Penetration testing helps organizations to quickly identify gaps in their security and detection capabilities that a real-world adversary could use to compromise a targeted environment. The most successful assessments are always the ones in which you can fully engage the customer in your activities. Some in the cybersecurity industry refer to this as Purple Teaming (Red team + Blue team = Purple team). In ICS, the capabilities of the Blue team can vary wildly depending on the level of maturity of the organization. Some customers we work with are able to detect our attacks in real-time and we work with them to fine-tune their ICS detection capabilities. Other customers lack capabilities and are interested in finding as many problems as possible in an effort to secure remediation budget. These teams often join our red team and help provide insider information to maximize our findings. At the very least, constant communication with the customer about what activities are going on and setting the expectation up front that they will be part of the assessment and critical to its success is very important. Customers (usually) understand their network far better than we possibly could within the span of a 1-week engagement, so recruiting them into your penetration testing team is very important. Customers enjoy the experience of taking an adversarial view of their own network and the opportunity to learn from ICS penetration testing experts. Building trust and a stronger customer relationship is often a byproduct of assessment work. In my presentation, I will share some stories about our experience performing assessments and penetration tests against the ICS networks of fortune 500 companies (names have been changed to protect the innocent) and empathize the importance of a collaborative approach to ICS assessments rather than an adversarial one.
Malware analysis sanboxes are pervading our IT environments and the internet as well. So, a lot of systems are available to be used and may be abused. Let's have a look on what we can get there and get your own tools ready to express yourself in this field.
SCADA: What the next Stuxnet will look like and how to prevent it
August 10, 2019 12:30 PM
In 2019, almost a decade after the famed Stuxnet worm silently wreaked havoc on an Iranian uranium enrichment plant, SCADA vendors still have gaping holes in their PLC and HMI development environments. Our new research into 4 different PLC vendor software systems details an almost negligent lack of security standards in modern SCADA environments. This lack of security creates great opportunity for future attackers and the next high-profile attack on industrial control systems. The attack scenario cannot be understated as critical systems such as power, water, transportation, and manufacturing all rely on major PLC vendors in one way or another . We will show a theoretical attack that could have happened using recently discovered vulnerabilities and proof of concept code to disrupt a major power industrial system. We share our observations on vulnerabilities found in vendors across the board and mitigation techniques for using these required software in highly critical environments where even air-gapping is not enough to remove the threat of a remote attacker.
Speaker Information
Panelist Information
Tenable
Before joining Tenable in 2014, Joseph worked at Symantec doing malware reverse engineering. Since joining Tenable as a reverse engineer, Joseph has developed low-level protocol functionality for Nessus, analyzed different classes of remote code execution vulnerabilities, and written many remote exploitation plugins. He has presented at VirusBulletin and BSides and has produced several publications on malware, exploitation, and reverse engineering.
Return to Index - Add to
- ics
Calendar file
CLV - Flamingo 3rd Floor - Reno I Room - Saturday - 14:30-15:10
Scaling Security in the Cloud With Open Source
Speaker: James Strassburg
Twitter: @jstrassburg
Abstract: The programmability of the cloud has revolutionized infrastructure deployments at scale and, at the same time, has enabled the automation of both the attack and defense of these deployments. In this talk, I will discuss the open-source tools and the techniques that my organization has used to scale security in the cloud to keep pace with our deployments. I'll also cover how we've used automation to adapt security processes to cloud strategies such as immutable servers. Some topics include: temporal leasing of API access keys and database credentials, automation of patching groups and scans, and automated enforcement of configuration policy.
About James: James Strassburg is an experienced software engineer, architect, researcher, and speaker. He has been building distributed software systems and web applications for the past 20 years. Most recently specializing in cloud migration and search engineering, he is an automation fanatic who has also worked on systems engineering, full-stack development, information security, artificial intelligence (AI), and DevOps, and has spoken on several related topics.
Return to Index - Add to
- ics
Calendar file
WS - Flamingo - Lower Level - Lake Mead I - Saturday - 14:30-18:30
scapy_dojo_v_1
Saturday, 1430-1830 in Flamingo, Lake Mead I
Hugo Trovao Hacker
Rushikesh D. Nandedkar Engineer, FireEye Inc.
The workshop aims towards making beginners aware and comfortable with various facets of Scapy and its real time usages in various task of penetration testing.
The flow of workshop will be as under:
1. Scapy basics
2. TCP Basics
3. DHCP server
4. DHCP server flooder || DNS/MDNS
5. Crafting a layer using Scapy
6. Fuzzing protocols with Scapy
7. Covert channel using Scapy
8. Scapy-radio
Added value to the workshop:
What attendees will learn:
- sending/receiving/displaying/modifying packets with Scapy
- implementing custom layers in Scapy
- implement answerMachines in Scapy
- to construct tools implementing some real life examples
- simple fuzzing through Scapy and generators
- to decode live traffic with an implemented protocol
Working in Scapy consequently attendees will learn:
- TCP basics
- DHCP/DNS/MDNS basics
- AJP13 protocol
- fuzzing
- Scapy-radio
+
Prebuilt VM containing all scripts and dependencies in place.
An ISO in progress can be found at:
https://drive.google.com/open?id=1wJ9OQOAnew3upyoFdMUz1hlo0WEuogJW
(/root contains install script. /src contains scripts. python-netaddr dependency needs to be installed manually as of now with apt.)
Skill Level Beginner
Prerequisites: Basics of Python scripting and networks.
Materials: For Windows users:
1. Virtualbox installed
2. Administrator privileges
3. 4GB+ RAM
4. 50 GB free space
For *nix users:
1. Virtaulbox installed (optional)
2. Root privileges
3. 4GB+ RAM
4. 50 GB free space
(In case *nix users do not want to use Virtualbox, they can run scripts directly on their boxes, provided Python and Scapy is installed there.)
Max students: 26
Registration: https://www.eventbrite.com/e/scapy-dojo-v-1-lake-mead-i-tickets-63439609580
(Opens 8-Jul-19)
Hugo Trovao
Hugo is a computer enthusiast since he was a kid and always curious to know how things worked. He liked everything related to computers. He's a researcher by passion, consultant by job and penetration tester by heart. He finds himself at peace while poking holes in applications/networks/systems, while writing security tools tailored to the assessments requirement and indeed while meditating. Always wants to known a better more efficient way of doing things.
Rushikesh D. Nandedkar
Rushikesh is an engineer at FireEye Inc. Having more than six years of experience under his belt, his assignments have always been pointed towards reducing the state of insecurity for information. His research papers were accepted at NCACNS 2013, nullcon '14 & '18, HITCON '14, Defcamp '14, BruCON '15 '16 '17 '18, DEFCON 24, x33fcon '17 & '18, c0c0n-X '17, Bsides Delhi '17, BlackHat USA '18, DEFCON 26 + Co-author of "DECEPTICON," an intelligent evil-twin. Being an avid CTF player, for him, solace is messing up with packets, frames, and shellcodes.
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Saturday - 12:30-12:59
Title:
Scrubber: An open source compilation to protect journalistic sources - Ethan Gregory Dodge
ABSTRACT
We've all heard the unfortunate events that lead the imprisonment of whistleblower Reality Winner. The protection of sources has been a challenge for journalists since the birth of the trade, but it's become even more difficult in the age of document leaks. With fingerprints, watermarks, exif data, etc, there seems to be an infinite number of ways that a document could be linked back to the source and seemingly equal is the number of ways to "scrub" them.
To help others navigate these waters, the Truth & Transparency Foundation (TTF), the non profit newsroom behind MormonLeaks and FaithLeaks, has developed Scrubber, a script written over the years of the TTF's existence that automates the "scrubbing" of sensitive documents to be released to the public. Building on top of dozens of other open source projects, Scrubber can be run on any platform and will help any journalist or activist implement consistency in the cleaning of their files. While there is no silver bullet, Scrubber lays a great foundation.
BIO
Ethan Gregory Dodge started his career as a cyber-security engineer in Silicon Valley. His understanding of security naturally flowered into a deep passion for privacy and he slowly found himself following journalists uncovering the state of surveillance in the United States. In early 2016, he experienced a drastic change of world view when he abandoned the orthodox Mormon belief system he was raised with. Despite having left the religion, Ethan has found the culture of Mormonism to be important to his identity. He continues studying the religious movement's history and progression as a secular Mormon. In late 2016, he was a founding member of the MormonLeaks.io team where his loves of transparency and Mormonism intersected. A year later, he co-founded the Truth & Transparency Foundation, a non-profit newsroom dedicated to empowering the disenfranchised by promoting transparency within religious institutions. He holds a bachelor's degree in Information Technology from Utah Valley University and enjoys learning and writing about where his interests of technology, security, privacy, and religion intersect.
Return to Index - Add to
- ics
Calendar file
BCV - Flamingo 3rd Floor - Laughlin III Room - Saturday - 12:00-12:50
Secrets Worlds in Plain Web. The BlockChain DNS.
No description available
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Saturday - 14:00-15:30
Title:
Securing America: How DHS, States, and Cybersecurity Startups are Working Together Before the 2020 Presidential Election
2:00 PM Securing America: How DHS, States, and Cybersecurity Startups are Working Together Before the 2020 Presidential Election
Alissa Starzak, Head of Policy, Cloudflare
Jay Kaplan, Co-Founder and CEO, Synack
Rita Gass, CIO, California Secretary of States Office
Trevor Timmons, CIO, Colorado Secretary of States Office
Wayne Thorley, Deputy Secretary for Elections, Nevada Secretary of States Office
Josh Benaloh, Senior Cryptographer, Microsoft Research
Alex Joves, Regional Director, Region V, Department of Homeland Security Cybersecurity and Infrastructure Security Agency
Joseph Marks (moderator), Reporter, The Washington Post
Return to Index - Add to
- ics
Calendar file
BCV - Flamingo 3rd Floor - Laughlin III Room - Saturday - 11:35-11:59
Securing the Unknown: A Methodology for Auditing Smart Contracts
No description available
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Saturday - 16:30-16:59
Title:
Securing Voting Systems (Beyond Paper Ballots!)
4:30 PM Securing Voting Systems (Beyond Paper Ballots!)
Tod Beardsley, Director of Research, Rapid7
Return to Index - Add to
- ics
Calendar file
AIV - Bally's Resort (Indigo) Tower 26th Floor - Skyview Room 3 - end - Saturday - 14:00-14:30
Securing your kubeflow clusters
No description available
Return to Index - Add to
- ics
Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Saturday - 14:30-14:59
Security to Make the CFO Happy
Adam, Engineer
As a security professional you're hungry to learn everything you can but training isn't quite free. Meanwhile, your boss, and the bosses in a bunch of other business units are fretting all they can about DoD 8570, just one more "unfunded mandate". How does anyone justify the cost of these nonfunctional requirements? This talk will draw some indirect lines in the org chart and cite documentation in various parts of a company to show how training can be a win for the entire organization.
Adam is an engineer. Several years ago, Adam's program got whacked with the compliance stick. If Adam wanted to fly he had to comply. In an odd turn of events, Adam found that all this security compliance made him level-up his systems engineering game. After satisfying a number of security "one-offs", Adam started to realize where non-engineers had strengths and willingness to bolster his program's overall security. As a lonely security engineer in a feature-driven world he credits the infosec community for providing so much "professional development". He is happy to show engineers how fun (less painful?) security can be. Tragically, he has yet to meet anyone who can wrestle failed vuln scanners as well as he can - but he knows that special someone is out there.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 1 - Saturday - 14:00-14:45
SELECT code_execution FROM * USING SQLite;—Gaining code execution using a malicious SQLite database
Saturday at 14:00 in Track 1
45 minutes | Demo, Tool, Exploit
Omer Gull Security Researcher at Check Point Software Technologies
Everyone knows that databases are the crown jewels from a hacker's point of view, but what if you could use a database as the hacking tool itself? We discovered that simply querying a malicious SQLite database - can lead to Remote Code Execution. We used undocumented SQLite3 behavior and memory corruption vulnerabilities to take advantage of the assumption that querying a database is safe.
