Difference between revisions of "OWASP BeNeLux-Days 2018"

OWASP BeNeLux conference and training days are free, but registration is required!

To support the OWASP organisation, consider to become a member, it's only US$50! Check out the Membership page to find out more.

Address

Venue:

Congres- en Erfgoedcentrum Lamot
Van Beethovenstraat 8-10
2800 Mechelen
Belgium

Google map

Parking:

Find your parking on Google Maps

How to reach the venue?

Public transport

You can reach the Mechelen's train station from Antwerpen or Brussels. The Lamot conference center is 10 min away by bus (line 1).

Or you can choose to walk for 15 min (1.2 km).

By car

From Brussels:

Follow the E19 Brussels / Antwerpen and take the exit 10.
Follow the N1 until the R12 (take a left) and turn to the right at the "Brusselpoort" into the Hoogstraat to reach one of the parkings.

From Antwerpen:

Follow the E19 Brussels / Antwerpen and take the exit 9.
Follow the N16 until the R12 (take a right) and turn to the left at the "Brusselpoort" into the Hoogstraat to reach one of the parkings.

Hotels Nearby

Hotels around the Lamot conference center

Training Day is November 29th

Agenda

Choose the most appropriate training as they will be hosted at the same time.

Trainings

Training 1 - Kubernetes security by Andrew Martin

Abstract

Course Description

The course guides attendees through Linux container security in general, and progresses to advanced Kubernetes cluster security. It emphasises pragmatic threat modelling and risk assessment based on an understanding of the tools and primitives available, rather than dogmatic dos and don’ts.

Course Outline

• How to attack containerised workloads
• Enhanced container security
• How to attack Kubernetes
• Interactive production cluster hacking
• Hardening Kubernetes
• Locking down applications
• Security tooling and vendor landscape

Who Should Attend

This course is suitable for intermediate to advanced Kubernetes users who want to strengthen their security understanding. It is particularly beneficial for those operating Kubernetes in a high-compliance domain, or for established security professionals looking to update their skills for the cloud native world.

Bio

Andrew has a strong test-first engineering ethos gained architecting and deploying high-traffic web applications. Proficient in systems development, testing, and maintenance, he is comfortable profiling and securing every tier of a bare metal or cloud native application, and has battle-hardened experience delivering containerised solutions to enterprise clients. He is a co-founder at https://control-plane.io

Training 2 - OWASP Zap Training by David Scrobonia

Abstract

This hands on course will start with the basics of using ZAP attack proxy and finish with leveraging it's API to integrate ZAP within you CI/CD processes. Along the way we will be practicing techniques by attacking the OWASP JuiceShop, an intentionally vulnerable web application.

Audience

This couse is designed for both new and experienced users. No knowledge or experience with ZAP is required, but even those familiar with ZAP will learn something new.

Contents

1. Basic Techniques & Manual Testing
2. Advanced Techniques & Automated Testing
3. Scripting with ZAP
4. Using ZAP within your CI/CD Pipeline

Bio

David Scrobonia is a part of the Security Engineering team at Segment working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and is a core team member of the OWASP ZAP project.

Training 3 - Android security workshop by Jeroen Beckers & Stephanie Vanroelen

Abstract

In this workshop, participants will come in contact with the basics of Android application security. Through hands-on exercises, Jeroen and Stephanie will show which mistakes can be made, both at the design and implementation level, that can compromise the security of both the application and the backend server. Although no real prior experience with Android is needed, some basic knowledge on programming is advised.

Participation requirements

• Basic linux / terminal knowledge
• Be able to understand the OWASP Top 10 (Not Mobile)
• Laptop with VirtualBox / VMWare (At least 8GB of RAM)

Bio

Jeroen Beckers is a security researcher at NVISO. He focusses mainly on mobile applications for Android/iOS and sometimes even Windows Phone (yes, some people actually use it!). Apart from breaking mobile applications, he also gives security trainings and presentations at conferences.

Stephanie Vanroelen is an IT security consultant currently focussing on Web and Mobile Application Security. Her experiences in organizing IT Security conferences such as BruCON and CyberSKool help her with project management and communication skills. In her free time she pretends to be Godzilla :).

