Jerusalem

OWASP Jerusalem

Welcome to the Jerusalem chapter homepage. The chapter leaders are Josh Amishav-Zlatin and Jacob Kili.

Participation

OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.

Sponsorship/Membership

to this chapter or become a local chapter supporter. Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member?

Upcoming Meetings

Meeting Location: Bynet building (next to Intel), Har Hozvim - Jerusalem

Our next chapter meeting will be on April 3rd 2013 at 18:00. The agenda is as follows:

Gathering - Refreshments & Opening Remarks: 18:00-18:15

First Lecture 18:15-18:45 Josh Amishav-Zlatin - A is for Anonymous and Application Layer DoS Attacks:

Abstract: Denial of service (DoS) attacks are like an annoying pest that wont go away. DoS attacks are a persistent problem on the Internet, which are extremely difficult to solve in a scalable fashion. According to WHID data, Denial of Service attacks make up a very significant portion of web based attacks. Despite efforts to code your app securely, a malicious user with minimum bandwidth might still be able to take your application offline at will. In this talk, we will focus on Slow HTTP DoS attacks which have been a popular attack method by various hacktivist groups such as Anonymous. We will also discuss several techniques that can be used to mitigate this threat.

Bio: Josh leads the R&D team at Pure Hacking where he focuses on web application defensive research and develops customized ModSecurity rulesets to help customers reduce risk associated with their web applications. Josh specializes in web application penetration testing and FOSS based security solutions. He is an active member of the ModSecurity community and is currently involved with the OWASP Core Rule Set, AuditConsole and WASC Threat Classification projects. Josh has over 10 years of experience in the IT security industry, working with both financial and government clients to help secure their critical applications

Second Lecture 18:50-19:25 Amitay Dan - Car Phone Intelligence

Many hackers try to demonstrate how to attack cars and mobile phones, but like any other battle there is a need for proper Intelligence. This lecture will show how to use systematic flaws like number's floor, hidden numbers and tenders to pinpoint and attack targets. In the close future almost every car will have a cellular modem, thus we need to start creating our defense right now.

Bio: Amitay Dan researches strategic and tactical cyber attack methods from databases, telecommunication and phreaking as well as medical field attacks. He works as a cyber intelligence analyst at Black Cube

Workshop 19:30-20:30 David Kaplan - Intro to Timing Attacks

Timing Attacks have become popular over the past number of years and have been employed successfully against numerous targets ranging from network-based attacks to games consoles. During the hour-long workshop, participants will have a chance to learn about simple software timing attacks and will attempt to attack vulnerable pieces of software. Participants are required to bring their own laptops. A Virtual Box image with all tools needed for the workshop will be provided in advance of the day (participants are expected to have this installed prior to the start of the workshop). Some experience with Linux – an advantage. Programming experience – a must (Python + gcc will be provided in the VM, any other languages participants should bring necessary software).

The workshop will be delivered in English.

Bio: Security Researcher working for Intel Corp. by day and hacker by night - breaking things for both fun and profit! Previously part of the red team at NDS (now Cisco). Interested in all things security; with a special interest in real-time and Linux-based embedded systems.

Everyone is welcome to join us at our chapter meetings.