AppSec 2007 pictures of breach party

OWASP and WASC AppSec Conference is over and it was by far the best conference i have ever been to. I was able to meet up with so many fantastic people, some of them i have exchanged emails with before and was good to see them in person. The conference topics and the presentation were really good. It was also my first time moderating a panel and it was a great experience. With such a sensitive topic, I was hoping the discussion would be a little bit more controversial but I guess since there was just one microphone, everyone was waiting for their turn and hence the discussion got a little dull. Or maybe the absece of google on the panel and microsoft getting a lot better in their security practice didnt help much :) It was a good discussion none the less.

Breach is building a reputation of throwing the best vendor parties during these conferences. Here are my set of pictures for the Tech Expo and the breach party.

RSnake flirting with the waitress

Pravir and Dinis Cruz sharing some thoughts

You get so many webappsec guys together and the lightning starts to come down. :)

From left : Jeremiah Grossman, Arian Evans, pdp, Myself, Ryan Barnett, Stefano DiPaola, Ory Segal and his colleague from IBM

pdp giving Arian a lesson on Web 2.0 hacking :)

Ryan Barnett, Stefano and Ory Segal (Happy to be here)

Whitehat Security Ops Team with few friends

Dinis Cruz and Arian Evans

Jeremiah, pdp and (i dont the person in the middle)

Ory Segal (enjoying the party)

The pictures below are of the Expo

Who are the real culprits for PCI compliance?

There was an article in SearchSecurity today on TJX issue.

Don't blame PCI DSS for TJX troubles, IT pros say
http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1280854,00.html?track=sy160&asrc=RSS_RSS-10_160

Here is an excerpt from the article

The auditor said TJX passed a PCI DSS check-up, but that the auditor failed to notice some key problems.

"They had no network monitoring and no logs, and they had unencrypted data," he said. "But this wasn't picked up by the auditor. They passed the Level 1 inspection and shouldn't have."



This makes me wonder what is the real objective of PCI complpiance. Most of the companies are still trying to understand the PCI requirements and hire a third party to assess their infrastructure for PCI compliance. Now, if PCI council has approved a vendor to assess a company's infrastructure for PCI requirements then for a company, the vendor understand PCI requirements and have proven to PCI council that they are qualified and capable of doing a good job. Now if a vendor charges $1000 to do the job or $15000 is upto the vendor. Companies are always looking for a good bargain and there is nothing wrong with that, as long as they are going to an approved vendor.

So if a company still gets breached after they are PCI compliant (assuming the data stored was not encrypted), who is actually liable in this case? The company or the vendor who certified the company for PCI compliance? In my mind, if the vendor would have told the company that they have to encrypt the sensitive data in their database, and company has not done it, then there was no question of company being PCI compliant.

Company getting penalized is understandable but is PCI council also going to impose penalties and fines on vendors who are not doing a good enough job? If a company is PCI compliant then its not completely company's fault for the data breach as much as it is the vendors, who did not identify and report the issues and certified the company as PCI compliant.

Panel discussion on Website Vulnerability Disclosure during AppSec Conference on Nov 15

As most of you know that OWASP-WASC AppSec Conference is held in ebay between Nov12-Nov15 including the training sessions. There are very many exciting topics to look forward to in the conference and not to forget the vendor parties at the end of the day. One of the things i am excited about is the panel discussion on Website Vulnerability Disclosure (which i will be moderating). We have some really great people on the panel and i am expecting a great lively discussion as the topic is also a little bit touchy :)

The panelists are
1. Robert "RSnake" Hansen - CEO of SecTheory with his blog at "http://ha.ckers.org".
2. Bruce Lowenthal - Director of Oracle Security Alerts Group, Oracle
3. Zulfikar Ramzan - Advanced Threat Team, Symantec;
4. Katie Moussouris - Security Strategist, Microsoft
5. Christopher Ernst - US Secret Service, San Francisco Field Branch.

I am expecting this to be one of the best panel since it is not only a sensitive topic but also since we will have the corporate, hacker and govt/law point of view on the subject.

Since i have been working on the questions to ask during the panel discussion, i thought i will also take others opinion on what kind of questions they would like to be asked. So, if you have any suggestions, please feel free to send me an email or leave them as a comment on the blog.

Do plan to be there as it should be fun. The date/time of the panel discussion is
Nov 15, 16:30 - 17:30

Here is the entire conference agenda
http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda

Conference Registration page (if you havent registered already) including the details on the vendor parties
http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007

WASC meetup on Nov 8

Its time for another WASC Meet-Up. As usual this will be an informal gathering. No agenda, slide-ware, or sponsors. Just some like minded people from the security industry getting together to share their stories over beer. Everyone is welcome and it should be a really fun time!

Please RSVP by email ASAP, if you haven't done so already, so we can make the proper reservations: anurag dot agarwal at yahoo dot com

Time: Thursday, Nov. 8 @ 7:00pm

Place:

Duke of Edinburgh
10801 N Wolfe Rd
Cupertino, CA 95014-0618
Phone: (408) 446-3853

OWASP & WASC AppSec 2007

The OWASP/WASC Black Hat cocktail party was so successful it only made sense to join forces again, this for an upcoming conference. OWASP & WASC AppSec 2007 is scheduled for Nov 12 – 15 @ eBay campus in San Jose, California. This will be an entire conference dedicated to web application security and something not to be missed. In fact, we’re a little nervous because the venue might be able to fit everyone (300 max) wanting to attend.

Currently we’re busy formalizing the agenda and coordinating the logistics with parties and events. If the wish list pans out, we’ll have an amazing speaker/topic line-up, a ton of industry experts in attendance, security professionals from all over silicon valley, and a hopefully a few surprises to go with it. The official announcement is below and I'll update the blog with new developments.

FYI: There are plenty of sponsorship opportunities for interested organizations.

OWASP and WASC have joined forces for this year's AppSec 2007 conference being held at eBay in San Jose, CA on Nov 12-15. A huge concentration of the industry leading experts will be in attendance presenting high quality web application security content. AppSec 2007 offers a unique opportunity for security professionals, software developers, and IT managers to get up to speed on the latest and greatest attack techniques, defense strategies, and industry trends in an atmosphere of peers. The conference format and venue is also perfect for networking and sharing experiences with others that are down in the trenches. AppSec 2007 expects to exceed all attendance records from the previously years, making space extremely limited. There's only room for approximately 300 attendees. So if you're planning to come, please register soon.

For more details and registration:
http://www.owasp.org/index.php/OWASP_&_WASC_AppSec_2007_Conference.

The conference also features:
1) Two full days of tutorials on a wide variety of web application security topics.
http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Training
2) A web services security track
3) Vendor services and technology expoConference

Location: The AppSec 2007 Conference will be held at eBay at their facility at: 2211 North First Street in San Jose, CA Nov 12th-15th.

Training Days: Novermber 12th-13th
Main Conference: November 14th-15th

WASC Meetup at IT Security World Conference on Sep 17

WASC is organizing another Meet-Up during the IT Security World Conference (Sep 17-18) in San Francisco @ O'Neills). As usual this will be an informal gathering. No agenda, slide-ware, or sponsors. Baysec is also organizing a meetup during that time and we are hoping to meet other security professionals from Bay Area. Everyone is welcome and it should be a really fun time!


