Find Blue Oceans - Through the Competitive World of Bug BountyMuneaki Nishimura
?
This document discusses tips for finding uncontested bug bounty targets from a bug hunter's experience with Mozilla Firefox. Some key tips include searching for bugs in web platforms, unstable features in development builds, and sub-products like Firefox for Android and Firefox for iOS in order to find less competitive targets. Examples are provided of successful bounties collected from bugs found in areas like the Firefox OS, Firefox for iOS internal pages, and Android intent handling.
ここ10年でCapture the Flag(CTF:キャプチャー?ザ?フラッグ)と呼ばれるネットワークセキュリティゲームが台頭してきた。 このゲームに参加している人ならこれらのゲームの面白さは既に理解済みだろう。 このようなゲームは参加者に対して常に新しいチャレンジを提供するだけではなく、似たような事に興味を持つ人同士の交流や仲間内での高い評価を得るのみならず、最近では様々な賞品を勝つ機会を与えるまでになっている。 このようなゲームは、正しく運用された場合は次世代のコンピュータープロフェッショナルを育てる事を可能にする点でも、非常に重要な要素の一つと言えるだろう。 本講演ではこのようなゲームをトレーニングや人材育成的評価面で使用する際の課題と改善策に付いて発表する。
クリス?イーグル - Chris Eagle
カリフォルニア州モントレーの米海軍大学校にて上級講師として活躍中。コンピュータエンジニア/研究者として28年以上のキャリアを持ち、研究内容はコンピュータネットワーク運用、フォレンジックとリバースエンジニアリングに関連する。Black Hat, Defcon, InfiltrateやShmooconなどのカンファレンスにて講演また、IDA Proに関するハンドブックの決定版と呼ばれる"The IDA Pro Book"の著者でもある。DEFCONのCapture The Flag Competionで複数回優勝しており、2009年から2012年までは、同CTF競技の開催運用側で活躍。現在はDARPAと共同でCyber Grand Challenge競技の構築を行っている。
This document summarizes Content Security Policy (CSP), a browser feature that helps mitigate cross-site scripting and other attacks. It discusses CSP's directives for controlling resource loading, browser support, syntax, and violation reporting. It also notes potential issues with abuse of CSP violation reports if not properly validated and formatted on the server-side.
IoT Devices Compliant with JC-STAR Using Linux as a Container OSTomohiro Saneyoshi
?
Security requirements for IoT devices are becoming more defined, as seen with the EU Cyber Resilience Act and Japan’s JC-STAR.
It's common for IoT devices to run Linux as their operating system. However, adopting general-purpose Linux distributions like Ubuntu or Debian, or Yocto-based Linux, presents certain difficulties. This article outlines those difficulties.
It also, it highlights the security benefits of using a Linux-based container OS and explains how to adopt it with JC-STAR, using the "Armadillo Base OS" as an example.
Feb.25.2025@JAWS-UG IoT
This document summarizes Content Security Policy (CSP), a browser feature that helps mitigate cross-site scripting and other attacks. It discusses CSP's directives for controlling resource loading, browser support, syntax, and violation reporting. It also notes potential issues with abuse of CSP violation reports if not properly validated and formatted on the server-side.
IoT Devices Compliant with JC-STAR Using Linux as a Container OSTomohiro Saneyoshi
?
Security requirements for IoT devices are becoming more defined, as seen with the EU Cyber Resilience Act and Japan’s JC-STAR.
It's common for IoT devices to run Linux as their operating system. However, adopting general-purpose Linux distributions like Ubuntu or Debian, or Yocto-based Linux, presents certain difficulties. This article outlines those difficulties.
It also, it highlights the security benefits of using a Linux-based container OS and explains how to adopt it with JC-STAR, using the "Armadillo Base OS" as an example.
Feb.25.2025@JAWS-UG IoT