Our next meeting is WEDNESDAY April 21, 2010. Pizza and networking start at 6:00 PM. Talks start at 6:30 PM. Location: Park Center Plaza #1, 6100 Oak Tree Blvd, off Rockside Road, Independence, Ohio. Click here for a Google Map! Open to everyone and free as always! Here are the list of talks and agenda items for this months meeting:
Oracle, Interrupted: Stealing Sessions and Credentials
In a world of free, ever-present encryption libraries, many penetration testers still find a lot of great stuff on the wire. Database traffic is a common favorite, and with good reason: when the data includes PAN, Track, and CVV, it makes you stop and wonder why this stuff isn’t encrypted by default. However, despite this weakness, we still need someone to issue queries before we see the data. Or maybe not… after all, it’s just plaintext.
Recapping his recent Black Hat Europe presentation with Wendel G. Henrique, Steve Ocepek will be taking a look at the world’s most popular relational database: Oracle. Through a combination of downgrade attacks and session take-over exploits, this talk introduces a unique approach to database account hijacking. Using a new tool, thicknet, Steve will demonstrate just how deadly injection attacks can be to database security.
Speaker Bio: Steve Ocepek serves as the Director of Security Research for Trustwave’s SpiderLabs division – the advanced security team focused on penetration testing, incident response, and application security. Steve has been working in the Information Security field for over ten years. As a founder of Wholepoint Corporation, he and his team created one of the first Network Access Control (NAC) systems in 2001, and has been granted four patents in this area to date. After being acquired by Mirage Networks in 2004, Steve continued his research, discovering new, effective ways to profile network devices in real-time. During this process, Steve had the opportunity to fill a number of roles, from research and development to security consulting. At Trustwave, Steve continues to innovate and is frequently referred to in cases where network technologies are concerned. Steve is a CISSP, frequently speaks at security venues, both corporate and academic. Recent venues include Black Hat USA 2009, Black Hat Europe 2010, and Northwestern University.
SIEM’s and Auto-blocking Attacks
SIEM’s are often used in the capacity for intelligence and information gathering within organizations. Often times, the large amount of information used is wasted and not utilized in an efficient manner. At my organization, the SIEM can be used in a much larger capacity when performing responses to actual threats and attacks in an automated fashion. Let’s take a plunge into ArcSight where we can actively block predefined attacks and utilize the SIEM in a responsive measure across an international company.
Speaker Bio: Josh Kelley is an Enterprise Security Analyst for a Fortune 1000 company where his primarily responsibilities are web application security, incident response, vulnerability management, and ensuring that the organization is protected against attack. Much of this is understanding the latest attack vectors and establishing a defense against a large international target. Josh has recently been working on exploit development and vulnerability research. Josh currently holds the SANS’ GSEC and GCIH certifications and is undergoing the Offensive-Security Certified Professional certification.
Come early, at 6:00 PM, for pizza, pop, water and social networking with your peers. We hope to see you there!