How? We created a rogue SQLite database that exploits the software used to open it.Exploring only a few of the possibilities this presents we’ll pwn password stealer backends while they parse credentials files and achieve iOS persistency by replacing its Contacts database…
The landscape is endless (Hint: Did someone say Windows 10 0-day?). This is extremely terrifying since SQLite3 is now practically built-in to any modern system.
In our talk we also discuss the SQLite internals and our novel approach for abusing them. We had to invent our own ROP chain technique using nothing but SQL CREATE statements. We used JOIN statements for Heap Spray and SELECT subqueries for x64 pointer unpacking and arithmetics. It's a new world of using the familiar Structured Query Language for exploitation primitives,laying the foundations for a generic leverage of memory corruption issues in database engines.
Omer Gull
Omer Gull is a vulnerability researcher in the Malware and Vulnerability Research group at Check Point Software Technologies.
Omer has a diverse background in security research, that includes web application penetration testing, RE and exploitation.
He loves Rum, Old School Hip-Hop and Memory Corruptions.
Twitter: @GullOmer
Return to Index - Add to
- ics
Calendar file
SKY - Bally's Jubilee Tower - 2nd Floor - Jubilee Ballroom - Saturday - 18:00-18:59
Sex & Drugs Go Great Together: Hashtags and Harm Reduction
August 10, 2019
18:00
-
19:00
Bally's, Jubilee Tower - Pacific BR - 2nd Floor
Maggie Mayhem
Between SESTA/FOSTA, the opioid crisis, and the increased corporatization of the Internet, an increasing number of web platforms are cracking down on online communities responsible for disseminating life saving information to sex workers and drug users. Though the stated goal of this censorship is safety, the outcomes reflect anything but that. The suppression of evidence based harm reduction efforts reflects anti-science attitudes in favor of moralistic thinking and produces web services that better serve advertisers than users. This talk will discuss the importance of preserving sex worker and drug user speech online and explain why the #NodSquad, #TweakerNation, and sex workers are in the best position to utilize social media as a peer based platform to save lives at a time when the stakes are at their highest.
NOTE: This talk will touch on subjects that may be triggers for some individuals including human trafficking and drug overdose.
SKYTALKS NOTE: This talk is intended for an 18 and older audience. Please use your own discretion when bringing minors.
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 6 - Saturday - 14:00 - 15:50
Shadow Workers: Backdooring with Service Workers
Saturday from 14:00 – 15:50 in Sunset 6 at Planet Hollywood
Audience: Offensive Security, AppSec
Emmanuel Law & Claudio Contin
This presentation is focused around Shadow Workers, a tool that came out of our research on service workers. Service Workers are a new addition to modern browser and often used to extend offline capabilities to a website. With this tool, we weaponized service workers to include the ability to implant a pseudo backdoor in the browser and ghost through a victim's browser session to sniff, manipulate, and even proxy data silently. We'll demo the various persistence mechanisms our tool provides to keep service workers alive and demo how MITM can be done at the browser layer.
https://github.com/shadow-workers/shadow-workers
Emmanuel Law
Emmanuel Law (@libnex) is currently a security engineer in the Bay Area. He spends his free time researching news ways to break stuff and has presented at various international conferences such as Black Hat Arsenal, Ruxcon, Kiwicon, Troopers etc.
Claudio Contin
Claudio Contin (@claudiocontin) is a security consultant with ZX Security in Wellington, New Zealand. Before working in security, he spent several years developing web applications. He has presented at Bsides SF, Kiwicon and OWASP conferences. During his free time, he contributed to various open-source projects such as BEeF framework and Gophish.
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 5 - Saturday - 14:00 - 15:50
Shellcode Compiler
Saturday from 14:00 – 15:50 in Sunset 5 at Planet Hollywood
Audience: Anyone interested in shellcode development
Ionut Popescu
Shellcode Compiler is a program that compiles C/C++ style code into a small, position-independent and NULL-free shellcode for Windows and Linux. It is possible to call any Windows API function or Linux syscall in a user-friendly way. The tool allows users to write custom shellcodes by providing an easy way to call functions or system calls. It does not have all the capabilities of a compiler, but it simplifies a lot the shellcode development process. There is no need to write assembler, it is only required to declare and call functions or system calls. Under the hood there is, of course, a custom compiler which compiles C/C++ style code into ASM which is later assembled using Keystone framework. Before the tool presentation, we will go into a deep dive on the shellcode development process for both Windows and Linux (32 bits only to keep it short and simple).
https://github.com/NytroRST/ShellcodeCompiler
Ionut Popescu
Ionut Popescu works as a Product Security Engineer for UiPath. His focus lies on web application penetration testing, source code review, security architecture review and providing security trainings. In his free time, he also likes to do research focusing on Windows internals, ASM and exploit development. Ionut is a regular speaker at different conferences, e.g. Defcon, Defcamp or OWASP.
Return to Index - Add to
- ics
Calendar file
RTV - Flamingo 3rd Floor - Laughlin I,II Rooms - Saturday - 09:00-09:59
SiestaTime, A Red Team Automation Tool for Generation of Long-term Implants and Infrastructure Deployment
Red Team operations require substantial efforts to both create implants and a resilient C2 infrastructure. SiestaTime aims to merge these ideas into a tool with an easy-to-use GUI, which facilitates implant and infrastructure automation. SiestaTime allows operators to provide registrar, SaaS and VPS credentials in order to deploy a resilient and ready to use Red Team infrastructure in less than five minutes. The generated implants will blend-in as legitimate traffic by communicating to the infrastructure using SaaS channels (e.g. GMail, Twitter). Use your VPS/Domains battery to deploy staging servers and inject your favorite shellcode for interactive sessions, clone sites and hide your implants ready to be downloaded, deploy more redirectors if they get busted‚ SiestaTime is built entirely in Golang, with the ability to generate Implants for multiple platforms, interact with different OS resources, and perform efficient C2 communications. Terraform will help to deploy/destroy different Infrastructure.
About Alvaro Folgado: Rebujacker works as a Product Security Engineer at Salesforce. He has multiple years of experience performing penetration tests, security assessment against different technologies, building automation tools for this purpose and performing application level researches. In the recent years his field of study has been focused into red teaming and automation. The combination of his application level and offensive security knowledge leads him to build better and stealthier implants that blends-in with nowadays cloud infrastructure and application stack of targeted organizations. Twitter: @rebujacker
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 4 - Saturday - 14:00 - 15:50
SILENTTRINITY
Saturday from 14:00 – 15:50 in Sunset 4 at Planet Hollywood
Audience: Offense
Marcello Salvati
SILENTTRINITY is an asynchronous post-exploitation agent powered by Python, IronPython, C# and .NET's DLR (Dynamic Language Runtime), it attempts to weaponize and demonstrate the flexibility that BYOI (Bring Your Own Interpreter) payloads have over traditional C# implants. What are BYOI payloads? Turns out by harnessing the sheer craziness of the .NET framework, you can embed entire interpreters inside of .NET languages allowing you to natively execute scripts written in third-party languages (like Python) on windows! Not only does this allow you to dynamically access all of the .NET API from a scripting language of your choosing, but it also allows you to still remain completely in memory and has a number of advantages over traditional C# payloads! Essentially, BYOI payloads allow you to have all the "power" of PowerShell, without going through PowerShell in anyway! Additionally, you can nest multiple interpreters within each other to perform what I've coined "engine inception"! If you're interested in bleeding-edge and out of the ordinary C#/.NET offensive trade-craft, this is the demo for you!
https://github.com/byt3bl33d3r/SILENTTRINITY
Marcello Salvati
Marcello Salvati (@byt3bl33d3r) is a Security Analyst at BlackHills Information Security by day and by night a tool developer who discovered a novel technique to turn tea, sushi, alcohol and dank memes into somewhat functioning code. His passions include anything Active Directory related, trolling people on GitHub and developing open-source tools for the security community at large which he’s been doing for the past several years, some of his projects include SilentTrinity, CrackMapExec, DeathStar, RedBaron and many more.
Return to Index - Add to
- ics
Calendar file
BCV - Flamingo 3rd Floor - Laughlin III Room - Saturday - 16:10-17:59
Smashing Smart Contracts: Detecting and Exploiting Vulnerabilities in EVM bytecode
No description available
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Saturday - 17:30-17:59
Title:
Snoop all Telegram messages - Vitor Ventura
ABSTRACT
Privacy is important for all kinds of people no matter what business or social status they are in. One of the cornerstones of privacy in our days is the secure messaging applications like Telegram, which deploy end-to-end encryption to protect the communications. At the same time these kind of applications have become so important that bug buying companies are now paying up to $500,000 for exploits on these platforms or just $15,000 for information disclosure exploits. It is no news that Telegram has been targeted by several intelligence agencies to allow the interception of messages. Several clone applications have been created and distributed with the intent of spying on their users. Telegram however, can be abused allowing the message interception on non-rooted Android device and without replacing the official application.
BIO
Vitor Ventura is a Cisco Talos security researcher. Has a researcher, he investigated and published various articles on emerging threats. Most of the days Vitor is hunting for threats, investigating, them reversing code but also looking for the geopolitical and/or economic context that better suits them. Vitor has been a speaker in conferences, like Recon and BSides Lisbon among others.
Prior to that he was IBM X-Force IRIS European manager where he was lead responder on several high profile organizations affected by the WannaCry and NotPetya infections, helping to determine the extent of the damage and to define the recovery path. Before that he did penetration testing at IBM X-Force Red, where Vitor lead flagship projects like Connected Car assessments and Oil and Gas ICS security assessments, custom mobile devices among other IoT security projects. Vitor holds multiple security related certifications like GREM (GIAC Reverse Engineer Malware), CISM (Certified Information Security Manager).
Return to Index - Add to
- ics
Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Saturday - 11:00-11:59
Solving Crimes with Wireless GeoFencing and Multi-Zone Correlation Analytics
Gleb Esman, Senior Project Manager, Fraud Analytics and Research at Splunk Inc.
The presentation will introduce viewer to geofencing - the technique successfully used by law enforcement agencies to pinpoint suspects in an array of anonymous metadata coming from wireless devices. The presentation will teach viewer how to build such system from scratch using freely downloadable analytical tools. Different ways to visually define GeoFencing zones and investigation constraints will be explained. Samples of working scripts, search queries, data formats and working dashboard layouts will be provided.
Gleb Esman (Twitter: @gesman) helps to guide research, product planning and development efforts in the areas of fraud detection, data security analytics and investigations at Splunk Inc. Currently Gleb manages number of security projects in healthcare space such as drugs and opioids diversion platform and healthcare privacy monitoring platform. Before Splunk Gleb was engaged at Morgan Stanley overseeing fraud detection platform and enterprise wide data analytics systems within retail banking space. During his career, Gleb worked in a various positions at a number of enterprises involved in research and development of solutions against advanced malware and computer viruses as well as solutions for secure payments and data protection in e-commerce space. Gleb is an author of several patents in Deep Learning, Security, Behavior Biometrics and Healthcare Data Analytics.
Return to Index - Add to
- ics
Calendar file
BHV - Planet Hollywood - Melrose 1-3 Rooms - Saturday - 10:15-10:59
10:15 AM: Spectra: Open Biomedical Imaging
Speaker: Jean Rintoul
Abstract: Biomedical Imaging has previously been expensive and near impossible to hack and experiment with. If more people experimented and understood how imaging works we could move it forward much faster and make these transformative technologies available to everyone. In this talk I'll present Spectra: a tiny 2" device that uses safe levels of AC current to recreate an image of any conductive material such as your lungs, arm or head, using the same tomographic reconstruction technique as a cat scan.
Speaker Bio: Jean Rintoul wants to push forward a health technology commons. Previous experiences include bringing consumer electronic biosensor products to market from the Emotiv BCI to the Basis watch and Kiddo biosensor watch, and being published for her work in Cognitive Neuroscience in Nature.
T:
@jeantoul
Return to Index - Add to
- ics
Calendar file
IOT - Flamingo 3rd Floor - Eldorado Ballroom - Saturday - 16:15-16:59
"Over the last 2 years we've analyzed and reverse-engineered a plethora of IoT-enabled surveillance cameras and spy cameras analyzing their app behaviors, cloud storage, network communications, data-at-rest, and hardware. In this spy vs. spy presentation, we reveal the unforeseen dark side of using these devices and their full capabilities. Wired and wireless packet captures will be analyzed, as well as the use of open source tools for anomalous behavior analysis substantiating the risks surrounding these devices. We then outline methods for fortifying their deployment and minimizing unwanted eavesdroppers. Remember that spy camera you just plugged in, maybe the method by which someone else is spying on you.
"
Bio:
Michael T. Raggo, Chief Security Officer, 802 Secure has over 20 years of security research experience currently focusing on IoT threats impacting the enterprise. Michael is the author of “Mobile Data Loss: Threats & Countermeasures” and “Data Hiding” for Syngress Books. A former security trainer, Michael has briefed the FBI and Pentagon; and is a frequent presenter at security conferences including Black Hat, DEF CON, Gartner, RSA, HackCon, and SANS.
Chet Hosmer - Founder, Python Forensics, Inc. - Present Focus - collaborative development of open source investigative technologies using Python and other scripting languages. Research and Development of forensics, digital investigation and steganography for 20+ years. Public Speaker on emerging cyber threats including: National Public Radio's Kojo Nnamdi show, ABC's Primetime Thursday, and ABC News Australia. Frequent contributor to technical and news stories relating to cyber security and forensics with IEEE, The New York Times, The Washington Post, Government Computer News, Salon.com and Wired Magazine.
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 4 - Saturday - 10:00 - 11:50
Srujan: Safer Networks for Smart Homes
Saturday from 10:00 – 11:50 in Sunset 4 at Planet Hollywood
Audience: Defense, Network, Hardware, IOT Security
Sanket Karpe & Parmanand Mishra
Srujan is a new type of network segregation system, based on Raspberry Pi, that can be easily deployed on home networks. It allows home users to segregate the devices connecting to their home networks based on the threat profile. User can keep their smart home devices separate from their computers and mobile devices to mitigate risk of cross infection from low-trust devices like smart cameras, speakers and thermostats. Srujan was created to address the challenges around the plethora of IOT devices being deployed in smart homes that are vulnerable and do not receive patches. Srujan can intelligently segregate the home network into different zones based on the device type. It automatically identifies and alerts users when the IOT devices attempt to contact any IP or domain which has been blacklisted by Google Safe Browsing.
Srujan provides the following features:
-- Intelligent segregation of devices based on their type
-- Ability to create network usage stats for each device
-- Ability to quarantine untrusted devices
-- Easy to integrate with SIEM
-- Ability to lookup IP/Domain against Google Safe Browsing.
-- Integration with ANWI (All New Wireless IDS)
-- Prevent call-home pings to manufacturer for enhanced privacy.
Sanket Karpe
Sanket Karpe is a security researcher with over decade of experience on reverse engineering malware and incident response. He is currently working as a Manager, Malware Research at Qualys Inc where his primary responsibilities include malware analysis, creating new malware detection techniques and tools development. He is the author for ANWI - All New Wireless IDS and likes to work on various IOT projects in his free time.
Parmanand Mishra
Parmanand Mishra is a security enthusiast who is currently working as Senior Malware Researcher at Qualys Inc. He works on malware analysis and adversary simulation based on ATT&CK and loves creating tools on the same. He has spoken at security conferences like c0c0n and goes by Kart1keya on Github.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 4 - Saturday - 13:00-13:45
SSO Wars: The Token Menace
Saturday at 13:00 in Track 4
45 minutes | Demo, Tool, Exploit
Alvaro Muñoz Software Security Researcher @ Fortify (Micro Focus)
Oleksandr Mirosh Software Security Researcher @ Fortify (Micro Focus)
It is the year 2019. Humanity has almost won its long-standing war against Single-Sign On (SSO) bugs. The last of them were discovered and eradicated some time ago and the world is now living in an era of prosperity while the Auth Federation enjoys peaceful CVE-free times. However, while things seem to be running smoothly, new bugs are brewing at the core of major implementation libraries. This is probably the last chance for the evil empire to launch a world scale attack against the Auth Federation.
In this talk, we will present two new techniques:
- 1) A new breed of SAML implementation flaws that break XML signature validation and enable arbitrary modification of the SAML assertion, which enables attackers to authenticate as arbitrary users or grant themselves arbitrary authorization claims. Although any implementation may be affected by this flaw, we will show how it affects Microsoft Windows Identity Framework (WIF) applications, Windows Communication Foundation (WCF) web services, and flagship products such as SharePoint and Exchange Servers.
- 2) A bug in the .NET crypto library, which may allow attackers to gain Remote Code Execution (RCE) or Denial of Service (DoS) depending on the availability of code gadgets in the target server.
A new tool to detect this type of vulnerability will also be discussed and released.
Alvaro Muñoz
Alvaro Muñoz (@pwntester) is Principal Security Researcher at Micro Focus Fortify where he researches new software vulnerabilities and implement systems to detect them. His research focuses on web application frameworks where he looks for vulnerabilities or unsafe uses of APIs. Before joining the research team, he worked as an Application Security Consultant helping enterprises to deploy application security programs. Muñoz has presented at many Security conferences including BlackHat, DEF CON, RSA, OWASP AppSec US & EU, JavaOne, etc and holds several infosec certifications, including OSCP, GWAPT and CISSP. He plays CTFs with Spanish int3pids team and blogs at http://www.pwntester.com.
Twitter: @pwntester
Website: http://www.pwntester.com
Oleksandr Mirosh
Oleksandr Mirosh has over 11 years of computer security experience, including vulnerability research, penetration testing, reverse engineering, fuzzing, developing exploits and consulting. He is working for Fortify Software Security Research team in Micro Focus investigating and analyzing new threats, vulnerabilities, security weaknesses, new techniques of exploiting security issues and development vulnerability detection, protection and remediation rules. In the past, he has performed a wide variety of security assessments, including design and code reviews, threat modelling, testing and fuzzing in order to identify and remove any existing or potentially emerging security defects in the software of various customers.
Twitter: @olekmirosh
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 3 - Saturday - 15:00-15:45
State of DNS Rebinding - Attack & Prevention Techniques and the Singularity of Origin
Saturday at 15:00 in Track 3
45 minutes | Demo, Tool
Gerald Doussot Principal
Security Consultant, NCC Group
Roger Meyer Principal
Security Consultant, NCC Group
Do you want to know how you can exploit DNS rebinding 10x faster, bypass prevention mechanisms, interactively browse the victim's internal network, and automate the whole process during your next red team exercise?
This talk will teach you how and give you an easy-to-use tool to do it.
First, we will cover in detail the subtleties that make DNS rebinding attacks more effective in practice, including techniques and operational conditions that make it faster and more reliable. We'll also explain how to bypass commonly recommended security controls, dispelling attack and defense misconceptions that have been disseminated in blogs and social media posts.
This talk will include a number of demos using Singularity, our open source DNS rebinding attack framework that includes all the parts you need to get started pwning today, including:
- Remote code execution and exfiltration payloads for common dev tools and software
- Practical scanning and automation techniques to maximize the chance of controlling targeted services
We'll also show an interesting post-exploitation technique that allows you to browse a victim browser network environment via the attacker's browser without the use of HTTP proxies.
You'll leave this talk with the knowledge and tools to immediately start finding and exploiting DNS rebinding bugs.
Gerald Doussot
Gerald Doussot is a Principal Security Consultant at NCC Group, with over 20 years experience in information technology. Gerald has undertaken defensive and offensive security roles, including the design, implementation and management of security solutions, software development, integration and security Testing.
Roger Meyer
Roger Meyer is a Principal Security Engineer at NCC Group with extensive experience in managing and leading complex engagements. Roger specializes in web application security, network penetration testing, configuration reviews, and secure software development and architecture design.
Return to Index - Add to
- ics
Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Saturday - 17:00-17:59
State Sponsored Hacking: How to Intercept/Decrypt TLS Traffic and How to Prevent TLS Interception Attacks
Chris Hanlon, Agile Data Security Ltd.
Recent reports of the Global DNS Hijacking Campaign campaign show state sponsored attackers using Man In The Middle attacks to generate fraudulent TLS certificates and intercept web traffic. In this presentation, we show the audience how they can perform similar attacks and use the certificates to intercept web traffic, emails or their coworker's VPN credentials. After demonstrating ways to trick 3 different certificate authorities into generate fraudulent TLS certificates, we explain simple ways to prevent these attacks.
Chris Hanlon (Twitter: @ChrisHanlonCA) runs an Information Security Consulting Business where he monitors and protects Endpoints, Routers, Servers, and Cloud Systems. In addition to protecting infrastructure, Chris also coaches software companies on ways to minimize vulnerabilities in their code, and reduce their vulnerability to social engineering attacks. During his "free time", Chris finds/reports security vulnerabilities, hosts hack-a-thons, uses real world exploits to help developers understand security vulnerabilities, lectures at colleges, presents at conferences, organizes security conferences, and volunteers on the presentation review board for for a BSides Conference.
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Saturday - 16:00-16:30
Title:
Stop Facebook From Buying Your Brain: Facial Recognition, DNA, and Biometric Privacy - Tiffany Li
ABSTRACT
You might have heard the saying, "Biometrics are usernames, not passwords." But outside the security world, most people have no idea of the scale of threats were all facing with biometric privacy.
Governments worldwide are using facial recognition for surveillance, often leading to disastrous consequences in countries without strong human rights protections. Companies, too, are developing more uses for facial recognition, often with a Move fast and break things mindset. Voice data, movement data, and more types of biometric data are also now commonly collected by public and private entities. People willingly put photos, videos, and audio of themselves online. They also use apps and consumer tech that collect biometric data. At the same time, deepfake technology is advancing rapidly, and surveillance culture is becoming increasingly pervasive everywhere.
Not only are consumers willingly giving up their face data for app discounts, but theyre also giving up their DNA data for questionably accurate genomic analysis. The popularity of DNA testing kits like 23and Me has led to a rise in public and private DNA databases, which come with their own risks, from potential government misuse of data to basic security risks that come with any large-scale collection of sensitive data.
The worst possible scenario, of course, is that we create a future where all of these privacy-invasive technologies will succeed and proliferate without laws or technological solutions to stop any of the harms. Thats a world in which we have zero privacy, because your unique and permanent biometric markers are being tracked literally everywhere you go, including, potentially, in your own thoughts. (See. e.g., Facebooks Reality Labs.)
Biometric privacy is one of the less-understood fields of privacy research and discussion. In this talk, I explore the unique biometric privacy risks and harms of these new technologies, and offer some solutions for what we can do to protect biometric privacy now and in the future.
