Johannes Ullrich

Presentations

Security Impact of HTML5

HTML 5 does more then add a couple new and nifty tags to the venerable HTML markup language. It has to be seen as part of the new dynamic web which no longer delivers static documents but dynamic applications that interact with backend web services.

This talk will discuss some of the more prominent and complex features of HTML and explore how a developer can use these features securely. We will demonstrate some attacks and walk through how different defenses mitigate these attacks. One of the focus areas will also be privacy and how the user data can be protected within HTML 5 applications.

Measuring Compromise: techniques to detect and quantify large scale automated web application exploits

About ten years ago, collecting firewall logs and aggregated analysis of rejected packets was a good measure of prevalent automated attacks originating from worms, and later bots. However, over time attacks moved up the stack and Firewall logs became less interesting. Currently, most attacks against servers use open ports and attack the applications listening on these ports. In some ways, web applications have become the new firewall, and collecting data about web application attacks has become an important research topic. However, collecting web application attack logs from live networks has proven itself to be a lot harder then collecting firewall logs. Privacy, log formats and data volume are just some of the topics that need to be considered.

We will discuss the different approaches used to collect web application attack data and present some results from our new 404 project.