|
|
| Line 9: |
Line 9: |
| | == Next Meeting == | | == Next Meeting == |
| | | | |
| − | The next Quarterly Chicago OWASP Chapter meeting will take place on August 21st, 2008 at 6pm CDT. | + | The next Quarterly Chicago OWASP Chapter meeting will take place in November or December 2008.. |
| | | | |
| − | We hope to see you at the Bank of America Plaza at 540 W. Madison, Downtown
| |
| − | Chicago, 23rd floor. Please RSVP to jason{AT}wittys.com by
| |
| − | 8/19/2008 if you plan to attend. Your name will need to be entered
| |
| − | into the building's security system in order to gain access to the
| |
| − | meeting.
| |
| | | | |
| | ===Agenda=== | | ===Agenda=== |
| | | | |
| − | 6:00 Refreshments and Networking<br>
| + | TBD |
| − | 6:15 '''Bad Cocktail: Spear Phishing + Application Hacks''' - Rohyt Belani, Managing Partner, Intrepidus Group<br>
| |
| − | 7:15 '''Get Rich or Die Trying - Making Money on The Web, The Black Hat Way''' - Jeremiah Grossman, Founder & CTO of Whitehat Security
| |
| | | | |
| | ===Presentation abstracts=== | | ===Presentation abstracts=== |
| | | | |
| | | | |
| − | '''Bad Cocktail: Spear Phishing + Application Hacks'''
| + | TBD |
| − |
| |
| − | Site takedown services, anti-phishing filters, and millions of dollars worth of protective technologies…..and the spear phishers are still successful!
| |
| − | This presentation will discuss why this is the case. Today, phishing is a key component in a "hackers" repertoire. Phishers are combining social engineering with application security flaws in well known websites to make automated detection of targeted phishing attacks almost impossible. The result - hijacked online brokerage accounts, stolen identities and e-bank robberies. During this talk, I will present the techniques used by attackers to execute such spear phishing attacks, and real-world cases that I have responded to that will provide perspective on the impact. I will then discuss countermeasures that have been proven to be effective and are recommended by reputed bodies like SANS and Carnegie Mellon University.
| |
| − |
| |
| − | Rohyt Belani is a Managing Partner and co-founder of the Intrepidus Group and Adjunct Professor at Carnegie Mellon University. Prior to starting the Intrepidus Group, Mr. Belani has held the positions of Managing Director at Mandiant, Principal Consultant at Foundstone and Researcher at the US-CERT.
| |
| − |
| |
| − | He is a contributing author for Osborne's Hack Notes – Network Security, as well as Addison Wesley's Extrusion Detection: Security Monitoring for Internal Intrusions.
| |
| − |
| |
| − | Mr. Belani is a regular speaker at various industry conferences including Black Hat, OWASP, ASIS, SecTOR, Hack in the Box, Infosec World, DallasCon, CPM, ISSA meetings, and several forums catering to the FBI, US Secret Service, and US Military.
| |
| − |
| |
| − | He has written technical articles and columns for online publications like Securityfocus and SC magazine, and has been interviewed by BBC Radio, Forbes magazine, TechNewsWorld, InformationWeek, Information Today, IndustryWeek, E-Commerce Times, SmartMoney, and Hacker Japan.
| |
| − |
| |
| − | Mr. Belani holds a Bachelor of Engineering in Computer Engineering from Bombay University and a Master of Science in Information Networking from Carnegie Mellon University. He currently leads the OWASP Java Project a world-wide consortium of Java security experts.
| |
| − |
| |
| | | | |
| | + | == Presentation Archives == |
| | | | |
| − | '''Get Rich or Die Trying - Making Money on The Web, The Black Hat Way'''
| + | Bad Cocktail: Spear Phishing - Mike Zusman - Presentation slides [https://www.owasp.org/images/6/60/Zusman_Chicago_2008.pdf here] |
| − | | |
| − | Forget Cross-Site Scripting. Forget SQL Injection. If you want to make some serious cash on the Web silently and surreptitiously, you don’t need them. You also don’t need noisy scanners, sophisticated proxies, 0-days, or ninja level reverse engineering skills -- all you need is a Web browser, a clue on what to look for, and a few black hat tricks. Generating affiliate advertising revenue from the Website traffic of others, trade stock using corporation information passively gleaned, inhibit the online purchase of sought after items creating artificial scarcity, and so much more. Activities not technically illegal, only violating terms of service.
| |
| − | | |
| − | You may have heard these referred to as business logic flaws, but that name really doesn’t do them justice. It sounds so academic and benign in that context when the truth is anything but. These are not the same ol’ Web hacker attack techniques everyone is familiar with, but the one staring you in the face and missed because gaming a system and making money this way couldn’t be that simple. Plus IDS can’t detect them and Web application firewalls can’t black them. If fact, these types of attacks are so hard to detect (if anyone is actually trying) we aren’t even sure how widespread their use actually is. Time to pull back the cover and expose what’s possible.
| |
| | | | |
| − | Bio:
| + | Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides [https://www.owasp.org/images/2/24/Grossman_Chicago_2008.pdf here] |
| − | Jeremiah Grossman is the founder and CTO of WhiteHat Security, considered a world-renowned expert in Web security, co-founder of the Web Application Security Consortium, and named to InfoWorld's Top 25 CTOs for 2007. Mr. Grossman is a frequent speaker at industry events including the BlackHat Briefings, RSA, ISACA, CSI, HiTB, OWASP, Vanguard, ISSA, Defcon, and a number of large universities. He has authored dozens of articles and white papers; is credited with the discovery of many cutting-edge attack and defensive techniques; and is a co-author of XSS Attacks. Mr. Grossman is frequently quoted in major media publications such as InfoWorld, USA Today, PCWorld, Dark Reading, SC Magazine, SecurityFocus, CNet, SC Magazine, CSO, and InformationWeek. Prior to WhiteHat he was an information security officer at Yahoo!
| |
| | | | |
| − | == Presentation Archives ==
| + | Extreme Client-Side Exploitation - Nate McFeters - Presentation slides [http://www.blackhat.com/presentations/bh-usa-08/McFeters_Carter_Heasman/BH_US_08_Mcfeters_Carter_Heasman_Extreme_Client-Side_Exploitation.pdf here] |
| | | | |
| | Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]<BR> | | Automated Thrash Testing - Andre Gironda - Presentation slides [http://www.owasp.org/images/3/32/Auto-thrash-testing.pdf here]<BR> |
Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.
If you have any questions about the Chicago chapter, please send an email to our chapter leaders Cory Scott or Jason Witty.
The next Quarterly Chicago OWASP Chapter meeting will take place in November or December 2008..
Making Money on the Web The Blackhat Way - Jeremiah Grossman - Presentation slides here
Where modern network architecture meets legacy application design, we get "The Port 80 Problem": vendors wrapping every conceivable network protocol in a series of POSTs and calling them "safe". These "Webapps In Name Only" are a nightmare for application security specialists.
In this talk, we'll discuss, with case studies, how tools from protocol reverse engineering can be brought to bear on web application security, covering the following areas:
- Locating and Decompiling Java and .NET Code
- Structure and Interpretation of Binary Protocols in HTTP
- Protocol Debugging Tools
- Web App Crypto Tricks
A short presentation on the threat models and attack vectors for token-less schemes used to reduce the risk of password-only authentication, but yet do not implement "true" two-factor technologies for logistical costs or user acceptance reasons. We'll go over how device fingerprinting and IP geo-location work and discuss the pros and cons of the solutions.
