DEFCON 15: Hacking the EULA: Reverse Benchmarking Web Application Security Scanners

Speakers: Tom Stracener Sr. Security Analyst, Cenzic Marce Luck Information Security Architect, A Fortune 100 Company Each year thousands of work hours are lost by security practitioners as time is spent sorting through web application security reports and separating out erroneous vulnerability data. Individuals must currently work through this process in a vacuum, as there is no publicly available information that is helpful. Restrictive EULAs (End User License Agreements) prohibit examining a signature code-base for common errors or signature flaws. Due to the latter point, a chilling effect and has discouraged public research into the common types of false positives that existing commercial technologies are prone to exhibit. Reverse Benchmarking is a new species of reverse engineering that involves running a security solution against an application designed to solicit false positives. Unlike testing scenarios that emphasize gathering valid or accurate data, Reverse Benchmarking involves exposing architectural or logical flaws within a web application scanner by employing techniques to trick simple rule-based mechanisms. Running a scanner against a Reverse Benchmark target quickly reveals faulty rules, flawed testing logic, or poorly written or implemented security testing procedures. Additionally, a Reverse Benchmarking application will expose patterns in the propensity of a scanner to report false results, making it easier to spot false positives when they occur in ...
Video Rating: 5 / 5

May also called "Fake Vacuum". Based on concept of environmental, free, and convenience then we design this tool. All of the beginning, the fallen leaf are difficult to be assembled because of the wind blown, the consistently method were nothing but using the broom, dustpan, and garbage bag. It is annoying and wasting time. Then the concept was brought out, combining the function of the broom, dustpan, and the garbage bag.Unexpectedly, we find out it could not only clean out the fallen leaf, collect the Ping-Pong ball, but also the light weight garbage. Like the head of a vacuum cleaner, it clean up anywhere you go.Height is adjustable, easy to disassembled, and installed by using the recycle material-PET bottle to be the body, three rows of the brushes (replacing the broom) at the front. And the roller go forward to collect the leaf, garbage into the contain (replacing the garbage bag). Work could be done much easier, very suitable for the recycling principle and the environmental need. Instructor：(A) CHIA YI INVENTOR ASSOCIATION Chairman: CHEN, SUI HSIAN (B) NationalChia-Yi Industrial High School E-Branch Director: SHU YIN SHENG TEL: (A) +886-5-2760990 (School) (B)+886-5-2783242 FAX: +886-5-2783247 Email:nck620132@yahoo.com.tw Address: (A) No.174,MituoRd., East Dist.,ChiayiCity 600, Taiwan (ROC) (B) No.101,ChaoyangSt., East Dist.,ChiayiCity 600, Taiwan (ROC)