Difference between revisions of "Boston"

Latest revision as of 17:29, 6 July 2019

OWASP Boston

Welcome to the Boston chapter homepage. Follow @OWASPBOSTON on Twitter. The chapter leader is Jim Weiler. The Boston chapter is grateful for support from Constant Contact, Salesforce, Microsoft and Akamai for generously hosting space and their hospitality for various events.

The Chapter would also like to thank our sponsors for their generous support.

Participation

OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.

Sponsorship/Membership

to this chapter or become a local chapter supporter. Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member?

Chapter Sponsor

Boston Application Security Conference

BASC 2019, the Boston Application Security Conference will take place 8:30am to 6:30pm on Saturday, October 19th at Microsoft, 5 Wayside Road, Burlington, MA. Read more

Chapter Meetings --- Our Fifteenth Year

We now use meetup to organize meetings.

We meet whenever a speaker and a venue have available dates, 6:30 to 9 pm.

Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. You can join the OWASP Boston Google group at https://groups.google.com/a/owasp.org/forum/#!forum/boston-chapter. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers.

Upcoming Meetings

May 22, 2019 - Watertown CMD+CTRL Web App Hacking Cyber Range 6:00-9:00pm  Partnered w/Security Innovation & Athenahealth

YOU CAN ONLY REGISTER ON THE SECURITY INNOVATION REGISTRATION SITE AT THIS LINK

Location: Athena Health Watertown

6PM *sharp*- Just bring your computer and evil inner-doer and you are ready to roll!

Want to test your skills in identifying web app vulnerabilities?  Join OWASP Boston, Athena Health and Security Innovation as members compete in CMD+CTRL, a web application cyber range where players exploit their way through hundreds of vulnerabilities that lurk in business applications today.  Success means learning quickly that attack and defense is all about thinking on your feet. Standard capture the flag using network and operating attack skills will not be much use here; understanding the OWASP Top 10 risks will help you find the vulnerabilities.

For each vulnerability you uncover, you are awarded points. Climb the interactive leaderboard for a chance to win prizes! CMD+CTRL is ideal for development teams to train and develop skills, but anyone involved in keeping your organization’s data secure can play - from developers and managers and even CISOs.

Just bring a laptop. Pizza and soda will be provided.

Venue/Location of the event:

Athena Health 311 Arsenal St. Watertown, MA 02472

• 

  Athenahealth Watertown Map

NOTE: Park in only P2 visitor lot or in garages P1 and P3. Parking is free.

The main lobby door is at “S1” shuttle pickup icon.

Enter the lobby and sign in at the front desk to pick up credentials.

Directions to the event room will be provided at that time

Upcoming Training

TBD

Past Meetings

January 29th, 2019 - Cambridge Partnered with Security Innovation

Location: Quick Base office

5PM- Just bring your computer and evil inner-doer and you are ready to roll!

Security Innovation is teaming up with OWASP Boston to offer attendees a fun "find the vulnerabilities" game - CMD+CTRL Cyber Range - that shows how hackers break into websites and teaches the importance of secure coding habits.

The CMD+CTRL Cyber Range we will be using is called ShadowBank, a banking website where players compete to find vulnerabilities, score points, and move up the leaderboard. Leveraging cheat sheets, attack tables, and expert led training sessions, platers take their shot at stealing money, manipulating share prices, and conducting other nefarious acts.

June 14th, 2017 - Burlington Meetup

Location: SalesForce (was Demandware) 5 Wall St., Burlington, MA

Everyone should report to Akamai 90 Broadway in the lobby and indicate about the Meetup. Someone form the staff will escort them to the 12th floor.

5:30 - 6:15 - Chat, Chew and Brew

6:15 - 6:45 News, Announcements

Chapter and OWASP events and news, audience announcements, questions, application security news(Google and Symantec certs, HTML5, Chrome features, SDLC and Microservices, others?)

7:00 pm Is RASP Ready?

Runtime Application Self-Protection is overhyped, according to many analysts and pundits. RASP promises applications that protect themselves - which sounds impossible - how can an application possibly protect itself? An agent that sits inside the app sounds like a deployment nightmare at worst, and a drain on the app at best. What’s the reality? Where are we now and what have we learned?

We’ve seen deployment successes and failures, and we will draw from those specific experiences to describe: Where does RASP work?

• What applications are well-suited for RASP?
• What types (organizational structure, culture, or skillset) of organizations are well-suited for RASP?

What is the reality of RASP?

• Is RASP a deployment model or a feature set?
• How mature is RASP? Is it an over-hyped immature space, enterprise-ready, or somewhere in between?
• Which RASP capabilities do organizations use? And how do they validate those capabilities in their own environments?
• Can RASP replace the WAF?

