Belgium

OWASP Belgium

Welcome to the Belgium chapter homepage. The chapter leader is Sebastien Deleersnyder

Participation

OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.

Sponsorship/Membership

to this chapter or become a local chapter supporter. Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member?

• Local News
• Chapter Meetings
• Belgium OWASP Chapter Leaders

Upcoming events

Upcoming chapter meetings

• 29 May 2017 in Machelen
• 19 June 2017 in Brussels

See https://www.owasp.org/index.php/Belgium#Chapter_Meetings for more details.

Stay in touch

If you want to be invited for the next OWASP Belgium Chapter meetings, please drop us your contact info.

Structural Sponsors 2017

OWASP Belgium thanks its structural chapter supporters for 2017 and the OWASP BeNeLux Days 2016:

If you want to support our chapter, please contact Seba Deleersnyder

19 June 2017 Meeting

WHEN

Monday 19 June 2017

WHERE

Host

NVISO

Address

Sinter-Goedelevoorplein 5 Parvis Sainte Gudule,
1000 Brussels

(map, directions)

PROGRAM

The agenda:

• 18h00 - 18h50: Welcome & sandwiches

• 18h50 - 19h00: OWASP Update (by Sebastien Deleersnyder, OWASP)

• 19h00 - 19h45: OWASP Summit Debrief (by Sebastien Deleersnyder, OWASP)

Abstract: The OWASP Summit 2017 is a 5-day participant driven event, dedicated to the collaboration of Development and Security professionals, with a strong focus on DevSecOps. This session will be a debriefing of what was delivered by 130+ participants in 145 Working Sessions :-).

Bio: Sebastien is an OWASP volunteer, Summit co-organizer and application security consultant at Toreon."

• 19h45 - 20h30: 'Threat modeling lessons from Star Wars (BruCON Video) (by Adam Shostack, freelance security consultant)

Abstract: Everyone knows you ought to threat model, but in practical reality it turns out to be tricky. If past efforts to threat model haven't panned out, perhaps part of the problem is confusion over what works, and how the various approaches conflict or align. This talk captures lessons from years of work helping people throughout the software industry threat model more effectively. It's designed to help security pros, developers and systems managers, all of whom will leave with both threat modeling lessons from Star Wars and a proven foundation, enabling them to threat model effectively.

Bio: Adam is a consultant, entrepreneur, technologist, author and game designer. He's a member of the BlackHat Review Board, and helped found the CVE and many other things. He's currently helping a variety of organizations improve their security, and advising and mentoring startups as a Mach37 Star Mentor. While at Microsoft, he drove the Autorun fix into Windows Update, was the lead designer of the SDL Threat Modeling Tool v3 and created the "Elevation of Privilege" game. Adam is the author of "Threat Modeling: Designing for Security," and the co-author of "The New School of Information Security."

• 20h30 - ... : Reception

REGISTRATION

Please register via EventBrite: https://owasp-belgium-2017-06-19.eventbrite.com

Coverage

29 May 2017 Meeting

WHEN

Monday 29 May 2017

WHERE

Host

Ernst & Young

Address

De Kleetlaan 2,
1831 Machelen

(map, directions)

PROGRAM

The agenda:

• 18h00 - 18h50: Welcome & sandwiches
  
• 18h50 - 19h00: OWASP Update (by Lieven Desmet)
  
• 19h00 - 19h45: HTTP for the Good or the Bad (by Xavier Mertens, freelance security consultant)
  

Abstract: Today, the classic infection vectors remain SMTP and HTTP. Many spam & phishing campaigns are delivered to the victim’s mailbox and usually the next step of the attack is performed on top of HTTP, by visiting a malicious website or downloading a piece of malicious code. This talk will be split in two parts. To begin, I’ll explain how HTTP techniques are used to make the life of security researchers and incident handlers more difficult (attackers use many techniques to prevent access to their juicy data). The next part will demonstrate that attackers are also humans and make mistakes like all of us. They also need to follow the OWASP Top-10! I’ll review some example of bad code / bad configuration that I found during my investigations.

Bio: Xavier Mertens is a freelance security consultant based in Belgium. His job focuses on protecting his customers by applying “offensive” (pentesting) as well as “defensive” security (incident handling, log management, SIEM, security visualisation, OSINT). Xavier is also a SANS Internet Storm Center handler (https://isc.sans.org). He’s also maintaining his security blog (https://blog.rootshell.be) and is a co-organizer of the BruCON security conference (http://www.brucon.org).

