[WEB SECURITY] 2nd OWASP Israel mini conference at Interdisciplinary Center Herzliya (IDC), Monday, May 21st, 13:30

["Ofer Shezaf" <OferS@xxxxxxxxxx>]

------_=_NextPart_001_01C7916B.95E2D6FC
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi fellow AppSec experts,

Following the big success of the 1st one, we are glad to announce the
2nd OWASP Israel mini conference at Interdisciplinary Center Herzliya
(IDC). The mini conference is a non-commercial event focusing on web
application security. As you can see in the program below, we have
carefully selected the presentations and we hope they are all relevant,
informative and most importantly, none commercial. Never the less, we
are happy to say that we were able to get very distinguish companies to
sponsor the event and make sure that the refreshments would be great.
The meeting is sponsored by Breach Security, Checkpoint, Hacktics,
Applicure Technologies, Zend, Microsoft and the Interdisciplinary Center
Herzliya (IDC).=20

The meeting will be held on Monday, May 21st, Starting at 13:30 at IDC
Herzliya campus (driving directions will be sent to registrants).
Participation is free and open to all, but please inform us (e-mail to
ofers@breach.com) that you are coming as space is limited. Feel free to
spread the word about this meeting to anyone you feel would be
interested. You can also register to get the OWASP Israel mailing list
(http://lists.owasp.org/mailman/listinfo/owasp-israel) and receive
updates regarding chapter's meetings. For further details please contact
us at ofers@breach.com or go to the web page at
http://www.owasp.org/index.php/Israel#2nd_OWASP_IL_mini_conference_at_ID
C.2C_May__21th_2007

Dr. Anat Bremler-Barr
Program Academic Director, Information Security Program
Efi Arazi School of Computer Science, IDC Herzliya      =20

Ofer Shezaf
Chapter Leader, OWASP Israel=20
CTO, Breach Security

The agenda of the meeting is:=20

Gathering and Refreshments=20
13:30 - 14:00=20

Updates from OWASP Europe, Milan
Ofer Shezaf, OWASP IL chapter leader, CTO, Breach Security=20
14:00 - 14:15=20

Since the conference is just a few days after OWASP Europe 2007 in
Milan, and since most of you would not have a chance to be there, I will
try to convey the content and spirit of this unique conference to you.=20

In addition you will hear Yair Amit, who will repeat the presentation he
is going to make in OWASP Europe, and Erez Metula will build his lecture
on OWASP chief evangelist's presentation about .NET. For my presentation
in OWASP Europe, you had to come to the previous OWASP IL Mini
Conference.=20

Pen-Testing at Microsoft: FuzzGuru fuzzing framework=20
John Neystadt, Lead Program Manager, Microsoft Forefront Edge, Microsoft

14:15 - 15:00=20

Fuzzing is the main systematic methodology used these days by hackers to
find vulnerabilities in web and other applications. Fuzzing can find
buffer overrun, denial-of-service and information disclosure
vulnerabilities. It should be done for C++, C#/Java, ASP/JP code.=20

FuzzGuru is a generic network fuzzing development framework developed in
Microsoft Israel Development Center and is formally recommended best
practice for all products developed in Microsoft.=20

In this talk John will present some fuzzing testing theory, demonstrate
the tools and discuss Microsoft fuzzing practices.=20

Unregister Attacks in SIP=20
Ronit Halachmi-Bekel, IDC=20
15:00 - 15:40=20

The presentation discusses a research work done at the IDS about the
"unregister attack", a new kind of a denial of service attack on SIP
servers. In this attack, the attacker sends a spoofed "unregister"
message to a SIP server and cancels the registration of the victim at
that server. This prevents the victim user from receiving any calls.=20

The research also offers a solution: the SIP One-Way Hash Function
Algorithm (SOHA), motivated by the one-time password mechanism. SOHA
prevents the unregister attack in all situations. The algorithm is easy
to deploy since it requires only a minor modification and is fully
backwards compatible and requires no additional configuration from the
user or the server.=20

The paper is a joint work with Dr. Anat Bremler-Barr and Jussi
Kangasharju. The paper was presented at the 14th IEEE International
Conference on Network Protocols (ICNP).=20

Break=20
15:40 - 16:00=20

Application Denial of Service; is it Really That Easy?=20
Shay Chen, Hacktics=20
16:00 - 16:40=20

Denial of service attacks, which are quite a nuisance on the network
layer, are a nightmare when done on the application layer, but are
equally underrated.=20

