19th-20th November 2011 - Melbourne, Australia
2011 Talks
The Security Of 3D Web Extensions
This presentation will go into more detail on the well publicised research that Context undertook into the recently standardised WebGL technology (http://www.contextis.com/blog/webgl), which brings high performance 3D graphics to the browser. The blog articles attracted considerable interest from the media (including large technology sites such as ZDNet, PCWorld.com and The Register) as well as US CERT publishing our advice for disabling WebGL. Of course not all of our research or low-level details made it into the blog articles so this presentation will contain new content not previously released.
The research identified significant risks to the stability and security of a computer by having this extension enabled by default in Mozilla Firefox and Google Chrome; including allowing a malicious attacker to crash a user's machine or steal information which they should not be able access. This was in part a failure of specification as well as implementation. Through the publication of this information we made a significant impact on the use of WebGL including making Khronos, the standardising body change WebGL in order to improve overall security.
The presentation will also go into a few of the other up and coming technologies which claim to provide the same level of access to 3D hardware acceleration and whether they exhibit exactly the same classes of issues.
Speaker: James Forshaw
I am currently a senior security consultant at Context Information Security Limited; a UK based security consultancy firm with a presence in Australia through our Melbourne office. I have been involved with computer hardware and software security for almost 10 years with a skill set which covers the bread and butter of the security industry such as application testing, through to more bespoke product assessment, vulnerability analysis and exploitation. Researching the security of new technologies is of particular interest, making WebGL a perfect target for investigation.
In terms of publically disclosed work my biggest area to date has been my research into games console security, especially my involvement in the team which took apart the Playstation Portable (PSP) security model, developing a significant proportion of the toolchain/SDK as well as finding and exploiting vulnerabilities in the device’s hardware and software. This culminated in a presentation at the Chaos Computer Congress 2007 in Berlin.
Mobile and Contactless Payment Security