Roberto Suggi Liverani & Scott Bell (Principal Security Consultants, Security-Asessment.com)

PRESENTATION TITLE: Window Shopping: Browser Bug Hunting in 2012

PRESENTATION ABSTRACT:

Web browsers have become part of everyday life, and are relied upon by millions of internet citizens each day. The feature rich online world has turned the once simple web browser into a highly complex (and very often insecure) desktop application.

As browser vendors have extended functionality and support to new technologies, security researchers and hackers are continuously looking for new vulnerabilities. In this talk, Roberto and Scott will share results of their assiduous browser bug hunting. The talk will examine techniques used to discover critical and less severe vulnerabilities in some of the most popular browsers on the market.

This talk will focus heavily (but not exclusively) on the following areas:

- Memory corruption bugs;
– New approaches to DOM fuzzing;
– Old school techniques against new browser technology;
– Cross Context Scripting and injection attacks;
– SOP Bypass;

The presentation will conclude with a montage of on-stage demonstrations of previously unreleased vulnerabilities, including remote code execution, injections and other tailored browser exploits.

ABOUT ROBERTO SUGGI LIVERANI

Roberto Suggi Liverani focuses on intrusion testing and new methods of exploitation. Roberto has worked with companies such as Google, Adobe, Oracle, Mozilla and Opera by reporting and helping to fix security vulnerabilities in their products. Roberto has been a guest speaker at global security conferences, including EUSecWest, Ruxcon, Kiwicon and DEFCON. Roberto tweets from @malerisch and his blog can be found at: http://blog.malerisch.net

ABOUT SCOTT BELL

Scott Bell is a Principal Security Consultant at Security-Asessment.com. Scott specialises in web application security and is co-leader of the OWASP New Zealand Chapter. As a side interest, Scott enjoys fuzzing, finding bugs and dabbling in exploit development. Scott also holds a Ph.D in reverse-shellology.