We will conclude, not with a sales pitch, but some lessons learned on: the three must have attributes for RASP, some suggestions on good candidates for RASP – both types of teams and types of applications, and finally - if, how, and when to get started.

Speaker: Michael Feiertag, CEO and Co-Founder, tCell Before co-founding tCell at the end of 2014, Michael led a string of successful products – most recently as head of products at Okta, and prior to that, as technology director at Blue Coat. Prior to Blue Coat, Michael held product management, engineering, and sales positions at several start-ups. Michael holds a B.S. from The University of Chicago, and an M.S. from the University of Maryland

May 2, 2017 - Burlington Meetup

Location: SalesForce (was Demandware) 5 Wall St., Burlington, MA

Everyone should report to Akamai 90 Broadway in the lobby and indicate about the Meetup. Someone form the staff will escort them to the 12th floor.

5:30 - 6:15 - Chat, Chew and Brew

6:15 - 6:45 News, Announcements

Chapter and OWASP events and news, audience announcements, questions, application security news(Google and Symantec certs, HTML5, Chrome features, SDLC and Microservices, others?)

6:50 pm Random Number Generation - Lava Lamps, Clouds, New Standards and the IoT - Richard Moulds

The SANS Institute recently listed "Weak random number generators" as one of the 7 most dangerous security techniques to watch in 2017. But how do you really know how good your random numbers are? Virtualization and IoT make things worse and new standards are a wake-up call. Random numbers are the basis of security for all cryptography, yet they are often taken for granted. Without entropy, crypto is just math.  

Learn why random numbers are so hard to generate and validate, compare different technologies in use today across virtualized environments, and discuss operational steps to take the risk out of random numbers and help secure cryptosystems even into the era of quantum computers.

Speaker: Richard Moulds, General Manager of Whitewood Security, has spoken at RSA 2017 and at several OWASP chapter events in New York, Chicago and Austin. Richard has over 20 years of experience in the area of cryptography and encryption.

November 2, 2016 - Cambridge Meetup

Location: Akamai at 90 Broadway, Cambridge, MA 02142 (down the street from the usual location)

Everyone should report to Akamai 90 Broadway in the lobby and indicate about the Meetup. Someone form the staff will escort them to the 12th floor.

6:30 News, Announcements

7:00 'Advanced Persistent Legal Threats - William Gamble, JD, LLM, EMBA

Abstract: Good cyber security can protect IT infrastructure against many attacks. Because of the difficulty in monetizing cyber thefts, the direct loss of a breach can be limited. However, the legal costs, both from government agencies and plaintiffs, can be far greater. The legal landscape, both in the US and internationally is changing as fast if not faster than the technology.

Bio: I am a lawyer and a member of the Florida Bar.I used to practice tax, securities and banking law. I have written three books and spoken around the world on the economic efficiency of legal and regulatory infrastructures specifically in emerging markets like China. Over the past two years, I have immersed myself in cyber security. I now hold the CompTIA A+, Network+, and Security+. I will take the CASP next month. Besides keeping up with the regulations, I am studying incident response and auditing. I am also working toward my health care law certification. My hero is Dr. Johannes Ullrich.

September 28, 2016 - Burlington - Meetup

Location: Demandware at 5 Wall St., Burlington, MA

6:00 News, Announcements

6:15 OWASP Top 10 #1 - Injection Flaws

Jim Weiler will discuss XML External Entity Injection flaws; how it works, how to prevent, code examples.

6:45 'From the Frontlines of RASP Adoption - Goran Begic, VP of Product, IMMUNIO

Runtime Application Self-Protection (RASP) is one of the newest technologies coined by Gartner and it is in early stages of adoption in the industry. It promises dynamic defense and automatic mitigation of vulnerabilities in web applications.

This presentation is a summary of experiences from several dozens of commercial evaluations and early adoptions in production that took place this year and provides some examples of situations and challenges that are not specific to any individual vendor. In this talk Goran will provide an overview of buying criteria and evaluation requirements across different industries and some typical pitfalls that can slow down adoption.

After the introduction and a brief reminder on the technology Goran will invite audience to participate in discussion about organizational requirements for adoption and operationalization of RASP.

Questions for discussion:

My application is under attack.

• What actions should I take?
• Who owns the response?
• Which attacks should I respond to and which ones can I ignore?
• How to get started with mitigation provided by technology?
• Does RASP fit with DevOps?
• Does RASP help with remediation?

What this presentation is not: This is not a product pitch in any way. Evaluation criteria, comparison of RASP with IAST and other security technologies, personal experiences and examples discussed in this talk are generally applicable to all RASP solutions.

Key takeaways:

At the end of the presentation you will:

• get a better understanding of requirements for evaluation of RASP and its use cases,
• if you can pull a successful evaluation alone, or if you will need participation of other groups / teams
• learn about critical criteria for success of RASP in production
• how this criteria different relative to appsec testing tools.

September 7, 2016 - Cambridge - Meetup

Location: Akamai at 150 Broadway, Cambridge, MA 02142 (aka 8 Cambridge Center)

6:30 News, OWASP tools, documents review

7:00 Docker Containers and Application Security - Tsvi Korren

Docker containers are transforming the way applications are developed and deployed. Closely tied to DevOps and Continuous Delivery, containers introduce both risks and opportunities to security management in Web applications. This talk will introduce the basic concepts of containers, how companies use them today and how to support this technology while elevating the security posture of your application stacks.

Tsvi Korren, CISSP, has been an enterprise IT professional for 20 years with background in business process consulting in large organizations. Most recently at CA Technologies, he worked across verticals in government, retail, financial institutions and healthcare to implement compliance and security processes, from Identity and Access to Host and Server Controls. Tsvi is currently the director of technical services at Aqua, concentrating on building bridges between DevOps and Security.

June 8, 2016 - Burlington - Meetup

Location: Demandware at 5 Wall St., Burlington, MA

6-6:30 News, announcements, job postings, etc.

6:30-7 Introduction to SQL Injection - Jim Weiler

7:00 Computer Science Curricula’s Failure - What Should We Do Now? - Ming Chow & Roy Wattanasin

We are still facing the same security vulnerabilities from over a decade ago. The problems are not going away anytime soon and a reason is because Computer Science curricula are still churning out students who are not even exposed to security. This talk will address the lack of emphasis on information security in Computer Science curricula, how CS curricula have an obligation, how to gradually fix the problem by integrating security into many Computer Science undergraduate and graduate classes, and success stories from students. This talk will also discuss what Tufts and Brandeis are currently working on to further address the security education problem by creating a joint cyber security and policy program that spans multiple departments. Additional points and feedback from the audience are encouraged to help with the issue. All are encourage to attend to submit your feedback to help!

Presenters:

Ming Chow - @0xmchow

Ming Chow is a Senior Lecturer at the Tufts University Department of Computer Science. His areas of work are in web and mobile engineering and web security. He was a web application developer for ten years at Harvard University. Ming has spoken at numerous organizations and conferences including the High Technology Crime Investigation Association - New England Chapter (HTCIA-NE), the Massachusetts Office of the Attorney General (AGO), John Hancock, OWASP, InfoSec World, DEF CON, Intel, SOURCE Conference, and BSides Boston. He was a mentor for a Proving Ground speaker at BSides Las Vegas in 2014 and 2015.

Roy Wattanasin - @wr0

Roy Wattanasin is an adjunct faculty at Brandeis University in both the Health and Medical Informatics and Information Security graduate programs. He spends most of his time leading, teaching and developing information security programs, finding vulnerabilities, performing incident response and working on many projects. Roy has spoken at many conferences including RSA, ISSA International, Source Conference, Braintank, Cyber Security World, OWASP and the Security BSides conferences. He is also a healthcare information security professional. He was a mentor for a Proving Ground speaker at BSides Las Vegas in 2015.

May 4, 2016 - Cambridge - Meetup

Location: Slightly different Akamai location: 90 Broadway, Cambridge, MA 02142 between Meadhall and the Mariott

6:30 News, OWASP tools, documents review

7:00 The ABCs of Source-Assisted Web Application Penetration Testing With OWASP ZAP - Dan Cornell

There are a number of reasons to use source code to assist in web application penetration testing such as making better use of penetration testers’ time, providing penetration testers with deeper insight into system behavior, and highlighting specific sections of so development teams can remediate vulnerabilities faster. Examples of these are provided using the open source ThreadFix plugin for the OWASP ZAP proxy and dynamic application security testing tool. These show opportunities attendees have to enhance their own penetration tests given access to source code.

This presentation covers the “ABCs” of source code assisted web application penetration testing: covering issues of attack surface enumeration, backdoor identification, and configuration issue discovery. Having access to the source lets an attacker enumerate all of the URLs and parameters an application exposes – essentially its attack surface. Knowing these allows pen testers greater application coverage during testing. In addition, access to source code can help to identify potential backdoors that have been intentionally added to the system. Comparing the results of blind spidering to a full attack surface model can identify items of interest such as hidden admin consoles or secret backdoor parameters. Finally, the presentation examines how access to source code can help identify configuration settings that may have an adverse impact on the security of the deployed application.

Dan Cornell is a globally recognized application security expert, Dan Cornell holds over 15 years of experience architecting, developing and securing web-based software systems. As the Chief Technology Officer and a Principal at Denim Group, Ltd., he leads the technology team to help Fortune 500 companies and government organizations integrate security throughout the development process. He is also the original creator of ThreadFix, Denim Group's industry leading application security program management platform. Cornell was Principal Investigator as Denim Group researched and developed the Hybrid Analysis Mapping (HAM) technology that lies at the heart of ThreadFix, through a Small Business Innovation Research (SBIR) contract with the Department of Homeland Security's Science and Technology Directorate.

More information at: http://www.denimgroup.com/about_team_dan.html

April 6, 2016 - Cambridge - Meetup

Location: Akamai at 150 Broadway, Cambridge, MA 02142 (aka 8 Cambridge Center)

6:30 News, OWASP tools, documents review

7:00 Runtime Application Self-Protection (RASP) Tools - Kunal Anand

This talk will highlight the latest in AppSec and dive into a different kind of solution called Runtime Application Self-Protection (RASP). We'll also explore a new methodology called language theoretic security (LANGSEC) and explain how it can outperform existing approaches like pattern matching, regular expressions, etc. This talk will lay the foundation via informal and formal theory how lexers, tokenizers and parsers work. We’ll move onto constructing an open source toolchain to analyzing data and exploring interactive data visualizations. Along the way, we’ll cover performance tradeoffs and discuss the challenges of modern application security.

Kunal Anand is the co-founder and CTO of Prevoty, a runtime application security platform. Prior to that, he was the Director of Technology at the BBC Worldwide, overseeing engineering and operations across the company’s global Digital Entertainment and Gaming initiatives. Kunal also has several years of experience leading security, data and engineering at Gravity, MySpace and NASA’s JetPropulsion Laboratory. His work has been featured in Wired Magazine and Fast Company. Kunal received a B.S. from Babson College.

Past Training

March 16, 2016 - Burlington - Meetup

Location: Demandware, Burlington.

6:00 News, OWASP tools, documents review

6:30 Software Security by the Numbers - Chris Eng

Deep dive into data we’ve collected about the state of software security in 2016

• Based on scans of 200,000+ applications over an 18-month period
• How different industries and programming languages compare to one another
• Vulnerability remediation habits and patterns
• Three characteristics of a successful AppSec program

Chris Eng is vice president of research at Veracode. In this role, he leads the team responsible for integrating security expertise into all aspects of Veracode’s technology. Throughout his career, he has led projects breaking, building, and defending web applications and commercial software for some of the world’s largest companies. Chris is a frequent speaker at premier industry conferences, where he has presented on a diverse range of topics, including cryptographic attacks, agile security, mobile application security, and security metrics. He has been interviewed by Bloomberg, Fox Business, CBS, and other media outlets worldwide.

January 26, 2016 - Waltham - Meetup

Location: Constant Contact, Waltham. Trapelo Rd. exit from Rt. 128, toward Lincoln. The parking lot entrance is on the right, at the first traffic light. Drive around to the front of the office complex, facing the highway. Enter under the clock tower. Park in the front of the building and enter in the main building lobby, continue down the hallway and you will see the innovation center, enter in the large glass doors.

7:00 News, OWASP tools, documents review

7:20 What Security Testing Tools Miss

Black Duck Software presents - Static analysis, dynamic analysis, and other testing tools are all essential weapons against adversaries. But for the 80%+ of companies worldwide that use open source software in their application development these tools are ineffective in identifying and mitigating open source security risks . This presentation will cover:

The value of static and dynamic tools, and where they best fit in the Secure Development Lifecycle

Why these tools are not useful in identifying known vulnerabilities in open source components

Controls development and security professionals can deploy to select, detect, manage and monitor open source for existing and newly disclosed vulnerabilities

Food will be provided by Constant Contact.

November 2015 - Cambridge - Meetup

When: Wednesday, November 4, 6:30 pm

Location: Akamai at 150 Broadway Cambridge, MA 02142 (aka 8 Cambridge Center)

6:30 News, views, announcements, conversation

7:00 Interactive Discussions (Come and ask your questions!)

Attendee interaction is always mentioned as a high value at meetings and was great at the MetroWest meetings, so we're doing that at Akamai this month. Some discussion starters so far: SSL certificate impacts from CA/Browser alliance decisions and SHA1 weakness; mutual (client) SSL, javascript client and server side; what the heck is threat intelligence, dev ops and faster secure SDLC.

July 2015 - Metrowest

When: Wednesday, July 20, 7:00 pm

Location: Constant Contact, Innovation Center, Reservoir Place, 1601 Trapelo Road, Waltham, MA 02451

7:00 News, views, announcements, conversation

7:30 Access in Maliceland - Risk Based Access Control - Gunnar Peterson

John Lambert observed attackers win because while defenders think in lists, attackers think in graphs. Access control systems divide the system a priori into secure and insecure states. But that’s only worth the paper its printed on. A Attackers see the system as it is, for attackers, the access control scheme is the beginning of the game not the end. Determined attackers seek out access control models and then find holes that they can leverage. Access control systems that purport to protect the system are built on assumptions from which reality diverges. Application security needs a new approach to access control- adding feedback loops for risk based decisions, fine-grained, dynamic access control.