On our last conference, Dr. Anat Bremler-Bar discussed some of the
theoretical aspects of application layer denial of service attacks. Shay
Chen will expand and explore the practicalities of application layer
denial of service. He will show real world techniques, real life stories
and personal experiences conducting DOS attacks during penetration
testing on major Israeli sites.=20

Behavioral Analysis for Generating A Positive Security Model For
Applications=20
Ofer Shezaf, OWASP IL chapter leader, CTO, Breach Security=20
16:40 - 17:10=20

In the last OWASP IL conference, as well as in OWASP Europe in Milan, I
explored the potential of a negative security model for securing
applications. While a negative security model can provide some level of
security, most agree that a positive security model is preferable for
protection application.=20

However, building a rule set to provide positive security is a difficult
and never ending project. Modern tools employ behavioral analysis to
build automatically those rules. The presentation will discuss the
algorithms and methods used to build automatically an application layer
positive security rule set as well as the problems and limitation of
such as approach.=20

Overtaking Google Desktop - Leveraging XSS to Raise Havoc=20
Yair Amit, Senior Security Researcher, Watchfire=20
17:10 - 17:50=20

Yair will present a ground breaking research paper by Watchfire
application security labs. The paper describes an innovative attack
methodology against Google Desktop which enables a malicious individual
to achieve a remote, persistent access to sensitive data, and
potentially a full system control.=20

This represents a significant real world example of a new generation of
computer attacks which take advantage of Web application vulnerabilities
utilizing the increasing power of the Web browser. Their purpose is to
remotely access private information.=20

This presentation would be presented by Yair the week before at OWASP
Europe in Milan.=20

Break=20
17:50 - 18:00=20

Application Security is Not Just About Development=20
David Lewis, CISM, CISA, CISSP, Rosenblum Holtzman=20
18:00 - 18:20=20

What many developers forget about is that the application even though it
is a very important part of securing the "Gold", data, there are other
risks that require their attention. These risks require their
understanding and preventative measures need to be implemented, managed
and validated to limit the exposure to themselves and their
organizations. E.g. Developers do not see the need for securing their
code.=20

One of the things I will provide you during my presentation is why you
should secure your code. It is one of the ways you will keep your job.=20


.NET reverse engineering=20
Erez Metula, Application Security Department Manager, 2Bsecure=20
18:20 - 19:20=20

The presentation will introduce MSIL (Microsoft Intermediate Language)
and debugging MSIL. Based on this foundation the presentation will
explore and demonstrate tools and techniques for changing the behavior
of .NET assemblies and the CLR using reversing engineering techniques.=20


------_=_NextPart_001_01C7916B.95E2D6FC
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:dt=3D"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml"; =
xmlns=3D"http://www.w3.org/TR/REC-html40";>

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<style>
<!--
 /* Font Definitions */
 @font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";}
h2
	{mso-style-priority:9;
	mso-style-link:"Heading 2 Char";
	mso-margin-top-alt:auto;
	margin-right:0cm;
	mso-margin-bottom-alt:auto;
	margin-left:0cm;
	font-size:18.0pt;
	font-family:"Times New Roman","serif";
	font-weight:bold;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p
	{mso-style-priority:99;
	mso-margin-top-alt:auto;
	margin-right:0cm;
	mso-margin-bottom-alt:auto;
	margin-left:0cm;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"Balloon Text Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:8.0pt;
	font-family:"Tahoma","sans-serif";}
span.Heading2Char
	{mso-style-name:"Heading 2 Char";
	mso-style-priority:9;
	mso-style-link:"Heading 2";
	font-family:"Times New Roman","serif";
	font-weight:bold;}
span.BalloonTextChar
	{mso-style-name:"Balloon Text Char";
	mso-style-priority:99;
	mso-style-link:"Balloon Text";
	font-family:"Tahoma","sans-serif";}
span.EmailStyle21
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif";
	color:windowtext;}
span.editsection
	{mso-style-name:editsection;}
span.mw-headline
	{mso-style-name:mw-headline;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page Section1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
	{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext=3D"edit" spidmax=3D"1027" />
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext=3D"edit">
  <o:idmap v:ext=3D"edit" data=3D"1" />
 </o:shapelayout></xml><![endif]-->
</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

<p>Hi fellow AppSec experts,<o:p></o:p></p>

<p>Following the big success of the 1st one, we are glad to announce the =
2nd
OWASP Israel mini conference at Interdisciplinary Center Herzliya (IDC). =
The
mini conference is a non-commercial event focusing on web application =
security.
As you can see in the program below, we have carefully selected the
presentations and we hope they are all relevant, informative and most
importantly, none commercial. Never the less, we are happy to say that =
we were
able to get very distinguish companies to sponsor the event and make =
sure that
the refreshments would be great. The meeting is sponsored by Breach =
Security,
Checkpoint, Hacktics, Applicure Technologies, Zend, Microsoft and the
Interdisciplinary Center Herzliya (IDC). <span lang=3DHE =
dir=3DRTL><o:p></o:p></span></p>