• 19h45 - 20h30: Reverse engineering with Panopticon: a Libre Cross-Platform Disassembler (by Kai Michaelis)
  

Abstract: The Panopticon project aims to develop a tool to end the dominance of proprietary software for reverse engineering.

Panopticon is a graphical disassembler written in Rust that runs on GNU/Linux, Windows and OS X, which aims to create a free replacement for tools like IDA Pro and BinDiff.

What sets Panopticon apart from other free disassembler is the belief that an intuitive GUI is paramount to aid human analysts to understand as much of the binary as possible. As such Panopticon comes with an Qt 5 UI written in QML that allows browsing and annotating control flow graphs.

Bio: Kai Michaelis studies IT-Security in Bochum, Germany and works part-time on Free Software. When he's not on the campus you can meet him at the local hackerspace. His interests are program analysis, reverse engineering and cryptography.

• 20h30 - ... : Reception

REGISTRATION

Please register via EventBrite: https://owasp-belgium-2017-05-29.eventbrite.com

Coverage

28 February 2017 Meeting

WHEN

Tuesday 28 Feburary 2017

WHERE

Host

Distrinet Research Group (KU Leuven) (Both speakers are faculty of the Secure Application Development course held in Leuven from 2017-02-27 to 2017-03-03.)

Address

Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee

(map, directions)

PROGRAM

The agenda:

• 18h15 - 19h00: Welcome & sandwiches
  
• 19h00 - 19h10: OWASP Update (by Lieven Desmet)
  
• 19h10 - 20h00: XSS defense strategies (by Jim Manico, Manicode Security)
  

Abstract: TBD

Bio: Jim Manico is the founder of Manicode Security where he trains software developers on secure coding and security engineering. Jim is a frequent speaker on secure software practices and is a member of the Java-One Rock Star speaker community. Jim was a Global Board Member for the OWASP foundation and is the author of "Iron-Clad Java: Building Secure Web Applications" from McGraw-Hill..

• 20h00 - 20h10: Break
  
• 20h10 - 21h00: Why traditional Web security technologies no longer suffice (by Philippe De Ryck, KU Leuven)
  

Abstract: Not a day goes by without a story on a Web security incident somewhere. A data breach disclosing millions of people’s details. A defacement of a major Web site. Malware served from a legitimate Web site to thousands of users. Contrary to popular belief, the people running these Web sites are generally not clueless about security, but getting it right is just not that easy. Recent evolutions, like the rise of public networks, or the strong dependence on third-party code, have made it easier to attack Web sites, and harder to defend them. Join us to get an overview of these threats, and to take a dive into HTTP Strict Transport Security (HSTS), one of the latest Web security technologies that really help you improve security.

Bio: Philippe De Ryck is a professional speaker and trainer on software security and web security. Since he obtained his PhD at the imec-DistriNet research group (KU Leuven, Belgium), he has been running the group's Web Security Training program, which ensures a sustainable knowledge transfer of the group’s security expertise towards practitioners.

REGISTRATION

Please register via EventBrite: https://owasp-belgium-2017-02-28.eventbrite.com

Coverage

Previous Meeting (18 October 2016) in Ghent

WHEN

Tuesday 18 October 2016

WHERE

Hosted at UGent

Faculteit Ingenieurswetenschappen en Architectuur
Campus Boekentoren
Jozef Plateaustraat 22
9000 Gent
Belgium

PROGRAM

The agenda:

• 18h15 - 19h00: Welcome & sandwiches
  
• 19h00 - 19h10: OWASP Update
  
• 19h15 - 19h45: Find and fix software security problems… wait, do not make security mistakes in the first place! (by Matias Madou)
  

Abstract: Today, companies do not have a shortage of known security problems in their solutions. Tools and people point out numerous software security problems that eventually should be fixed. So how do organizations deal with all these issues? What is the most effective way to get issues fixed? For companies taking security serious, the question is no longer “How many problems can you find?”, but the real question is “How many security issues can you fix or prevent developers from making?” In this session, we explore different routes on how to find and fix security issues, or prevent making them in the first place.

Bio: Matias is the founder of Sensei Security, a software security startup building solutions to effectively fix and prevent security problems in software. Matias has over a decade of hands-on software security experience ranging from the research to improve existing solutions to scoping and building new solutions. A dozen patents and a bunch of papers are the result of his research that eventually led to a hand full of commercial products.

