Monday, August 3, 2009

OWASP AppSec Asia Conference 2009, New Delhi

2009 - OWASP India is back with more interesting and exciting stuff from AppSec World..With the successful launch of OWASP India Conference in August 2008, organized in New Delhi with participation from 350+ attendees from 80+ companies and government sector. OWASP India now proudly announces the biggest Information security conference in India in association with Canada based Information Security Conference (www.securitybyte.org). Securitybyte and OWASP AppSec Asia Conference 2009 is planned for 17th - 20th November 2009 in New Delhi. Event will cover end-to-end Information Security tracks that includes Application Security, Network / Infrastructure Security, Cyber Terrorism, Cloud security,SOA Security, Cyber Forensics, Wi-Fi security, Risk Management & Compliance, etc.

Brief list of Speakers in the conference:
Howard A. Schmidt, Advisor, NIST & PSG - ENISAJohn Bumgarner ,SSCP Research Director for Security Technology, U.S. Cyber Consequences Unit
Shreeraj Shah, B.E., MSCS, MBA, Founder, BlueInfy

Dino Covotsos,Founder & Managing Director, Telspace Systems
Charlton Smith ,Security Analyst, Telspace Systems
Nitin Kumar,Independent Security Engineer & Researcher, NVLabs
Vipin Kumar,Independent Security Consultant & Analyst, NVLabs
Joshua Talbot ,Security Intelligence Analysis Team, Symantec Corporation
Aviram Jenik,Founder, Beyond Security
Cédric Blancher ,Head of Computer Security Research Lab EADS Innovation Works
Mano Paul (CISSP, MCSD, MCAD, CompTIA Network+, ECSA)
Fyodor Yarochkin, Security Consultant, GuardInfo
Other Speakers:
Jeremiah Grossman, White Hat Security
Alexander Kornbrust, Red Database Security GmbH
Robert Hansen (RSnake), Ha.ckers.org
There will be training sessions as well:
  • Application, Database & Web Security
  • Infrastructure Security (Network / Wireless/ Bluetooth / Malware / Forensics / Cyber- terrorism / Physical Security / Information warfare etc.)

There will be few 0-Day(Zero day) attacks as well :)

So fasten your seat belt and be ready for the excitement. Be there...

For any queries contact:

OWASP India Co-Chairs-

Mr. Puneet Mehta at puneet.mehta(at)owasp.org

Mr. Dhruv Soi at dhruv.soi(at)owasp.org

For more information on sessions,schedules, event and Registration go to:

http://securitybyte.org/

http://www.owasp.org/index.php/Category:India

Posted by at No comments:

An Introduction to PDF XSS

Here I am going to give a brief write up about PDF XSS.

Amit Klien introduced a third kind of XSS attack-DOM Based XSS in which exploits client side vulnerabilities rather than Server Side flaws.He also observed how the # character can be used to, very conveniently, avoid sending attack payload to the server.DOM-based XSS typically uses JavaScript.Example (taken from Amit’s paper):

<HTML><TITLE>Welcome!</TITLE>Hi <SCRIPT>var pos = ocument.URL.indexOf("name=") + 5; document.write(document.URL.substring(pos,document.URL.length));</SCRIPT></HTML>

Exploiting PDF :Use the same technique using JavaScript it would execute it when a link in the following format is encountered:

http://www.example.com/file.pdf#a=javascript:alert()


Threats:
After a successful attack the code is executed in the context of the site that hosts the PDF file.

The attacker is in full control of the victim’s browser (think session hijacking, request forgery, etc.).

Individual users are fully compromised.System compromise is possible through escalation.


Fixing the problem:
In many ways this is a simple problem to solve.

Just upgrade the client-side software:Adobe Reader 8 not vulnerable.Internet Explorer 7 not vulnerable.

Alternatively, you can configure the browser not to open PDF files at all.But we know many users will not upgrade.

Not possible to detect attack on the server.Therefore our only option is to “protect” all PDF files no matter if they are being attacked or not.Proposed mitigation revolves around three ideas:Moving PDF files to some other domain name.Preventing browsers from recognising PDF files. (Some are very stubborn in this regard.)Forcing browsers to download PDF files.

Posted by at No comments:

Sunday, August 2, 2009

Automated CSRF attack tool MonekyFist

A pair of researchers here yesterday unleashed a tool that automatically executes dangerous cross-site request forgery (CSRF) attacks.
Shawn Moyer and Nathan Hamiel demonstrated how their tool, MonkeyFist, performs what they call "dynamic" CSRF attacks, or attacks on Websites that have put up preventative measures such as tokenization and session IDs . CSRF is when an attacker makes a Web request within the context of the victim's Web session.
The researchers say the emergence of integrated and aggregated content, such as buttons for Twitter or "Digg This," have opened up even more possibilities for these attacks, which take advantage of a pervasive but difficult-to-detect vulnerability in many Websites.
This "session-riding" attack basically lets the bad guy silently ride atop the victim's Web session. "You're [the attacker] already authenticated into a site, and the user's session, header, and cookie is already there," says Moyer, a hacker on the Security Assessments Team at FishNet Security. "You're already there, so what you're doing is getting the user to do something and you're riding on their session."
It lets an attacker steal credentials from a user, by luring the victim to his malicious Website, for example. The researchers demonstrated a CSRF attack using MonkeyFist on the global password function on Newsweek.com during their presentation here at Black Hat.
MonkeyFist is a Python-based Web server tool that listens and automates per-request, dynamic CSRF attacks. In the demo here, MonkeyFist pointed a Newsweek.com "user" to a "bad guy's" site via the publication's password reset process. The user then went to Reddit, the social networking news and digest site. "A hidden POST reset his password and took him to YouTube," where the researchers had set up a phony video, says Hamiel, senior security consultant with Idea Information Security.
"Using MonkeyFist makes it easy to do host-based CSRF," he says. "It lets you get session ID information through cross-referrer leakage."
The researchers say the tool also simplifies the previously onerous task of a POST-based CSRF attack.
Posted by at No comments:
Subscribe to: Posts (Atom)