Difference between revisions of "OWASP New Zealand Day 2013"

Speakers List

Tom Eastman - Catalyst IT - Serialization Formats Aren't Toys

Abstract

Do you have an API? Do you accept input from users? Do you accept it in XML? What about YAML? Or maybe JSON? How safe are you? How sure are you? It's not in the OWASP Top 10, but you don't have to look far to hear stories of security vulnerabilities involving deserialization user inputs. Why do they keep happening?

In this talk I'll go over what the threat is, how you might be making yourself vulnerable and how to mitigate the problem. I'll cover the features (not bugs, features) of formats like XML, YAML, and JSON that make them surprisingly dangerous, and how to protect your code from them.

Because here's the thing: If you are using, say, a compliant, properly implemented XML parser to parse your XML, you are NOT safe. Possibly quite the opposite.

Speaker Bio

Tom is a senior Python developer and technical lead for Catalyst IT, New Zealand's largest company specialising in open source. Prior to that he worked as a developer and system administrator for the University of Otago Faculty of Medicine and as a Computer Science tutor for same.

Paul Haas - Security-Assessment.com - Improving XPath Injection with Binary Search Optimisations

Abstract

XPath injection is technique similar to SQL injection for attacking XML processors, however many people are unaware of the technique and exploitation vectors. This talk aims to expand awareness of both the risks and remediation path in addition to the introduction of a new technique to significantly improve reconstruction speed of the backend XML document. A brief primer to XPath injection will also be covered within the talk.

Speaker Bio

Paul Haas hails from California where the waves are better but the quakes are not. With over nine years of experience in professional hacking, he is currently working with Security-Assessment.com in Wellington to bring the good word of web hacks to Kiwis everywhere. His sole hobby is driving people into Mario Kart's abyss.

Nick von Dadelszen - Lateral Security - Security Vulnerability Disclosure

Abstract

Disclosing security vulnerabilities can be a dangerous business. While there are systems in place for handling disclosures to most major software companies, the process for disclosing vulnerabilities to local organisations is a lot less discussed.

As the discloser, there is always the chance that you are accused of hacking and get a visit from the police merely for identifying an issue. As an organisation, you can find yourself on the front page of the news when someone goes public with an issue.

This talk outlines the dilemmas faced when stumbling across that SQL injection in the local shopping site and proposes mechanisms to safely get the right people told about it. It also discusses how organisations can make it more likely that security vulnerabilities are reported to them directly, rather than through the press.

Speaker Bio

Nick von Dadelszen is the technical director at Lateral Security. Nick has been performing professional penetration testing for over 12 years and has managed several successful penetration testing teams. He has worked with the majority of large corporates and Government agencies in New Zealand and is a regular presenter at OWASP and Kiwicon conferences.

Mark Piper - Insomnia Security - OWASP Top 10 Mobile Risks - An Introduction By Case Study

Abstract

As mobile application usage explodes, so does the associated application security issues. The OWASP Mobile Security Project includes an initiative to categorise and rate these issues into a top 10 format. This list is known as the Top 10 Mobile Risks.

During the session, we will introduce the current (RC1) Top 10 supported with several real world case studies of issues. We will cover how the issues were identified, how they may be exploited by attackers and what mitigation's could be implemented to resolve the issues in the future. While the issues will be largely platform agnostic, the examples will cover both iOS and Android environments.

Speaker Bio

Mark is a Principal Security Consultant with the Insomnia Security team. Mark spends his days auditing software, running penetration testing and red team engagements while working with global customers on developing new testing services.

Kirk Jackson - Xero - Bad Smells That Lead to Bad Security

Abstract

Your job as a defender is to reduce the attack surface of your web application and protect your infrastructure and data from being breached. However we can't be involved in every decision that goes on in our organisation, and we don't always think the same as an attacker does. This talk will introduce you to some common "bad smells" that might indicate security issues lurking under the surface of your code, and help you develop your spidey sense so that you know when to raise the alarm.

Speaker Bio

Kirk is the Security Officer at Xero, and is interested in writing and defending secure web applications.

Kim Carter - BinaryMist - What's Our Software Doing With All That User Input

Abstract

What are we doing with all the characters that get shoved into our applications? Have we considered every potential execution context? It's often interesting and surprising to see what sort of concoction of characters can be executed in different places... and linking multiple attack vectors together which the builders haven't thought about. What are we trusting? Why are we trusting it? What, where and how should we be sanitising?

We have a vast collection of libraries, techniques, cheat sheets, tutorials, guides and tools at our disposal. I often find myself thinking... how can we commoditise the sanitisation of user input and I keep coming up with the same answer. It's not easy. Every application has a completely different set of concerns.

In order for our software to be shielded from an attack, the builders must think like attackers.

In this talk I'll attempt to:

• Increase our knowledge and awareness
• Discuss practical techniques and approaches that increase our defences
• Break some software

Speaker Bio

Kim Carter is a Software Engineer, Architect, Entrepreneur and the founder of BinaryMist. He is passionate about and enjoys many things. Some of which include:

• Designing and creating robust software and networks.
• Breaking his and others software and networks, then fixing it/them.
• Teaching, training, mentoring, motivating, listening to and being around smart people.
• Increasing quality awareness and helping people and organisations implement higher quality in a cost effective manner.
• Improving operational efficiencies.

