Confirmed users
529
edits
Security/Automation/WinterOfSecurity2014: Difference between revisions
Security/Automation/WinterOfSecurity2014 (view source)
Revision as of 13:16, 19 July 2014
, 19 July 2014→Media
(→Media) |
|||
| (30 intermediate revisions by 4 users not shown) | |||
| Line 1: | Line 1: | ||
= Winter Of Security 2014 = | = Winter Of Security 2014 = | ||
The Winter of Security (MWOS) is Mozilla program to involve students with Security projects. Students who have to perform a semester project as part of their university curriculum can apply to one of the MWOS project. Projects are guided by a Mozilla Adviser, and a University Professor. Students are graded by their University, based on success criteria identified at the beginning of the project. Mozilla Advisers allocate up to 2 hours each week to their students, typically on video-conference, to discuss progress and roadblocks. | [[File:WinterOfSecurity_logo_light_horizontal.png|right|500px]] | ||
The Winter of Security (MWOS) is Mozilla's program to involve students with Security projects. Students who have to perform a semester project as part of their university curriculum can apply to one of the MWOS project. Projects are guided by a Mozilla Adviser, and a University Professor. Students are graded by their University, based on success criteria identified at the beginning of the project. Mozilla Advisers allocate up to 2 hours each week to their students, typically on video-conference, to discuss progress and roadblocks. | |||
Projects are focused on building security tools, and students are expected to write code which must be released as Open Source. Universities are free to specify their own requirements to projects, such as written reports. Mozilla does not influence the way grades are allocated, but advisers will provide any information professors need in order to grade their students. | Projects are focused on building security tools, and students are expected to write code which must be released as Open Source. Universities are free to specify their own requirements to projects, such as written reports. Mozilla does not influence the way grades are allocated, but advisers will provide any information professors need in order to grade their students. | ||
| Line 16: | Line 15: | ||
* short description of each team member (skills, interest, ...) (max 500 character for each team member) | * short description of each team member (skills, interest, ...) (max 500 character for each team member) | ||
* links to relevant resources (university website, resumes, ...) | * links to relevant resources (university website, resumes, ...) | ||
'''UPDATE: Application to the 2014 edition of Mozilla Winter of Security are now closed.''' | |||
== Timeline == | |||
The application deadline is July 15th, 2014. We will take a few weeks to review all applications and inform the candidates by middle of August. | |||
The students and their professor can decide on the timeline, and make sure that it fits well with other classes. | |||
Ideally, projects should not take more than 6 months from start to finish. | |||
Mozilla advisors will be available weekly on video (Vidyo, Google Hangout or Skype) to discuss progress and roadblocks, and provide help. Professors can set intermediary deadlines if needed, and have complete control over the grading of their students. | |||
== Student projects == | == Student projects == | ||
=== Web Security === | === Web Security === | ||
==== ScanJS: Contribute to a JavaScript source code analyzer ==== | ==== ScanJS: Contribute to a JavaScript source code analyzer ==== | ||
* Mozilla Advisor: Frederik Braun | * Mozilla Advisor: [https://mozillians.org/en-US/u/freddyb/ Frederik Braun] | ||
* difficulty: high | * difficulty: high | ||
* language: english or german | * language: english or german | ||
[https://github.com/mozilla/scanjs ScanJS] is a JavaScript source code analyzer written in JavaScript. It helps reviewing and testing open web apps for security vulnerabilities. The goal of this project is to contribute to ScanJS by taking some [https://github.com/mozilla/scanjs/issues known issues] and improve the tool's capabilities. Students are also | [https://github.com/mozilla/scanjs ScanJS] is a JavaScript source code analyzer written in JavaScript. It helps reviewing and testing open web apps for security vulnerabilities. The goal of this project is to contribute to ScanJS by taking some [https://github.com/mozilla/scanjs/issues known issues] and improve the tool's capabilities. Students are also encouraged to explore areas of Javascript static analysis and contribute their findings to ScanJS. You can test ScanJS at this [http://mozilla.github.io/scanjs/client/ demo page] by uploading a JavaScript file (or a ZIP file containing multiple files - like Firefox OS apps). | ||
==== OWASP ZAP: Scripted Add-ons ==== | ==== OWASP ZAP: Scripted Add-ons ==== | ||
* Mozilla Advisor: [ | * Mozilla Advisor: [https://mozillians.org/en-US/u/psiinon/ Simon Bennetts] | ||
* difficulty: medium | * difficulty: medium | ||
* language: English | * language: English | ||
| Line 34: | Line 42: | ||
==== OWASP ZAP: AMF Support ==== | ==== OWASP ZAP: AMF Support ==== | ||
* Mozilla Advisor: [ | * Mozilla Advisor: [https://mozillians.org/en-US/u/psiinon/ Simon Bennetts] | ||
* difficulty: medium | * difficulty: medium | ||
* language: English | * language: English | ||
| Line 40: | Line 48: | ||
ZAP is the most active OWASP project and was voted the most popular security tool of 2013 by ToolsWatch.org reeaders. It is written in Java, so a good knowledge of this language is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential. | ZAP is the most active OWASP project and was voted the most popular security tool of 2013 by ToolsWatch.org reeaders. It is written in Java, so a good knowledge of this language is recommended, as is knowledge of HTML. Some knowledge of application security would be useful, but not essential. | ||
=== Forensic === | === Forensic === | ||
==== Cross-platform memory scanning in Go ==== | ==== Cross-platform memory scanning in Go ==== | ||
* Mozilla Advisor: Julien Vehent | * Mozilla Advisor: [https://mozillians.org/en-US/u/jvehent/ Julien Vehent] | ||
* difficulty: high | * difficulty: high | ||
* language: english or french | * language: english or french | ||
The Mozilla InvestiGator (MIG) project needs a way to inspect the content of the memory of a system, and detect threats. The typical approach in memory forensic is to dump the memory of a system, and perform analysis on another system, using tools like Volatility. We are looking for an approach that is less invasive, where an agent running on a target system can inspect its own memory without disrupting operations. Existing libraries, such as Volatility, are hard to ship to remote systems because of their size and dependencies. The goal of this project is to design and code a lean, cross-platform, memory inspection library in the Go language that can be integrated into MIG. | The [https://github.com/mozilla/mig/ Mozilla InvestiGator (MIG)] project needs a way to inspect the content of the memory of a system, and detect threats. The typical approach in memory forensic is to dump the memory of a system, and perform analysis on another system, using tools like [https://code.google.com/p/volatility/ Volatility]. We are looking for an approach that is less invasive, where an agent running on a target system can inspect its own memory without disrupting operations. Existing libraries, such as Volatility, are hard to ship to remote systems because of their size and dependencies. The goal of this project is to design and code a lean, cross-platform, memory inspection library in the Go language that can be integrated into MIG. | ||
This project is an opportunity for a group of students to take a close look at memory forensic across all operating systems. | This project is an opportunity for a group of students to take a close look at memory forensic across all operating systems. | ||
=== Network & System Security === | === Network & System Security === | ||
==== Cross-platform firewall driver in Go ==== | ==== Cross-platform firewall driver in Go ==== | ||
* Mozilla Advisor: Julien Vehent | * Mozilla Advisor: [https://mozillians.org/en-US/u/jvehent/ Julien Vehent] | ||
* difficulty: medium | * difficulty: medium | ||
* language: english or french | * language: english or french | ||
The Mozilla InvestiGator (MIG) is designing to detect and respond to threats. One way of responding to an attack is to create firewall rules on the local host to block an IP, or a particular connection. The goal of this project is to create a library in the Go language that can create and delete firewall rules on Windows, MacOS and Linux (iptables and ntables). The library should also be able to retrieve a ruleset from a host in a standardized format (JSON). | The [https://github.com/mozilla/mig/ Mozilla InvestiGator (MIG)] is designing to detect and respond to threats. One way of responding to an attack is to create firewall rules on the local host to block an IP, or a particular connection. The goal of this project is to create a library in the Go language that can create and delete firewall rules on Windows ([http://msdn.microsoft.com/en-us/library/windows/desktop/dd339609%28v=vs.85%29.aspx example]), MacOS and Linux (iptables and ntables). The library should also be able to retrieve a ruleset from a host in a standardized format (JSON). | ||
This project is an opportunity for a group of students to take a close look at firewall management on the major operating systems. | This project is an opportunity for a group of students to take a close look at firewall management on the major operating systems. | ||
==== Linux Audit heka plugin (Go) ==== | ==== Linux Audit heka plugin (Go) ==== | ||
* Mozilla Advisor: Guillaume Destuynder | * Mozilla Advisor: [https://mozillians.org/en-US/u/kang/ Guillaume Destuynder] | ||
* difficulty: medium | * difficulty: medium | ||
* language: english or french | * language: english or french | ||
| Line 74: | Line 74: | ||
==== Passive vulnerability scanning ==== | ==== Passive vulnerability scanning ==== | ||
* Mozilla Advisor: Michal Purzynski | * Mozilla Advisor: [https://mozillians.org/en-US/u/michalpurzynski/ Michal Purzynski] | ||
* difficulty: high | * difficulty: high | ||
* language: english or polish | * language: english or polish | ||
| Line 84: | Line 84: | ||
=== Cryptography === | === Cryptography === | ||
==== Compliance checking of TLS configuration ==== | ==== Compliance checking of TLS configuration ==== | ||
* Mozilla Advisor: Julien Vehent | * Mozilla Advisor: [https://mozillians.org/en-US/u/jvehent/ Julien Vehent] | ||
