OWASP Global AppSec San Francisco 2024
2024-09-23..2024-09-27
San Francisco, United States
who it's for
application security engineers, security researchers, red teamers, security architects, product security managers, platform engineers, developers
topics
prompt injection and RAG grounding; Microsoft Copilot plugin persistence; GraphQL path traversal exploits; OData injection in Power Platform; WebRTC TURN and RTP abuse; server-side HTML sanitization failures; vulnerable AI infrastructure (AI Goat); open source maintainer burnout risks; software supply chain security; container escape techniques and defenses; SBOM collection and usage; OWASP AppSec maturity models (ASVS SAMM DSOMM)
| title | author | length |
|---|---|---|
| Keynote: Thriving in the Age of AI | Aanchal Gupta | 38m |
Claims and measurable examples drive the decision: ChatGPT hits 100 million users in one year; Walmart projects +$20 billion from AI supply‑chain work; Pfizer… | ||
| Keynote: Red, Blue, and Purple AI | Jason Haddix | 01h 03m |
Talk claims practical, ready-to-run artifacts: prompt methodology that yields 30–35% improvement over single‑shot prompts, system prompts tuned for ChatGPT‑4… | ||
| Keynote: Navigating the Intersection of Technology, Security, and Trust | Reeny Sondhi | 57m |
After a public breach the organization moves to WebAuthn as a stronger second factor for 8,000 people in days and measures that change by customer feedback… | ||
| Keynote: Think Like a Hacker | Ted Harrington | 35m |
Claims specific vulnerabilities and remedial actions: security research finds dating apps let attackers change vote data, bypass payment controls, and… | ||
| Living off Microsoft Copilot | Michael Bargury | 49m |
Demonstrates a red-team–grade exploit chain: Copilot plugins can install a persistent backdoor into other users’ Copilot interactions, allowing data theft and… | ||
| GraphQL Exploitation: Secondary Context Attacks and Business Logic | Willis Vandevanter | 33m |
GraphQL servers commonly forward client input into internal REST calls so path traversal via ID/string input lets attackers pivot into backend APIs; real… | ||
| O My Data: OData Injection attack in Microsoft Power Platform and UiPath | Amichai Shulman | 48m |
New protocol-level exploit called OData Injection targets Microsoft Power Platform and appears in UiPath connectors enabling data exfiltration and… | ||
| Web Security Experts: Are you overlooking WebRTC vulnerabilities? | Sandro Gauci | 46m |
Findings include TURN relay abuse, RTP injection, and signaling flood with concrete demos: a stunner-based TURN relay probe that abused misconfigured TURN… | ||
| AI Goat: A Damn Vulnerable AI Infrastructure | Ofir Yakobi, Shir Sadon | 37m |
Deliberately vulnerable lab called AI Goat reproduces OWASP AI Top 10 risks and yields three hands‑on challenges; deployment uses Terraform and Github Actions… | ||
| Sanitize Client-Side: Why Server-Side HTML Sanitization is Doomed to Fail | Yaniv Nizry | 27m |
Claim: server-side HTML sanitization repeatedly fails because parsing and serialization differ across HTML versions, parsers and browsers, and real-world… | ||
| Hidden Chains: Revealing High-Impact Bugs from Bounty submissions | Murali Vadakke Puthanveetil, Vinay Prabhushankar | 42m |
Curated bounty reports show concrete wins not promises: a compromised S3-hosted binary in FS events S3 takeover executes on macOS and prompts a reserved-bucket… | ||
| Hackuracy: Boosting AST accuracy through hacking | Andres Roldan | 41m |
Claim: scanners alone miss most real exposure while combining scans with manual hacking finds far more. Experiment uses an insecure-by-design web app Moderna… | ||
| Kernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections | Subho Halder | 35m |
Claim: modifying the Android kernel lets RASP checks be intercepted and falsified. Implements a custom ohas driver and either direct syscall table hooking or… | ||
| Modernizing the Application Penetration Engagement and Reporting Lifecycle | Ryan Armstrong | 41m |
Claims a full rebuild of the application penetration engagement lifecycle: moves from Word + VBA + SmartDocs + SharePoint snippets to a content-first pipeline… | ||
| Navigating the complex and rapidly evolving world of product and application security regulations | Andrea Zodrow | 13m |
Finite State claims regulators now force product security practices like SBOMs, continuous monitoring and 24‑hour incident reporting, citing 75 billion… | ||
| Pay the Maintainers: xz utils Hack Highlights the Dangers of OSS Maintainer Burnout | Matthew Arnow | 35m |
Claims that paying maintainers raises security actually come with numbers and interventions: a 400‑maintainer Tidelift survey finds 60% of maintainers are… | ||
| OWASP Top 10 Risks for Open Source Software | George Apostolopoulos | 25m |
A concise set of concrete risks and mitigations: a Census2 datapoint shows 80–85% open source of some Java projects so dependency risk is pervasive… | ||
