Firefox Coding Event

Event Name: Coding for Firefox, VIIT Pune
Time: 10:00 am to 5:00 pm
Date:  19th July 2016
Venue: VIIT, Pune
Hashtags: #firefoxCoding, #firefoxstudents, #viitfirefoxclub

The VIIT Firefox Club organized an event on Firefox Coding on 19th July in Internet Lab (System Dept) VIIT.   Total 61 Computer Engineering students attended the event.

Our Goals:
A] Introduction and contributing to Mozilla
B] Getting ready for development,
C] Building Firefox,
D] Getting ready to work on your first bug,
E] Using online tools to help productivity,
F] Front end Firefox development tools

Output of the Event:

1) 2) All participants became member of VIIT Firefox Club

2) Students became familiar with Mercurial revision control system

3) Students learn how to compile source code

4) Students learned Bugzilla and bugs reporting system. 

Protect the Open Web Event

Event Name: Protect the Open Web Event.
Timings: 02:15 pm to 4:30 pm
Date:  23rd January 2016.
Place:  Vishwakarma Institute of Information Technology, Kondhwa(Bk), Pune.
Audience: 29 students of Bachelors of Computer Engineering.
Hashtags: #viitOpenWeb #privacymonth #advocate4privacy #viitfirefoxclub


Flickr :  https://www.flickr.com/photos/55210866@N05/24470940731/in/dateposted-public/
            https://www.flickr.com/photos/55210866@N05/24185470519/in/dateposted-public/

Objectives:
1) how to be safe and feel safe online
2) security features in Firefox

3) Security add-on available on AMO

Images:

= Was it worth it? =-
According to my knowledge, Yes. The audience was satisfied with the content of the event.

-= Should we go again? =-
Yes. I feel its worth the investment.

Learn about Firefox Security - CSP

Topic: Learn about Firefox Security - CSP
Venue: VIIT 
Time: 12 pm to 6:00pm
Date: 29 August 2015
Hashtag: #FirefoxSecVIIT

Flickr Link:  https://www.flickr.com/photos/55210866@N05/20865639238/in/dateposted-public/


This event aims to cover Content Security Policies (CSP). What is CSP, How to use CSP while developing a websites. UserCSP add-on introduction on AMO given to the audience. 
We also given introduction of security features available in the Firefox web browser to the participants.  In addition, we have introduce them and tested security add-ons available on the AMO.  Total 34 participants attended the event. 


Photos:

= Was it worth it? =-
According to my knowledge, Yes. The audience was satisfied with the content of the event.

Research Publications

Research Publications:

A Measurement Study of the Content Security  Policy on Real-World Applications  [PDF]
Kailas Patil and Braun Frederik
International Journal of Network Security (IJNS),
Vol.18, No.2, PP.383-392, Mar. 2016


Towards Fine-Grained Access Control in JavaScript Contexts  [PDF]
Kailas Patil, Xinshu Dong, Xiaolei Li, Zhenkai Liang, and Xuxian Jiang.
In the 31st IEEE International Conference on Distributed Computing Systems (ICDCS),
ISSN : 1063-6927
E-ISBN : 978-0-7695-4364-2
Print ISBN: 978-1-61284-384-1
DOI: 10.1109/ICDCS.2011.87


Survey on Access Control Mechanism in Android  [PDF]
Shekhar K. Shende, Kailas R. Patil
International Journal of Electrical, Electronics and Computer Systems (IJEECS),
ISSN (Online): 2347-2820, Volume -3, Issue-4 2015


Survey on Privacy Preserving Mobile Health Monitoring System using  Cloud Computing [PDF]
Abhijeet S. Kurle,  Kailas R. Patil
International Journal of Electrical, Electronics and Computer Systems (IJEECS)
ISSN (Online): 2347-2820, Volume -3, Issue-4 2015


Poster: UserCSP-User Specified Content Security Policies [PDF]
Kailas Patil, T Vyas, F Braun, M Goodwin, Z Liang
In the proceedings of the Symposium On Usable Privacy and Security (SOUPS), 2013

FxOS APP Contribution Workshop- Test, Review and Develop apps on Tarako Devices

Topic: FxOS APP Contribution Workshop- Test, Reviewhotoand Develop apps on Tarako Devices
Venue: VIIT 
Time: 12 pm to 6:00pm
Date: 22 August 2015
Hashtag: #appreviewviitpune
Flickr Link:  https://www.flickr.com/photos/55210866@N05/tags/appreviewviitpune/


This event focused on to teach audience: how to create an App using Appmaker. In addition, this event also aim to introduced Firefox Marketplace to the audience and taught them how to download and test apps from the Firefox Marketplace. 

Total 55 people participated in the event. During the event participants submitted reviews for total 31 apps available on Firefox Marketplace. After introducing the participant APPMaker, we conducted a competition for APP development. We declared four winners based on useful apps created by the participants. For all four winners we gave Mozilla FirefoxOS T-shirts and Mozilla googles. 

Output of the Event:
1) Total 26 New FSA recruited.
2) All participants became member of VIIT Firefox Club
3) Total 31 apps reviewed on Firefox Marketplace
4) Good apps are created during the event such as roller coaster, NCERT (Xth), minesweeper, Heath advisor, SE engg programing guide, etc. Participants are requested to submit it  on Marketplace after giving it a final touch and testing its functionality. 


Photos:

= Was it worth it? =-
According to my knowledge, Yes. The audience was satisfied with the content of the event.

-= Should we go again? =-
Yes. I feel its worth the investment.

Firefox Marketplace Security Related Extensions

Firefox add-ons:

Sr. No.	Name	Features
1	XSS-Me	XSS-Me is the Exploit-Me tool used to test for reflected XSS vulnerabilities.
2	noXSS	Protects user against XSS attacks Not for latest firefox 35
3	NoScript Security Suite 2.6.9.15	Allow active content to run only from sites that user trust, and protect user against XSS and Clickjacking attacks.
4	RightClickXSS 0.2.1	This addon adds a right-click menu option to insert sample XSS payloads into textboxes for security testing. Useful for security researchers or developers testing for cross-site scripting in web applications.
5	FB Phishing Protector 4.4.3	Protects user from Phishing or Scams (through XSS injection attacks) while user is on Facebook
6	ImmuniWeb® Self-Fuzzer 0.9.3	ImmuniWeb® Self-Fuzzer is a simple and free extension that fuzzes user's HTTP requests in real-time to detect SQLi and XSS vulnerabilities on a website, demonstrating how easily these 2 most common web weaknesses can be found by anyone.
7	HackBar 1.6.3	Its main purpose is to help a developer do security audits on his code. If you know what your doing, this toolbar will help you do it faster.
8	Secure Login 1.0.6	Secure Login is an extension for Firefox integrated password manager. Prevents malicious JavaScript code to automatically steal your login data. Provides an option to protect your login data from all JavaScript code during login. Websites requiring JavaScript for the login process can be added to an exception list. Can prevent cross-site scripting (XSS) attacks to steal your passwords without having to deactivate JavaScript.
9	Karma Blocker 0.4.8	Especially useful for blocking third-party resources to help combat privacy leaks (cookies) and security problems (XSS).
10	Netcraft Toolbar 1.10.1	Blocks phishing sites, helping to protect users from online fraud • Detailed site reports –the extension displays a wealth of information about the sites you visit, helping you to make informed choices about their integrity. • Risk Ratings – we evaluate the characteristics of the site and compare these against those depicted by fraudulent sites. The result is a simple visual summary displayed on the site report. • Protection against cross site scripting (XSS) – The extension optionally traps XSS and other suspicious URLs which contain characters with no purpose other than to deceive.
11	X-Forwarded-For Spoofer 1.0.2	With this add-on, you can assign an arbitrary IP address to the X-Forwarded-For field, attempt to perform XSS by including HTML in this field, or even attempt SQL injection. Not available for firefox 35.0
12	HTTP Content Security Policy Detector 0.78	It scrutinizes the HTTP Response Headers for the presence of X-Content-Security-Policy.
13	SiteCheck extension for Firefox 1.0.3	Scan any website for security issues, blacklisting, and malware with Sucuri SiteCheck
14	Clickjacking Reveal 1.1	This extension tries to warn you if it found clickjacking technique on the page you are viewing.
15	Clickjacking Defense - Declarative Sec Detector 0.77	It scrutinizes the HTTP Response Headers for the presence of X-Frame-Options Header
16	Policeman 0.18.1	Policeman gives you precise control over what web requests are allowed. Create rules based on domain name and type of resource being requested. It can also be used to improve privacy or block cross-site scripts.
17	XSSed Search 20101014	Search the cross-site scripting database at XSSed.Com
18	Remove Cookie(s) for Site 0.63	A very simple extension to remove all the cookies of currently opened site. It adds an option to the Right Click menu of the page, and a Clear Cookies Button to perform this operation. It displays the status of operation in the status bar
19	Simple Site Blocker 1.1	A simple site blocker with whitelist features.
20	Controle de Scripts 1.0.3	Controle de Scripts is an extension that allows you to control what JavaScripts do on your browser. It adds extra settings to your browser preferences window, improving its native JavaScript control interface.
21	CSRF Finder 1.2	CSRF Finder captures http request and looks csrf vulnerability
22	RequestPolicy 0.5.28	Be in control of which cross-site requests are allowed. Improve the privacy of your browsing by not letting other sites know your browsing habits. Secure yourself from Cross-Site Request Forgery (CSRF) and other attacks.
23	CsFire 1.0.8	CsFire autonomously protects you against dangerous or malicious cross-domain requests, such as Cross-Site Request Forgery (CSRF). CSRF is very prevalent and dangerous, as stated by the OWASP top 10, as well as the CWE/SANS top 25 programming errors.
24	Self-Destructing Cookies 0.4.7	Fix the web. Gets rid of a site's cookies and LocalStorage as soon as you close its tabs. Protects against trackers and zombie-cookies. Trustworthy services can be whitelisted.
25	SQL Inject Me 0.4.7	SQL Injection vulnerabilites can cause a lot of damage to a web application. A malicious user can possibly view records, delete records, drop tables or gain access to your server. SQL Inject-Me is Firefox Extension used to test for SQL Injection vulnerabilities.
26	SecurityFocus Vulnerabilities search plugin 20091001	This plugin lets you search on Security Focus Vulnerabilities.
27	SurfPatrol 1.2.1	SurfPatrol invisibly scans your browser and signals to you if any vulnerability in Firefox or its plugin is found. Notifications are displayed on the browser’s toolbar.
28	Heartbleed Monitor 0.2.1	A Firefox add-on to notify you when you visit a webpage vulnerable to Heartbleed
29	PunkSPIDER 1.0	Displays web vulnerability information from PunkSPIDER about the site you're currently visiting. PunkSPIDER is an open source project that scans the entire Internet for web vulnerabilities and provides the results free and open to the public.

Network Security Awareness Event

Topic: Network and Wireless Security
Venue: VIIT E&TC Dept
Time: 10:30 am to 12:30pm
Date: 9th March 2015

We conducted Network and Wireless security awareness event in E&TC dept of VIIT. Final year (BE) elex students were the attendees of the event.

I explain basic of network security and properties of security such as confidentiality, integrity, authentication, and availability.

Siddharth Rao demonstrated WPA2 password hacking technique and email credential harvesting using phishing site. Then he explained how to countermeasure these hacks.

Photos: