcement
We are proud to announce the dates of the next edition of BeNeLux OWASP Day!
The event will take place on 17 and 18 March 2016, in Belval Campus, in Esch-sur-Alzette - Luxembourg.
More information on the venue can be found here.
Don't wait and register now!
Confirmed speakers Conference
The OWASP BeNeLux Program Committee
- Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium
- Martin Knobloch, OWASP Netherlands
- Jocelyn Aubert, OWASP Luxembourg
Tweet!
Event tag is #owaspbnl16
Donate to OWASP BeNeLux
OWASP BeNeLux training day and conference are free, but registration is required!
Register today at https://owasp-benelux-day-2016.eventbrite.com . We only have a limited number of seats available for our trainings and conference. First come, first serve!
To support the OWASP organisation, consider to become a member, it's only US$50!
Check out the Membership page to find out more.
Venue is
University of Luxembourg
Maison du Savoir
2, avenue de l'Université
L-4365 Esch-sur-Alzette
How to reach the venue?
By car
Check the Belval Campus map - available on google maps - for route information.
Outdoor parking areas and underground car parks are available throughout the campus, particularly P+R Belval Université, or Square Mile parking or Belval Plaza.
By train
Trains departing every 15 minutes from Luxembourg Central Station are direct to "Belval-Université" - line is connection-free via Esch-sur-Alzette. Get information on train schedules on the CFL’s website.
When on site, access to buildings is easy on foot.
Hotel nearby
Hotel Ibis Esch-Belval
12, avenue du Rock'n'Roll
L-4361 Esch-sur-Alzette, Luxembourg
From 81 EUR per night
Trainingday is March 17th
Location
The training venue is at the same location as the conference venue, i.e. Maison du Savoir on the 4th floor.
Agenda
Time | Description | Room 4.320 | Room 4.350 | Room 4.360 | Room 4.400 |
---|---|---|---|---|---|
08h30 - 9h30 | Registration | ||||
09h30 - 11h00 | Training | Application Security Primer by Martin Knobloch | Hands-on Threat Modeling by Sebastien Deleersnyder | Security Shepherd by Pol Mac Cana | O-saft by Torsten Gigler |
11h00 - 11h30 | Coffee Break | ||||
11h30 - 13h00 | Training | ||||
13h00 - 14h00 | Lunch | ||||
14h00 - 15h30 | Training | ||||
15h30 - 16h00 | Coffee Break | ||||
16h00 - 17h30 | Training |
Trainings
Application Security Primer
This workshop is an introduction into (web) application security with hands-on labs, using OWASP documentation and tooling. You will be introduced into the security mindset, discus the OWASP TopTen 2013 and learn basic skills in how to find vulnerabilities in web applications. All tools and documentation are provided during the training. As this is an hands-on workshop, please bring your own laptop!
Prerequisites for this workshop
- Laptop with Virtualbox or VMware
- Basic understanding of HTTP and web application testing/development
- An open mind
Hands-on Threat Modeling
This is a 1 day, trainer-led, on-site, Threat Modeling course. The training material and hands-on workshops include real live Use Cases. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:
- B2B web and mobile applications, sharing the same REST backend
- An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service
Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.
Threat modeling allows you to consider, document, and discuss the security implications of designs in the context of their planned operational environment and in a structured fashion. Threat modeling also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model.
This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications and databases. The students should bring their own laptop to the course.
Course topics (1 day)
Threat modeling introduction
- Threat modeling in a secure development lifecycle
- What is threat modeling
- Why threat modeling?
- Threat modeling stages
- Diagrams
- Identify threats
- Addressing threats
- Document a threat model
Diagrams – what are you building?
- Understanding context
- Doomsday scenarios
- Data flow diagrams
- Trust Boundaries
- Hands-on: diagram B2B web and mobile applications, sharing the same REST backend
Identifying threats – what can go wrong?
- STRIDE introduction
- Spoofing threats
- Tampering threats
- Repudiation threats
- Information disclosure threats
- Denial of service threats
- Elevation of privilege threats
- Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service
Addressing each threat
- Mitigation patterns
- Authentication: mitigating spoofing
- Integrity: mitigating tampering
- Non-repudiation: mitigating repudiation
- Confidentiality: mitigating information disclosure
- Availability: mitigating denial of service
- Authorization: mitigating elevation of privilege
Threat modeling tools
- General tools
- Open-Source tools
- Commercial tools
The course students receive the following package as part of the course:
- Hand-outs of the presentations
- Work sheets of the use cases,
- Detailed solution descriptions of the use cases
- Template to document a threat model
- Template to calculate risk levels of identified threats
The students should bring their own laptop
Threat Modeling – real life use cases
As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world. In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build a threat model. Using this methodology for the hands on workshops we provide our students with a robust training experience and the templates to incorporate threat modeling best practices in their daily work. The students will be challenged to perform the threat modeling in groups of 3 to 4 people performing the different stages of threat modeling on:
- B2B web and mobile applications, sharing the same REST backend
- An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service
After each hands-on workshop, the results are discussed, and the students receive a documented solution.
