OWASP AppSec Israel 2017

Authentication is important, but how do you authenticate when user interaction is not an option? For example, an IoT app without a user interface. We need to authenticate the app - without any predefined credentials. Want to see how? Join me for this session, including a live demo on Raspberry Pi!

We do our best to protect the servers' information using security controls like TLS communication, Firewall and advanced security cloud services, but then they bleed secrets (arbitrary pieces of memory are leaked to a potential attacker).

This talk observes three zero days found within security solutions (two from this year) that can be the cause for data breaches like the one from May 31 where OneLogin was breached and encrypted secrets were stolen in clear text.
We will review code, understand the vulnerabilities, assess the root cause, challenge a few assumptions (on open-source, security solutions and others) and review some best practices that can help prevent such vulnerabilities.

The goal of our session is to inspire organizations to increase their security conscience, by addressing the security from both process and content points of view.
As part of the Shift Left movement in the world of security,we'd like to suggest a surprising security ambassador: The Product Manager.

Open source modules, maven and python packages, ruby gems and especially npm, are undoubtedly awesome. However, they also represent an undeniable and massive risk. You’re introducing someone else’s code into your system, often with little or no scrutiny. The wrong package can introduce severe vulnerabilities into your application, exposing your application and your users data.

The security risk from vulnerable open source binaries is well understood. While still often mishandled, there are good practices for tackling it, and industry trends like Serverless & PaaS all but eliminate it.

Vulnerabilities in open source code packages, however, get practically no air time. These packages, pulled from the likes of npm, RubyGems and Maven, are just as prevalent, outdated and hard to manage. More importantly, they’re just as vulnerable!

In this talk I’ll share details and demonstrate several vulnerabilities in popular packages. For each issue, I’ll explain why it happened, show its impact, and – most importantly – see how to avoid or fix it.

This lecture will go over some examples of automated attacks targeting eCommerce websites and specifically the cart and purchase flow. We will discuss some real (yet anonymized) examples from our customers and what you can do to protect yourself.

"Connect all the things!" is, for some time now, the main theme when talking about IoT devices, solutions and products. Our eagerness to find new, at times - innovative, ways to make anything to rhyme along the anthem of the internet is a great promise for malicious activity.

As those devices supposed to be lightweight they mostly rely on a small fingerprint stack of protocols - one of those protocols is the message protocol - MQTT.

We will go deep into protocol details, observe how common is to find such devices (and how), and several novel ways to abuse any one of tens of thousands easily spotted publicly facing MQTT brokers on the internet for "fun and profit".

During the presentation we will learn about - WHAT is using MQTT (common and extreme examples) - How SPREAD OUT it is? I’ll be sharing statistical information on different MQTT brokers and version fragmentation collected during research - An OVERVIEW of o its infrastructure and protocol bit & bytes (no prior knowledge required, your head won’t be blown). o General purpose TOOLS – libraries, open source software and apps - RECON – exploring device’s settings, gathering intel, spotting vulnerable devices (+ dropping tools) - Identifying clients - EXPLOITING bad configurations for fun and profit (+ in-the-wild examples): o Spy on subscribers via MQTT o Running remote code on connected devices. o Hijack unsuspected servers and utilize them for evil (e.g. botnet communication). o Misconfigured broker spits machine’s credentials. - DEMOs - Notes on securing your own MQTT-wielding IoT device. - All tools and scripts that were used will be shared right after the talk

Offensive AI allows us to leverage techniques used by ML algorithm to gauge their weak points and exploiting them. ML is great at identifying and classifying patterns, but an attacker can use the gray areas to influence (or even subvert) the pattern matching algorithms.