OWASP AppSecUSA 2014
2014-09-16..2014-09-19
Denver, United States
| title | author | length |
|---|---|---|
| Keynote: CISO Perspectives | Renee Guttmann | 49m |
Argues that software security is a business problem and that application security pulls a long train by forcing procurement, SLAs and funding changes; cites… | ||
| Keynote: The Future of Incident Response | Bruce Schneier | 58m |
Argues incident response must scale around people not replace them, because full automation fails for novel, targeted attacks; three trends—outsourced/cloud… | ||
| Keynote: BSIMM: A Decade of Software Security | Gary McGraw | 01h 20m |
Presents a decade‑long, data‑first claim: software security becomes measurable with BSIMM: descriptive model from 67 firms (now 87), revealing surprising… | ||
| Keynote | Tobias Fabio Tom | 53m |
Global appsec community reports concrete metrics: a 26% jump in corporate cybercrime cost year‑over‑year and ~50% higher individual impact, with a midsize… | ||
| Catch me if you can: Building a Web Malware Analyzer using Machine Learning | Anirban Banerjee | 48m |
Cloudflare builds a Docker-based tarpit that spins up hundreds of thousands of CMS instances, feeds dropped files into a cuckoo-based sandbox, and labels… | ||
| Reversing Engineering a Web Application - For Fun, Behavior & WAF Detection | Rodrigo Montoro | 47m |
Describes building a whitelist-plus-behavior detection layer on top of traditional WAFs that comes from reverse-engineering CMS traffic, crawling with Burp and… | ||
| Mobile Security Attacks: A Glimpse from the Trenches | Yair Amit, Adi Sharabani | 48m |
Live tests show 10% of networks at some point perform active traffic manipulation and users have a 23% chance to hit one within a month; a public map… | ||
| Use After Free Exploitation | Stephen Sims | 47m |
Defines a Use-After-Free as a prematurely freed C++ object and shows how to find and confirm one with IDA Pro, Bindiff, GFlags/PageHeap and a postmortem… | ||
| Static Analysis for Dynamic Assessments | Greg Patton | 38m |
Shows how to export Burp Suite traffic to XML, parse and write client-side files with a custom tool Ripa, then run static scanners like Fortify SCA over… | ||
| Runtime Manipulation of Android and iOS Applications | David Lindner | 43m |
Shows live runtime manipulation on Android and iOS using concrete tools and commands: attach to an emulator with ADB and jdb, set breakpoints, run locals and… | ||
| Top 10 Web Hacking Techniques of 2013 | Johnathan Kuskos | 47m |
Annual roundup enumerates ten concrete techniques with demos and measurements: Mutation XSS shows browsers auto‑mutating innerHTML to turn benign input into… | ||
| Bringing a Machete to the Amazon | Erik Peterson | 40m |
Demonstrates concrete attack paths: SSRF or an uploaded URL pulls the metadata API and yields short‑lived IAM credentials, attackers then clone EBS volumes or… | ||
| Cloud Security at Scale and What it Means for Your Application | Ben Hagen | 47m |
Netflix runs ~50M subscribers and consumes roughly one third of US downstream bandwidth, with hundreds of applications and hundreds of production pushes per… | ||
| AutoScaling Web Application Security in the Cloud | Misha Govshteyn | 41m |
Shows how to run WAFs and other security layers on AWS so they scale with web tiers: uses Elastic Load Balancer, Auto Scaling groups, CloudWatch triggers and… | ||
| The DevOps of Everything | John Willis | 43m |
History and practical roadmap for taking DevOps beyond compute into network and storage, arguing for Chef and Puppet style abstractions, Git-driven configs… | ||
| DevOps and Security: The Facts, The Myths, The Legend | David Mortman | 34m |
Argues DevOps improves security by shrinking change sets and increasing auditability: cites IBM 1979 research linking smaller, frequent changes to lower… | ||
| Where the Security Rubber Meets the DevOps Road | Damon Edwards | 47m |
Claims a measurable payoff: a 2014 State of DevOps survey of ~10,000 responses shows high performers have twice the change success rate, 12× faster mean time… | ||
| Ground Truths of a Rugged DevOps Practitioner | Matt Tesauro | 53m |
Draws on Rackspace operations to argue traditional week‑long security windows are gone — one team averages 75 deploys/week — and replaces them with automated… | ||
| OWASP A9: A Year Later - Are you still using components with known vulnerabilities? | Ryan Berg | 45m |
OWASP added A9 last year to call out apps assembling opaque third‑party code; Sonatype data shows Maven Central (~600k components) and ecosystems like… | ||
| From the Ground Up | Steven van der Baan | 26m |
Project marks every java.lang.String with an evil bit and propagates a tainted string flag via modified StringBuilder and an instrumented class loader. It uses… | ||
| Stop Chasing Vulnerabilities - Introducing Continuous Application Security | Jeff Williams | 49m |
Recorded at AppSecUSA 2014 in Denver
http://2014.appsecusa.org/
Friday, September 19 • 1:00pm - 1:45pm
Stop Chasing Vulnerabilities - Introducing… | ||
| Threat Modeling Made Interactive | Eunsuk Kang | 40m |
An interactive threat‑modeling tool named Poirot models components and APIs, uses an extensible threat library and compiles system plus requirements into… | ||