Security Shepherd
Want to learn the basics of Web App pen testing? Or would you prefer to develop new advanced pen testing tricks? Join the us for the lightning Security Shepherd Web Application training session that will bring attendees up to speed on all the latest and greatest security testing techniques that are a concern in the industry today. Compete against other participants and solve increasingly complex security puzzles derived from real world security threats. Attendees will leave with a real familiarity of web application pen testing best practice, terminology, workflow's and commonly used tool kits.
Prerequisites
A Laptop Capable of Connecting to Internet on the day You should have Java, Java Installed, OWASP ZAP / Burpsuite Downloaded or Installed, Firefox is the browser of choice.
O-saft
The use of SSL/TLS to protect the transport of data has become very common today. On the other hand it does not work pretty 'out of the box'. Furthermore it has more and more secuirty issues. As a consequence it often does not protect as assumed. It is often difficult to understand, what are the root causes of the issues, and how to detect and
finally avoid or fix them.
This training will give a brief introduction to SSL, how it works i. g., what issues are related to the protocol, the PKI used, and the known vulnerabilities including potential attacks and provide tools to check for these issues. The main focus will be on SSL/TLS used in HTTPS. Other usages i.e. SSL for SMTP are a small subset. As a round-up there will be recommendations how to configure and maintain TLS securely.
Course Topics
The main part of the course will be a hands-on-training showing by example how to check the established TLS/SSL connection (including ciphers) to a web server and show how to analyse the provided certificate. Various tools will be explained. It will be demonstrated how these tools can be used to detect weaknesses in the TLS/SSL connection and such.
The explained tools are for example: openssl, sslscan, testssl.sh, o-saft, and some more, as well as some online checking tools like ssllabs.com. We show what are these tools useful for, what they can do, and what they cannot. Finally we show how the OWASP tool o-saft can be used to cover most of the previous shown techniques and how to use its advanced features like:
- checking for ciphers
- checking for special SSL settings
- check multiple servers at a time
- customizing the results
- customizing o-saft itself
- or simple debugging of various SSL connection problems.
The purpose of this course is to provide a tool set for checking TLS/SSL to the participants, and teach the participants how and when to use which tool, and why some tools do not provide complete results (e.g. protocols, ciphers). The course is about analysing TLS/SSL from a client-site view. It will not go into the details of fuzzing or even breaking TLS/SSL, or exploiting vulnerabilities. Mostly we will analyse HTTPS, furthermore we will provide some examples for protocols using STARTTLS, too (e.g. SMTP).
Additionally it will give system architects, administrator, or operational people, hints how to set-up and configure TLS/SSL in a proper secure way.
Technical requirements
The participants should bring their own laptop with any operating system (recommended is Linux) and at least following tools installed:
- openssl (1.0.1e or newer)
- perl (5.8 or newer), on windows system Strawberry perl is recommended
- Net::SSLeay (1.53 or newer), IO::Socket::SSL (1.37 or newer)
- Tcl (8.5) optional, on a windows system ActiveTcl (8.6) is recommended
- python (2.7) optional
Optional, for smooth testing, a local SSL-enabled (SSLv2, SSLv3, TLS) web server should be running on the laptop (i.e. OWASP-BWA).
Trainers
Martin Knobloch
Martin is Principal Consultant at Nixu BeNeLux (https://www.nixu.com/en/nixubenelux). His main working area is (software) security in general, from awareness to implementation. In his daily work, he is responsible for education in application security matters, advise and implementation of application security measures. In2006, Martin got involved in OWASP when attending his first OWASP conference. He became a member of the OWASP Netherland Chapter board in 2007. He has contributed to several OWASP projects and is co-organizer of the OWASP BeNeLux-Day conference since 2008. Martin has been chair of the Global Education Committee from 2008 until the ending of the Global Committees. Futher, Martin is the conference chair of the OWASP AppSec-Eu/Research 2015 conference in Amsterdam, the Netherlands and involved in the AppSec-Eu 2016 among other activities as CfT Co-Chair. Martin is a frequent speaker at universities, hacker spaces and various conferences.
Sebastien Deleersnyder
Sebastien Deleersnyder, managing partner and application security consultant at Toreon will share his practical threat model experience. Sebastien led engagements in the domain of ICT-security, Web and Mobile Security with several customers including BNP Paribas Fortis, Atos Worldline, KBC, Nationale Nederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post , Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, served as vice-chair of the global OWASP Foundation Board and performed several public presentations on Web Application, Mobile and Web Services Security. Furthermore, Sebastien co-founded the yearly BruCON conference.