Please RSVP by email ASAP, if you haven't done so already, so we can make the proper reservations: (mailto:anurag.agarwal@yahoo.com?subject=WASC%20meetup)

Time: Monday, Sep. 17 @ 7:00pm

Place:

O’Neills Irish Pub
747 3rd StSan Francisco,
CA 94107
Phone: (415) 777-1177

WASC WASSEC Project - Update

Thank you all for your patience. We have received an overwhelming response from the WASSEC (Web Application Security Scanner Evaluation Criteria) project. To proceed with the project please

1. Please email wasc-wassec-subscribe@webappsec.org and reply to confirmation email.
2. It is moderated subscription so every contributor has to be approved to send messages to the list.
3. Once you are subscribed to the list, then email wasc-wassec@webappsec.org to post messages.

All further communication will be done through the mailing list. Please keep checking your junk mail folder in case some messages might go there. We are also in the process of setting up a wiki for the length of the project to post updates, etc. Until then I will be updating my blog with the project details.

Once again, thank you for your participation.

WASC Announcement: 'WASSEC Project' Call for Participants

WASC has announced a new project WASSEC (Web Application Security Scanner Evaluation Criteria). Currently WASC is seeking volunteers from various sections of the community including penetration testers, scanner vendors, security researchers and also end users to contribute to the project.

A brief description of the project

The Web Application Security Evaluation Criteria is a set of guidelines to evaluate web application security scanners on their identification of web application vulnerabilities and its completeness. It will cover things like crawling, parsing, session handling, types of vulnerabilities and information about those vulnerabilities. The goal of this project is to evaluate the technical aspects of the web application security scanners and NOT the features provided by it.

The project page can be found at
http://www.webappsec.org/projects/wassec/

If you would like to be involved with the project, please contact Anurag Agarwal (anurag.agarwal@yahoo.com)

Did WebApp developers learn from Samy worm?

At the Mozilla Pyjama party during Blackhat, Me and Jeremiah met up with Bubba Gump and he shared with us an interesting story on how he was able to do something similar like Samy worm on another social networking site. His story just goes to show that there are so many other websites which are still getting hacked the same way but either have no clue or are in a denial mode. We asked him to share his story with others in the community too and if he can write it for us then I will post it on my blog. The site developers were already notified of the vulnerability and they have fixed it so I am posting this story on my blog. Here it goes


Awhile back I read a Newsweek article about a new social networking website called GoLoco.org. This site is designed for making car-pooling arrangements and is run by an environmentalist CEO named Robin Chase. The idea is to help the environment and save money on gas at the same time – an interesting concept.

After signing up for a free account on the GoLoco site, I couldn't help but play around with it a bit. I started by going to the Modify Profile page and injecting <> tags into various items in my profile to see what would happen. For the most part, any tag I injected would be properly HTML encoded before being echoed back onto the page. However, they forgot to lock down two of the fields in my profile. Upon further experimentation, I found that each field had a max length of 255 characters and could hold a persistent Cross-Site Script. Nice!

Although some very interesting feats could be accomplished with this vulnerability, I sat on this info for awhile – the Goloco site was new, with only about 1000 users at that time. There wasn't much glory to be had in creating another Samy worm on this site.

But two weeks later I received an email from Robin Chase. She laid down a challenge – the first Goloco user to exceed her in number of friends would win a free t-shirt. It was almost like she was asking to be XSSed!

I started by inserting some AJAX code into my profile that would make the person viewing it automatically POST a request to become my friend. In order to get more people to view my profile, I posted a trip from Boston to California. Most of the site's users are from Boston, so they would see this trip listed on their homepage upon logging in. Clicking on the Trip Details link would bring up my profile, which would cause the user to unknowingly make the friendship request.

I expected to start receiving lots of friendship request emails, but was disappointed at first. An average of just one or two requests came in per day, which reflected the low amount of traffic on this site and the fact that a user would have to click on my link out of a list of about 20 trips in order to be hit with the XSS. Clearly I needed to re-think my approach.

A little more exploration of the site led me to the breakthrough that I was hoping for. It turns out that the trip location names were also Cross-Site Scriptable, and the destination location name is what showed up on the homepage after a user logs in. This means that users no longer had to click on my link to get hit with the XSS – all they needed to do was log into the site and they'd immediately request to become my friend. I did not attempt to make the XSS payload wormable because I did not want to do anything that would cause damage to other peoples' profiles or trips.
After this new, improved XSS was put in place, the friendship requests started pouring in at a rate of about 15 per day, which for this particular site was impressive. A nice, unexpected side-effect is that I would receive an email every time a user logged into the site. I quickly got to learn the usage habits of various people – for example, one of the employees of the site had a strange tendency to log in at 4:00 AM. I also experienced another unintended side-effect. The site had no controls in place to prevent duplicate friendship requests from the same person, so I began to get spammed with duplicate requests as the same user hit the homepage multiple times. This became annoying after awhile, so I modified my XSS to drop a cookie on the user's machine to track whether or not they had submitted a friendship request already – ah, much better!

While waiting for the friendship requests to come in, I explored the site a bit further, this time looking for interesting HTML comments. I discovered that the site's developers were displaying private communications between members in HTML comments. I was able to obtain lots of interesting info this way, including the names of all of the site's developers and CEO Robin Chase's cell phone number. This would come in handy later.

After three days, I had built up enough friendship requests to exceed Robin. And in fact, the last person to get hit with my XSS was none other than Robin Chase herself, who logged in bright and early at 6:45 AM. I removed the XSS, accepted all of the friendship requests that had queued up, and counted my friends – sure enough, I was ready to claim my prize.

Later that morning I called Robin and claimed my t-shirt. Interestingly, she didn't ask me how I obtained her cell phone number or how I had acquired so many friends so quickly. But she congratulated me and told me she'd send me the t-shirt.

Shortly after that, I got in touch with the people in charge of development for the site and told them about the security issues, which they quickly addressed. Today, Goloco is integrated with Facebook, so I suspect that it is a bit harder to hack than it used to be. And Robin, if you're reading this I just want to remind you that I'm still waiting for my t-shirt!

-Bubba

My experience at BlackHat and DefCon

I came back from blackhat and defcon last Sunday. I was there for the entire 9 days (combined blackhat and defcon) and when i came back, I realized why people said 9 days of Vegas are toooo long. It was my first time to Vegas so I didn’t see it earlier but now i have learnt my lesson. :)

It had been a very enjoyable experience. Though the party really took off on Tuesday night when most of the people started to come in for briefings. I had dinner with Mozilla guys along with several other webappsec professionals. I was talking to Dan from Mozilla and to my surprise; he asked me “What kind of security features would you like to see in firefox”. They also had a discussion with RSnake, Jeremiah Grossman and I am sure with some other webappsec professionals too. I am impressed by firefox’s approach. They are reaching out to the webappsec community and asking for their support and advice in making their browser more secure. I think it’s a great start and I know they will get flooded with suggestions, most of which they won’t be able to include until the next decade but at least they are sincere and making an effort(or so it appears, we’ll find out soon enough).

