AppSecUSA 2016
| title | author | length |
|---|---|---|
| The Less Hacked Path | Sammy Kamkar | 59m |
Creates a MySpace worm that infected ~1M profiles in <24 hours using XSS plus AJAX to steal CSRF tokens, builds an open project called SkyJack drone takeover… | ||
| Cryptography in the age of Heartbleed | Matthew Green | 44m |
Heartbleed opens the door to concrete failures: 30% of servers still accept export‑grade RSA, a 512‑bit RSA key can be cracked in about an hour for tens of… | ||
| Software Supply Chain Lifecycle Management | Joe Jarzombek | 52m |
Claims that supply chains must be managed across development acquisition and DevOps with software composition analysis and standards automation are backed by… | ||
| How To Find The Next Great Deserialization CVE | Arshan Dabirsiaghi | 35m |
Generalizes the recent Java deserialization surge and shows an actually authored exploit that chains a hashCode → ProcessBuilder.start chain to get remote… | ||
| Threat Modeling With Architectural Risk Patterns | Stephen de Vries | 50m |
Software-centric method uses risk patterns to speed and scale threat modeling, moving from checklist templates to a flexible rules engine that auto-selects and… | ||
| Next Gen Web Pen Testing | Kevin Johnson, Jason Gillam | 58m |
Covers concrete testing tactics for HTTP/2 CORS CSP REST and WebSockets with examples and tool notes rather than theory explains when to downgrade to HTTP/1.1… | ||
| Barbarians at the Gate(way) | Dave Lewis | 45m |
Platform logs show 97–99% of observed DDoS traffic is infrastructure‑based, web attacks still put SQL injection at the top of lists, Q2 data attributes ~25% of… | ||
| Continuous Integration: Live Static Analysis using Visual Studio & the Roslyn API | Eric Johnson | 54m |
Shows how to use the Roslyn API and Visual Studio 2015 to write live static rules, and delivers a free extension published as a PumaScan NuGet with about 40… | ||
| AppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program | Matt Tesauro | 48m |
Adopts CI/CD ideas into AppSec with concrete results: pipeline architecture (intake → triage → parallel testing → vulnerability repo → Jira) that automates… | ||
| SPArring with the Security of Single Page Applications | Dan Kuykendall | 56m |
Single page applications shift real work to the client and break conventional scanners by hiding REST calls and parameter structure so testing must target the… | ||
| Automating API Penetration Testing using fuzzapi | Abhijeth Dugginapeddi, Lalith Rallabhandi | 46m |
A working API fuzzer called Fuzzapi is released as an OWASP project: a Ruby gem plus a Rails UI that uses Sidekiq/Redis, MySQL and optional Docker images so… | ||
| Exploiting CORS Misconfigurations for Bitcoins and Bounties | James Kettle | 46m |
Shows concrete exploits: CORS dynamic allow-origin logic and the null origin let attackers steal API keys and take over accounts, enabling full Bitcoin… | ||
| Misconfigured CORS and why web appsec is not getting easier | Evan Johnson | 40m |
Claims a concrete fault: scanned the Alexa 1 million and finds about 1,000 sites reflecting the Origin header plus Access‑Control‑Allow‑Credentials true… | ||
| Putting an 'I' in Code Review Turning Code Reviewing Interactive | Ofer Maor | 43m |
Claim: making manual code review interactive by attaching a debugger to a running Java app gives faster, focused findings than static reading. The demos… | ||
| Cleaning Your Applications' Dirty Laundry with Scumblr | Scott Behrens, Andrew Hoernecke | 53m |
Open-source Scumblr 2.0 "Dirty Laundry" centralizes scans and metadata, runs multithreaded tasks (curl, Breakman, Bandit, Arachni/AppSpider integrations… | ||
| Everything is Terrible: Three Perspectives on Building, Configuring, and Securing Software | Chris Barker, Adrien Thebo, Bill Weiss | 49m |
Concrete claims and tools: automated CI security checks (Breakman), a man in the middle SSL test harness, and config management that enforces firewall and… | ||
| HTTPS & TLS in 2016: Security practices from the front lines | Kenneth White, Eric Mill | 01h 01m |
Covers concrete failures and fixes: exploits like FREAK, BEAST, POODLE and LOGJAM, migration choices (ECDSA vs RSA, 2K vs 4K), and deployment recipes for… | ||