* difficulty: | * difficulty: medium | ||
* language: english or french | * language: english or french | ||
Mozilla maintains guidelines for server side configurations of SSL/TLS. The goal of this project is to build a tool that verifies compliance of a configuration with our guidelines, and help the administrators improve their security. It is very similar in philosophy to project like SSL Labs, but with a | Mozilla maintains guidelines for [[Security/Server_Side_TLS|server side configurations of SSL/TLS]] that we use to guide the deployment of secure channels everywhere. The goal of this project is to build a tool that verifies compliance of a configuration with our guidelines, and help the administrators improve their security. The tool must be able to evaluate the quality of ciphers, detect required features such as OCSP stapling, and evaluate certificates. It is very similar in philosophy to project like SSL Labs and [https://github.com/jvehent/cipherscan Cipherscan], but mixed with a certificate observatory. The end goal is to help administrators reach a better security level, and measure compliance against Mozilla's policies. The team will be free of reusing existing tools, or build a new one from scratch. | ||
=== Identity Management === | === Identity Management === | ||
==== Make Multi-Factor Authentication for OpenVPN a first class citizen ==== | ==== Make Multi-Factor Authentication for OpenVPN a first class citizen ==== | ||
* Mozilla Advisor: Guillaume Destuynder | * Mozilla Advisor: [https://mozillians.org/en-US/u/kang/ Guillaume Destuynder] | ||
* difficulty: medium | * difficulty: medium | ||
* language: english, french | * language: english, french | ||
| Line 100: | Line 100: | ||
=== Risk Management === | === Risk Management === | ||
==== An online threat modeling tool ==== | ==== An online threat modeling tool ==== | ||
* Mozilla Advisor: | * Mozilla Advisor: [https://mozillians.org/en-US/u/curtisk/ Curtis Koenig] | ||
* difficulty: medium | * difficulty: medium | ||
* language: english | * language: english | ||
Threat modelling is an important part of designing an application, and a threat model diagram is a very useful way to document the threats that apply to your application. | Threat modelling is an important part of designing an application, and a threat model diagram is a very useful way to document the threats that apply to your application. | ||
Unfortunately there are a very limited number of | Unfortunately there are a very limited number of threat modelling tools available, and most of those are restricted to specific platforms. | ||
This project is to create an online HTML5 application which will allow the user to easily create threat model diagrams online. | This project is to create an online HTML5 application which will allow the user to easily create threat model diagrams online. | ||
It should be very easy to use, and allow the diagrams to be exported in the most common image formats. | It should be very easy to use, and allow the diagrams to be exported in the most common image formats. | ||
The graphical elements of the [https://www.microsoft.com/security/sdl/adopt/threatmodeling.aspx Microsoft Threat Modeling tool] are a good example of the type of functionality required. | The graphical elements of the [https://www.microsoft.com/security/sdl/adopt/threatmodeling.aspx Microsoft Threat Modeling tool] are a good example of the type of functionality required. | ||
== FAQ == | |||
* What is meant by "Presentation of the University program" in the application form? | |||
We would like to see what kind of degree your are currently pursuing (e.g. Bachelor of Science in Computer Science or Master of Science in IT Security, ..), as well as a description of the University itself. This is another data point that gives us more information about the applicants' chances to successfully complete a project. | |||
* Can students apply to multiple projects? | |||
Yes. Students can apply to one or more projects. Students cannot apply twice for the same project, even if their team compositions varies. | |||
* What criteria will you use to select the candidates? | |||
The skills and passion of the team members are key points. The size of the team may play in the favor of applicants, but is not a requirement. A single candidate who can show a portfolio of successful projects will have the same chances as larger teams. | |||
Commitment from the University is a strong requirement. Students need to demonstrate that their professors support them, and will give them time to work on the projects. The ideal situation is for a team to pick a MWoS project as their final thesis, and work on the project for a full semester. Not all students will be able to do so, and we will evaluate all applications with the same level of scrutiny. | |||
* Can I still work on Mozilla projects if I am not selected for MWoS? | |||
Yes! We continuously have projects that are available for students to grab! Take a look at the [[Security/Mentorship|Mentorship]] program, and reach out to us in the #security IRC channel if you are interested. | |||
== Media == | |||
[[File:WinterOfSecurity_logo_light_horizontal.png|400px]] | |||
[[File:WinterOfSecurity_logo_dark_horizontal.png|400px]] | |||
[[File:WinterOfSecurity_logo_light_vertical.png|300px]] | |||
[[File:WinterOfSecurity_logo_dark_vertical2.png|300px]] | |||