Difference between revisions of "BeNeLux OWASP Day 2016"

OWASP BeNeLux training day and conference are free, but registration is required!

Register today at https://owasp-benelux-day-2016.eventbrite.com . We only have a limited number of seats available for our trainings and conference. First come, first serve!

To support the OWASP organisation, consider to become a member, it's only US$50!
Check out the Membership page to find out more.

Venue is

University of Luxembourg
Maison du Savoir
2, avenue de l'Université
L-4365 Esch-sur-Alzette

How to reach the venue?

By car

Check the Belval Campus map - available on google maps - for route information.

Outdoor parking areas and underground car parks are available throughout the campus, particularly P+R Belval Université, or Square Mile parking or Belval Plaza.

By train

Trains departing every 15 minutes from Luxembourg Central Station are direct to "Belval-Université" - line is connection-free via Esch-sur-Alzette. Get information on train schedules on the CFL’s website.

When on site, access to buildings is easy on foot.

Hotel nearby

Hotel Ibis Esch-Belval
12, avenue du Rock'n'Roll
L-4361 Esch-sur-Alzette, Luxembourg
From 81 EUR per night

Trainingday is March 17th

Location

The training venue is at the same location as the conference venue.

Agenda

Application Security Primer by Martin Knobloch

TBD

Hands-on Threat Modeling by Sebastien Deleersnyder

This is a 1 day, trainer-led, on-site, Threat Modeling course. The training material and hands-on workshops include real live Use Cases. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:

• B2B web and mobile applications, sharing the same REST backend
• An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.

Threat modeling allows you to consider, document, and discuss the security implications of designs in the context of their planned operational environment and in a structured fashion. Threat modeling also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model.

This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications and databases. The students should bring their own laptop to the course.

Course topics (1 day)

Threat modeling introduction

• Threat modeling in a secure development lifecycle
• What is threat modeling
• Why threat modeling?
• Threat modeling stages
• Diagrams
• Identify threats
• Addressing threats
• Document a threat model

Diagrams – what are you building?

• Understanding context
• Doomsday scenarios
• Data flow diagrams
• Trust Boundaries
• Hands-on: diagram B2B web and mobile applications, sharing the same REST backend

Identifying threats – what can go wrong?

• STRIDE introduction
• Spoofing threats
• Tampering threats
• Repudiation threats
• Information disclosure threats
• Denial of service threats
• Elevation of privilege threats
• Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Addressing each threat

• Mitigation patterns
• Authentication: mitigating spoofing
• Integrity: mitigating tampering
• Non-repudiation: mitigating repudiation
• Confidentiality: mitigating information disclosure
• Availability: mitigating denial of service
• Authorization: mitigating elevation of privilege

Threat modeling tools

• General tools
• Open-Source tools
• Commercial tools

The course students receive the following package as part of the course:

• Hand-outs of the presentations
• Work sheets of the use cases,
• Detailed solution descriptions of the use cases
• Template to document a threat model
• Template to calculate risk levels of identified threats

The students should bring their own laptop

Threat Modeling – real life use cases

As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world. In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build a threat model. Using this methodology for the hands on workshops we provide our students with a robust training experience and the templates to incorporate threat modeling best practices in their daily work. The students will be challenged to perform the threat modeling in groups of 3 to 4 people performing the different stages of threat modeling on:

• B2B web and mobile applications, sharing the same REST backend
• An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

After each hands-on workshop, the results are discussed, and the students receive a documented solution.

Sebastien Deleersnyder

Sebastien Deleersnyder, managing partner and application security consultant at Toreon will share his practical threat model experience. Sebastien led engagements in the domain of ICT-security, Web and Mobile Security with several customers including BNP Paribas Fortis, Atos Worldline, KBC, Nationale Nederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post , Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, served as vice-chair of the global OWASP Foundation Board and performed several public presentations on Web Application, Mobile and Web Services Security. Furthermore, Sebastien co-founded the yearly BruCON conference.

Security Shepherd by Mark Denihan

TBD

O-saft by Achim Hoffman & Torsten Gigler

Abstract

The use of SSL/TLS to protect the transport of data has become very common today. On the other hand it does not work pretty 'out of the box'. Furthermore it has more and more secuirty issues. As a consequence it often does not protect as assumed. It is often difficult to understand, what are the root causes of the issues, and how to detect and finally avoid or fix them.
This training will give a brief introduction to SSL, how it works i. g., what issues are related to the protocol, the PKI used, and the known vulnerabilities including potential attacks and provide tools to check for these issues. The main focus will be on SSL/TLS used in HTTPS. Other usages i.e. SSL for SMTP are a small subset. As a round-up there will be recommendations how to configure and maintain TLS securely.