I met with a lot of great guys from the webappsec community including from google, TiVo, verisign, iSECPartners, Outpost24, ebay, Breach, Aspect Security, Ounce Labs, and many more. Some of them I didn’t know before, some of them I had interacted with emails earlier and some of them I did a reflection on, but it’s great to meet them in person (RSnake, Ryan Barnett, Ivan Ristic, Alex Stamos, Robert Auger, Andrew Van der Stock, Jeff Williams, Dinis Cruz). I spent sometime with id from ha.ckers.org. He takes time in opening up but when he does, he is actually a very nice guy (that is only if you are not planning to take his laptop away from him).

I also got a chance to meet the ex-L0pht guys, now they are running their own company (SafeLight). Rob Cheyne (the guy who wrote LC4 and also the CEO of SafeLight) handed me his business card in a sleeve. Interesting, why is that? Actually the sleeve is a radio frequency blocking sleeve to protect your RF enabled credit cards from being stolen even when they are in safely tucked in your wallet.

Bubba Gump was another guy I can recall very well since he had a very interesting story to share which I will publish as a separate post as it is well worth the read.

The most hilarious presentation of Blackhat and Defcon award goes to Jeff Moss. Jeff Moss made a presentation titled “Cisco Gate” (his experience with the Cisco IOS flaw presentation fiasco). The content of-course was interesting since everyone wanted to know “behind the scenes” story but I think his content delivery was equally good. We could not stop laughing through the entire length of the presentation.

Last but not the least; the OWASP-WASC party was a huge success. There were over 350 people who came to the party. The feedback I got from several people was that it was the best party of Blackhat. Many thanks to Heather Cason of Breach Security, who did an excellent job in organizing the whole show. She also sent me the pictures of the party which you can see below.

Reflection on Dinis Cruz

In the last episode of reflection, we have someone who has become a pillar of OWASP. Dinis Cruz is a chief OWASP evangelist and a part of the OWASP board. At OWASP, he organizes events such as the OWASP Autumn of Code, delivers keynotes and advanced technical presentations on OWASP Conferences and leads the OWASP .Net Project where (amongst others) he created the tools: OWASP Report Generator, OWASP Site Generator, SAM'SHE (Security Analyzer for Microsoft's Shared Hosting Environments) and Asp.Net Reflector. Dinis Cruz is a Security Consultant based in London specialized in Penetration Testing, ASP.NET Application Security, Source-Code Security reviews, Reverse Engineering and Security Curriculum Development. On his reflection, Dinis shares with us how he started in web application security. In his own words

“When I was 10 years old and started programming assembly on my brother’s ZX Spectrum 48k. I remember being very happy by using PEEK and POKE to manipulate pixels on the screen (I also remember translating by hand Assembly Code into Bytes since at the time I had a book on assembly but had no compiler (ahhhh, these kids today have it so easy).

I then went though an Amiga phase (probably the best computer ever, which was at that time miles ahead of everybody else), trying to write games and cool demos (again there was no Internet available).

After that came the BBS world with 2400 baud modems, followed by a super fast 14440 Modem and big phone bills. Once the Internet arrived I couldn’t get enough of it.

I started with Web Application Security about 6 years ago when I become fascinated on how easy it was to remotely 0wn computers. I then decided to shift my professional focus into security and have not looked back since.

I think my programming background was a big help since once I understood the issues with security I was able to use those skills to find vulnerabilities (and propose solutions)

On security, my first experiments where with first Edition of Hacking Exposed which taught me the basics of Network Security, followed by a special focus on ASP Classic and .NET Framework security.

My journey with OWASP started with an email that I sent to Mark Curphey in October 2003 about my research on the security implications of running ASP.NET code in Full Trust. Mark replied with the challenge "Hey!, why don’t you publish this material on OWASP and manage the OWASP .Net project?", which I accepted and have since dedicated considerable amount of energy to it. OWASP is a very empowering, open organization where motivated and focused individuals can find their place and shine. OWASP was a perfect match for my values and professional objectives. I published most of my .NET Research and eventually become the Chief OWASP Evangelist.”

Based out of London, UK, Dinis is 32 years old. Below is a list of his contributions to the community.


Articles:-

Roadmap to a Partial Trust Managed Code world
http://blogs.owasp.org/diniscruz/2007/03/05/roadmap-to-a-partial-trust-managed-code-world/

‘Security Awareness Modes’ & the ‘day Microsoft changes’
http://blogs.owasp.org/diniscruz/2007/03/05/security-awareness-modes-the-day-microsoft-changes/

On Microsoft’s lack of Partial Trust Managed Code (PTMC) focus and ideas for the future
http://blogs.owasp.org/diniscruz/2007/03/05/on-microsofts-lack-of-partial-trust-managed-code-ptmc-focus-and-ideas-for-the-future/

I give up, no more posts to Full-Disclosure and DailyDave about Full Trust and .Net /Java Sandboxes
http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0147.html

An 'Asp.Net' accident waiting to happen
http://www.owasp.org/index.php/An_

Microsoft must deliver secure environments not tools to write secure code
http://www.owasp.org/index.php/Microsoft_must_deliver_secure_environments_not_tools_to_write_secure_code
Full Trust Asp.Net Security Vulnerabilties, and Microsoft's current position
http://www.owasp.org/index.php/Full_Trust_Asp.Net_Security_Vulnerabilties,_and_Microsoft

What are the 'Real World' security advantages of the .Net Framework and the JVM?
http://www.owasp.org/index.php/What_are_the_

.NET research from OWASP .NET Project

Rooting The CLR (demo files available on request)
http://www.owasp.org/index.php/Rooting_The_CLR

Buffer OverFlow in ILASM and ILDASM
http://www.owasp.org/index.php/Buffer_OverFlow_in_ILASM_and_ILDASM

Full Trust CLR Verification issue: changing the Method Parameters order
http://www.owasp.org/index.php/Full_Trust_CLR_Verification_issue:_changing_the_Method_Parameters_order

Full Trust CLR Verification issue: changing the return address order
http://www.owasp.org/index.php/Full_Trust_CLR_Verification_issue:_changing_the_return_address_order

Full Trust CLR Verification issue: Changing Private Field using Proxy Struct
http://www.owasp.org/index.php/Full_Trust_CLR_Verification_issue:_Changing_Private_Field_using_Proxy_Struct

Full Trust CLR Verification issue: Exploiting Passing Reference Types by Reference
http://www.owasp.org/index.php/Full_Trust_CLR_Verification_issue:_Exploiting_Passing_Reference_Types_by_Reference

Manipulating private method behavior by overriding public virtual methods in public classes
http://www.owasp.org/index.php/Manipulating_private_method_behaviour_by_overriding_public_virtual_methods_in_public_classes

