Its been posted everywhere except here that I'll be presenting at this years Black Hat USA 2006. The show is only a few short weeks away and I'm really excited about it. The sheer volume of web application security talks is nothing short of amazing and I think I’ll just camp out in the Palace Ballroom 1 (Web Security Track) on Day 2.
Anyone who has ever responded to a Black Hat CFP knows how difficult it is to get in because you are literally competing with the top infosec experts in the world. This is why people attend Black Hat and what they expect to see. Even after nearly a dozen appearances, its still very much an honor to be accepted. My topic this year, Hacking Intranet Websites from the Outside - "JavaScript malware just got a lot more dangerous", will be particularly special and well beyond anything previously demonstrated in the past.
That’s right, JavaScript Malware.
When visiting a web page JavaScript Malware grabs your web browser’s cookies/history, discovers your internal NAT'ed IP address, port scans behind the firewall, and exploits intranet web-enable devices from the inside. Of course the PoC code also acts like a trojan horse by keystroke recording and tracking your every move. No browser exploits required. If this isn’t malware I don’t know what is. And if that weren't enough, I’ll be describing how websites that are vulnerable to Cross-Site Scripting (the most common vulnerability) can open them up to hosting and publishing JavaScript Malware to their visitors.
If you are at the show, WASC is having another meet-up:
“Whenever there are lots of webappsec presentations and people in the same place, it's a good opportunity for members of the community to meet-up. As we did last year, tucked in between the first day talks and before the vendor parties, we gather to share drinks, war stories, gossip, techno babble, and some laughs. With the amount web application security stuff going on at the conference, our 4th WASC meet-up should be the biggest ever!”
Time: Wed, August 2 @ 6:15pm
Place: Shadow bar at Caesars
http://www.caesars.com/Caesars/LasVegas/Dining/BarsLounges/ShadowBar.htm
No comments:
Post a Comment