Talks & Presentations

WordCamp Brisbane 2018

Next Event: Laracon AU
Brisbane, Australia ~ 7th – 8th November, 2024

Below you’ll find my recent conference talks and workshops, including talk notes and recordings (when available). I present talks focused on development and security, mainly in the PHP and Laravel space, but am can easily adapt my talks for any technical audience.

If you’d like me to speak at your event, please reach out and we can work out the details. I can either present in-person or in an online format. I’ve presented talks internationally, in various locations in Australia, New Zealand, Norway, and Portugal.

All of my talk recordings can be found here: YouTube Playlist.

Practical Security

AKA: Bulletproof Coding: Essential Cybersecurity

Let’s face it, it can be hard to know where to start when thinking about the security of your app – and it’s easy to overlook the little things that leave big holes. So let me share my experience auditing the security of Laravel apps, and take you through my list of top practical security tips to keep a Laravel app secure. We’ll cover the basics, configuration options, and even some advanced (but easy to follow) tips that’ll help keep your app secure.

Th1nk Lik3 a H4cker

There are plenty of guides and checklists online that teach you “security best practices”, but most of them are pointless if you don’t understand how a hacker can exploit weaknesses in your apps to break through your defences. You’ll tick the boxes and overlook the real weaknesses , leaving your app open and your users exposed.

It’s time to change that! I want to teach you to Think Like a Hacker by actually performing some hacks yourself. In this talk, we’ll assume the role of a hacker and break into a vulnerable website. Exploring how the hacker thinks at each point, and how they’d go about compromising each stage. The talk is fully interactive, you can hack everything from just a phone browser – or just come along to watch and learn. By the end, you’ll know how to spot vulnerabilities and exploit them, so you can keep your apps protected.

Passwords are Dead, Long live Passkeys!

Authentication is hard! Passwords are guessable, while SMS and app-based multi-factor authentication can be compromised. Even the promise of hardware tokens comes at a cost, being easy to lose and/or forget. Unfortunately, as developers, we’re stuck trying to solve this difficult problem: how to make authentication work without putting our users at risk. Every option appears to have downsides… but there is hope!

Passkeys are a new authentication technology that uses cryptography within the web browser to securely identify and authenticate users, automatically syncing across devices, to entirely eliminate the need for passwords. It’s like magic! We’ll learn what they are, how they work, and why they are (virtually) unhackable. Your users will love a simplified login flow, and you’ll stop worrying about account takeovers.

In Defence of PHP

PHP is, in my humble opinion, unfairly treated within the security community. Sure, there are a lot of examples of vulnerable PHP code floating around, and outdated WordPress is definitely an easy target, but modern PHP apps are secure and the PHP community does care a lot about security. So I want to take you on a journey from the early days of PHP through to now, looking at different frameworks that have come and gone and where the current state of security is in PHP. I may even defend modern WordPress… maybe…

Browsers are Magical Creatures

Web browsers are magical creatures that include A LOT of features. Buried within this multitude, you’ll find a number of security tools waiting for you, kinda like the chatty stranger in the bar, trying to flog off their wares. Although unlike that stranger, the browser lets you use them all for free, and you can use as many as you want!

You might have heard of Content Security Policies (CSP), and HTTP Strict Transport Security (HSTS), and Same-Site Cookies, or seen headers like X-Content-Type-Options and X-Frame-Options in your web server configuration. What about the confusingly named CORP, COOP, CORS and COEP, or Trusted Types, and a Permissions-Policy?

The point is, like secrets in a cave, there are a lot of security tools hidden in your browser. You won’t want or need all of them on every site, but if you’re aware of what’s available, you’ll know what you can and should enable, to add that extra layer of security to your sites. I’m just not sure they’ll help you slay that dragon though…

Vulnerability Exists Between Keyboard and Chair

When we think of our apps being hacked, we typically think of the common acronyms that cover technical vulnerabilities: XSS, CSRF, SQLi, etc. (Cross-Site Scripting, Cross-Site Request Forgery, SQL Injection, etc). While these vulnerabilities are important and we do need to be aware of how to avoid them, they aren’t the only threat we need to consider. We also need to consider the human vulnerabilities, the weaknesses that target the human between the keyboard and chair.

We will look at recent examples of social engineering, such as the attack of Twitter in 2020, and the many stories of cryptocurrency vaults being plundered through SIM-swapping. We’ll also look at password reuse, brute force attacks, and credential stuffing, and even some hardware hacks that fool victims the old-fashioned way. The common thread in all of these cases… The vulnerability existed between a keyboard and chair.

