OWASP Newcastle (UK)

Welcome to the official chapter page of the OWASP Newcastle-Upon-Tyne (UK) Chapter. We meet four times a year, usually on the last Tuesday of the month when we arrange meet-ups.

We’re always looking for speakers, we welcome anyone who is interested in presenting a talk. Whether you are new to the chapter or an existing member, we encourage you to reach out to one of our chapter leaders for more information on how to get involved. To help you along the way, we can also provide support with the preparation and delivery of your talk.

As we encourage knowledge sharing and raising awareness of our events and the topics covered, we also make the presentations available on our previous events page after each event.


Next Event

04/02/2020 1800 - 2100 (Barclays Eagle Labs / TusPark)

Title: What I learned from running a honeypot

Speaker: Andi

Description: Towards the end of 2019 I ran several honeypots for around a week. This talk aims to walk through how to set up your own, learning from my mistakes, and then examines the data about what attacks are really taking place.


Title: 5G and LTE security

Speaker: Matt Summers

Bio: Matt is an accomplished security consultant with over 2 decades of experience. A former Army Captain within the British Army’s Information Assurance unit and former HMG Science Advisor specialising in research and development of secure hardware and software solutions. A co-founder of the BSides London security conference, co-founder and director of the BSides Manchester security conference and chief cat herder for the DefCon Aerospace Village Matt has a passion for knowledge sharing and community engagement. He was recently appointed to the executive at CREST.

Description: This presentation is about 5G and LTE security and an adaption of his 44Con talk from 2019 which wasn’t recorded. We will initially get an overview of the technology followed by a deep dive into LTE flaws and misconceptions. Followed on by a look at 5G security and how most security experts are getting it wrong with 5G.


Schedule:

Schedule:

  • 1800 - 1815 - Arrival and networking
  • 1815 - 1820 - OWASP Newcastle Welcome
  • 1820 - 1900 - Talk 1
  • 1900 - 2000 - Pizza and Networking
  • 2000 - 2045 - Talk 2
  • 2045 - onwards Pub?

Previous Events

Here are the details from previous OWASP Newcastle meetups. Often there are links to presentations available.


2020


2019


03/12/2019

Capture the flag event

Following on from the success of their recent Avalanche CTF, we’ve asked Pentest to build a brand new CTF for everyone to tackle at OWASP Newcastle. Avalanche 2, as they’re calling it, will still be based on a petition/campaign website like 38 degrees or the UK.gov, but promises to be bigger and better than the original, with a host of new challenges.

With assistance from our friends at Pentest Limited, we present to you Avalanche 2.

All levels of experience are welcome, starting from zero knowledge right up to experienced red teamer. All you need to do is bring yourself plus a laptop. You will learn something new, and if you don’t you will have fun anyway! You can work alone or in a team.

If you’d like to have a go at the original Avalanche CTF you still can by visiting https://pentest.co.uk/labs/avalanche-ctf/

As always, we will be providing pizza and drinks courtesy of our sponsors at Sage. If you have any dietary requirements please just message one of the organisers and we can make sure you’re catered for.

Schedule:

  • 1800 - 1815 - Arrival and networking
  • 1815 - 2100 - Avalanche 2 CTF
  • 2100 - onwards Pub?

23/09/2019

Title: Stalk Awareness

Speaker: Cian

Description: We often focus on nation states and corporation’s role in eroding our privacy and expanding omnipresent surveillance worldwide, meanwhile an entire niche industry that caters to regular consumers who want similar spying capabilities has slipped largely under the radar. Mobile apps that are designed to enable toxic and abusive behavior are being openly sold on the internet, marketed directly to abusers, these apps have come to be termed “stalkerware”.

This talk will present analysis of the stalkerware industry, its products, marketing and the scope of the problem it represents, as well as potential solutions. I’ll be examining these topics from both a technical and non-technical standpoint, based on many months of personal research.


Title: Rethinking Threat Intelligence - a quick glance at intelligence led risk management - Slides

Speaker: Adam Pickering

Description: 45 min chat about rethinking how we use threat intelligence capabilities within enterprise to bring about changes to the way we deploy countermeasures against threat actors


13/06/2019

Red Team versus Blue Team event

Title: Red Teaming a view from the field

Speakers: Andi Pannell and Gavin Johnson-Lynn

Description: A talk about what red teaming is, how it is different from a penetration test, and then we’ll reveal some hardware we use during red team engagements and some success stories.


