DEF CON 23 Hacking Conference

Schedule

Thursday, August 6th Schedule

10:00

This Schedule is tentative and may be changed at any time. Check at an Info Booth for the latest.

Jump to DC Talks Index  -  DC Speakers Index  -  DC Talks List   -  WOS Talks List   -  WShops Talks List   -  DL Talks List

Jump to Thursday  -  Friday  -  Saturday  -  Sunday

Track 4  -   Hardware and Trust Security: Explain it like I’m 5 Teddy Reed & Nick Anderson

DC 101  -   Introduction to SDR and the Wireless Village DaKahuna & satanklawz

Thursday, August 6th Schedule

11:00

Track 4  -   Hacking Web Apps Brent White

DC 101  -   Hackers Hiring Hackers - How to Do Things Better Tottenkoph & IrishMASMS

Bally's Grand Salon  -  Contest Early Registration

Thursday, August 6th Schedule

12:00

Track 4  -   Seeing through the Fog Zack Fasel

DC 101  -   DEF CON 101: The Panel Panel

Bally's Grand Salon  -  Contest Early Registration

Thursday, August 6th Schedule

13:00

Track 4  -   Alice and Bob are Really Confused David Huerta

DC 101  -   DEF CON 101: The Panel Panel

Bally's Grand Salon  -  Contest Early Registration

Thursday, August 6th Schedule

14:00

Track 4  -   Hacker in the Wires Dr. Phil Polstra

DC 101  -   Beyond the Scan: The Value Proposition of Vulnerability Assessment Damon Small

Thursday, August 6th Schedule

15:00

Track 4  -   Forensic Artifacts From a Pass the Hash Attack Gerard Laygui

DC 101  -   Responsible Incident: Covert Keys Against Subverted Technology Latencies, Especially Yubikey 1o57

Thursday, August 6th Schedule

16:00

Track 4  -   Sorry, Wrong Number: Mysteries Of The Phone System — Past and Present "Unregistered436" & "Snide" Owen

DC 101  -   Guests N' Goblins: Exposing Wi-Fi Exfiltration Risks and Mitigation techniques Peter Desfigies, Joshua Brierton & Naveed Ul Islam

Sunset Park Area F  -  *UNOFFICIAL* Defcon Toxic Barbecue XI 16:00 - 20:00

Thursday, August 6th Schedule

17:00

Track 4  -   Backdooring Git John Menerick

DC 101  -   Dark side of the ELF — leveraging dynamic loading to pwn noobs Alessandro Di Federico & Yan Shoshitaishvil

Thursday, August 6th Schedule

18:00

Track 4  -   Secure Messaging for Normal People Justin Engler

DC 101  -   Medical Devices: Pwnage and Honeypots Scott Erven & Mark Collao

Thursday, August 6th Schedule

20:00

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Thursday, August 6th Schedule

21:00

Skyview 5&6  -  B&W Ball Music - An Hobbes

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Thursday, August 6th Schedule

22:00

Skyview 5&6  -  B&W Ball Music - CTRL

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Thursday, August 6th Schedule

23:00

Skyview 5&6  -  B&W Ball Music - Jonn5 and Spherex

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Thursday, August 6th Schedule

24:00

Skyview 5&6  -  B&W Ball Music - DJ %27 ( Thur nite/Fri morn )

Thursday, August 6th Schedule

25:00

Skyview 5&6  -  B&W Ball Music - alikat ( Thur nite/Fri morn )

Friday, August 7th Schedule

09:00

This Schedule is tentative and may be changed at any time. Check at an Info Booth for the latest.

Jump to DC Talks Index  -  DC Speakers Index  -  DC Talks List   -  WOS Talks List   -  WShops Talks List   -  DL Talks List

Jump to Thursday  -  Friday  -  Saturday  -  Sunday

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams

WS LV BR 2  -  Offensive and Defensive: Android Reverse Engineering - Tim Strazzere, Jon Sawyer, & Caleb Fenton

WS LV BR 3  -  Analyzing Internet Attacks with Honeypots - Ioannis Koniaris

WS LV BR 4  -  iOS Application exploitation - Prateek Gianchandani

WS LV BR 5  -  Violent Python - Sam Bowne

WS LV BR 6  -  ARM for Pentesters - Aseem Jakhar

WS LV BR 7  -  Advanced Cyber Exercises - Andrea Guerber

Friday, August 7th Schedule

10:00

Track 1  -   Shall We Play a Game? Tamas Szakaly

Track 2  -   Working together to keep the Internet safe and secure Alejandro Mayorkas

Track 3  -   Welcome to DEF CON DT and 1057

Track 4  -   Bugged Files: Is Your Document Telling on You? Daniel “unicornFurnace” Crowley & Damon Smith

DC 101  -   NSM 101 for ICS Chris Sistrunk

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 2  -  Offensive and Defensive: Android Reverse Engineering - Tim Strazzere, Jon Sawyer, & Caleb Fenton - (continued)

WS LV BR 3  -  Analyzing Internet Attacks with Honeypots - Ioannis Koniaris - (continued)

WS LV BR 4  -  iOS Application exploitation - Prateek Gianchandani - (continued)

WS LV BR 5  -  Violent Python - Sam Bowne - (continued)

WS LV BR 6  -  ARM for Pentesters - Aseem Jakhar - (continued)

WS LV BR 7  -  Advanced Cyber Exercises - Andrea Guerber - (continued)

PH Village / WOS  -  Tools and Techniques Used at the Wall of Sheep (10 - 10:20 AM) - Ming ChowReal World Automation for Rapid Response (10:20 - 11 AM)Monzy Merza

Wireless Village  -  PSK31 Modulation Polyglots - Travis Goodspeed

CP Village B3  -  "DNS and the Future of Authenticity" - indolering

BH Village  -   Parallels in BioSec and InfoSec - 10:00-10:15

ICS Village B1  -  My first ICS Pwnage - Larry Pesce

Friday, August 7th Schedule

10:25

BH Village  -  Social Implications of DNA Acquisition & Storage - 10:25-10:50

Friday, August 7th Schedule

10:30

CP Village B3  -  "Getting In to the Trust Store we Trust" - Ajit Hatti

Friday, August 7th Schedule

11:00

Track 1  -   Stagefright: Scary Code in the Heart of Android Joshua J. Drake

Track 2  -   Licensed to Pwn: The Weaponization and Regulation of Security Research Panel

Track 3  -   Fighting Back in the War on General Purpose Computers Cory Doctorow

Track 4  -   Goodbye Memory Scraping Malware: Hold Out Till "Chip And Pin” Weston Hecker

DC 101  -   Crypto for Hackers Eijah

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 2  -  Offensive and Defensive: Android Reverse Engineering - Tim Strazzere, Jon Sawyer, & Caleb Fenton - (continued)

WS LV BR 3  -  Analyzing Internet Attacks with Honeypots - Ioannis Koniaris - (continued)

WS LV BR 4  -  iOS Application exploitation - Prateek Gianchandani - (continued)

WS LV BR 5  -  Violent Python - Sam Bowne - (continued)

WS LV BR 6  -  ARM for Pentesters - Aseem Jakhar - (continued)

WS LV BR 7  -  Advanced Cyber Exercises - Andrea Guerber - (continued)

PH Village / WOS  -  Mobile Data Loss - Threats & Countermeasures - Mike Raggo

Wireless Village  -  WPA Enterprise Hacking - Vivek Ramachandran & Mister_X - 11:00 - 12:30

CP Village B3  -  "Using Privacy and Crypto Tools" - Edmond Rogers (bigezy) & Shane Rogers (bust3r)

CP Village B4  -  "Modern Crypto: 15 Years of Advancement in Cryptography" - Steve Weis

ICS Village B1  -  Raspberry PI, a little IO with SDN equals "control network in a box" - Matthew E. Luallen

Friday, August 7th Schedule

11:30

CP Village B3  -  "Peerio: Productivity with end-to-end encryption" - Nadim Kobeissi

Friday, August 7th Schedule

12:00

Track 1  -   Malware in the Gaming Micro-economy Zack Allen & Rusty Bower

Track 2  -   Licensed to Pwn: The Weaponization and Regulation of Security Research cont.

Track 3  -   USB Attack to Decrypt Wi-Fi Communications Jeremy Dorrough

Track 4  -   Confessions of a Professional Cyber Stalker Ken Westin

DC 101  -   Bruce Schneier Q&A Bruce Schneier

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 2  -  Offensive and Defensive: Android Reverse Engineering - Tim Strazzere, Jon Sawyer, & Caleb Fenton - (continued)

WS LV BR 3  -  Analyzing Internet Attacks with Honeypots - Ioannis Koniaris - (continued)

WS LV BR 4  -  iOS Application exploitation - Prateek Gianchandani - (continued)

WS LV BR 5  -  Violent Python - Sam Bowne - (continued)

WS LV BR 6  -  ARM for Pentesters - Aseem Jakhar - (continued)

WS LV BR 7  -  Advanced Cyber Exercises - Andrea Guerber - (continued)

PH Village / WOS  -  Sniffing SCADA - Karl Koscher

Wireless Village  -  WPA Enterprise Hacking - Vivek Ramachandran & Mister_X - 11:00 - 12:30 (Continued)

CP Village B3  -  Keynote: Crypto & Privacy Village

IoT Talks B4  -  Cameras, Thermostats, and Home Automation Controllers - Hacking 14 IoT Devices - Wesley Wineberg

IoT WS B2  -  Press Event - TBD - 30 mins long

Bally's penthouse suite  -  Escape to the IOAsis - DEF CON style! - IOActive Las Vegas

Friday, August 7th Schedule

12:30

CP Village B3  -  Keynote: Underhanded Crypto Contest - Adam Caudill & Taylor Hornby

Friday, August 7th Schedule

13:00

Track 1  -   Insteon' False Security And Deceptive Documentation Peter Shipley & Ryan Gooler

Track 2  -   Drive It Like You Hacked It: New Attacks and Tools to Wirelessly Steal Cars Samy Kamkar

Track 3  -   Red vs. Blue: Modern Active Directory Attacks & Defense Sean Metcalf

Track 4  -   Don't Whisper my Chips: Sidechannel and Glitching for Fun and Profit Colin O'Flynn

DC 101  -   Applied Intelligence: Using Information That's Not There Michael Schrenk

PH Village / WOS  -  dnstap - A Standard Interface to Real Time DNS Transaction Flows - Paul Vixie

Wireless Village  -  SIGINT and Blind Signal Analysis with GNU Radio + Advanced SDR - Balint Seeber

CP Village B3  -  "Life of PII: A Day in the Life of Your Personally Identifiable Information" - Alisha Kloc

IoT WS B2  -  Behind the Scene with the Village - ISE - 30 mins long

Bally's penthouse suite  -  Escape to the IOAsis - DEF CON style! - IOActive Las Vegas

ICS Village B1  -  Vulnerability Inheritance in Industrial Systems - K. Reid Wightman

Skyview 2  -  Kali 2.0 Dojo Workshops

Friday, August 7th Schedule

14:00

Track 1  -   Build a free cellular traffic capture tool with a vxworks based femoto Yuwei Zheng & Haoqi Shan

Track 2  -   How to Hack a Tesla Model S Marc Rogers & Kevin Mahaffey

Track 3  -   Remote Access, the APT Ian Latter

Track 4  -   Cracking Cryptocurrency Brainwallets Ryan Castellucci

DC 101  -   Hacking SQL Injection for Remote Code Execution on a LAMP stack Nemus

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 2  -  Offensive and Defensive: Android Reverse Engineering - Tim Strazzere, Jon Sawyer, & Caleb Fenton - (continued)

WS LV BR 3  -  Excuse me, your RFID is showing - Valerie Thomas & Terry Gold

WS LV BR 4  -  iOS Application exploitation - Prateek Gianchandani - (continued)

WS LV BR 5  -  Crypto for Hackers: The Workshop - Eijah

WS LV BR 6  -  ARM for Pentesters - Aseem Jakhar - (continued)

WS LV BR 7  -  From Spam to Threat Intel - Robert Simmons

PH Village / WOS  -  Hacker's Practice Ground - Lokesh Pidawekar

CP Village B3  -  "Opening Backdoors: The Importance of Backdoor Research" - Adam Caudill

IoT WS B2  -  There are a few of our favorite(hardware) things - Hugo Fiennes, Tom Byrne, Gino Maglio, and Zandr Milewski - @electricimp

Bally's penthouse suite  -  Escape to the IOAsis - DEF CON style! - IOActive Las Vegas

ICS Village B1  -  Raspberry PI, a little IO with SDN equals "control network in a box" - Matthew E. Luallen

Skyview 2  -  Kali 2.0 Dojo Workshops

Friday, August 7th Schedule

14:30

CP Village B3  -  "How to Engineer a Cryptographic 'Front Door'" - Karl Koscher

Friday, August 7th Schedule

15:00

Track 1  -   How to hack your way out of home detention AmmonRa

Track 2  -   Low-cost GPS simulator – GPS spoofing by SDR Lin Huang & Qing Yang

Track 3  -   REvisiting RE:DoS Eric (XlogicX) Davisson

Track 4  -   Quantum Computers vs. Computers Security Jean-Philippe Aumasson

DC 101  -   Chellam – a Wi-Fi IDS/Firewall for Windows Vivek Ramachandran

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 2  -  Offensive and Defensive: Android Reverse Engineering - Tim Strazzere, Jon Sawyer, & Caleb Fenton - (continued)

WS LV BR 3  -  Excuse me, your RFID is showing - Valerie Thomas & Terry Gold - (continued)

WS LV BR 4  -  iOS Application exploitation - Prateek Gianchandani - (continued)

WS LV BR 5  -  Crypto for Hackers: The Workshop - Eijah - (continued)

WS LV BR 6  -  ARM for Pentesters - Aseem Jakhar - (continued)

WS LV BR 7  -  From Spam to Threat Intel - Robert Simmons - (continued)

PH Village / WOS  -  Global Honeypot Trend - Elliott Brink

Wireless Village  -  The Wireless World of the Internet of Things - JP Dunning

CP Village B3  -  "Let's Talk about Let's Encrypt" - Bill Budington

BH Village  -  Physiology from the Perspective of Control: A Bio-hacker's Guide - 15:00-15:20

Contest Area Stage  -  Beard and Moustache Contest ( 15:00 - 17:00 )

Bally's penthouse suite  -  Escape to the IOAsis - DEF CON style! - IOActive Las Vegas

Skyview 2  -  Kali 2.0 Dojo Workshops

Friday, August 7th Schedule

15:30

BH Village  -  Examining the Robustness of the Brain Against a Malicious Adversary - 15:30-15:50

Friday, August 7th Schedule

16:00

Track 1  -   HamSammich – long distance proxying over radio Robert Graham & David Maynor

Track 2  -   Harness: Powershell Weaponization Made Easy (or at least easier) Rich Kelley

Track 3  -   When the Secretary of State says: “Please Stop Hacking Us…” David An

Track 4  -   Tell me who you are and I will tell you your lock pattern Marte Løge

DC 101  -   LTE Recon and Tracking with RTLSDR Ian Kline

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 2  -  Offensive and Defensive: Android Reverse Engineering - Tim Strazzere, Jon Sawyer, & Caleb Fenton - (continued)

WS LV BR 3  -  Excuse me, your RFID is showing - Valerie Thomas & Terry Gold - (continued)

WS LV BR 4  -  iOS Application exploitation - Prateek Gianchandani - (continued)

WS LV BR 5  -  Crypto for Hackers: The Workshop - Eijah - (continued)

WS LV BR 6  -  ARM for Pentesters - Aseem Jakhar - (continued)

WS LV BR 7  -  From Spam to Threat Intel - Robert Simmons - (continued)

SE Village  -  Yellow Means Proceed with Caution - Applied De-escalation for Social Engineering - Noah Beddome

PH Village / WOS  -  Remaining Covert in an Overt World - Mike Raggo, Chet Hosmer

Wireless Village  -  Covert Wireless: Practical Hacker LPI-LPD - Wireless Warrior - 16:00 - 17:30

CP Village B3  -  "Machine Learning and Manipulation" - Jennifer Helsby (redshiftzero)

CP Village B4  -  "CFSSL: the evolution of a PKI toolkit" - Nick Sullivan

IoT WS B2  -  Security of Wireless Home Automation Systems - A World Beside TCP/IP - Tobias Zillner & Sebastian Strobl

Contest Area Stage  -  Beard and Moustache Contest ( 15:00 - 17:00 )

Bally's penthouse suite  -  Escape to the IOAsis - DEF CON style! - IOActive Las Vegas

Skyview 2  -  Kali 2.0 Dojo Workshops

Friday, August 7th Schedule

16:30

Track 1  -   How to secure the keyboard chain Paul Amicelli & Baptiste David

Track 2  -   I Will Kill You Chris Rock

Track 3  -   Put on your tinfo_t hat if you're my type miaubiz

Track 4  -   Separating Bots from the Humans Ryan Mitchell

DC 101  -   Detecting Randomly Generated Strings; A Language Based Approach Mahdi Namazifar

CP Village B3  -  "Beginner Crypto for Application Developers" - Justin Engler

CP Village B4  -  "IMSI Catcher Counter-Surveillance" - Freddy Martinez

Friday, August 7th Schedule

17:00

Track 1  -   When IoT attacks: hacking a Linux-powered rifle Runa A. Sandvik & Michael Auger

Track 2  -   Fun with Symboliks atlas

Track 3  -   NetRipper - Smart traffic sniffing for penetration testers Ionut Popescu

Track 4  -   Hack the Legacy! IBM i (aka AS/400) Revealed Bart Kulach

DC 101  -   I Am Packer And So Can You Mike Sconzo

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 2  -  Offensive and Defensive: Android Reverse Engineering - Tim Strazzere, Jon Sawyer, & Caleb Fenton - (continued)

WS LV BR 3  -  Excuse me, your RFID is showing - Valerie Thomas & Terry Gold - (continued)

WS LV BR 4  -  iOS Application exploitation - Prateek Gianchandani - (continued)

WS LV BR 5  -  Crypto for Hackers: The Workshop - Eijah - (continued)

WS LV BR 6  -  ARM for Pentesters - Aseem Jakhar - (continued)

WS LV BR 7  -  From Spam to Threat Intel - Robert Simmons - (continued)

SE Village  -  “I Didn’t Think it was Loaded” and Other Mental Derps - Michele Fincher

PH Village / WOS  -  Violating Web Services - Ron Taylor

Wireless Village  -  Covert Wireless: Practical Hacker LPI-LPD - Wireless Warrior - 16:00 - 17:30 (Continued)

CP Village B3  -  "Breaking RSA - new cryptography for a post-quantum world" - Jennifer Katherine Fernick

IoT Talks B4  -  Yes, You Can Walk on Water: Application & Product Security on a Startup Budget - Brian Knopf

Bally's penthouse suite  -  Escape to the IOAsis - DEF CON style! - IOActive Las Vegas

Friday, August 7th Schedule

17:30

CP Village B3  -  OPEN MIC/Key Signing Party

Friday, August 7th Schedule

18:00

Track 1  -   How to Train Your RFID Hacking Tools Craig Young

Track 2  -   Drinking from LETHE: New methods of exploiting and mitigating memory corruption vulnerabilities Daniel Selifonov

Track 3  -   Hooked Browser Meshed-Networks with WebRTC and BeEF Christian (@xntrik) Frichot

Track 4  -   Breaking SSL Using Time Synchronisation Attacks Jose Selvi

DC 101  -   Rocking the Pocket Book: Hacking Chemical Plant for Competition and Extortion Marina Krotofil & Jason Larsen

SE Village  -  Understanding Social Engineering Attacks with Natural Language Processing - Ian Harris

PH Village / WOS  -  Penetration Testing Using a Raspberry Pi - Joseph Muniz, Aamir Lakhani

IoT WS B2  -  Round Table

Le Bar Du Sport (near the sports book) - Paris Hotel & Casino  -  Reddit meetup at Defcon 23!!

Friday, August 7th Schedule

19:00

Track 1  -   One Device to Pwn Them All Dr. Phil Polstra

SE Village  -  I Am Not What I Am: Shakespeare and Social Engineering - John Ridpath

Friday, August 7th Schedule

20:00

Track 3  -  Hacker Jeopardy ( unknown start/end time, check info )

SE Village  -  Classify Targets to Make Social Engineering Easier to Achieve - Heng Guan

Skyview 5&6  -  B&W Ball Music - VJ Q.Alba

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Las Vegas Ballroom 1-3  -  Silent Circle ( unknown start/end time, check info )

Las Vegas Ballroom 4-5  -  Aerial Drone Warz ( unknown start/end time, check info )

Main Bally's pool  -  Queercon Pool Party - DJ Abstrct

Skyview 1  -  Hacker Karaoke ( unknown start/end time, check info )

Skyview 3-4  -  303 party ( unknown start/end time, check info )

Friday, August 7th Schedule

21:00

Track 3  -  Hacker Jeopardy ( unknown start/end time, check info )

Skyview 5&6  -  B&W Ball Music - PyrO

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Las Vegas Ballroom 1-3  -  Silent Circle ( unknown start/end time, check info )

Las Vegas Ballroom 4-5  -  Aerial Drone Warz ( unknown start/end time, check info )

Las Vegas Ballroom 6-7  -  unlocked

Main Bally's pool  -  Queercon Pool Party - DJ Abstrct

Skyview 1  -  Hacker Karaoke ( unknown start/end time, check info )

Skyview 3-4  -  303 party ( unknown start/end time, check info )

Top Floor Jubilee Tower  -  503 party

Friday, August 7th Schedule

22:00

Track 3  -  Hacker Jeopardy ( unknown start/end time, check info )

Skyview 5&6  -  B&W Ball Music - Dualcore

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Las Vegas Ballroom 1-3  -  Silent Circle ( unknown start/end time, check info )

Las Vegas Ballroom 4-5  -  Aerial Drone Warz ( unknown start/end time, check info )

Las Vegas Ballroom 6-7  -  unlocked

Main Bally's pool  -  Queercon Pool Party - Skittish and Bus

Skyview 1  -  Hacker Karaoke ( unknown start/end time, check info )

Skyview 3-4  -  303 party ( unknown start/end time, check info )

Top Floor Jubilee Tower  -  503 party

Friday, August 7th Schedule

22:30

Skyview 2  -  DEF CON Groups / Forum Party

Friday, August 7th Schedule

23:00

Track 3  -  Hacker Jeopardy ( unknown start/end time, check info )

Skyview 5&6  -  B&W Ball Music - mc chris

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Las Vegas Ballroom 1-3  -  Silent Circle ( unknown start/end time, check info )

Las Vegas Ballroom 4-5  -  Aerial Drone Warz ( unknown start/end time, check info )

Las Vegas Ballroom 6-7  -  unlocked

Main Bally's pool  -  Queercon Pool Party - Skittish and Bus

Skyview 1  -  Hacker Karaoke ( unknown start/end time, check info )

Skyview 2  -  DEF CON Groups / Forum Party

Skyview 3-4  -  303 party ( unknown start/end time, check info )

Top Floor Jubilee Tower  -  503 party

Friday, August 7th Schedule

24:00

Skyview 5&6  -  B&W Ball Music - YTCracker ( Thur nite/Fri morn )

Main Bally's pool  -  Queercon Pool Party - Skittish and Bus ( Fri nite / Sat morn )

Skyview 2  -  DEF CON Groups / Forum Party

Top Floor Jubilee Tower  -  503 party

Friday, August 7th Schedule

24:30

Main Bally's pool  -  Queercon Pool Party - DJ Mass Effect ( Fri nite / Sat morn )

Friday, August 7th Schedule

25:00

Skyview 5&6  -  B&W Ball Music - Ninjula ( Thur nite/Fri morn )

Main Bally's pool  -  Queercon Pool Party - DJ Mass Effect ( Fri nite / Sat morn )

Friday, August 7th Schedule

26:00

Main Bally's pool  -  Queercon Pool Party - DJ Mass Effect ( Fri nite / Sat morn )

Saturday, August 8th Schedule

09:00

This Schedule is tentative and may be changed at any time. Check at an Info Booth for the latest.

Jump to DC Talks Index  -  DC Speakers Index  -  DC Talks List   -  WOS Talks List   -  WShops Talks List   -  DL Talks List

Jump to Thursday  -  Friday  -  Saturday  -  Sunday

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams

WS LV BR 3  -  From 0 To Pwnd - The Ultimate Social Engineering Primer - Valerie Thomas

WS LV BR 4  -  Running KALI on a Raspberry PI and other fun tricks - Dallas

WS LV BR 5  -  Security Auditing Mobile App - Sam Bowne

WS LV BR 6  -  The Art of VoIP Hacking - Fatih Ozavci

WS LV BR 7  -  Embedded System Design - Rodrigo Maximiano Antunes de Almeida

Skyview 2  -  Ham Radio Exams ( 09:00 - 17:00 )

Saturday, August 8th Schedule

10:00

Track 1  -   Scared Poopless – LTE and *your* laptop Mickey Shkatov & Jesse Michael

Track 2  -   ThunderStrike 2: Sith Strike Trammel Hudson, Xeno Kovah, Corey Kallenberg

Track 3  -   Do Export Controls on “Intrusion Software” Threaten Vulnerability Research? Tom Cross aka Decius & Collin Anderson

Track 4  -   Dissecting the Design of SCADA Web Human Machine Interfaces (HMIs) - Hunting Vulnerabilities Aditya K Sood

DC 101  -   A Hacker’s Guide to Risk Bruce Potter

DL Table 1  -  CuckooDroid - Idan Revivo

DL Table 2  -  CANtact - Eric Evenchick

DL Table 3  -  SpeedPhishing Framework (SPF) - Adam Compton

DL Table 4  -  Ombuds - Nick Skelsey

DL Table 5  -  MozDef: The Mozilla Defense Platform - Jeff Bryner

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 3  -  From 0 To Pwnd - The Ultimate Social Engineering Primer - Valerie Thomas - (continued)

WS LV BR 4  -  Running KALI on a Raspberry PI and other fun tricks - Dallas - (continued)

WS LV BR 5  -  Security Auditing Mobile App - Sam Bowne - (continued)

WS LV BR 6  -  The Art of VoIP Hacking - Fatih Ozavci - (continued)

WS LV BR 7  -  Embedded System Design - Rodrigo Maximiano Antunes de Almeida - (continued)

PH Village / WOS  -  How Machine Learning Finds Malware Needles in an AppStore Haystack - Theodora Titonis

Wireless Village  -  Wireless Pentesting So Easy A Cave Man Can Do It - Cyb3r-Assassin - 10:00 - 11:30

CP Village B3  -  "Should we trust crypto frameworks? A story about CVE-2015-2141" - Anton Karpov

IoT WS B2  -  Hacking You Fat: The FitBit Aria - Ken Munro & David Lodge @TheKenMuroShow

ICS Village B1  -  Electric Grid: A Multiplayer Game of Destruction - Kenneth Shaw, Jerel Culliss

Skyview 2  -  Ham Radio Exams ( 09:00 - 17:00 )

Saturday, August 8th Schedule

10:30

CP Village B3  -  "Where are the privacy-preserving services for the masses?" - Hadi Asghari

Saturday, August 8th Schedule

11:00

Track 1  -   Key-Logger, Video, Mouse — How To Turn Your KVM Into a Raging Key-logging Yaniv Balmas & Lior Oppenheim

Track 2  -   Machine vs. Machine: Inside DARPA’s Fully Automated CTF Michael Walker & Jordan Wiens

Track 3  -   'DLL Hijacking' on OS X? #@%& Yeah! Patrick Wardle

Track 4  -   QARK: Android App Exploit and SCA Tool Tony Trummer & Tushar Dalvi

DC 101  -   And That's How I Lost My Other Eye: Further Explorations In Data Destruction Zoz

DL Table 1  -  CuckooDroid - Idan Revivo - (continued)

DL Table 2  -  CANtact - Eric Evenchick - (continued)

DL Table 3  -  SpeedPhishing Framework (SPF) - Adam Compton - (continued)

DL Table 4  -  Ombuds - Nick Skelsey - (continued)

DL Table 5  -  MozDef: The Mozilla Defense Platform - Jeff Bryner - (continued)

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 3  -  From 0 To Pwnd - The Ultimate Social Engineering Primer - Valerie Thomas - (continued)

WS LV BR 4  -  Running KALI on a Raspberry PI and other fun tricks - Dallas - (continued)

WS LV BR 5  -  Security Auditing Mobile App - Sam Bowne - (continued)

WS LV BR 6  -  The Art of VoIP Hacking - Fatih Ozavci - (continued)

WS LV BR 7  -  Embedded System Design - Rodrigo Maximiano Antunes de Almeida - (continued)

PH Village / WOS  -  MITM 101: Easy Traffic Interception Techniques Using Scapy - Bob Simpson

Wireless Village  -  Wireless Pentesting So Easy A Cave Man Can Do It - Cyb3r-Assassin - 10:00 - 11:30 (Continued)

CP Village B3  -  "Skip, Freak, and Logjam: Moving past a legacy of weakness in TLS" - Karthikeyan Bhargavan

CP Workshop B3  -  "How Do I Tails? A Beginner's Guide to Anonymous Computing" - Forrest (Forbo)

ICS Village B1  -  Raspberry PI, a little IO with SDN equals "control network in a box" - Matthew E. Luallen

Skyview 2  -  Ham Radio Exams ( 09:00 - 17:00 )

Saturday, August 8th Schedule

12:00

Track 1  -   Hacking Smart Safes: On the "Brink" of a Robbery Dan “AltF4” Petro & Oscar Salazar

Track 2  -   F*ck the attribution, show us your .idb! Morgan Marquis-Boire, Marion Marschalek, Claudio Guarnieri

Track 3  -   I Hunt Penetration Testers: More Weaknesses in Tools and Procedures Wesley McGrew

Track 4  -   Chigula — a framework for Wi-Fi Intrusion Detection and Forensics Vivek Ramachandran

DC 101  -   Are We Really Safe? - Bypassing Access Control Systems Dennis Maldonado

DL Table 1  -  Fiber Optic Tapping - Josh Ruppe

DL Table 2  -  The Deck - Dr. Phil (Polstra)

DL Table 3  -  Shevirah - Georgia Weidman

DL Table 4  -  Rudra - Ankur Tyagi

DL Table 5  -  SecBee - An automated ZigBee security - Tobias Zillner

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 3  -  From 0 To Pwnd - The Ultimate Social Engineering Primer - Valerie Thomas - (continued)

WS LV BR 4  -  Running KALI on a Raspberry PI and other fun tricks - Dallas - (continued)

WS LV BR 5  -  Security Auditing Mobile App - Sam Bowne - (continued)

WS LV BR 6  -  The Art of VoIP Hacking - Fatih Ozavci - (continued)

WS LV BR 7  -  Embedded System Design - Rodrigo Maximiano Antunes de Almeida - (continued)

PH Village / WOS  -  I See You - Brian Wohlwinder, Andrew Beard

Wireless Village  -  Software Defined Radio Performance Trades and Tweaks - Michael Calabro

CP Village B3  -  "What is Bitcoin Tumbling and why do it?" - Sean Thomas Jones

IoT Talks B4  -  A Surface Area Approach to Pentesting the IoT - Daniel Miessler

IoT WS B2  -  Press Event - TBD - 30 mins long

Chillout Lounge  -  DEAF CON meetup

Skyview 2  -  Ham Radio Exams ( 09:00 - 17:00 )

Saturday, August 8th Schedule

12:30

CP Village B3  -  "The design and implementation of a white-listed, end to end encrypted status application" - David Dahl

Saturday, August 8th Schedule

13:00

Track 1  -   Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service Colby Moore

Track 2  -   Angry Hacking - the next generation of binary analysis Yan Shoshitaishvili & Fish Wang

Track 3  -   WhyMI so Sexy? WMI Attacks, Real-Time Defense, and Advanced Forensic Analysis Matt Graeber, Willi Ballentin, Claudiu Teodorescu

Track 4  -   From 0 To Secure In 1 Minute — Securing IAAS Nir Valtman & Moshe Ferber

DC 101  -   It's The Only Way To Be Sure: Obtaining and Detecting Domain Persistence Grant Bugher

DL Table 1  -  Fiber Optic Tapping - Josh Ruppe - (continued)

DL Table 2  -  The Deck - Dr. Phil (Polstra) - (continued)

DL Table 3  -  Shevirah - Georgia Weidman - (continued)

DL Table 4  -  Rudra - Ankur Tyagi - (continued)

DL Table 5  -  SecBee - An automated ZigBee security - Tobias Zillner - (continued)

PH Village / WOS  -  PowerShell for Penetration Testers - Nikhil Mittal

Wireless Village  -  DSP for SDR - Karl Koscher

CP Village B3  -  "Death of Privacy" - Stealth

CP Village B4  -  "Hacking Quantum Cryptography" - Marina (bt3)

IoT WS B2  -  Speaker Q&A - TBA - 45 mins long

ICS Village B1  -  The Little Pump Gauge that Could: Attacks Against Gas Pump Monitoring Systems - Kyle Wilhoit, Stephen Hilt

Skyview 2  -  Ham Radio Exams ( 09:00 - 17:00 )

Saturday, August 8th Schedule

14:00

Track 1  -   Extracting the Painful (blue)tooth Matteo Beccaro & Matteo Collura

Track 2  -   Remote exploitation of an unaltered passenger vehicle Charlie Miller and Chris Valasek

Track 3  -   WhyMI so Sexy? WMI Attacks, Real-Time Defense, and Advanced Forensic Analysis cont.