<p>The meeting will be held on Monday, May 21<sup>st</sup>, Starting at =
1<span
dir=3DRTL></span><span lang=3DHE dir=3DRTL><span =
dir=3DRTL></span>3</span><span
dir=3DLTR></span><span dir=3DLTR></span>:30 at IDC Herzliya campus =
(driving
directions will be sent to registrants). Participation is free and open =
to all,
but please inform us (e-mail to ofers@breach.com) that you are coming as =
space
is limited. Feel free to spread the word about this meeting to anyone =
you feel
would be interested. You can also register to get the OWASP Israel =
mailing list
(http://lists.owasp.org/mailman/listinfo/owasp-israel) and receive =
updates
regarding chapter's meetings. For further details please contact us at =
<a
href=3D"mailto:ofers@breach.com";>ofers@breach.com</a> or go to the web =
page at <a
href=3D"http://www.owasp.org/index.php/Israel#2nd_OWASP_IL_mini_conferenc=
e_at_IDC.2C_May__21th_2007">http://www.owasp.org/index.php/Israel#2nd_OWA=
SP_IL_mini_conference_at_IDC.2C_May__21th_2007</a><o:p></o:p></p>

<p>Dr. Anat Bremler-Barr<br>
Program Academic Director, Information Security Program<br>
Efi Arazi School of Computer Science, IDC =
Herzliya&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<o:p></o:p></p>

<p>Ofer Shezaf<br>
Chapter Leader, OWASP Israel <br>
CTO, Breach Security<o:p></o:p></p>

<p>The agenda of the meeting is: <o:p></o:p></p>

<p><b>Gathering and Refreshments</b> <br>
13:30 - 14:00 <o:p></o:p></p>

<p><b><span style=3D'font-size:13.5pt'>Updates from OWASP Europe, =
Milan<br>
</span>Ofer Shezaf, OWASP IL chapter leader, CTO, Breach Security</b> =
<br>
14:00 - 14:15 <o:p></o:p></p>

<p>Since the conference is just a few days after OWASP Europe 2007 in =
Milan,
and since most of you would not have a chance to be there, I will try to =
convey
the content and spirit of this unique conference to you. <o:p></o:p></p>

<p>In addition you will hear Yair Amit, who will repeat the presentation =
he is
going to make in OWASP Europe, and Erez Metula will build his lecture on =
OWASP
chief evangelist's presentation about .NET. For my presentation in OWASP
Europe, you had to come to the previous OWASP IL Mini Conference. =
<o:p></o:p></p>

<p><b><span style=3D'font-size:13.5pt'>Pen-Testing at Microsoft: =
FuzzGuru fuzzing
framework</span></b> <br>
<b>John Neystadt, Lead Program Manager, Microsoft Forefront Edge, =
Microsoft</b>
<br>
14:15 - 15:00 <o:p></o:p></p>

<p>Fuzzing is the main systematic methodology used these days by hackers =
to
find vulnerabilities in web and other applications. Fuzzing can find =
buffer
overrun, denial-of-service and information disclosure vulnerabilities. =
It
should be done for C++, C#/Java, ASP/JP code. <o:p></o:p></p>

<p>FuzzGuru is a generic network fuzzing development framework developed =
in
Microsoft Israel Development Center and is formally recommended best =
practice
for all products developed in Microsoft. <o:p></o:p></p>

<p>In this talk John will present some fuzzing testing theory, =
demonstrate the
tools and discuss Microsoft fuzzing practices. <o:p></o:p></p>

<p><b><span style=3D'font-size:13.5pt'>Unregister Attacks in =
SIP</span></b> <br>
<b>Ronit Halachmi-Bekel, IDC</b> <br>
15:00 - 15:40 <o:p></o:p></p>

<p>The presentation discusses a research work done at the IDS about the
&quot;unregister attack&quot;, a new kind of a denial of service attack =
on SIP
servers. In this attack, the attacker sends a spoofed =
&quot;unregister&quot;
message to a SIP server and cancels the registration of the victim at =
that
server. This prevents the victim user from receiving any calls. =
<o:p></o:p></p>

