Difference between revisions of "BeNeLux OWASP Day 2011"

Revision as of 21:06, 28 November 2011

Welcome

Venue is the University of Luxembourg (Grand Duchy of Luxembourg)

Training and conference location, together with hotel information, can be found here.

Training and first list of conference speakers are announced!

See here and here

Tweet!

Event tag is #owaspbnl11

Registrations are open:

Training, December 1st

Registration starts at 9h00

Training will start at 10h00 and we plan to stop at 17h00

The training room is: Paul Feidert (for details, check the venue tab)

OWASP Training: Secure Application Development, by Eoin Keary

Abstract: Writing Secure code is the most effective method to securing your web applications. Writing secure code takes skill and know-how but results in a more stable and robust application and assists in protecting an organisations brand. Application security is not commonly a part of many computer science curricula today and most organizations have not focused on instituting a culture that includes application security as a core part of their software development training efforts. This intensive one-day course focuses on the most common web application security problems, including aspects of both the OWASP Top Ten (2010) and the MITRE Top 25. The course will introduce and demonstrate application assessment techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities in their code.

This course includes coverage of the following areas:

Unvalidated Input
Injection Flaws, OS commanding, SQL Injection
Cross-Site Scriping & Client-side security
CSRF/XSRF
Authentication & Session Management
Access control & Authorisation
Broken Caching
Error Handling & Resource Management
The Secure SDLC
Fuzzing, Proxy use and testing approach

Hands on Exercises

To cement the principles discussed, students can participate in a number of hands-on security testing exercises where they attack a live web application (i.e., OWASP Bank etc) that has been seeded with common web application vulnerabilities.

The students will use proxy tools commonly used by the hacker community to complete the exercises. Students need to bring their own windows based laptop to participate in the exercises. Wireless capability is recommended.

Audience

Developers who want to understand the most common web application security flaws, and how to avoid them and code in a secure manner.

Level: Beginner/Intermediate

Prerequisite: Basic knowledge of a web programming language like Java or .NET recommended but not required.

Bringing your own windows based laptop is recommended so you can participate in the hands on exercises

Trainer Bio:

Eoin Keary is a Global OWASP board member since 2009. He is a long time member of OWASP and have contributed year on year to OWASP projects and the OWASP mission of fighting the causes of software insecurity. He is based in Dublin, Ireland and director of Bccriskadvisory.

Conference, December 2nd

We are pleased to announce the list of confirmed speakers:

Brenno De Winter (Journalist) From DigiNotar to Leaktober
Koen Vanderloock (Lead Security Competence Group at Cegeka) on the new OWASP Simba project
Justin Clarke (Director and Co-Founder of Gotham Digital Science Ltd) on practical crypto attacks against web applications
Lieven Desmet (Research Manager at University Leuven) on HTML5 security
Andrey Belenko (Chief Security Researcher at ElcomSoft Co. Ltd) on iOS data protection internals
Alexandre Dulaunoy (Incident Management - Security Research at CIRCL) on dynamic malware analysis
Ludovic Petit (Group Fraud & Information Security Adviser at SFR, Vodafone Group) on WebApp Security and legal and regulatory aspects
Jean-Marc Bost and Sébastien Bischof (ELCA) on The limits of e-banking
Yves Le Traon on security testing for web apps (talk will be held on the Training Day)
Seba Deleersnyder & Eoin Keary (OWASP Board) on OWASP Update

Stay tuned for the final agenda!

Agenda ' (program has slightly changed !)

Time	Speaker	Topic
08h30 - 9h30	Registration
09h30 - 9h40	OWASP Benelux Organization & Thomas Engel	Welcome
09h40 - 10h00	Sebastien Deleersnyder & Eion Keary	OWASP update
10h00 - 10h40	Brenno De Winter	From DigiNotar to Leaktober
10h40 - 11h00	Break
11h00 - 11h40	Justin Clarke	practical crypto attacks against web applications
11h40 - 12h20	Andrey Belenko	Overcoming iOS Data Protection to Re-Enable iPhone Forensics
12h20 - 13h00	Koen Vanderloock	OWASP SIMBA - guarding your applications
13h00 - 14h00	Lunch
14h00 - 14h40	Ludovic Petit	Do you... Legal?
14h40 - 15h20	Thierry Zoller	The rise of the Vulnerability Market
15h20 - 16h00	Jean-Marc Bost & Sébastien Bischof	The limits of e-banking
16h00 - 16h20	Break
16h20 - 17h00	Alexandre Delaunoy	Dynamic malware analysis
17h00 - 17h40	Lieven Desmet	HTML5 security
17h40 - 18h00	OWASP Benelux 2011 organization	Closing notes

From DigiNotar to Leaktober

Web application security is hard. With Lektober, Brenno shows that to the general public. Privacy is at stake, not only in the Netherlands. Brenno will reveal some of the more "interesting" leaks.

Brenno J.S.A.A.F. de Winter

Brenno De Winter started experimenting with security at the age of 9. He has a background in open source that dates back to 1993 and he contributed to several projects like MySQL, GnuPG, Gnucomo (Gnu Computer Monitoring) and recently started the Small Sister-project for privacy-friendly internet usage. In his daily job he practices security,teaches it and works as an IT-journalist. His writings have triggered several debates in parliament and often raises questions.

OWASP SIMBA - guarding your applications (by Koen Vanderloock, Leader Security Competence Group at Cegeka)

SIMBA (Security Integration Module for Business Applications) is a OWASP project that provides you with a User Access Management system that can be integrated with any business application. The purpose of SIMBA is to secure an application fast and easy. Because SIMBA itself is generic it can be customized for every project. Many features are customizable e.g. designing your own authentication chain is easy and fast by using existing or newly created building blocks. SIMBA contains authentication, authorization, session management and a GUI to manage your security information.

Koen Vanderloock, Leader Security Competence Group at Cegeka

Koen Vanderloock is the leader of the security competence group at Cegeka. About 2 years ago Cegeka decided to create a sandbox for investigating security issues and solutions so they could be included in the current projects. Koen Vanderloock is a Java developer with 8 years of experience and started exploring the world of security 3 years ago when UAM problems started to occur.

Practical Crypto Attacks Against Web Applications (by Justin Clarke, Director and Co-Founder of Gotham Digital Science Ltd)

The science of cryptography underpins many of the information security technologies we use on a daily basis, such as the ability to keep information confidential and to ensure we can identify who we are communicating with. However, it is a very complex subject area with many types of mistakes that can reduce the overall security of a solution. A number of these types of mistakes can be identified by a tester, if they know what they're looking for, but in general it isn't a well tested area.

This talk is intended to provide a high level overview of some of the areas where cryptographic operations such as encryption and hashing can provide far less security than was planned, and concrete examples of how these were found and exploited. Examples will include discussion and demonstration of the recently patched cryptographic padding attack against the Microsoft .NET framework (affecting ASP.NET applications) caused by a design error in how ASP.NET handles some types of encrypted data, but we will also be looking at some other fun areas including bit flipping attacks, ECB mode attacks, and some miscellaneous hashing algorithm attacks against common web application implementations.

Justin Clarke, Director and Co-Founder of Gotham Digital Science Ltd

Justin is a Director and Co-Founder of Gotham Digital Science and an experienced software security consultant with extensive international Big 4 risk management, security consulting and testing experience. He is the lead author/technical editor of "SQL Injection Attacks and Defenses" (Syngress 2009), co-author of "Network Security Tools" (O'Reilly 2005), contributor to "Network Security Assessment, 2nd Edition" (O'Reilly 2007), as well as a speaker at various security conferences and events such as Black Hat, EuSecWest, ISACA, BruCON, OWASP, OSCON, RSA and SANS. He is currently the OWASP London chapter president, and a member of the OWASP Global Connections Committee. On 10 Oct 2011, at 09:33, Seba wrote:

HTML5 security (by Lieven Desmet, Research Manager at Katholieke Universiteit Leuven)

In this talk, Lieven will highlight the results of the HTML5 security analysis, conducted by the DistriNet Research Group (K.U.Leuven). The security analysis of next generation web standards, commissioned by ENISA, looked into 13 emerging W3C web standards (i.e. the specification of HTML 5 and some of the associated APIs), and assessed the security of each of them as well as the overall security and consistency across specifications.