• 19h45 - 19h55: Break
  
• 19h55 - 20h30: Exploit mitigation using Multi-Variant Execution (by Stijn Volckaert)
  

Abstract: Software we rely on every day is riddled with security vulnerabilities that can be exploited to crash, extract data, or seize control of computer systems. Current exploit mitigations do not seem to suffice to remedy this situation because hackers can circumvent them with relative ease. In this talk, I will present GHUMVEE, a state-of-the-art Multi-Variant Execution framework that was developed at Ghent University. GHUMVEE can amplify the effectiveness of other exploit mitigations and enable them to detect and block zero-day attacks. The idea is to create multiple diversified replicas of a vulnerable program and to execute these replicas in parallel on the same inputs while simultaneously monitoring their behavior. The program replicas are functionally equivalent under normal circumstances but behave differently when attacked. GHUMVEE detects this behavioral difference using a monitor. In the talk, I will discuss GHUMVEE’s design and implementation, as well as some of the follow-up research sponsored by the Defense Advanced Research Projects Agency (DARPA) in the USA.

Bio: Stijn is a Postdoctoral Scholar in Prof. Michael Franz’ research group at the University of California, Irvine. He received his Ph.D. from Ghent University in 2015, under the supervision of Prof. Bjorn De Sutter and Prof. Koen De Bosschere. His research interests include systems security, reliability, and compilation. He is the recipient of the 2016 IBM Innovation Award (awarded by the F.W.O) for his PhD thesis on the topic of Multi-Variant Execution.

• 20h30 - 20h40: Break
  
• 20h40 - 21h15: ASPIRE: Advanced Software Protection: Integration, Research, and Exploitation (by Bjorn De Sutter)
  

Abstract: ASPIRE is a three year European FP7 research project on software protection to mitigate Man-at-the-End attacks on native code libraries on mobile systems. Together with Nagravision, Gemalto, and SafeNet, world leaders in their respective security markets, four academic institutes aim for developing layered, but software-only protection techniques that can protect the assets embedded in mobile apps of content, software and service providers as well as can be achieved with custom hardware-based protections such as smart cards and dongles. The project also aims for developing a quantitative evaluation methodology to assess the value of combinations of protections, and decision support to aid users of the ASPIRE protection framework. ASPIRE ends in October 2016, so this talk will present a preview off the final project results.

Bio: Since 2008, Bjorn is a professor in the Computer Systems Lab at Ghent University. His research topics include compiler technologies and software protection, incl. binary rewriting techniques for a wide range of applications such as fault-injection mitigation, side-channel leakage mitigation, anti-reverse engineer, anti-tampering, and anti-debugging. He coordinates the ASPIRE project.

• 21h15 - ...: drink and networking event

REGISTRATION

Please register via EventBrite: https://owasp-belgium-2016-10-18.eventbrite.com

Coverage

Previous Meeting (8 September 2016) in Zaventem

WHEN

Thursday 8 September 2016

WHERE

Hosted at PwC

Woluwedal 18
1932 Zaventem
Belgium

Google Maps: https://goo.gl/maps/3Jo8u

PROGRAM

UPDATED AGENDA:

The agenda:

• 18h15 - 19h00: Welcome & sandwiches
  
• 19h00 - 19h15: OWASP Update
  
• 19h15 - 20h00: CloudPiercer: Bypassing Cloud-based Security Providers (by Thomas Vissers, iMinds-DistriNet-KU Leuven)
  

Abstract: Many website owners turn to Cloud-based Security Providers (CBSPs) to protect their websites from DDoS and web application attacks. Some of these security services rely solely on changing the DNS settings of a customer’s domain name to reroute his traffic through the CBSP's cloud infrastructure. This allows for complete circumvention of the security service by directly attacking the website’s hosting IP address. Therefore, it is crucial that a web server's hosting IP address remains hidden from potential attackers. Despite this risk, our study has shown that, in practice, over 70% of CBSP-protected domains are exposing their real IP address. In this talk, we will discuss several significant attack vectors and steps administrators can take to prevent their IP address from being discovered by attackers.

