August 16, 2010

      August 18th NEOISF Meeting Announcement

Our next meeting is this WEDNESDAY August 18, 2010. Pizza and networking start at 6:00 PM. Talks start at 6:30 PM. Location: Park Center Plaza #1, 6100 Oak Tree Blvd, off Rockside Road, Independence, Ohio. Click here for a Google Map! Open to everyone and free as always! Here are the list of talks and agenda items for this months meeting:

Overview of The Next HOPE Conference – Jody McCluggage
The HOPE (Hackers on Planet Earth) conference is a biennial conference held in New York City and sponsored by 2600. A high level overview will be given of the events, presentations, and politics at the most recent conference.

Return of the Social Zombies – Tom Eston
Tom Eston, the only survivor of the zombie apocalypse that took place at Shmoocon this year, examines the risks of social networks and discusses techniques and tools that can be used to exploit these issues. This presentation begins by discussing new twists on existing privacy concerns that are caused by the trust mass that is social networks. This privacy confusion is used to exploit members and their companies during penetration tests. The presentation then discusses social network botnets and bot programs. Both the delivery of malware through social networks and the use of these social networks as command and control channels will be examined. Tom then explores the use of browser-based bots and their delivery through custom social network applications and shows new social network applications can be used for malware delivery. Finally, the information available through the social network APIs is explored using third-party applications designed for penetration testing. This allows for complete coverage of the targets and their information.

Speaker Bios:

Jody McCluggage (CISSP, CCNA, CEH, MCTS, CHP, Network+) – Director of Operations and Compliance at a local government agency.

Tom Eston is a Senior Security Consultant for SecureState. Tom has previously served in many security roles for large enterprises including leading a penetration testing team for a Fortune 500 financial institution. Tom is actively involved in the security community and focuses his research on the security of social media. He is the founder of which is an open source community dedicated to exposing the insecurities of social media. Tom is also a security blogger, co-host of the Security Justice and Social Media Security podcasts and is a frequent speaker at security user groups and national security conferences including Defcon, Shmoocon, OWASP AppSec and Notacon.|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon

June 11, 2010

      Audio from the May NEOISF Meeting with Rafal Los

We just posted the audio from Rafal Los’ talk: Into the Rabbit Hole: Execution Flow-Based Web Application Testing.  The slide deck will be posted soon!  You can download the audio as a podcast below:|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon

April 30, 2010

      Rafal Los from HP Speaking at the May 19th Meeting

We are excited to announce that Rafal Los from HP will be speaking at the May 19th meeting.  He will be giving his talk from the Source Boston conference “Into the Rabbit Hole: Execution Flow-Based Web Application Testing”.  Here is the talk abstract and his bio:

Since the caveman first fashioned a spear humans have been using tools to make them more efficient and effective. Unfortunately, today’s analysts often misunderstand the role tools play in testing web applications. While tools can be quite good at mapping a web application’s attack surface there is still much human analysis that must be done to find the elusive defects that lie just below the surface. That human analysis is daunting and irregular … until now. The answer is an execution-flow-based approach to application security testing. By first understanding application logic and execution flow it is possible to completely map a web application’s attack surface, and therefore fully test the application. Along the way, we will cover the principles of data-flow analysis, application process mapping and building execution-flow diagrams (EFDs), which together form a complete picture of the web application and allow an analyst to uncover potentially critical defects.

Speaker Bio:
Senior Security Specialist and Web Application Security evangelist with Hewlett-Packard’s Application Security Center (ASC), Rafal Los has more than thirteen years of experience in network and system design, security policy and process design, risk analysis, penetration testing, and consulting. For the past eight years, he has focused on information security and risk management, leading security architecture teams, and managing successful enterprise security programs for General Electric and other Fortune 100 companies, as well as SMB enterprises. Previously, Rafal spent three years in-house with GE Consumer Finance, leading its web application security programs.

Stay tuned for the full agenda announcement in the next few days!  We hope to see you May 19th!|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon

March 14, 2010

      March 2010 Meeting Announcement

Our next meeting is WEDNESDAY March 17, 2010.  Pizza and networking start at 6:00 PM.  Talks start at 6:30 PM.  Location: Park Center Plaza #1, 6100 Oak Tree Blvd, off Rockside Road, Independence, Ohio.  Click here for a Google Map! Open to everyone and free as always!  Here are the list of talks and agenda items for this months meeting:

Attacking WPA-Enterprise Wireless Networks, Matt Neely
This presentation covers different attacks that can be leveraged against wireless networks using Enterprise (802.1x) authentication. Attendees will learn about and see demonstrations of these attacks, many of which can be used to reveal the credentials used to join the wireless network. The presentation concludes with recommendations on how to defend against these attacks.

Matt Neely (CISSP, CTGA, GCIH and GCWN) is the Profiling Team Manager at SecureState, a Cleveland Ohio based security consulting company. At SecureState, Matt and his team perform traditional penetration tests, physical penetration tests, web application security reviews and wireless security assessments. His research interests include the convergence of physical and logical security, cryptography and all things wireless. Matt is also a host on the Security Justice podcast.

Analysis of the Energizer Charger Malware, Tyler Hudak

Energizer and the US-CERT recently released an advisory that the software for the Energizer USB battery charger contained a backdoor.  Tyler will perform a technical analysis of the backdoor and discuss why this malware is more than just an accidental infection of software.

Come early, at 6:00 PM, for pizza, pop, water and social networking with your peers.  We hope to see you there|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon

Local Security Jobs @ our LinkedIn Group!

Support our Sponsors:

Visit our friends: