AppSec Israel 2018

By Amit Klein and Dor Azouri

Suppose you have malware running on one of your endpoints. But you have a highly secure enterprise, with cloud AV, IR team, and locked down network (endpoints can’t access the external network). Can the malware still exfiltrate sensitive data out of your network? You bet! And we’ll show you how!

By Guy Barnhart-Magen and Ezra Caltum

Exploits, Backdoors, and Hacks: words we do not commonly hear when speaking of Machine Learning (ML). In this talk, I will present the relatively new field of hacking and manipulate machine learning systems and the potential these techniques pose for active offensive research.  

By Danny Grander

Whether we like to admit it or not, we’ve all borrowed code from stackoverflow at one time in our lives. Many do it more often than they care to admit. If a vulnerability exists in a stackoverflow code snippet, it’s easy for it to go viral in even the most widely used frameworks and libraries. 

By Tanya Janca

This talk will explain what developers needs to adjust in order to turn DevOps into DevSecOps within their organizations. Several strategies are presented for weaving security into each of the “Three Ways”, with clear steps audience members can start implementing immediately. 

By Ezra Caltum

By finding function relationships between dynamically compiled binaries and its libraries, and representing them in a Graph Database, we can quickly identify exploitation points. In this presentation, I’ll discuss Graphs, Binary Relationships and Vulnerable Functions.

By Erez Metula

During this talk, we'll discuss common security vulnerabilities that can occur in smart contracts and see how code that caused losses of millions of dollars looks like. We'll cover the tools and techniques to explore , analyze, identify and exploit vulnerabilities in smart contracts.

We'll talk about real world exploits, and look at the vulnerable code that caused them. We'll talk about a new class of code vulnerabilities related to smart contracts, such as re-entrancy, time manipulations, overflows, authorization bypass, exposing secrets, etc.