Course Topics

The main part of the course will be a hands-on-training showing by example how to check the established TLS/SSL connection (including ciphers) to a web server and show how to analyse the provided certificate. Various tools will be explained. It will be demonstrated how these tools can be used to detect weaknesses in the TLS/SSL connection and such.
The explained tools are for example: openssl, sslscan, testssl.sh, o-saft, and some more, as well as some online checking tools like ssllabs.com. We show what are these tools useful for, what they can do, and what they cannot. Finally we show how the OWASP tool o-saft can be used to cover most of the previous shown techniques and how to use its advanced features like:

• checking for ciphers
• checking for special SSL settings
• check multiple servers at a time
• customizing the results
• customizing o-saft itself
• or simple debugging of various SSL connection problems.
  

The purpose of this course is to provide a tool set for checking TLS/SSL to the participants, and teach the participants how and when to use which tool, and why some tools do not provide complete results (e.g. protocols, ciphers). The course is about analysing TLS/SSL from a client-site view. It will not go into the details of fuzzing or even breaking TLS/SSL, or exploiting vulnerabilities. Mostly we will analyse HTTPS, furthermore we will provide some examples for protocols using STARTTLS, too (e.g. SMTP).
Additionally it will give system architects, administrator, or operational people, hints how to set-up and configure TLS/SSL in a proper secure way.

Technical requirements

The participants should bring their own laptop with any operating system (recommended is Linux) and at least following tools installed:

• openssl (1.0.1e or newer)
• perl (5.8 or newer), on windows system Strawberry perl is recommended
• Net::SSLeay (1.53 or newer), IO::Socket::SSL (1.37 or newer)
• Tcl (8.5) optional, on a windows system ActiveTcl (8.6) is recommended
• python (2.7) optional
  

Optional, for smooth testing, a local SSL-enabled (SSLv2, SSLv3, TLS) web server should be running on the laptop (i.e. OWASP-BWA).

Bio's

• Achim Hoffmann ... Starting with Linux/network security in the nineties. Achim Hoffmann has been working in web application security since more than 15 years. While working as a developer for web-application for several years he started concentrating on web application security as major subject in different roles like penetration tester, doing SCA and giving security workshops. He is author, co-author and maintainer of various papers about web application security at BSI (Germany), OWASP and WASC. He also published some tools (EnDe, EMiR, ReDoS, O-Saft) which aim to make web application security more visible. Achim is owner of sic[!]sec GmbH, Germany, a company that provides information security services. Outside work he is German OWASP Board Member and helps maintaining OWASP's mailing lists.
• Torsten Gigler ... Internernal Security Consultant in a large scale enterprise >15 years (ICT-Infrastructure- and Application Security). He has been volunteering for OWASP since more than 3 years: since 2 years co-developer of O-Saft, contributed to the Transport Layer Protection Cheat Sheet (Cipher Section), project leader 'OWASP Top 10 für Entwickler' / OWASP Top 10 for Developers, contributed to the German translation of OWASP-Top-10 2013, supported the Top_10_2013-Project: Review, Wiki.

Conferenceday is March 18th

Agenda

Talks

Julie Gommes - Gamers, You're the New Botnets

Abstract: Downloading, playing, downloading, playing, downloading, playing, downloading, playing, downloading, playing... that is really funny. You can try new games every day but the guys who share those games are not just happy and funny people doing that just for pleasure to share "games". Yeas, they're sharing games, but lot of other Tools they enjoy to play with... Let's talk about malwares, about botnets, about backdoors and about some computer which can win a "botnet award".

Bio: Julie Gommes is a cybersecurity contractor, working in Paris on risk analysis, Security gap analysis, Security in project management, Audit, CISO support. She is also trainer for exposed professionals (journalists, lawyers, HR, employees of NGOs ...). https://fr.linkedin.com/in/juliegommes; Twitter : @JujuSete

Stefan Burgmair - OWASP Top 10 Privacy Risks

Abstract: There are lively discussions about how to protect personal data especially with the upcoming EU Data Protection Regulation that requires Privacy by Design. But still there was no independent description of privacy risks specifically for web applications available. Thus, companies lack guidance to identify and avoid privacy risks during systems development. Therefore the OWASP Top 10 Privacy Risks project developed a list of the top 10 privacy risks in web applications. The project covers technical and organizational aspects like missing encryption or insufficient transparency and results and practical countermeasures are presented in this session.

Bio: Stefan Burgmair is a German security and privacy consultant at msg systems in Munich. He wrote his Master Thesis in information systems and management about the “Top 10 Privacy Risks for Web Applications” and continues to deliver key content for the project.

Erik Poll - LangSec meets State Machines

Abstract: Language-theoretic Security, or LangSec for short, provides useful insights into the root causes of an important class security flaws - namely flaws in handling input - and ways to avoid these. This talk will discuss the core ideas of LangSec and the relation with security research we have done at over the years, where we used state machines as a means to systematically investigate GSM, bank cards, internet banking tokens, and TLS.

Bio: Erik Poll is Associate Professor in the Digital Security group of the Radboud University in Nijmegen. His research interests include smart cards, security protocols, the security of payment systems and smart grids, and formal methods that can improve security by providing a rigorous basis for design, analysis, and testing.