BIO
Tiffany C. Li is a tech lawyer and legal scholar. She is a Resident Fellow at Yale Law Schools Information Society Project.
Li is an expert on privacy, intellectual property, and tech platform governance. Lis writing has appeared in the Washington Post, NBC News, Slate, and academic publications.
Li has been honored as a Transatlantic Digital Debates Fellow (Global Public Policy Institute/ New America Foundation), a Fellow of Information Privacy (International Association of Privacy Professionals), and an Internet Law and Policy Foundry Fellow (Internet Education Foundation).
Li is a licensed attorney and holds CIPP/US, CIPP/E, CIPT, and CIPM certifications. She has a J.D. from Georgetown University Law Center, where she was a Global Law Scholar, and a B.A. in English from University of California Los Angeles.
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Saturday - 12:00-12:30
Title:
Stop right now! Quantum-Safe Instantaneous Vehicle to Vehicle communication - Sarah McCarthy
ABSTRACT
According to recent estimates, a quantum computer may be built as soon as 2030. As this will render existing cryptography insecure, we require quantum-safe alternatives now. Another aspect is the development of the Internet of Things, whereby increasing numbers of devices are being connected to the internet. This poses further challenges as not only is the new crypto more computationally intensive, but these devices are becoming smaller in terms of area and power capacity. This talk will present a form of quantum-based cryptography which is suitable for constrained devices, and will demonstrate in real-time an efficient implementation of such a scheme for a relevant use-case.
BIO
Sarah McCarthy is a researcher at the Centre for Secure Information Technologies, Queens University Belfast (QUB), where she has been based for 5 years. She specialises in post-quantum lattice-based cryptography, has made contributions to the EU-funded H2020 SAFEcrypto project and is involved in the ETSI Standards Quantum Safe Cryptography (QSC) Working Group. She has recently given invited talks at the 2018 ETSI QSC Workshop and 2019 International Cryptographic Module Conference. Sarah graduated from QUB with a Masters of Science in Mathematics and is currently completing her PhD in Computer Science there.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 3 - Saturday - 13:00-13:45
Tag-side attacks against NFC
Saturday at 13:00 in Track 3
45 minutes | Demo, Tool
Christopher Wade
This talk covers tag-side attacks against NFC communication protocols, including cracking of Mifare encryption keys and performing targeted attacks against NFC readers. In addition, it will cover the design and creation of devices capable of emulating NFC tags down to the raw protocol using standard components and tools, with no abstraction to dedicated hardware, covering and expanding on the capabilities of available products. This talk will contain how 13.56MHz NFC works at a raw level, how tools can be built for analysing it, how the protocol can be implemented in full on standard Microcontrollers, and the security weaknesses present in its design.
Christopher Wade
Chris is a seasoned security researcher and testing consultant. His main focuses are in reverse engineering hardware, fingerprinting USB vulnerabilities and playing with Software Defined Radios, with his key strength lying in firmware analysis, which he utilises as part of the hardware testing team at Pen Test Partners.
Twitter: @Iskuri1
Github: https://github.com/Iskuri
Return to Index - Add to
- ics
Calendar file
BCV - Flamingo 3rd Floor - Laughlin III Room - Saturday - 14:15-15:59
Take back control of user data with the decentralized cloud
No description available
Return to Index - Add to
- ics
Calendar file
SKY - Bally's Jubilee Tower - 2nd Floor - Jubilee Ballroom - Saturday - 11:00-11:59
The Art of Defeating Facial Recognition
August 10, 2019
11:00
-
12:00
Bally's, Jubilee Tower - Pacific BR - 2nd Floor
Vic Harkness
It's not a recent development that CCTV surveillance systems are everywhere. What is new is the use of automatic facial detection/recognition systems everywhere. A lot of people don’t like the potential for mass surveillance, including non-techies. Although there are various technical solutions for countering ubiquitous facial recognition systems (such as adversarial examples), people are also taking low-tech approaches to defeating them. In this talk, I will discuss the general concepts needed to understand how to defeat facial detection/recognition systems, how these factors can be leveraged, and provide various examples of how people have already done so. By talking about how facial detection/recognition systems can be defeated in general terms, I hope to inspire other people to begin exploring this domain. Or, perhaps, help people to bypass systems that they encounter in their day to day lives.
This talk will not be a deep dive in to how the technology works, making it suitable for a wide range of attendees.
Return to Index - Add to
- ics
Calendar file
SEV - Bally's Jubilee Tower - 3rd Floor - Las Vegas Ballroom - Saturday - 18:50-19:20
Saturday August 10 2019 1850 30 mins
The Aspie’s Guide to Social Engineering Your Way Through Life
CPerry Carpenter, Chief Evangelist & Strategy Officer for KnowBe4 will discuss how he, both knowingly and unknowingly, ethically used Social Engineering skills all throughout his career to be successful.
He hopes to teach and encourage others who struggle socially how to grow their careers by leaning into their personal differences. And to find the strengths embedded in those differences.
Perry Carpenter: @perrycarpenter
Perry Carpenter is the author of, “Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors” from Wiley Publishing, and he currently serves as Chief Evangelist and Strategy Officer for KnowBe4, the world’s most popular security awareness and simulated phishing platform.
Previously, Perry led security awareness, security culture management, and anti-phishing behavior management research at Gartner Research, in addition to covering areas of IAM strategy, CISO Program Management mentoring, and Technology Service Provider success strategies. With a long career as a security professional and researcher, Mr. Carpenter has broad experience in North America and Europe, providing security consulting and advisory services for many of the best-known global brands.
Perry holds a Master of Science in Information Assurance (MSIA) from Norwich University in Vermont and is a Certified Chief Information Security Officer (C|CISO).
Return to Index - Add to
- ics
Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Saturday - 11:15-11:45
11:15-11:45
The Cost of Good Open-Source Software
Amir Montazery, Open Source Technology Improvement Fund (OSTIF)
Amir will explain a new and impactful approach toward more secure and efficient software. He will give an overview of OSTIF and how it came to be, and he will talk about going from an idea to an international coalition of individuals and organizations focused on improving critical open-source software. He will share OSTIF’s accomplishments and relationship with the Monero community. He will share some of the behind-the-scenes work that went into coordinating the security and functionality of Monero with bulletproof and RandomX audits.
Return to Index - Add to
- ics
Calendar file
SKY - Bally's Jubilee Tower - 2nd Floor - Jubilee Ballroom - Saturday - 10:00-10:59
The Cyberlous Mrs. Maisel: A Comedic (and slightly terrifying) Introduction to Information Warfare
August 10, 2019
10:00
-
11:00
Bally's, Jubilee Tower - Pacific BR - 2nd Floor
Zhanna Malekos Smith
Like a dear family relative who won't stop talking at Thanksgiving dinner, a backdoor exploit also talks to anyone who'll listen. Come listen to the Cyberlous Mrs. Maisel! She'll offer a satirical reflection on how we engage with technology in the Information Age and explain the basic historical principles that animate Russia's approach to information warfare. Topics covered include maskirovka (i.e., camouflage, concealment and deception), disinformation, and reflexive control, among others. Although a strategic objective of information warfare is to induce complacency with falsehoods, this presentation's unique style can help jolt the public's consciousness awake through its originality and bite.
Return to Index - Add to
- ics
Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Saturday - 19:00-19:59
The Cyberlous Mrs. Maisel: A Comedic (and slightly terrifying) Introduction to Information Warfare
J. Zhanna Malekos Smith, Duke Law School
Like a dear family relative who won't stop talking at Thanksgiving dinner, a backdoor exploit also talks to anyone who'll listen. Come listen to the Cyberlous Mrs. Maisel! She'll offer a satirical reflection on how we engage with technology in the Information Age and explain the basic historical principles that animate Russia's approach to information warfare. Topics covered include maskirovka (i.e., cover, concealment and deception), reflexive control, disinformation, and imitation, among others. Although a strategic objective of information warfare is to induce complacency with falsehoods, this presentation's unique style can help jolt the public's consciousness awake through its originality and bite.
J. Zhanna Malekos Smith is the Reuben Everett Cyber Scholar at Duke University Law School. Previously, she served as a Captain in the U.S. Air Force Judge Advocate General's Corps. Prior to military service, she was a post-doctoral fellow at the Belfer Center's Cyber Security Project at the Harvard Kennedy School. She holds a J.D. from the University of California, Davis; a B.A. from Wellesley College, where she was a Fellow of the Madeleine Korbel Albright Institute for Global Affairs; and is finishing her M.A. with the Department of War Studies at King's College London. She has presented her research at DEF CON, RSA, and ShmooCon, among others.
Return to Index - Add to
- ics
Calendar file
WLV - Bally's - Palace Meeting Rooms 1-7 - off hallway to Event Center - Saturday - 17:00-17:55
Woody
Bio
He likes to look into the light and hear stuff.
@tb69rr
The Ford Hack (Raptor Captor)
Abstract
"This talk will show flaws with development of security protocols in New Ford key fobs. This will exploit several areas. The ability for a denial of service to the keyfob WITHOUT jamming. How to trick the vehicle into resetting its rolling code count. How to lock, unlock, start, stop, and open the trunk of ford vehicles using a replay attacked after resetting rolling code count. How to find the master access code for Fords keypad to bypass security. This talk will also demonstrate how to reset your key fobs if they are attacked by a deauth attack. We will also demonstrate gnu-radio script to automate RF collection of Ford key fobs.
As seen on HAK5 episodes 2523-2525"
|
Return to Index - Add to
- ics
Calendar file
LBV - Flamingo - Carson City II Room - Saturday - 18:00-18:59
Title:
The Human Body's Promise: How Your Bare Hands can Defeat Physical Security
Return to Index - Add to
- ics
Calendar file
BHV - Planet Hollywood - Melrose 1-3 Rooms - Saturday - 14:30-15:15
2:30 PM: The L33T Shall Inherit the Cosmos
Speaker: J.J. Hastings
Abstract: The era of the astro-jock is over, no more men in tin cans taking orders from mission control. Staying alive off Earth will require the ability to thrive in an environment that requires constant adaptation. Fellow hacker and analogue astronaut J.J. Hastings argues that hackers are an ideal match to the space environment. Her talk suggests how we might become extra-terrestrial hackers and shares insights from her missions as a field researcher and analogue astronaut.
Speaker Bio: A biohacker since 2009, JJ Hastings co-founded London Biohackspace and BioQuisitive, and has the first garage to be PC-1 certified in Australia. An alumna of NYU, Harvard and Oxford with advanced degrees in Biology and Bioinformatics, she is an analogue astronaut and field researcher for NASA/JPL.
T:
@HackerAstro
Return to Index - Add to
- ics
Calendar file
BHV - Planet Hollywood - Melrose 1-3 Rooms - Saturday - 15:15-15:59
3:15 PM: The Story of SICGRL Vulnerability
Speaker: Andrea Downing
Abstract: A massive security vulnerability was discovered which allowed PHI to be leaked from closed patient support groups on Facebook. In this session well discuss how a coalition of patients and security researchers faced this crisis and explore the need to develop a new model for collective data governance on social media.
Speaker Bio: Andrea Downing is a BRCA Community Data Organizer and founder of Brave Bosom. Along with Fred Trotter, Andrea discovered a security vulnerability in Facebook's Group product that affected all closed groups on Facebook.
T:
@BraveBosom
Return to Index - Add to
- ics
Calendar file
SEV - Bally's Jubilee Tower - 3rd Floor - Las Vegas Ballroom - Saturday - 18:15-18:45
Saturday August 10 2019 1815 30 mins
The Voice Told Me To Do It
Corporate colors and logos characteristic of a brand are easily and freely accessed on the network. As consumers we have been advised to distrust an email with these identities.