Track 4  -   BurpKit — Using WebKit to Own the Web Nadeem Douba

DC 101  -   Abusing XSLT for Practical Attacks Fernando Arnaboldi

DL Table 1  -  Emanate like a boss - Ang Cui

DL Table 2  -  PortaPack H1 Portable SDR - Jared Boone

DL Table 3  -  Sphinx - Takehiro Takahashi

DL Table 4  -  QARK - Android Exploitation and Static Code Analysis Tool - Tony Trummer and Tushar Dalvi

DL Table 5  -  Badge Jeopardy - Fuzzbizz

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 3  -  From 0 To Pwnd - The Ultimate Social Engineering Primer - Valerie Thomas - (continued)

WS LV BR 4  -  Running KALI on a Raspberry PI and other fun tricks - Dallas - (continued)

WS LV BR 5  -  Crypto for Hackers: The Workshop - Eijah

WS LV BR 6  -  The Art of VoIP Hacking - Fatih Ozavci - (continued)

WS LV BR 7  -  Embedded System Design - Rodrigo Maximiano Antunes de Almeida - (continued)

PH Village / WOS  -  The Packets Made Me Do It: Getting Started with Distributed Full Packet Capture Using OpenFPC - Leon Ward

Wireless Village  -  Automating Live WPA/WPA2 Attacks with Wpa_Supplicant - Vivek Ramachandran

CP Village B3  -  "CrypTag: Building Encrypted, Taggable, Searchable Zero-knowledge Systems" - Steven Phillips

IoT WS B2  -  Hacking Satellite TV Receivers - Sofiane Talmat @_Sud0

BH Village  -  Biohacking: The Anatomy of DIY Implantable Devices - 14:00-14:25

ICS Village B1  -  Raspberry PI, a little IO with SDN equals "control network in a box" - Matthew E. Luallen

Skyview 2  -  Ham Radio Exams ( 09:00 - 17:00 )

Saturday, August 8th Schedule

14:30

CP Village B3  -  "Making Email Dark" - Ladar Levison & Fred Nixon

BH Village  -  Cloning Access Cards to Implants - 14:30-14:55

Saturday, August 8th Schedule

15:00

Track 1  -   Looping Surveillance Cameras through Live Editing of Network Streams Eric Van Albert & Zach Banks

Track 2  -   Hacking Electric Skateboards: Vehicle Research For Mortals Mike Ryan & Richo Healey

Track 3  -   High-Def Fuzzing: Exploring Vulnerabilities in HDMI-CEC Joshua Smith

Track 4  -   Let's Encrypt - Minting Free Certificates to Encrypt the Entire Web Peter Eckersley, James Kasten, & Yan Zhu

DC 101  -   Extending Fuzzing Grammars to Exploit Unexplored Code Paths in Modern Web Browsers Saif El-Sherei & Etienne Stalmans

DL Table 1  -  Emanate like a boss - Ang Cui - (continued)

DL Table 2  -  PortaPack H1 Portable SDR - Jared Boone - (continued)

DL Table 3  -  Sphinx - Takehiro Takahashi - (continued)

DL Table 4  -  QARK - Android Exploitation and Static Code Analysis Tool - Tony Trummer and Tushar Dalvi - (continued)

DL Table 5  -  Badge Jeopardy - Fuzzbizz - (continued)

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 3  -  From 0 To Pwnd - The Ultimate Social Engineering Primer - Valerie Thomas - (continued)

WS LV BR 4  -  Running KALI on a Raspberry PI and other fun tricks - Dallas - (continued)

WS LV BR 5  -  Crypto for Hackers: The Workshop - Eijah - (continued)

WS LV BR 6  -  The Art of VoIP Hacking - Fatih Ozavci - (continued)

WS LV BR 7  -  Embedded System Design - Rodrigo Maximiano Antunes de Almeida - (continued)

PH Village / WOS  -  Is Your Android App Secure? - Sam Bowne

Wireless Village  -  GNU Radio Tools for Radio Wrangling and Spectrum Domination - Tim O'Shea

CP Village B3  -  "STD's are the least of your worries when Cyber Cancer Prognosis is imminent" - Chris Brown (BigBiz)

Skyview 2  -  Ham Radio Exams ( 09:00 - 17:00 )

Saturday, August 8th Schedule

16:00

Track 1  -   Switches Get Stitches Colin Cassidy, Éireann Leverett, Robert M. Lee

Track 2  -   I want these * bugs off my * Internet Dan Kaminsky

Track 3  -   Investigating the Practicality and Cost of Abusing Memory Errors with DNS Luke Young

Track 4  -   NSA Playset: JTAG Implants Joe FitzPatrick & Matt King

DC 101  -   How to Shot Web: Web and mobile hacking in 2015 Jason Haddix

DL Table 1  -  Haka - An open source security oriented language - Mehdi Talbi

DL Table 2  -  The ShadyShield - Karl Koscher

DL Table 3  -  Digital Disease Tracking Web App - Efrain Ortiz & Dave Ewall

DL Table 4  -  SWATtack – Smartwatch Attack Tool - Michael Raggo

DL Table 5  -  HamShield: A wideband VHF/UHF FM transceiver for your Arduino - Casey Halverson

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 3  -  From 0 To Pwnd - The Ultimate Social Engineering Primer - Valerie Thomas - (continued)

WS LV BR 4  -  Running KALI on a Raspberry PI and other fun tricks - Dallas - (continued)

WS LV BR 5  -  Crypto for Hackers: The Workshop - Eijah - (continued)

WS LV BR 6  -  The Art of VoIP Hacking - Fatih Ozavci - (continued)

WS LV BR 7  -  Embedded System Design - Rodrigo Maximiano Antunes de Almeida - (continued)

SE Village  -  Breaking in Bad! (I’m the one who doesn’t knock) - Jayson Street

PH Village / WOS  -  sup3r s3cr3t -

Wireless Village  -  Rollin' down the street sniffin' WiFi, sippin on Pineapple Juice - Darren Kitchen & Seb Kinne

CP Village B3  -  "Protecting global email - status & the road ahead" - Per Thorsheim

IoT WS B2  -  Advanced SOHO Router Exploitation (MIPS/ARM) - Lyon Yang @l0Op3r

Skyview 2  -  Ham Radio Exams ( 09:00 - 17:00 )

Saturday, August 8th Schedule

16:30

CP Village B3  -  "Engineering Responsible Data Governance - A Privacy by Design Primer" - Steven F. Fox

Saturday, August 8th Schedule

17:00

Track 1  -   Exploring Layer 2 Network Security in Virtualized Environments Ronny L. Bull & Jeanna N. Matthews

Track 2  -   Security Necromancy: Further Adventures in Mainframe Hacking Philip Young & Chad "Bigendian Smalls” Rikansrud

Track 3  -   802.11 Massive Monitoring Andres Blanco & Andres Gazzoli

Track 4  -   Hacking the Human Body/brain: Identity Shift, the Shape of a New Self, and Humanity 2.0 Richard Thieme

DC 101  -   The Bieber Project: Ad Tech 101, Fake Fans and Adventures in Buying Internet Traffic Mark Ryan Talabis

DL Table 1  -  Haka - An open source security oriented language - Mehdi Talbi - (continued)

DL Table 2  -  The ShadyShield - Karl Koscher - (continued)

DL Table 3  -  Digital Disease Tracking Web App - Efrain Ortiz & Dave Ewall - (continued)

DL Table 4  -  SWATtack – Smartwatch Attack Tool - Michael Raggo - (continued)

DL Table 5  -  HamShield: A wideband VHF/UHF FM transceiver for your Arduino - Casey Halverson - (continued)

WS LV BR 1  -  Exploited Host Analysis - Robin Jackson & Ed Williams - (continued)

WS LV BR 3  -  From 0 To Pwnd - The Ultimate Social Engineering Primer - Valerie Thomas - (continued)

WS LV BR 4  -  Running KALI on a Raspberry PI and other fun tricks - Dallas - (continued)

WS LV BR 5  -  Crypto for Hackers: The Workshop - Eijah - (continued)

WS LV BR 6  -  The Art of VoIP Hacking - Fatih Ozavci - (continued)

WS LV BR 7  -  Embedded System Design - Rodrigo Maximiano Antunes de Almeida - (continued)

SE Village  -  Twitter, ISIL, and Tech - Tim Newberry

PH Village / WOS  -  Creating REAL Threat Intelligence With Evernote - grecs

Wireless Village  -  TospoVirus: Weaponizing Wifi Pineapple Vulnerabilities - Catatonic

CP Village B3  -  Underhanded Crypto Contest Wrapup - Adam Caudill & Taylor Hornby

IoT Talks B4  -  Securing the IoT world - Aaron Guzman

Saturday, August 8th Schedule

17:30

CP Village B3  -  OPEN MIC/Key Signing Party

Saturday, August 8th Schedule

18:00

Track 1  -   Staying Persistent in Software Defined Networks Gregory Pickett

Track 2  -   Ask the EFF: The Year in Digital Civil Liberties Panel

Track 3  -   DEF CON Comedy Inception: How many levels deep can we go? Panel

Track 4  -   DIY Nukeproofing: a new dig at "data-mining" 3AlarmLampscooter

DC 101  -   Game of Hacks: Play, Hack & Track Amit Ashbel & Maty Siman

SE Village  -  A Peek Behind the Blue Mask: The Evolution of the SECTF - Chris Hadnagy

PH Village / WOS  -  Haking the Next Generation - David Schwartzberg

CP Village B4  -  "Teaching Privacy Using Red Team Strategies: An Undergraduate General Education Curriculum" - Robert Olson (nerdprof)

Saturday, August 8th Schedule

19:00

Track 1  -   Contest: Drunk Hacker History Until 20:20

Track 2  -   Ask the EFF: The Year in Digital Civil Liberties Cont.

Track 3  -   DEF CON Comedy Inception: How many levels deep can we go? Cont.

Track 4  -   I’m A Newbie Yet I Can Hack ZigBee – Take Unauthorized Control Over ZigBee Devices LI Jun & YANG Qing

DC 101  -   Linux Containers: Future or Fantasy? Aaron Grattafiori

SE Village  -  Understanding End-User Attacks – Real World Examples - Dave Kennedy

BH Village  -  Brain Waves Surfing - (In)security in EEG (Electroencephalography) Technologies - 19:00-19:50

Saturday, August 8th Schedule

20:00

Track 1  -  Drunk Hacker History ( unknown start/end time, check info )

Track 3  -  Hacker Jeopardy ( unknown start/end time, check info )

SE Village  -  Phishing: Recon to Creds with the SpeedPhishing Framework - Adam Compton & Eric Gershman

Skyview 5&6  -  B&W Ball Music - Skittish And Bus

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Las Vegas Ballroom 1  -  Access Now ( unknown start/end time, check info )

Skyview 1  -  Hacker Karaoke ( unknown start/end time, check info )

Skyview 3-4  -  303 party ( unknown start/end time, check info )

Saturday, August 8th Schedule

21:00

Track 1  -  Drunk Hacker History ( unknown start/end time, check info )

Track 3  -  Hacker Jeopardy ( unknown start/end time, check info )

Skyview 5&6  -  B&W Ball Music - Miss Jackalope

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Las Vegas Ballroom 1  -  Access Now ( unknown start/end time, check info )

Skyview 1  -  Hacker Karaoke ( unknown start/end time, check info )

Skyview 3-4  -  303 party ( unknown start/end time, check info )

Saturday, August 8th Schedule

22:00

Track 1  -  Drunk Hacker History ( unknown start/end time, check info )

Track 3  -  Hacker Jeopardy ( unknown start/end time, check info )

Skyview 5&6  -  B&W Ball Music - Zebbler Encanti Experience

Bally's Blu Pool  -  IOActive's Freakfest 2015 - IOActive Las Vegas

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Las Vegas Ballroom 1  -  Access Now ( unknown start/end time, check info )

Skyview 1  -  Hacker Karaoke ( unknown start/end time, check info )

Skyview 3-4  -  303 party ( unknown start/end time, check info )

Saturday, August 8th Schedule

22:30

Skyview 2  -  DEF CON Groups / Forum Party

Saturday, August 8th Schedule

23:00

Track 1  -  Drunk Hacker History ( unknown start/end time, check info )

Track 3  -  Hacker Jeopardy ( unknown start/end time, check info )

Skyview 5&6  -  B&W Ball Music - Downlink

Bally's Blu Pool  -  IOActive's Freakfest 2015 - IOActive Las Vegas

Grand Ballroom Gold  -  Movie Night with DT ( unknown movie, start/end time, check info )

Las Vegas Ballroom 1  -  Access Now ( unknown start/end time, check info )

Skyview 1  -  Hacker Karaoke ( unknown start/end time, check info )

Skyview 2  -  DEF CON Groups / Forum Party

Skyview 3-4  -  303 party ( unknown start/end time, check info )

Saturday, August 8th Schedule

24:00

Skyview 5&6  -  B&W Ball Music - Dieselboy ( Thur nite/Fri morn )

Bally's Blu Pool  -  IOActive's Freakfest 2015 - IOActive Las Vegas

Skyview 2  -  DEF CON Groups / Forum Party

Saturday, August 8th Schedule

25:00

Skyview 5&6  -  B&W Ball Music - ZackBarbie ( Thur nite/Fri morn )

Bally's Blu Pool  -  IOActive's Freakfest 2015 - IOActive Las Vegas

Saturday, August 8th Schedule

26:00

Bally's Blu Pool  -  IOActive's Freakfest 2015 - IOActive Las Vegas

Sunday, August 9th Schedule

10:00

This Schedule is tentative and may be changed at any time. Check at an Info Booth for the latest.

Jump to DC Talks Index  -  DC Speakers Index  -  DC Talks List   -  WOS Talks List   -  WShops Talks List   -  DL Talks List

Jump to Thursday  -  Friday  -  Saturday  -  Sunday

Track 1  -   Abusing Adobe Reader’s JavaScript APIs Brian Gorenc, Abdul-Aziz Hariri, Jasiel Spelman

Track 2  -   Docker, Docker, Give Me The News, I Got A Bad Case Of Securing You David Mortman

Track 3  -   How to Hack Government: Technologists as Policy Makers Terrell McSweeny & Ashkan Soltani

DC 101  -   Abusing native Shims for Post Exploitation Sean Pierce

Wireless Village  -  Meeting People Over Wifi - JoshInGeneral

IoT Talks B4  -  Smart Home Invasion - Craig Young

IoT WS B2  -  Pwning* IoT with Hardware Attacks - Chase Schultz @f47h3r_B0

Sunday, August 9th Schedule

11:00

Track 1  -   Who Will Rule the Sky? The Coming Drone Policy Wars Matt Cagle & Eric Cheng

Track 2  -   Canary: Keeping Your Dick Pics Safe(r) Rob Bathurst (evilrob) & Jeff Thomas (xaphan)

Track 3  -   REpsych: Psychological Warfare in Reverse Engineering Chris Domas

DC 101  -   Ubiquity Forensics - Your iCloud and You Sarah Edwards

PH Village / WOS  -  802.11 Monitoring with PCAP2XML/SQLite - Vivek Ramachandran

Wireless Village  -  Seeing Blue: Tools, Tricks, and Techniques for Messin' with Bluetooth™ - Mike Ryan & Dominic Spill - 11:00 - 12:30

CP Village B4  -  "Breaking CBC, or Randomness Never Was Happiness" - Dr. Albert H. Carlson (ECCSmith) & Patrick Doherty

Sunday, August 9th Schedule

11:30

IoT WS B2  -  Special Presentation - TBA - 30 mins long

Sunday, August 9th Schedule

12:00

Track 1  -   Knocking my neighbor’s kid’s cruddy drone offline Michael Robinson

Track 2  -   Pivoting Without Rights – Introducing Pivoter Geoff Walton & Dave Kennedy

Track 3  -   Stick That In Your (root)Pipe & Smoke It Patrick Wardle

DC 101  -   Hijacking Arbitrary .NET Application Control Flow Topher Timzen

PH Village / WOS  -  The Digital Cockroach Bait Station: How to Build Spam Honeypots - Robert Simmons

Wireless Village  -  Seeing Blue: Tools, Tricks, and Techniques for Messin' with Bluetooth™ - Mike Ryan & Dominic Spill - 11:00 - 12:30 (Continued)

Sunday, August 9th Schedule

12:15

IoT WS B2  -  Press Event - TBD - 30 mins long

Sunday, August 9th Schedule

13:00

Track 1  -   Attacking Hypervisors Using Firmware and Hardware Yuriy Bulygin

Track 2  -   Why nation-state malwares target Telco Networks: Dissecting technical capabilities of Regin and its counterparts Omer Coskun

Track 3  -   "Quantum" Classification of Malware John Seymour

DC 101  -   RFIDiggity: Pentester Guide to Hacking HF/NFC and UHF RFID Francis Brown & Shubham Shah

PH Village / WOS  -  Fishing To Phishing: It's All About Slimy Creatures - Wayne Crowder

IoT WS B2  -  ISE Awards - ISE - 30 mins long

Sunday, August 9th Schedule

14:00

Track 1  -   Inter-VM data exfiltration: The art of cache timing covert channel on x86 multi-core Etienne Martineau

Track 2  -   Let's Talk About SOAP, Baby. Let's Talk About UPNP Ricky "HeadlessZeke" Lawshae

Track 3  -   Advances in Linux Process Forensics Using ECFS Ryan O'Neill

DC 101  -   Contest Closing Ceremonies

PH Village / WOS  -  From XSS to Root on Your NAS - Tony Martin

BH Village  -  Biohacking at home: Pragmatic DNA design, assembly, and transformation - 14:00-14:25

Sunday, August 9th Schedule

14:30

BH Village  -  Genetic engineering - Genetically modifying organisms for fun and profit - 14:30-14:55

Sunday, August 9th Schedule

15:00

Track 1  -   Closed for Setup

Track 2  -   Closed for Setup

Track 3  -   Closed for Setup

DC 101  -   Contest Closing Ceremonies Cont.

PH Village / WOS  -  OPEN

Sunday, August 9th Schedule

16:30

Track 1  -   Closing Ceremonies

Track 2  -   Closing Ceremonies

Track 3  -   Closing Ceremonies

DC 101  -

Talks Index

Thursday  -  DC Talks Index  -  DC Speakers Index  -  DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

DEF CON 101: The Panel.

When the Secretary of State says: “Please Stop Hacking Us…”

Game of Hacks: Play, Hack & Track

Abusing XSLT for Practical Attacks

RFIDiggity: Pentester Guide to Hacking HF/NFC and UHF RFID

It's The Only Way To Be Sure: Obtaining and Detecting Domain Persistence

Introduction to SDR and the Wireless Village

Guests N’ Goblins: Exposing Wi-Fi Exfiltration Risks and Mitigation techniques

Let's Encrypt - Minting Free Certificates to Encrypt the Entire Web

Ubiquity Forensics - Your iCloud and You

Crypto for Hackers

Extending Fuzzing Grammars to Exploit Unexplored Code Paths in Modern Web Browsers

Secure Messaging for Normal People

Seeing through the Fog

Linux Containers: Future or Fantasy?

How to Shot Web: Web and mobile hacking in 2015

Alice and Bob are Really Confused

LTE Recon and Tracking with RTLSDR

Forensic Artifacts From a Pass the Hash Attack

I’m A Newbie Yet I Can Hack ZigBee – Take Unauthorized Control Over ZigBee Devices

Are We Really Safe? - Bypassing Access Control Systems

Sorry, Wrong Number: Mysteries Of The Phone System - Past and Present

Backdooring Git

Hacking SQL Injection for Remote Code Execution on a LAMP stack

Abusing native Shims for Post Exploitation

Hacker in the Wires

A Hacker’s Guide to Risk

Chellam – a Wi-Fi IDS/Firewall for Windows

Hardware and Trust Security: Explain it like I’m 5

Bruce Schneier Q&A

Applied Intelligence: Using Information That's Not There

I Am Packer And So Can You

NSM 101 for ICS

Beyond the Scan: The Value Proposition of Vulnerability Assessment

The Bieber Project: Ad Tech 101, Fake Fans and Adventures in Buying Internet Traffic

Hijacking Arbitrary .NET Application Control Flow

Hackers Hiring Hackers - How to Do Things Better

QARK: Android App Exploit and SCA Tool

Hacking Web Apps

And That's How I Lost My Other Eye: Further Explorations In Data Destruction

Malware in the Gaming Micro-economy

How to secure the keyboard chain

How to hack your way out of home detention

Fun with Symboliks

Quantum Computers vs. Computers Security

Key-Logger, Video, Mouse — How To Turn Your KVM Into a Raging Key-logging Monster

Canary: Keeping Your Dick Pics Safe(r)

Extracting the Painful (blue)tooth

802.11 Massive Monitoring

Exploring Layer 2 Network Security in Virtualized Environments

Attacking Hypervisors Using Firmware and Hardware

Who Will Rule the Sky? The Coming Drone Policy Wars

Switches Get Stitches

Cracking Cryptocurrency Brainwallets

Paranoia and ProxyHam: High-Stakes Anonymity on the Internet

Why nation-state malwares target Telco Networks: Dissecting technical capabilities of Regin and its counterparts

Bugged Files: Is Your Document Telling on You?

Do Export Controls on “Intrusion Software” Threaten Vulnerability Research?

REvisiting RE:DoS

Licensed to Pwn: The Weaponization and Regulation of Security Research

Dark side of the ELF - leveraging dynamic loading to pwn noobs

Fighting Back in the War on General Purpose Computers

REpsych: Psychological Warfare in Reverse Engineering

USB Attack to Decrypt Wi-Fi Communications

BurpKit - Using WebKit to Own the Web

Stagefright: Scary Code in the Heart of Android

Medical Devices: Pwnage and Honeypots

NSA Playset: JTAG Implants

Unbootable: Exploiting the PayLock SmartBoot Vehicle Immobilizer

Hooked Browser Meshed-Networks with WebRTC and BeEF

Abusing Adobe Reader’s JavaScript APIs

WhyMI so Sexy? WMI Attacks, Real-Time Defense, and Advanced Forensic Analysis

HamSammich – long distance proxying over radio

Goodbye Memory Scraping Malware: Hold Out Till "Chip And Pin”

Low-cost GPS simulator – GPS spoofing by SDR

I want these * bugs off my * Internet

Drive It Like You Hacked It: New Attacks and Tools to Wirelessly Steal Cars

Harness: Powershell Weaponization Made Easy (or at least easier)

ThunderStrike 2: Sith Strike

Rocking the Pocket Book: Hacking Chemical Plant for Competition and Extortion

Hack the Legacy! IBM i (aka AS/400) Revealed.

Remote Access, the APT

Let's Talk About SOAP, Baby. Let's Talk About UPNP

Tell me who you are and I will tell you your lock pattern

Responsible Incident: Covert Keys Against Subverted Technology Latencies, Especially Yubikey

F*ck the attribution, show us your .idb!

Inter-VM data exfiltration: The art of cache timing covert channel on x86 multi-core

Working together to keep the Internet safe and secure

I Hunt Penetration Testers: More Weaknesses in Tools and Procedures

How to Hack Government: Technologists as Policy Makers

Red vs. Blue: Modern Active Directory Attacks & Defense

Put on your tinfo_t hat if you're my type

Remote Exploitation of an Unaltered Passenger Vehicle

Separating Bots from the Humans

Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service

Docker, Docker, Give Me The News, I Got A Bad Case Of Securing You

Detecting Randomly Generated Strings; A Language Based Approach

Don't Whisper my Chips: Sidechannel and Glitching for Fun and Profit

Advances in Linux Process Forensics Using ECFS

Ask the EFF: The Year in Digital Civil Liberties

DEF CON Comedy Inception: How many levels deep can we go?

Hacking Smart Safes: On the "Brink" of a Robbery

Staying Persistent in Software Defined Networks

One Device to Pwn Them All

NetRipper - Smart traffic sniffing for penetration testers

Chigula — a framework for Wi-Fi Intrusion Detection and Forensics

Knocking my neighbor’s kid’s cruddy drone offline

I Will Kill You

How to Hack a Tesla Model S

Hacking Electric Skateboards: Vehicle Research For Mortals

When IoT attacks: hacking a Linux-powered rifle

Drinking from LETHE: New methods of exploiting and mitigating memory corruption vulnerabilities

Breaking SSL Using Time Synchronisation Attacks

"Quantum" Classification of Malware

Insteon' False Security And Deceptive Documentation

Scared Poopless – LTE and *your* laptop

Angry Hacking - the next generation of binary analysis

High-Def Fuzzing: Exploring Vulnerabilities in HDMI-CEC

Dissecting the Design of SCADA Web Human Machine Interfaces (HMIs) - Hunting Vulnerabilities

Shall We Play a Game?

DIY Nukeproofing: a new dig at "data-mining"

Hacking the Human Body/brain: Identity Shift, the Shape of a New Self, and Humanity 2.0

From 0 To Secure In 1 Minute — Securing IAAS

Looping Surveillance Cameras through Live Editing of Network Streams

Machine vs. Machine: Inside DARPA’s Fully Automated CTF

Pivoting Without Rights – Introducing Pivoter

'DLL Hijacking' on OS X? #@%& Yeah!

Stick That In Your (root)Pipe & Smoke It

Confessions of a Professional Cyber Stalker

How to Train Your RFID Hacking Tools

Investigating the Practicality and Cost of Abusing Memory Errors with DNS

Security Necromancy: Further Adventures in Mainframe Hacking

Build a free cellular traffic capture tool with a vxworks based femoto

Speakers Index

Thursday  -  DC Talks Index  -  DC Speakers Index  -  DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

A

Dave Aitel

Zack Allen

Paul Amicelli

AmmonRa

David An

Nick Anderson

Collin Anderson

Fernando Arnaboldi

Amit Ashbel

atlas

Michael Auger

Jean-Philippe Aumasson

B

Willi Ballenthin

Yaniv Balmas

Zach Banks

Rob Bathurst (evilrob)

Oleksandr Bazhaniuk

Matteo Beccaro

Amanda Berlin

Andres Blanco

Matt Blaze

Chris Blow

Rusty Bower

Joshua Brierton

Francis Brown

Grant Bugher

Ronny L. Bull

Yuriy Bulygin

C

Matt Cagle

Nate Cardozo (1, 2)

Colin Cassidy

Ryan Castellucci

Benjamin Caudill

Eric Cheng

Mark Collao

Matteo Collura

Omer Coskun

Adam Crain

Tom Cross

Daniel "unicornFurnace" Crowley

D

DaKahuna

Tushar Dalvi

Baptiste David

Eric (XlogicX) Davisson

Jim Denaro

Peter Desfigies

Alessandro Di Federico

Cory Doctorow

Chris Domas

Jeremy Dorrough

Nadeem Douba

Joshua J. Drake

E

Peter Eckersley (1, 2)

Sarah Edwards

Eijah

Saif El-Sherei

Justin Engler

Scott Erven

F

Zack Fasel

Moshe Ferber

Joe FitzPatrick

fluxist

Christian @xntrik Frichot

Andrew Furtak

G

Andres Gazzoli

Ryan Gooler

Brian Gorenc

Mikhail Gorobets

Matt Graeber

Robert Graham

Aaron Grattafiori

Claudio Guarnieri

H

Jason Haddix

Abdul-Aziz Hariri

Richo Healey

Weston Hecker

Lin Huang

Trammel Hudson

David Huerta

I

IrishMASMS

J

Mark Jaycox

K

Corey Kallenberg

Dan Kaminsky

Samy Kamkar

James Kasten

Nadia Kayyali

Rich Kelley

Dave Kennedy

Matt King

Ian Kline

Xeno Kovah

Nikita Kronenberg

Marina Krotofil

Bart Kulach

L

Jason Larsen

Ian Latter

Ricky "HeadlessZeke" Lawshae

Gerard Laygui

Robert M. Lee

Eireann Leverett

LI Jun

Marte Løge

LosT

M

Kevin Mahaffey

Dennis Maldonado

Morgan Marquis-Boire

Marion Marschalek

Etienne Martineau

Alexander Matrosov

Jeanna N. Matthews

David Maynor

Alejandro Mayorkas

Wesley McGrew

"Unregistered436" Patrick McNeil

Corynne McSherry

Terrell McSweeny

John Menerick

Sean Metcalf

miaubiz

Jesse Michael

Charlie Miller

Ryan Mitchell

Colby Moore

David Mortman

Katie Moussouris

N

Mahdi Namazifar

Nemus

O

Colin O'Flynn

Ryan O'Neill

Lior Oppenheim

Kurt Opsahl

”Snide" Owen

P

Larry Pesce

Dan "AltF4" Petro

Mike Petruzzi (wiseacre)

Gregory Pickett

Sean Pierce

Plug

Dr. Phil Polstra (1, 2)

Ionut Popescu

Bruce Potter

PushPin

R

Vivek Ramachandran (1, 2)

Teddy Reed

Chad "Bigendian Smalls” Rikansrud

Michael Robinson

Chris Rock

Marc Rogers

Russ Rogers

Mike Ryan

S

Oscar Salazar

Runa A. Sandvik

Satanlawz

Bruce Schneier

Michael Schrenk

Mike Sconzo

Daniel Selifonov

Jose Selvi

John Seymour

Shubham Shah

Haoqi Shan

Peter Shipley

Mickey Shkatov

Yan Shoshitaishvili (1, 2)

Maty Siman

Chris Sistrunk (1, 2)

Damon Small

Damon Smith

Joshua Smith

Aditya K Sood

Ashkan Soltani

Jasiel Spelman

Etienne Stalmans

Tamas Szakaly

T

Mark Ryan Talabis

Mara Tam

Dan Tentler

Claudiu Teodorescu

Jeff Thomas (xaphan)

3AlarmLampscooter

Richard Thieme

Topher Timzen

Tottenkoph

Tony Trummer

U

Naveed Ul Islam

V

Chris Valasek

Nir Valtman

Eric Van Albert

W

Michael Walker

Geoff Walton

Fish Wang

Patrick Wardle (1, 2)

Jordan Wiens

Ken Westin

Brent White

Y

YANG Qing (1, 2)

Craig Young

Luke Young

Philip “Soldier of Fortran” Young

Z

Yuwei Zheng

Yan Zhu

Zoz

Talks List

DEF CON 101 Presentations

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

DEF CON 101: The Panel.

Mike Petruzzi (wiseacre), Senior Cyber Security Penetration Tester

Nikita Kronenberg Not a Security Researcher, DEF CON

PushPin

Plug

Russ Rogers Chief of Operations, DEF CON

DEF CON has changed for the better since the days at the Alexis Park.  It has evolved from a few speaking tracks to an event that still offers the speakers, but also Villages, where you can get hands-on experience and Demo Labs where you can see tools in action.  Of course, there is still the entertainment and Contest Area, as well as, Capture The Flag.  There is so much more to DEF CON than there was in the past and it is our goal to help you get the best experience possible.  In addition to introducing each of the different aspects and areas of DEF CON, we have a panel of speakers that will talk about how they came to be part of DEF CON and their personal experiences over the years.

