Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat USA
August 1-6, 2020
Las Vegas, NV, USA
Black Hat Asia
September 29 - October 2, 2020
Singapore
Black Hat Europe
November 9-12, 2020
London UK
2/22/2019
09:00 AM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Learn to Plug (or Exploit) New Vulnerabilities at Black Hat Asia

There's no better place to bone up on the ins and outs of web security than Black Hat Asia in Singapore next month.

The humble web browser is a workhorse of the modern world, and it can get you into some real trouble if you’re not careful.

Security experts know that better than most, and there’s no better place to bone up on the ins and outs of web security than Black Hat Asia in Singapore next month, where a bevy of Briefings, Trainings, and Arsenal tool demos offer loads of opportunities for hands-on learning.

Who Left Open the Cookie Jar?” is a 50-minute Briefing where researchers Tom Van Goethem and Gertjan Franke will walk you through how several flaws in seven browsers and 46 browser extensions purportedly block third-party cookies.

You want to see this Briefing to learn how the researchers novel techniques can prevent attackers from circumventing many of today’s built-in protection mechanisms. They’ll also show you that for every anti-tracking or ad-blocking browser extension there exists at least one technique to bypass its defenses, then offer a solution and analyze why these bypass techniques exist.

For a different perspective on Web security, check out the 25-minute Briefing on “Make Redirection Evil Again - URL Parser Issues in OAuth.” You’ll get a quick refresher on the security community's understanding of OAuth redirection threats, learn how OAuth has evolved and what the best practices are for implementing it in your own projects.

Now, the fun part: You’ll get a demonstration of new OAuth redirection attack techniques which exploit the interaction of URL parsing problems with redirection handling in mainstream browsers or mobile apps. In particular, some attacks leverage newly-discovered URL interpretation bugs in mainstream browsers or the Android platform. (The latter were independently discovered and have been recently patched.)

Don’t forget to stop by the Black Hat Asia Arsenal (located in the Business Hall) to enjoy some live demos of useful web security tools and chat with the folks who make them. Catch “A Look at ModSec 3.0 for NGINX: A Software Web Application Firewall” on Friday morning to see how at how the popular open-source proxy server NGINX can be combined with the respected open-source web app firewall ModSecurity to create an effective, secure layer for your web application stack.

You can also see the latest version of ModSecurity live during the “ModSecurity 3.1: Stepping up the Game for Web Attacks” Arsenal demo. The 3.1 release promises improved performance, stability and new exciting features including an exclusive testing feature that allows rules writers and WAF administrators to effortlessly search and match for known malware payloads and signatures. Be sure to stop by and check it out!

Get a firsthand look at a new web exploit by attending the “ReDTunnel: Explore Internal Networks via DNS Rebinding Tunnel” Arsenal demo. You’ll see how researchers have found a new way to attack web browsers by combining two concepts: JavaScript reconnaissance techniques and the DNS rebinding attack.

The result (at least if everything works well) is that you open your browser, wait until the victim visits your website, and then start browsing the internal websites in their network. It’s a great trick (especially if you’re part of a red team), and the best way to see it is to come to Black Hat Asia next month.

Black Hat Asia returns to the Marina Bay Sands in Singapore March 26-29, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5347
PUBLISHED: 2020-04-04
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS responses.
CVE-2020-5348
PUBLISHED: 2020-04-04
Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFI_BOOT_SERVICES in system management mode. A local unauthenticated attacker may exploit this vulnerability by overwriting the EFI_BOOT_SERVICES structure to execute arbitrary code in system management mode.
CVE-2020-8142
PUBLISHED: 2020-04-03
A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was how...
CVE-2020-8143
PUBLISHED: 2020-04-03
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/...
CVE-2020-8147
PUBLISHED: 2020-04-03
Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend.