Belgium Events 2009

These are the 2009 events of the OWASP Belgium Chapter.

Previous year: 2008. Next year: 2010.

Previous Meeting (Sep-15-2009) in Leuven

WHERE

Distrinet Research Group (K.U.Leuven) sponsored the venue

Address:
Department of Computer Science (auditorium 00.225)
Celestijnenlaan 200 A
3001 Heverlee

Routemap: http://distrinet.cs.kuleuven.be/about/route/

PROGRAM

The agenda:

• 18h30 - 19h00: Welcome & Refreshments
  
• 19h00 - 19h15: OWASP Update (by Sebastien Deleersnyder, Telindus, OWASP Board)
  
• 19h15 - 20h00: CSRF: the nightmare becomes reality (by Lieven Desmet, DistriNet Research Group (K.U. Leuven))
  

Presentation + discussion: Cross-Site Request Forgery (CSRF) is a well known attack in which a malicious webpage instructs the victim's browser to send out requests to legitimate sites on behalf of the victim, while piggybacking on the authorized sessions of the victim. CSRF attacks are typically transparent for the victim, and for legitimate websites it is hard to differentiate between requests initiated by the victim, and requests initiated by the malicious webpage.

Although this type of vulnerability is already known for about a decade, CSRF recently gained much more attention because of its impact on contemporary e-society. In November 2007, a vulnerability in GMail was exploited to forward incoming mails of the victims to an arbitrary account. In October 2008, Zeller and Felten published a technical report, describing CSRF attacks on four larger websites, including NYTimes.com and INGDirect.com .

Several mitigation techniques are already developed, both for protecting the client as well as the legitimate server. In this presentation, I will give an overview of the possible mitigation techniques and discuss several of the proposed solutions.

Lieven received his Ph.D. in software security in January 2007 and is currently active as Research Manager on Secure Software within the DistriNet research group at the Katholieke Universiteit Leuven (Belgium). His main research interests are in software security and software engineering. In particular, he is working on software verification and web application security. Lieven is a board member of the Belgium OWASP chapter, and organized several editions of the OWASP refereed papers track at the OWASP AppSec EU conferences. Since 2008, he is also a guest lecturer on web application security for the industry course SecAppDev.

• 20h00 - 21h15: Hacking Web 2.0 Streams – Cross Domain Injection and Exploits (by Shreeraj Shah, founder of Blueinfy)
  

download presentation

Presentation + discussion: Web 2.0 applications are becoming increasingly interconnected and consuming various streams coming from cross domains. It is very challenging to identify these streams and discovering vulnerabilities by fuzzing them. This talk will focus on understanding application architecture, cross domain relationships, XML/JSON stream manipulations and vulnerability detection. Following issues will be discussed with cases, demos and tools.

• XML and SOAP poisoning
• JSON injections and manipulations
• XSS based on XML and JSON
• Asynchronous injections
• Cross Domain CSRF poisoning
• JSON and CSRF
• XPATH, XQUERY and SQL over JSON/SOAP
• XML and SOAP exploits

Shreeraj Shah, B.E., MSCS, MBA, is the founder of Blueinfy, a company that provides application security services. Prior to founding Blueinfy, he was founder and board member at Net Square. He also worked with Foundstone (McAfee), Chase Manhattan Bank and IBM in security space. He is also the author of popular books like Hacking Web Services (Thomson 06) and Web Hacking: Attacks and Defense (Addison-Wesley 03). In addition, he has published several advisories, tools, and whitepapers, and has presented at numerous conferences including RSA, AusCERT, InfosecWorld (Misti), HackInTheBox, Blackhat, OSCON, Bellua, Syscan, ISACA etc. His articles are regularly published on Securityfocus, InformIT, DevX, O’reilly, HNS. His work has been quoted on BBC, Dark Reading, Bank Technology as an expert.

Previous Meeting (Mar-4-2009) in Brussels

WHEN

Wednesday, March 4th, 2009 (18h00pm-21h00pm)

WHERE

Location is sponsored by Telindus, Belgacom-ICT.
Address: Geldenaaksebaan 335, B-3001 Heverlee (Route + Google Maps)

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome & Refreshments
  
• 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, Telindus, OWASP Board)
  
• 18h45 - 20h45: A Software Security Maturity Model (by Gary McGraw, CTO of Cigital)
  

Presentation + discussion: As a discipline, software security has made great progress over the last decade. There are now at least 23 large scale software security initiatives underway in enterprises including global financial services firms, independent software vendors, defense organizations, and other verticals. In 2008, Brian Chess, Sammy Migues and I interviewed the executives running nine initiatives using the twelve practices of the Software Security Framework as our guide. The resulting data, drawn from real programs at different levels of maturity was used to guide the construction of a Software Security Maturity Model. This talk will describe the maturity model, drawing examples from many real software security programs. A maturity model is appropriate because improving software security almost always means changing the way an organization works ---people, process, and automation are all required. While not all organizations need to achieve the same security goals, all successful large scale software security initiatives share common ideas and approaches. Whether you rely on the Cigital Touchpoints, Microsoft's SDL, or OWASP CLASP, there is much to learn from practical experience. Use the software security maturity model to determine where you stand and what kind of software security plan will work best for you.