In total 51 security threats and issues have been identified, and detailed in the ENISA report (http://www.enisa.europa.eu/html5). During the talk, Lieven will discuss the methodology developed to assess the huge amount of specifications, and zoom into a representative set of identified threats and their remediation.

Lieven Desmet, Research Manager at Katholieke Universiteit Leuven

Lieven Desmet is the Research Manager on Secure Software at the Katholieke Universiteit Leuven (Belgium), where he coaches junior researchers in web application security and participates in dissemination and valorization activities. His interests are in software verification and security of middleware and web-enabled technologies. Lieven is actively engaged in OWASP and is board member of the OWASP Chapter Belgium.

Overcoming iOS Data Protection to Re-Enable iPhone Forensics (by Andrey Belenko, Chief Security Researcher at ElcomSoft)

Data protection is a feature available for iOS devices (iOS 4 and up) with hardware encryption: iPhone 4S, iPhone 4, iPhone 3GS, iPod touch (3rd generation or later), and all iPad models. Introduction of this feature had complicated iPhone forensics process because now (almost) all files on user partition are encrypted and physical dumps are of much less value to examiners: while the filesystem seems to be intact, actual file contents are encrypted and are not suitable for analysis.

This talk will provide in-depth information about iOS Data protection internals and on the implication it had on iOS forensics. More specifically, it will cover the following:

System keys and their hierarchy
Device passcode and its recovery
Escrow keys
Filesystem encryption
Keychain encryption

Presentation will start by providing attendees with required background on iOS encryption keys architecture: system keys, passcode key, escrow key. After attendees are familiar with those concepts, presentation will continue to filesystem and keychain encryption details and to the techniques that can be used to overcome the hurdles imposed by iOS Data Protection.

Andrey Belenko, Chief Security Researcher at ElcomSoft

Chief security researcher and software developer at Elcomsoft. Co-invented ThunderTables (which are improved RainbowTables) and was first to bring GPU acceleration to password recovery. M. Sc. IT and CISSP.

LinkedIn: http://ru.linkedin.com/in/belenko

Twitter: @andreybelenko

Do you... Legal? (by Ludovic Petit, Group Fraud & Information Security Adviser at SFR, Vodafone Group)

The OWASP core mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. However, if you do not pay enough attention to many aspects of Legal compliance, you'll see why Web Application Security is somehow linked to Legal and Regulatory aspects as well as... Corporate Responsability, so yours. Who is accountable for what, what about each other's responsibility? Nowadays, the legal constraints oblige us to comply via technical means, whatever the local framework, and this is specially true for Web Application Security, many sensitive informations having to be handled through these web interfaces. A such, what do you think about your Security Policy compliance with your local Legal framework? Compliant? Sure? Really? Interesting isn't it? Let's have a talk about this.

Ludovic Petit, Group Fraud & Information Security Adviser at SFR, Vodafone Group

Ludovic is an internationally recognised information security expert with over 25 years experience. Last 15 years spent in various Corporate Management positions covering both Technical and Law Enforcement expertise dedicated to Mobile Telecommunications Fraud and Security in multi-national corporations.

Ludovic is Chapter Leader & Founding Member OWASP France and an active contributor to OWASP in several roles and projects.

LinkedIn Profile: http://www.linkedin.com/in/lpetit

Dynamic Malware Analysis or How to Play in the House of Horrors (by Alexandre Dulaunoy, Incident Management - Security Research at CIRCL)

Malware reversing is a time consuming task. Many approaches are available to dissect and analyse suspicious binaries. Dynamic malware analysis is one of the option to better understand them and also a nifty companion to static analysis. The current dynamic malware analysis techniques will be presented especially the ones relying on instrumented operating system systems (from the filesystem to the network stack). You'll see a wandering through common and less common malware partially analysed using dynamic analysis and how dynamic malware analysis can help you.