Conference Day is November 30th

Agenda

Talks

Fast, Furious and Insecure: Passive Keyless Entry and Start in Modern Supercars by Lennert Wouters

Abstract

The security of immobiliser and Remote Keyless Entry systems has been extensively studied over the past years. Passive Keyless Entry and Start systems, which are currently deployed in luxury vehicles, have not received as much attention. During this presentation we will share the techniques used in reverse engineering the Tesla Model S Passive Keyless Entry and Start system. We will discuss multiple security weaknesses in the system including the use of an inadequate proprietary cipher using 40-bit keys, the lack of mutual authentication in the challenge-response protocol, hardware configuration mistakes and the absence of security partitioning.
We verified our findings by implementing a proof of concept attack allowing us to clone a Tesla Model S key fob in a matter of seconds with low cost commercial off the shelf equipment.
Finally, we will share our experience with the responsible disclosure of these finding to Tesla Motors and other likely affected manufacturers such as McLaren, Karma Automotive and Triumph Motorcycles as they all use the same system developed by Pektron.

Bio

Lennert Wouters is a PhD researcher at the Computer Security and Industrial Cryptography (COSIC) research group at KU Leuven. His research interests involve hardware security of connected embedded devices and side channel attacks.

Weaknesses in our voice communications network: from Blue Boxing to VoLTE by Ralph Moonen

Abstract

Voice over 4G, or VoLTE, brings back the phreaking 80's. Once again, after 3 decades, the signaling path of telephony is accessible to end users. No more R1, R2, C4 or C5 however: we now have SIP. As it turns out, the implementations of SIP and VoLTE in various European providers' 4G infrastructures, open up a host of possibilities. During our research over the past few years we have identified vulnerabilities in implementations such as txt message spoofing, subscriber enumeration, location determination (leakage of cell-ID and LAC), IMEI leakage and a potential SIM-card sharing attack.
During this talk we will begin with a little historic stroll of phone phreaking through notable events and discoveries over the years. Bridging the narrative over the last few decades, new technologies such as VoIP, Volte, and VoWiFi are introduced, explaining the 4G and VoLTE infrastructure components and protocols. Next, on a rooted Android phone, we will show what control the user has over the VoLTE stack using some standard tools and the IPv6 stack. This includes hidden activities in Android and extraction of IPsec keys from the VoLTE stack. We will show that it is possible to import keys to Wireshark and monitor the IPv6 SIP traffic and components. Finally, examples of the vulnerabilities in implementations such as txt message spoofing, subscriber enumeration, location determination (leakage of cell-ID and LAC), IMEI leakage and a potential SIM-card sharing attack will be explained.
Yes, a slightly technical nugget of knowledge, yet very accessible and a lot of fun!

Importance of presentation for involved audience
The phone systems of the world have always been of interest to everyone: from users who expect privacy, to intelligence agencies who want access. The privacy, integrity and confidentiality of voice communications over telecommunication networks is therefore of interest to anyone who uses mobile phones (i.e.: everyone). It is also typically a closed subject with very little research being done, relative to other security topics such as malware and application vulnerabilities. The combination of little research and high impact on everyone, makes that this topic deserves much more attention than it currently does. The VoLTE weaknesses we will describe are implementation dependent, and largely unpublished (i.e. new).

Bio

Ralph Moonen CISSP is Technical Director at Secura. Ralph is an old-school ethical hacker with 3 decades of experience as penetration tester, IT-auditor and security consultant. Now, as Technical Director, he is responsible for topics such as R&D and technical projects at Secura.

When Serverless Met Security… Serverless Security & Functions-as-a-Service (FaaS) by Niels Tanis

Abstract

Serverless is a design pattern for writing scalable applications in which Functions as a Service (FaaS) is one of the key building blocks. Every mayor Cloud Provider has got his own FaaS available. On Microsoft Azure there is Azure Functions, AWS has got Lambda and Cloud Functions can be used on the Google Cloud. All of these have a lot of similarities in the way they allow developers to create small event driven services.
From security perspective there are a lot of benefits when moving to a serverless architecture. There is no need to manage any of the machines and the underlying infrastructure. Dealing with updates, patches and infrastructure is the responsibility of the platform provider. FaaS are short lived processes which will be instantiated and destroyed in a matter of milliseconds making it more resilient to denial-of-services (DoS) and also makes it harder to attack and compromise.
But will all of this be sufficient to be ’secure’ or should we be worried about more? With serverless there is still a piece of software that will be developed, build, deployed and executed. It will also introduce a more complex architecture with corresponding attack surface which also makes it hard to monitor. What about the software supply chain and delivery pipeline? There still will be a need to patch your software for vulnerabilities in code and used 3rd party libraries. In this talk we will identify the security area’s we do need to focus on when developing serverless and define possible solutions for dealing with those problems.