Hugh Davenport - Aura RedEye Security - Bug Chaining (aka, why XSS can be worse than you think)

Abstract

Security bugs can range in damage from small stuff, all the way to big stuff. Some people only focus on the large stuff, and the smaller stuff can go unnoticed. This talk will give a real world example of a project that had a small bug, that allowed a larger bug to happen, which allowed a larger bug, which allowed for unwanted shell access.

Speaker Bio

Hugh works at Aura RedEye Security on their managed vulnerability scanning service. In his spare time, he is the security point of contact on the Mahara open source tool and contributes to many other open source projects.

Hinne Hettema - University of Auckland - Evolution of Threats and the Skills in our Security Team

Abstract

The threat landscape for security threats is constantly evolving, with new threats being stealthier, more diverse, and increasingly aimed at bypassing the protection offered by antivirus and network intrusion detection systems. Adversaries are now often part of a semi-organised underground economy geared towards the acquisition and sale of digital assets such as usernames, passwords, confidential business information, financial data and designs. There are specific value chains in this economy, which make the acquisition, sale and utilisation of such assets a relatively easy process.

This talk focuses on the skills needed in a security team to deal with this next level of threat, and on the sort of teams that we need in enterprise security to address the modern threats that we face.

Speaker Bio

Hinne Hettema is the team leader of the IT security team at The University of Auckland, an honorary research fellow in the Department of Philosophy at The University of Auckland, and lectures in cyber security at Unitec. He has 10 years experience in security consulting and has a PhD in Philosophy (2012) and theoretical chemistry (1993).

Francois Marier - Mozilla - Securing the Web Without Site-Specific Passwords

Abstract

Has anyone else noticed that the OWASP Top 10 is not changing very much? Especially in the realm of authentication-related problems. I don't claim to have the one true solution for this, but one thing is certain: if we change how things are done on the web and relieve developers from having to store passwords, we can make things better.

We need to let web developers outsource their authentication needs to people who can do it well. Does that mean we should force all of our users to join Facebook? Well not really. That might work for some sites, but outsourcing all of our logins to a single for-profit company isn't a solution that works for the whole web.

The open web needs a better solution. One that enable users to choose their identity provider and shop for the most secure one if that's what they're into. This is the promise behind Persona and the BrowserID protocol. Choose your email provider carefully and let's get rid of all of these site-specific passwords that are just sitting there waiting to be leaked and cracked.

Speaker Bio

Francois is a software engineer and security champion on the Mozilla Identity team where he works on decentralising authentication on the web. A long time Debian developer, Francois has been involved in Open Source and web development for a while and has always had a strong interest in security.

Andrew Kelly - Nothing to See Here!

Abstract

This is how it starts: "Seeking an exciting new challenge? Want to be responsible for building and shaping an embryonic information security function? Then you so won't want to miss this golden opportunity!" Andrew will talk about the setting up of an information security function in an organisation from scratch ('Greenfield') - as opposed to trying to bed yourself down into an already-existing organisation ('Brownfield'). He'll talk about the pros and the cons, and the many ups and downs. And hopefully he'll answer some questions like: Is there, if fact, any such thing as a greenfield security opportunity left in the wild? And ... if such mythical beasties do exist ... are they worth signing on for? Andrew will discuss the pitfalls and pratfalls of the journey from initial engagement, through (maybe) acceptance, until (perhaps) security sign-off and (hopefully) go-live. He'll also discuss both the Pit Bulls and prats you're likely to meet along the way. So ... if you want to hear a guy speak who reckons he's forgotten more than he ever thought he knew? Then this is so the talk for you!

Speaker Bio

Andrew is a whole year older than he was when he presented at last year's OWASP Day: So this time around he's bringing a quarter century's worth of IT security experience to OWASP! Now 25 years ago, he was this mainframe security uber-tech - but today Andrew's recognised as being a 'pragmatic' subject-matter expert on corporate-level information security policy, compliance, frameworks and governance. His first greenfield security 'opportunity' came in November 1989 at the Sun Life Assurance Company of Canada, in the UK. And during those intervening 24 years, he's had similar experiences at various other companies including the likes of Lloyds/TSB Bank, Fonterra, BT Syntegra, Telecom/Gen-i and, lately, Health Benefits Ltd. - amongst many others.

Call For Presentations

OWASP New Zealand Day conferences attract a high quality of speakers from a variety of security disciplines including web developers, system administrators, penetration testers, policy specialists and more. We encourage presentations to have a strong component on fixing and prevention of security issues. We are looking for presentations on a wide variety of security topics, including but not limited to:

• Web application security
• Mobile security
• Secure development
• Vulnerability analysis
• Threat modelling
• Threat and vulnerability countermeasures
• Platform or language security (.NET, Java, RoR, etc)
• Penetration Testing
• Browser and client security
• Application and solution architecture security
• PCI DSS
• Risk management
• Security concepts for C*Os, project managers and other non-technical attendees
• Privacy controls

The email subject must be "OWASP New Zealand 2013: CFP" and the email body must contains the following information/sections:

• Name and Surname
• Affiliation
• Telephone number
• Email address
• Short presenter bio
• Title of the contribution
• Type of contribution: Technical, Informative, Management
• Short abstract (up to 500 words)
• List of the author's previous papers/articles/speeches on the same topic
• If you are not from New Zealand, will your company support your travel/accommodation costs? - Yes/No

The submission will be reviewed by the OWASP New Zealand Day CFP Review Board and the highest voted talks will be selected and invited for presentation.