Gary McGraw (aka gem) is the CTO of Cigital, Inc., a software security and quality consulting firm with headquarters in the Washington, D.C. area. He is a globally recognized authority on software security and the author of six best selling books on this topic. The latest, Exploiting Online Games was released in 2007. His other titles include Java Security, Building Secure Software, Exploiting Software, and Software Security; and he is editor of the Addison-Wesley Software Security series. Dr. McGraw has also written over 90 peer-reviewed scientific publications, authors a monthly security column for darkreading.com, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Fortify Software and Raven White. His dual PhD is in Cognitive Science and Computer Science from Indiana University where he serves on the Dean's Advisory Council for the School of Informatics. Gary is an IEEE Computer Society Board of Governors member and produces the monthly Silver Bullet Security Podcast for IEEE Security & Privacy magazine.

Previous Meeting (Feb-4-2009) in Brussels

BLOG posts by
security4all
rootshell

WHEN

Wednesday, February 4th, 2009 (18h00pm-21h00pm)

WHERE

Location was sponsored by Ernst&Young's Information Security Team.
address: De Kleetlaan 2, 1831 Diegem (Route + Google Maps)

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome & Refreshments
  
• 18h30 - 18h40: OWASP Update (by Sebastien Deleersnyder, Telindus, OWASP Board)
  
• 18h40 - 19h30: Best Practices Guide Web Application Firewalls (by Alexander Meisel, CTO and founder of Art of Defence)
  

Presentation + discussion: the OWASP German chapter has put together a paper to give a better understanding in how and where Web Application Firewalls should be used.

Alexander Meisel is CTO and founder of art of defence. He is in charge of product development, professional services and support. His interest and expertise in the area of security dates back to his thesis in which he wrote about avoiding and tracing distributed denial-of-service attacks. He worked for a Swiss IT service provider as a Web security expert; later he joined LINX, Europe’s largest Internet exchange, where he took care of member network security issues. After working for three years as a senior consultant designing and implementing large Web farms, including security audits with a leading producer of web servers, Alexander switched to a SPX Corporation company, where he was the main project manager for Web application solutions in the SAP area.

• 19h30 - 20h00: I thought you were my friend - Evil Markup, browser issues and other obscurities (by Mario Heiderich)
  

Presentation: This talk is a preview of the upcoming Poland talk (still in selection process). The talk will cover a short exegesis of how and where browser vendors talk about security - and what can be seen from a security professionals perspective. The ratio between the growth of new browser technologies and the amount of time for developers to learn working with them could turn out to be a problem - especially when knowing that todays browsers support a vast amount of lost treasures. Amongst them various XML quirks, data islands, SVG fonts etc. which make it hard to protect rich web applications. Surprising but true: several of the most recent in-the-wild browser exploits were possible due to those legacy features like the IE6-8 code execution flaw. Reason enough to dive into a collection of weird techniques and standards exposing attack vectors and scenarios that WAF systems and filters might have some trouble with. The talk also shows some issues regarding IE8 and Opera 10 - as well as current Firefox versions. The conclusion of the talk features an overview of what we can expect during the next months, ways for developers and related parties to deal with those security risks.

Mario Heiderich, is a cologne based CTO for an online enterprise based in Cologne and New York. He was visitor and speaker on several OWASP conferences, maintains the PHPIDS and other security related projects and recently authored a German book on Web Security together with Christian Matthies, fukami and Johannes Dahse. He is currently into browser security and digging the HTML5 specifications.

• 20h00 - 20h10: Break
• 20h10 - 21h00: Research on Belgian bank trojan attacks (by Richard Bennett, software consultant)
  

Presentation + discussion: Richard will present results of his research on trojans attacking customers of Belgian banks.

The paper summarizes the following aspects:

• What are these 'Banking Trojans'?
• Who creates them and why?
• What kind of infrastructure are they using?
• Which banks and organizations are they targeting?
• How do these trojans affect the target PC, and how are they spread?
• How can they be detected and removed?
• What are the risks to banking and e-commerce?
• What are the CBFA's updated 2009 recommendations, and do they make sense?
• How can we further mitigate this risk?

It is quite a high-level paper aimed to be used as input and context during a risk-analysis.

The PDF will be made available shortly.

Richard_Bennett is an OWASP member and consultant with Elmos NV, currently working for a Belgian business bank as test and QA engineer.