AppSecUSA 2013
| title | author | length |
|---|---|---|
| Zed Attack Proxy | Simon Bennetts | 51m |
Zed Attack Proxy claims real capability not marketing: a free OSS proxy with 25,000 downloads and over 20 translations, built-in API for automated regression… | ||
| The Cavalry Is US: Protecting the public good | Joshua Corman, Nicholas Percoco | 50m |
Asserts that “the cavalry isn¹t coming” and organizes a movement that actually builds channels: a public mailing list and Google group, a two‑day… | ||
| AppSec Guide and CISO Survey | Marco M. Morana, Tobias Gondrom | 41m |
OWASP publishes a CISO guide and runs a ~100+ CISO survey that claims application risks dominate risk portfolios and are rising: responders allocate ~70–80% of… | ||
| Top Ten Proactive Controls | Jim Manico | 50m |
The OWASP Proactive Controls lists concrete, testable requirements: adopt query parameterization to eliminate SQL injection, stop using fast salted hashes… | ||
| Forensic Investigations of Web Exploitations | Ondrej Krehel | 53m |
Shows that a single pcap file can contain enough to prove compromise: HTTP directory‑traversal (double‑encoded, Nimda‑style) leads to a web‑server running a… | ||
| Big Data Intelligence | Ory Segal, Tsvika Klein | 46m |
Akamai describes a platform that collects petabytes of WAF data (about 260 TB compressed logs per day, stores 2 PB for 45 days) and analyzes it with Akamai CSI… | ||
| All the network is a stage, and the APKs merely players | Daniel Peck | 42m |
Shows how an attacker disassembles APKs with apktool/smali and jd gui, intercepts traffic with ProxyDroid and Burp, then loads APK classes into JRuby to call… | ||
| BASHing iOS Applications | Jason Haddix, Dawn Isabel | 47m |
Claims a practical, low‑expertise binary-focused workflow that runs in about a minute using a jailbroken device, decrypts apps with clutch/raps, extracts… | ||
| What You Didn't Know About XML External Entities Attacks | Timothy Morgan | 39m |
A concrete set of XXE exploits appears: parameter entities and DTD bootstrapping let attackers embed file contents or construct URLs, Java jar handler gives… | ||
| Hackademic | Konstantinos Papapanagiotou | 37m |
OWASP Hackademic is a classroom-focused vulnerable-app system that actually exists as a PHP portal deployed online and in dozens of universities; it starts… | ||
| Periodic Table of Elements | James Landis | 49m |
Claims that the OWASP Periodic Table of Vulnerabilities recombines OWASP Top 10 WASC TCv2 and CWE-25 into a practical fix plan it maps ~50 elements across… | ||
| Why is SCADA Security an Uphill Battle? | Amol Sarwate | 47m |
Explains why control networks keep failing by naming actual weak points: 66% in SCADA master (HMI/DCS/web apps), real protocol flaws in Modbus DNP3 and other… | ||
| Making the Future Secure with Java | Milton Smith | 50m |
Oracle documents show concrete moves: Java 8 slips to Q1 2014 because of security, CPUs go quarterly, and remediation tempo jumps (one CPU fixes 55… | ||
| Tagging Your Code with a Useful Assurance Label | Robert Martin | 31m |
Claims that a concise label can say which assurance activities were done, when in the lifecycle, and which CWEs those activities actually cover. It maps… | ||
| HTML5: Risky Business or Hidden Security Tool Chest? | Johannes Ullrich | 51m |
HTML5 features produce concrete tradeoffs: local/sessionStorage used for device tokens can block CSRF by keeping tokens out of cookie headers but exposes data… | ||
| Thinking Differently About Security | Mary Ann Davidson | 51m |
Argues for concrete shifts: build resilient infrastructure instead of hiring more patchers, automate situational awareness with standards like security content… | ||
| The 2013 OWASP Top 10 | Dave Wichers | 49m |
Explains concrete changes: A9: using known vulnerable components added, two crypto items merged, seven items reordered; ranking comes from a defined risk… | ||
| PiOSoned POS - A Case Study in iOS based Mobile Point-of-Sale gone wrong | Mike Park | 40m |
PiOSoned POS - A Case Study in iOS based Mobile Point-of-Sale gone wrong - Mike Park
Mobile Point of Sale (POS) are becoming more and more common in a wide… | ||
| Verify your software for security bugs | Simon Roses Femerling | 50m |
A practical verification tool is available: BinSecSweeper is open source, Python based, cross‑platform and scans PE & ELF x86-64 binaries to report presence of… | ||
| Insecure Expectations | Matt Konda | 46m |
Tests and specs become security checks: concrete examples show RSpec and cucumber scenarios driving WebDriver to prove SQLi XSS CSRF mass‑assignment and… | ||
| Hacking Web Server Apps for iOS | Bruno Oliveira | 31m |
Scans of iOS file‑sharing apps find many run embedded web servers with no SSL and often no authentication, expose services via mDNS advertisement, and accept… | ||
| Aim-Ready-Fire | Wendy Nather | 41m |
Panel gives concrete takeaways: surveys show almost 50 percent of IT executives refuse to buy application security, teams use OWASP Top 10, WebGoat, OpenSAMM… | ||
