OGD15 Speakers

Mario Heiderich

Bio

Dr. Mario Heiderich, handsome heart-breaker, bon-vivant and (as he loves to call himself) "security researcher" is from Berlin, likes everything between lesser- and greater-than.

He leads the small yet exquisite pen-test company called Cure53 and pesters peaceful attendees on various 5th tier conferences with his hastily assembled PowerPoint-slides and a lot of FUD.

The closest Mario ever was to visiting 日本(Japan) was a wild ride between ESC$B and ESC(B so it's about time to pay a visit!)

Title

An Abusive Relationship with AngularJS – About the Security Adventures with the "Super-Hero" Framework

Abstract

Some voices claim that "Angular is what HTML would have been if it had been designed for building web applications". While this statement may or may not be true, is certainly accounts as one of the bolder ones a JavaScript web framework can ever issue. And where boldness is glistening like a German Bratwurst sausage in the evening sun, a critical review from a grumpy old security person shouldn’t be too far away. This talk will have a stern, very stern look at AngularJS in particular and shed light on the security aspects of this ever-popular tool. Did the super-hero framework do everything right and follow its own super-heroic principles? Does AngularJS increase or rather decrease the attack surface of a web application? How does AngularJS play along with the Content Security Policy, and was it a good idea to combine this kind of security with futuristic feature creep? And what about AngularJS version 2.0? Beware that we won’t stop at glancing at the code itself, investigating security best practices, and verifying compatibility and other common things that contribute to robust security (or lack thereof). We will cross the moral border and see if the AngularJS team could notice rogue bug tickets. A pivotal question that everyone is wondering about is: Have they successfully kept evil minds like yours truly speaker here from introducing new security bugs into the code base? This talk is a reckoning with a modern JavaScript framework that promises a lot and keeps even more, not necessarily for the best for developers and users. We will conclude in deriving a general lesson learnt and hopefully agree that progress doesn't invariably mean an enhancement.

Michele Orrú

Bio

Michele Orru a.k.a. antisnatchor is the lead core developer and smart-minds-recruiter for the BeEF project. Michele is also the co-author of the "Browser Hacker's Handbook." He has a deep knowledge of programming in multiple languages and paradigms, and is excited to apply this knowledge while reading and hacking code written by others. Michele loves lateral thinking, black metal, and the communist utopia (there is still hope!). He also enjoys speaking and drinking at a multitude of hacking conferences, including CONFidence, DeepSec, Hacktivity, SecurityByte, AthCon, HackPra AllStars, OWASP AppSec USA, 44Con, EUSecWest, Ruxcon, InsomniHack, PXE, BlackHat and more we just cant disclose. Besides having a grim passion for hacking and programming, he enjoys leaving his Mac alone, while fishing on saltwater and praying for Kubricks resurrection.

Title

Dark FairyTales from a Phisherman (Vol. III)

Abstract

Phishing and client-side exploitation DevOps for all your needs. Combine BeEF, PhishingFrenzy and your fishy business to automate most of the usual phishing workflow while minimizing human interaction. Multiple real-life phishing engagements will be discussed, together with the shiny new BeEF Autorun Rule Engine.

Marie Moe

Bio

Marie Moe is passionate about incident handling and information sharing, she cares about public safety and securing systems that may impact human lives, this is why she has joined the grassroots organisation “I Am The Cavalry”. Marie is a research scientist at SINTEF ICT, and has a Ph. D. in information security. She has experience as a team leader at NorCERT, the Norwegian national CERT. Marie also teaches a class on incident management and contingency planning at Gjøvik University College in Norway. Marie loves to break crypto protocols, but gets angry when its in her own body.

Title

Unpatchable - Living with a Vulnerable Implanted Device

Abstract

My life depends on the functioning of a medical device, a pacemaker that generates each and every beat of my heart. This computer inside of me may fail due to hardware and software issues, due to misconfigurations or network-connectivity.

Yes, you read that correctly. The pacemaker has a wireless interface for remote monitoring and I am forced to become a human part of the Internet-of-Things. As a seasoned security-professional I am worried about my heart’s attack surface.

This talk will be focused on the problem that we have these life critical devices with vulnerabilities that can’t easily be patched without performing surgery on patients, my personal experience with being the host of such a device, and how the hacker community can proceed to work with the vendors to secure the devices.

Jenny Radcliffe

Bio

Jenny Radcliffe - aka “The People Hacker” - is a force to be reckoned with. She can diffuse a crisis situation, talk her way into a secure building and spot a psychopath at a hundred paces. She has been called a mind reader and a ‘human lie detector’, and likened to a Jedi Knight.

In reality, she is an expert in Social Engineering (the human element of security), negotiations, non-verbal communication and deception, using her skills to help clients from corporations and law enforcement, to poker players, politicians and the security industry.

Using a mixture of scams, psychological tactics, advanced profiling and non verbal communication skills, Jenny highlights how criminals, special interest groups and others with mal-intent, can talk or trick their way into gaining access to personnel, buildings and confidential information. It’s a guaranteed eye-opener for everyone from the Board to the Staff – many of whom will not appreciate how intrinsically linked their personal and family security is with that of their employer!

Title

The Invisible Man - Social Engineering Methods and Mindsets Revealed - Workshop

Abstract

This session covers some of the most widely used social engineering methods and tactics and explains how these are used to breach the physical and human elements of organisations. The workshop also covers the psychology behind Social Engineering attacks and explains how and why it works, revealing the hidden mindset of Social Engineers and the victims they target, illustrated by anecdotes and lessons learnt from successful real life attacks.

Key Points

- Understand the goals and motivations of Social Engineers
- Understand some of the most common attack methods and tricks deployed 
- Revealing the dark psychology of Social Engineers. What makes a good Social Engineer?  Why are they successful? Who do they target? How and why choose one company or individual over another
- Advice and guidance into protecting against Social Engineering attacks and creating awareness within our organisations and as individuals
- Interactive exercises, quiz and case study with prizes 

Sean Duggan

Bio

<TBA>

Title

OWASP Security Shepherd - Workshop

Abstract

How do you know a web site is secure? How do you know your credentials are safe online? What makes a web site safe? Do you even know the questions to ask to help determine this? HTTPs is not the answer and trust is no longer a solution. The only way to be sure is to perform ethical hacking on the web application using a combination of manual and automated pentesting techniques. These skills are in high demand in the market place right now - but how can one get them? Well that's easy... if you take the right first step!

Join Sean Duggan for a 3 hour hands on workshop that will bring attendees up to speed on all the latest and greatest security testing techniques that are a concern in the market today. Compete against other attendees to solve increasingly complex security puzzles derived from real world security threats. Workshop attendees will leave with a real familiarity of web and mobile security testing best practice, terminology, workflows, and commonly used tool kits.

Bring an open mind and your laptop

Martin Johns

Bio

<TBA>

Title

<TBA>

Abstract

<TBA>

Rikard Bodforss

Bio

<TBA>

Workshop

Forensics - Workshop

Abstract

<TBA>