Pol Mac Cana
Paul is currently working as a Security Technical Team Lead and has over 6 years experience in infoSec. He has contributed to the OWASP Security Shepherd Project since its inception and has given training session utilising the tool to universities and educational bodies for a number of years. He received his MSc. in Information Security and Digital Forensics from ITB in Dublin
Torsten Gigler
Torsten Gigler is Internernal Security Advisor in a large scale enterprise >15 years (ICT-Infrastructure- and Application Security). He has been volunteering for OWASP since more than 3 years: since 2 years co-developer of O-Saft, contributed to the Transport Layer Protection Cheat Sheet (Cipher Section), project leader 'OWASP Top 10 für Entwickler' / OWASP Top 10 for Developers, contributed to the German translation of OWASP-Top-10 2013, supported the Top_10_2013-Project: Review, Wiki.
Conferenceday is March 18th
The conference will take place at Maison du Savoir, 3rd floor, room 3.540.
Agenda
Time | Speaker | Topic | Presentation |
---|---|---|---|
08h30 - 09h10 | Registration | ||
09h15 - 10h00 | Julie Gommes | Gamers, You're the new Botnets | Download PDF |
10h00 - 10h45 | Stefan Burgmair | OWASP Top 10 Privacy Risks | Download PDF project website |
10h45 - 11h15 | Morning Break | ||
11h15 - 12h00 | Erik Poll | LangSec meets State Machines | Download PDF |
12h00 - 12h45 | Arne Swinnen | The Tales of a Bug Bounty Hunter | Download PDF |
12h45 - 13h45 | Lunch | ||
13h45 - 14h30 | Glenn Ten Cate & Riccardo Ten Cate | OWASP Security Knowledge Framework (SKF) | Download PDF project website |
14h30 - 15h15 | Kevin Allix | Challenges in Android Malware Detection | Download PDF |
15h15 - 15h45 | Break | ||
15h45 - 16h30 | Christian Schneider & Alvaro Muñoz | Serial Killer: Silently Pwning your Java Endpoints | Download PDF |
16h30 - 17h15 | Michael Hamm | Experiences with Paste-Monitoring | Download PDF |
17h15 - 17h30 | OWASP Benelux 2016 organization | Closing Notes |
Talks
Gamers, You're the New Botnets
Downloading, playing, downloading, playing, downloading, playing, downloading, playing, downloading, playing... that is really funny. You can try new games every day but the guys who share those games are not just happy and funny people doing that just for pleasure to share "games". Yeas, they're sharing games, but lot of other Tools they enjoy to play with... Let's talk about malwares, about botnets, about backdoors and about some computer which can win a "botnet award".
OWASP Top 10 Privacy Risks
There are lively discussions about how to protect personal data especially with the upcoming EU Data Protection Regulation that requires Privacy by Design. But still there was no independent description of privacy risks specifically for web applications available. Thus, companies lack guidance to identify and avoid privacy risks during systems development. Therefore the OWASP Top 10 Privacy Risks project developed a list of the top 10 privacy risks in web applications. The project covers technical and organizational aspects like missing encryption or insufficient transparency and results and practical countermeasures are presented in this session.
LangSec meets State Machines
Language-theoretic Security, or LangSec for short, provides useful insights into the root causes of an important class security flaws - namely flaws in handling input - and ways to avoid these. This talk will discuss the core ideas of LangSec and the relation with security research we have done at over the years, where we used state machines as a means to systematically investigate GSM, bank cards, internet banking tokens, and TLS.
The Tales of a Bug Bounty Hunter
Bug bounty hunting is the new black! During this technical talk, several interesting vulnerabilities identified in Instagram, the increasingly-popular photo-based social media platform, will be presented.
All vulnerabilities were disclosed responsibly via Facebook’s Public Bug Bounty program over the course of 2015 and 2016, and will be discussed in detail. Required advanced Mobile Security attack techniques for this Research, such as Binary Modification, Dynamic Hooking and Burp Suite Plugin Development will be covered, among other trickery.
The most interesting vulnerabilities were hybrid: Combinations of complementary vulnerabilities in different environments (e.g. Web and Mobile). All identified issues’ root causes will be mapped onto the Software Development Life Cycle (SDLC), to analyze where they could have been prevented from materializing. Last but not least, the monetary rewards offered by Facebook for each vulnerability and general Bug Bounty Hunting advice will be shared with the community.
OWASP Security Knowledge Framework
Over 10 years of experience in web application security bundled into a single application.
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team.
Use SKF to learn and integrate security by design in your web application.
SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing
you how to prevent hackers gaining access and running exploits on your application.
We will be talking about:
- Training your developers in writing secure code
- Security support pre-development (Security by design, early feedback of possible security issues)
- Security support post-development(Double check your code by means of the OWASP ASVS checklists )
- Code examples for secure coding
Challenges in Android Malware Detection
What is the state of Malware detection for Android? This talk will present a landscape of Android Malware and techniques used to (try and) detect Malware, with a focus on the limitations of the state-of-the-art detection methods.
Serial Killer: Silently Pwning your Java Endpoints
In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees. The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application. The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start. Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process.
Experiences with Paste-Monitoring
Paste platforms like Pastebin.com provide the possibility to store and share text online. Often this kind of services are used by programmers but also abused by attackers to present their achievements. CIRCL acts as a fire brigade and monitor several of those paste platforms to early detect potential incidents and help the victims. The findings vary from lists of vulnerable or compromised websites, leaked credentials, database dumps, opportunistic announcements, stolen credit card details and many more. We will present the used techniques, and some key experiences with the findings and introduce the AIL framework - Framework for Analysis of Information Leaks. AIL is designed to analyse unstructured data and identify potential data leaks.
Speakers
Julie Gommes
Julie Gommes is a cybersecurity contractor, working in Paris on risk analysis, Security gap analysis, Security in project management, Audit, CISO support. She is also trainer for exposed professionals (journalists, lawyers, HR, employees of NGOs ...). https://fr.linkedin.com/in/juliegommes; Twitter : @JujuSete
Stefan Burgmair
Stefan Burgmair is a German security and privacy consultant at msg systems in Munich. He wrote his Master Thesis in information systems and management about the “Top 10 Privacy Risks for Web Applications” and continues to deliver key content for the project.
Erik Poll
Erik is Associate Professor in the Digital Security group of the Radboud University in Nijmegen. His research interests include smart cards, security protocols, the security of payment systems and smart grids, and formal methods that can improve security by providing a rigorous basis for design, analysis, andtesting.
Arne Swinnen
Arne Swinnen is an IT Security Consultant at NVISO, a Belgian Cyber Security Consulting firm. Arne specializes in Application Security and Digital Forensics. He co-organized the first edition of the Cyber Security Challenge Belgium in 2015, a National cyber security competition designed exclusively for Belgian students.
Arne was a speaker at Black Hat USA and BruCON in 2014, presenting novel anti-virus detection and evasion techniques (“One Packer to Rule Them All”). Since 2015, he is also listed on Facebook’s Bug Bounty Half of Fame.
Glenn Ten Cate
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security.
His goal is to create an open-source software development life cycle with the tools and knowledge gathered over the years.
Riccardo Ten Cate
As a developer and penetration tester Riccardo specialises in web-application security and
has extensive knowledge in securing web applications in multiple coding languages.
Kevin Allix
After a Master degree obtained in 2007, Kevin Allix held operational positions for four years during which he deployed and ran network security equipments for dozens of customers, and built tools to help administrate one of the biggest french Video-on-Demand platform. In 2011, he joined the University of Luxembourg to start a PhD at the 'Centre for Security, Reliability and Trust'. He is now a Research Associate at SnT - uni.lu where he keeps focusing on Android malware detection.
Christian Schneider
Christian Schneider (@cschneider4711) writes software since the nineties, works as a freelance software developer since 1997, focuses on Java since 1999 and on IT-Security - especially Pentesting - since 2005. He enjoys writing articles about web application security as well as speaks and trains at conferences (OWASP AppSecEU, JAX, WJAX, WebTechCon, DevOpsCon, HackPra, RSA). He blogs at Christian-Schneider.net
Alvaro Muñoz
Alvaro Muñoz (@pwntester) works as Principal Security Researcher with HPE Security Fortify. He enjoys researching different programming languages and web application frameworks for vulnerabilities and unsafe APIs. Before joining the HPE research team, he worked as an Application Security Consultant helping enterprises to start and improve their application security programs. He blogs at pwntester.com
Michael Hamm
Works since 2000 in the field of security and since 2010 as CIRCL Operator.
Social Event,starting at 7PM
- 7 Avenue du Rock'n'Roll
- L- 4361Esch/Belval
- Au rez-de-chaussée du Plaza I, sortie Rockhal
- Phone: +352 26573281
Become a sponsor of OWASP BeNeLux
Donate to OWASP BeNeLux
Promotion
Feel free to use the text below to promote our event!
We invite you to our next OWASP event: the BeNeLux OWASP Days 2016! The good news: free! No fee!
The bad news: there are only 150 seats available (first register, first serve)!
Hosted and co-organized by
Made possible by our Sponsors