| Practical Static Analysis for Continuous Application Security | Justin Collins | 39m |
Claims that targeted static analysis is cheap to build and automatable: small grep-based rules or a bash/Ruby script that diffs changed files can flag a… | ||
| Using language-theoretics and runtime visibility to align AppSec with DevOps | Kunal Anand | 50m |
Claims a workable RASP built on LANGSEC that parses inputs with antler-generated lexer/parsers, runs inside Java as a shim or agent, and exposes SQL trees… | ||
| Breaking and Fixing your ‘Docker’ ized environments | Manideep Konakandla | 57m |
Co‑authored CIS Docker 1.12 benchmark gives the baseline and the work reports scanning of more than 50 Docker Hub images that reveal Heartbleed Shellshock and… | ||
| Protect Containerized Applications With System Call Profiling | Chenxi Wang | 53m |
Claim: automated static analysis of container images and Dockerfiles produces accurate system call profiles used at runtime that detect deviations and block… | ||
| DevOops: Redux | Chris Gates, Ken Johnson | 52m |
Concrete checks and fixes replace vague DevOps warnings: OSQuery + Doorman fleet control is used to detect and remediate compromised developer hosts, and… | ||
| Practical tips for web application security in the age of agile and DevOps | Zane Lackey | 53m |
Claims concrete tactics: adapt heavyweight static analysis to start bottom-up by onboarding one vulnerability class (example: command execution) and run checks… | ||
| Scaling Security Assessment at the Speed of DevOps | Blake Hitchcock, Brian Manifold, Roger Seagle | 50m |
A distributed security-testing framework called Norad automates and aggregates scanners (qualus, Vol, ZAP, nmap, sslyze, server‑spec) as Docker images, uses… | ||
| The Ways Hackers Are Taking To Win The Mobile Malware Battle | Yair Amit | 42m |
Claims a live-built Android malware bypasses static signatures and sandboxes by abusing accessibility clickjacking and the overlay draw flags, uses apktool… | ||
| Containerizing your Security Operations Center | Jimmy Mesta | 47m |
Claim: a pluggable cloud-based Security Operations Center runs entirely on containers so teams stop wrestling with local installs and PDFs and start shipping… | ||
| Your License for Bug Hunting Season | Jim Denaro, Casey Ellis | 55m |
Bug bounty programs reduce risk by turning incidental attackers into paid reporters and by using concrete controls: a hosted intake platform with triage and… | ||
| When encryption is not enough: Attacking Wearable | Chandra Prakash Gopalaiah, Sumanth Naropanth, Kavya Racharla | 43m |
Recorded at AppSecUSA 2016 in Washington, DC
https://2016.appsecusa.org/
When encryption is not enough: Attacking Wearable - Mobile Application communication… | ||
| Why using SMS in the authentication chain is risky | Simon Thorpe | 01h 02m |
Argues that SMS-based OTPs are insecure because of SS7 vulnerabilities and real-world SIM swapping incidents, demonstrates push-notification flows using… | ||
| Needle: Finding Issues within iOS Applications | Marco Lancini | 21m |
Due to technical difficulties, the entirety of this video is unavailable. However, a PDF of the slides can be found at the MWR Infosecurity website… | ||
| Patterns of Authentication and Self-Announcement in IoT | Farbod H Foomany, Amir Pourafshar | 47m |
Claims a reusable feature space that classifies real authentication patterns (password/PAP, CHAP, WPA2 four‑way, Diffie‑Hellman then sign, and PAKE/SKKE) and… | ||
| Practical Tips For Running A Successful Bug Bounty Program | Grant McCracken, Daniel Trauner | 52m |
Claims running hundreds of programs and concrete practices: use a single-page bounty brief with exact scope, exclusions and focus areas; prefer staging over… | ||
| [AUDIO] Should there be an Underwriters Laboratories certification for software in IoT products? | Joshua Corman, Anita D'Amico, Kevin Greene | 55m |
Proposal claims a CyberUL will raise IoT security by requiring publish a software bill of materials, no known CVEs without mitigation, and must be patchable… | ||
| nothing matches | ||