Keep Thinking Like a Hacker

What happens if a hacker breaks through your app, and gets to your server? You missed one tiny thing, and now the hacker is doing whatever they want on your server… How do you stop this from turning into a catastrophic event?

When we think about web app security, we immediately think of writing secure code, but that’s only half the story. We also need to secure our servers. We need to make sure that if a hacker breaks in, we can limit the damage they cause.

So in this talk, we’re going to assume the role of a hacker who has broken through the code, and has access to the server. We’ll go from there, hacking our way around, seeing what we have access to. While at the same time, adding layers of defence (as the site owner) to try and stop an impending catastrophic breach. The goal is to keep thinking like a hacker so we can build and deploy secure apps on all levels.

“Let’s Hack!” Workshop

Thinking like a hacker is an important step to protecting your site, it helps you identify where your vulnerabilities are and what is (and isn’t!) important.

A great way to gain the hacker mindset is to hack a site yourself, so that’s what we’re going to do in this workshop!

We’ll hack into an intentionally vulnerable WordPress site, learn why the hack works, and how to defend against it. All you need is your web browser and you’re ready to be a hacker!

Think Like a Hacker (for Laravel)

Laravel comes with many secure options enabled by default, and a bunch of helpful features that you can use to secure the rest. This helpfulness is a double-edged sword though, and you can easily begin to overlook the security implications of using specific features and end up writing insecure code without even realising it. There are plenty of guides and checklists online, such as the OWASP Top Ten, to teach you about web app security, however since a lot of people learn better by doing, we’re going to hack into a Laravel app to learn how to secure it!

We will target a vulnerable Laravel application, attacking common weaknesses and misconfigurations to compromise the app. After every attack, we will make the required changes to fix the vulnerability, and then attempt the attack again, hopefully unsuccessfully this time! The goal is to think like a hacker, learning what types of vulnerabilities exist and how they are exploited, so we can write secure code and protect our apps from attack.

SameSite Cookies Deep Dive / CSRF is dead (or is it?)

Although they’ve been around for years, SameSite cookies hadn’t gained much attention until September 2019. The Chrome team announced their plans to set ‘SameSite=Lax’ on all cookies without the SameSite attribute in Chrome 80, scheduled to release in February 2020. The rollout was delayed due to COVID-19 until July 2020, and was finally completed in August 2020. With many developers still unaware of this setting and how it works, it is still likely to catch a lot of us unawares with broken sites and weird behaviours.

In this session we will learn about the SameSite cookie attribute and why it is so important to securing your site. We’ll see why ‘Lax’ is the best default to use, and when you’d want to use ‘Strict’ and ‘None’ instead. Additionally, we will cover the edge cases and weird behaviours that can easily cause confusion and seemingly weird bugs. By the end of the session, you’ll know how to properly configure SameSite on your cookies, to ensure your site takes advantage of the security benefits without breaking expected functionality.

Think Like a Hacker and Secure WordPress, live on stage

“What could I have done to avoid being hacked?” is a question you’ll often hear after a site is hacked. In some cases the answer is complicated, but a lot of the time it’s relatively simple and there are many checklists and guides online outlining the ways sites can be hacked, plus how to secure them. However, a lot of people learn better from seeing and doing than reading (often boring) checklists. So rather than look at checklists on slides for 30 minutes, we’re going to hack into WordPress instead!

We will target a vulnerable installation of WordPress and attack the usual weaknesses to compromise the site. After every attack we perform, we will make the required changes to block the attack, and then attempt to compromise the site again, hopefully unsuccessfully this time! The goal is to think like a hacker, learning what types of vulnerabilities exist and how they are exploited, so we can better protect our sites and block hackers before they get in. By the end of the talk, we should have a secure site and an incredibly frustrated hacker.

My Year On The Front Line, Cleaning Infected Sites

Stephen has been working with the Wordfence Site Cleaning team part-time since early 2017, Fast-forward to the middle of 2018 and he’s recently stepped back from cleaning to join the Wordfence team full time as a developer, so now it’s time for him to tell us his story. He’ll share stories from the more memorable sites he’s cleaned, revealing his all-time favourite WordPress malwares, and the epic tale of the persistent attacker that almost thwarted them completely. Scattered throughout will be tips and ideas to help protect your site from compromise and keep everyone (except the bad guys!) happy.

Ansible, live on stage

  • New Zealand PHP Conference 2015

As PHP developers, we often find ourselves managing our own web servers and performing the same commands over and over again for each new server and website that we wish to deploy. We’ve heard about the benefits of tools like Puppet and Chef, but the time and effort involved in learning, setting up, and using those tools is prohibitive and we usually decide that using SSH, relying on bash history and even some helper scripts is easier than learning something new. However, there is an alternative: Ansible.