Difference between revisions of "AppSecAsiaPac2013"

Dissecting Smart Meters

Justin Searle

The Smart Grid brings greater benefits for electric utilities and customer alike, however these benefits come at a cost from a security perspective. This presentation will explore the architecture of most Smart Meters, the protocols they use, a breakdown of their embedded components, and the functionality their headend servers contain. We'll explain the methodologies we've developed to perform penetration testing these AMI systems, enumerate the types of vulnerabilities we commonly find, and discuss the solutions we recommend to Smart Meter vendors. We will even demonstrate at least one of the attacks we commonly perform in our penetration tests. This will be done without the FUD and over-hyped framing that we usually find in the media and other Smart Grid presentations.

The Droid Exploitation Saga

Aditya Gupta & Subho Halder

n this talk, we will be discussing about the recent trends in Android Security Exploitation, as well as we will be carrying out all the possible attacks using a framework which we've designed called as Android Framework for Exploitation.

We will show how easy it could get to break into any Android Device, either using any exploit, or creating a malware using AFE. Also, in case the malware gets detected by any of the anti malwares, you 'll have the option to make it Fully Undetectable again and again, using the framework.

The things you would be able to steal with the help of AFE-created malwares, aren't limited to Contacts, Call Logs or Text messages, but you could also steal the application specific information (contained within the database files or saved using Content Providers).

We will be covering each topic with live demonstrations and will also discuss the case studies of vulnerabilities in some of the most popular android applications.

Invisibility Purge – Unmasking the Dormant Events of Invisible Web Controls – Advanced Hacking Methods for Asp.Net, Mono and RIA

Shay Chen

Web Controls have become common in many popular platforms, enhancing the software lifecycle by speeding up development, and enabling developers to reuse custom content.

In platforms such as ASP.Net and Mono, the implementations of Web controls are packed with features that can enhance the security of applications, usually with minimum effort.

There are many ways to restrict the access to web controls, including privilege validation, deletion from pages that were duplicated for low privileged users, disabling controls, or even by making them invisible to anyone but users with pre-defined roles.

However, the event activation mechanism can also be a double-edged sword.

Invisibility, by definition, is in the eyes of the observer.

An object might be invisible to some eyes, while still being visible to instruments that were designed to locate it.

A new research reveals several methods that attackers can harness to unmask, enumerate and activate events of hidden web controls, even in popular platforms such as ASP.Net and Mono.

The slightest mistake or the right conditions can make this development model a fertile ground for attacks, enabling the attacker to completely ignore the security features of controls, and gain access to restricted and dormant server side events.

Locating invisible controls, Unmasking hidden events and activating them in-spite of various default and custom security measures – once only in theory, and now a step by step methodology that could be performed manually, or using designated tools.

This presentation will demonstrate several methods that can be used to locate invisible web controls, unmask secret events and activate dormant code. It will also discuss designated modules which are embedded into the upcoming release of the Diviner extension, an extension of the OWASP ZAP proxy project.

OWASP AppSensor the future of Application Security

Dennis Groves

The OWASP AppSensor is commonly described as an application layer intrusion detection system. However, it is far more that this. It is also an architecture design pattern, as well as a development practice and an operations methodology. I propose the following outline for my talk:

1. (describe) I will describe what OWASP AppSenor is and why you would want one.
2. (design) I will give a brief talk about the principles of secure architecture and design.
3. I will give a brief history of IDS and NIDS, their strengths and weaknesses.
4. I will then discuss how how and where AppSensor fits into that history, and how it improves upon the past for example:
5. (development) The concept in implementation is roughly analogous to an intrusion detection (and prevention) system in the network security world. However, this concept can be applied inside of an application in a more specific way that (importantly) reduces false positives, which is an issue that often plagues network intrusion detection systems. This means that the core of the AppSensor system performs detection, monitoring, and (possibly) response depending on configuration settings.
6. (deployment) I will the discuss deployment and operation of AppSensor.
7. I will then describe why I believe this is the most important development in application security, and why everbody will develop software this way by the end of the decade.
8. I will then propose future developments and enhancements for the OWASP AppSensor

Putting Security within the SDLC via Application Threat Modeling

Tony UV

As delusions of effective risk management for application environments continue to spread, companies continue to bleed large amounts of security spending without truly knowing if the amount is warranted, effective, or even elevating security at all. In parallel, hybrid, thought provoking security strategies are moving beyond conceptual ideas to practical applications within ripe environments. Application Threat Modeling is one of those areas where, beyond the hype, provides practical and sensible security strategy that leverages already existing security efforts for an improved threat model of what is lurking in the shadows.

