BeNeLux OWASP Day 2016

OWASP BeNeLux Announcement

We are proud to announce the dates of the next edition of BeNeLux OWASP Day! The event will take place on 17 and 18 March 2016, in Belval Campus, in Esch-sur-Alzette - Luxembourg. More information on the venue can be found here.
Don't wait and register now!

Confirmed speakers Conference

Stephen Burgmair (OWASP Germany)
Jullie Gommes
Erik Poll
Arne Swinnen (Nviso)
Glenn & Riccardo Ten Cate
Christian Schneider
Michael Hamm (CIRCL)

The OWASP BeNeLux Program Committee

Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium
Martin Knobloch, OWASP Netherlands
Jocelyn Aubert, OWASP Luxembourg

Tweet!

Event tag is #owaspbnl16

Donate to OWASP BeNeLux

Donate

Trainingday is March 17th

Location

The training venue is at the same location as the conference venue.

Agenda

Time	Description	Room 1	Room 2	Room 3	Room 4
08h30 - 9h30	Registration
09h30 - 11h00	Training	Application Security Primer by Martin Knobloch	Hands-on Threat Modeling by Sebastien Deleersnyder	Security Shepherd by Mark Denihan	O-saft by Achim Hoffman & Torsten Gigler
11h00 - 11h30	Coffee Break
11h30 - 13h00	Training
13h00 - 14h00	Lunch
14h00 - 15h30	Training
15h30 - 16h00	Coffee Break
16h00 - 17h30	Training

Application Security Primer by Martin Knobloch

TBD

Hands-on Threat Modeling by Sebastien Deleersnyder

This is a 1 day, trainer-led, on-site, Threat Modeling course. The training material and hands-on workshops include real live Use Cases. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:

B2B web and mobile applications, sharing the same REST backend
An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.

Threat modeling allows you to consider, document, and discuss the security implications of designs in the context of their planned operational environment and in a structured fashion. Threat modeling also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model.

This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications and databases. The students should bring their own laptop to the course.

Course topics (1 day)

Threat modeling introduction

Threat modeling in a secure development lifecycle
What is threat modeling
Why threat modeling?
Threat modeling stages
Diagrams
Identify threats
Addressing threats
Document a threat model

Diagrams – what are you building?

Understanding context
Doomsday scenarios
Data flow diagrams
Trust Boundaries
Hands-on: diagram B2B web and mobile applications, sharing the same REST backend

Identifying threats – what can go wrong?

STRIDE introduction
Spoofing threats
Tampering threats
Repudiation threats
Information disclosure threats
Denial of service threats
Elevation of privilege threats
Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Addressing each threat

Mitigation patterns
Authentication: mitigating spoofing
Integrity: mitigating tampering
Non-repudiation: mitigating repudiation
Confidentiality: mitigating information disclosure
Availability: mitigating denial of service
Authorization: mitigating elevation of privilege

Threat modeling tools

General tools
Open-Source tools
Commercial tools

The course students receive the following package as part of the course:

Hand-outs of the presentations
Work sheets of the use cases,
Detailed solution descriptions of the use cases
Template to document a threat model
Template to calculate risk levels of identified threats

The students should bring their own laptop

Threat Modeling – real life use cases

As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world. In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build a threat model. Using this methodology for the hands on workshops we provide our students with a robust training experience and the templates to incorporate threat modeling best practices in their daily work. The students will be challenged to perform the threat modeling in groups of 3 to 4 people performing the different stages of threat modeling on:

B2B web and mobile applications, sharing the same REST backend
An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

After each hands-on workshop, the results are discussed, and the students receive a documented solution.

Sebastien Deleersnyder

Sebastien Deleersnyder, managing partner and application security consultant at Toreon will share his practical threat model experience. Sebastien led engagements in the domain of ICT-security, Web and Mobile Security with several customers including BNP Paribas Fortis, Atos Worldline, KBC, Nationale Nederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post , Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, served as vice-chair of the global OWASP Foundation Board and performed several public presentations on Web Application, Mobile and Web Services Security. Furthermore, Sebastien co-founded the yearly BruCON conference.

Security Shepherd by Mark Denihan

TBD

O-saft by Achim Hoffman & Torsten Gigler

Abstract

The use of SSL/TLS to protect the transport of data has become very common today. On the other hand it does not work pretty 'out of the box'. Furthermore it has more and more secuirty issues. As a consequence it often does not protect as assumed. It is often difficult to understand, what are the root causes of the issues, and how to detect and finally avoid or fix them.
This training will give a brief introduction to SSL, how it works i. g., what issues are related to the protocol, the PKI used, and the known vulnerabilities including potential attacks and provide tools to check for these issues. The main focus will be on SSL/TLS used in HTTPS. Other usages i.e. SSL for SMTP are a small subset. As a round-up there will be recommendations how to configure and maintain TLS securely.

Course Topics

The main part of the course will be a hands-on-training showing by example how to check the established TLS/SSL connection (including ciphers) to a web server and show how to analyse the provided certificate. Various tools will be explained. It will be demonstrated how these tools can be used to detect weaknesses in the TLS/SSL connection and such.
The explained tools are for example: openssl, sslscan, testssl.sh, o-saft, and some more, as well as some online checking tools like ssllabs.com. We show what are these tools useful for, what they can do, and what they cannot. Finally we show how the OWASP tool o-saft can be used to cover most of the previous shown techniques and how to use its advanced features like:

checking for ciphers
checking for special SSL settings
check multiple servers at a time
customizing the results
customizing o-saft itself
or simple debugging of various SSL connection problems.

The purpose of this course is to provide a tool set for checking TLS/SSL to the participants, and teach the participants how and when to use which tool, and why some tools do not provide complete results (e.g. protocols, ciphers). The course is about analysing TLS/SSL from a client-site view. It will not go into the details of fuzzing or even breaking TLS/SSL, or exploiting vulnerabilities. Mostly we will analyse HTTPS, furthermore we will provide some examples for protocols using STARTTLS, too (e.g. SMTP).
Additionally it will give system architects, administrator, or operational people, hints how to set-up and configure TLS/SSL in a proper secure way.

Technical requirements

The participants should bring their own laptop with any operating system (recommended is Linux) and at least following tools installed:

openssl (1.0.1e or newer)
perl (5.8 or newer), on windows system Strawberry perl is recommended
Net::SSLeay (1.53 or newer), IO::Socket::SSL (1.37 or newer)
Tcl (8.5) optional, on a windows system ActiveTcl (8.6) is recommended
python (2.7) optional

Optional, for smooth testing, a local SSL-enabled (SSLv2, SSLv3, TLS) web server should be running on the laptop (i.e. OWASP-BWA).

Bio's

Achim Hoffmann ... Starting with Linux/network security in the nineties. Achim Hoffmann has been working in web application security since more than 15 years. While working as a developer for web-application for several years he started concentrating on web application security as major subject in different roles like penetration tester, doing SCA and giving security workshops. He is author, co-author and maintainer of various papers about web application security at BSI (Germany), OWASP and WASC. He also published some tools (EnDe, EMiR, ReDoS, O-Saft) which aim to make web application security more visible. Achim is owner of sic[!]sec GmbH, Germany, a company that provides information security services. Outside work he is German OWASP Board Member and helps maintaining OWASP's mailing lists.
Torsten Gigler ... Internernal Security Consultant in a large scale enterprise >15 years (ICT-Infrastructure- and Application Security). He has been volunteering for OWASP since more than 3 years: since 2 years co-developer of O-Saft, contributed to the Transport Layer Protection Cheat Sheet (Cipher Section), project leader 'OWASP Top 10 für Entwickler' / OWASP Top 10 for Developers, contributed to the German translation of OWASP-Top-10 2013, supported the Top_10_2013-Project: Review, Wiki.

Conferenceday is March 18th

Agenda

Time	Speaker	Topic
08h30 - 09h10	Registration
09h15 - 10h00	Jullie Gommes	Gamers, You're the new Botnets
10h00 - 10h45	Stephen Burgmair	OWASP Top 10 Privacy Risks
10h45 - 11h15	Morning Break
11h15 - 12h00	Erik Poll	LangSec meets State Machines
12h00 - 12h45	Arne Swinnen	The Tales of a Bug Bounty Hunter
12h45 - 13h45	Lunch
13h45 - 14h30	Glenn & Riccardo Ten Cate	OWASP Secure Knowledge Framework (SKF)
14h30 - 15h15	University Luxembourg	Mobile Security
15h15 - 15h45	Break
15h45 - 16h30	Christian Schneider & Alvaro Muñoz	Serial Killer: Silently Pwning your Java Endpoints
16h30 - 17h15	Michael Hamm	Experiences with Paste-Monitoring
17h15 - 17h30	OWASP Benelux 2015 organization	Closing Notes

Talks

Julie Gommes - Gamers, You're the New Botnets

Abstract: Downloading, playing, downloading, playing, downloading, playing, downloading, playing, downloading, playing... that is really funny. You can try new games every day but the guys who share those games are not just happy and funny people doing that just for pleasure to share "games". Yeas, they're sharing games, but lot of other Tools they enjoy to play with... Let's talk about malwares, about botnets, about backdoors and about some computer which can win a "botnet award".

