[Owasp-boston] Jeremiah Grossman tonight - real web app business logic flaws and more
jeff.williams at owasp.org
Thu Jun 26 10:14:04 EDT 2008
Please don't read anything negative about Jeremiah into my previous message.
He's been very up front over the years about pointing out things that
scanners can't do. The examples in his talk are fun and interesting and not
at all misleading. I was just making a small point about terminology. Sorry
for coming across more negative than I intended.
From: Jeff Williams [mailto:jeff.williams at owasp.org]
Sent: Thursday, June 26, 2008 9:20 AM
To: 'Weiler, Jim'; 'owasp-boston at lists.owasp.org'
Subject: RE: [Owasp-boston] Jeremiah Grossman tonight - real web app
business logic flaws and more
For the record, I think what Jeremiah means by "business-logic flaws" is
just flaws that you can't scan for. Most of them are just good-old
authentication, access control, validation, and sensitive data protection
problems. There are real business logic flaws though and they are
exceedingly difficult to find. For example, the transaction limit on this
is $1000. Or this report should never be issued on Thursday. You know it's
a *real* business logic flaw if you can't tell it's a problem without really
understanding the business rules and policies.
I'm a bit concerned that lumping together all the unscannable security
vulnerabilities into a single category called "business logic flaws" makes
it seem as though the scanning tools (and WAFs for that matter) are more
effective than they really are. If they say "we find all categories of
problems except business logic flaws" it sounds pretty good. Reality is
that they're finding the scannable ~30% of flaws in every category of
security problem. Doesn't sound so good now, eh?
It's a fun talk - wish I could be there.
From: owasp-boston-bounces at lists.owasp.org
[mailto:owasp-boston-bounces at lists.owasp.org] On Behalf Of Weiler, Jim
Sent: Thursday, June 26, 2008 8:04 AM
To: owasp-boston at lists.owasp.org
Cc: announcements-boston at naisg.org
Subject: [Owasp-boston] Jeremiah Grossman tonight - real web app business
logic flaws and more
Next Meeting Thursday June 26 - 6:30 pm
Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd.,
Sixth Floor Waltham, MA
Main Speaker - Jeremiah Grossman; Founder and CTO, Whitehat Security
Appetizer - Hacking Intranets from the Outside (Just when you thought your
Main Topic - Business Logic Flaws: How they put your Websites at Risk
Session handling *authentication*, credit card transactions *sensitive
data*, and password recovery *authentication* are just a few examples of
Web-enabled business logic processes that malicious hackers have abused to
compromise major websites. These types of vulnerabilities are routinely
overlooked during QA because the process is intended to test what a piece
of code is supposed to do and not what it can be made to do. The other
problem(s) with business logic flaws is scanners can't identify them, IDS
can't detect them, and Web application firewalls can't defend them. Plus,
the more sophisticated and Web 2.0 feature-rich a website, the more prone
it is to have flaws in business logic.The presentation will provide
real-world examples of how pernicious and dangerous business logic flaws
are to the security of a website. We'll also show how best to spot them and
provide organizations with a simple and rational game plan to prevent them.
Speaker Bio -
Mr. Grossman founded WhiteHat Security in 2001. Prior to WhiteHat, Mr.
Grossman was an information security officer at Yahoo! responsible for
performing security reviews on the company's hundreds of web applications.
As one of the world's busiest web properties, with over 17,000 web servers
for customer access and 600 web applications, the highest level of security
was required. Mr. Grossman is a founder of the Web Application Security
Consortium (WASC) and the Open Web Application Security Project (OWASP).
Jeremiah speaks at Blackhat, Defcon, RSA and OWASP chapters. Jeremiah has a
great depth of knowledge, experience and anecdotes, and is a very friendly,
>From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20.
>From Rt 128 South take exit 26 but go around the rotary to get to 20 East to
Waltham. Follow signs for Rt. 117 (left at the second light). When you get
to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look
for the Waltham Weston Corporate Center sign) is the second left, at a
blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128
(I95). The office building is at the bottom of Jones Rd. Best parking is to
turn right just before the building and park in the back. Knock on the door
to get the security guard to open it. The room is MPR C on the 6th floor.
Jim Weiler CISSP
Sr. Mgr. Information Security Risk Assessment
Starwood Hotels and Resorts | 1505 Washington St | Braintree MA. 02184
office: 781 356 0067
mobil: 781 654 6048
This electronic message transmission contains information from the Company
that may be proprietary, confidential and/or privileged. The information is
intended only for the use of the individual(s) or entity named above. If you
are not the intended recipient, be aware that any disclosure, copying or
distribution or use of the contents of this information is prohibited. If
you have received this electronic transmission in error, please notify the
sender immediately by replying to the address listed in the "From:" field.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Owasp-boston