BeNeLux OWASP Day 2016



= Information =

OWASP BeNeLux Announcement
We are proud to announce the dates of the next edition of BeNeLux OWASP Day! The event will take place on 17 and 18 March 2016, in Belval Campus, in Esch-sur-Alzette - Luxembourg. More information on the venue can be found.

The OWASP BeNeLux Program Committee

 * Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium
 * Martin Knobloch, OWASP Netherlands
 * Jocelyn Aubert, OWASP Luxembourg

Tweet!
Event tag is #owaspbnl16

Donate to OWASP BeNeLux
Donate

= Registration =

OWASP BeNeLux training day and conference are free, but registration is required!
Register today at https://owasp-benelux-day-2016.eventbrite.com. We only have a limited number of seats available for our trainings and conference. First come, first serve!

To support the OWASP organisation, consider to become a member, it's only US$50! Check out the Membership page to find out more.

= Venue =

Venue is
University of Luxembourg Maison du Savoir 2, avenue de l'Université L-4365 Esch-sur-Alzette

By car
Check the Belval Campus map - available on google maps - for route information.

Outdoor parking areas and underground car parks are available throughout the campus, particularly P+R Belval Université, or Square Mile parking or Belval Plaza.

By train
Trains departing every 15 minutes from Luxembourg Central Station are direct to "Belval-Université" - line is connection-free via Esch-sur-Alzette. Get information on train schedules on the CFL’s website.

When on site, access to buildings is easy on foot.

Hotel nearby
Hotel Ibis Esch-Belval 12, avenue du Rock'n'Roll L-4361 Esch-sur-Alzette, Luxembourg From 81 EUR per night

= Trainingday =

Location
The training venue is at the same location as the.

Training Abstracts
The training abstracts will be available soon

Application Security Primer by Martin Knobloch
TBD

Hands-on Threat Modeling by Sebastien Deleersnyder
This is a 1 day, trainer-led, on-site, Threat Modeling course. The training material and hands-on workshops include real live Use Cases. The students will be challenged to perform practical threat modeling in groups of 3 to 4 people covering the different stages of threat modeling on:
 * B2B web and mobile applications, sharing the same REST backend
 * An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing.

Threat modeling allows you to consider, document, and discuss the security implications of designs in the context of their planned operational environment and in a structured fashion. Threat modeling also allows consideration of security issues at the component or application level. The threat modeling course will teach you to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model.

This course is aimed at software developers, architects, system managers or security professionals. Before attending this course, students should be familiar with basic knowledge of web and mobile Applications and databases. The students should bring their own laptop to the course.

Course topics (1 day)
Threat modeling introduction Diagrams – what are you building? Identifying threats – what can go wrong? Addressing each threat Threat modeling tools
 * Threat modeling in a secure development lifecycle
 * What is threat modeling
 * Why threat modeling?
 * Threat modeling stages
 * Diagrams
 * Identify threats
 * Addressing threats
 * Document a threat model
 * Understanding context
 * Doomsday scenarios
 * Data flow diagrams
 * Trust Boundaries
 * Hands-on: diagram B2B web and mobile applications, sharing the same REST backend
 * STRIDE introduction
 * Spoofing threats
 * Tampering threats
 * Repudiation threats
 * Information disclosure threats
 * Denial of service threats
 * Elevation of privilege threats
 * Hands-on: STRIDE analysis of an Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service
 * Mitigation patterns
 * Authentication: mitigating spoofing
 * Integrity: mitigating tampering
 * Non-repudiation: mitigating repudiation
 * Confidentiality: mitigating information disclosure
 * Availability: mitigating denial of service
 * Authorization: mitigating elevation of privilege
 * General tools
 * Open-Source tools
 * Commercial tools

The course students receive the following package as part of the course: The students should bring their own laptop
 * Hand-outs of the presentations
 * Work sheets of the use cases,
 * Detailed solution descriptions of the use cases
 * Template to document a threat model
 * Template to calculate risk levels of identified threats

Threat Modeling – real life use cases
As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world. In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build a threat model. Using this methodology for the hands on workshops we provide our students with a robust training experience and the templates to incorporate threat modeling best practices in their daily work. The students will be challenged to perform the threat modeling in groups of 3 to 4 people performing the different stages of threat modeling on: After each hands-on workshop, the results are discussed, and the students receive a documented solution.
 * B2B web and mobile applications, sharing the same REST backend
 * An Internet of Things (IoT) deployment with an on premise gateway and cloud-based secure update service

Sebastien Deleersnyder
Sebastien Deleersnyder, managing partner and application security consultant at Toreon will share his practical threat model experience. Sebastien led engagements in the domain of ICT-security, Web and Mobile Security with several customers including BNP Paribas Fortis, Atos Worldline, KBC, Nationale Nederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post, Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, served as vice-chair of the global OWASP Foundation Board and performed several public presentations on Web Application, Mobile and Web Services Security. Furthermore, Sebastien co-founded the yearly BruCON conference.

