Conference Program - OWASP AppSec USA 2011

ESAPI 2.0 - Defense Against the Dark ArtsBeef (Chris Schmidt), Kevin WallIn this presentation Chris, joined by Kevin Wall and othermembers of the ESAPI team will highlight the latest GA releaseof OWASP Enterprise Security API 2.0. Key touchpointsof the talk will include:••What is ESAPI••Integrating Controls••Crypto Enhancements (Kevin Wall)••ESAPI Roadmap & Future (ESAPI Dev Team)••ESAPI Community LaunchWhat is ESAPI will feature an updated overview of what anEnterprise Security API is, why it is important, and how itis intended to be used. This will be a high-level overviewintended to raise questions from you about specifics that canbe addressed in the breakout session or over a cold beer.Integrating Controls will be a brief view into what it actuallytakes to build and integrate an ESAPI control into a web application.This demo will focus on solving a XSS issue on a smallvulnerable web application.One of the single largest enhancements to ESAPI 2.0 was acomplete overhaul of the Crypto component. Kevin Wall drovethis initiative from idea to completed project and will be highlightingthe hows, whys, and whats of the enhancements.Ghosts of XSS Past, Present and FutureJim ManicoThis talk will discuss the past methods used for XSS defensethat were only partially effective. Learning from these lessons,will will also discuss present day defensive methodologies thatare effective, but place an undue burden on the developer.We will then finish with a discussion of future XSS defensemethodologies that shift the burden of XSS defense from thedeveloper to various frameworks. These include auto-escapingtemplate technologies, browser-based defenses such asContent Security Policy, and Javascript sandboxes such as theGoogle CAJA project and JSReg.The Good Hacker - Dismantling Web MalwareAditya K Sood, Richard EnbodyThe talk sheds light on the new trends of web based malware.Technology and insecurity go hand in hand. With the adventof new attacks and techniques, the distribution of malwarethrough the web has been increased tremendously. BrowserExploit Packs (BEP) (BlackHole, Phoenix, Bleeding Life, etc.)are increasing infections day by day. Most of these BEPs areused in conjunction with botnets such as Zeus and SpyEyeto initiate infections across the web. The attackers spreadmalware elegantly by exploiting the vulnerabilities and driveby downloads. The infection strategies opted by attackers likemalware distribution through IFRAME injections, SEO poisoning,URL trickery, social network manipulations, and webvulnerabilities act as a launchpad for web malware. Third generationbanking malware such as SpyEye and Zeus has showndevastating artifacts. The question is, how we have to dealwith them? Are our protection mechanisms sound enough? Dowe need to hunt them back? All the answers will be providedin this talk covering the following points:••Tracing the malware entry points in-networkand hunting them••Building up methodologies like a hacker to hitback at malware domains••Analyzing trade and tactics of third generationbanking malware••Demonstrate the static, dynamic and behavioralanalysis of web malware including PCAPanalytics••Understanding the design and relevance ofBrowser Exploit Packs