CSharp readonly modifier is not enforced by the CLR (when in Full Trust)
http://www.owasp.org/index.php/CSharp_readonly_modifier_is_not_inforced_by_the_CLR_(when_in_Full_Trust)

ANSI/UNICODE bug in System.Net.HttpListenerRequest
http://www.owasp.org/index.php/ANSI/UNICODE_bug_in_System.Net.HttpListenerRequest


Tools written by him:-

DN_BOFinder (DotNet Buffer Overflow Finder)
http://www.owasp.org/index.php/DN_BOFinder

OWASP Site Generator
http://www.owasp.org/index.php/Owasp_SiteGenerator

OWASP Report Generator
http://www.owasp.org/index.php/Owasp_Report_Generator

.NET Assembly Analyzer
http://www.owasp.org/index.php/.Net_Assembly_Analyzer

New version (v2.0) of Foundstone's HacMe Bank (with Web Services) http://secure.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/proddesc/hacmebank.htm

Video of above is located here
http://secure.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/videos/hacmebank/index.htm

Foundstone's CodeScout (basic Source code analysis tool) http://secure.foundstone.com/resources/proddesc/codescout.htm

Foundstone's .NETMon (Flow Trace Tool for .NET)
http://secure.foundstone.com/resources/proddesc/dotnetmon.htm

HttpModule for Foundstone’s Validator.NET http://secure.foundstone.com/resources/proddesc/validator.htm

OWASP’s SAMSHE (Security Analyzer for Microsoft's Shared Hosting Environments)
http://www.owasp.org/index.php/SAM
is a part of
http://www.owasp.org/index.php/ANBS

OWASP’s ANSA (Asp.Net Security Analyser)
http://www.owasp.org/index.php/ANSA

Online Active Directory User Management System

Multi-lingual website Content Management System (COTS application)

Windows Security Log Analysis solution

Relational Database for London University Researchers
Back end for travel agency website

E-Commerce system for music publisher selling custom CDs online

Online website Content Management System


Contributions:-

Created and organized the OWASP Autumn of Code 2006 http://www.owasp.org/index.php/OWASP_Autumn_Of_Code_2006

OWASP Spring of Code 2007 http://www.owasp.org/index.php/OWASP_Spring_Of_Code_2007

Participation as a speaker in several Security Conferences (including Keynote presentations at OWASP conferences)

Buffer Overflows on the .Net Framework, 2006 Seattle

Panel: "The role of frameworks (e.g., .Net, Java, Enterprise Library, Struts, JaCorb) in 'forcing' developers to create and deploy 'secure' applications" , 2006 Seattle

Keynote OWASP 2.0 - Enabling organizations to develop, maintain, and acquire applications they can trust, 2006 Europe (Leuven) and 2006 Seattle

Panel: "The role of Sandboxing in creating secure .Net and Java applications.”, 2006 Europe ( Leuven )

Rooting the CLR, 2005 Washington DC

The Fog of Software, 2005 London

OWASP DotNet Security tools: DefApp, ANBS, SAM'SHE, ASP.NET Reflector, Beretta, .NETMon , 2005 London

Full Trust Asp.Net Insecurity, 2004 NYC


Videos:

FSTV (Foundstone TV) Interview on '.NET, web security tools, the future of OWASP, and ‘Open Source Software' , BlackHat 2006 http://video.google.com/videoplay?docid=941077664562737284

Attacking Web and Windows Apps ( UK 's DDD3 on Jun 2006) http://www.roadtowinfx.com/ddd3/2006-06-03%20Developer%20Developer%20Developer%20session%203.lo%20res.wmv

Attacking Web and Windows Applications (presented in the DDD2 on Oct 2005)
http://www.roadtowinfx.com/ddd/2005-10-22_DeveloperDay_session06.wmv

Rooting the CLR, OWASP conference in DC's NISC, Oct 2005 http://video.google.com/videoplay?docid=-2492965730809426450&q=owaspLog

Training:-

Advanced Asp.Net Exploits and Countermeasures (IOActive):

London (July 17th/18th)
http://www.nxtgenug.net/Course.aspx?CourseID=4

Black Hat in Las Vegas (July 28th/29th and July 30th/31st )
http://www.blackhat.com/html/bh-usa-07/train-bh-us-07-io-net.html

Advanced Asp.Net Security (Security Compass)

Writing Secure ASP.NET Code (IOActive)

Writing Secure Code - ASP.NET (C#) (Foundstone)

Writing Secure Code Boot Camp ( Intense School / Vigilar)


Memberships:-

OWASP


Company working for:-

Dinis has a main contract with Ounce Labs but continue to do other projects and training (for example the Black Hat training in Las Vegas for IOActive)


Companies worked for:-

Dinis has been the director of his UK based company for 10 years now, and have worked (under direct contract) for companies like: Ounce Labs, ABN AMRO, IOActive, Foundstone, Vigilar, Infosys, Security Compass, UK’s Defence Science and Technology Laboratory, UK’s Department for Transport, UK’s Competition Commission and many others.


Email:-

Dinis.Cruz at owasp.net


Blog:-

http://blogs.owasp.org/diniscruz


Website:-

http://www.owasp.org/


Education:-

Dinis has 50% of a degree from the Portuguese’s University of Algarve in ‘Computing Systems and Analysis’ (where he completed 3 out of five years) and have 50% of a degree from the UK ’s University of Westminster in ‘Commercial Music’ (where he completed 1 and ½ of 3 years).

So basically he has a degree in ‘Computing Commercial Systems and Music Analysis’


Dinis uses both Apple and Windows and prefer to program in C#. When he is not in front of a computer, he likes to spend time with his family, play football, golf, guitar and drums.

With this the reflection project comes to an end. I would like to thank everyone who participated in it and spent time with me in putting all the information together. It has been truly a fantastic experience.

Last Week - Cesar Cerrudo

Reflection on Cesar Cerrudo

This week on reflection we have someone who has done a lot of database research and published several advisories and presented at Blackhat, CanSecWest and other conferences on database security. Cesar Cerrudo works for his own company “Argeniss” and has contributed a lot to some of the databases to be more secure today. He has also identified a lot of vulnerabilities in Microsoft Windows, Microsoft Commerce Server, etc. He is passionate about application security and a big believer in open source community both for software and books. Cesar shares his journey with application security in his own words

"I think I always have had "hacker mind" for calling it in some way, I remember being a child and breaking things to look inside. When I was 10 or so I got my first computer a CZ Spectrum (I don't remember the exact model) but it ran BASIC. when I wanted to learn how to use it and to code in BASIC, I went to a place for kids but got bored after many days of being taught PRINT "HOLA MUNDO" only, so I used that computer for games (games were stored on a audio cassette tape and loading them required playing it in a cassette player). I learnt few tricks looking at the guy from a store that recorded games so I started to modify screens when the games were loading, I also hacked multilevel games by loading parts of one level and the rest from a different level, which for my age was a big deal. After a couple of years I stopped using that computer and I didn’t do anything computer related for several years apart from taking few boring classes of MS DOS, QPRO, Lotus, etc. When I was 19 I started to study Computer Science but I didn't have a PC (they were a bit expensive on this side of the planet earth) so I only read old books available at the university and played with a friend's computer, on those days the challenge was to try running cool games on old computers, I became an expert in MS DOS :)

I remember one day being very excited because I found the assembly code from a MS DOS virus in one of the PC at the university, I spent several hours with an old assembly book (thanks Norton-Socha!) until I learnt how the virus worked (in the process I learnt some x86 assembler without coding it in a PC). After some time I started to work on a client/server software for a couple of different local companies and one of the companies had internet access so I started using Internet and since I always liked hacking, Internet was a really good source of information so I started to learn something about hacking for the first time, I was lucky since I had a good academic background on programming, computers, etc. so I didn't end up reading and learning stupid things, but because I had an old PC and no Internet access at home I couldn't test much of the stuff I learnt. Then I took up a new job where I started using Internet frequently and started trying things in free time, this was like 7 years ago and that was when I started with webappsec. I had worked a lot with MS SQL Server so when I first read about SQL Injection I was really amazed with it and I started to create my own techniques, tools, etc.

