FRHACK

Conferences

NOW SHOWING

Can’t come to FRHACK? Don’t worry, we are providing LIVE STREAMS for you. + DVDs

Fuzzing the brain : applied social and cognitive psychology
Historically, cunnings and stratagems have been applied to battle plans, social promotion and money making. Sun Tzu, Machiavelli and many others have popularized such uses, but discoveries of the twenthieth century in the field of social psychology, coupled with inovations designed to convince consumers of the interest to buy, allowed a better undersranding of the dynamics of persuasion. The behavior of the humain being is ultimately predictable when certain stimuli are applied, which enables people who have mastered those principles to win the game.

- Bruno Kerouanton (Switzerland)

Reverse engineering and cryptographic errors
- Philippe Oechslin (Objectif Sécurité) (Switzerland)

Because any programmer can use a good crypto library to write crypto software it is often easier to crack a system by finding programming errors through reverse engineering rather than to cryptanalyse the algorithms used. We show this with three compelling examples:

- The MXI-stealth FIPS 140-3 level 2 certified key, were a poorly implemented “enterprise” feature allowed to extract unsalted hashes prior to authentication, before it got patched.

- A version of the E-capsule Private Safe software, where the manipulation of two bytes allows to use any of the admin, public, private or even panic password to access all data.

- The DataBecker PrivateSafe software, where a checksum ruins all the efforts of the blowfish key setup algorithm

All browsers MITM keylogging on remote
- p3lo (France)

Identification & Exploitation of Business Logic Flaws in Web Applications
- Georgiadis Filippos (Greece)

The talk will include an introduction into business logic and some theory on the identification and exploitation of business logic flaws for malicious purposes. Real life examples and scenarios (collected from my experience as penetration tester) will be presented. It will include a theoretical approach on the automation of the identification of business logic flaws and a presentation of BLe (A custom automated tool capable of detecting business logic flaws in web applications). Finally guidelines for safeguarding the applications against business logic flaws will be presented.

w3af

Open Source tools like Nikto, Wapiti, Pantera and others try to find vulnerabilities in web applications but lack many features and configuration options. Comercial products have the features, but also have high product costs and are almost impossible to customize.

w3af ( Web Application Attack and Audit Framework ) is an open source project that aims to automate the detection and explotation of all web application vulnerabilities. The project’s main objective is to become an open platform where anyone can contribute with new techniques and code to identify and exploit vulnerabilities. w3af’s core and plugins are fully written in Python and right now the project has more than 130 plugins and 60K lines of code!

My talk will introduce this tool to new users, while showing it’s features and the new GUI which was created during the last OWASP SoC. During the talk, I’ll perform a couple of demos of the main features and explain how the advanced exploitation features work.

- Andres Riancho (Argentine)
Andrés Riancho is an information security researcher and founder of Bonsai, where he is mainly involved in Penetration Testing and Vulnerability Research. In the research field, he discovered critical vulnerabilities in IPS appliances from 3com and ISS; and contributed with SAP research performed at his former employer.

His main focus has always been the Web Application Security field, in which he developed w3af a Web Application Attack and Audit Framework used extensively by penetration testers and security consultants. Andrés has spoken and hold trainings at many security conferences around the globe, like OWASP (Poland), CONFidence (Poland), OWASP World C0n (USA), CanSecWest (Canada), T2 (Finland) and ekoparty (Buenos Aires).

Andrés founded Bonsai in 2009 in order to further research into automated Web Application Vulnerability detection and exploitation.

Lockpicking
- Alexandre Triffault (France)

Wireless Sensor Networking as an Asset and a Liability

- Travis Goodspeed (USA)

HostileWRT – Abusing Embedded Hardware Platforms for Covert Operations