The limits of e-banking (by Jean-Marc Bost and Sébastien Bischof, ECLA)

The swiss german TV channel SF1 showed a footage on swiss e-banking security. The TV show follows a team of the ETH who earned a special authorization to test several e-anking platforms. After admitting that a personal computer can be infected by different means (actually 5% of the tested PCs are infected according to Microsoft), The team from Zürich showed the limits of the different platforms. Only the bank who signs each transaction is labelled as safe. We will come back during the presentation on the nature of the threat.
First of all, we will explain how famous malwares such as Zeus and SpyEye manage to steal from their victims without them being able to notice anything. Then we will see that e-banking is not the only target, as a matter of fact, the reality is far from this.
And then we will comment the most recent techniques that allow malwares to escape Antivirus and Antimalware programs even if they are up to date. We will vulgarize several concepts such as DKOM and bootkits in order to let everybody have a glimpse on the danger they represent.
Finally, we will think about if signing each transaction can efficiently fight off these threats. In fact, when attacks are coupled with Social Engineering, they have potentially no limit. Zeus is a living proof of this fact, because it even managed to attack the transaction validation system by SMS. As a conclusion, we will see that the e-banking platform that managed to resist the tests of the ETH team is vulnerable to such kind of attacks.

Jean-Marc Bost, ELCA

Jean-Marc Bost leads the security division at ELCA.
He is in charge of the various security solutions proposed by ELCA, some being released by ELCA, others being provided by partner vendors.
With a significant experience in the development of internet applications, he focused 10 years ago on their need for security.
Since then, he has been very active in :
- demonstrating the threats, in particular for ebanking
- conceiving practical and patented solutions for strong authentication, online transactions, electronic signature and secured documents
- presenting the findings of the security division in security events and through expert talks

Sébastien Bischof, ELCA

Sébastien Bischof works in the security division at ELCA Where he is specialized in OS-level and communication security.
As a major result, he developped a fully-working proof-of-concept of an attack against a sophisticated USB token for safe-browsing.
He obtained his Master of Science in Engineering at HEIG-VD/HES-SO with a strong emphasis on IT Security.
During his education, he focused on obfuscation and rootkit techniques.
Computer security enthusiast, he is very interested in hackings events such as Insomni'hack and keeps himself informed on the latest threats throuhg active participation in security forums.

Security testing: a key challenge for software engineering of web apps (by Yves Le Traon, UdL)

While important efforts are dedicated to system functional testing, very few works study how to specifically and systematically test security mechanisms. In this talk, we will present two categories of approaches. The first ones aim at assessing security mechanisms compliance with declared policies. Any security policy is strongly connected to system functionality: testing function includes exercising many security mechanisms. However, testing functionality does not intend at exercizing all security mechanisms. We thus propose test selection criteria to produce tests from a security policy. Empirical results will be presented about access control policies and about Android apps permission checks.

The second ones concern the attack surface of web apps, with a particular focus on web browser sensitivity to XSS attacks. Indeed, one of the major threats against web applications is Cross-Site Scripting (XSS) that crosses several web components: web server, security components and finally the client’s web browser. The final target is thus the client running a particular web browser. During this last decade, several competing web browsers (IE, Netscape, Chrome, Firefox) have been upgraded to add new features for the final users benefit. However, the improvement of web browsers is not related with systematic security regression testing. Beginning with an analysis of their current exposure degree to XSS, we extend the empirical study to a decade of most popular web browser versions.The results reveal a chaotic behavior in the evolution of most web browsers attack surface over time. This particularly shows an urgent need for regression testing strategies to ensure that security is not sacrificed when a new version is delivered.

In both cases, security must become a specific target for testing in order to get a satisfying level of confidence in security mechanisms

Yves Le Traon, UdL

Yves Le Traon is professor at University of Luxembourg in the domain of software engineering, reliability, validation and security. He is also a member of the Interdisciplinary Centre for Security, Reliability and Trust (SnT), where he leads the research group SERVAL (SEcuRity and VALidation of services and networks). His research interests include software testing, design for security, security testing, model-driven validation, model based testing, web application, mobile computing.