That’s when I started to play with MS SQL Server and after some time I found my first vulnerability, then the next one and so on when I realized I had found dozen of vulnerabilities on MS SQL Server, I also learnt how to code exploits and new techniques for finding vulnerabilities, since then I have found several vulnerabilities on MS Windows, Oracle Database Server, etc. I have also created new exploitation and attack techniques. Few years ago I designed and wrote a complete web application scanner for a security company, the scanner at that time was better than other available web app scanners but because of some patent issues the product was stop being sold (hurray for Watchfire!!!). Currently I do research on application security mostly focused on database security and in my spare time I like to hack MS Windows :)

I always try to keep big vendors improving on security, I don't care if I have to publish 0day vulnerabilities or controversial papers in order to accomplish that. I have been offered to write books but the only way I can write or contribute in a book is if it will be available for free in some way (electronic, etc.), I know what is not having resources for learning, all people should have easy access to knowledge, books only makes money for the editors and people without money can't get them."

Based out of Parana, Entre Rios, Argentina, Cesar is 31 years old. Below is a list of his contribution to the community


Articles:-

Hacking databases for owning your data
http://www.argeniss.com/research/HackingDatabases.zip

Practical security audit: Oracle case
http://www.argeniss.com/research/10MinSecAudit.zip

WLSI-Windows Local Shellcode Injection
http://www.argeniss.com/research/WLSI.zip

Story of a dumb patch
http://www.argeniss.com/research/MSBugPaper.pdf

Demystifying MS SQL Server & Oracle Database Server security
http://www.argeniss.com/research/SQL-Oracle.zip

Hacking Windows Internals
http://www.argeniss.com/research/hackwininter.zip

Auditing ActiveX Controls
http://www.blackhat.com/presentations/win-usa-04/bh-win-04-cerrudo/bh-win-04-cerrudo.pdf

Hunting Flaws in SQL Server
http://www.appsecinc.com/presentations/Hunting_Flaws_in_SQL_Server.pdf

Manipulating Microsoft SQL Server Using SQL Injection
http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf


Tools written by him:-

DataThief
http://www.argeniss.com/research/HackingDatabases.zip

Shared section tools
http://www.argeniss.com/research/hackwininter.zip


Contributions:-

WASC - Web Security Threat Classification


Advisories

Microsoft Windows Kernel GDI local privilege escalation procedure
http://www.argeniss.com/research/ARGENISS-ADV-110604.txt
http://www.argeniss.com/research/GDIKernelPoC.c

Oracle Database Server Directory traversal
http://www.argeniss.com/research/ARGENISS-ADV-030501.txt

COM+ Vulnerability
http://www.microsoft.com/technet/security/Bulletin/MS05-051.mspx

COM Structured Storage Vulnerability
http://www.microsoft.com/technet/security/bulletin/MS05-012.mspx
http://www.argeniss.com/research/SSExploit.c

Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege
http://www.microsoft.com/technet/security/bulletin/MS04-044.mspx

Vulnerability in Windows LSASS Could Allow Elevation of Privilege
http://www.microsoft.com/technet/security/bulletin/MS04-044.mspx

Multiple vulnerabilities in Oracle Database Server
http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf

Vulnerability in Utility Manager Could Allow Code Execution
http://www.microsoft.com/technet/security/bulletin/MS04-019.mspx

Utility Manager Vulnerability
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Biztalk Server Vulnerabilities
http://www.microsoft.com/technet/security/bulletin/MS03-016.asp

Buffer Overflow in Windows Troubleshooter ActiveX Control Could Allow Code Execution
http://www.microsoft.com/technet/security/Bulletin/MS03-042.mspx

Symantec Security Check RuFSI ActiveX Control Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/8008

http://secunia.com/advisories/8924/
Yahoo! Chat and Messenger Hostname Buffer Overflow Vulnerability

Multiple buffer overflows in DBCC and SQL Injections
http://www.appsecinc.com/resources/alerts/mssql/02-0011.shtml

BULK INSERT buffer overflow
http://www.appsecinc.com/resources/alerts/mssql/02-0010.shtml

Encoded password written by service pack
http://www.appsecinc.com/resources/alerts/mssql/02-0009.shtml

Microsoft SQL Server: Buffer Overflows in numerous extended stored procedures
http://www.appsecinc.com/resources/alerts/mssql/02-0000.html

xp_dirtree Buffer Overflow
http://www.appsecinc.com/resources/alerts/mssql/02-0007.shtml

Heterogenous Queries Buffer Overflow
http://www.appsecinc.com/resources/alerts/mssql/02-0008.shtml


Conferences:-

Hacking databases for owning your data - Black Hat Europe 2007
http://www.blackhat.com/

Practical security audit: Oracle case - Black Hat DC 2007
http://www.blackhat.com/

DataTheft - How databases are hacked and how to protect them - No cON Name 2006
http://www.noconname.org/

WLSI - Windows Local Shellcode Injection - Black Hat Europe 2006
http://www.blackhat.com/

WLSI - Windows Local Shellcode Injection - EUSecWest/core06 conference
http://www.eusecwest.com/

Database Hacking and Security - Web Application Security and Hacking
http://www.websec.com.mx/

Demystifying Microsoft SQL Server & Oracle Database Server security - Black Hat USA 2005
http://www.blackhat.com/

Hacking Windows Internals - cansecwest/core05 conference
http://www.cansecwest.com/

Hacking Windows Internals - Bellua Cyber Security Asia 2005
www.bellua.com/bcs2005/

Hacking Windows Internals - Black Hat Europe 2005
http://www.blackhat.com/

Auditing ActiveX Controls - Black Hat Windows 2004
http://www.blackhat.com/

Hunting Flaws in MS SQL Server - Black Hat Windows 2003
http://www.blackhat.com/


Company working for:-

Argeniss


Companies worked for:-

Application Security Inc.


Website:-

http://www.argeniss.com/


Email:-

Cesar<(at)>argeniss<(.)>com


Education:-

Analyst programmer


Cesar is very driven and passionate about application security. One of the best in database security. Though he doesn't have a blog right now but you can get all the information on his website along with the whitepapers and latest on database security.

