OWASP AppSec California 2018
2018-01-30..2018-01-31
Santa Monica, United States
[OWASP AppSec California 2016, OWASP AppSec California 2018]
as the organisers put it
Opening Keynote - Flipping the script: Fighting Advanced Threats at their Software Roots Eric Baize, Chairman, SAFECode Tuesday, January 30 • 9:25am - 10:15am Event details: The Open Web Application Security Project (OWASP) Los Angeles Chapter is teaming up with the Orange County, San Diego, SF Bay Area, and the Inland
| title | author | length |
|---|---|---|
| Robots with Pentest Recipes | Abhay Bhargav | 40m |
Shows a working pipeline that uses Robot Framework to glue OWASP ZAP, Nmap, Nessus, Burp and directory tools into reusable security “recipes,” producing… | ||
| The Bug Hunter's Methodology 2.0 | Jason Haddix | 46m |
Shows a repeatable discovery pipeline: scrape with sublister / recon-ng / enumall, brute-force subdomains with massDNS: 1m24s for a 1,136,964‑entry wordlist… | ||
| Opening Keynote - Flipping the script | Eric Baize | 43m |
Argues that scaling software security means shifting beyond tools to changing culture and buyers: publishes SAFECode practices and a forthcoming updated… | ||
| DevOps Is Automation, DevSecOps Is People | Mike Shema | 48m |
Argues that security succeeds by changing human practices not just adding tools: embeds checks into the CI/CD pipeline (linters, automated secret scans), runs… | ||
| The Only Reason Security Really Matters for DevOps | Caroline Wong | 47m |
Argues that security matters because it protects revenue and vendor trust, citing Amazon doing code deploys every 11.7 seconds, Netflix deploying thousands… | ||
| Authentication Without Authentication | Omer Levi Hevroni | 46m |
Claims a workable way to authenticate an app installation without user interaction by having each device generate an RSA keypair, register the public key plus… | ||
| Leveraging Cloud SDNs to Solve OWASP Top Ten | John Studarus | 40m |
Practical recipe for injecting virtual security appliances into cloud networks using layer 2 service chaining so applications keep their IPs: builds golden VM… | ||
| ReproNow - Save time Reproducing and Triaging Security Bugs | Vinayendra Nataraja, Lakshmi Sudheer | 45m |
A Chrome/Opera extension that captures screen and network using getUserMedia/MediaRecorder and chrome.webRequest, timestamps them to sync, and hides the… | ||
| The Best Flaw Didn't Make Into Production | Christian Dameff | 46m |
Argues that developers must surface small security changes as actionable tickets using existing issue trackers (JIRA) tied to tiny, testable checklists and… | ||
| Threat Modeling Toolkit | Jonathan Marcil | 49m |
Uses a minimalist connection flow diagram that focuses on attack surface, plus attack trees via PlantUML to organize real attacker goals; applies both to a… | ||
| Threat Modeling Panel | Jonathan Marcil, Brook S.E. Schoenfield, Adam Shostack, Izar Tarandach, Haral Tsitsivas | 49m |
Panel argues threat modeling succeeds when it’s modular, iterative and owned by the team, not a one-off review. Practical takeaways: use connection flow… | ||
| Breaking Fraud and Bot Detection Solutions | Mayank Dhiman | 52m |
Vendor JavaScript snippets harvest browser and behavior signals (fonts, canvas, audio, plugins, mouse/keystroke timing) and send a fingerprint to cloud ML… | ||
| The Path Of DevOps Enlightenment For InfoSec | James Wickett | 39m |
Claims that traditional security is in crisis and that embedding security into DevOps works by adding runtime telemetry and fast CI/CD feedback loops. Shows a… | ||
| Decrease Your Stress and Increase Your Reach with Appsec Champions | Coleen Coolidge | 34m |
Argues for an appsec champions program with concrete prerequisites (a budgeted roadmap, a written role description, a secret list) and a workflow: biweekly… | ||
| SecDevOps: Current Research and Best Practices | Clint Gibler | 51m |
Covers concrete SecDevOps moves: build secure-by-default libraries (example wrapper that bans MD5), run fast git hooks and linters like eslint to block eval… | ||
| OWASP Top 10 | Andrew van der Stock | 47m |
OWASP Top 10 2017 explains how the list is built from a real data call (over 114,000 applications, 43 dataset submissions with 20+ usable), closed 125 issues… | ||
| MarkDoom: How I Hacked Every Major IDE in 2 Weeks | Matt Austin | 40m |
Demonstrates arbitrary code execution across major IDEs by abusing markdown previews, Electron node integration and protocol handlers, producing 5 CVEs and… | ||
| Seeing Through the Fog - Navigating the Security Landscape of a Cloud-First World | Ben Johnson | 31m |
Cloud providers keep the hardware and uptime while enterprises keep the data and misconfigurations cause most damage: public AWS S3 buckets routinely expose… | ||
| Closing Keynote - Digital Disease: How Healthcare Cybersecurity Challenges... | Christian Dameff | 51m |
Argues that ubiquitous, poorly patched clinical systems and devices already enable lethal failures: reverse‑engineered insulin pumps deliver entire reservoirs… | ||
| Opening Keynote: Prove It! Confronting Security With Data. | Richard Seiersen | 44m |
