AppSec California 2014
as the organisers put it
AppSec California 2014 is a conference focused on web application security held in beautiful Santa Monica, CA at the Annenberg Community Beach House Jan 27-28th, 2014
who it's for
web application security engineers, security researchers, software developers, devops engineers, mobile application developers, red team operators, security managers
topics
Content Security Policy adoption; libinjection SQLi and XSS detection; million browser botnet via ads; OWASP proactive controls checklist; OWASP Mobile Top 10 risks; CSRF defense techniques; Zed Attack Proxy usage; large scale code review practices; DIY command and control; anatomy of webshells; detecting state actor surveillance; application DoS mitigation and survival
| title | author | length |
|---|---|---|
| Keynote | Michael Coates | 18m |
Verizon data show about 78% low difficulty exploits and most breaches are opportunistic, so focus is on eliminating trivial entry points not debating theory… | ||
| Privacy vs Security Intricacies | Robert Hansen | 44m |
Wants concrete details: a specific claim about privacy vs security, which tools used and how they were applied, measured outcomes or numbers that surprised me… | ||
| attack-driven defense | Zane Lackey | 52m |
Describes concrete outcomes: a homegrown host IDS called Trip Yarn that ships endpoint command and kernel‑module data to servers for central analysis, a GitHub… | ||
| Application Security at DevOps Speed and portfolio scale | Jeff Williams | 52m |
Claims that instrumenting an entire IT organization with passive sensors yields real‑time, portfolio‑wide security visibility; prototypes include a… | ||
| Million Browser Botnet | Jeremiah Grossman, Matt Johanssen | 48m |
Claim: buying ad impressions and cheap browser time runs arbitrary JavaScript and scales to vast botnets. Code uses plain HTML5/JavaScript (image tags, web… | ||
| Top Ten Proactive Web Application Controls | Jim Manico | 01h 01m |
Project status: OWASP proactive controls in beta with a concrete checklist. Key claims and tools: use query parameterization to eliminate SQL injection, adopt… | ||
| new framewords old problems | Ken Johnson, mike mccabe | 44m |
Newer frameworks like Play and Node based Geddy reproduce long‑known flaws rather than fix them: demoed exploitation uses Burp and sqlite to show client-side… | ||
| how to spy with python so easy the NSA can do it | Lynn Root | 29m |
Slides summarize PRISM and XKeyscore and claim those programs mine transit traffic and run federated queries; demonstration code reproduces six concrete… | ||
| The Cavalry is Us | Beau Woods | 47m |
Security frames as public safety not theory: claims include fixed six medical devices with Metasploit in about an hour, a documented chain that pushed FDA and… | ||
| Can AppSec Training Really make a smart developer | John Dickson | 33m |
Yearlong survey of ~1,000 developers measures knowledge before and after formal secure‑coding training, with about 450 usable responses and ~100 paired… | ||
| HTTP Time Bandit | Tigran Gevergyan, Vaagn Toukharian | 35m |
A crawler measures per-URL transfer speed, normalizes results, and selects low-speed low-variance endpoints to hammer; the supplied tool emits XML, draws a… | ||
| Running at 99% Surviging an Application DoS | Ryan Huber | 42m |
Strikes against application logic and resource pools drive decisions: a small Node.js reverse proxy called bouncer sits in front of Apache, closes blacklisted… | ||
| HTML5 JS Security | Maty Siman | 36m |
Shows concrete exploits and demos: uses html2canvas screenshots to capture same‑origin iframe content and a patched routine that modified input type reveals… | ||
| Android iPhone Risks and Solutions | Jonathan Carter | 32m |
Claims exploited: 100% of a 2013 snapshot of top 100 Android apps had cracked versions and paid iPhone apps show ~50–56% crack rates; studies cited include… | ||
| Whiz, Bang, ZAP! An introduction to OWASP's Zed Attack Proxy | Ben Walther | 58m |
Claims parity with AppScan and WebInspect but free open source, Zed Attack Proxy actually runs as a local Java proxy, records traffic, spiders (including an… | ||
| sandboxes: no thy limit | rahul kashyap | 58m |
Windows application sandboxes (examining Sandboxie, Adobe ReaderX and Chrome) have architectural limits: kernel bugs let sandboxed renderers escalate to SYSTEM… | ||
| The CSOs myopia | jordan bonagura | 24m |
Claim: The CSO's Myopia means policies produce pseudo security not real defense. Evidence: exposed config.php, SQL dumps, open Samba shares, downloadable CSVs… | ||
| Mantra OS: Because the World is Cruel | Gregory Disney-Leugers | 17m |
Mantra OS is a virtualized sandbox attack platform (available as ISO/OVA) that bundles LOIC, Slow HTTP and scampy for DDoS, Burp and sqlmap integrated with ZAP… | ||
| An inconvenient Zeus: The rise of Saas targeted malware | Ami Luttwak | 24m |
A new Zeus variant targeting Salesforce sits dormant on unpatched home machines waits for the user to log in then piggybacks the session to scrape records and… | ||
| Why Infosec Needs Rugged DevOps Now: A Study Of High Performing IT Organizations | Gene Kim | 58m |
Claims that integrating security into DevOps yields concrete results backed by numbers and tools: companies like Netflix LinkedIn Twitter Github Etsy run… | ||
| What is CSP and Why Haven't You Applied it Yet | Joel Weinberger | 32m |
Content Security Policy claims to block most XSS by enforcing a whitelist of resource origins, forbidding inline scripts and eval, and returning violations to… | ||
| OWASP Top 10 Mobile Risks: 2014 Reboot | Jack Mannino, Jason Haddix | 31m |
OWASP publishes a data-driven reboot of the Mobile Top 10 that reorders risks based on 800+ mobile assessments and ~250 unique vulnerabilities showing the top… | ||
| libinjection: from sqli to xss | Nick Galbreath | 34m |
libinjection claims fast accurate detection of SQLi and now HTML injection XSS it ships on GitHub under a BSD license and already integrates into WAFs and… | ||
| DIY Command & Control For Fun And *No* Profit | David Schwartzberg | 01h 02m |
A live Zeus command‑and‑control is built on LAMP/XAMPP with a bot builder and config.bin, deployed to zdemo.moo3os.com and shown with the guest account; the… | ||
| 7 Deadly Sins: Unlock the Gates of Mobile Hacking Heaven | Dan Kuykendall | 41m |
Research claims seven common session-management failures and backs them with live manipulations of real apps showing what actually breaks and why. Examples… | ||
| CSRF: not all defenses are created equal | Ari Elias-Bachrach | 45m |
Compares concrete defenses and shows which actually break or preserve functionality: synchronizer token pattern versus double submit cookies versus referrer… | ||
| Next Generation Red Teaming | Robert Wood | 46m |
Claims that siloed red teams miss app-layer risk and shows an application-centric method that actually combines components into composites. Demonstrates a real… | ||
| Anatomy of a WebShell | D0n Quix0te | 19m |
WebShells come in three concrete classes — eval-based tiny backdoors, admin/full-featured backdoors, and proxy exfiltration via XMLHttpRequest — with proxies… | ||
| adventures in reviewing mountains of code | Jon Boyd | 33m |
A code review of 2.6 million lines becomes a project: build a parser that produces an abstract syntax tree, link methods into a control‑flow graph, and run… | ||
| detecting and defending against state actor surveillance | robert r | 18m |
Claims link the SkyMall leaks to concrete implants and rogue networks and offers tests not theory: use a HackRF software-defined radio to spot RF exfiltration… | ||
| nothing matches | ||