TECHNOLOGY TRANSFER PRESENTS KEN VAN WYK JUNE 8-9, 2015 JUNE 10-11, 2015 VISCONTI PALACE HOTEL - VIA FEDERICO CESI, 37 ROME (ITALY)

Transcription

1 TECHNOLOGY TRANSFER PRESENTS KEN VAN WYK BREAKING AND FIXING WEB APPLICATIONS SECURITY PENETRATION TESTING IOS APPS JUNE 8-9, 2015 JUNE 10-11, 2015 VISCONTI PALACE HOTEL - VIA FEDERICO CESI, 37 ROME (ITALY) info@technologytransfer.it

2 BREAKING AND FIXING WEB APPLICATIONS SECURITY ABOUT THIS SEMINAR This rapid immersion class is for experienced web application software developers who want to take a quick but deep dive into the biggest web application security issues. The class is built extensively around a series of hands-on lab exercises in which the students first learn first-hand the details of today s biggest web application security defects and how to exploit them. This is immediately followed by a set of labs in which the students learn to remediate those same defects by implementing appropriate fixes in a JavaEE-based web application. This rapid fire approach to breaking and then fixing the security on an actual web application enables students to deeply understand and internalize the biggest security problems faced by today s web application developers. What you Will learn How to find and exploit common security defects in modern Web applications A detailed working knowledge of the OWASP Top-10 (and other) Web application security defects How to remediate a Web application to secure it against the most common security defects in Web applications A detailed working knowledge of how to design and implement security remediations into Web applications audience Web application developers Designers Architects The coding labs are in Java, but the concepts are easily adoptable to other languages. requirements In order to be able to participate in the hands-on exercises, each student will need a laptop computer capable of running a VirtualBox-based Linux virtual machine (provided). We recommend all laptops have local application installation privileges, 8 Gb RAM, and another 20 Gb of disk storage available. If local application installation is not feasible, an installed current version of VirtualBox ( is required to be installed prior to the class.

3 OUTLINE DAy 1 DAy 2 1. class introduction and setup Brief introduction to the class, exercises, and expected outcomes Students install and configure software tools to be used in the upcoming exercises The instructor demonstrates the tools and runs through a sample exercise to ensure all students can use the tools correctly 2. Breaking Web application security Walk through numerous Web app security defects, including OWASP Top-10 (2013) Injection flaws (including SQLi) Cross-site scripting (XSS) 3. continued Additional hands-on walk throughs of numerous Web app security defects, including OWASP Top-10 (2013) Broken authentication and session management Cross-site request forgery (CSRF) 4. continued Additional hands-on walk throughs of numerous Web app security defects, including OWASP Top-10 (2013) Broken access control Server misconfiguration 5. continued Additional hands-on walk throughs of numerous Web app security defects, including OWASP Top-10 (2013) Reliance on weak components Client side code reliance Code quality resulting in security exposures 6. questions and answers 1. coding labs fixing Web application security First, an architectural and source code overview of the app used in the labs How to build and deploy lab environment XSS Walk-through and discussion of all source code used in remediating the vulnerabilities 2. continued SQL Injection 3. continued Access control 4. continued Others 5. contest the challenge! Students are put to the test to see who can finish the contest first The lessons taught in this class are used to solve a puzzle that is highly representative of attacking/testing a modern web application 6. questions and answers 7. closing remarks 7. close

4 PENETRATION TESTING IOS APPS ABOUT THIS SEMINAR This class takes a deep dive into techniques for testing the security of ios apps. Students will learn how to statically and dynamically analyze ios apps for implementation as well as architectural security defects. After a brief description of the ios hardware and software security architecture, the class steps through a myriad of security pitfalls made by many developers. Each weakness is described in detail and explored in hands-on labs to enable students to fully understand and internalize the details. The pitfalls covered start with simple problems and escalate steadily to more and more advanced problems, culminating in the use of Man in the App attacks against running apps. Using MitA techniques, the apps architecture is actively probed and explored via weaknesses in the underlying Objective C run-time environment to look for exploitable weaknesses in client-side security controls. This range of static and dynamic app analysis allows the tester to perform a broad range of security tests on any ios app target. Who should attend ios security Testers Application Developers Designers Architects requirements In order to be able to participate in the hands-on exercises, each student will need a laptop computer with a complete ios development environment (XCode) installed. (Available for free from Apple Computer, Inc.) To perform all exercises including the MitA attacks, a jailbroken ios device is needed. We recommend using a dedicated test device for the testing.

