Difference between revisions of "AFSecurity Seminar"

From mn/ifi/AFSecurity
Jump to: navigation, search
Line 1: Line 1:
== Security of the Go Programming Language ==
+
== Software Vulnerability Exploitation ==
  
'''DATE:''' Friday 25 November 2016. 13:00h
+
'''DATE:''' Wednesday 7 December 2016. 13:00h
  
 
'''LOCATION:'''  Kristen Nygaards sal (room 5370), Ole Johan Dahl's House.
 
'''LOCATION:'''  Kristen Nygaards sal (room 5370), Ole Johan Dahl's House.
Line 9: Line 9:
 
13:00h Welcome at IFI
 
13:00h Welcome at IFI
  
13:15h Talk: ''Taint analysis for ensuring information flow security properties for
+
13:15h Talk: ''Software Vulnerabilities and Exploitation Methods''
the Go language''
 
  
 
14:00h Discussion
 
14:00h Discussion
  
'''SPEAKER:''' Anna-Katharina Wickert, TU-Darmstadt
+
'''SPEAKER:''' Laszlo Erdodi, University of Agder
  
 
'''ABSTRACT:'''
 
'''ABSTRACT:'''
Taint analysis is a form of data flow analysis aiming at secure
+
Vulnerable software is a frequently exploited by attackers and thus the research connected to these types of vulnerabilities is of high relevance. Modern techniques for exploiting software vulnerabilities are complex, and this is a rapidly evolving topic in the field of cybersecurity. Vulnerable software can cause denial of service, and a more serious consequence is that arbitrary commands can be executed if the attacker provides some specially crafted input data. The vulnerable software can be exploited to establish a connection from the internal network and use some kind of covert channel to communicate to a remote command and control server to implement malicious tasks.
information flow. Many common attack vectors can be covered by a taint
+
 
analysis e.g SQL Injections. We implemented a static taint analysis tool
+
Since increasinlgy complex software is used in computer applications, it is often the case that extremely popular tools turn out to be vulnerable (e.g. pdf readers, web browsers, operating systems, etc.). The presentation will first introduce and analyse the typical software vulnerabilities.
for Go. Go is a modern and statically typed programming language which
+
 
has concurrency features as first-class members. This talk will present
+
The presentation will discuss typical methods of finding vulnerability (code analysis, input data fuzzing, in memory fuzzing). Finding zero day vulnerability is always highly relevant and really challenging.
the first taint analysis for Go and our precise solution for the data
+
 
flow of the concurrent data structure of Go.  
+
The presentation will also approach the problem of software vulnerability form the aspect of the possible malicious actions that can be performed: the most up to date software vulnerability exploitation methods will be presented in details through interesting and surprising practical examples.
  
  
 
'''SPEAKER BIO:'''
 
'''SPEAKER BIO:'''
Anna-Katharina Wickert is a PhD student at the Technical University Darmstadt in Germany. She is currently a visiting researcher at the Department of Informatics, working in the Formal-Methods Group.
+
Dr. Laszlo Erdodi has a PhD in Information Security, is a Certified Ethical Hacker (CEH), and a System Security Certified Practitioner (SSCP). Since 2014 he has worked as a researcher at the University of Agder, Department of ICT.
 +
 
 +
His main research areas are: Information Security and Ethical Hacking, Software Vulnerabilities and exploitation, Secure Programming, and Malware analysis.
 +
 
 +
His cyber security related activities include: trainer of courses on ethical hacking and exploit writing (hardcore hacking), continuous penetration testing, continuous research on cyber security and participation in big research projects (e.g. Smart house security, SCADA security).

Revision as of 11:31, 28 November 2016

Software Vulnerability Exploitation

DATE: Wednesday 7 December 2016. 13:00h

LOCATION:  Kristen Nygaards sal (room 5370), Ole Johan Dahl's House.

AGENDA:

13:00h Welcome at IFI

13:15h Talk: Software Vulnerabilities and Exploitation Methods

14:00h Discussion

SPEAKER: Laszlo Erdodi, University of Agder

ABSTRACT: Vulnerable software is a frequently exploited by attackers and thus the research connected to these types of vulnerabilities is of high relevance. Modern techniques for exploiting software vulnerabilities are complex, and this is a rapidly evolving topic in the field of cybersecurity. Vulnerable software can cause denial of service, and a more serious consequence is that arbitrary commands can be executed if the attacker provides some specially crafted input data. The vulnerable software can be exploited to establish a connection from the internal network and use some kind of covert channel to communicate to a remote command and control server to implement malicious tasks.

Since increasinlgy complex software is used in computer applications, it is often the case that extremely popular tools turn out to be vulnerable (e.g. pdf readers, web browsers, operating systems, etc.). The presentation will first introduce and analyse the typical software vulnerabilities.

The presentation will discuss typical methods of finding vulnerability (code analysis, input data fuzzing, in memory fuzzing). Finding zero day vulnerability is always highly relevant and really challenging.

The presentation will also approach the problem of software vulnerability form the aspect of the possible malicious actions that can be performed: the most up to date software vulnerability exploitation methods will be presented in details through interesting and surprising practical examples.


SPEAKER BIO: Dr. Laszlo Erdodi has a PhD in Information Security, is a Certified Ethical Hacker (CEH), and a System Security Certified Practitioner (SSCP). Since 2014 he has worked as a researcher at the University of Agder, Department of ICT.

His main research areas are: Information Security and Ethical Hacking, Software Vulnerabilities and exploitation, Secure Programming, and Malware analysis.

His cyber security related activities include: trainer of courses on ethical hacking and exploit writing (hardcore hacking), continuous penetration testing, continuous research on cyber security and participation in big research projects (e.g. Smart house security, SCADA security).