Mike Petruzzi has been hacking managers for over 25 years. Mike is a Senior Cyber Security Penetration Testing Specialist working at various Federal Civil Agencies for the last 15 years. Yup, that's the title he was given.  Naturally, he got all his IT experience as the result of selling beer, wine and liquor. He has tricked everyone into believing that he can do anything at all.

Twitter: @wiseacre_mike

Nikita works full time for DEF CON doing stuff, and things. She is DEF CON’s administrator, director of the CFP review board, speaker liaison, workshop manager, and overall cat herder. Helping out over the past decade she has been involved in some capacity for over a dozen departments, activities, contests, and events. She provides annoyance, planning, and support in many ways, thus dubbed the “administrator of chaos”. If you hate the schedule, or are mad your talk was rejected, you can blame her. Nikita likes to think of herself as approachable, and loves to make people feel welcome at DEF CON, despite having R.B.F. Her hardest job yet was writing a serious third person bio.

Twitter: @niki7a

PushPin is an uptight, perfectionist, who is very rarely content working with idiots and enjoys his Jell-O Pudding cups. He can neither confirm nor deny working for any of the three letter agencies that oversee WMDs, high energy weapons [LASERS, YO], and play around with other countries. It is literally impossible to see him without his laptop at any given time during the day and has been told frequently to put it away in public; otherwise, you’ll find him at work devoid of any form of social life. I hate you all, seriously..

Twitter: @X72

Plug is a Mexican immigrant that immigrated to the States at age 18. While learning to read English found a 2600 magazine that lead him to his first LA2600 meeting in 1998, from that point forward he has been a computer security enthusiast.  Over the years he has worked a System's Administrator with a focus in security, eventually moving full time to work in information security.  Plug currently works as a Senior Security Engineer securing the network of a prominent finance and foreign exchange company.  He is also working on a volunteer project to teach 5th graders basic computer security skills. In his free time he enjoys playing with synthesizers and modular systems, when possible he volunteers his time to computer security events.

This is Russ’ 17th year as a DEF CON goon, and he has over 25 years experience in hacking. Russ first learned to program around the 1982 timeframe, when he received a Timex Sinclair, which used only programs keyed in via BASIC. He’s been involved in a numbers of aspects of DEF CON over the years, including the vendors, contests, DEF CON Groups, security, Hardware Hacking Village, and planning. Russ currently works a the Chief of Operations, where he depends heavily upon the other experienced hackers and goons that help run the world’s largest hacker conference.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

When the Secretary of State says: “Please Stop Hacking Us…”

David An Former U.S. State Department

Senior American officials routinely hold dialogues with foreign officials to discuss cyber espionage. However, if a cyber attack can be performed through proxy servers jumping several countries before reaching the U.S., then can anyone ever be sure of who is really behind the attack? Yet we often see newspaper headlines clearly identifying that one country is hacking another country through state-sponsored, cyber criminal, or hacktivist means. Even if government cyber analysts with TS/SCI security clearances have high confidence in the identity of an attacker based on forensics and human intelligence, what are the challenges in effectively addressing the topic in a diplomatic or military dialogue with the attacker country?

Two major roadblocks in cyber diplomacy are the "attribution problem," and the related "disclosure dilemma." If there is indeed an attribution problem--when a country cannot be sure which other state is hacking it because a third country could be using it as a proxy--then a country could never accuse another countries of state-sponsored cyber attacks. Yet, countries routinely accuse others of cyber attacks, the public sees this in newspapers almost every day, and it is often an important topic in bilateral dialogues. Furthermore, the disclosure dilemma occurs when a country has both incentives and disincentives to disclose details on how it was hacked. On one hand, evidence will prove its case, but on another hand, evidence will make the attacker more savvy and careful not to repeat the same mistakes next time. Disclosure could create a stronger adversary. These are major concerns in the practice of cyber diplomacy today.

My presentation identifies how government-to-government cyber diplomacy works, examines the attribution problem and disclosure dilemma more fully, and shows how the U.S. approaches this topic differently with partners versus potential adversaries. This is not a technical presentation, but rather it is a policy presentation on cyber diplomacy drawing from political science and my diplomatic experience.

David was a tenured U.S. diplomat before leaving the U.S. government to consult for the private sector, and to write policy and academic papers. At the State Department, he was the senior political-military affairs officer covering the East Asia region and his responsibilities included coordinating diplomatic dialogues, formulating plans with the Pentagon, notifying Congress of U.S. arms sales, writing the Secretary of State’s talking points, and traveling overseas with the Secretary of State and Secretary of Defense for bilateral dialogues. His other assignments included the U.S. embassies in Beijing, Tokyo, Wellington; U.S. consulates in Sydney and Perth; American Institute in Taiwan; and U.S. Pacific Command. He completed his B.A. at UC Berkeley; M.A. in international affairs and business management, and political science Ph.D. courses at UC San Diego.

Obligatory disclaimer: The comments are his own, and do not represent the U.S. government. Since Jeff Moss famously said in 2013: “Feds, we need some time apart,” David emphasizes that he is no longer a fed.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Game of Hacks: Play, Hack & Track

Amit Ashbel Product Evangelist Checkmarx

Maty Siman CTO and Founder Checkmarx

Fooling around with some ideas we found ourselves creating a hacker magnet. Game of Hacks, built using the node.js framework, displays a range of vulnerable code snippets challenging the player to locate the vulnerability. A multiplayer option makes the challenge even more attractive and the leaderboard spices up things when players compete for a seat on the iron throne.

Within 24 hours we had 35K players test their hacking skills...we weren't surprised when users started breaking the rules. Join us to:

- Play GoH against the audience in real time and get your claim for fame

- Understand how vulnerabilities were planted within Game of Hacks

- See real attack techniques (some caught us off guard) and how we handled them

- Learn how to avoid vulnerabilities in your code and how to go about designing a secure application

- Hear what to watch out for on the ultra-popular node.js framework.

Check it out at www.Gameofhacks.com

Amit Ashbel joined Checkmarx From Trusteer (acquired by IBM). He has been with the security community for more than a decade where he has taken on multiple tasks and responsibilities over the years, including technical and Senior Product lead positions.

Amit adds valuable product knowledge including experience with a wide range of security platforms and familiarity with emerging threats and the hi-tech security industry.

Maty is the CTO and founder of Checkmarx. Maty has more than a decade of experience in software development, IT security and source-code analysis. Prior to founding Checkmarx, Maty worked for two years at the Israeli Prime Minister’s Office as a senior IT security expert and project manager. Prior to that, he spent six years with the Israel Defense Forces (IDF), where he established and led a development team in the IDF’s Information Security Center. Maty regularly speaks at IT security conferences and is CISSP certified since 2003.

Web: www.Gameofhacks.com

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Abusing XSLT for Practical Attacks

Fernando Arnaboldi Senior Security Consultant at IOActive

Over the years, XML has been a rich target for attackers due to flaws in its design as well as implementations. It is a tempting target because it is used by other programming languages to interconnect applications and is supported by web browsers. In this talk, I will demonstrate how to use XSLT to produce documents that are vulnerable to new exploits.

XSLT can be leveraged to affect the integrity of arithmetic operations, lead to code logic failure, or cause random values to use the same initialization vector. Error disclosure has always provided valuable information, but thanks to XSLT, it is possible to partially read system files that could disclose service or system's passwords. Finally, XSLT can be used to compromise end-user confidentiality by abusing the same-origin policy concept present in web browsers.

This presentation includes proof-of-concept attacks demonstrating XSLT’s potential to affect production systems, along with recommendations for safe development.

Fernando Arnaboldi is a senior security researcher and consultant at IOActive, Inc. He has over 10 years of experience in the security research space (Deloitte, Core Security Technologies and IOActive) and holds a Bachelor's degree in Computer Science.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

RFIDiggity: Pentester Guide to Hacking HF/NFC and UHF RFID

Francis Brown Partner - Bishop Fox

Shubham Shah Security Analyst at Bishop Fox

Have you ever attended an RFID hacking presentation and walked away with more questions than answers? This talk will finally provide practical guidance for penetration testers on hacking High Frequency (HF - 13.56 MHz) and Ultra-High Frequency (UHF – 840-960 MHz). This includes Near Field Communication (NFC), which also operates at 13.56 MHz and can be found in things like mobile payment technologies, e.g., Apple Pay and Google Wallet. We'll also be releasing a slew of new and free RFID hacking tools using Arduino microcontrollers, Raspberry Pis, phone/tablet apps, and even 3D printing.

This presentation will NOT weigh you down with theoretical details or discussions of radio frequencies and modulation schemes. It WILL serve as a practical guide for penetration testers to better understand the attack tools and techniques available to them for stealing and using RFID tag information, specifically for HF and UHF systems. We will showcase the best-of-breed in hardware and software that you'll need to build an RFID penetration toolkit. Our goal is to eliminate pervasive myths and accurately illustrate RFID risks via live attack DEMOS:

- High Frequency / NFC – Attack Demos:

- HF physical access control systems (e.g., iCLASS and MIFARE DESFire 'contactless smart card' product families)

- Credit cards, public transit cards, passports (book), mobile payment systems (e.g., Apple Pay, Google Wallet), NFC loyalty cards (e.g., MyCoke Rewards), new hotel room keys, smart home door locks, and more

- Ultra-High Frequency – Attack Demos:

- Ski passes, enhanced driver's licenses, passports (card), U.S. Permanent Resident Card ('green card'), trusted traveler cards

Schematics and Arduino code will be released, and 100 lucky audience members will receive one of a handful of new flavors of our Tastic RFID Thief custom PCB, which they can insert into almost any commercial RFID reader to steal badge info or use as a MITM backdoor device capable of card replay attacks. New versions include extended control capabilities via Arduino add-on modules such as Bluetooth low energy (BLE) and GSM/GPRS (SMS messaging) modules.

This DEMO-rich presentation will benefit both newcomers to RFID penetration testing as well as seasoned professionals.

Francis Brown, CISA, CISSP, MCSE, is a Managing Partner at Bishop Fox (formerly Stach & Liu), a security consulting firm providing IT security services to the Fortune 1000 and global financial institutions as well as U.S. and foreign governments. Before joining Stach & Liu, Francis served as an IT Security Specialist with the Global Risk Assessment team of Honeywell International where he performed network and application penetration testing, product security evaluations, incident response, and risk assessments of critical infrastructure. Prior to that, Francis was a consultant with the Ernst & Young Advanced Security Centers and conducted network, application, wireless, and remote access penetration tests for Fortune 500 clients.

Francis has presented his research at leading conferences such as Black Hat USA, DEF CON, RSA, InfoSec World, ToorCon, and HackCon and has been cited in numerous industry and academic publications.

Francis holds a Bachelor of Science and Engineering from the University of Pennsylvania with a major in Computer Science and Engineering and a minor in Psychology. While at Penn, Francis taught operating system implementation, C programming, and participated in DARPA-funded research into advanced intrusion prevention system techniques.

Shubham Shah is a Security Analyst at Bishop Fox (formerly Stach & Liu), a security consulting firm providing IT security services to the Fortune 500, global financial institutions, and high-tech startups. Shubham's primary areas of expertise are application security assessment, source code review, and mobile application security.

Shubham is a former bug bounty hunter who has submitted medium-high risk bugs to the bug bounties of large corporations such as PayPal, Facebook, and Microsoft. He regularly conducts web application security research and frequently contributes to the security of open-source projects. He has presented at Ruxcon and is known in Australia for his identification of high-profile vulnerabilities in the infrastructures of major mobile telecommunication companies.

Prior to joining Bishop Fox, Shubham worked at EY. At EY, he performed web application security assessments and application penetration tests. Additionally, Shubham has been a contractor for companies such as Atlassian. As a contractor, he conducted external web application security penetration tests. Shubham also develops and maintains open-source projects such as Websec Weekly that assist the web application security industry.

Twitter: @bishopfox

Facebook: https://www.facebook.com/BishopFoxConsulting

LinkedIn: https://www.linkedin.com/company/bishop-fox

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

It's The Only Way To Be Sure: Obtaining and Detecting Domain Persistence

Grant Bugher Perimeter Grid

When a Windows domain is compromised, an attacker has several options to create backdoors, obscure his tracks, and make his access difficult to detect and remove. In this talk, I discuss ways that an attacker who has obtained domain administrator privileges can extend, persist, and maintain control, as well as how a forensic examiner or incident responder could detect these activities and root out an attacker.

Grant Bugher has been hacking and coding since the early 90's and working professionally in information security for the last 11 years. He is currently a security consultant and engineer for a cloud service provider, and has previously been an architect, program manager and software engineer on a variety of online services, developer tools and platforms. Grant is a prior speaker at BlackHat and DEF CON and a regular DEF CON attendee since DEF CON 16. Most of his research and work is on cloud computing and storage platforms, application security, and detecting attacks against web-scale applications.

Twitter: @fishsupreme

Web: http://perimetergrid.com

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Introduction to SDR and the Wireless Village

DaKahuna

satanklawz

In many circumstances, we all have to wear different hats when pursuing hobbies, jobs and research. This session will discuss the exploration and use of software defined radio from two perspectives; that of a security researcher and Ham Radio operator. We will cover common uses and abuses of hardware to make them work like transceivers that the Ham crowed is use too, as well as extending the same hardware for other research applications. Additionally we will highlight some of the application of this knowledge for use at The Wireless Village! Come and join this interactive session; audience participation is encouraged.

By day DaKahuna works for a small defense contractor as a consultant to large government agencies providing critical reviews of customer organizations compliance with Federal Information Systems  information Security Act (FISMA) requirements, effectiveness of their implementation of National Institute for Science and Technology (NIST) Special Publication requirements, cyber security policies, cyber security program plans, and governmental standards and guidance. By night he enjoys roaming the airwaves , be it the amateur radio bands or wireless networks. He is a father of two, grandfather to three, 24 year Navy veteran communicator, holder of an amateur radio Extra Class license and a staunch supporter and exerciser of his 2nd Amendment rights who enjoys shooting targets out to 1200 yards.

Satanklawz has been in the information security realm for 15 years. He built and sold a wireless ISP, worked info sec in the financial services industry and now is a public servant of sorts. His hobbies and interests have always involved radio in some sort of fashion. When he has spare time, he is completing his PhD, teaches, create mischief, and is working on his dad jokes.

Flowers, red and blue,

satanklawz loves *SDR*.

This is a haiku.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Guests N’ Goblins: Exposing Wi-Fi Exfiltration Risks and Mitigation techniques

Peter Desfigies Cyber Security Investigations Unit, TELUS Security Solutions

Joshua Brierton Sr. Security Analyst, TELUS Communications

Naveed Ul Islam Managing Consultant, TELUS

Wi-Fi is a pervasive part of everyone’s everyday life. Whether it be home networks, open hotspots at cafés, corporate networks or corporate guest networks they can be found virtually everywhere. Fortunately, for the security minded, some steps are taken to secure these weak points in one’s infrastructure. Usually this is done through some form of registration page which is common in the case of guest networks. But is this enough? And what new threats could be unleashed from even the most isolated of Wi-Fi networks?

In the most paranoid of cases, companies will generally attempt to isolate Wi-Fi networks from their official networks in order to protect their own assets from attacks, while still ensuring that Wi-Fi is convenient for end users. But there is another way to attack a company that could be damaging to the host company and harmful to other targets. This presentation will go over the utilization of various techniques of getting onto and getting out through publicly accessible Wi-Fi networks for nefarious purposes, termed Wi-Fi Exfiltration. Through this technique one is able to obfuscate their identity by using the host of the Wi-Fi’s identity, thus implicating the host in the attack.

During the presentation we will cover the findings through our tests along with a list of recommendations for what can be done to mitigate this risk. This is a must attend session to all security professionals and high level management.

Peter Desfigies is a Security Consultant at TELUS Communications Inc. where he works with a team of other operations analysts to proactively investigate and analyze customer traffic, while also providing threat intelligence on attacks, campaigns, and zero-days in order to protect customer’s environment and enhance their security posture. During his time at TELUS, he has worked with a variety of teams providing LAN, WAN, Telco, Security and hardware break/fix support, and now Security Analysis for government and corporate customer. Prior to TELUS, he worked for 12 years in IT operation roles to provide backbone network support including DNS, SMTP, POP, dialup, T1 to OC12 , and Ethernet at various companies, with the bulk of his experience at UUNET / MCI.

Joshua Brierton is a Sr. Security Analyst at TELUS Communications Inc. where he works with a team of SIEM specialists to provide customers with a cloud SIEM service offering. Primarily working on rule development and user work flows his other interests in the field includes developing tools to help automate and expedite repetitive work to increase user efficiency. During his time at TELUS he has worked with various teams providing security solutions from VPN services to IPS services along with outsourced development for a variety of other well-known SIEM’s. Prior to TELUS he worked for 5 years with Intellitactics Inc. doing development and device support for the content of the SIEM they provided. Collectively Josh has been working with a variety of SIEM’s for 10 years.

Naveed Ul Islam (BEE Telecom/DSP, CISSP, SABSA-SCF) is a Managing Consultant at TELUS and Security Intelligence architect within the TELUS Cyber Security Investigation Unit. Naveed’s other interests are in application forensics and enterprise security architecture. Naveed’s prior duties with TELUS include securing of then world’s largest PKI infrastructure known as Secure Channel. In addition, he was responsible for secure implementation of TELUS Health Space infrastructure. He led application security practices within TELUS Health, where he was able to incorporate software security lifecycle into software development practices. Also, he has been a part of security incident response and penetration testing teams. Previous to TELUS, Naveed was a security consultant for Microsoft USA, where he performed security and privacy audits of Microsoft’s core-business related websites. He has secured several key sites such as Microsoft XBOX 360 host web site and Microsoft’s internal auction site known as Micronews.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Let's Encrypt - Minting Free Certificates to Encrypt the Entire Web

Peter Eckersley Electronic Frontier Foundation

James Kasten Electronic Frontier Foundation

Yan Zhu Electronic Frontier Foundation

Let's Encrypt is a new certificate authority that is being launched by EFF in collaboration with Mozilla, Cisco, Akamai, IdenTrust, and a team at the University of Michigan. It will issue certificates for free, using a new automated protocol called ACME for verification of domain control and issuance.

This talk will describe the features of the CA and available clients at launch; explore the security challenges inherent in building such a system; and its effect on the security of the CA marketplace as a whole. We will also update our place on the roadmap to a Web that uses HTTPS by default.

Peter Eckersley is Chief Computer Scientist for the Electronic Frontier Foundation. He leads a team of technologists who watch for technologies that, by accident or design, pose a risk to computer users' freedoms—and then look for ways to fix them. They write code to make the Internet more secure, more open, and safer against surveillance and censorship. They explain gadgets to lawyers and policymakers, and law and policy to gadgets.

Aside from Let's Encrypt, Peter's other work at EFF has included privacy and security projects such as Panopticlick, HTTPS Everywhere, SSDI, and the SSL Observatory; helping to launch a movement for open wireless networks; fighting to keep modern computing platforms open; and running the first controlled tests to confirm that Comcast was using forged reset packets to interfere with P2P protocols.

Peter holds a PhD in computer science and law from the University of Melbourne.

James Kasten is a PhD candidate in Computer Science and Engineering at the University of Michgan and a STIET fellow. James is also a contractor at the Electronic Frontier Foundation. His research focuses on practical network security and PKI.

James has published on the state of TLS, its certificate ecosystem and its vulnerabilities. Most notably, James has helped design the protocol and launch the technology behind Let's Encrypt.

Yan is a security engineer at Yahoo, mostly working on End-to-End email encryption and improving TLS usage. She is also a Technology Fellow at EFF and a core developer of Let's Encrypt, HTTPS Everywhere, Privacy Badger Firefox, and SecureDrop. Yan has held a variety of jobs in the past, ranging from hacking web apps to composing modern orchestra music. She got a B.S. from MIT in 2012 and is a proud PhD dropout from Stanford.

Yan has been a speaker at HOPE, DEFCON 22, jQuerySF, Real World Crypto, SXSW, and various other human gatherings. She is @bcrypt on Twitter.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Ubiquity Forensics - Your iCloud and You

Sarah Edwards Test Engineer, Parsons Corporation & Author/Instructor, SANS Institute

Ubiquity or "Everything, Everywhere” - Apple uses this term describe iCloud related items and its availability across all devices. iCloud enables us to have our data synced with every Mac, iPhone, iPad, PC as well as accessible with your handy web browser. You can access your email, documents, contacts, browsing history, notes, keychains, photos, and more all with just a click of the mouse or a tap of the finger - on any device, all synced within seconds.

Much of this data gets cached on your devices, this presentation will explore the forensic artifacts related to this cached data. Where is the data stored; how to look at it; how is it synced; and what other sensitive information can be found that you may not have known existed!

Sarah is an digital forensic analyst who has worked with various federal law enforcement agencies. She has performed a variety of investigations including computer intrusions, criminal, counter intelligence, counter-narcotic, and counter terrorism. Sarah's research and analytical interests include Mac forensics, mobile device forensics, digital profiling, and malware reverse engineering. Sarah has presented at many industry conferences including; Shmoocon, CEIC, various Bsides, DEF CON, and the SANS DFIR Summit. Sarah is author and instructor of the SANS Mac Forensic Analysis Course - FOR518.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Crypto for Hackers

Eijah Founder, Demonsaw

Hacking is hard. It takes passion, dedication, and an unwavering attention to detail. Hacking requires a breadth of knowledge spread across many domains. We need to have experience with different platforms, operating systems, software packages, tools, programming languages, and technology trends. Being overly deficient in any one of these areas can add hours to our hack, or even worse, bring us total failure.

And while all of these things are important for a well-rounded hacker, one of the key areas that is often overlooked is cryptography. In an era dominated by security breaches, an understanding of encryption and hashing algorithms provides a tremendous advantage. We can better hone our attack vectors, especially when looking for security holes. A few years ago I released the first Blu-Ray device key, AA856A1BA814AB99FFDEBA6AEFBE1C04, by exploiting a vulnerability in an implementation of the AACS protocol. As hacks go, it was a simple one. But it was the knowledge of crypto that made it all possible.

This presentation is an overview of the most common crypto routines helpful to hackers. We'll review the strengths and weaknesses of each algorithm, which ones to embrace, and which ones to avoid. You'll get C++ code examples, high-level wrapper classes, and an open-source library that implements all the algorithms. We'll even talk about creative ways to merge algorithms to further increase entropy and key strength. If you've ever wanted to learn how crypto can give you an advantage as a hacker, then this talk is for you. With this information you'll be able to maximize your hacks and better protect your personal data.

Eijah is the founder of demonsaw, a secure and anonymous content sharing platform, and a Senior Programmer at a world-renowned game development studio. He has over 15 years of software development and IT Security experience. His career has covered a broad range of Internet and mid-range technologies, core security, and system architecture. Eijah has been a faculty member at multiple colleges, has spoken about security and development at conferences, and holds a master’s degree in Computer Science. Eijah is an active member of the hacking community and is an avid proponent of Internet freedom.

Twitter: @demon_saw

Web: https://www.demonsaw.com

Facebook: https://www.facebook.com/Demonsaw

Github: https://github.com/eijah/demonsaw

Email: eijah at demonsaw dot com

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Extending Fuzzing Grammars to Exploit Unexplored Code Paths in Modern Web Browsers

Saif El-Sherei Analyst, SensePost

Etienne Stalmans Analyst, SensePost

Fuzzing is a well-established technique for finding bugs, hopefully exploitable ones, by brute forcing inputs to explore code paths in an application. In recent years, fuzzing has become a near mandatory part of any major application's security team efforts. Our work focused on fuzzing web browsers, a particularly difficult challenge given the size and quality of some of their security teams, the existing high-quality fuzzers available for this, and, of late, bug bounty programs.

Despite this, our improved fuzzing approach was able to find four confirmed bugs within Google Chrome and two within Microsoft Internet Explorer 11. The bugs had varying potential exploitability. Interestingly, some had been independently discovered indicating others are active in this field. The work is on going, and we hope to have more before the presentation.

As browsers continue to grow as the new universal interface for devices and applications, they have become high value targets for exploitation. Additionally, with the growth of browser fuzzing since 2004, this is a complex field to get started in. Something we hope to help address.

Our research and presentation will consist of two parts:

The first part is an introduction to fuzzing for the security practitioner. Here we combine the approaches, tool sets and integrations between tools we found to be most effective into a recipe for fuzzing various browsers and various platforms.

The second part is a description of our work and approach used to create, and extend, browser fuzzing grammars based on w3c specifications to discover new and unexplored code paths, and find new browser security bugs. In particular, example of real bugs found in the Chrome and IE browser will be demonstrated.

Saif is the body double for Borat, but couldn't pull off a mankini and ended up in information security. His focus is on fuzzing and vulnerability research.

Etienne hopes he will outlive his beard, but in the meantime, this hacking schtick pays for beard oil. His other interests lie in mobile applications and no-sql databases. Both are analysts within SensePost's London office.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Secure Messaging for Normal People

Justin Engler Senior Security Engineer, iSEC Partners

"Secure" messaging programs and protocols continue to proliferate, and crypto experts can debate their minutiae, but there is very little information available to help the rest of the world differentiate between the different programs and their features. This talk will discuss the types of attacks various secure messaging features can defend against so those who are tech-savvy but not crypto-experts can make informed decisions on which crypto applications to use.

This talk is intended for people with no preexisting cryptography knowledge. There will be no math or programming knowledge required. The goal is to explain secure messaging concepts such as PKI, PFS, and key validation without diving into heavier crypto, math, or programming content.

Justin Engler is a Principal Security Engineer with NCC Group. Justin has been involved in application security assessments of many open and closed source messaging applications and other related technologies. He has spoken previously at DEF CON, BlackHat, Toorcon, and other regional events. Justin has 5 years of security consulting experience and has been involved in security, software development, and IT professionally for over 10 years.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Seeing through the Fog

Zack Fasel Urbane Security

Yes. "The Cloud" (drink). Even though many of us would much like to see use of public clouds decline, they're not going away any time soon. And with such, a plethora of companies now have revolutionary new solutions to solve your "cloud problems". From crypto to single sign on with two step auth, proxies to monitoring and DLP, every vendor has a solution, even cloud based for the cloud!

What we haven't seen is much of an open source or community lead solution to these problems. So let's change that.

Zack will review the laundry list of security problems with various cloud providers (and their pluthera of APIs), provide some easy fixes to the common issues seen, and introduce a few new open source tools to help monitor and defend the data and access in the wild.

Zack Fasel is a Founding Partner at Urbane Security, a solutions-focused vendor-agnostic information security services firm focusing on providing innovative defense, sophisticated offense and refined compliance services. Heading up Urbane's Research and Security Services divisions, Zack brings his years of diverse internal and external experience to drive Urbane's technical solutions to organizations top pain points. His previous research and presentations at conferences have spread across numerous domains including Windows authentication flaws, femtocells, open source defensive security solutions and unique network and application attack vectors. When not selling out, he can be found lost in the untz unce wubs, dabbling in instagram food photography, or eating scotch and drinking gummy bears (that's right, right?). More information on him can be found at zfasel.com and on Urbane Security at UrbaneSecurity.com.

Twitter: @zfasel

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Linux Containers: Future or Fantasy?

Aaron Grattafiori Principal Security Consultant, iSEC Partners/NCC Group

Containers, a pinnacle of fast and secure deployment or a panacea of false security? In recent years Linux containers have developed from an insecure and loose collection of Linux kernel namespaces to a production-ready OS virtualization stack. In this talk, the audience will first learn the basics of how containers function, understanding namespaces, capabilities and cgroups in order to see how Linux containers and the supporting kernel features can offer an effective application and system sandboxing solution yet to be widely deployed or adopted. Understanding LXC or Docker use, weaknesses and security for PaaS and application sandboxing is only the beginning.

Leveraging container technologies is rapidly becoming popular within the modern PaaS and devops world but little has been publicly discussed in terms of actual security risks or guarantees. Understanding prior container vulnerabilities or escapes, and current risks or pitfalls in major public platforms will be explored in this talk. I'll cover methods to harden containers against future attacks and common mistakes to avoid when using systems such as LXC and Docker. This will also include an analysis and discussion of techniques such as Linux kernel hardening, reduced capabilities, Mandatory Access Controls (MAC), the User kernel namespace and seccomp-bpf (syscall filtering); all of which help actually contain containers. The talk will end on some methods for creating minimal, highly-secure containers and end on where containers are going and why they might show up where you least expect them.

Aaron Grattafiori (@dyn___) is a Principal Security Consultant and Research Lead with iSEC Partners/NCC Group. A jack-of-all-security, Aaron leads projects dealing with complex system analysis, mobile and web application security to network, protocol, and design reviews to red teams and other hybrid testing. With over nine years of security experience, Aaron utilizes a wide array of technology skills, historical research and security knowledge to consistently discover critical vulnerabilities. Aaron has spoke on a wide range of topics at security conferences such as Blackhat, DEF CON Kids, Toorcon:Seattle+SanDiego, ToorCamp, Source Seattle, EELive! and SecureWorld in addition to being a guest speaker at Stanford University. Prior to working at iSEC Partners, Aaron worked as a Security Consultant for Security Innovation and is a retired long time member of the Neg9 CTF team. This will be Aaron's 12th DEF CON, w00t!

Twitter: @dyn___

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

How to Shot Web: Web and mobile hacking in 2015

Jason Haddix Director of Technical Operations, Bugcrowd

2014 was a year of unprecedented participation in crowdsourced and static bug bounty programs, and 2015 looks like a trendmaker. Join Jason as he explores successful tactics and tools used by himself and the best bug hunters. Practical methodologies, tools, and tips make you better at hacking websites and mobile apps to claim those bounties. Convert edge-case vulnerabilities to practical pwnage even on presumably heavily tested sites. These are tips and tricks that the every-tester can take home and use. Jason will focus on philosophy, discovery, mapping, tactical fuzzing (XSS, SQLi, LFI, ++), CSRF, web services, and mobile vulnerabilities. In many cases we will explore these attacks down to the parameter, teaching the tester common places to look when searching for certain bugs. In addition he will cover common evasions to filters and as many time saving techniques he can fit in.

Jasonis the Director of Technical Operations at Bugcrowd. Jason trains and works with internal application security engineers to triage and validate hardcore vulnerabilities in mobile, web, and IoT applications/devices. He also works with Bugcrowd to improve the security industries relations with the researchers. Jason’s interests and areas of expertise include, mobile penetration testing, black box web application auditing, network/infrastructural security assessments, binary reverse engineering, and static analysis.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Alice and Bob are Really Confused

David Huerta Cryptoparty Organizer

There have been over 20 cryptoparties in New York City, in which people are introduced to open source cryptography software. This doesn't always go smoothly. Usability experts have only recently being included in the design process for encryption tools, but by and large what we have to work with were designed by cryptography experts in the 90s. I'll be going over some pain points between real-world users and their real-life encounters with open source cryptography tools.

David Huerta ships critical art in suspicious packages and helps organize cryptoparties, which bring technologists and everyone else in New York together to learn how to protect their online privacy. Before arriving in New York, he dropped out of Arizona State University and was one of the founding members for HeatSync Labs, an Arizona hackerspace which brings makers, hackers, and the occasional futurist together to build things and teach others how to do the same.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

LTE Recon and Tracking with RTLSDR

Ian Kline Wolf Den Associates

Since RTLSDR became a consumer grade RX device, numerous talks and open source tools enabled the community to monitor airplanes, ships, and cars... but come on, what we really want to track are cell phones. If you know how to run cmake and have $50 to pick up an RTLSDR-E4000, I'll make sure you walk out of here with the power to monitor LTE devices around you on a slick Kibana4 dashboard. You'll also get a primer on geolocating the devices if you've got a second E4000 and some basic soldering skills.