Security is a business with a very long list of issues and requirements. The spreadsheets are miles long. This makes it essential to find reusable solution patterns that can address multiple problems.This presentation looks at both medium term improvements and code examples to improve access control decisions and overall security today

Gunnar Peterson (@oneraindrop) focuses on security architecture consulting and training. Experience includes Associate Editor for IEEE Security & Privacy Journal, a Microsoft MVP for App security, an IANS Research Faculty member, a Securosis Contributing Analyst, and a Visiting Scientist at Carnegie Mellon Software Engineering Institute. He maintains a popular information security blog at http://1raindrop.typepad.com.

July 2015 - Cambridge

When: Wednesday, July 8, 6:30 pm NOTE: It's the second Wednesday this month.

Location: Akamai at 8 Cambridge Center in Cambridge, MA

6:30 News, views, announcements, conversation

7:00 Interactive Discussions (Come and ask your questions!)

June 2015

When: Wednesday, June 3, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

6:30 News, views, announcements, conversation

7:00 Put Down the Megaphone: Effective Security Advocacy Without the Shouting - Darren Meyer

10 years’ experience in the InfoSec community--including work with organizations in many verticals, in sizes ranging from startups to Fortune 50 enterprises, leading Application Security teams, building and delivering security instruction to developers, managers, and InfoSec professionals—has taught me the importance of crafting advocacy for different audiences. In this talk, I share my experiences in learning to be an effective advocate with three key audiences: developers, management, and non-technical staff.

Darren is an Application Security advocate and researcher, technology hobbyist, and maker. He loves to learn, teach, nerd out, and inflict terrible puns on people. His background includes logistics, software development, and an assortment of information security roles including leading AppSec programs and professional security instruction targeting developers, managers, and InfoSec professionals.

May 2015

When: Wednesday, May 6, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

6:30 News, views, announcements, conversation

7:00 How the crowd is discovering critical vulns missed by traditional methods - Leif Dreizler

State of the art security programs are turning to bug bounties to leverage a vast array of skill-sets and knowledge. Learn why these programs work, when to deploy them, and how you can bring these new application security testing capabilities into your own organization. The speaker will discuss real world examples from bug bounties and focus on cases where business logic flaws and high priority vulnerabilities were found ... even with existing security testing processes in place.

Attendees will learn:

Testing methods deployed by our crowd that help them find bugs the scanners miss

Examples of the high quality of bugs our crowd is finding, including P1'sTrends which vulnerability types are found most often and whyWhat is the ROI on the pay for performance modelWhere does the SDLC merge into crowdsourced testing

Leif Dreizler is a Senior Security Engineer at Bugcrowd, the innovator in crowdsourced security testing for the enterprise. Prior to joining Bugcrowd, Leif was a Senior Application Security Engineer at Redspin, performing application security assessments. During his time at Redspin he also served as the Application Team Lead, liaising with clients at the engineering and sales level. He has also made minor contributions to the Firebug project. Leif attended the University of California, Santa Barbara where he studied Computer Science. Leif recently spoke to the NYC Security Meet-up group.

April 2015

When: Wednesday, April 1, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

6:30 News, views, announcements, conversation

Jim Weiler Will show some actual examples and patterns of SQL Injection attempts

7:00 Are You An Imposter? Me too! - Patrick Laverty

Many people in the information security field feel like a fraud, or an imposter. In reality, we often know far more, and are capable of far more than we believe we do. There is so much to know and we constantly hear about the latest groundbreaking research done by others, which makes us feel less important or worthy. Let’s talk about what Imposter Syndrome is, its prevalence, and then we can start to realize just how capable we are and go forward with the confidence in the field.

March 2015

When: Wednesday, March 4, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

6:30 News, views, announcements, conversation

7:00 Prioritizing Web Application Vulnerabilities – A Hacker’s Perspective - Nick Silver

The best application risk models capture not only the technical risk factors, but also the business context in which an asset lives. Traditionally, this is done by auditing application owners on an array of questions in order to properly classify the asset and its data – but that takes time which could be better spent elsewhere. We interviewed dozens of hackers and asked them which vulnerabilities they would look for first depending on the type of attack they wanted to carry out. We’ll walk through several examples of how to use this data as a shortcut means for prioritizing risk without the need for any pesky audit questionnaires.

