BEGIN:VCALENDAR PRODID;X-RICAL-TZSOURCE=TZINFO:-//Calagator//EN CALSCALE:GREGORIAN X-WR-CALNAME:Calagator METHOD:PUBLISH VERSION:2.0 BEGIN:VTIMEZONE TZID;X-RICAL-TZSOURCE=TZINFO:America/Los_Angeles BEGIN:DAYLIGHT DTSTART:20140309T020000 RDATE:20140309T020000 TZOFFSETFROM:-0800 TZOFFSETTO:-0700 TZNAME:PDT END:DAYLIGHT END:VTIMEZONE BEGIN:VEVENT CREATED;VALUE=DATE-TIME:20140522T172135Z DTEND;TZID=America/Los_Angeles;VALUE=DATE-TIME:20140722T193000 DTSTART;TZID=America/Los_Angeles;VALUE=DATE-TIME:20140722T180000 DTSTAMP;VALUE=DATE-TIME:20140522T172135Z LAST-MODIFIED;VALUE=DATE-TIME:20140522T172135Z UID:http://calagator.org/events/1250466289 DESCRIPTION:Tim Morgan will be presenting: What You Didn't Know About XML External Entities Attacks \;\n \;\nThe eXtensible Markup Language (XML) is an extremely pervasive technology used in countless software p rojects. Certain features built into the design of XML\, namely inline schemas and document type definitions (DTDs) are a well-known source of potential security problems. Despite being a publicly discussed for mor e than a decade\, a significant percentage of software using XML remains vulnerable to malicious schemas and DTDs. This talk will describe a co llection of techniques for exploiting XML external entities (XXE) vulner abilities\, some of which we believe are novel. These techniques can al low for more convenient file content theft\, sending of arbitrary data t o arbitrary internal TCP services\, uploads of arbitrary files to known locations on a vulnerable system\, as well as several possible denial of service attacks. We hope this talk will raise awareness about the overa ll risk associated with XXE attacks and will provide recommendations tha t developers and XML library implementors can use to help prevent these attacks. \;\n \;\nTim Morgan is credited with the discovery and r esponsible disclosure of several security vulnerabilities in commercial off-the-shelf and open source software including: IBM Tivoli Access Mana ger\, Real Networks Real Player\, Sun Java Runtime Environment\, Google Chrome Web Browser\, OpenOffice\, and Oracle WebLogic Application Server . Tim develops and maintains several open source forensics tools as well as Bletchley\, an application cryptanalysis tool kit. Tim regularly spe aks and delivers technical training courses\, his next of which will be on cryptography for developers at AppSecUSA 2014. \;\n \;\nThe Op en Web Application Security Project (OWASP) is a 501c3 not-for-profit wo rldwide charitable organization focused on improving the security of app lication software. To sign up for future meeting notes and to discuss se curity topics with local gurus\, sign up on the OWASP Portland mailing l ist: https://lists.owasp.org/mailman/listinfo/owasp-portland \;\n \;\nMeetings are free and open to the public.\n\nTags: security\, owasp\ , xml\, xxe\n\nImported from: http://calagator.org/events/1250466289 URL:https://www.owasp.org/index.php/Portland SUMMARY:OWASP Chapter Meeting LOCATION:New Relic: 111 SW 5th Avenue\, Suite 2700\, Portland Oregon 9720 4 United States SEQUENCE:4 END:VEVENT END:VCALENDAR