| AppSec at DevOps Speed and Portfolio Scale | Jeff Williams | 52m |
Argues for instrumenting an entire IT organization with passive sensors that collect HTTP, data‑flow and control‑flow evidence to detect vulnerabilities in… | ||
| Application Security: Everything we know is wrong | Eoin Keary | 44m |
Claims that time‑boxed pentests fail because attackers spend 10–100× longer probing, that most breaches are business‑logic failures not scannerable bugs, and… | ||
| An Introduction to the Newest Addition to the OWASP Top 10 | Ryan Berg, Jeff Williams | 48m |
OWASP A9 warns that component risk is concrete: Sonatype Central sees 8 billion requests annually and about 20 million downloads per week, and an analysis of… | ||
| Mobile app analysis with Santoku Linux | Andrew Hoog | 49m |
Santoku Linux is a bootable Debian-based distro that bundles mobile forensics, malware and security tools so installing dozens of utilities is unnecessary… | ||
| Accidental Abyss: Data Leakage on The Internet | Kelly FitzGerald | 39m |
Live demonstration of step‑by‑step recon on a reality‑TV subject shows how tiny public crumbs become a full dossier: patterns in Social Security numbers narrow… | ||
| Mantra OS: Because The World is Cruel | Gregory Disney-Leugers | 23m |
A virtualized attack platform built as an appliance with grsecurity, OpenVZ/LXC, KVM and libvirt that ships as OWASP Mantra OS and as ISO/OVF. It bundles… | ||
| Wassup MOM? Owning the Message Oriented Middleware | Gursev Singh Kalra | 51m |
Claims a practical audit of JMS security with working exploits: an attacker uses JMSDigger to brute force credentials, decrypt ActiveMQ stored passwords at… | ||
| Case Study: 10 Steps to Agile Development without Compromising Enterprise Security | Yair Rovek | 50m |
Claims implementation of an SSDLC across 22 SCRUM teams and ~200 developers covering up to 1M lines of code with measurable controls: OWASP ESAPI package as a… | ||
| Contain Yourself: Building Secure Containers for Mobile Devices | Ron Gutierrez | 49m |
Case studies show how commercial BYOD products perform dynamic library injection and method swizzling to wrap apps, with injected libs discovered by comparing… | ||
| iOS Application Defense - iMAS | Gregg Ganley | 43m |
Claims an open source iOS framework that pushes security beyond Apple with five security controls available for developers, concrete tools like encrypted core… | ||
| Pushing CSP to PROD | Brian Holyfield, Erik Larsson | 51m |
Case study of deploying a strict CSP on SendSafely.com: team sets default-src 'none', moves all JS to static.sendsafely.com, strips inline handlers to event… | ||
| Leveraging OWASP in Open Source Projects | Aaron Weaver, David Ohsie, Bill Thompson | 45m |
CAS AppSec Working Group applies OWASP resources to Jasig CAS and shows concrete results: data‑flow diagrams and OWASP STRIDE threat modeling, plus static and… | ||
| HTTP Time Bandit | Vaagn Toukharian, Tigran Gevorgyan | 43m |
A crawler measures per-URL download times, computes mean and standard deviation, and flags consistently slow endpoints for focused load trials; results are… | ||
| Missions and impacts to US industry, economy and citizens | James St. Pierre, Matthew Scholl | 40m |
NIST explains concrete results and tools: combinatorial covering arrays and a covering array generator that supports constraints and variable strengths… | ||
| Revenge of the Geeks: Hacking Fantasy Sports Sites | Dan Kuykendall | 46m |
Shows how mobile fantasy apps actually break: stole session tokens at draft using a Wifi Pineapple and Burp proxy, then changes opponents’ lineups and posts… | ||
| Hack.me: a new way to learn web application security | Armando Romeo | 44m |
Hack.me is a free platform that builds and runs community-contributed vulnerable web apps on demand using the Coliseum Framework after 30 months of development… | ||
| Broken Web Applications (OWASP BWA): Beyond 1.0 | Chuck Willis | 49m |
OWASP Broken Web Applications (OWASP BWA): Beyond 1.0 - Chuck Willis
The OWASP Broken Web Applications (OWASP BWA) Project produces a free and open source… | ||
| Can AppSec Training Really Make a Smarter Developer? | John Dickson | 45m |
A yearlong survey of nearly 1,000 developers measures knowledge before and after formal training and retests a subset for retention, finding yearlong survey of… | ||
| The Perilous Future of Browser Security | Robert Hansen | 42m |
Claims browsers are critically insecure for 2.4 billion users and that fixes require hard tradeoffs: losing performance and features to gain safety. Specific… | ||
| Women in Information Security | Joan Goodchild | 49m |
Cites a concrete gap — 80% programmers are men and industry studies show 11% women in information security — then gives numbers employers can act on: Urban… | ||
| Don't Tell Me Software Security | Mark Miller | 42m |
Panelists run a live news quiz with concrete, recent incidents: GitHub forces password resets and bans weak passwords, Google upgrades SSL keys, Adobe and… | ||
| nothing matches | ||