<p>The research also offers a solution: the SIP One-Way Hash Function =
Algorithm
(SOHA), motivated by the one-time password mechanism. SOHA prevents the
unregister attack in all situations. The algorithm is easy to deploy =
since it
requires only a minor modification and is fully backwards compatible and
requires no additional configuration from the user or the server. =
<o:p></o:p></p>

<p>The paper is a joint work with Dr. Anat Bremler-Barr and Jussi =
Kangasharju.
The paper was presented at the 14th IEEE International Conference on =
Network
Protocols (ICNP). <o:p></o:p></p>

<p><b>Break</b> <br>
15:40 - 16:00 <o:p></o:p></p>

<p><b><span style=3D'font-size:13.5pt'>Application Denial of Service; is =
it
Really That Easy?</span></b> <br>
<b>Shay Chen, Hacktics</b> <br>
16:00 - 16:40 <o:p></o:p></p>

<p>Denial of service attacks, which are quite a nuisance on the network =
layer,
are a nightmare when done on the application layer, but are equally =
underrated.
<o:p></o:p></p>

<p>On our last conference, Dr. Anat Bremler-Bar discussed some of the
theoretical aspects of application layer denial of service attacks. Shay =
Chen
will expand and explore the practicalities of application layer denial =
of
service. He will show real world techniques, real life stories and =
personal
experiences conducting DOS attacks during penetration testing on major =
Israeli
sites. <o:p></o:p></p>

<p><b><span style=3D'font-size:13.5pt'>Behavioral Analysis for =
Generating A
Positive Security Model For Applications</span></b> <br>
<b>Ofer Shezaf, OWASP IL chapter leader, CTO, Breach Security</b> <br>
16:40 - 17:10 <o:p></o:p></p>

<p>In the last OWASP IL conference, as well as in OWASP Europe in Milan, =
I explored
the potential of a negative security model for securing applications. =
While a
negative security model can provide some level of security, most agree =
that a
positive security model is preferable for protection application. =
<o:p></o:p></p>

<p>However, building a rule set to provide positive security is a =
difficult and
never ending project. Modern tools employ behavioral analysis to build
automatically those rules. The presentation will discuss the algorithms =
and
methods used to build automatically an application layer positive =
security rule
set as well as the problems and limitation of such as approach. =
<o:p></o:p></p>

<p><b><span style=3D'font-size:13.5pt'>Overtaking Google Desktop - =
Leveraging XSS
to Raise Havoc</span></b> <br>
<b>Yair Amit, Senior Security Researcher, Watchfire</b> <br>
17:10 - 17:50 <o:p></o:p></p>

<p>Yair will present a ground breaking research paper by Watchfire =
application
security labs. The paper describes an innovative attack methodology =
against
Google Desktop which enables a malicious individual to achieve a remote,
persistent access to sensitive data, and potentially a full system =
control. <o:p></o:p></p>

<p>This represents a significant real world example of a new generation =
of
computer attacks which take advantage of Web application vulnerabilities
utilizing the increasing power of the Web browser. Their purpose is to =
remotely
access private information. <o:p></o:p></p>

<p>This presentation would be presented by Yair the week before at OWASP =
Europe
in Milan. <o:p></o:p></p>

<p><b>Break</b> <br>
17:50 - 18:00 <o:p></o:p></p>

<p><b><span style=3D'font-size:13.5pt'>Application Security is Not Just =
About
Development</span></b> <br>
<b>David Lewis, CISM, CISA, CISSP, Rosenblum Holtzman</b> <br>
18:00 - 18:20 <o:p></o:p></p>

<p>What many developers forget about is that the application even though =
it is
a very important part of securing the &quot;Gold&quot;, data, there are =
other
risks that require their attention. These risks require their =
understanding and
preventative measures need to be implemented, managed and validated to =
limit
the exposure to themselves and their organizations. E.g. Developers do =
not see
the need for securing their code. <o:p></o:p></p>

<p>One of the things I will provide you during my presentation is why =
you
should secure your code. It is one of the ways you will keep your job. =
<o:p></o:p></p>

<p><br>
<b><span style=3D'font-size:13.5pt'>.NET reverse engineering</span></b> =
<br>
<b>Erez Metula, Application Security Department Manager, 2Bsecure</b> =
<br>
18:20 - 19:20 <o:p></o:p></p>

<p>The presentation will introduce MSIL (Microsoft Intermediate =
Language) and
debugging MSIL. Based on this foundation the presentation will explore =
and
demonstrate tools and techniques for changing the behavior of .NET =
assemblies
and the CLR using reversing engineering techniques. <o:p></o:p></p>

</div>

</body>

</html>

------_=_NextPart_001_01C7916B.95E2D6FC--