Ian has 10 years of experience studying the global RF emissions environment. Professionally, he uses this knowledge to rapidly hack up communication platforms and conduct RF surveys for pentesting and red teaming activities. Personnally, he can be found listening to satellites and building databses of all the cars that park on his block with TPMS. He currently supports Wolf Den Associates as Red Team leader and Digital Signature Specialist.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Forensic Artifacts From a Pass the Hash Attack

Gerard Laygui Security Researcher

A pass the hash (PtH) attack is one of the most devastating attacks to execute on the systems in a Windows domain. Many system admins are unaware about this type of attack and the amount of damage it can do. This presentation is for the system admins that don't have a full time forensics person working with them. This presentation will help identify key windows events and explain why these events are important. The presentation will also show various free tools that can assist in examining some of the common evidence left behind. The presentation will explain and demonstrate a pass the hash attack against common windows systems in an example domain. In the end, the presentation may offer some insight into what an attacker wants and needs to use PtH to pivot in a network.

Gerard has been in the IT industry for almost 20 years. He has held various network admin, system admin, web admin and security related positions throughout his career. He currently works for a Fortune 50 company doing compromise forensics and malware reverse engineering.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

I’m A Newbie Yet I Can Hack ZigBee – Take Unauthorized Control Over ZigBee Devices

LI Jun Graduate student from CUIT(Chengdu University of Information Technology , Chengdu ,China),Intern at Qihoo 360 Technology Co. Ltd.

YANG Qing Team Leader of Unicorn Team, Qihoo 360 Technology Co. Ltd.

With the advent of the Internet of Things，more and more objects are connected via various communication protocols like Bluetooth，Z-wave，WiFi , ZigBee etc. Among those protocols ZigBee accounts for the largest market share，it has been adapted to various applications like WSN（Wireless Sensor Network），Smart Home . Over the last few years, large amount of research has been conducted on the security of ZigBee. In this presentation we will introduce a new technique to beat the security of ZigBee, we found the “signature” of the location of the security key . We will go through a specific example and share the thinking process along the way. The techniques used throughout this example can be generalized and used by other hardware reverse engineers.

LI Jun is currently a hardware security intern in Unicorn Team of Qihoo 360 ,China. He is also a second year graduate student at Chengdu University of Information Technology. He received his bachelor’s degree from University of Electronic Science and Technology of China in 2013.During his college life, he switched between different majors, 2 years in Automobile Electronics,2 years in Electronic and Electric Engineering. He is interested in the security of the Internet of Things and the security of automobile electronics.

Linkedin: LI Jun

Weibo: GoRushing

Twitter：@bravo_fighter

YANG Qing is the team leader of Unicorn Team in Qihoo 360 Technology Co. Ltd. He has rich experiences in wireless and hardware security area, including WiFi penetration testing, cellular network interception, IC card cracking etc. His interests also cover embedded system hacking, firmware reversing, automotive security, and software radio .He is the first one who reported the vulnerabilities of WiFi system and RF IC card system used in Beijing subway.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Are We Really Safe? - Bypassing Access Control Systems

Dennis Maldonado Security Consultant - KLC Consulting

Access control systems are everywhere. They are used to protect everything from residential communities to commercial offices. People depend on these to work properly, but what if I had complete control over your access control solution just by using my phone? Or perhaps I input a secret keypad combination that unlocks your front door? You may not be as secure as you think.

The world relies on access control systems to ensure that secured areas are only accessible to authorized users. Usually, a keypad is the only thing stopping an unauthorized person from accessing the private space behind it. There are many types of access control systems from stand-alone keypads to telephony access control. In this talk, Dennis will be going over how and where access control systems are used. Dennis will walk through and demonstrate the tips and tricks used in bypassing common access control systems. This presentation will include attack methods of all nature including physical attacks, RFID, wireless, telephony, network, and more.

Dennis Maldonado is a Security Consultant at KLC Consulting. His current work includes vulnerability management, penetration testing, infrastructure risk assessment and security research. Dennis’ focus is encompassing all forms information security into an assessment in order to better simulate a real world attack against systems and infrastructure.

As a security researcher and evangelist, Dennis spends his time sharing what he knows about Information Security with anyone willing to learn. Dennis has presented at numerous workshops and meetups in the Houston area. Dennis co-founded Houston Locksport in Houston, Texas where he shares his love for lock-picking physical security.

Twitter: @DennisMald

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Sorry, Wrong Number: Mysteries Of The Phone System - Past and Present

"Unregistered436" Patrick McNeil Security Architect

"Snide" Owen Security Researcher

Exploring the phone system was once the new and exciting realm of “phone phreaks,” an ancestor of today’s computer “hackers.” The first phreaks “owned” and explored the vague mysteries of the telephone network for a time until their activities drew too much attention from the phone companies and law enforcement. The phone system evolved, somewhat, in an attempt to shut them out, and phreaking became both difficult and legally dangerous. Such events paralleled a new personal computer “revolution” wherein phone phreaks made the transition from the secret subtleties of telephony to the new and mystical frontier of personal computing. Private BBS(s) and, eventually, the Internet was not only the next logical step forward, but also provided “safer” alternatives that still allowed for the thrill of exploring the mysteries of a new modern age. Telephony, and voice security in general, became, as the years passed, something of a lost art to all but those who remember...

In this presentation we begin our adventure with a journey back in time, starting in the post-war Film Noir era of the 40’s and 50’s, when users required an operator at the switchboard to make a call, investigating some of the early roots of phreaking that many have forgotten. We will briefly take a look at the weaknesses of early telephone systems and the emergence of the original phreaks in the 50’s and 60’s who found and exploited them. Our journey will also allow us to demonstrate how some of the same basic phreaking approaches are still applicable to today’s "advanced" VoIP systems.

Certainly the initial creation and emergence of VoIP opened a variety of attack vectors that were covered at security conferences at the time. Commercial VoIP adoption, however, remained stagnant until standards and carriers caught up. Some VoIP hacking tools were left unmaintained, and VoIP wasn’t the sexy and mysterious attack vector it once was with the exception of tricksters who found old or insecure systems to be easy targets. Due to increased VoIP adoption over the last few years, however, telephony attacks are provocative once again.

As hardboiled VoIP detectives, we’ll unravel the mysteries of the curious, shadowy, and secretive world of phreaks, tricksters, and VoIP hackers. We’ll compare and contrast old school phreaking with new advances in VoIP hacking. We’ll explain how voice systems are targeted, how they are attacked using old and new methods, and how to secure them - with demonstrations along with practical and actionable tips along the way. We may even drop a new VoIP telephony phishing tool to fuse the past and the present..

Patrick spoke about telephony fraud last year at DEF CON Skytalks (“How To Make Money Fast Using A Pwned PBX”), and is a #telephreak at heart. He has over twenty years of experience, mostly with telecom manufacturers, and spent time in charge of product security for the communications security business of a fortune 100 company. When not working you can find him practicing Kung Fu, brewing beer, or picking locks with Oak City Locksport.

Twitter: @unregistered436

Owen used to be a professional developer code monkey. He’s worked in various IT fields including Server Administration, DevOps, Application Security and most recently as a penetration tester. He enjoys tinkering with various technologies, and has experimented for prolonged periods with PBXs and the obscure side of VoIP.

Twitter: @linuxblog

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Backdooring Git

John Menerick Security @ NetSuite

Join us for a fun-filled tour of source control management and services to talk about how to backdoor software. We will focus on one of the most popular, trendy SCM tools and related services out there – Git. Nothing is sacred. Along the way, we will expose the risks and liabilities one is exposed to by faulty usage and deployments. When we are finished, you will be able to use the same tools and techniques to protect or backdoor popular open source projects or your hobby project.

John Menerick works on Security @ NetSuite. John’s interests include cracking clouds, modeling complex systems, developing massive software-defined infrastructures, and is the outlier in your risk model.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hacking SQL Injection for Remote Code Execution on a LAMP stack

Nemus Software Engineer

Remember that web application you wrote when you where first learning PHP? Ever wonder how vulnerable that code base is? Through the perspective of an attacker you will see how SQL injection can lead to data loss and system compromise. This presentation will take you through the techniques and tools used to take control of a PHP web application starting from an injection point moving to PHP web shells, and ending with a Linux wildcard attack.

Nemus works as a software engineer in the payment industry developing software that transfers money between banking systems. He is a founding member of 801 Labs, a hackerspace located in Salt Lake City, and is an active member of his local DEF CON group DC801. Nemus has a BS in Computer Science and is a certified GIAC Web Application Penetration Tester (GWAPT).

Twitter: @Nemus801

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Abusing native Shims for Post Exploitation

Sean Pierce Technical Intelligence Analyst for iSIGHT Partners

Shims offer a powerful rootkit-like framework that is natively implemented in most all modern Windows Operating Systems. This talk will focus on the wide array of post-exploitation options that a novice attacker could utilize to subvert the integrity of virtually any Windows application. I will demonstrate how Shim Database Files (sdb files / shims) are simple to create, easy to install, flexible, and stealthy. I will also show that there are other far more advanced applications such as in-memory patching, malware obfuscation, evasion, and system integrity subversion. For defenders, I am releasing 6 open source tools to prevent, detect, and block malicious shims.

Sean Pierce is a Technical Intelligence Analyst for iSIGHT Partners. Sean currently specializes in reverse engineering malware & threat emulation and in the past has worked on incident response, botnet tracking, security research, automation, and quality control. Prior working at iSIGHT Partners, he was an academic researcher and part time lecturer at the University of Texas at Arlington where he earned a Bachelors of Computer Engineering with a minor in Math. Sean also does freelance consulting, penetration testing, forensics, and computer security education. He is an Eagle Scout and enjoys learning how things work.

Twitter: @secure_sean

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hacker in the Wires

Dr. Phil Polstra Professor, Bloomsburg University

This talk will show attendees how to use a small ARM-based computer that is connected inline to a wired network for penetration testing. The computer is running a full-featured penetration testing Linux distro. Data may be exfiltrated using the network or via a ZigBee mesh network or GSM modem.

The device discussed in this talk is easily integrated into a powerful penetration test that is performed with an army of ARM-based small computer systems connected by XBee or ZigBee mesh networking.

Some familiarity with Linux and penetration testing would be helpful, but not required.

Phil was born at an early age. He cleaned out his savings at age 8 in order to buy a TI99-4A computer for the sum of $450. Two years later he learned 6502 assembly and has been hacking computers and electronics ever since.

Dr. Phil currently works as a professor at Bloomsburg University of Pennsylvania. His research focus over the last few years has been on the use of microcontrollers and small embedded computers for forensics and pentesting. Phil has developed a custom pentesting Linux distro and related hardware to allow an inexpensive army of remote pentesting drones to be built using the BeagleBone Black computer boards. This work is described in detail in Phil's book "Hacking and Penetration Testing With Low Power Devices" (Syngress, 2015).

Prior to entering academia, Phil held several high level positions at well-known US companies. He holds a couple of the usual certs one might expect for someone in his position. When not working, he likes to spend time with his family, fly, hack electronics, and has been known to build airplanes.

Twitter: @ppolstra

http://facebook.com/ppolstra

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

A Hacker’s Guide to Risk

Bruce Potter The Shmoo Group

When the latest and greatest vulnerability is announced, the media and PR frenzy can be dizzying. However, when the dust settles, how do we actually measure the risk represented by a given vulnerability. When pen testers find holes in an organization, is it really “ZOMG, you’re SO 0WNED!” or is it something more manageable and controlled? When you’re attempting to convince the boss of the necessity of the latest security technology, how do really rank the importance of the technology against the threats facing the organization.

Understanding risk can be tricky, especially in an industry that often works on gut feelings and values quantity over quality. But risk and risk management doesn’t need to be complicated. With a few basic formulas and access to some simple models, understanding risk can be a straightforward process. This talk will discuss risk, why its important, and the poor job the hacker community has done when it comes to properly assessing risk. It will also touch on some existing risk assessment and management systems, as well as provide worked examples of real world vulnerabilities and systems and the risks they pose. Finally, this talk will examine some practical guidance on how you, as hackers, security researchers, and security practitioners can better measure risk in your day to day life

Bruce Potter is the founder of The Shmoo Group, one of the organizers of ShmooCon, and a director at KEYW Corporation. Bruce's lack of degrees and certifications hasn't stopped him from discussing infosec in numerous articles, books, and presentations. Bruce has been in the computer security field for nearly 2 decades which means he is getting old and increasingly jaded. His primary focus areas are trusted computing, cyber security risk management (yikes!), and large scale vulnerability analysis. Bruce believes that while attackers have the upper hand, we can still do better with the tools we have than most people realize. Bruce also believes in using fake names when ordering coffee but occasionally uses his real name to throw people off his scent.

Twitter: @gdead

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Chellam – a Wi-Fi IDS/Firewall for Windows

Vivek Ramachandran Founder, SecurityTube.net and Pentester Academy

This talk will introduce techniques to detect Wi-Fi attacks such as Honeypots, Evil Twins, Mis-association , Hosted Network based backdoors etc. on a Windows client without the need for custom hardware or drivers. Our attack detection techniques will work for both Encrypted (WPA/WPA2 PSK and Enterprise) and Unencrypted networks.

We will also release a proof of concept tool implementing our detection techniques. Even though the focus of this talk is Windows, the same principles can be used to protect other Operating Systems, both workstation and mobile.

Vivek Ramachandran discovered the Caffe Latte attack, broke WEP Cloaking and publicly demonstrated enterprise Wi-Fi backdoors. He is the author of "Backtrack 5: Wireless Penetration Testing" which has sold over 13,000+ copies worldwide. He is the founder of SecurityTube.net and runs SecurityTube Training & Pentester Academy which has trained professionals from 90 countries. He has spoken/trained at DEF CON, Blackhat USA/Europe/Abu Dhabi, Brucon, Hacktivity etc. conferences.

Twitter: @securitytube

Facebook: https://www.facebook.com/pagesectube

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hardware and Trust Security: Explain it like I’m 5

Teddy Reed Security Engineer Facebook

Nick Anderson Research Scientist

There are a lot of presentations and suggestions that indicate HSMs, TrustZone, AMT, TrEE, SecureBoot, Attestation, TPMs, IOMMU, DRTM, etc. are silver bullets. What does it all mean, should we be afraid, excited, hopeful? Hardware-based security features are not the end of the world, nor its savior, but they can be fun and useful. Although these technologies are vulnerability research targets, their trust concepts can be used to build secure software and devices.

This primer covers practical defensive uses of existing and upcoming hardware security and mobile trust technologies. We will overview the strengths, pitfalls, gotchas of these esoteric acronyms; and explain the capabilities of related features built into consumer and enterprise laptops, mobile, and embedded devices. Let’s take a tour around the wild world of hardware and trust security!

Teddy is a Security Engineer at Facebook developing production security tools. He is very passionate about trustworthy, safe, and secure code development. He loves open source and collaborative engineering when scale, resiliency, and performance enable defensive and protective software design. Teddy has published at security conferences on trusted computing, hardware trusted systems, UAVs, botnet development, human performance engineering, competition game theory, biometric vulnerabilities, and PaaS API vulnerabilities.

Nick Anderson is a research scientist at a US super serious secret laboratory. When Nick is not fighting cyber warriors in the cyber threatscape in his cyber career, he is actively engaged in malware research and enjoys failing at web development. Nick received his masters degree from NYU Polytechnic School of Engineering after completing his bachelors degree in Mathematics from the University of Wyoming.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Bruce Schneier Q&A

Bruce Schneier CTO, Resilient Systems

Bruce Schneier Talks Security. Come hear about what's new, what's hot, and what's hype in security. NSA surveillance, airports, voting machines, ID cards, cryptography -- he'll talk about what's in the news and what matters. Always a lively and interesting talk.

Bruce Schneier is an internationally renowned security technologist, called a security guru by the Economist. He is the author of 12 booksincluding the New York Times best-seller Data and Goliath: The Hidden Values to Collect Your Data and Control Your Worldas well as hundreds of articles, essays, and academic papers. His influential newsletter Crypto-Gram and his blog Schneier on Security are read by over 250,000 people. He has testified before Congress, is a frequent guest on television and radio, has served on several government committees, and is regularly quoted in the press. Schneier is a fellow at the Berkman Center for Internet and Society at Harvard Law School, a program fellow at the New America Foundations Open Technology Institute, a board member of the Electronic Frontier Foundation, and an advisory board member of the Electronic Privacy Information Center. He is the CTO of Resilient Systems.

Twitter: @schneierblog

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Applied Intelligence: Using Information That's Not There

Michael Schrenk Security Researcher

Organizations continue to unknowingly leak trade secrets on the Internet. To those in the know, these leaks are a valuable source of competitive intelligence. This talk describes how the speaker collects competitive intelligence for his own online retail business. Specifically, you learn how he combines, trends, and analyzes information within specific contexts to manufacture useful data that is real, but technically doesn't exist on it's own. For example, you will learn about the trade secrets that are hidden within sequential numbers, how he uses collected intelligence to procure inventory, and how and why he gauges the ongoing health of his industry and that of his competitors. And on a related note, you'll also learn how the federal government nearly exposed an entire generation to identity fraud.

Michael Schrenk has presented six DEF CON talks on intelligence and organizational privacy, including last year's talk "You're Leaking Trade Secrets". He has developed Internet-based intelligence campaigns since 1995 for organizations as diverse as: Fortune 500 Companies, Private Investigators, Asian Art Dealers, and Investigative Journalists. His adventures in intelligence have taken him around the world, with speaking opportunities in The Middle East, Eastern Europe, The UK, Silicon Valley, and most places in between. Mike is also the author of "Webbots, Spiders, and Screen Scrapers (2007 & 2012, No Starch Press, San Francisco)". He is again teaming with No Starch Press to write a non-technical Intelligence and Counterintelligence book scheduled for publication in Q1 2016.

Twitter: @mgschrenk

Facebook: facebook.com/webbots

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

I Am Packer And So Can You

Mike Sconzo Security Researcher

Automating packer and compiler/toolchain detection can be tricky and best and downright frustrating at worst. The majority of existing solutions are old, closed source or aren’t cross platform. Originally, a method of packer identification that leveraged some text analysis algorithms was presented. The goal is to create a method to identify compilers and packers based on the structural changes they leave behind in PE files. This iteration builds upon previous work of using assembly mnemonics for packer detection and grouping. New features and analysis are covered for identification and clustering of PE files.

Mike Sconzo has been around the Security Industry for quite some time, and is interested in creating and implementing new methods of detecting unknown and suspicious network activity as well as different approaches for file/malware analysis. This includes looking for protocol anomalies, patterns of network traffic, and various forms of static and dynamic file analysis. He works on reversing malware, tool creation for analysis, and threat intelligence. Currently a lot of his time is spent doing data exploration and tinkering with statistical analysis and machine learning.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

NSM 101 for ICS

Chris Sistrunk Sr. ICS Security Consultant, FireEye

Is your ICS breached? Are you sure? How do you know?

The current state of security in Industrial Control Systems is a widely publicized issue, but fixes to ICS security issues are long cycle, with some systems and devices that will unfortunately never have patches available. In this environment, visibility into security threats to ICS is critical, and almost all of ICS monitoring has been focused on compliance, rather than looking for indicators/evidence of compromise. The non-intrusive nature of Network Security Monitoring (NSM) is a perfect fit for ICS. This presentation will show how NSM should be part of ICS defense and response strategy, various options for implementing NSM, and some of the capabilities that NSM can bring to an ICS security program. Free tools such as Security Onion, Snort IDS, Bro IDS, NetworkMiner, and Wireshark will be used to look at the ICS environment for anomalies. It will be helpful if attendees have read these books (but they aren't required): The Cuckoo's Egg by Cliff Stoll, The Practice of Network Security Monitoring by Richard Bejtlich, and Applied Network Security Monitoring by Chris Sanders and Jason Smith.

Chris Sistrunk is a Senior Consultant at Mandiant, focusing on cyber security for industrial control systems (ICS) and critical infrastructure. Prior to joining Mandiant, Chris was a Senior Engineer at Entergy (over 11 years) where he was the Subject Matter Expert (SME) for SCADA systems. He has 10 years of experience in SCADA systems with tasks such as standards development, system design, database configuration, testing, commissioning, troubleshooting, and training. He was the co-overseer of the SCADA, relay, and cyber security labs at Entergy for 6 years. Chris has been working with Adam Crain of Automatak on Project Robus, an ICS protocol fuzzing project that has found and helped fix many implementation vulnerabilities in DNP3, Modbus, and Telegyr 8979.

Chris helped organize the first ICS Village, which debuted at DEF CON 22.

He is a Senior Member of IEEE, Mississippi Infragard President, member of the DNP Users Group, and also is a registered PE in Louisiana. He holds a BS in Electrical Engineering and MS in Engineering and Technology Management from Louisiana Tech University. Chris also founded and organizes BSidesJackson, Mississippi's only cyber security conference.

Twitter: @chrissistrunk

https://www.facebook.com/chrissistrunk

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Beyond the Scan: The Value Proposition of Vulnerability Assessment

Damon Small Security Researcher

Vulnerability Assessment is, by some, regarded as one of the least “sexy” capabilities in information security. However, it is the presenter’s view that it is also a key component of any successful infosec program, and one that is often overlooked. Doing so serves an injustice to the organization and results in many missed opportunities to help ensure success in protecting critical information assets. The presenter will explore how Vulnerability Assessment can be leveraged “Beyond the Scan” and provide tangible value to not only the security team, but the entire business that it supports.

Damon Small began his career studying music at Louisiana State University. Pursuing his desire to actually make money, he took advantage of computer skills learned in the LSU recording studio to become a systems administrator in the mid 1990s. Following the dotcom bust in the early 2000s, Small began focusing on cyber security. This has remained his passion, and over the past 15 years as a security professional he has supported infosec initiatives in the healthcare, defense, and oil and gas industries. In addition to his Bachelor of Arts in Music, Small completed the Master of Science in Information Assurance degree from Norwich University in 2005.

Twitter: @damonsmall

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

The Bieber Project: Ad Tech 101, Fake Fans and Adventures in Buying Internet Traffic

Mark Ryan Talabis Chief Security Scientist, zVelo

In the past year, I found myself immersed in the multi-billion dollar digital advertising industry. This gave me the opportunity to investigate the unique security challenges and issues facing the industry. It was a shock to me at first how complex the advertising ecosystem was particularly in the advent of programmatic advertising. But I dove in head first and learned a lot which I would like to share with my fellow security professionals. During this time, I got involved with unscrupulous publishers, apathetic ad networks, angry advertisers and activist malware researchers. I encountered self proclaimed experts with fantastic claims, vendors using scare tactics, and a glaring disconnect between the security and ad tech worlds.

In this presentation, I would like to be able to provide the audience with my experience plus a number of things. Among which are:

- Provide security professionals a 101 type of introduction to the world of digital advertising ecosystem. Among the things we will tackle is what is programmatic advertising, what the roles are of the different players like ad networks are and how money is made off all this interplay.

- Provide the audience a perspective on what security challenges the advertising industry is facing and opportunities for us security professionals to be involved. We all know about malvertising and its a big deal to us security guys but there are bigger, and in an advertisers perspective, more relevant issues that needs to be taken care of first. All of this will be discussed in this talk.

- An introduction about the different and creative ways unscrupulous publishers can pad their earnings. We will be talking about hidden ads, ad stacking, intrusive ads, auto-refreshes, popups, popunders, blackhat SEO techniques and dirty inventory.

- An in depth discussion on the problems caused by non-human traffic (NHT). We will talk about what it is, why is it a problem, how it is generated, and more importantly, how do we catch it? In fact, this presentation is named the “Bieber Project” which is the experiment which I leveraged to understand non-human traffic and determine how we can identify it.

Mark Ryan Talabis is the Chief Security Scientist for zVelo Inc where he conducts research on advertising fraud and non-human traffic. He is also formerly the Director of the Cloud Business Unit of FireEye. He is an alumni member of the Honeynet Project and a member of the anti-malware working group of the Interactive Advertising Bureau (IAB) where he is contributing in the promotion of threat intel sharing across the advertising industry.

His current work focuses on helping the advertisers and ad networks in finding ways to identify non-human traffic through various browser impression and behavioral based anomaly detection techniques. This also includes work on detecting various impression and click padding techniques by unscrupulous publishers.

He is a graduate of Harvard University and is a co-author of two books from Elsevier Syngress: "Information Security Analytics: Finding Security Insights, Patterns, and Anomalies in Big Data" (2014) and "Information Security Risk Assessment Toolkit: Practical Assessments through Data Collection and Data Analysis" (2012). Techniqies He has presented in various security and academic conferences and organizations around the world including Blackhat, DEF CON, Shakacon, INFORMS, INFRAGARD, ISSA, and ISACA.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hijacking Arbitrary .NET Application Control Flow

Topher Timzen Security Researcher - Intel

This speech will demonstrate attacking .NET applications at runtime. I will show how to modify running applications with advanced .NET and assembly level attacks that alter the control flow of any .NET application. New attack techniques and tools will be released to allow penetration testers and attackers to carry out advanced post exploitation attacks.

This presentation gives an overview of how to use these tools in a real attack sequence and gives a view into the .NET hacker space.

Topher Timzen has had a research emphasis on reverse engineering malware, incident response and exploit development. He has instructed college courses in malware analysis and memory forensics while managing a cybersecurity research lab. Focusing on .NET memory hijacking, he has produced tools that allow for new post exploitation attack sequences. Topher is currently a Security Researcher at Intel.

Twitter: @TTimzen

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hackers Hiring Hackers - How to Do Things Better

Tottenkoph Security Consultant, Rapid7

IrishMASMS Hacker

There are a lot of talks about how to be a better pen tester and workshops that show you how to use all of the cool new tools that are available to make our jobs easier, but there are only a few talks that address what some of us consider to be the hardest part of getting a job in security: the hiring process. The information security field is in desperate need of people with the technical skills hackers have to fill a myriad of roles within organizations across the world. However, both sides of the table are doing horribly when it comes to hiring and interviewing for work.

Organizations are doing poorly trying to communicate expectations for a job, there are people going to interviews without knowing how to showcase their (limited or vast) experience, and some people posture themselves so poorly that the hiring managers don’t think the candidates are really interested in the job. This talk takes the experiences of the speakers as both interviewers and interviewees as well as from others within the scene in order to help better prepare hackers to enter (or move within) “the industry” as well as let the people making hiring decisions know what they can do to get the people and experience they need for their teams.

Tottenkoph has been hacking for the past 10 years and is currently a security consultant for Rapid7. Tottie has spoken at several hacker cons and is currently pursuing her Master’s degree in Industrial and Organizational Psychology, planning to apply its practices to the hacker and infosec communities.

Twitter: @Tottenkoph

IrishMASMS is an old school hacker, fighting the good fight in Computer Network Defence (CND)/blue team efforts for over 16 years. Been lurking about since DEF CON 10, DJing the B&W ball at DEF CON 18 (with quite a few AP pool shindigs and private parties along the way). Panel member at HOPE 5, presenter at a couple of Notacon’s, and some other conferences that are hard to remember what really happened. Having progressed through the ranks to hiring manager and director level, he has experienced the pain from both sides of the hiring process and desires to improve the situation for the InfoSec community. Is this where we mention cyberderp?

Twitter: @IrishMASMS

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

QARK: Android App Exploit and SCA Tool

Tony Trummer Staff Information Security Engineer/LinkedIn

Tushar Dalvi Sr. Security Engineer/LinkedIn

Ever wonder why there isn't a metasploit-style framework for Android apps? We did! Whether you're a developer trying to protect your insecure app from winding up on devices, an Android n00b or a pentester trying to pwn all the things, QARK is just what you've been looking for! This tool combines SCA, teaching and automated exploitation into one, simple to use application!

Tony Trummer (@SecBro1) - has been working in the IT industry for nearly 20 years and has been focused on application security for the last 5 years. He is currently an in-house penetration tester for LinkedIn, running point on their mobile security initiatives and has been recognized in the Android Security Acknowledgements. When he's not hacking, he enjoys thinking about astrophysics, playing devil's advocate and has been known to dust his skateboard off from time-to-time.

Twitter: @SecBro1

LinkedIn: www.linkedin.com/in/tonytrummer

Tushar Dalvi (@tushardalvi) - Loves breaking web applications and ceramic bowls. Tushar Dalvi is a security enthusiast, and currently works as a Senior Information Security Engineer at LinkedIn. He specializes in the area of application security, with a strong focus on vulnerability research and assessment of mobile applications. Previously, Tushar has worked as a security consultant at Foundstone Professional Services (McAfee) and as a Senior developer at ACI Worldwide.

Twitter: @tushardalvi

LinkedIn: www.linkedin.com/in/tdalvi

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hacking Web Apps

Brent White Security Consultant, Solutionary, Inc.

Assessing the security posture of a web application is a common project for a penetration tester and a good skill for developers to know. In this talk, I'll go over the different stages of a web application pen test, from start to finish. We'll start with the discovery phase to utilize OSINT sources such as search engines, sub-domain brute-forcing and other methods to help you get a good idea of targets "footprint", all the way to fuzzing parameters to find potential SQL injection vulnerabilities. I'll also discuss several of the tools and some techniques that I use to conduct a full application penetration assessment. After this talk, you should have a good understanding of what is needed as well as where to start on your journey to hacking web apps.

Brent is an Offensive Security Consultant at Solutionary‹An NTT Group Security Company and has spoken at numerous security conferences, including DEF CON 22‹SE Village. He has held the role of Web/Project Manager and IT Security Director at the headquarters of a global franchise company. His experience includes Internal and External Penetration Assessments, Social Engineering and Physical Security Assessments, Wireless and Application Vulnerability Assessments and more.

Twitter: @BrentWDesign

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

And That's How I Lost My Other Eye: Further Explorations In Data Destruction

Zoz Robotics Engineer and Security Researcher

How much more paranoid are you now than you were four years ago? Warrantless surveillance and large-scale data confiscation have brought fear of the feds filching your files from black helicopter territory into the mainstream. Recent government snatch-and-grabs have run the gamut from remotely imaging foreign servers to straight up domestic coffeeshop muggings, so if you think you might need to discard a lot of data in hurry you're probably right. In their legendary DEF CON 19 presentation Shane Lawson, Bruce Potter and Deviant Ollam kicked off the discussion, and now it's time for another installment. While purging incriminating material residing on spinning disks remains the focus, the research has been expanded to encompass solid state storage and mobile solutions to your terabyte trashing needs. With best efforts to comply with the original constraints, the 2015 update features more analysis of the efficacy of kinetic projectiles, energetic materials and high voltages for saving your freedom at the potential cost of only a redundant body part... or two.

Zoz is a robotics engineer, rapid prototyping specialist and lifelong enthusiast of the pyrotechnic arts. Once he learned you could use a flamethrower and a coffee creamer bomb to fake a crop circle for TV he realized there are really no limits to creative destruction.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Presentations

-  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Malware in the Gaming Micro-economy

Zack Allen Lead Research Engineer, ZeroFOX

Rusty Bower Information Security Engineer

Microeconomics focuses on how patterns of supply and demand determine price and output in individual markets [1]. Within recent years, micro-economies have flourished within the video game industry. Companies like Valve rely heavily on a business model that depends on gamers making purchases for in-game items. Players can trade these items in bulk for a rare item, make bets on a competitive gaming match or gift the item for a charity event.

While originally well-intentioned, creating these micro-economies also created an incentive for criminals to scam and even steal from unsuspecting victims. Traditional scams date as far back to games like Diablo or Runescape where players were duped in trade windows and in game messaging systems were used to steal items. These low-tech strategies are effective, but recently a new, high-tech scam strategy has emerged relying upon malware specifically targeting the Steam micro-economy.

Over the last year, we have collected and reversed dozens of samples of malware that target Steam users. Pieces of malware can be sophisticated RAM scrapers that pilfer an item in memory and send trade requests through the Steam trading API, or as simple as a remote login service. The end result is the same - the hacker loots the victim’s backpack of in game items to sell them on the market for profit. This talk focuses on the techniques we have found in these samples, surveys of victims of these scams and the distribution of money lost from them (up to the $1000s of dollars for users in some cases) and the defenses Steam has put in place to combat this hacker underground.

Zack Allen is an RIT graduate, majoring in Information Security. He is also an alum of the Advanced Course for Engineering (ACE) held at AFRL every summer. After working for a government contractor, he joined the exciting startup world and is currently a Research team lead at ZeroFOX. His security specialties include research and development, threat intelligence, tool creation and red teaming.