Nick Silver is a Senior Solutions Architect with WhiteHat Security. He is responsible for translating business requirements into technical ones and assisting businesses in implementing web security programs. Previously, Nick led a team in WhiteHat’s Threat Research Center where they were responsible for testing more than 2,000 of their customers’ websites for vulnerabilities.

February 2015

When: Wednesday, February 4, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

6:30 News review, announcements - Jim Weiler

7:00 Incident Response and Web Application Security - Stories from the Trenches - Fred House and Joe Ceirante

Mandiant has conducted numerous incident response engagements throughout its history, including a record number of 200 incidents in 2014. Mandiant consultants Fred House and Joe Ceirante will discuss case studies and trends Mandiant has observed in relation to web application security.

Topics will include the types of threat actors that target web applications, the techniques they use to compromise web applications, and the activities they perform once inside the network. Techniques for detecting and mitigating web compromises will also be reviewed. All content will be derived from the real-world compromises that Mandiant has investigated.

January 2015

When: Wednesday, January 7, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

6:30 News review, risk analysis of Poodle - Jim Weiler

7:00 How a Hacker Views Your Web Site - Patrick Laverty

The most popular presentation of BASC 2014

As defenders, we have to be right 100% of the time where an attacker only needs to be right once. The attack surface of a modern web site is incredibly large and we need to be aware of all of it. Additionally, individual attacks may not always be effective but sometimes using them together can gain the desired effect. In this talk, we’ll take a look at the whole attack surface for a typical web site and the various ways that an attacker will use to compromise a site.

December 2014

When: Wednesday, December 3, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

6:30 News and Views You Can Use and Abuse - Jim Weiler

• Some thoughts and analysis on some current app security news and other stuff
• Adobe password breach
• Reducing Web Application Firewall SQL injection false positives

7:15 Swift and Security - Ming Chow

Apple is pushing its new programming language Swift for iOS development and for many good reasons. This talk will discuss what the language has right in terms of security, the old and new security pitfalls, and what developers need to be aware of moving forward with using the new language. The fact to the matter is, iOS isn't going away, iOS developers will need to learn and use Swift, and there will be a big rush of Swift-based apps: we might as well learn how to do it right the first time around.

Ming Chow is an Instructor at the Department of Computer Science, Tufts University. Ten years of web development experience. Specialties: Web and Mobile Development, Web and Mobile Security

July 2014

Topics: Grails Security and Validating Cross-Site Scripting Vulns with xssValidator

Presenters: Cyrus Malekpour and John Poulin

When: Tuesday, July 8, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

Topic 1: Grails Security

Grails is a framework developed for Groovy in the vein of Rails for Ruby. It provides a lot of features for web app security, but does it do enough? What might you need to implement yourself, and what might be provided? This presentation will discuss tips on securing Grails applications, including tools that the framework provides by default for security. It'll also discuss several shortcomings in the current toolset, and how you can avoid them.

Cyrus Malekpour (@cmalekpour) is currently interning at nVisium, working on web app development and security. He's currently an undergraduate student at the University of Virginia, where he's studying computer science with an emphasis on security and backend development.

Topic 2: Validating Cross-Site Scripting Vulns with xssValidator

xssValidator is a tool developed to automate the testing and validation of Cross-Site Scripting (xss) vulnerabilities within web applications. Automated scanners tend to report large amounts of false-positives, and as consultants we're forced spending our time trying to verify these findings. xssValidator leverages scriptable web-browsers such as PhantomJS and Slimer.js to automatically validate these findings.

John Poulin is an application security consultant for nVisium who specializes in web application security. He worked previously as a web developer and software engineer that focused on building multi-tier web applications. When he's not hacking on web apps, John spends his time building tools to help him hack on web apps! You can find him on twitter: @forced_request and on myspace: REDACTED.

June 2014

Topic: Training: SQL Injection and the OWASP Zed Attack Proxy (ZAP)

Presenters: Rob Cheyne and Jim Weiler

When: Wednesday, June 4, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

6:30 - general networking, news discussion, announcements.

7:00 - main presentations

The June 4th meeting will be the second in our series of 2014 training meetings. Rob Cheyne will continue explaining and exploring SQL Injection by conducting an actual injection attack.

This will be a demo-based discussion to get into the mindset of an attacker, and show how an attacker goes after a site. Demo will include:

• BurpProxy demo
• Common authentication flaws
• SQL Injection Demo that shows the process and how it builds to a full compromise

Rob Cheyne is currently CEO of Big Brain Security. In addition to security consulting for Fortune 500 customers, he was the author of LC4, a version of the award-winning L0phtCrack password auditing tool, and he also worked on the code scanning technology that was eventually spun off as Veracode. Rob was at @stake from the very first customer all the way through to the $50M acquisition by Symantec.

