BeNeLux OWASP Day 2010

Welcome

Confirmed Speakers:

Eoin Keary (OWASP Board, E&Y)
Sebastien Deleersnyder (OWASP Board, SAIT Zenitel)
Radu State (University of Luxembourg)
N Nikiforakis (Katholieke Universiteit Leuven)
Marco Balduzzi (Eurecom)
Walter Belgers (Madison Gurkha)
Thierry Zoller
...

Download the conference flyer here.
All the presentations will be available for download in the agenda tab.

Training, December 1st

COURSE

OWASP Projects and Resources you can use TODAY!

Overview & Goal

Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle.

This course aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.

If you are interested in participating in the hands on portion of the course, please bring a laptop.

Date

Venue & Directions

December 1, 2010

Fontys Hogescholen, Den Dolech 2, Traverse 3.43, Eindhoven, The Netherlands

How to get here:

Price & Registration

This Course is FREE for OWASP Members. Registration is mandatory. If you are not an OWASP member as of yet please consider becoming one - $50/USD 12 month term for individual supporters.
Register Now	OWASP Membership (sign now)

COURSE'S MODULES DETAILS
Time	Module	Trainer	Presentation	Overview & Goal
11h00 (30m)	Guided tour of OWASP Projects		Tour of OWASP’s projects	See details and Trainer's notes
11h30 (45m)	Threat Risk Modeling	Martin Knobloch	Threat Modeling – how to do it	See details and Trainer's notes
12h15 (15m)	Coffee Break
12h30 (45m)	OWASP Testing Guide	Martin Knobloch	Application Security Using the Testing Guide	See details and Trainer's notes
13h30 (60m)	Lunch
14h30 (60m)	OWASP Top 10	Sebastien Deleersnyder	OWASP Top 10 - Issues and Remedies	See details and Trainer's notes
15h30 (90m)	OWASP Code Review Project	Eoin Keary	OWASP Code Review	See details and Trainer's notes
17h00 (15m)	Coffee Break
17h15 (60m)	OWASP Software Assurance Maturity Model	Sebastien Deleersnyder	Software Assurance Maturity Model & Secure Development Lifecycle	See details and Trainer's notes

Conference, December 2nd

Location - December 2nd, 2010

from - to

Registration

from - to

Agenda:

Welcome and OWASP Update (by Eoin Keary, OWASP Board, E&Y and Seba Deleersnyder, OWASP Board, SAIT Zenitel)
0wning Networks with VoIP and Web attacks (by Radu State, University of Luxembourg)

Voice over IP is the current de facto technology for delivering voice data in both enterprise and service provider infrastructure. Although , security threats specific to VoIP signalling have been known for a while, few is known about cross-layer attacks in which Web enabled VoIP devices allow for efficient attacks against the VoIP infrastructure and general IT networks .

This talk will give a short introduction to VoIP and continue with a series of attacks that leverage SIP as efficient transport vehicle for billing attacks , disclosure attacks and network penetration. The talk will show how one single phone call can compromise even the best secured and hardened network perimeter .

Privacy of file sharing service (by N Nikiforakis, Katholieke Universiteit Leuven)

File sharing services are used daily by tens of thousands of people as a way of sharing files. Almost all such services, use a security-through-obscurity method of hiding the files of one user from others. For each uploaded file, the user is given a secret URL which supposedly cannot be guessed. The user can then share his uploaded file by sharing this URL with other users of his choice. Unfortunately though, a number of file sharing services are incorrectly implemented allowing an attacker to guess valid URLs of millions of files and thus allowing him to enumerate their file database and access all of the uploaded files. In this paper, we study some of these services and we record their incorrect implementations. We design automatic enumerators for two such services and a privacy-classifying module which characterises an uploaded file as private or public. Using this technique we gain access to thousands of private files ranging from private and company documents to personal photographs. We present a taxonomy of the private files found and ways that the users and services can protect themselves against such attacks.

Clickjacking: an empirical study with an automated testing/detection system (by Marco Balduzzi, Eurecom)

Clickjacking recently received new media attentions: Thousands of Facebook users have fallen victims of a worm that uses clickjacking techniques to propagate.

In a clickjacking attack, a malicious page is constructed (or a benign page is hijacked) to trick the user into performing unintended clicks that are advantageous for the attacker, such as propagating a web worm, stealing confidential information or abusing of the user session.

However it is currently unclear to what extent clickjacking is being used by attackers in the wild and how significant the attack is for the security of Internet users.

In this talk, we presents a solution we designed for studying the prevalence of clickjacking on the Internet and for detecting possible malicious pages in an automated fashion. We deployed our system over 10 distinct virtual machines to test more then a million unique web-pages in two months. From the analysis of our experimental results we discuss the clickjacking phenomenon and its future implications.