Rusty Bower graduated from the Rochester Institute of Technology with a degree in Information Security. He has been employed at Lockheed Martin and Palantir Technologies tackling a variety of security challenges. His experience is mainly focused in security operations, incident response, tool development, and infrastructure management. He is currently an Information Security Engineer in the Los Angeles area, tackling security challenges at scale.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

How to secure the keyboard chain

Paul Amicelli Student from IT Engineering School - ESIEA in Laval, France

Baptiste David Engineer from IT Engineer School - ESIEA in Laval, France

Keyloggers are hardware or software tools that record keystrokes. They are an overlooked threat to the computer security and user’s privacy. As they are able to retrieve all sensitive information typed on a keyboard in an almost invisibly way , they need to be seriously considered both for companies and individuals. Almost all the security measures against keyloggers are post-active and static.

*So what if the solution were to be proactive, and use the same technology as keyloggers do, in order to fool them ? This is all about this presentation, a way of fooling all known and unknown keyloggers (physicals, kernel-mode and user-mode) through a kernel mode driver developed under Windows. The technical details will be presented during the presentation, as well as the results and propositions.

Basically, the idea is to use a kernel mode driver which encrypts each keyboard key hit, at a very low level in the system (near the driver port). The encryption is made according to a common key, exchanged with a client application which needs to ensure that the entered text is secured and not recorded. After the driver has encrypted a key, it spreads it to the entire system. Thus, only the client application, holding the encryption key, can decrypt the keyboard key. In this way, the whole system is fooled.

Paul Amicelli is a French engineering student at ESIEA, an IT Engineering School in Laval, France. Fascinated by the world of computer security, he is currently involved as a student researcher in the Operational Cryptology and Virology research lab of its school, where some projects like the encryption solution Gostcrypt, in which he is taking part of, are developed. Prior to that, he has done a two-year preparatory class for the Grandes Ecoles in mathematics and physics (CPGE).

Baptiste David is a computer science engineer who has been working for the CVO laboratory for many years. His research areas are based on operational and offensive computer security for protection of critical systems. He is specialized n reverse engineering, kernel development and malware analysis. He has especially worked on GostCrypt and many antivirus project for many years. He made numerous conferences all over the world about security and offensive techniques.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

How to hack your way out of home detention

AmmonRa Security Researcher

Home detention and criminal tracking systems are used in hostile environments, and because of this, the designers of these trackers incorporate a range of anti-removal and tamper detection features. Software security, however, is an area on which less focus is placed.

This talk will cover practical attacks against home detention tracking systems, with a focus on software security. Intercepting and modifying tracking information sent from the device in order to spoof the tracker’s location will be demonstrated.

General information about how home detention tracking systems operate will be discussed, including the differences between older proximity based systems which used landlines, and newer models which use GPS and cellular networks. Topics will include how to (legally) get hold of and test a real world device, and how to use cheap software defined radios to spoof GSM cell towers. Focus will be on the details of how one particular device is constructed, how it operates and the vulnerabilities it was found to contain. How these vulnerabilities can be exploited and the challenges of doing so in the wild will also be covered.

AmmonRa is a former dev who now works in infosec as a pentester. Both at work and in his spare time AmmonRa hacks things. As well as hacking computers, AmmonRa is a DIY cyborg, designing and implanting in himself a range of devices, including NFC/RFID chips, biometric sensors and subdermal lights.

Twitter: @amm0nra

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Fun with Symboliks

atlas dude at Grimm

Asking the hard questions... and getting answer! Oh binary, where art thine vulns?

Symbolic analysis has been a "thing" for 20 years, and yet it's still left largely to the obscure and the academic researchers (and NASA). several years ago, Invisigoth incorporated the Symboliks subsystem into the Vivisect binary analysis framework. due to that inclusion, the very nature of binary analysis has been broken down, rethought, and arisen out of the ashes. this talk will give an introduction into Symboliks, Graph Theory, and the path forward for reverse engineering and vulnerability research, all from an interactive Python session or scripts.

A four time winner of DEF CON capture the flag and retired captain of the team "1@stplace", over the past decade atlas has proved expertise in programmatic reverse-engineering, automated vulnerability discovery and exploitation, and braking into or out of nearly every type of computer system/subsystem. areas of specialty include exmpedded/IoT exploitation, power systems and industrial control systems exploitation, automotive exploitation, and client/server/application exploitation.

Twitter: @at1as

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Quantum Computers vs. Computers Security

Jean-Philippe Aumasson Principal Cryptographer, Kudelski Security, Switzerland

We've heard about hypothetical quantum computers breaking most of the public-key crypto in use—RSA, elliptic curves, etc.—and we've heard about "post-quantum" systems that resist quantum computers. We also heard about quantum computers' potential to solve other problems considerably faster than classical computers, such as discrete optimization, machine learning, or code verification problems. And we heard about a commercial quantum computer, and we heard vendors of quantum key distribution or quantum random number generators promise us security as solid as the laws of physics. Still, most of us are clueless regarding:

- How quantum computers work and why they could solve certain problems faster than classical computers?

- What are the actual facts and what is FUD, hype, or journalistic exaggeration?

- Could quantum computers help in defending classical computers and networks against intrusions?

- Is it worth spending money in post-quantum systems, quantum key distribution, or in purchasing or developing of a quantum computer?

- Will usable quantum computers be built in the foreseeable future?

This talk gives honest answers to those questions, based on the latest research, on analyses of the researchers' and vendors' claims, and on a cost-benefit-risk analyses. We'll expose the fundamental principles of quantum computing in a way comprehensible by anyone, and we'll skip the technical details that require math and physics knowledge. Yet after this talk you'll best be able to assess the risk of quantum computers, to debunk misleading claims, and to ask the right questions.

Jean-Philippe (JP) Aumasson is Principal Cryptographer at Kudelski Security, in Switzerland. He is known for designing the cryptographic functions BLAKE, BLAKE2, SipHash, and NORX. He has spoken at conferences such as Black Hat, RSA, and CCC, and initiated the Crypto Coding Standard and the Password Hashing Competition projects. He co-wrote the 2015 book "The Hash Function BLAKE". He is member of the technical advisory board of the Open Crypto Audit Project and of the Underhanded Crypto Contest. JP tweets as @veorq.

Twitter: @veorq

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Key-Logger, Video, Mouse — How To Turn Your KVM Into a Raging Key-logging Monster

Yaniv Balmas Security Researcher, Check Point Software Technologies

Lior Oppenheim Security Researcher, Check Point Software Technologies

Key-Loggers are cool, really cool. It seems, however, that every conceivable aspect of key-logging has already been covered: from physical devices to hooking techniques. What possible innovation could be left in this field?

Well, that's what we used to think too. That is until we noticed that little grey box sitting there underneath a monitor, next to yesterday's dirty coffee cup. The little grey box that is most commonly known as 'KVM'.

The talk will tell the tale of our long journey to transform an innocent KVM into a raging key-logging monster. We will safely guide you through the embedded wastelands, past unknown IC's, to explore uncharted serial protocols and unravel monstrous obfuscation techniques.

Walking along the misty firmware woods of 8051 assembly we will challenge ambiguous functions and confront undebuggable environments.

Finally, we will present a live demo of our POC code and show you that air-gapped networks might not be as segregated as you imagined.

You will witness that malware code could actually reside outside your computer, persisting through reboots, wipes, formats, and even hardware replacements. You might laugh, you might cry, but one thing is certain - you will never look at your KVM the same as before.

Yaniv is a software engineer and a seasoned professional in the security field. He wrote his very first piece of code in BASIC on the new Commodore-64 he got for his 8th birthday. As a teenager, he spent his time looking for ways to hack computer games and break BBS software. This soon led to diving into more serious programming, and ultimately, the security field where he has been ever since. Yaniv is currently working as a security researcher and deals mainly with analyzing malware and vulnerability research

Twitter: @ynvb

Lior Oppenheim is a vulnerability researcher in the Malware and Vulnerability Research group at Check Point Software Technologies. Oppenheim was trained and served in an elite technological unit performing security research in the IDF. In his spare time, he loves tap dancing, reversing, playing his guitar and pwning embedded devices.

Twitter: @oppenheim1

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Canary: Keeping Your Dick Pics Safe(r)

Rob Bathurst (evilrob) Security Engineer and Penetration Tester

Jeff Thomas (xaphan) Senior Cyber Security Penetration Testing Specialist

The security of SSL/TLS is built on a rickety scaffolding of trust. At the core of this system is an ever growing number of Certificate Authorities that most people (and software) take for granted. Recent attacks have exploited this inherent trust to covertly intercept, monitor and manipulate supposedly secure communications. These types of attack endanger everyone, especially when they remain undetected. Unfortunately, there are few tools that non-technical humans can use to verify that their HTTPS traffic is actually secure.

We will present our research into the technical and political problems underlying SSL/TLS. We will also demonstrate a tool, currently called “Canary”, that will allow all types users to validate the digital certificates presented by services on the Internet.

Evilrob is a Security Engineer and Penetration Tester with over 14 years of experience with large network architecture and engineering. His current focus is on network security architecture, tool development, and high-assurance encryption devices. He currently spends his days contemplating new and exciting ways to do terrible things to all manner of healthcare related systems in the name of safety.

Twitter: @knomes

xaphan is a "Senior Cyber Security Penetration Testing Specialist" for a happy, non-threatening US government agency. He has been a penetration tester for 17 years, but maintains his sanity with a variety of distractions. He is the author of several ancient and obsolete security tools and the creator of DEFCOIN.

Twitter: @slugbait

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Extracting the Painful (blue)tooth

Matteo Beccaro

Matteo Collura

Do you know how many Bluetooth-enabled devices are currently present in the world? With the beginning of the IoT (Internet of Things) and Smart Bluetooth (Low energy) we find in our hands almost a zillion of them. Are they secure? What if I tell you I can unlock your Smartphone? What if I tell you I'm able to open the new shiny SmartLock you are using to secure your house's door?

In this talk we will explain briefly how the Bluetooth (BDR/EDR/LE) protocols work, focusing on security aspects. We will show then some known vulnerabilities and finally we will consider deeply undisclosed ones, even with live demonstrations.

Matteo Beccaro is a young security researcher. His interest focus on WiFi networks, networking and NFC implementations. He finished high school studies in July 2013 and actually he is a student at Politecnico di Torino in Computer Engineering course.

He has been selected as speaker at DEF CON 21, 30C3, BlackHat US Arsenal, DEF CON 22's Skytalks and BlackHat EU 2014 and Tetcon, for his research in vulnerabilities of NFC transport systems.

Since 2013 he is also pentester and security engineer at Secure Network s.r.l. Since 2015 he is also technical leader of the Security Research Team of OPFOR, the physical security division of Secure Network s.r.l.

Twitter: @_bughardy_

Matteo Collura is a student of Electronics Engineering at Politecnico di Torino. He has been studying Wireless networks and in the last few years he focused on NFC. He presented the results of a progressive work of research at several conferences: DEF CON 21 (Las Vegas, 2013), 30C3 (Hamburg 2013), DEF CON Skytalks (Las Vegas, 2014), BlackHat USA 2014 Arsenal (Las Vegas). Currently he is studying Bluetooth protocols and their implementations.

Twitter: @eagle1753

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

802.11 Massive Monitoring

Andres Blanco Sr Researcher, Core Security

Andres Gazzoli Sr Developer, Core Security

Wireless traffic analysis has been commonplace for quite a while now, frequently used in penetration testing and various areas of research. But what happens when channel hopping just doesn't cut it anymore -- can we monitor all 802.11 channels?

In this presentation we describe the analysis, different approaches and the development of a system to monitor and inject frames using routers running OpenWRT as wireless workers. At the end of this presentation we will release the tool we used to solve this problem.

Andrés Blanco is a researcher at CoreLabs, the research arm of Core Security. His research is mainly focused on wireless, network security and privacy. He has presented at Black Hat USA Arsenal, Hacklu and Ekoparty, and has published several security advisories.

Twitter: @6e726d

Andrés Gazzoli works at Core Security and is part of the Core Impact Pro developer team. He is a C++ developer with extensive experience in UI development. He enjoys everything related to wireless technologies and privacy.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Exploring Layer 2 Network Security in Virtualized Environments

Ronny L. Bull Ph.D. Graduate Student, Clarkson University

Jeanna N. Matthews Associate Professor, Clarkson University

Cloud service providers offer their customers the ability to deploy virtual machines in a multi-tenant environment. These virtual machines are typically connected to the physical network via a virtualized network configuration. This could be as simple as a bridged interface to each virtual machine or as complicated as a virtual switch providing more robust networking features such as VLANs, QoS, and monitoring. In this paper, we explore whether Layer 2 network attacks that work on physical switches apply to their virtualized counterparts by performing a systematic study across four major hypervisor environments - Open vSwitch, Citrix XenServer, Microsoft Hyper-V Server and VMware vSphere - in seven different virtual networking configurations. First, we use a malicious virtual machine to run a MAC flooding attack and evaluate the impact on co-resident VMs. We find that network performance is degraded on all platforms and that it is possible to eavesdrop on other client traffic passing over the same virtual network for Open vSwitch and Citrix XenServer. Second, we use a malicious virtual machine to run a rogue DHCP server and then run multiple DHCP attack scenarios. On all four platforms, co-resident VMs can be manipulated by providing them with incorrect or malicious network information.

Mr. Bull is a Computer Science Ph.D. graduate student at Clarkson University focusing on Layer 2 network security in virtualized environments. He presented his preliminary research involving MAC flooding attacks against virtualized networks at the DerbyCon 4.0 computer security conference held in Louisville, KY in September 2014. Mr. Bull earned an A.A.S. degree in Computer Networking at Herkimer College in 2006 and completed both a B.S. and M.S. in Computer Science at the State University of New York Institute of Technology in 2011. He was a founding faculty member of the School of Engineering at SUNY Polytechnic Institute in Utica, NY teaching undergraduate and graduate courses in both the Network and Computer Security and Telecommunications programs, and also served as an advisor to the SUNY Poly Network and Computer Security club. Mr. Bull recently made a transition to Utica College as an Assistant Professor of Computer Science with a focus in networking and cybersecurity. He also co-founded and is one of the primary organizers of the Central New York Intercollegiate Hackathon event which brings together local cybersecurity students from colleges in Central New York to compete against each other in offensive and defensive cybersecurity activities.

Dr. Matthews is an Associate Professor of Computer Science at Clarkson University. Her research interests include virtualization, cloud computing, computer security, computer networks and operating systems. Jeanna received her Ph.D. in Computer Science from the University of California at Berkeley in 1999. She is currently the chair of the ACM Special Interest Group on Operating Systems (SIGOPS), the co-editor of ACM Operating System Review and a member of the Executive Committee of US-ACM, the U.S. Public Policy Committee of ACM. She has written several popular books including ”Running Xen: A Hands-On Guide to the Art of Virtualization” and ”Computer Networking: Internet Protocols In Action".

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Attacking Hypervisors Using Firmware and Hardware

Yuriy Bulygin Advanced Threat Research, Intel Security

Mikhail Gorobets Advanced Threat Research, Intel Security

Alexander Matrosov Advanced Threat Research, Intel Security

Oleksandr Bazhaniuk Advanced Threat Research, Intel Security

Andrew Furtak Security Researcher

In this presentation, we explore the attack surface of modern hypervisors from the perspective of vulnerabilities in system firmware such as BIOS and in hardware emulation. We will demonstrate a number of new attacks on hypervisors based on system firmware vulnerabilities with impacts ranging from VMM DoS to hypervisor privilege escalation to SMM privilege escalation from within the virtual machines.

We will also show how a firmware rootkit based on these vulnerabilities could expose secrets within virtual machines and explain how firmware issues can be used for analysis of hypervisor-protected content such as VMCS structures, EPT tables, host physical addresses (HPA) map, IOMMU page tables etc. To enable further hypervisor security testing, we will also be releasing new modules in the open source CHIPSEC framework to test issues in hypervisors when virtualizing hardware.

Mikhail Gorobets is a security researcher in the Advanced Threat Research team. His area of expertise includes hardware security, virtualization technologies, reverse engineering, and vulnerability analysis. Previously, he led a team of security researchers working on Intel Virtualization Technology (VTx) and Intel Atom core security evaluation.  Mikhail holds a MS in computing machines, systems, and networks from the Moscow Institute of Electronics and Mathematics.

Alexander Matrosov has more than ten years of experience with malware analysis, reverse engineering, and advanced exploitation techniques. He is currently a senior security researcher in the Advanced Threat Research team at Intel Security Group. Prior to this role, he spent four years focused on advanced malware research at ESET. He is co-author of numerous research papers, including “Stuxnet Under the Microscope,” “The Evolution of TDL: Conquering x64,” and "Mind the Gapz: The most complex bootkit ever analyzed?". Alexander is frequently invited to speak at security conferences such as REcon, Ekoparty, Zeronigths, AVAR, CARO, and Virus Bulletin. Nowadays, he specializes in the comprehensive analysis of advanced threats, modern vectors of exploitation, and hardware security research.

Oleksandr Bazhaniuk is a security researcher in the Advanced Threat Research team. His primary interests are low-level hardware security, bios/uefi security, and automation of binary vulnerability analysis. His work has been presented at world-renowned conferences, including Black Hat USA, Hack In The Box, Hackito Ergo Sum, Positive Hack Days, Toorcon, CanSecWest. He is also a co-founder of DCUA, the first DEF CON group in Ukraine.

Andrew Furtak is a security researcher focusing on security analysis of firmware and hardware of modern computing platforms. He was previously a security software engineer. Andrew holds a MS in applied mathematics and physics from the Moscow Institute of Physics and Technology.

Yuriy Bulygin is chief threat researcher at Intel Security Group where he is leading the Advanced Threat Research team in identifying and analyzing new threats impacting modern platforms and researching mitigations in hardware and software against these threats. He joined Intel’s Security Center of Excellence in 2006, where he was responsible for conducting security analysis and penetration testing of microprocessors, chipsets, graphics, and various other components, firmware, and technologies on Intel PCs, servers, and mobile devices. Yuriy is also a member of the core security architecture team reviewing Intel’s future products. Prior to joining Intel, he was teaching undergrad seminars in information security at Moscow Institute of Physics and Technology.

Twitter: @c7zero

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Who Will Rule the Sky? The Coming Drone Policy Wars

Matt Cagle Technology and Civil Liberties Policy Attorney, ACLU of Northern California

Eric Cheng General Manager, DJI SF and Director of Aerial Imaging, DJI

Your private drone opens up limitless possibilities – how can manufacturers and policymakers ensure you are able to realize them? As private drone ownership becomes the norm, drone makers and lawmakers will need to make important policy decisions that account for the privacy and free speech issues raised by this new technology. What legal and technical rules are being considered right now, and how might they affect your ability to do things like record footage at a city park, monitor police at a protest, or fly near a government building? These decisions will dictate the technical limitations (or lack thereof) placed on drones, and the legal consequences of operating them. Join Eric Cheng, General Manager of DJI SF and DJI's Director of Aerial Imaging, and Matt Cagle, a Technology and Civil Liberties Policy Attorney with the ACLU of Northern California, to discuss the policy issues at this leading edge of law and consumer technologies.

Matt Cagle is a Technology and Civil Liberties Policy Attorney at the ACLU of Northern California. At the ACLU-NC, Matt's work focuses on the privacy and free speech issues raised by new services and technologies, including surveillance equipment, social media services, and connected devices. Last fall, Matt co-authored Making Smart Decisions About Surveillance: A Guide for Communities, a paper that provides a framework for communities considering surveillance technology proposals. Matt has worked in private practice advising technology companies on the privacy issues related to new products and services. Matt has substantial experience responding to state and federal law enforcement requests for online user information, and he co-authored reddit's first ever transparency report. Matt regularly speaks at conferences ranging from SXSW to RightsCon, and he served on the privacy committee for Oakland's controversial surveillance complex, the Domain Awareness Center. He grew up in Southern Arizona, studied Latin American history in Guatemala, and holds a JD from Stanford Law School.

Twitter: @matt_cagle

Eric Cheng is an award-winning photographer and publisher, and is the Director of Aerial Imaging and General Manager of the San Francisco office at DJI, the creators of the popular Phantom aerial-imaging quadcopter. Throughout his career, Cheng has straddled passions for photography, entrepreneurship, technology and communication. He publishes Wetpixel.com, the leading underwater-photography community on the web, and writes about his aerial-imaging pursuits at skypixel.org. His work as a photographer has been featured at the Smithsonian's Natural History Museum and in many media outlets including Wired, Outdoor Photographer, Popular Photography, Washington Post, Wall Street Journal, Make, ABC, Good Morning America, CBS, CNN and others. His video work has been shown on the Discovery Channel, National Geographic Channel, and on virtually every news network around the world.

Caught between technical and creative pursuits, Eric holds bachelor's and master's degrees in computer science from Stanford University, where he also studied classical cello performance. He leads regular photography expeditions and workshops around the world, and has given seminars and lectures internationally at events including TEDx, the Churchill Club, Photoshelter Luminance, CES, SXSW, AsiaD, DEMA, and others.

Twitter: @echeng

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Switches Get Stitches

Colin Cassidy Senior Security Consultant at IOActive

Éireann Leverett

Robert M. Lee

This talk will introduce you to Industrial Ethernet Switches and their vulnerabilities. These are switches used in industrial environments, like substations, factories, refineries, ports, or other homes of industrial automation. In other words: DCS, PCS, ICS & SCADA switches.

The researchers focus on attacking the management plane of these switches, because we all know that industrial system protocols lack authentication or cryptographic integrity. Thus, compromising any switch allows the creation of malicious firmwares for further MITM manipulation of a live process. Such MITM manipulation can lead to the plant or process shutting down (think: nuclear reactor SCRAM) or getting into a unknown and hazardous state (think: damaging a blast furnace at a steel mill)

Not only will vulnerabilities be disclosed for the first time, but the methods of finding those vulnerabilities will be shared. All vulnerabilities disclosed will be in the default configuration state of the devices. While these vulnerabilities have been responsibly disclosed to the vendors, SCADA/ICS patching in live environments tends to take 1-3 years. Because of this patching lag, the researchers will also be providing live mitigations that owner/operators can use immediately to protect themselves. At least four vendors switches will be examined: Siemens, GE, Garrettcom and Opengear.

Colin Cassidy is a security consultant for IOActive where he focuses on Industrial Control Systems. He has a strong development and software engineering background. He is also a seasoned leader in the areas of security and software engineering. Before joining IOActive, Cassidy served for a number of years as Technical Manager and Security Technical Lead for IGE Energy Services, Ltd, part of GE Energy. He has hands-on experience with PowerOn Fusion, a leading Outage Management System/Distribution Management System (OMS/DMS) solution for electricity distribution management. He also led a team of developers in producing new functionality within the core product and worked with customers to understand their requirements. Colin Cassidy has a BSc (Hons) in Computing Science from the University of Glasgow.

Twitter: @parttimesecguy

Éireann Leverett hates writing bios in the third person. He once placed second in an Eireann Leverett impersonation contest. He likes teaching the basics, and learning the obscure. He is sometimes jealous of his own moustache for being more famous than he is. If he could sum up his life in one sentence; he wouldn't. That would be a life-sentence! He is primarily known for smashing the myth of the air-gap in industrial systems with his master's thesis, finding authentication bypasses for industrial ethernet switches, and working with incident response teams to improve their understanding of industrial control systems security. He believes security takes an awful lot more than penetration-testing and speaks often about the wider effects of embedded system insecurity.

Twitter: @blackswanburst

Robert M. Lee is a co-founder of Dragos Security LLC where he has a passion for control system protocol analysis, digital forensics, and threat intelligence research. He is also an active-duty U.S. Air Force Cyber Warfare Operations Officer where he has been a member of multiple computer network defense teams including his establishing and leading of a first-of-its-kind ICS/SCADA threat intelligence and intrusion analysis mission. Robert received his BS from the United States Air Force Academy and his MS in Cybersecurity Digital Forensics from Utica College. He is a passionate educator and teaches in the ICS and Forensics programs at SANS and is an Adjunct Lecturer at Utica College where he teaches in their MS Cybersecurity program. Robert is also the author of 'SCADA and Me' and is currently pursuing his PhD at Kings College London with research in control system cyber security. He routinely publishes academic and industry focused works in a wide variety of journals and publications; additionally he has presented at conferences around the world.

Twitter: @RobertMLee

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Cracking Cryptocurrency Brainwallets

Ryan Castellucci Security Researcher, White Ops

Imagine a bank that, by design, made everyone's password hashes and balances public. No two-factor authentication, no backsies on transfers. Welcome to "brainwallets", a way for truly paranoid cryptocurrency users to wager their fortunes on their ability to choose a good password or passphrase.

Over the last decade, we've seen the same story play out dozens of times - a website is broken into, the user database is posted online, and most of the password hashes are cracked. Computers are now able make millions, billions or even trillions of guesses per second. Every eight character password you can type on a standard keyboard and every combination of five common english words could be tried in less than a day by today's botnets. Can people come up with passphrases able to stand up to that when money is on the line? Let's find out.

For this talk, I will be releasing my high speed brainwallet cracker, "Brainflayer". I'll cover a history of brainwallets, safer passphrase-based wallet generation, passphrase security, in-the-wild cracking activity, and how I accidently stole 250 Bitcoins (and tracked down the owner to give them back).

Ryan Castellucci has been interested in cryptography since childhood when his parents gave him a copy of "Codes, Ciphers and Secret Writing". He soon learned to program and wrote a tool to crack simple substitution ciphers. More recently, he co-spoke with Dan Kaminsky at DEF CON 22 and was a finalist in the 2014 Underhanded Crypto Contest. For his day job at White Ops, he finds new and exciting ways to tease out the subtle differences between bots and human-controlled web browsers.

Twitter: @ryancdotorg

Web: https://rya.nc

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Paranoia and ProxyHam: High-Stakes Anonymity on the Internet

Benjamin Caudill Founder, Rhino Security Labs

CANCELLED

From the US to China and beyond, anonymity on the internet is under fire – particularly for whistleblowers. National interests are pushing for greater control and monitoring of internet content, often invoking harsh punishments for informers and journalists, if caught. While a range of technologies (such as ToR) can provide some level of anonymity, a fundamental flaw still exists: a direct relationship between IP address and physical location. If your true IP is ever uncovered, it’s game over – a significant threat when your adversary owns the infrastructure.

To resolve this issue, I present ProxyHam, a hardware device which utilizes both WiFi and the 900Mhz band to act as a hardware proxy, routing local traffic through a far-off wireless network – and significantly increasing the difficulty in identifying the true source of the traffic. In addition to a demonstration of the device itself, full hardware schematics and code will be made freely available.

Benjamin Caudill is founder and Principal Consultant of Rhino Security Labs, an information security consultancy in Seattle, WA. As a security professional, Benjamin has broken and secured environments from mobile startups to government agencies and Fortune 500’s. His security research and exploits have been published in Wired Magazine, CNN, CNET, Forbes and Geekwire, as well as presented at security conferences such as DEF CON 21.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Why nation-state malwares target Telco Networks: Dissecting technical capabilities of Regin and its counterparts

Omer Coskun Ethical Hacker with KPN REDteam, KPN (Royal Dutch Telecom)

The recent research in malware analysis suggests state actors allegedly use cyber espionage campaigns against GSM networks. Analysis of state-sponsored malwares such like Flame, Duqu, Uruborus and the Regin revealed that these were designed to sustain long-term intelligence-gathering operations by remaining under the radar. Antivirus companies made a great job in revealing technical details of the attack campaigns, however, it exclusively has almost focused on the executables or the memory dump of the infected systems - the research hasn't been simulated in a real environment.

GSM networks still use ancient protocols; Signaling System 7 (SS7), GPRS Tunneling Protocol (GTP) and the Stream Control Transmission Protocol (SCTP) which contain loads of vulnerable components. Malware authors totally aware of it and weaponing exploits within their campaigns to grab encrypted and unencrypted streams of private communications handled by the Telecom companies. For instance, Regin was developed as a framework that can be customized with a wide range of different capabilities, one of the most interesting ability to monitor GSM networks.

In this talk, we are going to break down the Regin framework stages from a reverse engineering perspective - kernel driver infection scheme, virtual file system and its encryption scheme, kernel mode manager- while analyzing its behaviors on a GSM network and making technical comparison of its counterparts - such as TDL4, Uruborus, Duqu2.

Omer works as an Ethical Hacker for KPN's (Royal Dutch Telecom) REDteam in Amsterdam, the Netherlands. He enjoys diving into lines of code to spot bugs, tinkering in front of the debugger and developing wise tactics/tools to break applications on his day to day work. Prior to joining KPN REDteam, Omer worked for companies like IBM ISS, Verizon and as an external government contractor. He holds an Honour's Engineering degree in Computer Science.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Bugged Files: Is Your Document Telling on You?

Daniel “unicornFurnace” Crowley Security Consultant, NCC Group

Damon Smith Associate Security Consultant, NCC Group

Certain file formats, like Microsoft Word and PDF, are known to have features that allow for outbound requests to be made when the file opens. Other file formats allow for similar interactions but are not well-known for allowing such functionality. In this talk, we explore various file formats and their ability to make outbound requests, as well as what that means from a security and privacy perspective. Most interestingly, these techniques are not built on mistakes, but intentional design decisions, meaning that they will not be fixed as bugs. From data loss prevention to de-anonymization to request forgery to NTLM credential capture, this presentation will explore what it means to have files that communicate to various endpoints when opened.

Daniel (aka "unicornFurnace") is a Security Consultant for NCC Group. Daniel denies all allegations regarding unicorn smuggling and questions your character for even suggesting it. Daniel has developed configurable testbeds such as SQLol and XMLmao for training and research regarding specific vulnerabilities. Daniel enjoys climbing large rocks. Daniel has been working in the information security industry since 2004 and is a frequent speaker at conferences including Black Hat, DEF CON, Shmoocon, and SOURCE. Daniel does his own charcuterie. Daniel also holds the title of Baron in the micronation of Sealand.

Damon Smith is an Associate Security Engineer with NCC Group, an information security firm specializing in application, network, and mobile security. Damon specializes in web application assessments, embedded device/point of sale assessments, network penetration testing, and mobile testing. Damon graduated with a BS is Computer Science from the University of Texas, with a focus on Information Security. He has experience working as an IT consultant in the legal and retail industries and further as a security consultant focusing on application assessments.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Do Export Controls on “Intrusion Software” Threaten Vulnerability Research?

Tom Cross aka Decius CTO, Drawbridge Networks

Collin Anderson Independent Researcher

At the end of 2013, an international export control regime known as the Wassenaar Arrangement was updated to include controls on technology related to “Intrusion Software" and “IP Network Surveillance Systems." Earlier this year, the US Government announced a draft interpretation of these new controls, which has kicked off a firestorm of controversy within the information security community. Questions abound regarding what the exact scope of the proposed rules is, and what impact the rules might have on security researchers. Is it now illegal to share exploit code across borders, or to disclose a vulnerability to a software vendor in another country? Can export controls really keep surveillance technology developed in the west out of the hands of repressive regimes? This presentation will provide a deep dive on the text of the new controls and discuss what they are meant to cover, how the US Government has indicated that it may interpret them, and what those interpretations potentially mean for computer security researchers, and for the Internet as a whole.

Tom Cross is the CTO of Drawbridge Networks. He is credited with discovering a number of critical security vulnerabilities in enterprise class software and has written papers on collateral damage in cyber conflict, vulnerability disclosure ethics, security issues in internet routers, encrypting open wireless networks, and protecting Wikipedia from vandalism. Tom was previously Director of Security Research at Lancope, and Manager of the IBM Internet Security Systems X-Force Advanced Research team. He has spoken at numerous security conferences, including DEF CON, Blackhat Briefings, CyCon, HOPE, Source Boston, FIRST, and Security B-Sides.

Twitter: @_decius_

Collin Anderson is a Washington D.C.-based researcher focused on measurement and control of the Internet, including network ownership and access restrictions, with an emphasis on countries that restrict the free flow of information. Through open research and cross-organizational collaboration, these efforts have included monitoring the international sale of surveillance equipment, identifying consumer harm in disputes between core network operators, exploring alternative means of communications that bypass normal channels of control, and applying big data to shed new light on increasingly sophisticated restrictions by repressive governments. These involvements extend into the role of public policy toward promoting online expression and accountability, including regulation of the sale of surveillance technologies and reduction of online barriers to the public of countries under sanctions restrictions.