Bio: Thomas Vissers Thomas Vissers is a PhD Researcher at iMinds-Distrinet, KU Leuven. His research is broadly focused on internet security and privacy topics, such as cloud-based security, domain name abuse, denial-of-service attacks, email security and browser fingerprinting. Furthermore, he has a special interest in machine learning, data mining and large-scale analyses. Thomas has published and presented his research at various international conferences, such as CCS, NDSS and HotPETS. He obtained his Master’s degree in Engineering from the University of Antwerp and was a research intern at Anna University, India.

• 20h00 - 20h15: Break
  
• 20h15 - 21h15: Hackers! Do we shoot or do we hug? (by Edwin van Andel, Zerocopter)
  

Abstract: In the ever changing security landscape we are slowly seeing a shift from labeling hackers per default as 'bad and malicious individuals', to accepting them slowly as 'useful and potentially friendly’. We see more and more compagnies starting a bug bounty program and/or a Responsible Disclosure (Coordinated vulnerability disclosure) program.

We in te Netherlands are (at least in Europe) leading the pack on this last subject, also backed heavily by the Dutch NCSC, the Dutch government and the Dutch prosecution services with their Responsible Disclosure guideline .

In this interactive and mostly humorous talk I’ll start with defining security (in a grotesk way), followed bij the definition of hackers, the way hackers think and work, and how they can be used instead of feared by compagnies. I’ll show how bug bounties and the Responsible Disclosure processes work, or how they sometimes do not. I will also take the audience with me on some examples on how and why some websites fail in being secure, and the development errors behind those fails.

During the talk I interact a lot with the audience, do quiz questions about the subject, and reward good answers with a bottle of club-mate. At the end of the talk the combined audience consensus should of course be to hug the hackers!

Bio: Edwin van Andel , better known as @Yafsec, joined Zerocopter, where he's mostly working on publicly expanding their “continuous security” platform. Elected winner of the Lightning talks at BruCON 2013, and organizer of the alternative NCSC conference "because no hackers were invited" #ALT-S, he is now a renown speaker that will introduce you -in a humorous way- to the dangers, virtues and current state of affairs in the security landscape.

REGISTRATION

Please register via EventBrite: https://owasp-belgium-2016-09-08.eventbrite.com

Coverage

Previous Meeting (23 May 2016) in Mechelen

WHEN

Monday 23 May 2016

WHERE

Hosted at Moonbeat (Mechelen), kindly offered by is4u.

Venue address:
Moonbeat
Oude Brusselsestraat 10-12
2800 mechelen

Route/Parking: http://www.moonbeat.be/contact .

PROGRAM

The agenda:

• 18h00 - 19h00: Welcome & sandwiches
  
• 19h00 - 19h10: OWASP Update
  
• 19h10 - 20h00: All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and TLS (by Mathy Vanhoef, iMinds-DistriNet-KU Leuven)
  

Abstract: We present new biases in RC4, break the Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP), and design a practical plaintext recovery attack against the Transport Layer Security (TLS) protocol. To empirically find new biases in the RC4 keystream we use statistical hypothesis tests. This reveals many new biases in the initial keystream bytes, as well as several new long-term biases. Our fixed-plaintext recovery algorithms are capable of using multiple types of biases, and return a list of plaintext candidates in decreasing likelihood.

To break WPA-TKIP we introduce a method to generate a large number of identical packets. This packet is decrypted by generating its plaintext candidate list, and using redundant packet structure to prune bad candidates. From the decrypted packet we derive the TKIP MIC key, which can be used to inject and decrypt packets. In practice the attack can be executed within an hour. We also attack TLS as used by HTTPS, where we show how to decrypt a secure cookie with a high success rate using roughly one billion ciphertexts. This is done by injecting known data around the cookie, abusing this using Mantin's ABSAB bias, and brute-forcing the cookie by traversing the plaintext candidates. Using our traffic generation technique, we are able to execute the attack in merely 75 hours.

Bio: Mathy Vanhoef is a PhD student at KU Leuven, where he performs research on RC4 and its usage in network protocols such as WPA-TKIP and SSL/TLS (e.g. he discovered the RC4 NOMORE attack). He also focuses on wireless security, where he studies MAC address randomization, analyzes protocols like WPA-TKIP, and implements low-layer Wi-Fi attacks using commodity hardware. Apart from research, he is also interested in low-level security, reverse engineering, and binary exploitation. He regularly participates in CTFs with KU Leuven's Hacknamstyle CTF team.

• 20h00 - 20h10: Break
  
• 20h10 - 21h00: Docker Security (by Nils De Moor, CTO at WooRank)
  

Abstract: Docker, the new kid on the block, has taken the Ops world by storm. Suddenly everybody wants applications to be containerized and kick them from a development machine up to a production stack in seconds. But this new paradigm obviously has consequences in terms of security and compliance. In this talk we'll look at how to construct a container around applications and dive deeper into how we can put a tight lock around it, thanks to the built-in security primitives.

Bio: Nils De Moor is co-founder and CTO at WooRank, a SaaS tool for digital marketing agencies to monitor online presence of a brand. By grabbing and calculating millions of data points every day, he developed a passion for automating, scaling and distributing applications. Besides that he is passionate about open source communities and has started some initiatives, like techbelgium.io, Docker and AWS meetup groups, etc.

• 21h00 - ... : Networking drink

REGISTRATION

Please register via EventBrite: https://owasp-belgium-2016-05-23.eventbrite.com

Coverage

Previous Meeting (8 March 2016) in Leuven

WHEN

Tuesday 8 March 2016

WHERE

Hosted by iMinds-Distrinet Research Group (KU Leuven).

Both speakers are faculty of the Secure Application Development course which is held in Leuven from 7-11 March 2016. OWASP Members get a 10% discount to attend the course.

Address:
Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee (google maps)

Routemap: https://distrinet.cs.kuleuven.be/about/route/

PROGRAM

The agenda:

• 18h15 - 19h00: Welcome & sandwiches
  
• 19h00 - 19h15: OWASP Update (PDF)
  
• 19h15 - 20h15: Writing robust client-side code using Modern JavaScript (by Tom Van Cutsem, Bell Labs, Nokia)
  

Abstract: In this talk, I will take the audience on a tour of recent evolutions in the JavaScript language (and surrounding ecosystem) and how they can use these changes to their advantage to write better client-side code that is more robust against bugs and other exploits. JavaScript — still unquestionably the dominant client-side language in use on the Web — has evolved significantly over the past five years, with two significant updates to ECMAScript, its defining standard. I will give a brief introduction to the language and its Good and Bad parts and then move on to features added in ECMAScript 5th edition, such as "strict mode", which are by now widely deployed in major browsers. Next, I will look at relevant language features that were introduced recently as part of ECMAScript 6th edition. Finally, I will give a brief introduction to Secure ECMAScript (SES), which is a secure JavaScript dialect that enables the safe embedding of third-party scripts in a webpage, also forming the basis for Google’s Caja compiler.

Bio: Tom Van Cutsem is a senior researcher at Nokia Bell Labs in Antwerp, Belgium. Prior to joining Bell Labs, he was a professor of computer science at Vrije Universiteit Brussel. He sat on the ECMA TC39 committee in charge of standardising JavaScript and actively contributed to the ECMAScript 2015 (a.k.a. “ES6”) standard. Together with Mark S. Miller, he designed and specified ECMAScript’s new reflection API. Tom's broader research interests lie in distributed systems, programming languages, stream processing, concurrency and parallelism. He received his PhD in 2008 from Vrije Universiteit Brussel for his research on AmbientTalk, a distributed scripting language for mobile phones.

• 20h15 - 20h30: Break
  
• 20h30 - 21h30: Internet Censorship: Studies from China and Turkey (by prof. Dan Wallach, Rice University)
  

Abstract: TBA

Bio: Dan Wallach is a professor in the systems group at Rice University's Department of Computer Science, He manages Rice's computer security lab. His research interests include mobile code, wireless and smartphone security, and the security of electronic voting systems.

REGISTRATION

Please register via EventBrite: https://owasp-belgium-2016-03-08.eventbrite.com

Coverage

Previous Years

• Events held in 2015
• Events held in 2014
• Events held in 2013
• Events held in 2012
• Events held in 2011
• Events held in 2010
• Events held in 2009
• Events held in 2008
• Events held in 2007
• Events held in 2006
• Events held in 2005

The Belgium Chapter is supported by the following board:

• Sebastien Deleersnyder, Toreon
• Erwin Geirnaert, Zion Security
• Philippe Bogaerts, AviNetworks
• Lieven Desmet, KU Leuven
• Bart De Win, PWC
• David Mathy, Freelance
• Adolfo Solero, Freelance
• Stella Dineva, Ingenico Payment Services
• Thomas Hermes, NVISO

Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.