Open Source Fairy Dust
John Menerick details open Source Fairy Dust John Menerick SECURITY RESEARCHER, NETSUITE Over the past 30 years, the Internet and open source software have worked in tandem.
Summary
Architecture and Background
Open Source Fairy Dust John Menerick SECURITY RESEARCHER, NETSUITE Over the past 30 years, the Internet and open source software have worked in tandem. The Internet has provided an environment for open source software to prosper.
Vulnerability Analysis
Some would say the Internet and open source software are indistinguishable. From low level cryptography to critical services, the Internet’s foundation is built upon open source building blocks.
Exploitation and Demonstrations
These blocks are crumbling. This presentation will tread through popular open source projects, common fallacies, peer into 0days, walk trends, and break code.
Remediation and Defensive Strategies
When we are finished, you will be able to use the same techniques and tools to break or protect the Internet’s building blocks. John Menerick works on Security @ NetSuite. John’s interests include cracking clouds, modeling complex systems, developing massive software-defined infrastructures, and is the outlier in your risk model. Facebook: Web:
Related talks
Main Stage·35 min
Eaton Zveare · R Piyush
Reveals critical API authorization vulnerabilities in automotive dealer management systems that allowed national admin account creation and remote vehicle control.
Main Stage·40 min
Dongsung Kim
Dongsung Kim demonstrates how modern browser features and emerging Web APIs can be chained to resurrect Cross-Site Request Forgery (CSRF) despite SameSite cookies.
Main Stage·40 min
James Kettle
PortSwigger researcher James Kettle pioneers HTTP/2 request smuggling, uncovering critical implementation flaws when front-end reverse proxies downgrade to back-end HTTP/1.1.