BSides was the first secuity conferance I have attended. It was a stimulating  (club mate!) day packed full of all kinds of diffrent inforsec talks.

My day started at 2:40am making breakfast and inadvertently waking up a flatmate who  was not amused. I then caught the coach to Victoria  coach station and had a wet trek through London to the Barbican .

I attended the “breaking into security” talk from RandomStorm’s Robin which answered lots of questions about the best route into infosec. The talk was based on statisics Robin had collected online to try and get an un-biased view on what programming languages to learn and courses to go on to become a good penetration tester. The answer that supised me was that a big % of people did not think you need to know how to program to be a good penetration tester, which is wrong. SLIDES

You can take the survey here

The next talk I was going to attend was cancelled so I stayed and listened to the back-up talk from james davis which was on incident response incidents at Janet. The talk was amusing with tales about malicious students phishing there own university pretending to be student finance. Another story was about china ISP’s sending weird DNS requests apparently to cache websites because the request was timing out from some parts of china.

The digital forensics talk was cancelled and a back-up talk on true random number generation was the topic of the next talk. Maths can be  quite boring but the speaker Paco Hope made it entertaining. He talked about the common mistakes made when making random numbers such as using a modulo operation so that random numbers not in wanted range can be used, introduces bias. Paco also talked about how important having a random seed is as an example he talked about PartyPoker which made an error with it’s random shuffling seeding as it used the server time stamp as the basis of the seed. ParyPoker made available it’s shuffling algo so in theory Pokerhands could be reverse engineered. The talk also mentioned to keep things simple as overcomplicating number generation  makes it easier to introduce bias.  More on random numbers

Throughout the day I went around the stands and was lucky to get a fun t-shirt from MWR Infosec Labs, shown below.

In the afternoon I went to the MWR SAP slapping talk which is totally new to me. SAP systems talk was interesting as Dave Hartley was trying to help make SAP systems more secure as he found numerous vulnerability in the demo SAP system yet SAP refused to allow him access to full retail versions unless he paid. He did eventually get access to a SAP system for further research.

The next talk was on Satellite hacking which I will not write about as it was not allowed to be recorded.

The talk I went to next was my favorite of the day as it was on HTML 5 which brings new functionality to the web but also opens up a whole new array of security issues. The talk first went through the good parts of HTML 5, then the not so good parts and innovative ways to exploit HTML 5 new functions such as a “Botnet in the browser” that allows anyone to become a temporarily part of a botnet just by loading a webpage. Robert also talked about readily available tools from http://www.andlabs.org/tools.html  and Beef. He also demoed a PoC botnet that had DOS and HTML 5 geolocation tracking. He also mentioned http://html5security.org/ as  a good HTML 5 resource.

The next talk I went to was from Arron “finux” Finnon on the design flaws of UPnP which allows you to open ports on your home router as part of UPnP functionality. UPnP can be used for malicious  purposes  as no authentication is required when requesting and receiving information using the protocol as it’s seamless. It was also humerus as in the audience were some BT engineers that Finux’s talks have been giving a headache over BT’s homehub UPnP (lack of) security. Some links : UMAP , http://www.upnp-hacks.org/,UPnP Router Controller

The final talk I attended was on privilege escalation on webapps but the talk had lots of emphasis on showing clients a working exploit to demonstrate to them how serious the issue really is. He demoed that an XSS can really be serious when used as CSRF to add an admin account to wordpress (Why does wordpress not use a captcha?). SLIDES

I  attended the conservatory shorty to listen to glyn wintle talk on writing  javascript with only 8 chars to bypass XSS filters.  Here is a snapshot of coventry uni students in a group talk.

 

Before I left I handed in my feedback form and received a yubico key which I am yet to configure but will do shortly.

The afterparty was fun 🙂 Talked to some very interesting people.