Twitter: @cda

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

REvisiting RE:DoS

Eric (XlogicX) Davisson Not a security researcher

Regular Expression Denial of Service has existed for well over a decade, but has not received the love it deserves lately. There are some proof of concept attacks out there currently, most of which are ineffective due to implementation optimizations. Regardless of the effectiveness most of these PoC's are geared only to NFA engines.

This talk will demonstrate working PoC's that bypass optimizations. Both NFA and DFA engines will get love. Tools will be released (with demonstration) that benchmark NFA/DFA engines and automate creation of 'evil strings' given an arbitrary regular expression. Attendees can expect a review of regex and a deep under the hood explanation of both regex engines before abuses ensue.

^ Not a security researcher

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Licensed to Pwn: The Weaponization and Regulation of Security Research

Jim Denaro

Dave Aitel

Matt Blaze

Nate Cardozo

Mara Tam

Special Guest – TBA

Security research is under attack. Updates to the Wassenaar Arrangement in 2013 established among its 41 member nations an agreement to place a variety of previously undesignated “cybersecurity items” under export control. After 18 months and a half-dozen open advisory meetings, the U.S. has taken the entire security research community by surprise with its proposed rule; we are confronted by a sweeping implementation with profound consequences for academia, independent research, commercial cybersecurity, human rights, and national security.

While the outcome of this round of regulatory intervention is still uncertain, the fact that there will be more is not. This panel of experts will discuss the context, history, and general process of regulation, as well the related question of “weaponized” research in regulatory discourse.

There is significant daylight between the relatively lax text of the Wassenaar Arrangement itself and the extraordinarily broad implementation proposed in the U.S. What will the practical effects of those differences be, and why did the U.S. diverge from the Wassenaar text? Regulators are, even now, still struggling to comprehend what the consequences of this new “cyber rule” might be. So, how are we to understand this regulatory process? What are its objectives? Its impacts? Its limits? How can we influence its outcomes?

Eleventh-hour interventions are quickly becoming a hallmark of regulatory activities with implications for the wider world of information security; the fight here is almost exclusively a rearguard action. Without resorting to the usual polemics, what failures of analysis and advice are contributing to these missteps – on both sides? What interests might encourage them? How are security researchers being caught so off-balance? Come victory or despair in the present case, this panel aims to answer the question of whether there is a solution that prevents technology transfer to hostile nations while still enabling free markets, freedom of expression, and freedom of research.

Dave Aitel (@daveaitel) is an offensive security expert whose company, Immunity, Inc., consults for major financial institutions, Fortune/Global 500s, etc. At the age of 18, he was recruited by the National Security Agency where he served six years as a “security scientist” at the agency’s headquarters at Fort Meade, Maryland. He then served as a security consultant for @stake before founding Immunity in 2002. Today, Dave’s firm is hired by major companies to try to hack their computer networks - in order to find and fix vulnerabilities that criminal hackers, organized crime and nation-state adversaries could use. Immunity is also a past contractor on DARPA’s cyber weapons project, known as Cyber Fast Track. The company is well-known for developing several advanced hacking tools used by the security industry, such as Swarm, Canvas, Silica, Stalker, Accomplice, Spike, Spike Proxy, Unmask - and, most recently Innuendo, the first US-made nation-grade cyber implant with Flame/Stuxnet-like malware capabilities. Immunity has offices in Florida, D.C., Canada, Italy and Argentina. eWeek Magazine named Dave one of “The 15 Most Influential People in Security.” He is a past keynote speaker at BlackHat and DEF CON. He is a co-author of “The Hacker’s Handbook,” The Shellcoder’s Handbook” and “Beginning Python.” He is also the founder of the prestigious Infiltrate offensive security conference (Businessweek article) and the widely read “Daily Dave Mailing List,” which covers the latest cybersecurity news, research and exploit developments.

Twitter: @daveaitel

Matt Blaze (@mattblaze) is a professor in the computer science department at the University of Pennsylvania. From 1992 until he joined Penn in 2004, he was a research scientist at AT&T Bell Laboratories. His research focuses on the architecture and design of secure systems based on cryptographic techniques, analysis of secure systems against practical attack models, and on finding new cryptographic primitives and techniques. In 1994, he discovered a serious flaw in the US Government's "Clipper" encryption system, which had been proposed as a mechanism for the public to encrypt their data in a way that would still allow access by law enforcement. He has testified before various committees of the US Congress and European Parliament several times, providing technical perspective on the problems surrounding law enforcement and intelligence access to communications traffic and computer data. He is especially interested in the use of encryption to protect insecure systems such as the Internet. Recently, he has applied cryptologic techniques to other areas, including the analysis of physical security systems; this work yielded a powerful and practical attack against virtually all commonly used master-keyed mechanical locks.

Twitter: @mattblaze

Nate Cardozo (@ncardozo) is a Staff Attorney with the Electronic Frontier Foundation. He focuses on the intersection of technology, privacy, and free expression. He has defended the rights of anonymous bloggers, sued the United States government for access to improperly classified documents, and lobbied Congress for sensible reform of American surveillance laws. In addition, he works on EFF's Coders’ Rights Project, counseling hackers, academics, and security professionals at all stages of their research. Additionally, Nate manages EFF’s Who Has Your Back? report, which evaluates service providers' protection of user data. Nate has projects involving automotive privacy, speech in schools, government transparency, hardware hacking rights, anonymous speech, public records litigation, and resisting the expansion of the surveillance state. Nate has a B.A. in Anthropology and Politics from the University of California, Santa Cruz and a J.D. from the University of California, Hastings where he has taught legal writing and moot court.

Twitter: @ncardozo

Jim Denaro (@CipherLaw; moderator) is the founder of CipherLaw, a Washington, D.C.-based intellectual property law firm and focuses his practice on legal and technical issues faced by innovators in information security. He is a frequent speaker and writer on the subject and works in a wide range of technologies, including cryptography, intrusion detection, botnet investigation, and incident response. Jim advises clients on legal issues of particular concern to the information security community, including active defense technologies, government-mandated access (backdoors), export control, exploit development and sales, bug bounty programs, and confidential vulnerability disclosure (Disclosure as a Service). He has a degree in computer engineering and has completed various professional and technical certifications in information security and is engaged in graduate studies in national security at Georgetown University. Before becoming an attorney, Jim spent obscene amounts of time looking at PPC assembly in MacsBug.

Twitter: @CipherLaw

Mara Tam (@marasawr) is a semi-feral researcher and historian of policy, justice, culture, and security. She has authored, co-authored, and contributed research for technical policy papers in the fields of international security and arms control. After earning a first class degree in art history, Mara’s work supported bilateral negotiations towards peaceful nuclear cooperation between the United States and India. She has been a participant, speaker, and panellist for academic conferences in cultural studies, languages, and history, as well as for strategic programmes like ‘The Intangibles of Security’ initiative convened by NATO and the European Science Foundation. She is currently a doctoral candidate and freelance thinkfluencer.

Twitter: @marasawr

Special Guest – TBA

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Dark side of the ELF - leveraging dynamic loading to pwn noobs

Alessandro Di Federico PhD Student, Politecnico di Milano

Yan Shoshitaishvili PhD Student, UC Santa Barbara

The ELF format is ancient, and much mystery lurks in its dark depths. For 16 years, it has safely encompassed our software, providing support for binary loading, symbol resolution, and lots of very useful binary stuff. In that time, security has become a key concern, resulting in binary defenses like NX and ASLR, which have made exploiting vulnerabilities quite difficult. ASLR, for example, randomizes the location of the stack, the heap, libraries, and (optionally), the binary itself at every execution of an application.

There is no easy way to say this: ELF has let us down. In this talk, we'll explore the dark side of ELF. Specifically, we'll show how ELF, by design, implicitly trusts data structures in the ELF headers. Even in the presence of ASLR, an attacker able to corrupt these headers can trick the ELF loader into calling any function in any linked-in library, providing nothing but the name of the binary. In essence, this technique allows an attacker to call arbitrary library functions (such as system()!) without leaking memory addresses. We call this technique Leakless.

While developing Leakless, we checked many different implementations of the standard C library and found that Leakless can be adapted to attack the ELF loader implementations in all of the common ones (i.e., GNU libc, the libc of the major BSDs, and uClibc). In this talk, we'll describe the internals of the ELF format, show how Leakless works to subvert library function resolution, and demonstrate how it can be use to carry out attacks without information disclosures. And, of course, we'll open-source the tool that we developed to make carrying out this attack easier.

Alessandro is a PhD student at Politecnico Di Milano, right under that leaning tower. In his spare time, he hacks with Tower of Hanoi. He likes exploitation and doing really crazy stuff, on and off the computer!

Hacking since the age of eight, Yan Shoshitaishvili is fascinated by understanding and commandeering the computation and actions carried out by binary code. He is currently pursuing his PhD in the Seclab at UC Santa Barbara and is one of the hacking aces behind team Shellphish. In the little spare time he has left, he develops and releases computer security tools on the Internet.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Fighting Back in the War on General Purpose Computers

Cory Doctorow Author & Activist, Electronic Frontier Foundation

EFF's Apollo 1201 project is a 10-year mission to abolish all DRM, everywhere in the world, within a decade. We're working with security researchers to challenge the viability of the dread DMCA, a law that threatens you with jail time and fines when you do your job: discover and disclosing defects in systems that we rely on for life and limb.

Cory Doctorow (craphound.com) is a science fiction author, activist, journalist and blogger — the co-editor of Boing Boing (boingboing.net) and the author of the YA graphic novel IN REAL LIFE, the nonfiction business book INFORMATION DOESN’T WANT TO BE FREE< and young adult novels like HOMELAND, PIRATE CINEMA and LITTLE BROTHER and novels for adults like RAPTURE OF THE NERDS and MAKERS. He works for the Electronic Frontier Foundation and co-founded the UK Open Rights Group. Born in Toronto, Canada, he now lives in London.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

REpsych: Psychological Warfare in Reverse Engineering

Chris Domas Security Researcher

Your precious 0-day? That meticulously crafted exploit? The perfect foothold? At some point, they'll be captured, dissected, and put on display. Reverse engineers. When they begin snooping through your hard work, it pays to have planned out your defense ahead of time. You can take the traditional defensive route - encryption, obfuscation, anti-debugging - or you can go on the offense, and attack the heart and soul of anyone who dare look at your perfect code. With some carefully crafted assembly, we'll show how to break down a reverse engineer by sending them misleading, intimidating, and demoralizing messages through the control flow graphs of their favorite RE tools - turning their beloved IDA (Hopper, BinNavi, Radare, etc) into unwitting weapons for devastating psychological warfare in reverse engineering.

Chris is an embedded systems engineer and cyber security researcher, focused on innovative approaches to low level hardware and software RE and exploitation.

Twitter: @xoreaxeaxeax

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

USB Attack to Decrypt Wi-Fi Communications

Jeremy Dorrough Senior Network Security Architect / Genworth Financial

The term “Bad USB” has gotten some much needed press in last few months. There have been talks that have identified the risks that are caused by the inherent trust between the OS and any device attached by USB. I found in my research that most of the available payloads for the USB rubber ducky would be stopped by common enterprise security solutions. I then set out to create a new exploit that would force the victim to trust my Man-In-The-Middle access point. After my payload is deployed, all Wi-Fi communications will be readable, including usernames, passwords and authentication cookies. The attack will work without the need of elevating privileges, which makes it ideal for corporate environments.

Jeremy has built his career around protecting assets in the most critical IT sectors. He started his career working in a Network Operations Security Center for the US Army. He then went on to work as a Network Security Engineer defending Dominion’s North Anna Nuclear Power Station. He is currently a Senior Network Security Engineer/Architect at Genworth Financial. He is a MBA, CISSP, CEH, GIAC GPPA, CSA CCSK, ABCDEFG… Blah Blah Blah. Jeremy has spent over 10 years researching and implementing new ways to defend against the latest attacks. He enjoys creating new exploits and feels it makes him a more well-rounded defensive Security Engineer. He is happily married and a father to two soon to be hackers. When he’s not staring at a command prompt, he is busy building and driving demolition derby cars.

Twitter: @jdorrough1

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

BurpKit - Using WebKit to Own the Web

Nadeem Douba Founding Principal, Red Canari

Today's web apps are developed using a mashup of client- and server-side technologies. Everything from sophisticated Javascript libraries to third-party web services are thrown into the mix. Over the years, we've been asked to test these web apps with security tools that haven't evolved at the same pace. A common short-coming in most of these tools is their inability to perform dynamic analysis to identify vulnerabilities such as dynamically rendered XSS or DOM-based XSS. This is where BurpKit comes in - a BurpSuite plugin that integrates the power of WebKit with that of BurpSuite. In this presentation we'll go over how one can leverage WebKit to write their own web pen-testing tools and introduce BurpKit. We'll show you how BurpKit is able to perform a variety of powerful tasks including dynamic analysis, BurpSuite scripting, and more! Best of all, the plugin will be free and open source so you can extended it to your heart's desire!

Nadeem Douba is the founding principal of Red Canari, an information security consulting firm that specializes in the areas of technical security assessments. With over 15 years experience, Nadeem provides consulting and training services for organizations within the public and private sector. He has also presented at some of the world's largest security conferences and is the author of many well-known open source security tools, including PyMiProxy (used by the Internet Archive), Sploitego, and the Canari Framework (previously presented at DEF CON 20). His primary research interests include open source intelligence, application and operating system security, and big data.

Twitter: @ndouba

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Stagefright: Scary Code in the Heart of Android

Joshua J. Drake Sr. Director of Platform Research and Exploitation, Zimperium

With over a billion activated devices, Android holds strong as the market leading smartphone operating system. Underneath the hood, it is primarily built on the tens of gigabytes of source code from the Android Open Source Project (AOSP). Thoroughly reviewing a code base of this size is arduous at best -- arguably impossible. Several approaches exist to combat this problem. One such approach is identifying and focusing on a particularly dangerous area of code.

This presentation centers around the speaker's experience researching a particularly scary area of Android, the Stagefright multimedia framework. By limiting his focus to a relatively small area of code that's critically exposed on 95% of devices, Joshua discovered a multitude of implementation issues with impacts ranging from unassisted remote code execution down to simple denial of service. Apart from a full explanation of these vulnerabilities, this presentation also discusses; techniques used for discovery, Android OS internals, and the disclosure process. Finally, proof-of-concept code will be demonstrated.

After attending this presentation, you will understand how to discover vulnerabilities in Android more effectively. Joshua will show you why this particular code is so scary, what has been done to help improve the overall security of the Android operating system, and what challenges lie ahead.

Joshua J. Drake is the Sr. Director of Platform Research and Exploitation at Zimperium and lead author of the Android Hacker's Handbook. Joshua focuses on original research such as reverse engineering and the analysis, discovery, and exploitation of security vulnerabilities. He has over 10 years of experience auditing and exploiting a wide range of application and operating system software with a focus on Android since early 2012. In prior roles, he served at Metasploit and VeriSign’s iDefense Labs. Joshua previously spoke at BlackHat, RSA, CanSecWest, REcon, Ruxcon/Breakpoint, Toorcon, and DerbyCon. Other notable accomplishments include exploiting Oracle's JVM for a win at Pwn2Own 2013, successfully compromising the Android browser via NFC with Georg Wicherski at BlackHat USA 2012, and winning the DEF CON 18 CTF with the ACME Pharm team in 2010.

Twitter: @jduck

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Medical Devices: Pwnage and Honeypots

Scott Erven Associate Director, Protiviti

Mark Collao Security Consultant, Protiviti

We know medical devices are exposed to the Internet both directly and indirectly, so just how hard is it to take it to the next step in an attack and gain remote administrative access to these critical life saving devices?  We will discuss over 20 CVEís Scott has reported over the last year that will demonstrate how an attacker can gain remote administrative access to medical devices and supporting systems. Over 100 remote service and support credentials for medical devices will be presented.

So is an attack against medical devices a reality or just a myth?  Now that we know these devices have Internet facing exposure and are vulnerable to exploit, are they being targeted?  We will release and present six months of medical device honeypot research showing the implications of these patient care devices increasing their connectivity.

Scott Erven is an Associate Director at Protiviti.  He has over 15 years of information security and information technology experience with subject matter expertise in medical device and healthcare security.  Scott has consulted with the Department of Homeland Security, Food and Drug Administration and advised national policymakers.  His research on medical device security has been featured in Wired and numerous media outlets worldwide.  Mr. Erven has presented his research and expertise in the field internationally.   Scott also has served as a subject matter expert and exam writer for numerous industry certifications.  His current focus is on research that affects human life and public safety issues inside todayís healthcare landscape.

Mark Collao is a Security Consultant at Protiviti. He has over 5 years of experience in information security consulting, primarily in network and application penetration tests, red team assessments, and social engineering exercises. Mark also researches botnet activity and maintains several custom protocol and application honeypots on the net. He holds an Offensive Security Certified Professional (OSCP) certification, is a member of the MWCCDC red team, and graduated from DePaul University.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

NSA Playset: JTAG Implants

Joe FitzPatrick SecuringHardware.com

Matt King Security Researcher

While the NSA ANT team has been busy building the next generation spy toy catalog for the next leak, the NSA Playset team has been busy catching up with more open hardware implementations. GODSURGE is a bit of software that helps to persist malware into a system. It runs on the FLUXBABBIT hardware implant that connects to the depopulated JTAG header of certain models of Dell servers.

This talk will introduce SAVIORBURST, our own implementation of a jtag-based malware delivery firmware that will work hand-in-hand with SOLDERPEEK, our custom hardware design for a standalone JTAG attack device. We will demonstrate how to this pair enables the persistent compromise of an implanted system as well as release all the hardware and software necessary to port SAVIORBURST and SOLDERPEEK to your jtag-equipped target of choice. Anyone curious to know more about JTAG, regardless of previous hardware experience, will learn something from this talk.

Joe has spent a decade working on low-level silicon debug, security validation, and penetration testing of CPUS, SOCs, and microcontrollers. He develops and delivers hardware security training at https://SecuringHardware.com, including Software Exploitation via Hardware Exploits and Applied Physical Attacks on x86 Systems. In between, he keeps busy with contributions to the NSA Playset and other misdirected hardware projects.

Twitter: @securelyfitz

Matt is a hardware designer and security researcher who has over a decade of experience designing, securing and exploiting hardware test and debug features on CPUs and SoCs. When not performing pointless hardware tricks Matt tries to help educate integrated circuit designers on the risks posed by hardware debug capabilities.

Twitter: @syncsrc

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Unbootable: Exploiting the PayLock SmartBoot Vehicle Immobilizer

fluxist Hacker, Entrepreneur

CANCELLED

Many of us have seen the big yellow "boot" on the wheel of a parked car, marking like a scarlet letter some poor sap who hasn't paid his parking tickets. Since 2005 many US municipalities have switched from a manual boot to the PayLock SmartBoot. With just a phone call and a credit card you can pay your fines and extortionate fees and fill the county coffers -- and in return they'll give you the secret code to type in and unlock the electronic vehicle immobilizer. But what if there were another way to remove the boot, quicker than a phone call and a credit card payment? Join me in a thorough reverse engineering of the PayLock SmartBoot as we disassemble one, recover and analyze the firmware from the embedded controller, and find the secrets to thoroughly pwn the device. This talk will reveal a backdoor that can be used to disarm every SmartBoot in over 50 municipalities.

fluxist is an independent security researcher; Director - Special Projects at Dulotech Inc; and Owner of Cloud99 Vapes, a NY-based chain of retail vape shops. He is not available for comment.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hooked Browser Meshed-Networks with WebRTC and BeEF

Christian (@xntrik) Frichot Principal Security Consultant at Asterisk Information Security

One of the biggest issues with BeEF is that each hooked browser has to talk to your BeEF server. To try and avoid detection, you often want to try and obfuscate or hide your browsers, particularly if you're heavily targeting a single organization. Don’t worry Internet-friends, those crazy pioneers at Google, Mozilla and Opera have solved this problem for you with the introduction of Web Real-Time Communications (WebRTC). Initially designed to allow browsers to stream multimedia to each other, the spec has made its way into most Chrome and Firefox browsers, not to mention it’s enabled by default.

Using this bleeding-edge web technology, we can now mesh all those hooked browsers, funnelling all your BeEF comms through a single sacrificial beach-head. Leveraging WebRTC technologies (such as STUN/TURN and even the fact the RTC-enabled browsers on local subnets can simply UDP each other), meshing browsers together can really throw a spanner into an incident-responders work. The possibilities for a browser-attacker are fairly endless, channeling comms through a single browser, or, making all the browsers communicate with each other in round-robin. This is just another tool tucked into your belt to try and initiate and maintain control over browsers.

This presentation will present a background into WebRTC, and then demonstrate the WebRTC BeEF extension. (Bloody JavaScript...)

Christian is an Australian security professional and founder of Asterisk Information Security based in Perth. He is one of the co-authors of the recently published Browser Hacker’s Handbook (by Wiley), and long-term code-funkerer of the BeEF project. When not performing application security or penetration testing gigs, Christian spends his time either ranting about appsec or pining to get behind his drumkit. He has a deep love/hate relationship with web browsers and JavaScript. Christian has presented at numerous Australian security conferences, including OWASP AppSec APAC, the Australian Information Security Association's Perth Con, ISACA's Perth Con, OWASP Melbourne, and Ruxmon. In addition, Christian was fortunate to present at Kiwicon 8 in New Zealand at the end of 2014. s that Christian has been involved with include BeEF, OWASP's SAMM Self Assessment Tool, Prenus (the pretty Nessus thing), Burpdot (graphing connectivity between URLs from Burp), and the Devise Google Authenticator extension.

Christian has been blogging on un-excogitate.org and labs.asteriskinfosec.com.aufor ages now, and is often found on twitter (@xntrik) raging about various security topics.

Twitter: @xntrik

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Abusing Adobe Reader’s JavaScript APIs

Brian Gorenc Manager, HP’s Zero Day Initiative

Abdul-Aziz Hariri Security Researcher, HP’s Zero Day Initiative

Jasiel Spelman Security Researcher, HP’s Zero Day Initiative

Adobe Reader’s JavaScript APIs offer a rich set of functionality for document authors. These APIs allow for processing forms, controlling multimedia events, and communicating with databases, all of which provide end-users the ability to create complex documents. This complexity provides a perfect avenue for attackers to take advantage of weaknesses that exist in Reader’s JavaScript APIs.

In this talk, we will provide insight into both the documented and undocumented APIs available in Adobe Reader. Several code auditing techniques will be shared to aid in vulnerability discovery, along with numerous proofs-of-concept which highlight real-world examples. We’ll detail out how to chain several unique issues to obtain execution in a privileged context. Finally, we’ll describe how to construct an exploit that achieves remote code execution without the need for memory corruption.

Brian Gorenc is the manager of Vulnerability Research with Hewlett-Packard Security Research (HPSR). In this role, Gorenc leads the Zero Day Initiative (ZDI) program, which is the world’s largest vendor-agnostic bug bounty program. His focus includes analyzing and performing root-cause analysis on hundreds of zero-day vulnerabilities submitted by ZDI researchers from around the world. The ZDI works to expose and remediate weaknesses in the world’s most popular software. Brian is also responsible for organizing the ever-popular Pwn2Own hacking competitions.

Prior to joining HP, Gorenc worked for Lockheed Martin on the F-35 Joint Strike Fighter (JSF) program. In this role, he led the development effort on the Information Assurance (IA) products in the JSF’s mission planning environment.

Twitter: @maliciousinput

Abdul-Aziz Hariri is a security researcher with Hewlett-Packard Security Research (HPSR). In this role, Hariri analyzes and performs root-cause analysis on hundreds of vulnerabilities submitted to the Zero Day Initiative (ZDI) program, which is the world's largest vendor-agnostic bug bounty program. His focus includes performing root-cause analysis, fuzzing and exploit development.

Prior to joining HP, Hariri worked as an independent security researcher and threat analyst for Morgan Stanley emergency response team. During his time as an independent researcher, he was profiled by Wired magazine in their 2012 article, “Portrait of a Full-Time Bug Hunter”.

Twitter: @abdhariri

Jasiel Spelman is a vulnerability analyst and exploit developer for the Zero Day Initiative (ZDI) program. His primary role involves performing root cause analysis on ZDI submissions to determine exploitability, followed by developing exploits for accepted cases. Prior to being part of ZDI, Jasiel was a member of the Digital Vaccine team where he wrote exploits for ZDI submissions, and helped develop the ReputationDV service from TippingPoint. Jasiel's focus started off in the networking world but then shifted to development until transitioning to security. He has a BA in Computer Science from the University of Texas at Austin.

Twitter: @wanderingglitch

HP’s Zero Day Initiative, Twitter: @thezdi

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

WhyMI so Sexy? WMI Attacks, Real-Time Defense, and Advanced Forensic Analysis

Matt Graeber Reverse Engineer, FireEye Inc.

Willi Ballenthin Reverse Engineer, FireEye Inc.

Claudiu Teodorescu Reverse Engineer, FireEye Inc.

Windows Management Instrumentation (WMI) is a remote management framework that enables the collection of host information, execution of code, and provides an eventing system that can respond to operating system events in real time. FireEye has recently seen a surge in attacker use of WMI to carry out objectives such as system reconnaissance, remote code execution, persistence, lateral movement, covert data storage, and VM detection. Defenders and forensic analysts have largely remained unaware of the value of WMI due to its relative obscurity and completely undocumented file format. After extensive reverse engineering, our team has documented the WMI repository file format in detail, developed libraries to parse it, and formed a methodology for finding evil in the repository.

In this talk, we will take a deep dive into the architecture of WMI, reveal a case study in attacker use of WMI in the wild, describe WMI attack mitigation strategies, show how to mine its repository for forensic artifacts, and demonstrate how to detect attacker activity in real-time by tapping into the WMI eventing system. By the end of this talk, we will have convinced the audience that WMI is a valuable asset not just for system administrators and attackers, but equally so for defenders and forensic analysts.

Matt Graeber is a reverse engineer in the FireEye Labs Advanced Reverse Engineering (FLARE) team with a varied background in reverse engineering, red teaming, and offensive tool development. Since joining FireEye, Matt has reversed a vast quantity of targeted and commodity malware samples and served as an instructor of Mandiant's Advanced Malware Analysis course. Matt is the author of various PowerShell modules used for pentesting and reverse engineering including PowerSploit and PowerShellArsenal. He has also been designated a Microsoft "Most Valuable Professional" in PowerShell.

Twitter: @mattifestation

Willi Ballenthin is a reverse engineer in the FLARE team who specializes in incident response and computer forensics. He can typically be found investigating intrusions at Fortune 500 companies and enjoys reverse engineering malware, developing forensic techniques, and exploring the cutting edge. Willi is the author of a number of cross-platform Python libraries including python-registry, python-evtx, and INDXParse.py.

Twitter: @williballenthin

Claudiu Teodorescu is a reverse engineer in the FLARE team. Prior to joining FireEye, Claudiu worked for Guidance Software, writing forensic parsers for different file formats to support the EnCase forensic tool. Also, as the Cryptographic Officer of the company, he supported EnCase integration with different disk/volume/file based encryption products including Bitlocker, McAfee EEPC, Checkpoint FDE, Symantec EEPC, etc.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

HamSammich – long distance proxying over radio

Robert Graham Erratasec.com

David Maynor Erratasec.com

The ProxyHam talk was mysteriously canceled. However, it’s easy to replicate the talk from the press coverage. In this talk, we propose “HamSammich”, creating a point-to-point link in order to access WiFi from many miles away, as a means to avoid detection. We show how off-the-shelf devices can be configured to do this for less than $200. After demonstrating the working system, we’ll talk about radio signals. This includes both the FCC regulatory issues which may have caused the cancelation of the original talk, as well as signals-intelligence, and the practicalities of being detected and caught. Finally, we’ll talk about hiding signals with SDR, a more complicated and expensive technique, but one that hides better in the electromagnetic spectrum.

We’ll demonstrate not only a working system, but what the 900MHz spectrum looks like, and how to track down a working system.

Robert Graham is the CEO of Errata Security, a pentest/consulting firm. He's known for creating the first IPS, the BlackICE series of products, sidejacking, and masscan. In his spare time, he scans the Internet. He has been speaking at several conferences a year for the past decade.

Twitter: @ErrataRob

David Maynor is the CTO of Errata Security, and chief pentester. He’s a frequent speaker at conferences, most infamously in the Apple WiFi scandal. In his spare time, he builds weapons for Skynet’s domination of the planet.

Twitter: @Dave_Maynor

-  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Goodbye Memory Scraping Malware: Hold Out Till "Chip And Pin”

Weston Hecker SR Pentester, Sr Systems Security Analyst at "KLJ Security”

Proof of concept for stopping credit card theft in memory skimming operations . Alternative methods of stopping credit card skimming

I am leading project on Free Open Source software that attacks POS skimming malware. Launching platform and concept for stores to not be low hanging fruit In effect making it no longer possible to sell credit card numbers from skim breaches. Better collection of forensic data with cannery features (such as putting flagged card into memory so if it is skimmed it will be flagged at processor and catch the breaches much faster)Injects 1-500 false random CC numbers for every one legitimate CC number that is entered. In effect making stolen credit card batches harder to sell. I will go in detail of how criminals Steal and sell credit cards at this time. This is a software for making credit cards numbers harder to steal in the methods that have been happening in larger breaches Target, Home Depot.

10 Years Pen-testing, 11 years security research and programming experience. Working for a security Company in the Midwest, Weston has recently Spoken at DEF CON 22 and over 40 other speaking engagements from telecom regional events to Universitys on security subject matter. Working with A major University's research project with Department of Homeland Security on 911 emergency systems and attack mitigation. Attended school in Minneapolis Minnesota. Computer Science and Geophysics. Co-Author of "SkimBad" Anti-malware framework Found several vulnerability's in very popular software and firmware. Including Microsoft, Qualcomm, Samsung, HTC, Verizon.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Low-cost GPS simulator – GPS spoofing by SDR

Lin Huang Senior wireless security researcher, Qihoo 360 Technology Co. Ltd.

Qing Yang Team Leader of Unicorn Team, Qihoo 360 Technology Co. Ltd.

It is known that GPS L1 signal is unencrypted so that someone can produce or replay the fake GPS signal to make GPS receivers get wrong positioning results. There are many companies provide commercial GPS emulators, which can be used for the GPS spoofing, but the commercial emulators are quite expensive, or at least not free. Now we found by integrating some open source projects related to GPS we can produce GPS signal through SDR tools, e.g. USRP / bladeRF. This makes the attack cost very low. It may influence all the civilian use GPS chipset. In this presentation, the basic GPS system principle, signal structure, mathematical models of pseudo-range and Doppler effect will be introduced. The useful open source projects on Internet will be shared with attendees.

HUANG Lin is a wireless security researcher, from Unicorn Team of Qihoo 360 China. Before entering Qihoo, she worked for telecom operator Orange, for 9 years, as a wireless researcher. Her interests include the security issues in wireless communication, especially the cellular network security, and also other problems in ADS-B, GPS, Bluetooth, Wifi, and automotive electronics.

Twitter: @huanglin_bupt

She is one of the earliest users of USRP in China, and keeps active in SDR/USRP research and development since 2006. She contributed to several UMTS/LTE soft base station projects, e.g. Open Air Interface. In 2009, She wrote one free e-book for GNU Radio training, which is very popular in China.

YANG Qing is the team leader of Unicorn Team in Qihoo 360 Technology Co. Ltd. He has rich experiences in wireless and hardware security area, including WiFi penetration testing, cellular network interception, IC card cracking etc. His interests also cover embedded system hacking, firmware reversing, automotive security, and software radio.

He is the first one who reported the vulnerabilities of WiFi system and RF IC card system used in Beijing subway.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

I want these * bugs off my * Internet

Dan Kaminsky Chief Scientist, White Ops

Are you interested in the gory details in fixing ugly bugs? No? Just like watching stuff blow up? Go to some other talk! But if you want to see what it takes to comprehensively end an entire bug class -- how you dive into a code base, what performance and usability and maintainability and debuggability constraints it takes to make a web browser more secure -- oh do I have some dirt for you.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Drive It Like You Hacked It: New Attacks and Tools to Wirelessly Steal Cars

Samy Kamkar

Gary Numan said it best. Cars. They’re everywhere. You can hardly drive down a busy freeway without seeing one. But what about their security?