Instead, the voice gives us confidence. When we need help, the voice is there. It is the first thing we hear when we call, it tells us how wonderful and beneficial it is to be associated with that brand. A voice that will never harm us, until now.
Identity spoofing is one of the most used social engineering formats to initiate major attacks. But what if cyber-criminals could go further? What would happen if someone could not only impersonate, but actually use the identity of an institution to make an attack on a national level? Is it possible to do this with a minimal investment or without capital? The answer is yes.
Daniel Isler: @Fr1endlyRATs
Daniel Isler is Security Consultant, Bachelor in Arts of Representation, Actor and Scenic Communicator and Voice Over Artist. With more than 10 years of experience as an academic in Acting classes at the University of Valparaíso, UNIACC University and Professional Institute Aiep. He also develops projects in the area of visual arts. With those who have participated in contemporary art festivals in Chile, Argentina, Portugal and Spain. Since 2015 he leads the Social Engineering team at Dreamlab Technologies.
Certifications / Competencies:
• Advanced Practical Social Engineering, Orlando, FL, United States.
• Usable Security, University of Maryland, United States.
• Improvisation Summer School, Keith Johnstone Workshop Inc. Calgary, Canada.
• French for foreign language, Université de Pau et des Pays de L’adour, Pau, France.
• Diploma in commercial speech, dubbing and neutral accentuation, Voces de Marca, Caracas, Venezuela.
• Diploma in Digital Photography, Arcos Professional Institute.
• Diploma in Audiovisual Language, UNIACC University.
Return to Index - Add to
- ics
Calendar file
RTV - Flamingo 3rd Floor - Laughlin I,II Rooms - Saturday - 16:00-16:59
Through the Looking Glass: Own the Data Center
The data center embodies the heart of many businesses on the Internet. It contains much of the information in a centralized location which provides a huge incentive for those who would wish harm. The data centers in the realm of Cloud may no longer contain just a single entity, but many individual tenants that attach to a common fabric. The Cisco Application Centric Infrastructure (ACI) aims to meet these needs with a multi-tenant, scalable fabric that interconnects physical hosts, VMs and containers. ACI is Cisco's answer to the centrally-managed Software Defined Network (SDN). The Application Policy Infrastructure Controller (APIC) and Nexus 9000 series switches form the brains and backbone of ACI.
A member of Cisco's Advanced Security Initiatives Group (ASIG) will demonstrate their findings during an evaluation of ACI and the APIC, more than three years before the BH2019 talk "APIC's Adventures in Wonderland." Step into the mind of an attacker and scan, probe, and interact with the network fabric to progress from an unauthenticated user to administrator and root of the data center switch fabric. Once inside the system, see how the APIC can be modified in a nearly undetectable manner to provide the attacker unfettered internal access to all the interconnected hosts and VMs in the data center. The target audience for this talk includes those with a technical interest in offensive discovery and secure product development. Participants will receive an overview of how a data center product is viewed in an offensive light.
About Chris McCoy: Chris is a technical leader in Cisco's Advanced Security Initiatives Group (ASIG) and published author of Security Penetration Testing, The Art of Hacking Series LiveLessons with Cisco Press. He has over 20 years of experience in the networking and security industry. He has a passion for computer security, finding flaws in mission-critical systems, and designing mitigations to thwart motivated and resourceful adversaries. He was formerly with Spirent Communications and the U.S. Air Force. Chris is CCIE certified (Emeritus) in the Routing & Switching and Service Provider tracks, which he has held for over 10 years. Twitter: @chris_mccoy
Return to Index - Add to
- ics
Calendar file
Meetups - Planet Hollywood - Mezzanine Stage - Saturday - 17:00-17:59
Title:
Tinfoil Hat Contest
reddit post with info
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Saturday - 13:00-13:59
Title:
Tiplines Today - Harlo Holmes
ABSTRACT
Nowadays, the majority of US-based newsrooms rely on primarily consumer-facing applications to facilitate secure communications with sources. Usage of tools like Signal, WhatsApp, Threema, and others, have spiked in usage as the most state-of-the-art way to ensure confidential conversations with at-risk leakers and whistleblowers. Documents flood newsrooms, sometimes in gigabytes at a time, and journalists need tools to interrogate that data in relative safety from device compromise, legal interception, all while getting the job at the accelerated speed of the news cycle. Let's explore how these tools, from both a technical and behavioral usage standpoint, *make the news*. Sometimes in a good way, when a story comes out after months of clandestine collaboration with sources, and toiling over data that needs to be interrogated; sometimes in a bad way, when sources get burned, or organizations endanger themselves.
BIO
Harlo Holmes is the Director of Digital Security at Freedom of the Press Foundation. She strives to help individual journalists in various media organizations become confident and effective in securing their communications within their newsrooms, with their sources, and with the public at large. She is a media scholar, software programmer, and activist.
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Saturday - 11:00-11:59
Title:
TLS decryption attacks and back-doors to secure systems - Chris Hanlon
ABSTRACT
In this presentation, we show the audience how to use well documented protocol weaknesses to generate fraudulent domain security certificates, decrypt "secure https" web traffic, and decrypt TLS encrypted emails.
Then we show the audience how to use these weaknesses as backdoors to break into Cisco Meraki firewalls, Google Nest security cameras, physical building locks, Dropbox accounts, Onedrive accounts, Outlook.com accounts, Skype message histories, Amazon AWS Virtual Machines, Oracle Cloud virtual machines, LogMeIN remote access accounts, Online Medical Records, online backups, windows bit-locker encrypted hard drives, apple file-vault encrypted hard drives drives, and many other systems.
At the end of the presentation: we cite related research showing multiple government agencies successfully using these TLS interception attacks against citizens, businesses, other governments, ... then provide simple solutions to prevent this type of attack.
BIO
Chris Hanlon is the founder of Agile Data Security a company dedicated to helping businesses secure their software development life-cycle, protect their technology assets (computers, routers, servers, databases and cloud systems) and reduce their vulnerability to social engineering attacks.
Return to Index - Add to
- ics
Calendar file
PHVW - Bally's Resort (Indigo) Tower 26th floor - Saturday - 11:20-13:20
Tools? We Don’t Need No Stinkin’ Tools: Hands-on Hacking with Python
Jason Nickola, Directory of Technical Services, Pulsar Security
Wayne Marsh, Senior Software Engineer, Pulsar Security
The hacking world is full of fantastic tools, but the ability to write your own in order to customize and achieve new functionality is the real black magic. This workshop quickly builds from programming and python fundamentals to manual construction of real-world attack tactics and techniques. Prior hacking and programming skills are not required (although they help), but basic technical knowledge and an ahead-of-time review of introductory topics are highly recommended. Come in with nothing and leave with experience writing your own host and port scanner, reverse shell, packet parser, and more in a controlled (legal) environment.
Jason Nickola (Twitter: @chm0dx) is the Director of Technical Services at Pulsar Security where he also serves as Principle Security Consultant. He can frequently be found working with clients to develop creative solutions to red- (and increasingly blue-) team challenges. Passionate about both technology and the lifelong learning process, Jason enjoys enabling others via teaching and aiding in career development. Jason is a SANS instructor for SEC560: Network Penetration Testing and Ethical Hacking and holds the GIAC Security Expert, GXPN, GREM, and OSCP certifications among others.
Wayne Marsh (Twitter: @infogroke) is a Security Consultant and the Senior Software Engineer at Pulsar Security where he spends his time programming, architecting enterprise products, and breaking into the occasional network. His varied career has involved television and satellite broadcast systems, games development, and marketing before finally focusing on the infosec industry in recent years, where he realized that the common thread in all of these areas of development is security. He loves both obsolete and new, as well as increasingly unfashionable genres of music. Wayne’s security credentials include OSCP, GPYC, GXPN, and GCIA.
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Saturday - 10:30-10:59
Title:
Towards Usable Dining Cryptographer Networks with Howl - Tyler Kell (NOT RECORDED)
ABSTRACT
Anonymous communication is important for dissidents, activists, whistleblowers, journalists, and any individuals that might be under surveillance by other parties. Dining Cryptographer Networks (DC-Nets) provide the strongest anonymity protections and the lowest possible latency of any current cryptographic solution. Unfortunately DC-Nets are faced with three fatal flaws that prevent their deployment in the real world: prohibitive bandwidth consumption, denial of service attacks (DoS) by participants, and low fault tolerance. In this talk, I will present Howl, our new open source project and decentralized anonymity network that solves these issues to make DC-Nets usable in the real world. We leverage a new aggregation protocol for bandwidth and fault tolerance issues, and use trusted execution environments (TEEs) to prevent DoS. All privacy is handled by the DC-net protocol and at no point does broadcast privacy rely on the trusted execution environment or aggregation network.
BIO
Tyler Kell is a Research Engineer at Cornell Tech in New York City. In a prior life, before becoming a researcher, he worked as a penetration tester and security consultant.
Return to Index - Add to
- ics
Calendar file
SKY - Bally's Jubilee Tower - 2nd Floor - Jubilee Ballroom - Saturday - 14:00-14:59
Two Talk Block: "88 Pints: The Story of an Ice Cream Heist" & "How to f**k with people and change history"
August 10, 2019
14:00
-
15:00
Bally's, Jubilee Tower - Pacific BR - 2nd Floor
NOTE: We will not be emptying the room between these two talks.
1400 – 1430
"88 Pints: The Story of an Ice Cream Heist"
by noodle
With the peak of "hustle culture", people in both mainstream culture and the Internet underground are finding ways save anywhere from a couple bucks to thousands of dollars with what often legally amounts to fraud. This talk is a brief overview of modern promotion fraud, including a discussion on legality, ways for companies to prevent it, tales of some high-profile cases in the past year, and the story of how a food delivery app gave out way more ice cream than they anticipated.
1430 – 1500
"How to f**k with people and change history"
by Oryx
The world is becoming a more divided place. My research recently has been around population manipulation in the context of security. It was when looking into this topic that I started to delve into online groups... what were fringe ideas before now have boiled to the surface. The fringe groups and forums are one thing, but when these attitudes go mainstream we all must pay attention. I want to share my experience interacting with folks across the political spectrum; which I did anonymously much of the time. By engaging a wide swath of folks I began to understand how information spreads, beliefs become solidified and divisions are sowed. This talk is about "human hacking"... though to do that, we need to understand the human first. We will demonstrate how one can f**k with people for better or worse.
Return to Index - Add to
- ics
Calendar file
SKY - Bally's Jubilee Tower - 2nd Floor - Jubilee Ballroom - Saturday - 15:00-15:59
Two Talk Block: "Securing Enterprise Systems: The Emperor Has No Clothes" & "Healthcare Cybersecurity: Is it all just a little bit of history repeating?"
August 10, 2019
15:00
-
16:00
Bally's, Jubilee Tower - Pacific BR - 2nd Floor
NOTE: We will not be emptying the room between these two talks.
1500 – 1530pm
"Securing Enterprise Systems: The Emperor Has No Clothes"
By 3ncr1pt3d
Let’s talk about the ugly realities of enterprise systems: unpatched, exposed legacy systems; limited visibility; shadow it; misconfiguration; BYoD; IoT. When attackers are living off the land inside your enterprise networks, that shit is gonna get you pwned. In this talk I’ll share what I’ve found just doing my job:
-No, we don’t really know what is on the network
-There will always be something internet-facing that shouldn’t be
-An accurate asset inventory is the stuff of fairytales
Based on my experiences, some of which I will share, when it comes to securing enterprise systems, our belief system is fucked:
-We believe that what we monitor is what we need to see.
-That our trusted partners are entirely trustworthy
-That our mitigating controls are enough.
How are we actually determining what is “enough”? I’m here to call out the fallacy that somebody’s risk ratio calculation over actual experience is going to save our enterprise asses when Petya 2.0 hits. Because it only takes once.
1530 – 1600
"Healthcare Cybersecurity: Is it all just a little bit of history repeating?"
By Audie
Healthcare cybersecurity is in critical condition. The disease from which it suffers is communicable and has plagued the advances of humankind throughout history. No one is immune. There’s something evolving.
What kind of public health hazard has been so persistent throughout history that even today, with all the promises of technology, it still threatens to trigger a crisis of confidence? Communication failures.
The need to communicate is fundamental and universal. It exists in every culture, in every industry, and — at an accelerating rate — in every new technology. We are increasingly dependent on connected technology — and our dependence is outpacing our ability to secure it. In healthcare, this presents significant safety concerns.
I’ve seen it before, I’ll see it again.
The Challenger explosion, the sinking of the Titanic, and Chernobyl are examples where communication issues contributed to or catalyzed failures. In this talk, we will extract lessons from these tragedies, draw parallels to events I have personally experienced working in healthcare, and outline treatments to improve communication — and safety, as a result.
Return to Index - Add to
- ics
Calendar file
HHV - Bally's Event Center - Saturday - 11:00-11:50
Understanding & Making Pcb Art
TwinkleTwinkie
Abstract
PCB Art is all over DEF CON and for some attendees one of their primary goals is to see, admire, and collect some of the dozens of stunning examples of PCB Art that premieres at DEF CON every year. In this talk I will walk you through an explanation of what a PCB is, how it’s made, how PCB Artists use the limitations of the PCB Manufacturing process to produce stunning artwork and finally how you can make your own PCB Art using Inkscape & KiCAD. This talk is intended for anyone who appreciates PCB Art, wants to make their own PCB Art, or just wants to know how the sausage gets made.
Bio
TwinkleTwinkie is an independent PCB Artist and has manufactured dozens of Artistic PCB Badges & Indie Badge Addons. His work was featured in Hackaday’s 2018 “Badge Life” Documentary. Some of his notable works that he has produced are: Arc Badge, BSides Vancouver 2019 Badge, BSides Atlanta 2019 Badge, Queercon 15 Badge Top Board & Access Pass, Krusty the It “SAO”, Prince & Pharoah OSHCat “SAO” for OSHPark, the Cheshire Cat “SAO”, and the Chestoro “SAO”.
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Saturday - 10:00-11:59
Title:
Unhack the Ballot
10:00 AM Unhack the Ballot
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 1 - Saturday - 16:30-16:50
Unpacking Pkgs: A Look Inside Macos Installer Packages And Common Security Flaws
Saturday at 16:30 in Track 1
20 minutes | Demo
Andy Grant Technical Vice President, NCC Group
We are hackers, we won't do as you expect or play by your rules, and we certainly don't trust you. JAR files are really ZIPs...unzip them! So are Microsoft's DOCX, XLSX, PPTX, etc. Let's open them up! macOS applications (.app "files") are really directories you can browse?! Sweet, let's do that.
Less well known but similarly prevalent are Flat Package Mac OS X Installer (.pkg) files. These are actually XAR archives that, among other things, contain many plaintext files (including shell, Perl, and Python scripts) as cpio files compressed using gzip.
In this presentation I'll walk you through extracting the contents of these installer packages, understanding their structure, and seeing how they work while highlighting where security issues can come up. To drive the point home of what can go wrong, I'll include examples of serious security issues I've seen in the wild and show you how they can be exploited to elevate privileges and gain code/command execution.
After this talk, .pkg files will no longer be opaque blobs to you. You'll walk away knowing tools and techniques to tear them open, understand how to evaluate what they're really doing on your computer, and a methodology for finding bugs in them. As a final bonus, I'll include a subtle trick or two that can be used on red teams.
Andy Grant
Andy Grant is a Technical Vice President for NCC Group. While at NCC Group, Andy has worked on a wide-variety of security assessment and advisory projects. He has performed numerous application assessments on mobile (Android, iOS, WP7), desktop (OS X/macOS, Windows, Linux), and web platforms. He has also performed many internal and external network penetration tests and widget/third-party platform reviews. Andy has worked with small tech start-ups, small and large software development groups, and large financial institutions. Andy has a BS in Computer Science and an Advanced Computer Security Certificate from Stanford University.
Twitter: @andywgrant
Return to Index - Add to
- ics
Calendar file
RCV - Planet Hollywood - Celebrity 5 Ballroom - Saturday - 11:55-12:30
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 4 - Saturday - 16:00-16:30
Vacuum Cleaning Security—Pinky and the Brain Edition
Saturday at 16:00 in Track 4
20 minutes | Exploit
jiska TU Darmstadt, Secure
Mobile Networking Lab
clou (Fabian Ullrich)
Data collected by vacuum cleaning robot sensors is highly privacy-sensitive, as it includes details and metadata about consumers’ habits, how they live, when they work or invite friends, and more. Connected vacuum robots are not as low-budget as other IoT devices and vendors indeed invest into their security. This makes vacuum cleaning robot ecosystems interesting for further analysis to understand their security mechanisms and derive takeaways.
In this talk we discuss the security of the well-protected Neato and Vorwerk ecosystems. Their robots run the proprietary QNX operating system, are locally protected with secure boot, and use various mechanisms that ensure authentication and encryption in the cloud communication. Nonetheless, we were able to bypass substantial security components and even gain unauthenticated privileged remote execution on arbitrary robots. We present how we dissected ecosystem components including a selection of vacuum robot firmwares and their cloud interactions.
jiska
Jiska has a M.Sc. in IT-Security. She is a PhD student at the Secure Mobile Networking Lab (TU Darmstadt) since May 2014. Her main research interest are wireless physical layer security and reverse engineering. You might also know her embroidery projects or game shows from past CCC events.
Twitter: @seemoolab
clou (Fabian Ullrich)
Fabian has a M.Sc. in IT-Security. He is working as a researcher and analyst at ERNW. His main research interests are full stack IoT and web application security. In his free time, Fabian likes to capture some flags.
Return to Index - Add to
- ics
Calendar file
RGV - Flamingo - 3rd Floor - Carson City II - Saturday - 17:00-17:59
Title:
Verbal Steganography Workshop
Verbal Steganography Workshop with Four Suits Co. Space will be limited. Sign-up is available
here
Return to Index - Add to
- ics
Calendar file
RGV - Flamingo - 3rd Floor - Carson City II - Saturday - 16:00-16:59
Title:
Verbal Steganography
Verbal Steganography
Four Suits Co. presents a talk (and demonstration) of live stenographic communication. Boiled down to its simplest form that means all the ways for two or more people to secretly, and in an analog way, communicate with each other. This includes physical and verbal codes, as well as memory systems and shortcuts that allow large amounts of information to be remembered and transferred from person to person.
Return to Index - Add to
- ics
Calendar file
WLV - Bally's - Palace Meeting Rooms 1-7 - off hallway to Event Center - Saturday - 13:00-13:55
Gabriel Ryan (s0lst1c3)
Bio
Gabriel Ryan (s0lst1c3) is an offensive security R&D and consultant at SpecterOps. He is the author of EAPHammer, a toolkit for performing targeted rogue access point attacks against enterprise wireless networks.
@ss0lst1c3
Steve Darracott (wytshadow)
Bio
Steven Darracott (wytshadow) works as a Senior Security Consultant on Optiv’s Attack and Penetration team. Steven is the co-author of sniffair, a modular framework for performing security assessments against modern wireless networks.
@theDarracott
War Never Changes: Attacks Against WPA3's "Enhanced Open"
Abstract
In this presentation we will introduce working proof-of-concept attacks that can be used against wireless networks that use Opportunity Wireless Encryption (OWE), which is better known as WPA3’s “Enhanced Open.” We’ll also demonstrate a resource exhaustion attack that can be used to disconnect wireless clients from networks that use Protected Management Frames (PMF). By doing this we hope to inspire a conversation about whether OWE is truly a significant improvement from open WiFi, and whether it truly addresses the current wireless threat model.
|
Return to Index - Add to
- ics
Calendar file
DC - Planet Hollywood - Firesides Lounge - Saturday - 22:15-22:59
We Hacked Twitter… And the World Lost Their Sh*t Over It!
Saturday at 22:15 in Firesides Lounge
45 minutes
Mike Godfrey Penetration Tester, INSINIA Security
Matthew Carr Penetration Tester, INSINIA Security
In December 2018 INSINIA Security was involved in one of the biggest hacking stories of the year. A number of “celebrities”, including Louis Theroux, Eamon Holmes and more, logged into their Twitter accounts just after Christmas to find a Tweet, from their account, saying:
“This account has been temporarily hijacked by INSINIA SECURITY”.
The tweet immediately directed people to our blog post, and the compromised accounts retweeted INSINIA’s Tweet, saying:
“This account is now under the control of @InsiniaSRT. Luckily, this has been H4CK3D to highlight an important vulnerability. The user of this account has NOT lost access to it, no data compromised and is NOT under attack. See how it was done…”.
What we did was simple. We used spoof texts to Tweet from these accounts. We NEVER had access to these accounts. We could never read DM’s. We simply passively controlled these accounts with no opportunity of getting confidential data in return.
So what did the hacking community, journalists and commentators do?! They LOST THEIR SH*T OVER IT!
“It’s unethical” “It’s a crime” “Computer Misuse Act counts for security researchers too!” “You guys are total f*cking idiots!
These are the types of things we’d heard from our peers. But why was the backlash so bad? In this talk, INSINIA explains why it was done, how it was done, how people reacted and how research can be released quickly and responsibly… Without always getting the warm reception you might expect!
Mike Godfrey
Mike Godfrey, Director of INSINIA Security, started life as a “hacker” before he had hit his teens. With a professional background in Electro-technical / Electro-mechanical Engineering and almost 20 years’ experience in building and breaking computers.
Mike offers a unique perspective when it comes to varied and multi-vector attacks and is regarded as one of the UK’s most capable multi-skilled Cyber Security Specialists, gaining notoriety in the Cyber Security industry for using elements of different skills, both on hard and soft surfaces, to carry out highly technical and often highly intricate electronic attacks. One of these attacks includes hacking Costco’s high security Sentry display safe with nothing more than a magnet and a sock! This research was utilised and referenced by @Plor in his talk at DEF CON 25 – “Popping a Smart Gun”. Mike has also been lucky enough to become a DEF CON speaker in 2018, one of the proudest moments of his life!
Mike works as a Cyber Security contributor for the BBC, LBC, Channel 4 and was the Ethical Hacker who discovered the TalkTalk and O2 data breach stories.
Twitter: @MikeGHacks
Matthew Carr
Matthew's previous roles including Senior Penetration Tester and Researcher at SecureLink, Europe's largest managed security services provider and Operational Security Specialist at Ikea overseeing worldwide Operational Security as part of a Specialist Team.
Matthew regularly speaks at industry events and lectures offensive security at Malmö's Technology University in Sweden.
Matthew spent over 3 years as part of an R&D team building intrusion detection software, a secure cloud platform, SIEM tools and other security software, Matthew is not only a competent red teamer but also a valuable asset to any blue team.
Matthew works as a Cyber Security contributor for the Telegraph, Talk Radio and SVT.
Twitter: @sekuryti
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 1 - Saturday - 10:00-10:45
Weaponizing Hypervisors to Fight and Beat Car and Medical Devices Attacks
Saturday at 10:00 in Track 1
45 minutes | Demo, Tool
Ali Islam CEO, Numen Inc.
Dan Regalado (DanuX) CTO, Numen Inc
Historically, hypervisors have existed in the cloud for efficient utilization of resources, space, and money.
The isolation feature is one of the reasons hypervisors are heavily moving to other ecosystems, like Automobiles, so that for example, if an Infotainment crashes, it does not affect other sensitive ECUs like ADAS. Blackberry QNX and AGL announced the use of hypervisors in their deployments on Cars.
The trending is real, but there is a big challenge! Most of the systems in Cars and Medical devices run on ARM, plus, protection at the hypervisor level is still limited. So, is it possible to have a framework that runs at the hypervisor level, able to monitor at the OS level and most important, capable to identify and kill threats coming into the monitored devices?
During this talk we will walk you through the steps needed to setup a framework running on Xilinx ZCU102 board able to monitor ARM-based devices and to kill malicious threats identified. Also will discuss challenges on syscall monitoring, single-stepping limitations, techniques to stay stealthy, techniques to detect and kill traditional malware seen in enterprise like Ransomware, Heap Exploits and capabilities on VM Escape attacks and feasibilty to detect Spectre-like exploits.
Ali Islam
Ali Islam Khan is the Chief Executive Officer (CEO) and Co-Founder of Numen Inc. He is also an avid C programmer and has developed the core set of Numen’s Virtual Machine Introspection (VMI) capabilities. Before quitting his job to work full time on Numen, Ali was Director R&D at FireEye where he was leading the R&D efforts for FireEye’s flagship email and network products. He is the founding member of FireEye Labs where he invented & developed some of the key detection technologies used in FireEye products today. Ali has multiple patents to his name and has over 13 years’ experience in a wide range of cyber security disciplines, including cryptography, malware analysis, cyber-espionage and product development. He has successfully created and led global teams from scratch. Ali has spoken at conferences such as RSA and worked with various government agencies such as DHS, KISA on intelligence sharing efforts to counter nation-state level threats.
Khan holds an MBA from UC Berkeley and a Master’s degree in network security from Monash University, Australia. He is an AUSAID scholar and the recipient of the prestigious Golden Key Award.
Twitter: @Ali_Islam_Khan
LinkedIn: https://www.linkedin.com/in/aliislam/
Dan Regalado (DanuX)
Daniel Regalado aka DanuX is the CTO and Co-Founder of Numen Inc. He is a Mexican security researcher with more than 17 years in the scene. He has worked reversing malware and exploits at Symantec Security Response Team and FireEye Labs and lately focused on IoT threats at Zingbox. He is credited with the discovery of most of the ATM malware worldwide. He is the co-author of famous book Gray Hat Hacking and he likes to present his discoveries in major security conferences like RECon, RSA, DEF CON IoT/Car Hacking villages, BSIDES.
Twitter: @danuxx
LinkedIn: https://www.linkedin.com/in/daniel-regalado-200aa414/
Return to Index - Add to
- ics
Calendar file
CHV - Bally's Event Center - Saturday - 12:00-12:50
Weaponizing Hypervisors to protect Car Infotainment from hackers
Dan Regalado
Sat 8/10 •
12:00 PM-12:50 PM
50 min talk
Historically, hypervisors have existed in the cloud for efficient utilization of resources, saving space, and money.
The isolation feature is one of the reasons hypervisors are heavily moving to other ecosystems, like Automobiles, so that for example, if an Infotainment crashes, does not affect other sensitive ECUs like ADAS. Blackberry QNX and AGL announced the use of Hypervisors in their deployments on Cars.
The trending is real, but there is a big challenge! Most of the systems in Cars run on ARM, plus, protection at the hypervisor level is still limited. So, is it possible to have a framework that runs at the hypervisor level, able to monitor at the OS level and most important, capable to identify and kill threats coming into the monitored devices?
During this talk we will walk you through the steps needed to setup a framework running on Renesas R-Car H3 board able to monitor ARM-based devices and to kill malicious threats identified. Also will discuss challenges on syscall monitoring, single-stepping limitations, techniques to stay stealthy or to get better latency, techniques to detect and kill traditional malware seen in enterprise like Ransomware, Heap Exploits and capabilities on VM Escape attacks and feasibilty to detect Spectre-like exploits.
Return to Index - Add to
- ics
Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Saturday - 13:00-13:30
13:00-13:30
What Happens when the Block Reward Runs Out? The Critical Role of the Minimum Block Reward (Tail Emission) in Monero.
Francisco “ArticMine” Cabañas, Member of the Monero Core Team
Francisco will provide an overview and review of blockchain scaling and fees in Monero. He will review the relationship between fees and the Cryptonote (now Monero) penalty with an emphasis on the impact of the block reward on fees. He will focus on rational miner behavior, and how this creates a fee market in Monero which is totally dependent upon the block reward. He will also consider the case of the block reward going to zero, how this limits the Satoshi fee market in Bitcoin and the critical differences between Monero and Bitcoin. In addition, he will consider the possible impacts of block rewards falling to zero on large block and adaptive block crypto-currencies.
Return to Index - Add to
- ics
Calendar file
LPV - Bally's - Platinum II Ballroom - Saturday - 15:00-15:45
Title:
What I Wish I Knew When I Started Picking
Presented By
Harry
Abstract
A brief discussion of several techniques and concepts that I wish I knew when I started picking.
Return to Index - Add to
- ics
Calendar file
HHV - Bally's Event Center - Saturday - 12:00-12:50
What You Print Is Not What You Get Anymore: Mitm Attack On 3D Printers Network Communications
Hamza Alkofahi
Abstract
Additive Manufacturing (AM) and 3D Printing were conceived to reduce the cost of the prototyping process. Over time, these technologies became faster, more accurate, and much more affordable. All of these factors, as well as the potential to use AM in production parts and systems, have helped rapidly drive the growth of AM in both industrial and personal uses. Thus, there is a concomitant demand to understand the implications of cybersecurity in this field and these systems. In our research, we show how manufacturers of high-end 3D printers failed to protect the confidentiality and integrity of the printed 3D models. Also, our proof of concept demonstrates how network attacks (such as MITM) on 3D printers communication channels can cause a massive impact (such as stealing, replacing or even sabotaging models) on the whole printing process.
Bio
Hamza is a cybersecurity researcher and a white-hat hacker, currently doing his Ph.D. at Auburn University. He is interested in vulnerability assessment, reverse engineering, and detecting business logic vulnerabilities. He developed the first parser for a closed source file format (CMB) also built an automated system for detecting vulnerabilities in critical infrastructure websites.
Return to Index - Add to
- ics
Calendar file
BTVT - Flamingo - 3rd Floor- Savoy Room - Saturday - 16:30-16:59
When A Plan Comes Together: Building A SOC A-Team
Saturday 16:30, Savoy Ballroom, Flamingo (Blue Team Village) (30M)
@markaorlando
started his security career in 2001 as a Security Analyst, and since then has been both fighting for blue team resources and trying to automate them out of a job. He has built, assessed, and managed security teams at the Pentagon, the White House, the Department of Energy, global Managed Security Service Providers, and numerous financial sector and Fortune 500 clients. Short on patience and attention, Mark is constantly working on new projects to improve defensive security through automation and other short cut-y things so defenders can be more agile and creative. While Director of Operations at Foreground Security, he designed and launched a Managed Detection and Response (MDR) service offering and helped to invent an automated cyber threat hunting technology, both of which were later acquired. He enjoys teaching and learning from others but spends far more time doing the latter.
The security industry is facing a severe talent shortage, but the threats are growing in number and sophistication. Finding talent, honing it to meet your specific mission, and retaining it have become immense challenges for modern operations teams. In this talk, we’ll explore these challenges and discuss creative ways to find, train, and equip a security operations “A-Team”.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 3 - Saturday - 12:00-12:45
Why You Should Fear Your “mundane” Office Equipment
Saturday at 12:00 in Track 3
45 minutes | Demo, Tool, Exploit
Daniel Romero Managing Security Consultant, NCC Group
Mario Rivas Senior Security Consultant, NCC Group
The security of common enterprise infrastructure devices such as desktops and laptops has advanced over the years through incremental improvements in operating system and endpoint security. However, security controls for network devices such as enterprise printers are often ignored and thus present a greater potential for exploitation and compromise by threat actors seeking to gain a persistent foothold on target organisations.
In order to assess the current state of mainstream enterprise printer product security and to challenge common assumptions made about the security of these devices, which sit on key parts of enterprise networks and process sensitive data, we set out on a vulnerability and exploitation research project of six known vendors. We were able to find remote vulnerabilities in all printers tested through various attack vectors, revealing a large number of 0-day vulnerabilities in the process.
In this talk we walk through the entire research engagement, from initial phases such as threat modelling to understand printer attack surfaces to the development of attack methodologies and fuzzing tools used to target printer-specific protocols and functions. Besides of remarking important vulnerabilities found and their respective CVE’s, proof of concept exploits showing how it is possible to gain full control of printers and all of the data they manage will be presented. This will show how to use enterprise printers as a method of persistence on a network, perhaps to exfiltrate sensitive data or support C2 persistence on Red Team engagements.
We also address a number of challenges that researchers can face when performing vulnerability research on devices such as printers and how we used different techniques to overcome these challenges, working with limited to no debugging and triage capabilities. We also present mitigations that printer manufacturers can implement in order to reduce printer attack surfaces and render exploitation more difficult.
Daniel Romero
Daniel is currently a security consultant and researcher at NCC Group. During his career he has worked in interesting security projects, always trying to “break” as much as possible. In the last years Daniel has mostly been focused on embedded devices / IoT and all what surrounds it such as hardware, code review, reverse engineering, fuzzing or exploiting.
Twitter: @daniel_rome
Mario Rivas
Mario is a penetration tester and security consultant at NCC Group in Madrid. His interests revolve around all areas of computer security, always trying to learn new things, and specially enjoying writing tools during the process to make his life a bit easier.
Twitter: @Grifo
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 1 - Saturday - 10:00 - 11:50
WiFi Kraken – Scalable Wireless Monitoring
Saturday from 10:00 – 11:50 in Sunset 1 at Planet Hollywood
Audience: Offense, Defense, Hardware
Mike Spicer
This tool is the culmination of lessoned learned during the last 3 years of wireless monitoring at DEF CON using tools like the #WiFiCactus. This demo will show you the software and hardware needed to build a robust wireless monitoring sensor network that is capable of capturing everything up to 802.11ac including Bluetooth. This demo will include a distributed capture network that will take captured data from multiple nodes and send it back to a single capture server. This project will show you how to use advanced features of Kismet Wireless to increase the amount of data you capture. Wireless threats and attacker tactics will be discussed and identified as they happen in the environment. Data analytic techniques will be demonstrated and discussed using tools like Wireshark, NetworkMiner and PCAPinator.
http://palshack.org/def-con-27-demolab/
Mike Spicer
d4rkm4tter is a mad scientist hacker who likes to meddle with hardware and software. He is particularly obsessed with wireless. He has a degree in computer science from Southern Utah University which he has put to use building and breaking a wide array of systems. These include web application pentesting, wireless monitoring and tracking as well as good old fashioned reverse engineering. He is the creator of the #WiFiCactus and has been seen presenting Demolabs at DEF CON and DEF CON China Beta. He is a Kismet cultist and active in the wireless and wardriving communities.
Return to Index - Add to
- ics
Calendar file
ASV - Flamingo 3rd Floor - Mesquite Room - Saturday - 14:00-17:59
WORKSHOP "The OWASP Top Ten for Developers- Secure Coding Seminar"
Student Requirements: Familiarity with the technical details of building web applications and web services from a software engineering point of view.
Laptop Requirements: This seminar will be mostly lecture and demonstration. A laptop is not required but might be useful to take notes.
Description: The major cause of webservice and web application insecurity is insecure software development practices. This highly intensive and interactive 4-hour seminar will provide essential application security training for web application and webservice developers and architects.
The class is a combination of lecture, security testing demonstration and code review. Students will learn the most common threats against applications. More importantly, students will learn how to code secure web and API solutions via defense-based code samples.
Return to Index - Add to
- ics
Calendar file
WS - Flamingo - Lower Level - Lake Mead II - Saturday - 10:00-13:59
Writing custom backdoor payloads using C#
Saturday, 1000-1400 in Flamingo, Lake Mead II
Mauricio Velazco Threat Management Team Lead
Olindo Verrillo Hacker
This workshop aims to provide attendees hands-on experience on writing custom backdoor payloads using C# for the most common command and control frameworks including Metasploit, Powershell Empire and Cobalt Strike. The workshop consists in 7 lab exercises; each of the exercises goes over a different technique that leverages C# and .NET capabilities to obtain a reverse shell on a victim Windows host. The covered techniques include raw shellcode injection, process injection, process hollowing, runtime compilation, parent pid spoofing, antivirus bypassing, etc. At the end of this workshop attendees will have a clear understanding of these techniques both from an attack and defense perspective.
Skill Level Intermediate
Prerequisites: Basic to intermediate programming/scripting skills.
Prior experience with C# helps bot not required.
Materials: Laptop with virtualization software.
A Windows virtual machine
A Kali Linux Virtual Machine.
Max students: 40
Registration: https://www.eventbrite.com/e/writing-custom-backdoor-payloads-using-c-lake-mead-ii-tickets-63439591526
(Opens 8-Jul-19)
Mauricio Velazco
Mauricio Velazco (@mvelazco) is a Peruvian, Infosec geek who started his career as a penetration tester and jumped to the blue team 7 years ago. He currently leads the Threat Management team at a financial services organization in New York where he focuses on threat detection/hunting and adversary simulation. Mauricio has presented and hosted workshops at conferences like Defcon, Derbycon and BSides. He also holds certifications like OSCP and OSCE.
Olindo Verrillo
Olindo Verrillo is a Senior Security Engineer who straddles the line between blue and red. He currently focuses most of his attention on purple teaming and detection engineering. Olindo has worked as Senior consultant, performing both offensive and defensive engagements for numerous Fortune 500 companies.
Return to Index - Add to
- ics
Calendar file
PHVW - Bally's Resort (Indigo) Tower 26th floor - Saturday - 13:40-15:40
Writing Wireshark Plugins for Security Analysis
Nishant Sharma, R&D Manager, Pentester Academy
Jeswin Mathai, Security Researcher, Pentester Academy
Network traffic always proves to be a gold mine when mined with proper tools. There are various open source and paid tools to analyze the traffic but most of them either have predefined functionality or scalability issues or one of a dozen other problems. And, in some cases when we are dealing with non-standard protocols, the analysis becomes more difficult. But, what if we can extend our favourite traffic analysis tool Wireshark to accommodate our requirements? As most people know, Wireshark supports custom plugins created in C and Lua which can be used to analyze or dissect the packets. In this workshop, we will learn the basics of Wireshark plugins and move on to create different types of plugins to perform dissection of non-standard protocol, provide macro statistics, detect attacks etc. We will use examples of older and newer protocols (including non-standard ones) to understand the plugin workflow and development.
Nishant Sharma (Twitter: @wifisecguy) is an R&D Manager at Pentester Academy and Attack Defense. He is also the Architect at Hacker Arsenal where he leads the development of multiple gadgets for WiFi pentesting such as WiMonitor, WiNX and WiMini. He also handles technical content creation and moderation for Pentester Academy TV. He has 7+ years of experience in information security field including 5+ years in WiFi security research and development. He has presented/published his work at Blackhat USA/Asia, DEF CON China, Wireless Village, IoT village and Demo labs (DEFCON USA). Prior to joining Pentester Academy, he worked as a firmware developer at Mojo Networks where he contributed in developing new features for the enterprise-grade WiFi APs and maintaining the state of art WiFi Intrusion Prevention System (WIPS). He has a Master's degree in Information Security from IIIT Delhi. He has also published peer-reviewed academic research on HMAC security. His areas of interest include WiFi and IoT security, AD security, Forensics and Cryptography.
Jeswin Mathai (Twitter: @jeswinmathai) is a Researcher at Pentester Academy and Attack Defense. He has presented/published his work at DEF CON China, Blackhat Arsenal and Demo labs (DEFCON). He has a Bachelor's degree from IIIT Bhubaneswar. He was the team lead at InfoSec Society IIIT Bhubaneswar in association with CDAC and ISEA, which performed security auditing of government portals, conducted awareness workshops for government institutions. He was also the part of team Pied Piper who won Smart India Hackathon 2017, a national level competition organized by GoI. His area of interest includes Malware Analysis and Reverse Engineering, Cryptography, WiFi security and Web Application Security.
Return to Index - Add to
- ics
Calendar file
CLV - Flamingo 3rd Floor - Reno I Room - Saturday - 15:10-15:50
Your Blacklist is Dead. Airgap Everything: The Future of CNC is the Cloud
Speaker: Erick Galinkin
Twitter: @erickgalinkin
Abstract: What happens when attackers start taking advantage of whitelisted APIs as a form of obfuscated command and control? Companies both large and small are moving workloads to the cloud and are very concerned with how to secure their resources which actually live in AWS, GCP, and Azure. However, they don't address how enabling this access changes their internal attack surface and weakens their defenses.
In this talk, we demonstrate that attackers no longer have any reason to rely on conventional CNC, being able to outsource their costs and infrastructure management to the likes of Slack, Github, Pastebin, Dropbox, Google, and social media sites. Using these sorts of techniques, URL blacklisting becomes obsolete, IDS becomes less effective, and attackers no longer have to waste their time writing domain generation algorithms.
Specifically, I will demo a proof-of-concept malware which uses multiple SaaS services, social networks, and more conventional "cloud infrastructure" (S3) that would be extremely difficult to mitigate generically with today's IPS solutions, and we discuss how the same techniques can be used by red teams and attackers to quietly maintain persistence and exfiltrate data.
About Erick: Erick is a security researcher at Netskope focused on malicious SaaS usage and attacks against Microsoft Azure. He previously was previously at Cisco's Talos group where he focused on hunting exploit kits. As part of his academic research at Johns Hopkins University, he conducts research on neural networks, verifiable computing, and computational complexity.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 1 - Saturday - 11:00-11:45
Your Car is My Car
Saturday at 11:00 in Track 1
45 minutes | Demo, Tool, Exploit
Jmaxxz
For many of us, our cars are one of the largest purchases we will ever make. In an always connected world it is natural that we would want to have the convenience of being able to remotely monitor our vehicles: to do everything from remind ourselves exactly where exactly we parked, verify we locked our vehicle, or even remote start it so it will be warmed up (or cooled down) when we get in. There are a variety of vendors offering aftermarket alarm systems that provide these conveniences and offer a peace of mind. But how much can we trust the vendors of these systems are protecting access to our cars in the digital domain? In this talk, Jmaxxz will tell the story of what he found when he looked into one such system.
Jmaxxz
Jmaxxz works as a software engineer, but is a hacker by passion. He is best known for his work on the August Smart Lock (DEF CON 24 “Backdooring the Frontdoor”). In recent years IoT devices have been the focus of his work. He participated in the IoT village zero day track at DEF CON 24 and DEF CON 25. After enduring several polar vortexes, he decided it was probably time to investigate an IoT remote car starter.
twitter: @jmaxxz
Website: jmaxxz.com
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 3 - Saturday - 14:00-14:45
Zero bugs found? Hold my Beer AFL! How To Improve Coverage-Guided Fuzzing and Find New 0days in Tough Targets
Saturday at 14:00 in Track 3
45 minutes | Demo, Tool, Exploit
Maksim Shudrak Security Researcher
Fuzzing remains to be the most effective technique for bugs hunting in memory-unsafe programs. Last year, hundreds of security papers and talks on fuzzing have been published and dozens of them were focused on adapting or improving American Fuzzy Lop in some way. Attracting with its simplicity and efficiency, AFL is the number one choice for the vast majority of security researchers. This high popularity means that hunting for bugs with AFL or a similar tool is becoming less and less fruitful since many projects are already covered by other researchers. It is especially hard when we talk about a project participating in Google OSS-Fuzz program which utilizes AFL to generate a half-trillion test cases per day.
In practice, this means that we can not blindly rely on AFL anymore and should search for better fuzzing techniques. In order to overcome this challenge, we need to understand how AFL and similar fuzzers work and be able to use their weaknesses to find new 0days. This talk is aimed to discuss these weaknesses on real examples, explain how we can do fuzzing better and release a new open-source fuzzer called Manul.
Manul is a high-scalable coverage-guided parallel fuzzer with the ability to search for bugs in open source and black box binaries on Windows and Linux. Manul was able to find 10 0-days in 4 widely-used projects that have been extensively tested by AFL. These vulnerabilities were not found by chance, but by analyzing and addressing issues exist in AFL. Authors will show several of the most critical vulnerabilities and explain why AFL overlooked them.
This talk will be interested for experienced hackers, who are willing to improve their bug hunting capabilities, as well as for new researchers, who are making their first steps on the thorny trail of bug hunting.
Maksim Shudrak
Maksim is a security researcher and vulnerability hunter in open-source and blackbox applications. In the past, he had experience working on dynamic binary instrumentation framework DynamoRIO, developing extremely abstract Windows OS emulator for malware analysis at IBM Research as well as writing sophisticated fuzzer to search for vulnerabilities in machine code. The latter was so exciting that he defended PhD on this topic. Today, he works on Red Team side at large cloud-based software company.
Maksim has spoken at various security conferences around the world such as DEF CON, Positive Hack Days, Virus Bulletin and BSides SF.
Twitter: @Mshudrak
LinkedIn: https://www.linkedin.com/in/mshudrak
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 4 - Saturday - 12:00-12:45
Zombie Ant Farm: Practical Tips for Playing Hide and Seek with Linux EDRs
Saturday at 12:00 in Track 4
45 minutes | Demo, Tool
Dimitry Snezhkov Sr. Security Consultant, X-Force Red
EDR solutions have landed in Linux. With the ever increasing footprint of Linux machines deployed in data centers, offensive operators have to answer the call.
In the first part of the talk we will share practical tips and techniques hackers can use to slide under the EDR radar, and expand post-exploitation capabilities.
We will see how approved executables could be used as decoys to execute foreign functionality. We will walk through the process of using well known capabilities of the dynamic loader. We will take lessons from user-land root-kits in evasion choices.
Part two will focus on weaponizing the capabilities. We will show how to create custom preloaders, and use mimicry to hide modular malware in memory. We will create a "Preloader-as-a-Service" capability of sorts by abstracting storage of modular malware from its executing cradles. This PaaS is free to you though!
We fully believe the ability to retool in the field matters, so we have packaged the techniques into reusable code patterns in a toolkit you will be able to use (or base your own code on) after it is released.
This talk is for hackers, offensive operators, malware analysts and system defenders. We sincerely hope defensive hackers can attend and also have fun.
Dimitry Snezhkov
Dimitry Snezhkov is a Sr. Security Consultant for X-Force Red. In this role he hacks code, tools, networks, apps and sometimes subverts human behavior too. Dimitry has spoken at DEF CON, THOTCON, DerbyCon, CircleCityCon, NorthSec, and presented tools at BlackHat Arsenal.
Twitter: @Op_Nomad
Return to Index - Add to
- ics
Calendar file
