Game of Hacks: Play, Hack & Track
Amit Ashbel and Maty Siman present Game of Hacks, evaluating how thousands of developers identify vulnerable code patterns through competitive vulnerability hunting games.
Summary
Architecture and Background
Amit Ashbel Product Evangelist Checkmarx Fooling around with some ideas we found ourselves creating a hacker magnet. Game of Hacks, built using the node.js framework, displays a range of vulnerable code snippets challenging the player to locate the vulnerability. A multiplayer option makes the challenge even more attractive and the leaderboard spices up things when players compete for a seat on the iron throne.
Vulnerability Analysis
Within 24 hours we had 35K players test their hacking skills...we weren't surprised when users started breaking the rules. Join us to: Play GoH against the audience in real time and get your claim for fame Understand how vulnerabilities were planted within Game of Hacks See real attack techniques (some caught us off guard) and how we handled them Learn how to avoid vulnerabilities in your code and how to go about designing a secure application Hear what to watch out for on the ultra-popular node.js framework. Amit Ashbel joined Checkmarx From Trusteer (acquired by IBM).
Exploitation and Demonstrations
He has been with the security community for more than a decade where he has taken on multiple tasks and responsibilities over the years, including technical and Senior Product lead positions. Amit adds valuable product knowledge including experience with a wide range of security platforms and familiarity with emerging threats and the hi-tech security industry. Maty is the CTO and founder of Checkmarx.
Remediation and Defensive Strategies
Maty has more than a decade of experience in software development, IT security and source-code analysis. Prior to founding Checkmarx, Maty worked for two years at the Israeli Prime Minister’s Office as a senior IT security expert and project manager. Prior to that, he spent six years with the Israel Defense Forces (IDF), where he established and led a development team in the IDF’s Information Security Center. Maty regularly speaks at IT security conferences and is CISSP certified since 2003.
Related talks
Main Stage·45 min
Rotem Bar
Rotem Bar turns static application security testing (SAST) tools and linters against developers, weaponizing malicious repositories to achieve RCE during source code scanning.
Ekoparty Security Conference·25 min
Ileana Maricel Barrionuevo
Investigates when giants fall: XSS in Meta through code review and evaluates key implications for security practitioners.
OWASP Foundation·54 min
Analysts investigate attack surfaces and defenses concerning It’s Giving Insecure Vibes: Secure Coding Literacy for Vibe Coders Track 1.