Attacking is easy, defending is hard (by Walter Belgers, Madison Gurkha)

An attacker has an easy job. They need only find one security hole, and they've broken the system. The system, application and network administrators :have a much harder task. They have to find not just one, but each and every one of the holes. Preferably before the bad guys do.

And, these holes can be at several different layers. In the presentation, we will look at those layers (system level, application level, but also user :level) and observe what goes wrong and how to fix it. The observations come from the daily work at Madison Gurkha.

Examples of problems are lack of patches, problems during the development phase, susceptibility to social engineering attacks and more.

How not to design and implement a cash back system (by Thierry Zoller)

..

Speakers

Eoin Keary (OWASP Board, E&Y)

Chapter Lead and founder of OWASP Ireland chapter. Co-Author,Co - Editor and team lead of the OWASP Testing Guide.

Co-Author, Editor/team lead of the OWASP Code Review guide.

Sebastien Deleersnyder (OWASP Board, SAIT Zenitel)

Sebastien started the successful Belgian OWASP Chapter and performed several public presentations on web application and web services security. Sebastien specialises in (web) application security, combining his software development and information security experience. He is currently OWASP Foundation board member and Managing Technical Consultant at SAIT Zenitel.

Radu State (University of Luxembourg)

Radu received his PhD degree from INRIA, Nancy – University Henri Poincaré in 2001.

Radu has held positions as Research Engineer and Senior Engineer at INRIA-LORIA and has been working as Senior Researcher at the University of Luxembourg, FSTC-CSC Research Unit from October 2008 to September 2010. Radu's research activity will be on one side investigate interoperability aspects to supply security components in the area of ubiquitous computing and on the other side set up a project specific interoperability research lab in close cooperation with industry.

Nick Nikiforakis (Katholieke Universiteit Leuven)

Nick Nikiforakis is a PhD student at the Katholieke Universiteit Leuven, in Belgium. He belongs to the DistriNet research group and specifically in the “Security & Languages” task-force. His current research interests are: low-level security for unsafe languages and web application security.

Nick holds a BSc in Computer Science and a MSc on Distributed Systems from the University of Crete in Greece. He worked for 3 years as a research assistant in the Distributed Computing Systems group at the Foundation of Research and Technology in Crete where he did research in network data visualization, authentication schemes using mobile devices and phishing countermeasures. In the past, Nick has presented his work in academic conferences as well as hacking conventions. His work can be found online at www.securitee.org.

Marco Balduzzi (Eurecom)

Marco Balduzzi was born in Seriate (Italy) in 1982. He has studied Computer Engineering at the University of Bergamo where he has obtained his Master (Eng. Msc.) with a thesis titled «Security by virtualization: a novel antivirus for personal computers». During his graduation studies, in 2005 he has spent six months as exchange student at the University of Science and Technology of Trondheim (Norway), and the following year he has joined an IT-security company in Munich (Germany) to perform an internship oriented to the research of a new system architecture for computers defense. Marco is interested in Linux and Free-Software since the year 2000, when he co-founded the Bergamo's Linux User Group. Since 2004, he has worked as IT-security and networking specialist for several companies in Milan (Italy), Munich (Germany) and Sophia-Antipolis (France). In October 2008, he has joined EURECOM as Ph.D. student, where he works in the research group of Applied Security iSecLab under the supervision of Prof. Engin Kirda

Walter Belgers (Madison Gurkha)

Walter Belgers heeft Technische Informatica gestudeerd aan de Technische Universiteit Eindhoven met als extra vak o.a. Computercriminaliteit (Universiteit van Tilburg). Walter is in 1994 begonnen bij Philips C&P (tegenwoordig Atos Origin) als ontwikkelaar van wereldwijde firewall-diensten en de uitrol daarvan. Daarna heeft hij enkele jaren lesgegeven op het gebied van UNIX en Internet beveiliging bij AT Computing. In 2002 is hij toegetreden tot Madison Gurkha als partner. Naast zijn technische consultancy-activiteiten, houdt Walter zich bezig met het schrijven van artikelen en columns, het geven van lezingen en voorlichten van de pers. Walter is gecertificeerd security professional (CISSP) en security auditor (CISA).

Martin Knobloch (Sogeti Nederland B.V.)

Martin Knobloch is employed at Sogeti Netherlands as Senior Security Consultant. He is founder and thought leader of the Sogeti task force PaSS, Proactive Security Strategy, with an integral solution of information security within organisation, infrastructure and software.

At OWASP, Martin is board member of the OWASP Netherlands Chapter and member of the Global Education Committee.