Last Week – Alex Stamos

Next Week – Dinis Cruz

Reflection on Alex Stamos

This week on reflection we have Alex Stamos from iSEC Partners Inc. Alex has been involved in webappsec for sometime now and has presented at Blackhat, ToorCon, OWASP, ISACA, etc. He is a founder and Vice President of Professional Services at iSEC. He is a leading researcher in the field of web application and web services security and is also a co-author of an upcoming book Hacking Exposed Web 2.0. Alex shares with us how he got started in webappsec field. In his own words

"Back in 2001 I started working at Loudcloud, which was basically a large ISP/ASP made famous by the fact that Mark Andreessen was a founder. While there, I ended up with the primary security responsibility for about 50 Fortune-500 web applications. Through a series of late night pages, self-exploration through our customer's code, and a couple of hairy incidents, I decided that web app security was way more important to these apps than double-checking the firewall rulesets or slightly decreasing how fast we patched OpenSSH.

At @stake, a major focus of my work was penetration testing of web applications and teaching classes to web app developers on how to stop making the same mistakes others had already made. Since we started iSEC about three years ago, web application and web services security has been a major focus of my research and work with clients, although I also dabble in other security areas such as forensics. "

Based out of San Francisco, CA, US, Alex is only 28 years old. Below is a list of his contribution to the community.


Books:-

Co-authored - Hacking Exposed Web 2.0 (to be released soon)
(http://www.amazon.com/Hacking-Exposed-Web-2-0-Solutions/dp/0071494618/ref=sr_1_1/103-2901853-2679805?ie=UTF8&s=books&qid=1182153208&sr=8-1)


Tools written by him:-

Alex has worked on a few SOAP security tools with Scott Stender and Jesse Burns, and is releasing some new file and file system fuzzing tools to attack forensic software at BlackHat this summer.
All the tools can be found on ISEC website
http://www.isecpartners.com/tools.html


Presentations:-

Upcoming - "Breaking Forensics Software: Weaknesses in Critical Evidence Collection"
BlackHat USA 2007
http://blackhat.com/html/bh-usa-07/bh-usa-07-speakers.html#Palmer


"Vulnerabilities 2.0 in Web 2.0: Next Generation Web Apps from a Hacker's Perspective" - Web 2.0 Expo, BlackHat USA, BlackHat Japan, ToorCon, ACM Reflections/Projections, OWASP SF
http://www.isecpartners.com/files/Attacking_AJAX_Applications-UIUC_ACM_2006.pdf


Cyber Crime- Security, Strategy & Solutions - ISACA Silicon Valley Annual Conference
http://www.isaca-sv.org/WinterConferenceSecTopic.html#11


"Cross-Domain Request Forgery and Web Crimes" - SF Bay Infraguard with Jesse Burns
http://www.sfbay-infragard.org/


Attacking Web Services - BlackHat USA, CanSecWest, OWASP App Sec, SyScan
http://www.infoworld.com/event/soa/may/



Memberships:-

OWASP
http://www.owasp.org/

ISACA
http://www.isaca.org/

IEEE
http://www.ieee.org/portal/site


Company working for:-

Founder and Vice President of Professional Services at iSEC
Partners, Inc. (http://www.isecpartners.com/)


Email:-

alex__at__isecpartners_dot_com


Website:-

http://www.isecpartners.com/


Companies worked for:-

@stake, Loudcloud, E.O. Lawrence Berkeley National Laboratory


Education:-

BS in Electrical Engineering and Computer Science- University of
California, Berkeley.


Last Week – pdp
Next Week – Cesar Cerrudo

Reflection on pdp

This week on reflection we have Petko D Petkov (popularly known as pdp). pdp has been active in the webappsec community for sometime now. He has written many articles and published many tools. Two of his more popular tools are Attack API and Technika (firefox extension). He is also a co-author of the book XSS Exploits: Attacks and Defense. Recently he presented on Advanced Web Hacking Revealed in OWASP Appsec Conference in Italy 2007. In his reflection pdp shares with us how he got started in webappsec field. In his own words

“I have always been fascinated by the power of Web but it was around year 2000 when I got into web application security. Other then that, my interests towards IT security has been growing since 1995. Funny enough, it was "Hackers", the movie that sort of inspired me to spend my time on solving interesting problems with my not-so-advance for that time PC, rather then wasting time on games. Back then, I had 286 MHz "Pravetz", produced in Bulgaria. One of the first projects of mine was a simple calculator that was also password protected. When I finished the project, I also learned how to trick the password protection mechanism by modifying the jumper inside the program binary. That was fun. The Bulgarian underground scene used to be a great resource for me to learn. I started reading an online-zine called Phreadom. I am still looking for the old issues but I guess they are somehow lost forever.

I started hacking from the time I learned how to program. My Dad told me that programming is one of the few professions out there that teaches you about the world in general since programmers try to reflect real world problems into easy to maintain and use software products. That made me start thinking outside the box. I define myself as a life-hacker. I guess this is the reason why I am where I am today. When I came to UK I didn't wanted to waste time so I did a lot of security related projects. This is when my IT Security career started. I was 18 I was doing the stuff that I wanted to do all my life.”

Based out of london, UK, pdp is only 22 years old. Below is a list of his contributions to the webappsec community.


Books:-

XSS Attacks: Exploits and Defense
http://www.amazon.com/Cross-Site-Scripting-Attacks-Exploits/dp/1597491543/sr=1-1/qid=1170769149?ie=UTF8&s=books

Articles:-

The Web has Betrayed Us
http://www.gnucitizen.org/blog/the-web-has-betrayed-us

Persistent CSRF and The Hotlink Hell
http://www.gnucitizen.org/blog/persistent-csrf-and-the-hotlink-hell

Preventing CSRF
http://www.gnucitizen.org/blog/preventing-csrf

Sex, Candies and Bookmarklet Exploits
http://www.gnucitizen.org/blog/sex-candies-and-bookmarklet-exploits

The Machine is Using Us
http://www.gnucitizen.org/blog/the-machine-is-using-us

Playing in Large
http://www.gnucitizen.org/blog/playing-in-large

Universal PDF XSS After Party
http://www.gnucitizen.org/blog/universal-pdf-xss-after-party

Danger Danger Danger
http://www.gnucitizen.org/blog/danger-danger-danger

Web OS
http://www.gnucitizen.org/blog/web-os

Cross-site Request Forgery
http://www.gnucitizen.org/blog/cross-site-request-forgery

The 0XSS Credo
http://www.gnucitizen.org/blog/the-0xss-credo

The Backdooring Series:
http://www.gnucitizen.org/blog/backdooring-images
http://www.gnucitizen.org/blog/backdooring-mp3-files
http://www.gnucitizen.org/blog/backdooring-quicktime-movies
http://www.gnucitizen.org/blog/backdooring-flash-objects-receipt
http://www.gnucitizen.org/blog/backdooring-flash-objects
http://www.gnucitizen.org/blog/backdooring-web-pages