In this talk I’ll reveal new research and real attacks in the area of wirelessly controlled gates, garages, and cars. Many cars are now controlled from mobile devices over GSM, while even more can be unlocked and ignitions started from wireless keyfobs over RF. All of these are subject to attack with low-cost tools (such as RTL-SDR, GNU Radio, HackRF, Arduino, and even a Mattel toy).

We will investigate how these features work, and of course, how they can be exploited. I will be releasing new tools and vulnerabilities in this area, such as key-space reduction attacks on fixed-codes, advanced "code grabbers" using RF attacks on encrypted and rolling codes, and how to protect yourself against such issues.

By the end of this talk you’ll understand not only how vehicles and the wirelessly-controlled physical access protecting them can be exploited, but also learn about various tools for car and RF research, as well as how to use and build your own inexpensive devices for such investigation.

Ladies and gentlemen, start your engines. And other people’s engines.

Samy Kamkar is a security researcher, best known for creating The MySpace Worm, one of the fastest spreading viruses of all time. He (attempts to) illustrate terrifying vulnerabilities with playfulness, and his exploits have been branded:

“Controversial”, -The Wall Street Journal

“Horrific”, -The New York Times

“Now I want to fill my USB ports up with cement”, -Gizmodo

He’s demonstrated usurping typical hardware for surreptitious means such as with KeySweeper, turning a standard USB wall charger into a covert, wireless keyboard sniffer, and SkyJack, a custom drone which takes over any other nearby drones allowing them to be controlled as a massive zombie swarm. He’s exposed issues around privacy, such as by developing the Evercookie which appeared in a top-secret NSA document revealed by Edward Snowden, exemplifying techniques used by governments and corporations for clandestine web tracking, and has discovered and released research around the illicit GPS and location tracking performed by Apple, Google and Microsoft mobile devices. He continues to produce new research and tools for the public as open source and open hardware.

Twitter: @samykamkar

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Harness: Powershell Weaponization Made Easy (or at least easier)

Rich Kelley security researcher & co-founder of Gray Tier Technologies

The Harness toolset aims to give penetration testers and red teams the ability to pull a remote powershell interface with all the same features of the native Powershell CLI and more. Several tools and utilities have been released to solve the powershell weaponization problem, but no freely available tool give operators the full capabilities of powershell through a remote interface. We’ll start the talk with a quick survey of the previous methods of weaponizing powershell, and then move into the capabilities of the Harness toolset which includes a fully interactive powershell CLI, and remote importing of modules across the wire without staging. We’ll conclude with taking a look at the underlying code that makes the toolset work, and briefly discuss planned features. The Harness toolset will be released open source in conjunction with this talk.

Rich Kelley (@RGKelley5) is a security researcher and the co-founder of Gray Tier Technologies, a small InfoSec start-up based out of Alexandria, VA. After his time in the military he held positions as a network engineer, software engineer, and penetration tester for various government agencies. He recently moved into exploit development and reverse engineering, and is pretty sure he knows less than when he started.

Twitter: @RGKelley5

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

ThunderStrike 2: Sith Strike

Trammel Hudson Vice President, Two Sigma Investments

Xeno Kovah Co-founder, LegbaCore, LLC

Corey Kallenberg Co-Founder, LegbaCore, LLC

The number of vulnerabilities in firmware disclosed as affecting Wintel PC vendors has been rising over the past few years. Although several attacks have been presented against Mac firmware, unlike their PC counterparts, all of them required physical presence to perform. Interestingly, when contacted with the details of previously disclosed PC firmware attacks, Apple systematically declared themselves not vulnerable.

This talk will provide conclusive evidence that Mac's are in fact vulnerable to many of the software only firmware attacks that also affect PC systems. In addition, to emphasize the consequences of successful exploitation of these attack vectors, we will demonstrate the power of the dark side by showing what Mac firmware malware is capable of.

Trammell Hudsonenjoys taking things apart and understanding how they work. He presented the Thunderstrike firmware vulnerability at 31C3, created the Magic Lantern firmware for Canon cameras, and teaches classes at the Brooklyn hackerspace NYC Resistor.

Twitter: @qrs

Web: https://trmm.net/

Xeno Kovah's speciality area is stealth malware and its ability to hide from security software and force security software to lie. To combat such attacks he researches trusted computing systems that can provide much stronger security guarantees than normal COTS. He co-founded LegbaCore in 2014 to help improve security at the foundation of computing systems. He is also the founder and lead contributor to OpenSecurityTraining.info. He has posted 9 full days of class material material on x86 assembly, architecture, binary formats (PE and ELF), and Windows rootkits to OpenSecurityTraining.info.

Twitter: @XenoKovah

Twitter: @legbacore

Corey Kallenberg is a co-founder of LegbaCore, a consultancy focused on evaluating and improving host security at the lowest levels. His specialty areas are trusted computing, vulnerability research and low level development. In particular, Corey has spent several years using his vulnerability research expertise to evaluate limitations in current trusted computing implementations. In addition, he has used his development experience to create and improve upon trusted computing applications. Among these are a timing based attestation agent designed to improve firmware integrity reporting, and an open source Trusted Platform Module driver for Windows. Corey is also an experienced trainer, having created and delivered several technical courses. He is an internationally recognized speaker who has presented at BlackHat USA, DEF CON, CanSecWest, Hack in the Box, NoSuchCon, SyScan, EkoParty and Ruxcon.

Twitter: @CoreyKal

Twitter: @legbacore

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Rocking the Pocket Book: Hacking Chemical Plant for Competition and Extortion

Marina Krotofil Senior Security Consultant. European Network for Cyber Security

Jason Larsen Principal Security Consultant, IOActive

The appeal of hacking a physical process is dreaming about physical damage attacks lighting up the sky in a shower of goodness. Let’s face it, after such elite hacking action nobody is going to let one present it even at a conference like DEF CON. As a poor substitute, this presentation will get as close as using a simulated plant for Vinyl Acetate production for demonstrating a complete attack, from start to end, directed at persistent economic damage to a production site while avoiding attribution of production loss to a cyber-event. Such an attack scenario could be useful to a manufacturer aiming at putting competitors out of business or as a strong argument in an extortion attack.

Picking up a paper these days it’s easy to find an article on all the “SCADA insecurity” out there associated with an unstoppable attacker with unsophisticated goal of kicking up another apocalypse. Sorry to disappoint excited crowd but formula “Your wish is my command” does not work for control systems. The target plant is not designed in a hacker friendly way. Hopefully by the end of the presentation, the audience will understand the difference between breaking into the system and breaking the system, obtaining control and being in control. An attacker targeting a remote process is not immediately gifted with complete knowledge of the process and the means to manipulate it. In general, an attacker follows a series of stages before getting to the final attack. Designing an attack scenario is a matter of art as much as economic consideration. The cost of attack can quickly exceed damage worth. Also, the attacker has to find the way to compare between competing attack scenarios.

In traditional IT hacking, a goal is to go undetected. In OT (operational technologies) hacking this is not an option. An attack will change things in the real world that cannot be removed by simply erasing the log files. If a piece of equipment is damaged or if a plant suddenly becomes less profitable, it will be investigated. The attacker has to create forensic footprint for investigators by manipulating the process and the logs in such a way that the analysts draw the wrong conclusions.

Exploiting physical process is an exotic and hard to develop skill which have so far kept a high barrier to entry. Therefore real-world control system exploitation has remained in the hands of a few. To help the community mastering new skills we have developed „Damn Vulnerable Chemical Process“ – first open source framework for cyber-physical experimentation based on two realistic models of chemical plants. Come to the session and take your first master class on complex physical hacking.

Marina is Senior Security Consultant at European Network for Cyber Security. Through her life she has accumulated vast hands-on experience in several engineering fields. Most recently she completed her doctoral degree in ICS security at Hamburg University of Technology, Germany. Her research over the last few years has been focused on the bits and peac.hes of the design and implementation of cyber-physical attacks aiming at both physical and economic damage. Marina used her pioneering destructive knowledge for designing process-aware defensive solutions and risk assessment approaches. During her PhD she collaborated with several industrial partners, participated in EU projects and collaborated with cool dudes from the hacking community. She has written more than a dozen papers on the subject of cyber-physical exploitation. Marina gives workshops on cyber-physical exploitation and is a frequent speaker at the leading ICS security and hacking venues around the world. She holds MBA in Technology Management, MSc in Telecommunications and MSc in Information and Communication Systems.

Jason Larsen is a professional hacker that specializes in critical infrastructure and process control systems. Over the last several years he has been doing focused research into remote physical damage. Jason graduated from Idaho State University where he worked doing Monte Carlo and pharmacokinetic modeling for Boron-Neutron Capture Therapy. He was one of the founding members of the Cyber-Security department at the Idaho National Labs, which hosts the ICS -CERT and the National SCADA Tested .Jason has audited most of the major process control and SCADA systems as well as having extensive experience doing penetration tests against live systems. His other activities include two years on the Window 7 penetration testing team, designing the anti-malware system for a very large auction site, and building anonymous relay networks. He is currently a Principle Security Consultant for IOActive in Seattle.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hack the Legacy! IBM i (aka AS/400) Revealed.

Bart Kulach (Bartlomiej Jakub Kulach) Security Researcher

Have you ever heard about the famous "green screen"? No, it's not a screensaver... Believe me, it still does exist!

In many industries, although the front-end systems are all new and shiny, in the back-end they still rely on well-known, proven IBM i (aka AS/400) technology for their back-office, core systems. Surprisingly, nobody truly seems to care about the security. Even if these nice IBM heavy black boxes are directly connected to the Internet...

The aim of the talk is to give you more insight in a number of techniques for performing a security test of / securing an IBM i system from perspective of an external and internal intruder. Methods like privilege escalation by nested user switching, getting full system access via JDBC or bypassing the "green screen" (5250) limitations will be presented.

Last but not least: I will also show a undocumented output format of the built-in password transfer API, giving you direct access to all password hashes. Even IBM engineers may wonder...

Bart Kulach: Aged 31, with 14 years of work experience within IT security, risk management and IT operations. Security specialist and experienced supervisor for IT audits, CISA, CISM. Working currently for NN Group in the Netherlands as coordinator for IT audits within Investment and Insurance business units in Europe and Asia. The past 7 years he held various security and risk management related positions. Focused on security of IBM i (aka AS/400, iSeries), website security as well as lean IT processes and architecture.

Facebook: (bart.kulach)

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Remote Access, the APT

Ian Latter Midnight Code

ThruGlassXfer (TGXf) is a new and exciting technique to steal files from a computer through the screen.

Any user that has screen and keyboard access to a shell (CLI, GUI or browser) in an enterprise IT environment has the ability to transfer arbitrary data, code and executables in and out of that environment without raising alarms, today. This includes staff, partners and suppliers, both on and off-shore. And implementation of best practice Data Center (Jump hosts), Perimeter / Remote Access (VPN, VDI, ..) and End Point Security (DLP, AV, ..) architectures have no effect on the outcome.

In this session I will take you from first principles to a full exploitation framework. At the end of the session you'll learn how build on this unidirectional file transfer and augment the solution into a full duplex communications channel (a virtual serial link) and then a native PPP link, from an user owned device, through the remote enterprise-controlled screen and keyboard, to the most sensitive infrastructure in the enterprise. In this special DEF CON presentation I will also be releasing the new high-speed data exfiltration tool, hsTGXf.

This is an exciting and cross-discipline presentation that picks up the story in the DEC VT220 terminal era and will take you on a journey to exploiting modern enterprise security architectures. So join me, whatever your knowledge or skill-set and learn something interesting!

A 20 year veteran of the IT industry, Ian has spent 15 years working in security in a number of positions including Penetration Tester, Security Architect and most recently, a Security Governance role at a blue chip corporate. Ian teaches the Practical Threat Intelligence course at Black Hat and has spoken at key international hacking and security conferences including COSAC (Ireland), Ruxcon (Australia), and Kiwicon (New Zealand). If he had spare time, Ian would be pursuing a number of private software and robotics projects, including the Barbie Car that he promised his daughter (wiser friends have advised that I finish this project before she's old enough to ask for a real Corvette).

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Let's Talk About SOAP, Baby. Let's Talk About UPNP

Ricky "HeadlessZeke" Lawshae Security Researcher, HP TippingPoint

Whether we want it to be or not, the Internet of Things is upon us. Network interfaces are the racing stripes of today's consumer device market. And if you put a network interface on a device, you have to make it do something right? That's where a Simple Object Access Protocol (SOAP) service comes in. SOAP services are designed with ease-of-access in mind, many times at the expense of security. Ludicrous amounts of control over device functionality, just about every category of vulnerability you can think of, and an all-around lack of good security practice about sums it up. In this talk, I will discuss this growing attack surface, demonstrate different methods for attacking/fuzzing it, and provide plenty of examples of the many dangers of insecure SOAP/ UPnP interfaces on embedded and "smart" devices along the way.

Ricky "HeadlessZeke" Lawshae is a Security Researcher for DVLabs at HP TippingPoint with a medium-sized number of years' experience in professionally voiding warranties. He has spoken at the DEF CON, Recon, Insomni'hack, and Ruxcon security conferences, and is an active participant in the extensive Austin, TX hacker community. In his meager spare time, he enjoys picking locks, reading comic books, and drinking expensive beers.

Twitter: @HeadlessZeke

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Tell me who you are and I will tell you your lock pattern

Marte Løge Security Researcher

You are predictable. Your passwords are predictable, and so are your PINs. This fact is being used by the hackers, as well as the agencies watching you. But what about your Android lock patterns? Can who you are reveal what patterns you create?

This presentation will present the result from an analysis of 3400 user-selected patterns. The interesting part is that we collected additional information about the respondents, not just the patterns themselves.

Will being left-handed and having experience with security affect the way you create your lock patterns? There are 389,112 possible patterns. Your full device encryption won't save you if your lock pattern is L - as in "looser".

Marte has just finished her master degree in computer science at the Norwegian University of Technology and Science (...NUTS <3) and has discovered the beauty of security.

She likes passwords and colors, resulting in a special interest in graphical passwords. She is probably the only person that has survived after studying the Android Pattern Lock for a whole year.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Responsible Incident: Covert Keys Against Subverted Technology Latencies, Especially Yubikey

LosT

We're no strangers to love

You know the rules and so do I

A full commitment's what I'm thinking of

You wouldn't get this from any other guy

I just wanna tell you how I'm feeling

Gotta make you understand

Never gonna give you up

Never gonna let you down

Never gonna run around and desert you

Never gonna make you cry

Never gonna say goodbye

Never gonna tell a lie and hurt you

LosT also runs the annual Mystery Box Challenge contest at DEF CON, which he launched at DEF CON 9. L0s7 says he likes to create the kind of challenges and puzzles that he wishes someone else would create for him to solve. 1057 has allegedly created the badges for DEF CON 23. Lo5t also appreciates jokes.

Twitter: @1o57

Web: www.LostboY.net

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

F*ck the attribution, show us your .idb!

Morgan Marquis-Boire Senior Researcher, Citizen Lab

Marion Marschalek Malware reverse engineer, Cyphort Inc

Claudio Guarnieri Creator and lead developer, Cuckoo Sandbox

Over the past few years state-sponsored hacking has received attention that would make a rockstar jealous. Discussion of malware has shifted in focus from ‘cyber crime’ to ‘cyber weapons’, there have been intense public debates on attribution of various high profile attacks, and heated policy discussion surrounding regulation of offensive tools. We’ve also seen the sale of ‘lawful intercept’ malware become a global trade.

While a substantial focus has revolved around the activities of China, Russia, and Iran, recent discoveries have revealed the capabilities of Western nations such as WARRIORPRIDE aka. Regin (FVEY) and SNOWGLOBE aka. Babar (France). Many have argued that digital operations are a logical, even desirable part of modern statecraft. The step from digital espionage to political persecution is, however, a small one. Commercially written, offensive software from companies like FinFisher and Hacking Team has been sold to repressive regimes under the guise of ‘governmental intrusion’ software.

Nation state hacking operations are frequently well-funded, difficult to attribute, and rarely prosecuted even if substantive evidence can be discovered. While efforts have been made to counter this problem, proof is hard to find and even more difficult to correctly interpret. This creates a perfect storm of conditions for lies, vendor lies, and flimsy attribution.

In this talk we will unveil the mess happening backstage when uncovering nation state malware, lead the audience on the track of actor attribution, and cover what happens when you find other players on the hunt. We will present a novel approach to binary stylometry, which helps matching binaries of equal authorship and allows credible linking of binaries into the bigger picture of an attack. After this session the audience will have a better understanding of what happened behind the scenes when the next big APT report surfaces.

Morgan Marquis-Boire is a Senior Researcher at the Citizen Lab, University of Toronto. He is the Director of Security for First Look Media and a contributing writer for The Intercept. Prior to this, he worked on the security team at Google. He is a Special Advisor to the Electronic Frontier Foundation in San Francisco and an Advisor to the United Nations Inter-regional Crime and Justice Research Institute. In addition to this, he serves as a member of the Freedom of the Press Foundation advisory board and as an advisor to Amnesty International.

Marion is a malware reverse engineer on duty for Cyphort Inc., focussing on the analysis of emerging threats and exploring novel methods of threat detection. She teaches malware analysis at University of Applied Sciences St. Pölten and frequently appears as speaker at international conferences. Two years ago Marion won Halvar Flake's reverse engineering challenge for females, since then she set out to threaten cyber criminals. She practices martial arts and has a vivid passion for taking things apart. Preferably, other people's things.

Claudio is a security researcher mostly specialized in the analysis of malware, botnets and computer attacks in general. He's a core member of The Honeynet Project and created the open source malware analysis software Cuckoo Sandbox and Viper and runs the Malwr free service. Claudio published abundant research on botnets and targeted attacks and presented at conferences such as Hack In The Box, BlackHat, Chaos Communication Congress and many more. In recent years he devoted his attention especially on issues of privacy and surveillance and published numerous articles on surveillance vendors such as FinFisher and HackingTeam with the Citizen Lab as well as on NSA/GCHQ and Five Eyes surveillance capabilities with The Intercept and Der Spiegel. Claudio also contributes to Global Voices Advocacy. He continuously researches and writes on government surveillance and threats to journalists and dissidents worldwide and supports human rights organisations with operational security and emergency response.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Inter-VM data exfiltration: The art of cache timing covert channel on x86 multi-core

Etienne Martineau Software engineer, Cisco Systems

On x86 multi-core covert channels between co-located Virtual Machine (VM) are real and practical thanks to the architecture that has many imperfections in the way shared resources are isolated.

This talk will demonstrate how a non-privileged application from one VM can ex-filtrate data or even establish a reverse shell into a co-located VM using a cache timing covert channel that is totally hidden from the standard access control mechanisms while being able to offer surprisingly high bps at a low error rate.

In this talk you'll learn about the various concepts, techniques and challenges involve in the design of a cache timing covert channel on x86 multi-core such as:

- An overview of some of the X86 shared resources and how we can use / abuse them to carry information across VMs.

- Fundamental concept behind cache line encoding / decoding.

- Getting around the hardware pre-fetching logic ( without disabling it from the BIOS! )

- Data persistency and noise. What can be done?

- Guest to host page table de-obfuscation. The easy way.

- Phase Lock Loop and high precision inter-VM synchronization. All about timers.

At the end of this talk we will go over a working VM to VM reverse shell example as well as some surprising bandwidth measurement results. We will also cover the detection aspect and the potential countermeasure to defeat such a communication channel. The source code is going to be release at that time on 'github'

Etienne holds bachelor's degree in electrical engineering from University Laval at Quebec and is currently a senior technical leader at Cisco Systems. He has over 15 years' mission critical Linux in telecom and space industry experience. His career has covered broad range of high performance / high availability hardware and software technologies, system level architecture and since 2008 a very special focus on the KVM hypervisor. He likes to work on complex and challenging problems but when not working, he likes to spend time with his family and during the night hack virtual machines or rebuild car engines.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Working together to keep the Internet safe and secure

Alejandro Mayorkas Deputy Secretary of Homeland Security

We all have a role to play when it comes to ensuring the safety and security of the Internet, whether you are a federal employee, the CEO of a company, or a private citizen. Today’s threats require the engagement of our entire society. This shared responsibility means that we have to work with each other in ways that is often new for the government and the private sector. This means that we also have to trust each other and share information. While we have achieved some successes, we have much more work to do. Deputy Secretary Mayorkas will highlight the role that DHS plays in securing the Internet and discuss the challenges and opportunities to collaborate across our society and across borders.

Alejandro Mayorkas was sworn in as Deputy Secretary of Homeland Security on December 23, 2013. Since 2009, following his nomination by President Obama and subsequent confirmation, Deputy Secretary Mayorkas served as the Director of the Department of Homeland Security’s United States Citizenship and Immigration Services (USCIS), the agency charged with operating the largest immigration system in the world. In that position, he led a workforce of 18,000 members throughout more than 250 offices worldwide and oversaw a $3 billion annual budget. While at USCIS he oversaw a number of important programs and enhancements, including the implementation of Deferred Action for Childhood Arrivals (DACA) as well as important reforms that safeguard our nation’s security, and ensure the integrity of the immigration system.

Prior to his appointment at USCIS, Deputy Secretary Mayorkas was a partner in the law firm of O’Melveny & Myers LLP. In 2008, the National Law Journal recognized Deputy Secretary Mayorkas as one of the “50 Most Influential Minority Lawyers in America.”

In 1998, Deputy Secretary Mayorkas was nominated by President Clinton and confirmed by the Senate to be the United States Attorney for the Central District of California, becoming the youngest U.S. Attorney to serve the nation at that time. In addition to leading an office of 240 Assistant U.S. Attorneys, Mayorkas served as the ViceChair of the Attorney General’s Advisory Subcommittee on Civil Rights and as a member of the Subcommittee on Ethics in Government. From 1989 to 1998, Mayorkas served as an Assistant U.S. Attorney for the Central District of California.

Deputy Secretary Mayorkas is a graduate of the University of California at Berkeley and received his law degree from Loyola Law School.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

I Hunt Penetration Testers: More Weaknesses in Tools and Procedures

Wesley McGrew Assistant Research Professor Distributed Analytics and Security Institute, Mississippi State University

When we lack the capability to understand our tools, we operate at the mercy of those that do. Penetration testers make excellent targets for bad actors, as the average tester’s awareness and understanding of the potential risks and vulnerabilities in their tools and processes is low, and the value of the information they gather and gain access to among their client base is very high. As demonstrated by Wesley’s DEF CON 21 talk on vulnerabilities in penetration testing devices, and last year’s compromise of WiFi Pineapple devices, the tools of offensive security professionals often represent a soft target. In this talk, operational security issues facing penetration testers will be discussed, including communication and data security (not just “bugs”), which impact both testers and clients. A classification system for illustrating the risks of various tools is presented, and vulnerabilities in specific hardware and software use cases are presented. Recommendations are made for improving penetration testing practices and training. This talk is intended to be valuable to penetration testers wanting to protect themselves and their clients, and for those who are interesting in profiling weaknesses of opposing forces that may use similar tools and techniques.

Wesley McGrew (@McGrewSecurity) is an assistant research professor at Mississippi State University's Distributed Analytics and Security Institute. At DASI, he is involved in malware and vulnerability research. In the spring 2013 semester, he began teaching a self-designed course on reverse engineering to students at MSU, using real-world, high-profile malware samples, as part of gaining NSA CAE Cyber Ops certification for MSU. Wesley has presented at Black Hat USA and DEF CON on forensics, malware, and penetration testing topics, and is the author of security and forensics tools that he publishes through his personal/consultancy website, McGrewSecurity.com.

Twitter: @mcgrewsecurity

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

How to Hack Government: Technologists as Policy Makers

Terrell McSweeny Commissioner, Federal Trade Commission

Ashkan Soltani Chief Technologist, Federal Trade Commission

As the leading federal agency responsible for protecting your privacy rights online, technology is at the core of the Federal Trade Commission's work. You may be familiar with the agency's enforcement actions against some of the world's biggest tech companies for privacy/data security violations - but you may not know how your research skills can inform its investigations and policy. Come hear about some of the Commission's recent tech-related actions, research and reports, plus how its work impacts both consumers and businesses. You'll also learn how you can directly or indirectly help the agency protect consumers, guide businesses to develop better/strong data security, and much more.

Terrell McSweeny serves as a Commissioner of the Federal Trade Commission - sometimes referred to as the Federal Technology Commission. This year marks her second DEF CON adventure. When it comes to tech issues, Commissioner McSweeny wants companies to implement security by design, to be transparent about their data collection practices, and to give consumers as much control as possible.

Twitter: @TMcSweenyFTC

Ashkan Soltani serves as the FTC's fourth Chief Technologist. He is a privacy and security researcher whose work draws attention to privacy problems online, demystifies technology for the non-technically inclined, and provides data-driven insights to help inform policy. Ashkan was recognized as part of the 2014 Pulitzer winning team at the Washington Post and was the primary technical consultant on the Wall Street Journal's "What They Know" investigative series on online privacy.

Twitter: @TechFTC

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Red vs. Blue: Modern Active Directory Attacks & Defense

Sean Metcalf CTO, DAn Solutions, Inc.

Kerberos "Golden Tickets" were unveiled by Alva "Skip" Duckwall & Benjamin Delpy in 2014 during their Black Hat USA presentation. Around this time, Active Directory (AD) admins all over the world felt a great disturbance in the Force. Golden Tickets are the ultimate method for persistent, forever AD admin rights to a network since they are valid Kerberos tickets and can't be detected, right?

This talk explores the latest Active Directory attack vectors and describes how Golden Ticket usage can be detected. When forged Kerberos tickets are used in AD, there are some interesting artifacts that can be identified. Yes, despite what you may have read on the internet, there are ways to detect Golden & Silver Ticket usage.

Skip the fluff and dive right into the technical detail describing the latest methods for gaining and maintaining administrative access in Active Directory, including some sneaky AD persistence methods. Also covered are traditional security measures that work (and ones that don't) as well as the mitigation strategies that disrupts the attacker's preferred game-plan. Prepare to go beyond "Pass-the-Hash" and down the rabbit hole.

Some of the topics covered:

- Sneaky persistence methods attackers use to maintain admin rights.

- How attackers go from zero to (Domain) Admin

- MS14-068: the vulnerability, the exploit, and the danger.

- "SPN Scanning" with PowerShell to identify potential targets without network scans (SQL, Exchange, FIM, webservers, etc.).

- Exploiting weak service account passwords as a regular AD user.

- Mimikatz, the attacker's multi-tool.

- Using Silver Tickets for stealthy persistence that won’t be detected (until now).

- Identifying forged Kerberos tickets (Golden & Silver Tickets) on your network.

- Detecting offensive PowerShell tools like Invoke-Mimikatz.

- Active Directory attack mitigation.

Kerberos expertise is not required since the presentation covers how Active Directory leverages Kerberos for authentication identifying the areas useful for attack. Information presented is useful for both Red Team & Blue Team members.

Sean Metcalf is the Chief Technology Officer at DAn Solutions, a company that provides Microsoft platform engineering and security expertise. Mr. Metcalf is one of about 100 people in the world who holds the elite Microsoft Certified Master Directory Services (MCM) certification. Furthermore, he assisted Microsoft in developing the Microsoft Certified Master Directory Services certification program for Windows Server 2012.

Mr. Metcalf has provided Active Directory and security expertise to government, corporate, and educational entities since Active Directory was released. He currently provides security consulting services to customers with large Active Directory environments and regularly posts useful Active Directory security information on his blog, ADSecurity.org. Follow him on Twitter @PyroTek3

Twitter: @PyroTek3

Web: ADSecurity.org

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Put on your tinfo_t hat if you're my type

miaubiz Senior Dr. at Azimuth Security

The IDA Pro APIs for interacting with type information are full of opportunities (horrible problems). I will show you how to create unparseable types, how to apply these types to functions and variables and how to transfer these types from one IDB to another.

miaubiz is a senior doctor of security at Azimuth Security. he has previously found bugs in web browsers and has spoken at SyScan, Infiltrate, T2. his interests are bad APIs and sniffing ARMpits.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Remote Exploitation of an Unaltered Passenger Vehicle

Charlie Miller Security engineer at Twitter

Chris Valasek Director of Vehicle Security Research at IOActive

Although the hacking of automobiles is a topic often discussed, details regarding successful attacks, if ever made public, are non-comprehensive at best. The ambiguous nature of automotive security leads to narratives that are polar opposites: either we’re all going to die or our cars are perfectly safe. In this talk, we will show the reality of car hacking by demonstrating exactly how a remote attack works against an unaltered, factory vehicle. Starting with remote exploitation, we will show how to pivot through different pieces of the vehicle’s hardware in order to be able to send messages on the CAN bus to critical electronic control units. We will conclude by showing several CAN messages that affect physical systems of the vehicle. By chaining these elements together, we will demonstrate the reality and limitations of remote car attacks.

Charlie Miller is a security engineer at Twitter, a hacker, and a gentleman. Back when he still had time to research, he was the first with a public remote exploit for both the iPhone and the G1 Android phone. He is a four time winner of the CanSecWest Pwn2Own competition. He has authored three information security books and holds a PhD from the University of Notre Dame. He has hacked browsers, phones, cars, and batteries. Charlie spends his free time trying to get back together with Apple, but sadly they still list their relationship status as "It's complicated".

Twitter: @0xcharlie

Christopher Valasek is the Director of Vehicle Security Research at IOActive, an industry leader in comprehensive computer security services. Valasek specializes in offensive research methodologies with a focus in reverse engineering and exploitation. Valasek is known for his extensive research in the automotive field and his exploitation and reverse engineering of Windows. Valasek is also the Chairman of SummerCon, the nation's oldest hacker conference. He holds a B.S. in Computer Science from the University of Pittsburgh.

Twitter: @nudehaberdasher

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Separating Bots from the Humans

Ryan Mitchell Software Engineer, LinkeDrive Inc

There’s an escalating arms race between bots and the people who protect sites from them. Bots, or web scrapers, can be used to gather valuable data, probe large collections of sites for vulnerabilities, exploit found weaknesses, and are often unfazed by traditional solutions like robots.txt files, Ajax loading, and even CAPTCHAs. I’ll give an overview of both sides of the battle and explain what what really separates the bots from the humans. I’ll also demonstrate and easy new tool that can be used to crack CAPTCHAs with high rates of success, some creative approaches to honeypots, and demonstrate how to scrape many “bot-proof” sites.

Ryan Mitchell is Software Engineer at LinkeDrive in Boston, where she develops their API and data analysis tools. She is a graduate of Olin College of Engineering, and is a masters degree student at Harvard University School of Extension Studies. Prior to joining LinkeDrive, she was a Software Engineer building web scrapers and bots at Abine Inc, and regularly does freelance work, building web scrapers for clients, primarily in the financial and retail industries.

Ryan is also the author of two books: “Instant Web Scraping with Java” (Packt Publishing, 2013) and “Web Scraping with Python” (O’Reilly Media, 2015)

Twitter: @Kludgist

Amazon Author Page: http://www.amazon.com/Ryan-Mitchell/e/B00MQI8TVQ

Website: http://ryanemitchell.com

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service

Colby Moore Manager of Special Activities, Synack

Recently there have been several highly publicized talks about satellite hacking. However, most only touch on the theoretical rather than demonstrate actual vulnerabilities and real world attack scenarios. This talk will demystify some of the technologies behind satellite communications and do what no one has done before - take the audience step-by-step from reverse engineering to exploitation of the GlobalStar simplex satcom protocol and demonstrate a full blown signals intelligence collection and spoofing capability. I will also demonstrate how an attacker might simulate critical conditions in satellite connected SCADA systems.

In recent years, Globalstar has gained popularity with the introduction of its consumer focused SPOT asset-tracking solutions. During the session, I’ll deconstruct the transmitters used in these (and commercial) solutions and reveal design and implementation flaws that result in the ability to intercept, spoof, falsify, and intelligently jam communications. Due to design tradeoffs these vulnerabilities are realistically unpatchable and put millions of devices, critical infrastructure, emergency services, and high value assets at risk.