Security Shepherd by Mark Denihan
TBD

O-saft by Achim Hoffman
TBD

= Conferenceday =

Julie Gommes - Gamers, You're the New Botnets
Abstract: Downloading, playing, downloading, playing, downloading, playing, downloading, playing, downloading, playing... that is really funny. You can try new games every day but the guys who share those games are not just happy and funny people doing that just for pleasure to share "games". Yeas, they're sharing games, but lot of other Tools they enjoy to play with... Let's talk about malwares, about botnets, about backdoors and about some computer which can win a "botnet award". Bio: Julie Gommes is a cybersecurity contractor, working in Paris on risk analysis, Security gap analysis, Security in project management, Audit, CISO support. She is also trainer for exposed professionals (journalists, lawyers, HR, employees of NGOs ...). https://fr.linkedin.com/in/juliegommes; Twitter : @JujuSete

Arne Swinnen - The Tales of a Bug Bounty Hunter
Abstract: Bug bounty hunting is the new black! During this technical talk, several interesting vulnerabilities identified in Instagram, the increasingly-popular photo-based social media platform, will be presented. All vulnerabilities were disclosed responsibly via Facebook’s Public Bug Bounty program over the course of 2015 and 2016, and will be discussed in detail. Required advanced Mobile Security attack techniques for this Research, such as Binary Modification, Dynamic Hooking and Burp Suite Plugin Development will be covered, among other trickery. The most interesting vulnerabilities were hybrid: Combinations of complementary vulnerabilities in different environments (e.g. Web and Mobile). All identified issues’ root causes will be mapped onto the Software Development Life Cycle (SDLC), to analyze where they could have been prevented from materializing. Last but not least, the monetary rewards offered by Facebook for each vulnerability and general Bug Bounty Hunting advice will be shared with the community. Bio: Arne Swinnen is an IT Security Consultant at NVISO, a Belgian Cyber Security Consulting firm. Arne specializes in Application Security and Digital Forensics. He co-organized the first edition of the Cyber Security Challenge Belgium in 2015, a National cyber security competition designed exclusively for Belgian students. Arne was a speaker at Black Hat USA and BruCON in 2014, presenting novel anti-virus detection and evasion techniques (“One Packer to Rule Them All”). Since 2015, he is also listed on Facebook’s Bug Bounty Half of Fame''.

Christian Schneider & Alvaro Muñoz - Serial Killer: Silently Pwning your Java Endpoints
Abstract: In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees. The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application. The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start. Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process.

Bio's:
 * Christian Schneider (@cschneider4711) writes software since the nineties, works as a freelance software developer since 1997, focuses on Java since 1999 and on IT-Security - especially Pentesting - since 2005. He enjoys writing articles about web application security as well as speaks and trains at conferences (OWASP AppSecEU, JAX, WJAX, WebTechCon, DevOpsCon, HackPra, RSA). He blogs at Christian-Schneider.net
 * Alvaro Muñoz (@pwntester) works as Principal Security Researcher with HPE Security Fortify. He enjoys researching different programming languages and web application frameworks for vulnerabilities and unsafe APIs. Before joining the HPE research team, he worked as an Application Security Consultant helping enterprises to start and improve their application security programs. He blogs at pwntester.com

= Social Event =

Social Event
Wait for it...

= CTF =

Capture the Flag!

 * Do you like puzzles?
 * Do you like challenges?
 * Are you a hacker?

Whether you are an experienced hacker or new enthusiast you should come to OWASP BeNeLux Day and participate in the Capture the Flag event.

The OWASP CTF is especially designed to support challengers of all skill levels. The CTF contains multiple challenges in various fields related to application security. As every challenge gains you one point, you can pick and choose which challenge you want to play.

All you need is a laptop with a wifi card and your favorite (preferably) non-commercial tools.

So come, show off your skills, learn new tricks and above all have a good time at the CTF event.

= Sponsor =

Donate to OWASP BeNeLux
Sponsor

Promotion
Feel free to use the text below to promote our event!

We invite you to our next OWASP event: the BeNeLux OWASP Days 2016!

The good news: free! No fee!

The bad news: there are only 150 seats available (first register, first serve)!