| OWASP DevSecOps Maturity Model (DSOMM) | Timo Pagel | 25m |
Claims a practical DSOMM-based program that moves teams from Excel inventories to an inventory of production dependencies, runs 2 hour interview assessments… | ||
| OWASP Coraza - Web Application Firewall | Juan Pablo Tosso | 32m |
Coraza claims drop‑in compatibility with the OWASP Core Rule Set while serving cloud‑native deployments, showing 4 million requests in 8 minutes on a 32‑core… | ||
| OWASP Software Assurance Maturity Model (SAMM) | Aram Hovsepyan, Sebastien Deleersnyder | 26m |
SAMM presents a maturity model with levels 0–3, an assessment questionnaire that measures both coverage and quality of activities, direct mappings to… | ||
| OWASP IoT Security Testing Guide (ISTG) | Aaron Guzman | 26m |
OWASP ISTG presents concrete, repeatable IoT penetration steps: an eight‑interface test case catalog, clear PA1–PA4 physical access levels and… | ||
| OWASP Nettacker | Arkadii Yakovets, Sam Stepanyan | 34m |
OWASP Nettacker is a Python 100% tool that runs without external binaries and can scan thousands of IPs or all subdomains of a domain, chain modules and run in… | ||
| OWASP Serverless Top 10 | David Melamed, Aruneesh Salhotra | 28m |
Claims OWASP Serverless Top Ten is the industry reference that must be refreshed: the current list dates from 2017 and the project runs a ~12‑month V2 process… | ||
| OWASP DefectDojo | Matt Tesauro | 27m |
DefectDojo is an open source AppSec platform that aggregates 180+ scanner parsers and exposes a REST‑based API, normalizing and de‑duping findings, grouping… | ||
| OWASP Application Security Verification Standard (ASVS) | Shanni Prutchi, Ryan Armstrong | 35m |
Standard currently lists about 278 controls across 14 topics and keeps level one almost entirely pen‑testable; version 5.0 aims to ship a candidate v5 before… | ||
| OWASP JuiceShop | Bjoern Kimminich | 39m |
A vulnerable web app born in 2014 grows from 23 hacking challenges to 107 hacking challenges including 31 linked coding exercises and a handful of Web3… | ||
| AppSec Meets Project Management: Hacking the Frameworks for Secure Software | Stefan Brätsch | 33m |
Compares concrete framework fit and gaps: PMBOK/PMI treats security appears 17 times in PMBOK and only once as “information security,” while PMI’s acquisition… | ||
| Running Your Application Security Program Like a Marathon | Derek Fang | 35m |
Draws concrete parallels: mental training maps to persistent program building, seven marathons becomes proof that steady pacing wins, and specific tooling… | ||
| Who Hurt You? Earning the trust of developers | Tanya Janca | 46m |
Argues that developer buy‑in is the linchpin: trust shortage creates attrition, slows innovation, and blocks fixes; specific fixes include secret scanning and… | ||
| Bridging Security & Privacy Standards: Harnessing OpenCRE for Effective Mapping | Dimitar Raichev | 32m |
Claims that OpenCRE-generated mapping produces fast, automated mappings are backed by a direct comparison to a SAMM → SSDF official mapping where OpenCRE… | ||
| Businesses Run On Risk And Debt: Why Communicating Security Risk Is Hard | Dwayne McDaniel | 46m |
Claim: executives hear resiliency and technical debt very differently than security people do, so budget requests fail. Concrete moves: translate CVEs and CVSS… | ||
| How Three Threat Modelers Can Influence an Entire Organization | Léandre Forget-B., Laurent Bouchard | 45m |
Three full‑time threat modelers scale practice across a 58,000‑person firm with 4,000 developers over three years by adopting a concise AIV taxonomy, training… | ||
| How to get developers to want to adopt AppSec | Matan Rabi | 37m |
Claims a practical framework: translate vulnerabilities into engineering ownership and KPIs, prioritize fixes by business impact not CVSS, and integrate… | ||
| The Broken State of DevSecOps and Its Maturity Model | Eitan Worcel, Dustin Lehr | 40m |
Claims that the DevSecOps maturity model is broken and SLAs are ignored, backed by concrete failure modes and a replacement model showing stages, metrics, and… | ||
| Learning to build an effective security design review program | Felix Matenaar, Ari Fay | 40m |
Over two years and about ~400 design reviews for a 500‑developer org the team builds a repeatable program: automated intake from the feature roadmap, a… | ||
| I Know What You Did Last Summer: Lessons Learned from Privacy Breaches and Scandals | Kim Wuyts | 52m |
Covers concrete incidents and what failed: a vending machine facial recognition deploys biometric capture with a lawyer-approved “GDPR compliant” claim that… | ||
| Striding Your Way to LINDDUN: Threat Modeling for Privacy | Shanni Prutchi, Chris Bush | 48m |
Shows a concrete privacy workflow: adopts LINDDUN go with 33 threat cards, draws cards against a simple DFD-style public library management system, and… | ||
| Under the Radar: How we found 0-days in the Build Pipeline of OSS Packages | François Proulx | 47m |
