Welcome to the Belgium chapter homepage. The chapter leader is Sebastien Deleersnyder
OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.
to this chapter or become a local chapter supporter. Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member?
Upcoming chapter meetings
We will organize our next chapter meetings this year:
- 7 June 2016 (Registration via https://owasp-belgium-2016-06-07.eventbrite.com)
- week 26-Sep
- week 12-Dec
See https://www.owasp.org/index.php/Belgium#Chapter_Meetings for more details.
OWASP BeNeLux Day 2016
We are proud to announce the dates of the next edition of BeNeLux OWASP Day! The event will take place on 17 and 18 March 2016, in Belval Campus, in Esch-sur-Alzette - Luxembourg.
See BeNeLux OWASP Day 2016 for more details.
Stay in touch
If you want to be invited for the next OWASP Belgium Chapter meetings, please drop us your contact info.
Structural Sponsors 2016
OWASP Belgium thanks its structural chapter supporters for 2016 and the OWASP BeNeLux Days 2016:
If you want to support our chapter, please contact Seba Deleersnyder
Upcoming Meeting (7 June 2016) in Zaventem
Tuesday 7 June 2016
Hosted at PwC
Google Maps: https://goo.gl/maps/3Jo8u
- 18h15 - 19h00: Welcome & sandwiches
- 19h00 - 19h10: OWASP Update
- 19h10 - 20h00: CloudPiercer: Bypassing Cloud-based Security Providers (by Thomas Vissers)
- Abstract: Many website owners turn to Cloud-based Security Providers (CBSPs) to protect their websites from DDoS and web application attacks. Some of these security services rely solely on changing the DNS settings of a customer’s domain name to reroute his traffic through the CBSP's cloud infrastructure. This allows for complete circumvention of the security service by directly attacking the website’s hosting IP address. Therefore, it is crucial that a web server's hosting IP address remains hidden from potential attackers. Despite this risk, our study has shown that, in practice, over 70% of CBSP-protected domains are exposing their real IP address. In this talk, we will discuss several significant attack vectors and steps administrators can take to prevent their IP address from being discovered by attackers.
- Bio: 'Thomas Vissers Thomas Vissers is a PhD Researcher at iMinds-Distrinet, KU Leuven. His research is broadly focused on internet security and privacy topics, such as cloud-based security, domain name abuse, denial-of-service attacks, email security and browser fingerprinting. Furthermore, he has a special interest in machine learning, data mining and large-scale analyses. Thomas has published and presented his research at various international conferences, such as CCS, NDSS and HotPETS. He obtained his Master’s degree in Engineering from the University of Antwerp and was a research intern at Anna University, India.
- 20h00 - 20h15: Break
- 20h15 - 21h15:
A FAIR approach to risk (by Wim Remes, Rapid7)
- Abstract: IT Risk Management has quickly evolved from something we did once or twice a year to a full time practice within organizations large and small. As more and more data becomes available and with the understanding that taking risk is essential to doing business, we are looking for new approaches to bring the technical and business components of risk together. FAIR (Factor Analysis of Information Risk) is a risk ontology that can help organizations in understanding, communicating, and addressing information risk at all levels. In this presentation we will explore FAIR as a tool for organizations and the value it brings to all players on the risk playing field.
- Bio: Wim Remes As the Manager of Strategic Security Services for Rapid7 in EMEA, Wim Remes leverages his 15+ years of security leadership experience to advise clients on reducing their risk posture by solving complex security problems and by building resiliency into their organization. Wim delivers expert guidance on reducing the high cost of IT security failures, both financially and in terms of brand reputation combining his deep expertise in network security, identity management, policy design, risk assessment, and penetration testing to develop innovative approaches to enterprise security. Before joining the Rapid7 team, Wim was a Managing Consultant at IOActive and previously he has worked as a Manager of Information Security for Ernst and Young and a Security Consultant for Bull, where he gained valuable experience building security programs for enterprise class clients.
- Wim has been engaged in various infosec community initiatives such as the co-development of the Penetration Testing Execution Standard (PTES), InfosecMentors, and organizing the BruCON security conference. Wim has been a featured speaker at international conferences such as Excaliburcon (China), Black Hat Europe, Source Boston, Source Barcelona and SecZone (Colombia). He was also a Member of the Board of Directors at (ISC)2 from 2012 until 2014 and Chairperson of that Board in 2014.
Please register via EventBrite: https://owasp-belgium-2016-06-07.eventbrite.com
Previous Meeting (23 May 2016) in Mechelen
Monday 23 May 2016
Hosted at Moonbeat (Mechelen), kindly offered by is4u.
Oude Brusselsestraat 10-12
Route/Parking: http://www.moonbeat.be/contact .
- 18h00 - 19h00: Welcome & sandwiches
- 19h00 - 19h10: OWASP Update
- 19h10 - 20h00: All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and TLS (by Mathy Vanhoef, iMinds-DistriNet-KU Leuven)
- Abstract: We present new biases in RC4, break the Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP), and design a practical plaintext recovery attack against the Transport Layer Security (TLS) protocol. To empirically find new biases in the RC4 keystream we use statistical hypothesis tests. This reveals many new biases in the initial keystream bytes, as well as several new long-term biases. Our fixed-plaintext recovery algorithms are capable of using multiple types of biases, and return a list of plaintext candidates in decreasing likelihood.
- To break WPA-TKIP we introduce a method to generate a large number of identical packets. This packet is decrypted by generating its plaintext candidate list, and using redundant packet structure to prune bad candidates. From the decrypted packet we derive the TKIP MIC key, which can be used to inject and decrypt packets. In practice the attack can be executed within an hour. We also attack TLS as used by HTTPS, where we show how to decrypt a secure cookie with a high success rate using roughly one billion ciphertexts. This is done by injecting known data around the cookie, abusing this using Mantin's ABSAB bias, and brute-forcing the cookie by traversing the plaintext candidates. Using our traffic generation technique, we are able to execute the attack in merely 75 hours.
- Bio: Mathy Vanhoef is a PhD student at KU Leuven, where he performs research on RC4 and its usage in network protocols such as WPA-TKIP and SSL/TLS (e.g. he discovered the RC4 NOMORE attack). He also focuses on wireless security, where he studies MAC address randomization, analyzes protocols like WPA-TKIP, and implements low-layer Wi-Fi attacks using commodity hardware. Apart from research, he is also interested in low-level security, reverse engineering, and binary exploitation. He regularly participates in CTFs with KU Leuven's Hacknamstyle CTF team.
- 20h00 - 20h10: Break
- 20h10 - 21h00: Docker Security (by Nils De Moor, CTO at WooRank)
- Abstract: Docker, the new kid on the block, has taken the Ops world by storm. Suddenly everybody wants applications to be containerized and kick them from a development machine up to a production stack in seconds. But this new paradigm obviously has consequences in terms of security and compliance. In this talk we'll look at how to construct a container around applications and dive deeper into how we can put a tight lock around it, thanks to the built-in security primitives.
- Bio: Nils De Moor is co-founder and CTO at WooRank, a SaaS tool for digital marketing agencies to monitor online presence of a brand. By grabbing and calculating millions of data points every day, he developed a passion for automating, scaling and distributing applications. Besides that he is passionate about open source communities and has started some initiatives, like techbelgium.io, Docker and AWS meetup groups, etc.
- 21h00 - ... : Networking drink
Please register via EventBrite: https://owasp-belgium-2016-05-23.eventbrite.com
Previous Meeting (8 March 2016) in Leuven
Tuesday 8 March 2016
Hosted by iMinds-Distrinet Research Group (KU Leuven).
Both speakers are faculty of the Secure Application Development course which is held in Leuven from 7-11 March 2016. OWASP Members get a 10% discount to attend the course.
Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee (google maps)
- 18h15 - 19h00: Welcome & sandwiches
- 19h00 - 19h15: OWASP Update (PDF)
- 20h15 - 20h30: Break
- 20h30 - 21h30: Internet Censorship: Studies from China and Turkey (by prof. Dan Wallach, Rice University)
- Abstract: TBA
- Bio: Dan Wallach is a professor in the systems group at Rice University's Department of Computer Science, He manages Rice's computer security lab. His research interests include mobile code, wireless and smartphone security, and the security of electronic voting systems.
Please register via EventBrite: https://owasp-belgium-2016-03-08.eventbrite.com
The Belgium Chapter is supported by the following board:
- Sebastien Deleersnyder, Toreon
- Erwin Geirnaert, Zion Security
- Philippe Bogaerts, AviNetworks
- André Mariën, Euroclear
- Lieven Desmet, KU Leuven
- Bart De Win, PWC
- David Mathy, Freelance