Jim Weiler will introduce the OWASP Zed Attack Proxy (ZAP). This is a very powerful free OWASP intercepting proxy that lets you see, analyze, change, replay etc. every browser request and response, analyze your session, scan and attack web sites, save the results and run reports. We can't cover all the functionality but we'll show some practical tips and techniques.

Pizza, salad and soda courtesy of Akamai

March 2014

Topic: Training: SQL Injection, WebGoat, Cross Site Request Forgery Presenter: Benjamin Lerner When: Wednesday, March 5, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

There will be three training sessions:

One will be on SQL Injection - intro, detection, prevention, scanning and false positives. This is the most serious web application vulnerability.

The second will be on OWASP WebGoat. WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. You can install and practice with WebGoat in either J2EE or in ASP.NET. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat applications. There are hints and 39 different lesson plans on various vulnerabilities and technologies. We won't cover all of them of course!

The third will be on Cross Site Request Forgery - not a hack really, it's just the way the web works. But it causes apps to do legitimate things that you didn't ask them to do.

Pizza and drinks provided by Akamai.

January 2014

When: Wednesday, January 8, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

Topic: JavaScript Verification: From Browsers to Pages

Modern web browsers implement a "private browsing" mode that is intended to leave behind no traces of a user's browsing activity on their computer. This feature is in direct tension with support for *extensions*, which let users add third-party functionality into their browser. I will discuss the scope of this problem, present our approach to verifying extensions' compliance with private browsing mode, and sketch our findings on several real, third-party extensions. I will then briefly describe the toolkit underlying our approach, and end with a sketch of a newer project, adapting this approach to the very different-seeming problem of statically catching errors when using the jQuery library.

Presenter: Benjamin Lerner

Benjamin Lerner has just completed a post-doctoral research position in the PLT group at Brown University, and is now a lecturer at Northeastern University. His research examines the challenges of analyzing client-side web programming, from the behavior of web pages down through the semantics of the browser. He received a PhD in Computer Science from the University of Washington in 2011, building a platform to analyze conflicts between browser extensions, and a B.S. in Computer Science and Mathematics from Yale University.

November 2013

When: Wednesday, November 6, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

Topic: Attacking iOS Applications

Slides: On slideshare

This presentation will cover the basics of attacking iOS applications (and their back ends) using a web proxy to intercept, modify, and repeat HTTP/HTTPS requests. (The proxy used during research was Burp; however, any HTTP intercepting proxy such as OWASP ZAP could be used) From setting up the proxy to pulling data from the backend systems, this talk will be a great primer for anyone interested in testing iOS applications at the HTTP protocol level. There will be a short (2 minute) primer on setting up the intercepting proxy, followed by three practical examples showing how to intercept data headed to the phone, how to modify data heading to the application server, and how to pull extra data from application servers to further an attack. All of these examples will focus on native iOS apps (Game Center and Passbook) and/or functionality (Passbook Passes).

Presenter: Karl Fosaaen

Karl is a senior security consultant at NetSPI. This role has allowed Karl to work in a variety of industries, including financial services, health care, and hardware manufacturing. Karl specializes in network and web application penetration testing. In his spare time, Karl helps out as an OPER at THOTCON and a swag goon at DEF CON.

October 2013

When: Wednesday, October 2, 6:30 pm

Location: Akamai at 8 Cambridge Center in Cambridge, MA

Topic: Abusing NoSQL Databases

The days of selecting from a few SQL database options for an application are over. There is now a plethora of NoSQL database options to choose from: some are better than others for certain jobs. There are good reasons why developers are choosing them over traditional SQL databases including performance, scalabiltiy, and ease-of-use. Unfortunately like for many hot techologies, security is largely an afterthought in NoSQL databases. This short but concise presentation will illustrate how poor the quality of security in many NoSQL database systems is. This presentation will not be confined to one particular NoSQL database system. Two sets of security issues will be discussed: those that affect all NoSQL database systems such as defaults, authentication, encryption; and those that affect specific NoSQL database systems such as MongoDB and CouchDB. The ideas that we now have a complicated heterogeneous problem and that defense-in-depth is even more necessary will be stressed. There is a common misconception that SQL injection attacks are eliminated by using a NoSQL database system. While specifically SQL injection is largely eliminated, injection attack vectors have increased thanks to JavaScript and the flexibility of NoSQL databases. This presentation will present and demo new classes of injection attacks. Attendees should be familiar with JavaScript and JSON.