5 OUTLINE DAy 1 DAy 2 1. introduction and tool setup A brief introduction to the problems with developing and testing the security of ios apps Also, class goals and the tools to be used in the labs Class tools installed and demonstrated 2. Platform security architecture Overview of ios platform security features Sandboxing Hardware encryption Pasteboard Hands-on lab exercises to explore features in iphone simulator and hardware device 3. continued Details and hands-on lab exploration of common ios platform security weaknesses Screen shots Cut-n-paste buffer Autocorrect cache 4. application architecture Detailed description of ios app security features App sandbox file space Data protection Hands-on lab exercises 5. continued Additional ios security features, capabilities and weaknesses Keychains App screen shots App caches 1. Jailbreaking A detailed description of how jailbreaking works - Files and folders exposed by jailbreak Hands-on labs to explore data on a jailbroken device (to be provided by students) Exploration of Apple app files outside of normal sandbox environments 2. continued Hands-on labs to perform static analysis of any ios app How to determine potential architectural defects Statically map an ios application to determine its components, linked libraries, etc. 3. dynamic analysis of app run-time A detailed look at Objective-C s soft underbelly, its Run-Time environment Dynamic probing of a running app to learn its architecture Objects and methods in process memory Testing the security of an app s Run-Time environment from the inside of the app Hands-on labs to explore an ios app using Man in the App techniques 4. Bringing it all together How to turn the techniques described in this class into a rigorous security testing process 5. questions and answers 6. closing remarks 6. questions and answers 7. close of day one

6 INFORMATION PARTICIPATION FEE Breaking and fixing Web applications security 1200 Penetration testing ios apps 1200 special price for the delegates who attend both seminars: 2300 The fee includes all seminar documentation, luncheon and coffee breaks. VENUE Roma, Visconti Palace Hotel Via Federico Cesi, 37 Rome (Italy) SEMINAR TIMETABLE 9.30 am pm 2.00 pm pm HOW TO REGISTER you must send the registration form with the receipt of the payment to: TECHNOLOGy TRANSFER S.r.l. Piazza Cavour, Rome (Italy) Fax within may 25, 2015 PAYMENT Wire transfer to: Technology Transfer S.r.l. Banca: Cariparma Agenzia 1 di Roma IBAN Code: IT 03 W BIC/SWIFT: CRPPIT2P546 GENERAL CONDITIONS DISCOUNT The participants who will register 30 days before the seminar are entitled to a 5% discount. If a company registers 5 participants to the same seminar, it will pay only for 4. Those who benefit of this discount are not entitled to other discounts for the same seminar. CANCELLATION POLICY A full refund is given for any cancellation received more than 15 days before the seminar starts. Cancellations less than 15 days prior the event are liable for 50% of the fee. Cancellations less than one week prior to the event date will be liable for the full fee. CANCELLATION LIABILITY In the case of cancellation of an event for any reason, Technology Transfer s liability is limited to the return of the registration fee only. KEN VAN WYK Breaking and Fixing WeB applications security Rome June 8-9, 2015 Visconti Palace Hotel - Via Federico Cesi, 37 Registration fee: 1200 Penetration testing ios apps Rome June 10-11,2015 Visconti Palace Hotel - Via Federico Cesi, 37 Registration fee: 1200 first name... surname... job title... organisation... address... postcode... Stamp and signature Both seminars special price for the delegates who attend both seminars: 2300 city... country... If anyone registered is unable to attend, or in case of cancellation of the seminar, the general conditions mentioned before are applicable. telephone... fax Send your registration form with the receipt of the payment to: Technology Transfer S.r.l. Piazza Cavour, Rome (Italy) Tel Fax info@technologytransfer.it

7 SPEAKER ken van Wyk is an internationally recognized information security expert and author of the O Reilly and Associates books, Incident Response and Secure Coding. In addition to providing consulting and training services through his company, KRvW Associates, LLC, he currently holds the following positions: Member of the Board of Directors and Steering Committee for non-profit organization, FIRST.org, Inc., Member of the Board of Directors for SecAppDev, and monthly columnist for Computerworld. Ken is also the project leader of the Open Web Application Security Project (OWASP) igoat project. Mr. van Wyk has 22 years experience as an IT Security practitioner in the academic, military, and commercial sectors. He has held senior and executive technologist positions at Tekmark, Para-Protect, Science Applications International Corporation (SAIC), the U.S. Department of Defense, Carnegie Mellon University, and Lehigh University. At Carnegie Mellon University s Software Engineering Institute, Mr. van Wyk was one of the founders of the Computer Emergency Response Team (CERT ). He holds an engineering degree from Lehigh University and is a frequent speaker at technical conferences, and has presented tutorials and technical sessions CSI, ISF, USENIX, FIRST, AusCERT, and others.