Built a large‑scale analysis pipeline that clones ~350,000 repos, parses workflows, runs specialized static checks and stores results in BigQuery then Neo4j… | ||
| Don’t Make This Mistake: Painful Learnings of Applying AI in Security | Eitan Worcel | 41m |
Tested OpenAI (GPT‑3) on two apps (Juice Shop, WebGoat) with ~100+ scanner findings: 29% solved with workable fixes, 19% partial or nonbreaking fixes, and 52%… | ||
| Threat Modeling in the Age of AI | Susanna Cox | 45m |
Claims a usable OWASP AI Exchange threat framework and a published ML SEC Ops architecture and shows how to apply them to concrete attacks like data poisoning… | ||
| OWASP Top 10 for Large Language Models: Project Update | Steve Wilson, Scott Clinton | 46m |
OWASP reports concrete uptake: v1 adopted across gov and industry, thousands following on LinkedIn, hundreds of articles and videos, and over 100,000 estimated… | ||
| OWASP AI Exchange experts on the future of security for AI | Chloe Messdaghi | 51m |
OWASP AI Exchange claims a reusable, practical security framework — free under creative commons license — that maps threats across development and runtime… | ||
| Millions Of Public Certificates Are Reusing Old Private Keys | Dylan Ayrey, Joseph Leon | 45m |
Analysis of 7 billion certs in Certificate Transparency finds millions reusing private keys, including organizations that reissue the same key after revocation… | ||
| Slack’s Vulnerability Aggregator: manage vulnerabilities at scale | Atul Gaikwad, Nicholas Lin | 43m |
Slack builds a central Vulnerability Aggregator that ingests findings from 15+ scanners, normalizes them into a data model (finding rule, finding, asset… | ||
| Escaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams | Ahmad Sadeddin | 01h 06m |
Claims concrete results: scanners miss 60% of vulnerabilities undetected and produce ~50% false positives; remediation runs from ~$400–$4,000 historically to… | ||
| Maturing Your Application Security Program with ASVS-Driven Development | Aram Hovsepyan | 45m |
Claims that 162 ASVS requirements (58%) are automatable and that an experiment adding 98 ASVS items to sprint planning yields 90 ASVS tests implemented in 10… | ||
| 5 Steps to VEX Success: Managing the End-to-End Workflow | Cortez Frazier Jr. | 48m |
States five concrete steps: generate SBOMs, detect vulnerabilities via SCA and CVE feeds, decompose with EPSS reachability and CISA KEV, triage by impact and… | ||
| AI Code Generation - Benefits, Risks and Mitigation Controls | Aruneesh Salhotra | 44m |
Claims that AI code gen speeds delivery and cuts manual errors while vendors like GitHub Copilot Tabnine Google Codi AWS CodeWhisperer Codium and Replit are… | ||
| Self-Discovering API Key Permissions and Resources | Joseph Leon, Dylan Ayrey | 43m |
A concrete method called self-discovery enumerates ownership, permissions and resources for exposed API keys by sending safe, non‑destructive API probes, using… | ||
| The Missing Link - How we collect and leverage SBOMs | Cassie Crossley | 47m |
Company policy changes and a lightweight platform generate and store 4,000+ SBOMs mostly from binaries, indexed for dependency lookup and customer sharing… | ||
| The Container Escape Room: An Exploration of Container Escapes | Amit Schendel | 45m |
Shows a working exploit chain that uses the dirty_pipe kernel bug to overwrite the host runc page cache and seize execution, and a live demo that uses a small… | ||
| Automatic application hardening by leveraging container runtime behavior analysis | Amit Schendel | 31m |
An automated pipeline records container runtime behavior with eBPF-based tools, generates native Kubernetes policies (seccomp profiles, NetworkPolicy, AppArmor… | ||
| Practical Software Supply Chain Security Solutions | Robert Marion | 45m |
Claims that SBOMs and SCA snapshots are necessary but insufficient and show why with examples: dependency confusion, repo jacking, typo squatting and repo… | ||
| AI Under the Hood: Unmasking Hidden Threats | Nitish M. Uplavikar | 28m |
A meta-analysis of 14 AI threat-modeling frameworks yields a unified library that collapses ~429 listed threats into a deduplicated set, converted into roughly… | ||
| OWASP: The Next 25 years | Andrew van der Stock | 44m |
OWASP reports concrete asks and results: a call for OWASP Top 10 data call closes in November, submit as CSV with three fields; ASVS sits at ASVS 4.0 (5.0… | ||
| Learning from Past Security Breaches: Strengthening AppSec Efforts and Focus | Jon McCoy | 33m |
Practical, checklistable items and failed/working fixes drive the talk not high-level platitudes: cut a Jira ticket with metadata and run a 10–30 minute rapid… | ||
| OWASP Mobile Application Security (MAS) | Sven Schleier, Carlos Holguera | 28m |
Project presents a concrete interface called MASWE beta that maps MVS controls to specific weaknesses, each with unique IDs, profiles and one or more… | ||
| nothing matches | ||