The XSSing the Lan Series:
http://www.gnucitizen.org/blog/xssing-the-lan-4
http://www.gnucitizen.org/blog/xssing-the-lan-3
http://www.gnucitizen.org/blog/xssing-the-lan-2
http://www.gnucitizen.org/blog/xssing-the-lan


Presentation:-

Advanced Web hacking revealed
http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda


Tools written by him:-

Some of the tools published by him

JavaScript YPipes Spider
http://www.gnucitizen.org/projects/6th-owasp-conference/spider.htm

JavaScript TinyURL Filesystem
http://www.gnucitizen.org/projects/6th-owasp-conference/tinyfs.htm

Google Hacking Database Interface
http://www.gnucitizen.org/applications/ghdb

JavaScript Port Scanner
http://www.gnucitizen.org/projects/javascript-port-scanner

Greasemonkey Backdoor
http://www.gnucitizen.org/projects/greasecarnaval

Exploit Development Environment for Firefox
http://www.gnucitizen.org/projects/technika

Geo position Zombies on a map
http://www.gnucitizen.org/applications/zombiemap

Attack Framework for controlling zombies
http://www.gnucitizen.org/applications/backframe

simple JavaScript tesing framework
http://www.gnucitizen.org/projects/firetest

powerful JavaScript based attack library
http://www.gnucitizen.org/projects/attackapi

The Cross-site Scripting database
http://www.gnucitizen.org/applications/xssdb

Powerful and very customizable attack communication channel
http://www.gnucitizen.org/projects/javascript-attack-channel

Set of utilities useful when performing enumeration attacks
http://www.gnucitizen.org/projects/met


Company working for:-

NTA-Monitor


Email:-

pdp__at__gnucitizen_dot_org


Blog:-

gnucitizen.org


Web:-

gnucitizen.org


Companies worked for:-

Freelance


Pdp has a vast knowledge of different technologies and frameworks available on the internet. If you are not already following his blog, then I would recommend doing so. He brings up some good points for webappsec community.

Last Week – Saumil Shah
Next Week – Alex Stamos

WASC meetup in Blackhat USA 2007

OWASP and WASC have joined hands to have a combined meetup at Blackhat USA 2007 in Las Vegas which was earlier planned as a WASC meetup. Breach Security has stepped forward to sponsor the event. Please click on the image to see a larger version of the invite. Come and join us for a drink and meet other like minded people from the industry.

NOTE: Those who have already RSVPed need not to RSVP again.

Any java developers in bay area?

Any java developers in bay area who are interested in working together on some of the research ideas i have in web application security.

Most of the development would be in java. Knowledge of javascript is a plus. Knowledge of webapp security field is optional.

Interested? contact me on anurag.agarwal@yahoo.com

Reflection on Saumil Shah

This week on reflection we have Saumil Shah from net-square Solutions. Saumil has been involed in webappsec community for a long time and is a regular presenter at Blackhat. He focuses on researching vulnerabilities with various e-commerce and web based application systems, system architecture for Net-Square's tools and products, and developing short term training programmes. He specializes in ethical hacking and security architecture. In his reflection, Saumil shares with us how he got involed in webappsec. In his own words

“My original interest in security has always been Unix hacking and reverse engineering. In 1998, when I joined Ernst & Young as a penetration testing specialist, we used to have a field day with systems wide open on the Internet. NetBIOS and SunRPC made our day. Not to mention a slew of other services like open database ports, terminal ports, and more. By the end of 1999, the only ports we could find open on the Internet were 80 and 443. Not to be outdone, I ended up finding out ways to compromise systems, this time using HTTP and the application behind it.

Leaving apart the whole idiotic debate on hacking vs. cracking, I shall say that I truly started hacking at the age of 11. My first few "hacks" were to spot programming errors in home computer magazines, for the ZX Spectrum and the BBC Micro, fixing them while keying in long listings in BASIC, and enjoying the games until I had to unplug the power. The only storage medium was cassette tape back in 1984.”


Based out of Ahmedabad, India, Saumil is only 33 years old and is a co-author of "Web Hacking: Attacks and Defense" (Addison Wesley, 2002) and is the author of "The Anti-Virus Book" (Tata McGraw-Hill, 1996). He has served as a technical editor for "Hacking Exposed 2nd Ed", and has contributed to "Know your Enemy - the Honeynet Project" book. Saumil has also presented at Blackhat, CNET eDevCon, hack.lu, EUSecWest, and many more. Below are a list of his contributions to the webappsec community.

Books:-

Web Hacking - Attacks and Defense
http://www.awprofessional.com/bookstore/product.asp?isbn=0201761769&rl=1

The Anti Virus Book
http://saumil.net/antivirus/contents.html


Articles:-

Saumil did a monthly column for two years on C-NET Builder.com, titled ”Security Issues”, along with Chris Prosise.
http://builder.cnet.com/

One Way Web Hacking
http://net-square.com/papers/one_way

An Introduction to HTTP fingerprinting
http://net-square.com/httprint/httprint_paper.html


Tools written by him:-

httprint - Advanced HTTP Fingerprinting
http://net-square.com/httprint/


Contributions:-

One of the very early members of The Honeynet Project in 2000.


Presentations:-

Web Hacking
http://www.blackhat.com/html/win-usa-01/win-usa-01-speakers.html

Adware/Spyware
http://www.blackhat.com/html/bh-japan-05/bh-jp-05-en-speakers.html

The Exploit Laboratory: Analyzing Vulnerabilities and Writing Exploits
(Black Hat Europe 2006 Briefings and Training, Black Hat USA Training 2006)
http://www.blackhat.com/html/bh-usa-06/train-bh-us-06-ss-el.html

Defeating Automated Web Assessment Tools
http://www.blackhat.com/html/bh-usa-04/bh-usa-04-speakers.html


HTTP Fingerprinting and Advanced Assessment Techniques – (BH Europe 2004, BH Asia 2003, BH Federal 2003, BH Windows 2004)
http://www.blackhat.com/html/bh-europe-04/bh-europe-04-speakers.html


HTTP: Advanced Assessment Techniques
http://www.blackhat.com/html/win-usa-03/win-usa-03-speakers.html#Saumil%20Udayan%20Shah


Top Ten Web Attacks
http://www.blackhat.com/html/bh-asia-02/bh-asia-02-speakers.html

One-Way SQL Hacking: Futility of Firewalls in Web Hacking
http://www.blackhat.com/html/bh-europe-01/bh-europe-01-speakers.html#Marc%20Witteman


Writing Metasploit Plugins - From Vulnerability to Exploit
http://conference.hackinthebox.org/hitbsecconf2006kl/?page_id=81


CNET eDevCon 2000: "Hacking Exposed: Ecommerce - Live!


Company working for:-

Net-Square - Founder and CEO
http://net-square.com/


Companies worked for:-

Ernst & Young, Foundstone


Email:-

saumil__at__net-square_dot_com


Website:-
http://saumil.net/


Education:-

M.S. Computer Science, Purdue University, USA - graduated in 1998
B.E. Computer Engineering, Gujarat University, India - graduated in 1995


Saumil has also been doing pre-conference training since past 6 years at Blackhat, and have also taught classes at CanSecWest and Hack in the Box. I am sure we will see a lot more contribution from him going forward.