| Ten Secrets to Secure Mobile Applications | Jason Haddix, Daniel Miessler | 45m |
Mobile traffic grows 26x from 2010–2015 and most risks live on the backend and on-device file misconfiguration: examples include NSUserDefaults storing… | ||
| Hacking .NET(C#) Applications: The Black Arts (ASM attacks) | Jon McCoy | 56m |
Claims a toolkit that edits .NET apps on disk and live in memory, swapping IL on disk and overwriting JIT'd machine code to change behavior; demonstrates… | ||
| Warning Ahead: Security Storms are Brewing in Your JavaScript | Helen Bravo | 34m |
Recorded at AppSecUSA 2014 in Denver
http://2014.appsecusa.org/
Friday, September 19 • 9:30am - 10:15am
Warning Ahead: Security Storms are Brewing in Your… | ||
| When you can't afford 0days: Client-side exploitation for the masses | Michele Orru | 44m |
Demonstrates concrete, zero‑day‑free client compromise: an automated Web Store uploader that publishes repackaged Chrome extensions which gain tab and Gmail… | ||
| Headless Browser Hide and Seek | Sergey Shekyan | 44m |
Recorded at AppSecUSA 2014 in Denver
http://2014.appsecusa.org/
Friday, September 19 • 3:00pm - 3:45pm
Headless Browser Hide and Seek
Headless browsers have… | ||
| Hacking the Oracle Application Framework | David Byrne | 34m |
Shows a real exploit that lets an attacker impersonate any active user by setting an OA Developer/OA Diagnostic cookie to 1, and documents finding plaintext… | ||
| Your Password Complexity Requirements are Worthless | Rick Redman | 47m |
Password complexity rules and JavaScript strength meters fail because modern crackers exploit predictable topologies, not brute force: a LinkedIn dump becomes… | ||
| Clientside security with the Security Header Injection Module SHIM | Eric Johnson | 39m |
An open‑source HTTP module called SHIM injects client‑side security headers into ASP.NET responses by changing three web.config entries and registering the… | ||
| iOS App Integrity: Got Any? | (no speaker listed) | 41m |
Open-source Encrypted Code Modules (ECM) encrypt sensitive dynamic libraries at build time and decrypt them on-device with an app-specific key; Encrypted… | ||
| Modern Web Application Defense with OWASP Tools | Frank Kim | 40m |
Live demos show OWASP tools stopping real attacks: reflected XSS is blocked by a strict Content Security Policy header and verified in ZAP traffic; output… | ||
| Blended Web and Database Attacks on Real-time, In-Memory Platforms | Juan Perez | 49m |
Shows a new SQL injection vector that abuses TIME TRAVEL queries to retrieve previously deleted rows from versioned tables, live-demoed against SAP HANA… | ||
| Red Phish, Blue Phish: Improved Phishing Detection Using Perceptual Hashing | Daniel Peck | 41m |
Claim: perceptual image hashing — using average hash and difference hash (plus a DCT-style perceptual hash) — reliably flags pages that visually impersonate… | ||
| Project Monterey or How I Learned to Stop Worrying and Love the Cloud | Kevin Glisson | 49m |
Project Monterey is a Python framework that runs and scales existing scanners across dynamic cloud fleets, automatically discovering new apps via Asgard and… | ||
| Anatomy of memory scraping credit card stealing POS malware | Amol Sarwate | 56m |
Shows a Windows RAM‑scraper that gains SeDebugPrivilege, enumerates processes, opens the POS process and uses ReadProcessMemory and VirtualQueryEx to scan only… | ||
| IEEE Computer Societys Center for Secure Design | Jim DelGrosso | 45m |
IEEE Computer Society launches the Center for Secure Design in 2014 and documents Top 10 design flaws from a May 2014 workshop using real internal-review… | ||
| Not Go Quietly Adaptive Strategies and Unlikely Teammates | Joshua Corman | 51m |
Argues that targeted influence beats one-size-fits-all security: use procurement to force vendor SDLC and contract penalties, use general counsel to win… | ||
| 11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey | Jeff Williams, Matt Johanssen, Damon Edwards, Matt Tesauro, Oleg Gryb, James Wickett, Ryan Berg, Joshua Corman | 47m |
Four-year survey covers 3,300 responses in April 2014 (11,000 total to date) and delivers hard numbers: 75% of organizations don’t enforce open-source… | ||
| Lean Security for Small or Medium Sized Business | Anson Gomes | 40m |
Recorded at AppSecUSA 2014 in Denver
http://2014.appsecusa.org/
Thursday, September 18 • 2:00pm - 2:45pm
Lean Security for Small or Medium Sized… | ||
| AppSec Survey 2.0 : FineTuning an AppSec Training Program Based on Data cut | John B. Dickson | 39m |
A 600-developer survey (about 500 usable responses) finds baseline appsec knowledge at 56% correct mirroring prior work, with those reporting 3+ days training… | ||
| Building Your Application Security Data Hub: The Imperative for Structured Vulnerability Information | Dan Cornell | 50m |
Centralizes and normalizes scanner and manual test output so one unified list replaces overlapping 300‑page PDFs, merging static, dynamic and component scans… | ||
| SWAMP & Partners Panel Discussion | Mark Miller | 42m |
Funded as a $23.5M, five‑year project, the SWAMP automates running multiple static and binary analysis tools (CodeSonar, Parasoft, GrammaTech/Red Lizard… | ||
| nothing matches | ||