PLEASE NOTE:

• Due to limited budget available, expenses for international speakers cannot be covered.
• If your company is willing to cover travel and accommodation costs, the company will become "Support Sponsor" of the event.

Please submit the above information to both Nick Freeman and Adrian Hayes - [email protected] and [email protected]

Submissions deadline: 1st August 2013

Call For Trainers

We are happy to announce that training will run on Wednesday September 11th 2013, the day before the OWASP Day conference. The training venues will be auditoriums kindly provided by the University of Auckland, in the same building as the OWASP Day conference itself. Classes will contain up to 20 students, and each seat has power for laptop usage. A wide range of half-day or full-day training proposals will be considered, see the Call for Papers for a list of topics example topics

If you are interested in running one of the training sessions, please contact Nick Freeman and Adrian Hayes with the following information:

• Trainer name
• Trainer organisation
• Telephone + email contact
• Short Trainer bio

• Training title
• Trainer requirements (e.g. a projector, whiteboard, etc)
• Trainee requirements (e.g. laptop, VMWare/Virtualbox, etc)
• Training summary (less than 500 words)
• Target audience (e.g. testers, project managers, security managers, web developers)
• Skill level required (Basic / Intermediate / Advanced)
• What attendees can expect to learn (key objectives)

• Short course outline

The fixed price per head for training will be $250 for a half-day session and $500 for a whole-day session. As this training is part of an OWASP event, part of the proceeds go back to OWASP. The split is as follows:

• 25% to OWASP Global - used for OWASP projects around the world
• 25% to OWASP NZ Day - used for expenses such as catering during the conference
• 50% to the training provider.

Please submit the above information to both Nick Freeman and Adrian Hayes - [email protected] and [email protected]

• [email protected]
• [email protected]

Submissions deadline: 1st August 201

Call For Sponsorships

OWASP New Zealand Day 2013 will be held in Auckland on the 12th of September, 2013 and is a security conference entirely dedicated to application security. The conference is once again being hosted by the University of Auckland with their support and assistance. OWASP New Zealand Day 2013 is a free event, but requires sponsor support to help be an instructive and quality event for the New Zealand community. OWASP is strictly non for profit. The sponsorship money will be used to help make OWASP New Zealand Day 2013 a free, compelling, and valuable experience for the audience.

The sponsorship funds collected are to be used for things such as:

• Refreshments (coffee break/lunch) - we want to keep people refreshed during the day; while we certainly bring good and interesting speakers, we don't want people to go home when they become hungry.
• Name tags - we feel that getting to know people within the New Zealand community is important, and name tags make that possible.
• Promotion - up to now our events are propagating by word of mouth. We would like to get to a wider audience by advertising our events.
• Printed Materials - printed materials will include brochures, tags and lanyards.

Facts

Last year, the event was supported by seven sponsors and attracted more than 250 participants. Plenty of constructive (and positive!) feedback from the audience was received and we are using this to make the conference more appealing to more people. For more information on last year's event, please visit: https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2012

The OWASP New Zealand community is strong and there are more than 220 people currently subscribed to the mailing-list. OWASP New Zealand Day is expected to attract between 250 and 300 attendees this year.

OWASP regular attendees are IT project managers, IT security managers, IT security consultants, web application architects and developers, QA managers, QA testers and system administrators.

Sponsorships

There are three different levels of sponsorships for the OWASP Day event:

Support Sponsorship: (Covering international speaker travel expenses, media coverage/article/promotion of the event)

Includes:

• Publication of the sponsor logo on the event web site - https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2013

Silver Sponsorship: 1500 NZD

Includes:

• Publication of the sponsor logo on the event web site - https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2013
• The publication of the sponsor logo in the event site, in the agenda, on the handouts and in all the official communications with the attendees at the conference.
• The possibility to distribute the company brochures, CDs or other materials to the participants during the event.

Gold Sponsorship: 2750 NZD

Includes:

• The possibility to have a promotional banner or sign side stage in the main auditorium (to be provided by the sponsor, size subject to approval by the OWASP NZ Day Committee).
• The publication of the sponsor logo in the event site, in the agenda, on the handouts and in all the official communications with the attendees at the conference.
• The possibility to distribute the company brochures, CDs or other materials to the participants during the event.
• Publication of the sponsor logo on the OWASP New Zealand Chapter page - Sponsor logo on the OWASP NZ site prior and during the OWASP Day event - https://www.owasp.org/index.php/New_Zealand
• Publication of the sponsor logo on the event web site - https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2013

Those who are interested in sponsoring OWASP New Zealand 2013 Conference can contact the OWASP New Zealand Board.