Upcoming DEF CON 32 Talk by SquareX Founder Vivek Ramachandran to Expose Critical Web Gateway Vulnerabilities
Vivek Ramachandran, founder of SquareX and former CEO of Pentester Academy (acquired by INE), will deliver a groundbreaking talk at DEF CON 32 titled “Breaking Secure Web Gateways (SWG) for Fun and Profit!” on Friday, August 9, 2024, at 5 PM PT. With over 20 years of cybersecurity experience, Ramachandran and his team will present their latest research on a new class of attacks known as “Last Mile Reassembly Attacks.”
Unveiling “Last Mile Reassembly Attacks”
These attacks bypass Secure Web Gateways (SWGs), which are integral to modern Secure Access Service Edge (SASE) and Security Service Edge (SSE) solutions. Despite the high usage of web browsers in enterprises, they remain under-protected, making them prime targets for attackers who exploit vulnerabilities during routine online activities of employees and consultants. Current SWG solutions fail to detect these sophisticated client-side threats, leaving enterprises exposed.
Groundbreaking Research and Implications
The research team at SquareX has identified architectural and vendor-agnostic vulnerabilities that affect SWGs and cloud-based proxies, rendering traditional malware and malicious website defenses ineffective. This revelation is significant for the $40 billion SASE market, as it impacts every major security vendor. The discovery of “Last Mile Reassembly Attacks” suggests that these attacks may have been active undetected for some time.
Presentation Highlights
Ramachandran will explain how these attacks work by assembling malicious payloads directly in the user’s browser, thus avoiding server-side detection. The presentation will include demonstrations of over 25 bypass methods, including chunking attacks and WASM payloads. This session aims to prompt security vendors to rethink their reliance on cloud-based detection and consider implementing client-side security measures.
Vivek Ramachandran’s Vision
“We are eager to present our findings at DEF CON 32,” said Vivek Ramachandran. “This research challenges current SASE and SSE vendors to rethink their strategies. We hope to emphasize the need for a robust client-side security approach to complement SWGs and effectively detect and mitigate web-based threats.”
About SquareX and Vivek Ramachandran
SquareX specializes in real-time detection, mitigation, and threat hunting of web attacks against enterprise users with its innovative browser-native security product. This product protects users from a wide range of web-based threats, including malicious files, websites, and compromised networks.
Vivek Ramachandran is a renowned security researcher, author, speaker, and entrepreneur with a storied career in offensive cybersecurity. He founded Pentester Academy, which was acquired in 2021, and has authored multiple highly-rated books on cybersecurity. Ramachandran has been a prominent figure at leading security conferences and has made significant contributions to the field, including the discovery of the Caffe Latte attack and the development of various Wi-Fi security tools.
DEF CON 32 Talk Details
- Event: DEF CON 32
- Date: Friday, August 9, 2024
- Time: 5 PM PT
- Topic: “Breaking Secure Web Gateways (SWG) for Fun and Profit!”
- Speakers: Vivek Ramachandran and SquareX Research Team
Join Vivek Ramachandran and the SquareX team at DEF CON 32 for an insightful session that promises to reshape the landscape of web security.