Arne Swinnen - The Tales of a Bug Bounty Hunter

Abstract: Bug bounty hunting is the new black! During this technical talk, several interesting vulnerabilities identified in Instagram, the increasingly-popular photo-based social media platform, will be presented.
All vulnerabilities were disclosed responsibly via Facebook’s Public Bug Bounty program over the course of 2015 and 2016, and will be discussed in detail. Required advanced Mobile Security attack techniques for this Research, such as Binary Modification, Dynamic Hooking and Burp Suite Plugin Development will be covered, among other trickery.
The most interesting vulnerabilities were hybrid: Combinations of complementary vulnerabilities in different environments (e.g. Web and Mobile). All identified issues’ root causes will be mapped onto the Software Development Life Cycle (SDLC), to analyze where they could have been prevented from materializing. Last but not least, the monetary rewards offered by Facebook for each vulnerability and general Bug Bounty Hunting advice will be shared with the community.

Bio: Arne Swinnen is an IT Security Consultant at NVISO, a Belgian Cyber Security Consulting firm. Arne specializes in Application Security and Digital Forensics. He co-organized the first edition of the Cyber Security Challenge Belgium in 2015, a National cyber security competition designed exclusively for Belgian students.
Arne was a speaker at Black Hat USA and BruCON in 2014, presenting novel anti-virus detection and evasion techniques (“One Packer to Rule Them All”). Since 2015, he is also listed on Facebook’s Bug Bounty Half of Fame.

Christian Schneider & Alvaro Muñoz - Serial Killer: Silently Pwning your Java Endpoints

Abstract: In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees. The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application. The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start. Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process.

Bio's:

• Christian Schneider (@cschneider4711) writes software since the nineties, works as a freelance software developer since 1997, focuses on Java since 1999 and on IT-Security - especially Pentesting - since 2005. He enjoys writing articles about web application security as well as speaks and trains at conferences (OWASP AppSecEU, JAX, WJAX, WebTechCon, DevOpsCon, HackPra, RSA). He blogs at Christian-Schneider.net
• Alvaro Muñoz (@pwntester) works as Principal Security Researcher with HPE Security Fortify. He enjoys researching different programming languages and web application frameworks for vulnerabilities and unsafe APIs. Before joining the HPE research team, he worked as an Application Security Consultant helping enterprises to start and improve their application security programs. He blogs at pwntester.com

Michael Hamm - Experiences with Paste-Monitoring

Abstract: Paste platforms like Pastebin.com provide the possibility to store and share text online. Often this kind of services are used by programmers but also abused by attackers to present their achievements. CIRCL acts as a fire brigade and monitor several of those paste platforms to early detect potential incidents and help the victims. The findings vary from lists of vulnerable or compromised websites, leaked credentials, database dumps, opportunistic announcements, stolen credit card details and many more. We will present the used techniques, and some key experiences with the findings and introduce the AIL framework - Framework for Analysis of Information Leaks. AIL is designed to analyse unstructured data and identify potential data leaks.

Bio: Works since 2000 in the field of security and since 2010 as CIRCL Operator.

Glenn ten Cate, Riccardo ten Cate -- Security knowledge framework

Over 10 years of experience in web application security bundled into a single application.
The Security Knowledge Framework is a vital asset to the coding toolkit of you and your development team.
Use SKF to learn and integrate security by design in your web application.

SKF is an open source security knowledgebase including manageble projects with checklists and best practice code examples in multiple programming languages showing
you how to prevent hackers gaining access and running exploits on your application.

We will be talking about:

• Training your developers in writing secure code
• Security support pre-development (Security by design, early feedback of possible security issues)
• Security support post-development(Double check your code by means of the OWASP ASVS checklists )
• Code examples for secure coding

"Bio:"
Glenn
As a coder, hacker, speaker, trainer and security researcher Glenn has over 10 years experience in the field of security.
His goal is to create an open-source software development life cycle with the tools and knowledge gathered over the years.

Riccardo
As a developer and penetration tester Riccardo specialises in web-application security and
has extensive knowledge in securing web applications in multiple coding languages.

Social Event

Wait for it...

Capture the Flag!

• Do you like puzzles?
• Do you like challenges?
• Are you a hacker?

Whether you are an experienced hacker or new enthusiast you should come to OWASP BeNeLux Day and participate in the Capture the Flag event.

The OWASP CTF is especially designed to support challengers of all skill levels. The CTF contains multiple challenges in various fields related to application security. As every challenge gains you one point, you can pick and choose which challenge you want to play.

All you need is a laptop with a wifi card and your favorite (preferably) non-commercial tools.

So come, show off your skills, learn new tricks and above all have a good time at the CTF event.

Become a sponsor of OWASP BeNeLux

Donate to OWASP BeNeLux

Sponsor

Promotion

Feel free to use the text below to promote our event!

We invite you to our next OWASP event: the BeNeLux OWASP Days 2016! The good news: free! No fee!

The bad news: there are only 150 seats available (first register, first serve)!