Bio: Julie Gommes is a cybersecurity contractor, working in Paris on risk analysis, Security gap analysis, Security in project management, Audit, CISO support. She is also trainer for exposed professionals (journalists, lawyers, HR, employees of NGOs ...). https://fr.linkedin.com/in/juliegommes; Twitter : @JujuSete

Stefan Burgmair - OWASP Top 10 Privacy Risks

Abstract: There are lively discussions about how to protect personal data especially with the upcoming EU Data Protection Regulation that requires Privacy by Design. But still there was no independent description of privacy risks specifically for web applications available. Thus, companies lack guidance to identify and avoid privacy risks during systems development. Therefore the OWASP Top 10 Privacy Risks project developed a list of the top 10 privacy risks in web applications. The project covers technical and organizational aspects like missing encryption or insufficient transparency and results and practical countermeasures are presented in this session.

Bio: Stefan Burgmair is a German security and privacy consultant at msg systems in Munich. He wrote his Master Thesis in information systems and management about the “Top 10 Privacy Risks for Web Applications” and continues to deliver key content for the project.

Erik Poll - LangSec meets State Machines

Abstract: Language-theoretic Security, or LangSec for short, provides useful insights into the root causes of an important class security flaws - namely flaws in handling input - and ways to avoid these. This talk will discuss the core ideas of LangSec and the relation with security research we have done at over the years, where we used state machines as a means to systematically investigate GSM, bank cards, internet banking tokens, and TLS.

Bio: Erik Poll is Associate Professor in the Digital Security group of the Radboud University in Nijmegen. His research interests include smart cards, security protocols, the security of payment systems and smart grids, and formal methods that can improve security by providing a rigorous basis for design, analysis, and testing.

Arne Swinnen - The Tales of a Bug Bounty Hunter

Abstract: Bug bounty hunting is the new black! During this technical talk, several interesting vulnerabilities identified in Instagram, the increasingly-popular photo-based social media platform, will be presented.
All vulnerabilities were disclosed responsibly via Facebook’s Public Bug Bounty program over the course of 2015 and 2016, and will be discussed in detail. Required advanced Mobile Security attack techniques for this Research, such as Binary Modification, Dynamic Hooking and Burp Suite Plugin Development will be covered, among other trickery.
The most interesting vulnerabilities were hybrid: Combinations of complementary vulnerabilities in different environments (e.g. Web and Mobile). All identified issues’ root causes will be mapped onto the Software Development Life Cycle (SDLC), to analyze where they could have been prevented from materializing. Last but not least, the monetary rewards offered by Facebook for each vulnerability and general Bug Bounty Hunting advice will be shared with the community.

Bio: Arne Swinnen is an IT Security Consultant at NVISO, a Belgian Cyber Security Consulting firm. Arne specializes in Application Security and Digital Forensics. He co-organized the first edition of the Cyber Security Challenge Belgium in 2015, a National cyber security competition designed exclusively for Belgian students.
Arne was a speaker at Black Hat USA and BruCON in 2014, presenting novel anti-virus detection and evasion techniques (“One Packer to Rule Them All”). Since 2015, he is also listed on Facebook’s Bug Bounty Half of Fame.

Christian Schneider & Alvaro Muñoz - Serial Killer: Silently Pwning your Java Endpoints

Abstract: In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees. The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application. The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start. Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process.

Bio's:

Christian Schneider (@cschneider4711) writes software since the nineties, works as a freelance software developer since 1997, focuses on Java since 1999 and on IT-Security - especially Pentesting - since 2005. He enjoys writing articles about web application security as well as speaks and trains at conferences (OWASP AppSecEU, JAX, WJAX, WebTechCon, DevOpsCon, HackPra, RSA). He blogs at Christian-Schneider.net
Alvaro Muñoz (@pwntester) works as Principal Security Researcher with HPE Security Fortify. He enjoys researching different programming languages and web application frameworks for vulnerabilities and unsafe APIs. Before joining the HPE research team, he worked as an Application Security Consultant helping enterprises to start and improve their application security programs. He blogs at pwntester.com

Made possible by our Sponsors