Title: Protecting the museum – HIPS

Speaker: Marek Banas

Description: How you can minimise the manual labour with increasing the security on legacy servers, plus some issues we hit while choosing the solutions, challenges we had.


26/02/2019

The talk will be three smaller talks, covering:

  • Remote online social engineering (how attackers use catfishing techniques)
  • Hacking with light and sound (using infrared, ultrasound, and lasers to exfiltrate data and disrupt sensors)
  • Attack linkage (using granular attack behaviours to link different cyber attacks)

Speaker: Matt Wixey


Title: Getting stakeholders on board”

Speaker: Kathryn Cardose

Description: So you’ve nailed the tech, you’ve found the controls, you’ve requested remediation…..how do you get stakeholders of all levels to buy in and support security?


2018


25/09/2018

Title: Don’t tell your Big Brother

Speaker: Andy Ferguson

Description: Encryption tips and tricks.


Title: My Path to CSSLP

Speaker: Gavin Johnson-Lynn

Description: Join me on a journey from a vague knowledge of security to gaining a valued security certification. For anyone considering certification as a route to success, self-improvement, or even just some thoughts on how I approached it. We’ll look at what I learned and how I learned it, including some tricks I picked up along the way to help cram information into my brain (and keep it there).


26/06/2018

We held our first CTF (Capture The Flag) event.

The CTF event was facilitated by Secarma. The attendees were split into groups, each group had their own sandboxed environment to connect into, and prizes were offered to the teams who captured the most flags.


27/03/2018

Title: The Internet of (broken) things.

Speaker: Andi Pannell

Description: This talk will focus on the internet of things, how we’re connecting everything to the internet now, because why not add a WiFi connection to your Fridge? And how security is unlikely to be a consideration when making these products. I’ll also talk about DefCon, as last year my company sent a team of us to DefCon 25 in Las Vegas, explaining what DefCon is, what happens there, and how we won the IoT Village 0-day contest and I’ll conclude with a live hacking demo.


Title: An introduction to the OWASP automated threats to web applications

Speaker: Colin Watson

Description: Web applications are subjected to unwanted automated usage – day in, day out. The vast majority of these events relate to misuse of inherent valid functionality, rather than the attempted exploitation of unmitigated vulnerabilities. Also, excessive misuse is often mistakenly reported as application denial-of-service (DoS) like HTTP-flooding, when in fact the DoS is a side-effect instead of the attacker’s primary intent.


30/01/2018

Title: Code that fights back

Speaker: Neil Dixley

Description: Lessons from the gaming world on detecting and responding to attacks on software assets. An introduction to proactive software security including a philosophical look at how far we should go to protect our apps.


Title: Practical demonstration of mobile software penetration

Speaker: Luke Sadler

Description: Luke Sadler walks us through hands on examples of cracking mobile technology.


2017


21/11/2017

Title: Explain hacking in ten minutes

Speaker: Lorenzo Grespan

Description: Recently I had to show a 10-minute “live hack” to a non-technical audience. As an introvert and a geek my main effort was in maintaining technical accuracy, however what made the audience go “aha!” turned out to be what for me was the least significant detail of the entire demo. In this talk I will show the hack, share the lessons learned and discuss how to communicate security concerns to non technical stakeholders, higher management and end users.


Title: Building a Development Environment That’s ‘Secure Enough’

Speaker: Robin Sillem

Description: This will be a discussion of how a team at DWP is using modern DevOps practices to create a dev/build/test platform secure enough for development of services handling large volumes of UK citizen data. Media:Modern_DevOps_and_security.pptx


19/09/2017

Title: Running a security event using OWASP Security Shepherd

Speaker: Gareth Dixon

Description: In this talk I will cover running a security event using OWASP Security Shepherd. The event to be discussed was staged to promote engagement in a security initiative, understanding of security vulnerabilities and the application of knowledge to production services and applications. This talk will cover the project planning stage, through execution to the project retrospective.


Title: Enter the (Threat) Dragon

Speaker: Mike Goodwin

Description: Threat Modeling with OWASP Threat Dragon. Threat modelling is a great technique for hardening your application designs, but current tooling is a bit “crashy”, limited to Windows or not free. OWASP Threat Dragon is an OWASP incubator project that aims to fix this and bring threat modeling to the masses. This talk is a tour round the tool, it’s future road map and a look under it’s hood. Mike the the project leader for Threat Dragon, so if you want to contribute, he would be very pleased to speak to you.