Last Week – Stefano Di Paola

Next Week – pdp

Reflection on Stefano Di Paola

This week on reflection we have Stefano Di Paola who caught everyone’s attention through his paper Subverting Ajax which talked about acrobat reader plugin vulnerability and javascript prototype exploit. Those of you who remember, there was a lot of commotion on WASC mailing list at the beginning of this year. Tons of emails going back and forth on a vulnerability which was identified in acrobat reader plugin and had the potential of infecting almost all the websites hosting PDF files (Universal XSS).

Stefano has released several advisories including the ones that are not publicly disclosed but patched. He has also contributed to OWASP testing guide and is a also a Research & Development Director of OWASP Italian Chapter. Today he shares with us how he started with web application security. In his own words


”When I was 9 or 10 years old, I began to hack my 45 rpm portable record player in order to control the angular speed and play with my childhood songs in a funnier way. Then I realized I didn't know how to remount my opened player, I asked my parents to buy me another one with the promise to not break it again. I kept that promise… or at least for a while. A couple of years later I decided to hack my tape recorder and I succeeded in mixing voice recording while playing music (my mother never knew I recorded my voice on her music tapes).

I started to practice with computer security when I bought a 486 in 1997; I was a student at the Computer Engineering Faculty at the University of Florence. The first thing I read about hacking was about reverse engineering and cracking shareware software protections. It was quite funny but when I managed to install my first linux 2.0 on my PC, the approach and the vision were going to change inside me. I had already worked on Sun Solaris and AIX at the University, but linux was my first Unix love. The research and the study about linux configurations tutorials brought me to Phrack and "Smashing the Stack for Fun and Profit" by Aleph1. The first time I applied all the theory I had learned was when I urgently needed root privileges on a SGI Workstation at the university while I was finishing my master degree thesis. As the sysadmin was sick I decided to get root by myself and accomplish my tasks. After a couple of days I warned the sysadmin about my privilege escalation and I told him how to fix the issue.

It was in 1999 the first time I stumbled upon http://www.fravia.org/ and I was amazed by the quantity of information about hacking old style CGI web pages and search engines. Since large number of web servers where on *nix OS flavors at that time, my background on linux, Sun Solaris and AIX helped me a lot. I realized it was quite easy for me to find flaws on CGI scripts (most of all system execution vulnerabilities). As a consequence of my hacking research activity, I began to think about web application firewalls but since it was early days of web application security and no information on WAF was available on the net, so I gave up. But it was in the 2004 that I decided to work as web application security consultant and released my first public advisory.

I've been working as a freelance in Italy from 2000 to early 2007 then I founded MindedSecurity(an Application Security Company with the mission to build a Center of Excellence on Web Application Security in order to give high quality services).”


Based out of Florence, Italy, Stefano is 35 years old and works as a freelance ICT security consultant and software architect for several companies and public institutions in Italy. Below is a list of his contributions to the webappsec community.



Articles:-

Universal Cross Site Scripting (Internet Magazine - Italy)
http://www.edmaster.it/?job=arretrati&id=3&op=sommario&num=113

The Owasp Testing Guide (Hackin9)
http://hakin9.org/

Several sections in the Owasp Testing Guide v 2.0

XML Injection
http://www.owasp.org/index.php/Testing_for_XML_Injection

Xpath Injection
http://www.owasp.org/index.php/Testing_for_XPath_Injection

LDAP Injection
http://www.owasp.org/index.php/Testing_for_LDAP_Injection

Mysql Injection
http://www.owasp.org/index.php/Testing_for_MySQL

Ajax Testing
http://www.owasp.org/index.php/Testing_for_AJAX


Memberships:--

Research & Development Director of Owasp Italian Chapter.


Tools written by him:-

PassBroker - a php extension which dispatch secrets which are often embedded in clear inside php web pages (ie. sql username and password.)
http://www.wisec.it/projects.php?id=2

HMAUTH - A Html form authentication using HMAC
http://www.wisec.it/projects.php?id=1

Anti Tamper Module for Apache 2.0 - It is a tool which parses every outbound html page and add a sign to every static link and to cookies, in order to prevent malicious users from tampering GET parameters and cookies.
http://www.wisec.it/projects.php?id=3

Rul-o-matic - a web agent for white list mod_security rules generation.
http://www.wisec.it/sectou.php?id=438064b3e5ea4
http://www.wisec.it/rdr.php?fn=/Projects/Rule-o-matic.tgz


Company working for :-

Co-founder of Minded Security ( http://www.mindedsecurity.com/ ).


Email:-

stefano.dipaola_at_mindedsecurity_dot_com
stefano.dipaola_at_wisec_dot_it


Blog:-

http://www.wisec.it/


Website:-

http://www.wisec.it/
http://www.midedsecurity.com/


Conferences:-

Web Security By Example - SMAU (Italy)
http://www.webb.it/event/eventview/4476/

Subverting Ajax - 23rd CCC (Germany)
http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf

Ajax Security - Infosecurity (Italy)
http://www.sikurezza.org/wiki/Risorse/I07FedonDiPaola

Testing Flash Applications - 6th Owasp AppSec Conference (Italy)
http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt


Lectures (University of Florence):-

Secure Software Development Life Cycle(2007) - Phd Course Faculty of Software Eng.

Web Developing Security(2005/2006) - Course of 'Databases', Faculty of Software Eng.


Advisories:-

Php RFC1867 Arbitrary File Upload (10/2004)
http://www.wisec.it/vulns.php

Php shmop safemode bypass and write to arbitrary locations (10/2004)
http://www.wisec.it/vulns.php

MySQL Server CREATE FUNCTION libc arbitrary code execution (03/2005)
http://www.wisec.it/vulns.php

MySQL Server CREATE FUNCTION mysql.func table arbitrary library injection (03/2005)
http://www.wisec.it/vulns.php

MySQL Server insecure temporary File Creation (03/2005)
http://www.wisec.it/vulns.php

MySQL Server COM_TABLE_DUMP Information Leakage and Arbitrary command execution.(04/2006)
http://www.wisec.it/vulns.php?page=8

MySQL Server Anonymous Login Handshake Information Leakage. (04/2006)
http://www.wisec.it/vulns.php?page=7

Acrobat Reader Plugin Multiple Vulnerabilities (01/2007)
http://www.wisec.it/vulns.php?page=9

Php import_req_var globals overwrite Advisory (03/2007)
http://www.wisec.it/vulns.php?id=10

IE and Firefox Digest Authentication Request Splitting (04/2007)
http://www.wisec.it/vulns.php?id=11


Education:-

Masters in Software Engineer (University of Florence)
Certified Lead Auditor ISO 27001.


Stefano had recently released a paper on Flash vulnerabilities in OWASP Europe conference and is also working on some new interesting research ideas. For all those who are in webappsec community should definitely keep an eye on him.


Last Week – Ryan Barnett
Next Week – Saumil Shah