Presenter: Ming Chow

Ming Chow (@tufts_cs_mchow) is a Lecturer at the Tufts University Department of Computer Science. His areas of work are in web and mobile engineering and web security. He teaches courses largely in the undergraduate curriculum including the second course in the major sequence, Web Programming, Music Apps on the iPad, and Introduction to Computer Security. He was also a web application developer for ten years at Harvard University. Ming has spoken at numerous organizations and conferences including the High Technology Crime Investigation Association - New England Chapter (HTCIA-NE), the Massachusetts Office of the Attorney General (AGO), John Hancock, OWASP, InfoSec World (2011 and 2012), DEF CON 19 (2011), the Design Automation Conference (2011), Intel, and the SOURCE Conference (Boston 2013). Ming's projects in information security include building numerous CTF challenges, Internet investigations, HTML5 and JavaScript security, and Android forensics.

September 2013 - Joint Meeting with Boston Cloud Services 

When: Tuesday, September 10, 6 pm

Location: Microsoft NERD Center (not our usual location)

Note: This is a joint meeting. Please register at the Boston Cloud Services meetup page if you plan to attend.

There will be two presentations at this meeting:

Topic: People Centric Security (PCS)

Presenter: Nick Stamos

People Centric Security (PCS) is a new security model, presented as part of Gartner's Maverick Research 2 year ago. PCS is well suited for Cloud Business/Consumer services such as Dropbox, Google Drive, SkyDrive, etc. PCS enables users to have what they desire, and provides enterprises what they require for data governance and compliance. Nick Stamos co-founded his fourth company, nCrypted Cloud in July of 2012. His past startups include Verdasys, Phase Forward (IPO FY2004, $685M Oracle Acquisition 2010), and Amulet. He studied at Tufts University where he received a BSEE and MSEE.

Topic: SSL Certs

Presenter: Jim Weiler

Practical experiences with issuing and risk assessing SSL certs for enterprise applications on a cloud provider: who creates the CSR, how do you protect the private key on the cloud server, certs on cloud provider managed load balancers vrs 3rd party managed app servers, roles and responsibilities of cloud IT, 3rd party developer IT, enterprise IT and service providers. Jim Weiler is Application Security Architect at Starwoods Hotels and the Chapter Leader of OWASP Boston.

July 2013 - Doubleheader!

Location: Akamai at 8 Cambridge Center in Cambridge, MA

When: Wednesday, July 10, 6:30 pm

Topic: RailsGoat

Presented by: Ken Johnson

Abstract: While working to secure rails applications in a truly Agile development environment, it became clear that the Rails and Ruby ecosystem needed attention from the security community in the form of free and open training, and the events that have transpired within the last few months have only reinforced that belief. RailsGoat is an attempt to bring attention to both the problems that most frequently occur in Rails as well as the solutions for remediation. To accomplish this, we've built a vulnerable Rails application that aligns with the OWASP Top 10 and can be used as a training tool for Rails-based development shops.

Topic: PhoneGap on Android

Presented by: Jack Mannino

Abstract: PhoneGap is a widely used framework that allows developers to rapidly build cross-platform mobile applications using HTML5, JavaScript, and CSS. Using PhoneGap plugins, developers can call native platform APIs from browser-like applications using JavaScript. This approach introduces vulnerabilities that are not typically as prevalent within native Android applications, warranting a fresh look at the way we view mobile applications. In this presentation, we will take a deep look at the Android implementation of the framework and we will examine the overall attack surface for applications. Real-world examples of vulnerable applications will be demonstrated as well in order to provide context, entertainment, and enjoyment.

About the Speakers:

Ken Johnson is the former Manager of LivingSocial.com's application security team where he built their security program before leaving for his true home as the CTO of nVisium Security, a VA-based application security company. Ken is the primary developer of the Web Exploitation Framework and contributes to other open source application security projects as often as time permits. He has spoken at AppSec DC 2010 and 2012, OWASP NoVA and Phoenix chapters, Northern Virginia Hackers Association (NoVAH) and is a contributor to the Attack Research team.

Jack Mannino is the CEO of nVisium Security, a VA-based application security company. At nVisium, he helps to ensure that large corporations, government agencies, and software startups have the tools they need to build and maintain successful security initiatives. He is an active Android security researcher/tinkerer, and has a keen interest in identifying security issues and trends on a large scale. Jack is a leader and founder of the OWASP Mobile Security Project. He is the lead developer for the OWASP GoatDroid project, and is the chairman of the OWASP Northern Virginia chapter.

June 2013

Topic: We see the future…and it isn’t pretty

Presented by: Andrea Mulligan, Sr. Director at Veracode

Location: Akamai at 8 Cambridge Center in Cambridge, MA

When: Wednesday, June 5, 6:30 pm

In this session Andrea presents research findings from the State of Software Security Report, which offers a before the breach look at security by examining the flaws commonly found in applications of all kinds. She will also examine what the research findings mean for security, predict how these flaws could cause history to repeat itself, and discuss how security pros can help change the future.

May 2013

Topic: Systems Thinking + Web Security

Presented by: Akamai