This presentation seeks to walk though practical applications and exercises associated with application threat modeling. Integration to multi-security focused disciplines will be included, such as dynamic analysis, static analysis, incident monitoring, vulnerability management, social engineering, penetration testing, and more.

The objective of the presentation is to illustrate the efficiency and effectiveness of application threat modeling in properly integrating and leveraging security information in order to evolve beyond a broken risk analysis model for application security today. The PASTA (Process for Attack Simulation & Threat Analysis) methodology will be introduced as part of this talk.

The target audience will encompass motley of both IS and IT professional, ideally providing a cross section of developers, project managers, system administrators, quality assurance engineers, security analysts, pen testers, network engineers, security risk analysts, and even compliance professionals. Due to the level of depth to be covered in the presentation which will go over Data Flow Diagramming, Application Decomposition exercises, correlation to existing frameworks such as Building Security-In Maturity Modeling, Software Assurance Maturity Modeling, and more.

Securing data with a Data Encryption Infrastructure

Arshad Noor

As companies are challenged to keep up with an increasing number of data-security regulations worldwide, encryption of sensitive data has become the universal ""safe-harbor"", the last bastion of defense against unauthorized disclosure of data, mandated or highly recommended in every regulation.

While the protection of structured data-elements such as Credit Card Numbers, Bank Account numbers, etc., is addressed by applications on a case-by-case basis, we are entering an era where unstructured sensitive data are becoming equally attractive targets. Military documents, medical data, blueprints of new products, financial and legal documents, etc. are just as valuable as credit card numbers to attackers depending on their motiviation and backers.

While it is feasible for companies to address the protection of such documents on a case-by-case basis, it is far more effective to deploy a ubiquitous network service that addresses all of the following requirements:

• Provide a single point/protocol for commuication to the service (much like DNS or DHCP);
• Is accessible to any platform or programming environment;
• Provides automated scheduling of cryptographic operations (synchronous and asynchronous);
• Provides automated key-management (generation, escrow, recovery, etc.);
• Auto-scales cryptographic capability to address peaks/valleys of processing loads;
• Integrates with existing Identity and Access Management (IAM) infrastructure;
• Integrates with existing public/private Cloud services;
• Provides load-balancing and is highly-available; and
• Meets regulatory requirements of any data-security regulation anywhere.

While sounding more like a pipe-dream, this paper presents a case-study of a real-world implementation of such a network service to protect structured and unstructured content worth hundreds of millions of dollars, for one of the largest e-commerce companies in the world.

The Regulatory Compliant Cloud Computing (RC3) - a web-application architecture for secure cloud-computing - was presented at OWASP AppSec APAC 2012 in Sydney by this author, where it was fairly well received (to the best of my knowledge). RC3 is gaining attention worldwide, with IBM having translated the paper into Chinese, Portuguese and Russian for the BRIC markets on its developerWorks web-site (http://ibm.co/rc3dw), and the paper presented at various other conferences around the world (after AppSec APAC 2012).

This paper continues the discussion to present, for the first time, a real-world RC3 implementation, and discusses how the experience can be leveraged by others to address data-protection requirements. It will include details of the architecture, technology components (FOSS), and performance data to support the tenets described in the original RC3 paper from 2012.

Using the Wisdom of the Crowd to Enhance Application Security

Moshe Lerner

Security-oriented source code analysis tools detect vulnerabilities only for well-defined hacks and tend to return many results which are hard to remediate. Two problems result: One, how can we overcome the lack of coverage? And two, how can we improve the ability to fix?

These problems are all the more pressing considering today’s short development cycles through Agile methodologies, the ever-increasing requirement for continuous deployment and large applications containing vast amounts of source code. In these environments, automation and accuracy are absolute necessities in order to achieve high rates of vulnerability detection and furthermore, taking the right preventive actions.

