Black Hat Asia
March 26-29, 2019
Singapore
Black Hat USA
August 3-8, 2019
Las Vegas, NV, USA
Black Hat Europe
December 3-6, 2019
London UK
2/22/2019
09:00 AM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Learn to Plug (or Exploit) New Vulnerabilities at Black Hat Asia

There's no better place to bone up on the ins and outs of web security than Black Hat Asia in Singapore next month.

The humble web browser is a workhorse of the modern world, and it can get you into some real trouble if you’re not careful.

Security experts know that better than most, and there’s no better place to bone up on the ins and outs of web security than Black Hat Asia in Singapore next month, where a bevy of Briefings, Trainings, and Arsenal tool demos offer loads of opportunities for hands-on learning.

Who Left Open the Cookie Jar?” is a 50-minute Briefing where researchers Tom Van Goethem and Gertjan Franke will walk you through how several flaws in seven browsers and 46 browser extensions purportedly block third-party cookies.

You want to see this Briefing to learn how the researchers novel techniques can prevent attackers from circumventing many of today’s built-in protection mechanisms. They’ll also show you that for every anti-tracking or ad-blocking browser extension there exists at least one technique to bypass its defenses, then offer a solution and analyze why these bypass techniques exist.

For a different perspective on Web security, check out the 25-minute Briefing on “Make Redirection Evil Again - URL Parser Issues in OAuth.” You’ll get a quick refresher on the security community's understanding of OAuth redirection threats, learn how OAuth has evolved and what the best practices are for implementing it in your own projects.

Now, the fun part: You’ll get a demonstration of new OAuth redirection attack techniques which exploit the interaction of URL parsing problems with redirection handling in mainstream browsers or mobile apps. In particular, some attacks leverage newly-discovered URL interpretation bugs in mainstream browsers or the Android platform. (The latter were independently discovered and have been recently patched.)

Don’t forget to stop by the Black Hat Asia Arsenal (located in the Business Hall) to enjoy some live demos of useful web security tools and chat with the folks who make them. Catch “A Look at ModSec 3.0 for NGINX: A Software Web Application Firewall” on Friday morning to see how at how the popular open-source proxy server NGINX can be combined with the respected open-source web app firewall ModSecurity to create an effective, secure layer for your web application stack.

You can also see the latest version of ModSecurity live during the “ModSecurity 3.1: Stepping up the Game for Web Attacks” Arsenal demo. The 3.1 release promises improved performance, stability and new exciting features including an exclusive testing feature that allows rules writers and WAF administrators to effortlessly search and match for known malware payloads and signatures. Be sure to stop by and check it out!

Get a firsthand look at a new web exploit by attending the “ReDTunnel: Explore Internal Networks via DNS Rebinding Tunnel” Arsenal demo. You’ll see how researchers have found a new way to attack web browsers by combining two concepts: JavaScript reconnaissance techniques and the DNS rebinding attack.

The result (at least if everything works well) is that you open your browser, wait until the victim visits your website, and then start browsing the internal websites in their network. It’s a great trick (especially if you’re part of a red team), and the best way to see it is to come to Black Hat Asia next month.

Black Hat Asia returns to the Marina Bay Sands in Singapore March 26-29, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.