Argues security should be measured by concrete rates not adjectives, proposing to quantify the rate of new exploitable risks and the time‑to‑live (survival) of… | ||
| European Vacation: Leveraging GDPR for Security | Anthony Trummer | 54m |
Claims GDPR becomes a practical security driver not just legal overhead and can be automated to reduce risk; cites the surprising penalty of 4% of global… | ||
| Closing Keynote - A free, fair and open internet is a process, not a product. | Cory Doctorow | 52m |
Argues that internet freedom is an ongoing fight not a finished product, citing concrete wins and losses: Title II net neutrality win in 2015 and its reversal… | ||
| Marketing Trailer | 03m | |
Trailer shows software-defined networking used in private clouds to satisfy specific OWASP Top Ten controls, and claims a working SDN enforcement prototype… | ||
| What's New in TLS 1.3 | Alex Balducci | 52m |
TLS 1.3 tightens choices and cuts latency: it replaces dozens of legacy suites with five cipher choices (AES-GCM/CCM and ChaCha20-Poly1305), mandates AEAD, and… | ||
| Where, how, and why is SSL traffic on mobile getting intercepted? | Alban Diquet | 52m |
Analysis of 10 million reports from ~2,000 apps shows 3 million unique certificate chains and splits incidents into concrete causes: developer proxies… | ||
| Edgeguard: Client-side DOM Security - detecting malice - An Open Framework | Eoin Keary, Rahim Jina | 40m |
Open-source 6KB JavaScript library that inserts via an include and uses the MutationObserver API to detect DOM mutations (new elements, modified attributes… | ||
| How Privacy Violations, Fines and Economic Sanctions Create Darker Opportunities | Chris (Chris) | 41m |
Real incident reports show sanctioned regimes fund operations with breached data, planted Bitcoin miners, and targeted remote GIS archives where 650 MB GIS… | ||
| Costs of Coding to Compliance | Magen Wu | 32m |
Compliance-first projects leave measurable gaps: consulting engagements find most orgs at preliminary maturity with none reaching predictable or innovating… | ||
| Architecting for Security in the Cloud | Josh Sokol | 41m |
Builds and hosts the open-source SimpleRisk on AWS, claiming you can start secure from a clean slate and avoid novice-opponent failures by using concrete… | ||
| Taking on the King: Killing Injection Vulnerabilities | Justin Collins | 54m |
Injection stays number one because web apps treat untrusted values as strings and hand them to interpreters; SQL injection is about 20 years old yet still… | ||
| Pack your Android: Everything you need to know about Android Boxing | Swapna Deshmukh | 37m |
Describes concrete methods to extract malicious code from hardened Android apps: three hardening types (obfuscators, packers, protectors), with worked… | ||
| Prevention as a Business Strategy | Corey Whi | 29m |
Claims that prevention beats detect-and-respond, using AI/ML and big data to stop attacks before execution; ransomware specifics include BitPaymer hiding… | ||
| Hunter – Optimize your Pentesters Time | Kiran Shirali | 29m |
Open-source tool called Hunter grades HTTP/REST endpoints A–F grade using a Python/Django backend and sslyze to check TLS and cipher details, HTTP security… | ||
| Lessons From The Threat Modeling Trenches | Brook S.E. Schoenfield | 52m |
Built threat modeling programs across four organizations with hundreds of students, 100 formal trainings, and 1000s of threat models, the claim is that threat… | ||
| Security After Death -- Not your problem, or is it? | tae ship | 35m |
A practical how-to: a browser password store with no master password lets an executor extract hundreds of credentials (one case recovers ~385). Use a… | ||
| Women In Security Panel | Coleen Coolidge, Christina Kubecka, Kayva Pearlman, Caroline Wong, Magen Wu | 49m |
Group members recount technical origin stories, concrete programs and hard wins: leading an SOC/NOC and joint intelligence rebuild after Shamoon to restore… | ||
| Predicting Random Numbers in Ethereum Smart Contracts | Arseny (raz0r) | 52m |
Scans find 72 implementations of on-chain RNGs and the audit labels 43 vulnerable, with concrete failure modes: using miner-tied block variables, calling… | ||
| A Tour of API Underprotection | Skip (unknown) | 50m |
A demo shows a delivery app and an attacker web tool called ShipRaider web app that finds a leaked API key in manifest of an Android APK, uses it to call a… | ||
| We Come Bearing Gifts: Enabling Product Security with Culture and Cloud | Patrick Thomas | 53m |
Claim: replace approval gates with automation-first guardrails built on cloud primitives so teams never need security permission to ship. Netflix shows new… | ||
| Unpoisoned Fruit: Seeding Trust into a Growing World of Algorithmic Warfare | Davi Ottenheimer | 01h 07m |
Claims that AI/ML delegations create real-world weapons: Tesla Autopilot overconfidence costs lives (Joshua Brown dies two weeks after viral demo), Strava… | ||
| Applied Deception Beyond the Honeypot: Moving Past 101 | Robert Wood | 46m |
Argues that common deception tech like honey tokens and basic honeypots or sandbox redirects end up obvious and put defenders in a “hypercon” where attackers… | ||
| nothing matches | ||