Bio

Niels Tanis has got a background in .NET development, pentesting and security consultancy. He also holds the CSSLP certification and has been involved in breaking, defending and building secure applications. He joined Veracode in 2015 and right now he works as a security researcher on a variant of languages and technologies related to Veracode’s Binary Static Analysis service. He is married, father of 2 and lives in a small village just outside Amersfoort, The Netherlands.

OWASP Zap by David Scrobonia

Abstract

Intoducing security testing tools to a QA or developers workflow can be difficult when the tools aren't easy or intuitive to use. Even for security professionals, the friction of cumbersome security tooling can prevent them from getting the most from a tool or being effective with their time.
The OWASP ZAP team is working to help enable developers, QA, and hackers alike with the ZAP Heads Up Display, a more user friendly way to engage with the security testing tool. The Heads Up Displays integrates ZAP directly in the browser providing all of the funcitonality of the tool via a heads up display. The goal is to make ZAP more accessible and enabling users, especially developers, to integrate security in their daily workflows.
This talk will discuss the importance of usable tools, design tradeoffs made to improve usability, the various browser technologies powering the HUD, and how you can start hacking with a heads up display.

Bio

David Scrobonia is a part of the Security Engineering team at Segment working to secure modern web apps and AWS infrastructure. He contributes to open source in his spare time and is a core team member of the OWASP ZAP project.

Juice Shop: OWASP's most broken Flagship by Björn Kimminich

Abstract

OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in Javascript which encompasses the entire OWASP Top Ten and many more severe security flaws. In this talk, you'll learn about this open-source project and its capabilities first-hand from its creator. Join a “happy shopper round trip,” enjoy a hacking demo of some of the built-in challenges, witness how to re-theme the Juice Shop into a security awareness booster for your own company, and learn how to set it up for a capture-the-flag (CTF) event in less than 5 minutes!

Bio

Björn Kimminich is responsible for global IT architecture and application security at Kuehne + Nagel. On the side, he gives IT security lectures at the non-profit private university Nordakademie. Björn also is the project leader of the OWASP Juice Shop and a board member for the German OWASP chapter.

Leaky Processors: Stealing Your Secrets with Foreshadow by Jo Van Bulck

Abstract

For decades, memory isolation has been one of the key principles of secure system design. The recent wave of speculative execution attacks, including Meltdown, Spectre, and Foreshadow abruptly showed, however, that performance optimizations in modern processors fundamentally undermine application security.
This talk will review how speculative execution attacks work. What makes them dangerous, and why they require a paradigm shift in the way we think about application security. The talk will have a special focus on the recently disclosed Foreshadow CPU vulnerability, which led to a complete collapse of state-of-the-art Intel SGX technology, and necessitated hardware and software patches for all major operating systems and virtual machine hypervisors.

Bio

Jo Van Bulck is a PhD researcher at imec-DistriNet, KU Leuven, where he investigates hardware-level trusted computing from an integrated attack and defense perspective. His work resulted in a.o., the high-impact Foreshadow CPU vulnerability announced in August 2018, and several open-source secure processor prototypes.

Fast forwarding Mobile Security with the MSTG by Jeroen Willemsen

Abstract

After the startup of the mobile security project in 2010, the mobile security project and its testing guides have seen quiet some evolution. All of this changed quiet intensively when, in 2016, the Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MSTG) were created. Now, two years fast forward: where are we now? How can you use it as a pentester or a developer? We will start with introducing the current state of the MSTG and its side-projects and then show various demos on iOS and Android.

Bio

Jeroen Willemsen is a Principal Security Architect at Xebia. With a love for mobile security, he recently became one of the projectleaders for the OMTG project (MASV & MSTG). Jeroen is more or less a jack of all trades with interest in infrastructure security, risk management and application security.

The Social Event is on Thursday, November 29th

If you want to join the social event, don't forget to register for it via the registration:

The social event details will be published very soon! Stay tuned.

Become a sponsor of OWASP BeNeLux!

There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2019 and the BeNeLux OWASP Days 2018.

Download our sponsor brochure and contact us for questions or sponsorship confirmation!

Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses.

The sponsorship will also be dedicated to cover the costs of the OWASP 2018 BeNeLux event.