BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: The CSRF Resurrections! Starring the Unholy Trinity:
  Service\n   Worker of PWA\, SameSite of HTTP Cookie\, and Fetch\n   When:
  Saturday\, Aug 13\, 18:00 - 18:45 PDT\n   Where: Caesars Forum - Academy 
 401-410\, 421 (Track 3) - [1]Map\n\n   SpeakerBio:Dongsung Kim \, IT-Secur
 ity Expert\, Truesec\n   Dongsung (Donny) Kim is a security specialist at 
 Truesec || an\n   independent software developer. His software interests v
 ary widely\n   from frontend to DevSecOps\, with research interests spanni
 ng from\n   reverse engineering to web security. Equipped with both profes
 sional\n   and academic experiences\, he wants to reconcile two seemingly 
 opposite\n   ideas: understanding user-facing software problems without\n 
   compromising security.\n   Twitter: [2]@kid1ng\n\n   Description:\n   CS
 RF is (really) dead. SameSite killed it. Browsers protect us. Lax by\n   d
 efault!\n\n   Sounds a bit too good to be true\, doesn't it? We live in a 
 world where\n   browsers get constantly updated with brand new web feature
 s and new\n   specifications. The complexity abyss is getting wider and de
 eper. How\n   do we know web technologies always play perfectly nice with 
 each\n   other? What happens when something slips?\n\n   In this talk\, I 
 focus on three intertwined web features: HTTP Cookie's\n   SameSite attrib
 ute\, PWA's Service Worker\, and Fetch. I will start by\n   taking a look 
 at how each feature works in detail. Then\, I will\n   present how the thr
 ee combined together allows CSRF to be resurrected\,\n   bypassing the Sam
 eSite's defense. Also\, I will demonstrate how a web\n   developer can eas
 ily introduce the vulnerability to their web apps\n   when utilizing popul
 ar libraries. I will end the talk by sharing the\n   complex disclosure ti
 meline and the difficulty of patching the\n   vulnerability due to the int
 erconnected nature of web specifications.\n\n   '\n\n   1. https://defcon.
 outel.org/consolidated_page.html#CaesarsAcademyBR\n   2. https://twitter.c
 om/kid1ng\n\n\n
DTEND:20220814T014500Z
DTSTART:20220814T010000Z
LOCATION:DC - Caesars Forum - Academy 401-410\, 421 (Track 3)
SUMMARY:The CSRF Resurrections! Starring the Unholy Trinity: Service Worker
  of PWA\, SameSite of HTTP Cookie\, and Fetch
END:VEVENT
END:VCALENDAR