Professor Le Traon received his engineering degree and his PhD in Computer Science at the “Institut National Polytechnique” in Grenoble, France, in 1997. From 1998 to 2004, he was an associate professor at the University of Rennes, in Brittany, France. He is the co-founder of the Triskell INRIA team, which focuses on innovating design, modeling and testing techniques, such as Model-driven Engineering. During this period, Professor Le Traon studied design for testability techniques, validation and diagnosis of object-oriented programs and component-based systems. From 2004 to 2006, he was an expert in Model-Driven Architecture and Validation in the EXA team (Requirements Engineering and Applications) at “France Télécom R&D”. In 2006, he became professor at Telecom Bretagne (Ecole Nationale des Télécommunications de Bretagne), where he pioneered the application of testing for security assessment of web-applications, P2P systems and the promotion of intrusion detection systems using contract-based techniques.

CTF

Do you like puzzles? Do you like challenges? Are you a hacker?

Whether you are an old hacker or new enthusiast you should come to OWASP BeNeLux days 2011 and participate in the Capture the Flag event December 2nd 2011 at the University of Luxemburg.

The OWASP CTF is especially designed to support challengers of all skill levels. The CTF contains multiple challenges in various fields related to application security. As every challenge gains you one point, you can pick and choose which challenge you want to play.

All you need is a laptop with a wifi card and your favorite (preferably) non-commercial tools.

So come to Luxemburg, show off your skills, learn new tricks and above all have a good time at the CTF event.

Registration

The training day and the conference are free!

To support the OWASP organisation, consider to become a member, it's only US$50!
Check out the Membership page to find out more.

Venue

University of Luxembourg
Campus Kirchberg
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
http://wwwen.uni.lu/contact/campus_kirchberg
Room: Paul Feidert

Parking:

There is a public parking close to the conference venue. Click here to find the parking on Google Maps

Hotels nearby:

The first hotel is at 5 minutes on walk distance from the campus Kirchberg: Hotel d’Coque

single room with breakfast 77.50 €
double room with breakfast 93.00 €.
Booking email address with Ref. OWASP_SNT 2011 to : [email protected]
Reservation deadline: 20 October 2011

Second hotel (direct center of Luxembourg) 5/10 minutes with taxi or bus: Hotel Parc Bellevue

single room with breakfast 95.00 € (normal price 160 €)
double room with breakfast 115.00 € (normal price 180€)
wifi and parking included
Booking email address: [email protected]
Reservation deadline : 30 November
Reservation form: download form

Third hotel (near the Parc Bellevue): Hotel Plaza

single room with breakfast 130.00 € (normal price 225 €)
double room with breakfast 150.00 € (normal price 245€)
wifi and parking included
Booking email address: [email protected].
Reservation deadline: 30 November
Reservation form: download form

Fourth hotel: Hotel Mélia

single room with breakfast 140.00 €
Booking email address: [email protected]
Reservation deadline: 28 October 2011
Reservation form: download form

Organisation

The BeNeLux Day 2011 Program Committee:

Martin Knobloch / Ferdinand Vroom (OWASP Netherlands)
Bart De Win / Sebastien Deleersnyder (OWASP Belgium)
Jocelyn Aubert / Andre Adelsbach (OWASP Luxembourg)
Steven van der Baan (Capture The Flag)

Local organization:

Thomas Engel
Radu State
Magali Martin
Aurel Machalek

Sponsorship

Contact seba <at> owasp.org for sponsorship

<paypal>BeNeLux OWASP Day 2011</paypal>

Social Event

The social event is scheduled for Thursday, 1st of December, 19:00 at

Agua De Côco
2, rue Emile Mousel
L-2165 Luxembourg

(find the location on Google Maps)

Remark: split bill system - everyone has to cover own food & drinks.

Promotion

Feel free to use the text below to promote our event!

We invite you to our next OWASP event: the BeNeLux OWASP Days 2011!

Free your agenda on the 1st and 2nd of December, 2011.

The good news: free! No fee!

The bad news: there are only 160 seats available (first register, first serve)!

PROGRAM Day 1

10:00 AM - 18:00 PM: OWASP Training Day
19:00 PM - ?: Social event

OWASP Training: Secure Application Development, by Eoin Keary
This intensive one-day training focuses on the most common web application security problems, including aspects of both the OWASP Top Ten (2010) and the MITRE Top 25. The training will introduce and demonstrate application assessment techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities in their code.

PROGRAM Day 2

10:00 AM - 18:00 PM: OWASP Conference

List of confirmed speakers (more to be announced soon):

Brenno De Winter (Journalist) on the Diginotar story
Koen Vanderloock (Lead Security Competence Group at Cegeka) on the new OWASP Simba project
Justin Clarke (Director and Co-Founder of Gotham Digital Science Ltd) on practical crypto attacks against web applications
Lieven Desmet (Research Manager at University Leuven) on HTML5 security
Andrey Belenko (Chief Security Researcher at ElcomSoft Co. Ltd) on iOS data protection internals
Alexandre Dulaunoy (Incident Management - Security Research at CIRCL) on dynamic malware analysis
Ludovic Petit (Group Fraud & Information Security Adviser at SFR, Vodafone Group) on WebApp Security and legal and regulatory aspects
Seba Deleersnyder & Eoin Keary (OWASP Board) on OWASP Update

ORGANIZATION
OWASP's all-volunteer participants produce free, professional quality, open-source documentation, tools, and standards on application security. An example of this is the famous OWASP top ten of most critical web application security flaws. The OWASP community facilitates conferences, local chapters, articles, and message forums. Participation in OWASP is free and open to all, as are all the materials we produce.

WHO should attend?
Anyone interested in Web Application Security (management, security professionals, developers, students, etc). OWASP Belgium, Netherlands and Luxembourg chapters membership is free. All meetings are free. There are never vendor pitches or sales presentations at OWASP meetings.
Check our chapter page http://www.owasp.org/index.php/Belgium on meeting details, sign up to the chapter mailing list and introduce yourself.
Check our chapter page http://www.owasp.org/index.php/Netherlands on meeting details, sign up to the chapter mailing list and introduce yourself.
Check our chapter page http://www.owasp.org/index.php/Luxembourg on meeting details, sign up to the chapter mailing list and introduce yourself.

WHEN
Thursday and Friday, 1st and 2nd of December, 2011 (10 AM - 7 PM)

WHERE
University of Luxembourg
Campus Kirchberg
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
http://wwwen.uni.lu/contact/campus_kirchberg
Room: Paul Feidert

Attention: make sure to book your hotel in time, it will be difficult to find rooms in Luxembourg around Dec 1-2!
Hotel details https://www.owasp.org/index.php?title=BeNeLux_OWASP_Day_2011#tab=Venue

REGISTRATION
Only 160 places, please Register upfront: http://owaspbenelux2011.eventbrite.com !
All latest details are available on http://www.owaspbenelux.eu
Hope to see you all!

The BeNeLux Program Committee,

Martin Knobloch / Ferdinand Vroom, OWASP Netherlands
Bart De Win / Sebastien Deleersnyder, OWASP Belgium
Jocelyn Aubert / Andre Adelsbach, OWASP Luxembourg
Steven van der Baan, OWASP CTF Project

Kindly supported by the Interdisciplinary Centre for Security Reliability and Trust

Thomas Engel
Radu State
Magali Martin
Aurel Machalek

Hosted and co-organized by:

Made possible by our sponsors:

@@ Line 91: / Line 91: @@
 ! Time !! Speaker !! Topic
 |-
-| 08h30 - 9h30 || "Registration" ||
+| 08h30 - 9h30 || ''Registration'' ||
 |-
 | 09h30 - 9h40 || OWASP Benelux Organization & Thomas Engel|| Welcome