2016


23/08/2016

Title: 50 Million Downloads and All I Got Was Malware

Speaker: Andi Pannell

Description: How is it a free Android application that has been downloaded more times than WhatsApp can turn your phone into malware, sending your private data to China and inserting adverts? I’ll be discussing my journey of researching mobile malware and how you can too.


Title: OWASP Cornucopia

Speaker: Colin Watson

Description: OWASP Cornucopia is a free open-source card game, referenced by a PCI DSS information supplement, that helps derive application security requirements during the software development life cycle. This session will use an example eCommerce application to demonstrate how to utilise the card game. After an introduction and explanation, we will split into smaller groups to play the game gaining insights into relevant web application threats. The game is best played in groups of 4-6 with people who have a good knowledge of the application being assessed, and who have a mixture of backgrounds/experience - architects, developers, product owners, project managers, testers, etc, and those with software security responsibilities. Bring your colleagues along. Cornucopia is suitable for people aged 10 to 110 (decimal).


2015


24/11/2015

Title: The problems with proving identity

Speakers: Ben Lee and Ross Dargan

Description: In this talk Ross and Ben will discuss the conundrum of proving (and more importantly verifying!) identity online. While both of these tasks might seem simple at first, they really aren’t. This is a problem that people have grappled with since the beginning of communications (okay so not the online part!) and we still don’t have all the answers. The talk will cover among other things; Twitter, wax seals (!), hashing, certificates and much more…* (*Talk may not be historically accurate! ;))


Title: Think about the Top 10 Controls, not the Top 10 Risks

Speaker: Colin Watson

Description: The OWASP Top 10 is the most well-known OWASP project, but how can awareness of OWASP guidance for developers be improved? In this presentation Colin Watson will describe a board game that encourages developers to think and learn about the most important web application security controls, rather than risks or vulnerabilities. Take a copy of the game away with you - it is suitable for developers of all sizes.


Title: Automated Security Testing Using The ZAP API

Speaker: Michael Haselhurst

Description: This talk will show you how to integrate the OWASP ZAP API with automated test scripts using Sahi.


Title: Real world defence in depth (part 1)

Speaker: Mike Goodwin

Description: Everyone should be aiming for defence in depth, but what does it actually mean to an application developer? This is the first of a series of short talks about real world scenarios where defence in depth is genuinely useful and easily achievable. It should help you turn defence in depth from an aspiration into practical reality.


29/09/2015

Title: Securing Real-Time Networks

Speaker: John Beddard


Title: Content Security Policy

Speaker: Ian Oxley


Title: Threat Dragon - a new threat modelling tool project from OWASP

Speaker: Mike Goodwin


Title: OWASP Top 10 Mobile Risks

Speaker: Neil Dixley


28/07/2015

Title: Honeypots; from research to the Enterprise

Speaker: Andrew Waite


Title: Security in the World of Containerisation

Speaker: George Chlapoutakis


29/05/2015

Title: An introduction to basic application penetration testing

Speaker: Robin Fewster

Description: An introduction to penetration testing, using several OWASP projects as well as other open source and free programs.


Title: The Elevation of Privilege Threat Modelling Tool

Speaker: Neil Dixley

Description: An introduction to threat modelling and using the ‘Elevation of Privilege’ card game to facilitate and improve team threat modelling exercises.


24/03/2015

Title: Cognitive Bias and Security Vulnerabilities

Speaker: Neil Dixley

Description: The psychology of software engineering. An introduction to the psychology of cognitive bias and how human nature and cognitive biases are the key to user based security vulnerabilities. A look at how our brains trick us into feeling safe while giving our pin number to strangers on the phone plus a look at how we can use technology to disrupt cognitive bias and use these human traits to mitigate threats and strengthen application security.


Title: Security Compliance for Developers - Are we Certified… or Certifiable?

Speaker: Andy Ward

Description: Against a background of increasing threats and hacks, with more and more of our personal lives and business processes conducted online, it’s never been more important to ensure our software is secure and robust. But how do you prove it? These days, reassuring your customers takes more than an SSL padlock, and some marketing spiel mentioning ‘banking grade encryption’! After a quick reminder of “what’s the worst that can happen…”, Andy will introduce some of the security Compliance and Certification systems that help you ‘walk the walk’, and provide confidence that your system has its security in good hands, before looking at what it means for developers and engineering teams.


Sponsorship

Sponsor(s): Many thanks to Sage for sponsoring our chapter and allowing us to continue to run our events. They are a platinum sponsor and we are grateful for their generous support.

Sage Logo