To address these challenges our research turned to the field of Big Data analysis to integrate their advanced technologies into our research. In this talk we present our research methodology and findings. In particular, we show how to:

1. Adopt new technologies from the Big Data realm - used to locate required data and enable proper call for action – and apply them into source code analysis
2. Identify security vulnerabilities through code irregularities using the Wisdom of the Crowds (large scale apps reference)
3. Optimize vulnerability remediation of large result sets using smart graph methods that pinpoint vulnerability junctions and best-fix locations

Web Security - New Browser Security Technologies

Tobias Gondrom

This is cutting edge and will talk about new browser security technologies that have recently been developed and/or will be coming up in the coming months to counter risks that became apparent from the current trust model used in browsers. This will be improving channel protection and enabling better protection against XSS, Clickjacking and XSRF.

In the recent months global standard developing bodies and the browser vendors have in a joined effort developed and implemented many new major security capabilities in the browsers allowing web application developers to counter common security problems with comprehensive new mechanisms. This talk will be talking about:

• Channel protection: Securing SSL against Man-in-the-middle-attacks: New technologies - HTTP Strict Transport Security and and Pinning of Certs
• Protection against XSS and clickjacking: the future of X-Frame-Options and the Content Security Policy

The presented technologies are cutting edge and although some parts of the specifications are not final yet, they will be rolled-out in about 6 months time.

OWASP Project Track Talks

OWASP AppSensor the future of Application Security

Dennis Groves

The OWASP AppSensor is commonly described as an application layer intrusion detection system. However, it is far more that this. It is also an architecture design pattern, as well as a development practice and an operations methodology. I propose the following outline for my talk:

1. (describe) I will describe what OWASP AppSenor is and why you would want one.
2. (design) I will give a brief talk about the principles of secure architecture and design.
3. I will give a brief history of IDS and NIDS, their strengths and weaknesses.
4. I will then discuss how how and where AppSensor fits into that history, and how it improves upon the past for example:
5. (development) The concept in implementation is roughly analogous to an intrusion detection (and prevention) system in the network security world. However, this concept can be applied inside of an application in a more specific way that (importantly) reduces false positives, which is an issue that often plagues network intrusion detection systems. This means that the core of the AppSensor system performs detection, monitoring, and (possibly) response depending on configuration settings.
6. (deployment) I will the discuss deployment and operation of AppSensor.
7. I will then describe why I believe this is the most important development in application security, and why everbody will develop software this way by the end of the decade.
8. I will then propose future developments and enhancements for the OWASP AppSensor

Using ESAPI for Java to Build Secure Web Applications

Jim Manico

We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Organizations around the world rely on web security services to maintain the safety of their websites in today’s hostile online environment. Website developers must also learn to code in a secure fashion to have any chance of providing organizations with proper defenses in the current threat-scape. The session will provide specific tips and guidelines to make website code both low risk and less vulnerable using the OWASP ESAPI for Java project.

AppSec APAC 2013 will be held at the Hyatt Regency in Jeju, South Korea.

Conference Registration is now open! Click Here to Register.

OWASP AppSec Asia Pacific features two days of training February 19-20, and two days of talks, February 21-22, 2013

Please note - all prices below appear in USD; however arrangements can be made for payment in South Korean Won.

We are looking for sponsors for 2013 edition of Global AppSec APAC.

If you are interested to sponsor Global AppSec APAC 2013, please contact the conference team: [email protected]

Sponsorship Deadline is January 15, 2013.

To find out more about the different sponsorship opportunities please check the document below:
OWASP AppSec APAC 2013 Sponsorship Options - English
OWASP AppSec APAC 2013 Sponsorship Options - Korean

For assistance with booking a flight or hotel, feel free to utilize OWASP's preferred travel agency:
Segale Travel Service contact information is: +1-800-841-2276
Sr. Travel Consultants:
Maria Martinez...ext 524
Linn Vander Molen...ext 520

Additionally, the Conference Planning Team is available to answer any questions!

To book a room at the special rate:
*Add the room to your online conference registration or
*Complete the Hotel Booking Form and fax or email to the address on the form.  

We will be hosting a networking dinner with Korean-style food and beverages on Thursday evening, February 21 from 7:00pm to 9:00 pm at the Hyatt Regency Jeju.

The cost of this dinner is approximately 53,000 KRW ($50 USD) and can be added to your online conference registration.

Do you want to volunteer for AppSec APAC 2013? Click here to sign up

Contact us at [email protected]