[Owasp-boston] Jeremiah Grossman tonight - real web app business logic flaws and more

Thu Jun 26 09:20:13 EDT 2008

For the record, I think what Jeremiah means by "business-logic flaws" is
just flaws that you can't scan for.  Most of them are just good-old
authentication, access control, validation, and sensitive data protection
problems.  There are real business logic flaws though and they are
exceedingly difficult to find.  For example, the transaction limit on this
is $1000.  Or this report should never be issued on Thursday.  You know it's
a *real* business logic flaw if you can't tell it's a problem without really
understanding the business rules and policies.

I'm a bit concerned that lumping together all the unscannable security
vulnerabilities into a single category called "business logic flaws" makes
it seem as though the scanning tools (and WAFs for that matter) are more
effective than they really are.  If they say "we find all categories of
problems except business logic flaws" it sounds pretty good.  Reality is
that they're finding the scannable ~30% of flaws in every category of
security problem. Doesn't sound so good now, eh?

It's a fun talk - wish I could be there.

--Jeff

From: owasp-boston-bounces at lists.owasp.org
[mailto:owasp-boston-bounces at lists.owasp.org] On Behalf Of Weiler, Jim
Sent: Thursday, June 26, 2008 8:04 AM
To: owasp-boston at lists.owasp.org
Cc: announcements-boston at naisg.org
Subject: [Owasp-boston] Jeremiah Grossman tonight - real web app business
logic flaws and more

Next Meeting Thursday June 26 - 6:30 pm

Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd.,
Sixth Floor Waltham, MA

Main Speaker - Jeremiah Grossman; Founder and CTO, Whitehat Security

Appetizer - Hacking Intranets from the Outside (Just when you thought your
network was safe) Port scanning with Javascript

Main Topic - Business Logic Flaws: How they put your Websites at Risk
Session handling *authentication*, credit card transactions *sensitive
data*, and password recovery *authentication* are  just a few examples of
Web-enabled business logic processes that  malicious hackers have abused to
compromise major websites. These  types of vulnerabilities are routinely
overlooked during QA because  the process is intended to test what a piece
of code is supposed to do and not what it can be made to do. The other
problem(s) with  business logic flaws is scanners can't identify them, IDS
can't  detect them, and Web application firewalls can't defend them. Plus,
the more sophisticated and Web 2.0 feature-rich a website, the more  prone
it is to have flaws in business logic.The presentation will  provide
real-world examples of how pernicious and dangerous business  logic flaws
are to the security of a website. We'll also show how  best to spot them and
provide organizations with a simple and  rational game plan to prevent them.

Speaker Bio - 

Mr. Grossman founded WhiteHat Security in 2001. Prior to WhiteHat, Mr.
Grossman was an information security officer at Yahoo! responsible for
performing security reviews on the company's hundreds of web applications.
As one of the world's busiest web properties, with over 17,000 web servers
for customer access and 600 web applications, the highest level of security
was required. Mr. Grossman is a founder of the Web Application Security
Consortium (WASC) and the Open Web Application Security Project (OWASP).
Jeremiah speaks at Blackhat, Defcon, RSA and OWASP chapters. Jeremiah has a
great depth of knowledge, experience and anecdotes, and is a very friendly,
interactive guy. 

Directions - 

>From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20.
>From Rt 128 South take exit 26 but go around the rotary to get to 20 East to
Waltham. Follow signs for Rt. 117 (left at the second light). When you get
to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look
for the Waltham Weston Corporate Center sign) is the second left, at a
blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128
(I95). The office building is at the bottom of Jones Rd. Best parking is to
turn right just before the building and park in the back. Knock on the door
to get the security guard to open it. The room is MPR C on the 6th floor. 

Jim Weiler   CISSP

Sr. Mgr. Information Security Risk Assessment

Starwood Hotels and Resorts | 1505 Washington St | Braintree MA. 02184

office: 781 356 0067

mobil: 781 654 6048

This electronic message transmission contains information from the Company
that may be proprietary, confidential and/or privileged. The information is
intended only for the use of the individual(s) or entity named above. If you
are not the intended recipient, be aware that any disclosure, copying or
distribution or use of the contents of this information is prohibited. If
you have received this electronic transmission in error, please notify the
sender immediately by replying to the address listed in the "From:" field. 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.owasp.org/pipermail/owasp-boston/attachments/20080626/0c077e0b/attachment-0001.html 