Colby Moore is Synack's Manager of Special Activities. He works on the oddball and difficult problems that no one else knows how to tackle and strives to embrace the attacker mindset during all engagements. He is a former employee of VRL and has identified countless 0day vulnerabilities in embedded systems and major applications. In his spare time you will find him focusing on that sweet spot where hardware and software meet, usually resulting in very interesting consequences.

Twitter: @colbymoore

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Docker, Docker, Give Me The News, I Got A Bad Case Of Securing You

David Mortman Chief Security, Architect & Distinguished Engineer, Dell Software

Docker is all the rage these days. Everyone is talking about it and investing in it, from startups to enterprises and everything in between. But is it secure? What are the costs and benefits of using it? Is this just a huge risk or a huge opportunity? There's a while lot of ranting and raving going on, but not nearly enough rational discourse. I'll cover the risks and rewards of using Docker and similar technologies such as AppC as well as discuss the larger implications of using orchestration systems like Mesos or Kubernetes. This talk will cover the deep technical issues to be concerned about as well as the pragmatic realities of the real world.

David Mortman is the Chief Security Architect and Distinguished Engineer at Dell Software and is a Contributing Analyst at Securosis. Before Dell, he ran operations and security for C3. Formerly the Chief Information Security Officer for Siebel Systems, Inc., Previously, Mr. Mortman was Manager of IT Security at Network Associates. Mr. Mortman has also been a regular panelist and speaker at RSA, Blackhat, DEF CON and BruCon as well. Mr.Mortman sits on a variety of advisoryboards including Qualys, Lookout and Risk I/O. He holds a BS in Chemistry from the University of Chicago. David writes for Securosis, Emergent Chaos and the New School blogs.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Detecting Randomly Generated Strings; A Language Based Approach

Mahdi Namazifar Senior Data Scientist, Talos Team, Cisco Systems

Numerous botnets employ domain generation algorithms (DGA) to dynamically generate a large number of random domain names from which a small subset is selected for their command and control. A vast majority of DGA algorithms create random sequences of characters. In this work we present a novel language-based technique for detecting strings that are generate by chaining random characters. To evaluate randomness of a given string (domain name in this context) we lookup substrings of the string in the dictionary that we’ve built for this technique, and then we calculate a randomness score for the string based on several different factors including length of the string, number of languages that cover the substrings, etc. This score is used for determining whether the given string is a random sequence of characters. In order to evaluate the performance of this technique, on the one hand we use 9 known DGA algorithms to create random domain names as DGA domains, and on the other hand we use domain names from the Alexa 10,000 as likely non-DGA domains. The results show that our technique is more than 99% accurate in detecting random and non-random domain names.

Mahdi Namazifar is currently a Senior Data Scientist with Talos team of Cisco Systems' San Francisco Innovation Center (SFIC). He graduated his PhD in Operations Research from the University of Wisconsin-Madison in 2011. His PhD work was on theoretical and computational aspects of mathematical optimization. During his PhD Mahdi was also affiliated with Wisconsin Institute for Discovery (WID) and the French Institute for Research in Computer Science and Automation (INRIA). Also he was a National Science Foundation (NFS) Grantee at the San Diego Supercomputer Center in 2007 and a Research Intern at IBM T.J. Watson Research Lab in 2008. After graduate school and before his current position at Cisco he was a Scientist at Opera Solutions working on applications of machine learning in a variety of problems coming from industries such as healthcare and finance.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Don't Whisper my Chips: Sidechannel and Glitching for Fun and Profit

Colin O'Flynn Dalhousie University

If you thought the security practices of regular software was bad, just wait until you start learning about the security of embedded hardware systems. Recent open-source hardware tools have made this field accessible to a wider range of researchers, and this presentation will show you how to perform these attacks for equipment costing $200.

Attacks against a variety of real systems will be presented: AES-256 bootloaders, internet of things devices, hardware crypto tokens, and more. All of the attacks can be replicated by the attendees, using either their own tools if such equipped (such as oscilloscopes and pulse generators), the open-hardware ChipWhisperer-Lite, or an FPGA board of their own design.

The hands-on nature of this talk is designed to introduce you to the field, and give you the confidence to pick up some online tutorials or books and work through them. Even if you've never tried hardware hacking before, the availability of open-source hardware makes it possible to follow published tutorials and learn all about side-channel power analysis and glitching attacks for yourself.

Colin O'Flynn has been working with security on embedded systems for several years. He has designed the open-source ChipWhisperer project which won 2nd place in the 2014 Hackaday Prize, and developed an even lower-cost version called the ChipWhisperer-Lite, which was the focus of a Kickstarter in 2015.

Twitter: @colinoflynn

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Advances in Linux Process Forensics Using ECFS

Ryan O'Neill Security Consultant, Leviathan Security Group

Many hackers today are using process memory infections to maintain stealth residence inside of a compromised system. The current state of forensics tools in Linux, lack the sophistication used by the infection methods found in real world hacks. ECFS (Extended core file snapshot) technology, https://github.com/elfmaster/ecfs is an innovative extension to regular ELF core files, designed to be used as forensics-friendly snapshots of process memory. A brief showcasing of the ECFS technology was featured in POC||GTFO 0x7 (Innovations with core files).

However this talk will reveal deeper insight on the many features of this technology, such as full symbol table reconstruction, builtin detection heuristics, and how common binutils such as objdump, and readelf can be used to quickly identify complex infections such as PLT/GOT hooks and shared library injection. We will also cover the libecfs API that was created specifically for malware and forensics analysts who aim to implement support for ECFS snapshots into new or existing malware detection software.

While the ECFS core format was initially designed for runtime malware and forensics purposes, another very neat aspect to this technology was quickly extrapolated on; the ECFS snapshots can also be reloaded into memory and executed. Very similar to VM snapshots, which opens many more doors for research and exploration in a vast array of areas from dynamic analysis to migrating live processes across systems. ECFS is still a work in progress, but for those who understand the arduous nature of dissecting a process and identifying anomalies, will surely acquire a quick respect for the new technology that makes all of this so much easier.

Ryan 'elfmaster' O'Neill is a computer security researcher at Leviathan Security and the maintainer of Bitlackeys.org, a hub for much of his independent research. He is a Reverse engineer, and a Software engineer, who also specializes in the ELF binary format, and delivers on going workshops in this area to interested parties, including the US government. Ryan has worked on many security technologies including but not limited to:

- Maya's Veil : anti-tamper / anti-exploitation protection for Linux ELF binaries

- VMA Vudu : automated forensics analysis of process runtime infections in Linux

- kernelDetective : Linux kernel forensics software

Ryan has produced alot of research and publications in areas pertaining to Linux kernel and userland malware, such as "Linux kprobe instrumentation from phrack 66", and is author of soon to be released book "The art of Linux binary analysis" which focuses on everything from ELF internals to Linux Viruses, and Binary protection techniques. Ryan has been involved in the computer security scene since 1999.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Ask the EFF: The Year in Digital Civil Liberties

Kurt Opsahl General Counsel, Electronic Frontier Foundation

Nate Cardozo EFF Staff Attorney

Mark Jaycox EFF Legislative Analyst

Corynne McSherry EFF Legal Director

Nadia Kayyali EFF Activist

Peter Eckersley EFF Technology Projects Director

Get the latest information about how the law is racing to catch up with technological change from staffers at the Electronic Frontier Foundation, the nation’s premiere digital civil liberties group fighting for freedom and privacy in the computer age. This session will include updates on current EFF issues such as surveillance online and fighting efforts to use intellectual property claims to shut down free speech and halt innovation, discussion of our technology project to protect privacy and speech online, updates on cases and legislation affecting security research, and much more.  Half the session will be given over to question-and-answer, so it's your chance to ask EFF questions about the law and technology issues that are important to you.

Kurt Opsahl is the Deputy Executive Director and General Counsel of the Electronic Frontier Foundation. In addition to representing clients on civil liberties, free speech and privacy law, Opsahl counsels on EFF projects and initiatives.  Opsahl is the lead attorney on the Coders' Rights Project.  Before joining EFF, Opsahl worked at Perkins Coie, where he represented technology clients with respect to intellectual property, privacy, defamation, and other online liability matters, including working on Kelly v. Arribasoft, MGM v. Grokster and CoStar v. LoopNet. For his work responding to government subpoenas, Opsahl is proud to have been called a "rabid dog" by the Department of Justice. Prior to Perkins, Opsahl was a research fellow to Professor Pamela Samuelson at the U.C. Berkeley School of Information Management & Systems. Opsahl received his law degree from Boalt Hall, and undergraduate degree from U.C. Santa Cruz. Opsahl co-authored "Electronic Media and Privacy Law Handbook." In 2007, Opsahl was named as one of the "Attorneys of the Year" by California Lawyer magazine for his work on the O'Grady v. Superior Court appeal. In 2014, Opsahl was elected to the USENIX Board of Directors.

Nate Cardozo is a Staff Attorney on the Electronic Frontier Foundation’s digital civil liberties team. In addition to his focus on free speech and privacy litigation, Nate works on EFF's Who Has Your Back? report and Coders' Rights Project. Nate has projects involving cryptography and the law, automotive privacy, government transparency, hardware hacking rights, anonymous speech, electronic privacy law reform, Freedom of Information Act litigation, and resisting the expansion of the surveillance state. A 2009-2010 EFF Open Government Legal Fellow, Nate spent two years in private practice before returning to his senses and to EFF in 2012.  Nate has a B.A. in Anthropology and Politics from U.C. Santa Cruz and a J.D. from U.C. Hastings where he has taught first-year legal writing and moot court. He brews his own beer, has been to India four times, and watches too much Bollywood.

Mark Jaycox is a Legislative Analyst for EFF. His issues include user privacy, civil liberties, surveillance law, and "cybersecurity." When not reading legal or legislative documents, Mark can be found reading non-legal and legislative documents, exploring the Bay Area, and riding his bike. He was educated at Reed College, spent a year abroad at the University of Oxford (Wadham College), and concentrated in Political History. The intersection of his concentration with advancing technologies and the law was prevalent throughout his education, and Mark's excited to apply these passions to EFF. Previous to joining EFF, Mark was a Contributor to ArsTechnica, and a Legislative Research Assistant for LexisNexis.

Peter Eckersley is Technology Projects Director for the Electronic Frontier Foundation. He leads a team of technologists who watch for technologies that, by accident or design, pose a risk to computer users' freedoms—and then look for ways to fix them. They write code to make the Internet more secure, more open, and safer against surveillance and censorship. They explain gadgets to lawyers and policymakers, and law and policy to gadgets. Peter's work at EFF has included privacy and security projects such as the Let's Encrypt CA, Panopticlick, HTTPS Everywhere, SSDI, and the SSL Observatory; helping to launch a movement for open wireless networks; fighting to keep modern computing platforms open; and running the first controlled tests to confirm that Comcast was using forged reset packets to interfere with P2P protocols. Peter holds a PhD in computer science and law from the University of Melbourne; his research focused on the practicality and desirability of using alternative compensation systems to legalize P2P file sharing and similar distribution tools while still paying authors and artists for their work. He is an affiliate of the Center for International Security and Cooperation at Stanford University.

Nadia Kayyali is a member of EFF’s activism team. Nadia's work focuses on surveillance, national security policy, and the intersection of criminal justice, racial justice, and digital civil liberties issues.  Nadia has been an activist since high school, when they participated in the World Trade Organization protests in Seattle. Nadia is one of the creators of the Canary Watch website, which tracks and classifies warrant canaries.

Corynne McSherry is the Legal Director at EFF, specializing in intellectual property, open access, and free speech issues. Her favorite cases involve defending online fair use, political expression, and the public domain against the assault of copyright maximalists.   As a litigator, she has represented Professor Lawrence Lessig, Public.Resource.Org, the Yes Men, and a dancing baby, among others, and one of her first cases at EFF was In re Sony BMG CD Technologies Litigation (aka the "rootkit" case). Her policy work includes leading EFF’s effort to fix copyright (including the successful effort to shut down the Stop Online Privacy Act, or SOPA), promote net neutrality, and promote best practices for online expression. In 2014, she testified before Congress about problems with the Digital Millennium Copyright Act.  Corynne comments regularly on digital rights issues and has been quoted in a variety of outlets, including NPR, CBS News, Fox News, the New York Times, Billboard, the Wall Street Journal, and Rolling Stone. Prior to joining EFF, Corynne was a civil litigator at the law firm of Bingham McCutchen, LLP. Corynne has a B.A. from the University of California at Santa Cruz, a Ph.D from the University of California at San Diego, and a J.D. from Stanford Law School. While in law school, Corynne published Who Owns Academic Work?: Battling for Control of Intellectual Property (Harvard University Press, 2001).

Twitter: @eff, @kurtopsahl

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

DEF CON Comedy Inception: How many levels deep can we go?

Larry Pesce Senior Security Analyst, InGuardians

Chris Sistrunk Mandiant/FireEye

Will "illwill" Genovese

Chris Blow Rook Security

Dan Tentler Carbon Dynamics

Amanda Berlin Hurricane Labs

This year at DEF CON a former FAIL PANEL panelist attempts to keep the spirit alive by playing moderator. Less poetry, more roasting. A new cast of characters, more lulz, and no rules. Nothing is sacred, not the industry, not the audience, not even each other. Our cast of characters will bring you all sorts of technical fail, ROFLCOPTER to back it up. No waffles, but we have other tricks up our sleeve to punish, er, um, show love to our audience, all while raising money of the EFF and HFC. The FAIL PANEL may be dead, but the “giving” goes on.

Larry Pesce is a Senior Security Analyst with InGuardians. His recent experience includes providing penetration assessment, architecture review, hardware security assessment, wireless/radio analysis, and policy and procedure development for a wide range of industries including those in the financial, retail, and healthcare verticals.

Larry is an accomplished speaker, having presented numerous times at industry conferences as well as the co-host of the long running multi-award winning Security Podcast, Paul's Security Weekly. and is a certified instructor with the SANS Institute.

Larry is a graduate of Roger Williams University. In his spare time he likes to tinker with all things electronic and wireless. Larry is an amateur radio operator holding his Extra class license and is regularly involved in emergency communications activities.

In 1972 a crack commando unit was sent to prison by a military court for a crime they didn't commit. These men promptly escaped from a maximum security stockade.... making the decision to leave Amanda behind. Ms. Berlin is now rumored to have illegitimate children by Saudi Oil barons hidden all over the world in at least 27 countries but this can neither be confirmed nor denied.

Amanda Berlin is a Network Security Engineer at Hurricane Labs. She is most well known for being a breaker of hearts, knees, and SJW's. Bringing "Jack of All Trades" back to being sexy, she has worked her fingers to the bone securing ISPs, Healthcare facilities, Artificial Insemination factories, and brothels. Amanda managed the internal phishing campaign at a medium size healthcare facility to promote user education about phishing and hacking through an awards based reporting program. She is a lead organizer for CircleCityCon, volunteers at many other conferences, and enjoys writing and teaching others.

Twitter: @InfoSystir

Chris Blow is a Senior Technical Advisor with Rook Security. His most recent experience includes: penetration testing, social engineering, red team exercises, policy and procedure guidance focused on HIPAA and PCI DSS, developing security awareness programs, performing HIPAA assessments and serving as a Qualified Security Assessor for the Payment Card Industry.

@b10w

In reality, his primary duties are to be told by various clients that “security is hard” and to just “accept the risk.” He’s also well-versed in being told to keep vulnerable assets and people “out of scope.”

Chris is a graduate of Purdue University in West Lafayette, IN. Besides trying to keep up with all-things-InfoSec, Chris enjoys playing guitar, singing, and DJing.

Twitter: @b10w

illwill is a rogue blackhat as fuck subcontractor for top secret global governments. He spends his off time enjoying bubble baths, recovering from a debilitating injury as infosystir's former bean fluffer and hand carves realistic thrones made from discarded dildos found dumpster diving behind a porn store in Los Angeles.

Dan Tentler likes to break things. He's also an expert on failure. Ask him about it. But ask with scotch.

Twitter: @viss

@chrissistrunk

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hacking Smart Safes: On the "Brink" of a Robbery

Dan “AltF4” Petro Security Associate, Bishop Fox

Oscar Salazar Senior Security Associate at Bishop Fox

Have you ever wanted to crack open a safe full of cash with nothing but a USB stick? Now you can!

The Brink’s CompuSafe cash management product line provides a “smart safe as a service” solution to major retailers and fast food franchises. They offer end-to-end management of your cash, transporting it safely from your storefront safe to your bank via armored car.

During this talk, we’ll uncover a major flaw in the Brink’s CompuSafe and demonstrate how to crack one open in seconds flat. All you need is a USB stick and a large bag to hold all of the cash. We’ll discuss how to remotely takeover the safe with full administrator privileges, and show how to enumerate a target list of other major Brink’s CompuSafe customers (exposed via configuration files stored right on the safe).

At any given time, up to $240,000 can be sitting in each of the 14,000 Brink’s CompuSafe smart safes currently deployed across the United States - potentially billions of dollars just waiting to be stolen.

So come ready to engage us as we explore these tools and more in this DEMO-rich presentation. And don’t forget to call Kenny Loggins… because this presentation is your highway to the Danger Zone…

Note - This presentation is about exposing flaws in the Brinks’s Compusafe to improve security and allow pentesters to demonstrate these flaws to their customers. Please use this information responsibly.

Dan Petro is a Security Associate at Bishop Fox (formerly Stach & Liu), a security consulting firm providing IT security services to the Fortune 500, global financial institutions, and high-tech startups. In this role, he focuses on application penetration testing and secure development.

Dan has presented at numerous conferences, including DEF CON, BlackHat, HOPE, and BSides, and is the founding member of the Pi Backwards CTF team.

Prior to joining Bishop Fox, Dan served as Lead Software Engineer for a security contracting firm.

Dan holds a Bachelor of Science from Arizona State University with a major in Computer Science, as well as a Master’s Degree in Computer Science from Arizona State University.

Oscar Salazar is a Senior Security Associate at Bishop Fox (formerly Stach & Liu), a security consulting firm providing IT security services to the Fortune 500, global financial institutions, and high-tech startups. In this role, he focuses on application penetration testing, source code review, and secure software design.

Oscar has presented at RSA, Bsides, and Adobe’s annual private Security Summit conference.

Prior to joining Bishop Fox, Oscar served as a web security research engineer at Hewlett-Packard’s Application Security Center where he designed and developed security checks for the WebInspect web application security scanner. In addition, his research involved developing more effective methods of scanning Web 2.0 applications.

Oscar holds a Bachelor of Science from the Georgia Institute of Technology with a major in Computer Science and a focus on Networking and Security.

https://www.facebook.com/BishopFoxConsulting

https://twitter.com/bishopfox

https://www.linkedin.com/company/bishop-fox

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Staying Persistent in Software Defined Networks

Gregory Pickett Cybersecurity Operations, Hellfire Security

The Open Network Install Environment, or ONIE, makes commodity or WhiteBox Ethernet possible. By placing a common, Linux-based, install environment onto the firmware of the switch, customers can deploy the Network Operating Systems of their choice onto the switch and do so whenever they like without replacing the hardware. The problem is, if this gets compromised, it also makes it possible for hackers to install malware onto the switch. Malware that can manipulate it and your network, and keep doing it long after a Network Operating System reinstall.

With no secure boot, no encryption, no authentication, predictable HTTP/TFTP waterfalls, and exposed post-installation partition, ONIE is very susceptible to compromise. And with Network Operating Systems such as Switch Light, Cumulus Linux, and Mellanox-OS via their agents Indigo and eSwitchd not exactly putting up a fight with problems like no authentication, no encryption, poor encryption, and insufficient isolation, this is a real possibility.

In this session, we'll cover the weaknesses in ONIE, ways to reach the platform through these Network Operating Systems, and what can happen if we don't properly protect the Control Plane these switches run on. I'll even demonstrate with a drive-by web-attack that is able to pivot through a Windows management station to reach the isolated control plane network, and infect one of these ONIE-based switches with malware, malware that's there even after a refresh. You'll even get the source code to take home with you to see how easily it's done. Finally, we'll talk about how to compensate for these issues so that your network doesn't become infected with and manipulated by this sort of persistent firmware-level malware.

Gregory Pickett CISSP, GCIA, GPEN has a background in intrusion analysis for Fortune 100 companies but now heads up Hellfire Security’s Managed Security Services efforts and participates in their assessment practice as a network security subject matter expert. As a security professional, his primary area of focus and occasional research is networks with an interest in using network traffic to better understand, to better defend, and sometimes to better exploit the hosts that live on them. He holds a B.S. in Psychology which is completely unrelated but interesting to know. While it does nothing to contribute to how he makes a living, it does demonstrate how screwed up he actually is.

Twitter: @Shogun7273

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

One Device to Pwn Them All

Dr. Phil Polstra Professor, Bloomsburg University

This talk will present a device that can be used as a dropbox, remote hacking drone, hacking command console, USB writeblocker, USB Mass Storage device impersonator, or scripted USB HID device. The device is based on the BeagleBone Black, can be battery operated for several days, and is easily constructed for under $100.

The dropbox, remote hacking drone, and hacking command console functionality were presented at DEF CON 21. This talk will emphasize the new USB-based attack functionality. Topics will include injecting payloads by emulating an optionally write-protected USB mass storage device, rapidly executing commands on a target using the BeagleBone Black operating as a scripted USB HID device, USB mass storage device impersonation, and other attacks that can be performed with brief physical access to the target.

Some familiarity with Linux and USB devices would be helpful, but not required. All hardware and software to be discussed is 100% open source.

Phil was born at an early age. He cleaned out his savings at age 8 in order to buy a TI99-4A computer for the sum of $450. Two years later he learned 6502 assembly and has been hacking computers and electronics ever since.

Dr. Phil currently works as a professor at Bloomsburg University of Pennsylvania. His research focus over the last few years has been on the use of microcontrollers and small embedded computers for forensics and pentesting. Phil has developed a custom pentesting Linux distro and related hardware to allow an inexpensive army of remote pentesting drones to be built using the BeagleBone Black computer boards. This work is described in detail in Phil's book "Hacking and Penetration Testing With Low Power Devices" (Syngress, 2015).

Prior to entering academia, Phil held several high level positions at well-known US companies. He holds a couple of the usual certs one might expect for someone in his position. When not working, he likes to spend time with his family, fly, hack electronics, and has been known to build airplanes.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

NetRipper - Smart traffic sniffing for penetration testers

Ionut Popescu Senior Security Consultant at KPMG Romania

The post-exploitation activities in a penetration test can be challenging if the tester has low-privileges on a fully patched, well configured Windows machine. This work presents a technique for helping the tester to find useful information by sniffing network traffic of the applications on the compromised machine, despite his low-privileged rights. Furthermore, the encrypted traffic is also captured before being sent to the encryption layer, thus all traffic (clear-text and encrypted) can be sniffed. The implementation of this technique is a tool called NetRipper which uses API hooking to do the actions mentioned above and which has been especially designed to be used in penetration tests, but the concept can also be used to monitor network traffic of employees or to analyze a malicious application.

Ionut works as a Senior Security Consultant at KPMG in Romania. He is passionate about ASM, reverse engineering, shellcode and exploit development and he has a MCTS Windows Internals certification.

He spoke at various security conferences in Romania like: Defcamp, OWASP local meetings and others and also at the yearly Hacknet KPMG international conference in Helsinki and Berlin.

Ionut is also the main administrator of the biggest Romanian IT security community: rstforums.com and he writes technical articles on a blog initiated by a passionate team: securitycafe.ro.

Twitter: @NytroRST

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Chigula — a framework for Wi-Fi Intrusion Detection and Forensics

Vivek Ramachandran, Founder, SecurityTube.net and Pentester Academy

Most of Wi-Fi Intrusion Detection & Forensics is done today using million dollar products or spending hours applying filters in Wireshark :) Chigula aims to solve this by providing a comprehensive, extensible and scriptable framework for Wi-Fi intrusion detection and forensics.

A non-exhaustive list of attacks which will be detected using this framework include:

- Attack tool detection - Aireplay-NG, Airbase-NG, Mdk3 etc.

- Honeypot, Evil Twin and Multipot attacks

- Rogue devices

- Vulnerable clients based on Probed SSIDs

- Hosted network based backdoors

- MAC spoofing

- Deauthentication attacks

- Disassociation attacks

- Channel Jamming attacks using duration field

Vivek Ramachandran discovered the Caffe Latte attack, broke WEP Cloaking and publicly demonstrated enterprise Wi-Fi backdoors. He is the author of "Backtrack 5: Wireless Penetration Testing" which has sold over 13,000+ copies worldwide. He is the founder of SecurityTube.net and runs SecurityTube Training & Pentester Academy which has trained professionals from 90 countries. He has spoken/trained at DEF CON, Blackhat USA/Europe/Abu Dhabi, Brucon, Hacktivity etc. conferences.

Twitter: @securitytube

Facebook: https://www.facebook.com/pagesectube

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Knocking my neighbor’s kid’s cruddy drone offline

Michael Robinson Professor, Stevenson University

My neighbor’s kid is constantly flying his quad copter outside my windows. I see the copter has a camera and I know the little sexed crazed monster has been snooping around the neighborhood. With all of the hype around geo-fencing and drones, this got me to wondering: Would it be possible to force a commercial quad copter to land by sending a low-level pulse directly to it along the frequencies used by GPS? Of course, radio signal jamming is illegal in the U.S and, frankly, it would disrupt my electronics, too. In this presentation, we’ll look at some of the research and issues we encountered, when we attempted to force land two commercial drones (the new DJI Phantom 3 and the Parrot Bepop Drone) by sending GPS signals directly at the drones (while staying under the threshold for jamming and not disrupting anyone else).

Michael Robinson has over 15 years of computer security experience and is currently a computer and mobile device forensic examiner in the Washington, DC area, where he deals with intrusion analysis, incident response, and criminal cases. For over four years he ran IT and IA operations for a Department of Defense agency. He has conducted research on security of mobile devices and is starting to play around in the drone space. He teaches computer forensics at the graduate level at Stevenson University in Maryland.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

I Will Kill You

Chris Rock Kustodian Pty Ltd

Have you ever wanted to kill someone? Do you want to get rid of your partner, your boss or your arch nemesis? Perhaps you want to enjoy your life insurance payout whilst you’re still alive. Do you have rich elderly parents that just won’t die quick enough? Or do you want a “Do Over” new identity.

Then, this presentation is for you! I’ll provide you with the insight and techniques on how to “kill” someone and obtain a real death certificate and shutdown their lives. It focuses on the lack of security controls that allow any of us to virtually kill off anyone or any number of people. Forget the Dexter way of killing someone, I’ll show you how to avoid the messy clean up and focusing in on the digital aspects. You could be dead right now and not even know it.

The presentation will explain the death process and will highlight the vulnerabilities and its implications world-wide.

You will learn:

- How to fill in a doctor’s medical cause of death certificate anonymously.

- How to become a funeral director and dispose of the body.

- How to obtain a Death Certificate.

Once you’ve wrapped your mind around that concept, I will also show you how to “birth” Virtual identities that obtain real birth certificates. You will learn the birth registration process and the security vulnerabilities associated with this as well.

The third and final step of the presentation is “The baby harvest”, a concept that I’ve developed, which involves creating and raising virtual identities. This technique is similar to a shelf company. Virtuals will be “born”, registered with the government complete with birth certificates and social security numbers. They can open up bank accounts, get a virtual job to launder money, pay taxes, obtain home loans and obtain life insurance policies. They can be married to anyone (virtual or not) and be directors of companies…. the list is endless and to complete the circle of life, they can be killed off when they are ready for “harvest” for their life insurance payouts or sold as permanent I.D.’s. With no victim, this is taking identity theft to the next level.

Chris Rock has been active in the security industry for the last 20 years and is the founder and CEO of Kustodian, a specialized security company that specializes in Security Operations Centres, Penetration testing and independent research. Kustodian is an Australian, Middle East and Hong Kong registered company that has been operational for over 9 years. Chris has also spent 12 years in the banking sector and provides security services around the world for small, medium and large companies.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

How to Hack a Tesla Model S

Marc Rogers Principle Security Researcher for CloudFlare

Kevin Mahaffey CTO of Lookout Inc

The Tesla Model S is the most connected car in the world. It might surprise you to hear that it is also one of the most secure. In this talk we will walk you through the architecture of a Tesla Model S noting things that Tesla got right as well as identifying those that they got wrong. From this talk you will get an intimate understanding of how the many interconnected systems in a Tesla model S work and most importantly how they can be hacked. You will also get a good understanding of the data that this connected car collects and what Tesla does with this telemetry. We will also be releasing a tool that will enable Tesla Model S owners to view and analyse that telemetry in real time. Finally we will also be releasing several 0day vulnerabilities that will allow you to hack a Tesla Model S yourself - both locally and remotely. Note - only one of the 6 vulnerabilities we will discuss and release has been fixed. Disclaimer: With great access comes great responsibility - In other words we are not responsible for any Tesla Model S bricked by over enthusiastic attendees of this talk :)

Marc Rogers aka Cyberjunky has been a prominent member of the hacking scene since the 80’s.  Some of his most notable achievements are co-founding the notorious British hacker group, “The Agents of a Hostile Power” and his role in creating and appearing in the award winning BBC TV series “The Real Hustle”. Marc’s professional career spans more than twenty years, including a decade managing security for the UK operator Vodafone. Marc is currently the principal security researcher for web optimization and security company “CloudFlare. As well as his work in the infosec and telecoms industries, Marc has also been a CISO in South Korea and co-founder of a disruptive Bay Area start-up. Some of Marc’s notable recent hacks include Google Glass, Apple TouchID and most recently the Tesla Model S.

Kevin is an entrepreneur and technologist with a background in mobile and web technology, security, and privacy. He is the CTO of Lookout, a company dedicated making the world a safer place as it becomes more connected, starting with smartphones and tablets. He co-founded Lookout in 2007 and is responsible for driving Lookout’s technology to protect people from current and future threats while keeping the product simple and easy to use. He started building software when he was 8 years old and it has been a love affair ever since. Kevin is a frequent speaker on security, privacy, mobile, and other topics.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hacking Electric Skateboards: Vehicle Research For Mortals

Mike Ryan Red Team, eBay

Richo Healey Security Engineer, Stripe

In the last year there's been an explosion of electric skateboards onto the market- seemingly volleyed into popularity by the Boosted Boards kickstarter.

Following on from the success of their original Boosted Board exploit, the team went on to get their hands on the other popular boards on the market, and predictably broke all of them.

Richo and Mike will investigate the security of several popular skateboards, including Boosted's flagship model and demonstrate several vulnerabilities that allow complete control of a an unmodified victim's skateboard, as well as other attacks on the firmware of the board and controller directly.

Richo likes his ducks flat and his instruction sets reduced. By day he works at Stripe as a security engineer, by night he writes (lots of) open source code, on everything from the rust compiler to debugging aids like voltron.

Twitter: @rich0H

Mike Ryan is a computer jerk who gets paid to do stupid crap like this. He spends roughly 40 hours a week steamrolling through eBay's network and likes to relax at home by sniffing Bluetooth.

Twitter: @mpeg4codec

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

When IoT attacks: hacking a Linux-powered rifle

Runa A. Sandvik

Michael Auger

TrackingPoint is an Austin startup known for making precision-guided firearms. These firearms ship with a tightly integrated system coupling a rifle, an ARM-powered scope running a modified version of Linux, and a linked trigger mechanism. The scope can follow targets, calculate ballistics and drastically increase its user's first shot accuracy. The scope can also record video and audio, as well as stream video to other devices using its own wireless network and mobile applications.

In this talk, we will demonstrate how the TrackingPoint long range tactical rifle works. We will discuss how we reverse engineered the scope, the firmware, and three of TrackingPoint's mobile applications. We will discuss different use cases and attack surfaces. We will also discuss the security and privacy implications of network-connected firearms.

Runa A. Sandvik is a privacy and security researcher, working at the intersection of technology, law and policy. She is a technical advisor to both the Freedom of the Press Foundation and the TrueCrypt Audit Project, and a member of the review board for Black Hat Europe.

Twitter: @runasand

Michael Auger is an experienced IT Security specialist with extensive experience in integrating and leveraging IT security tools. He has leveraged a wide range of IT security solutions, integrating them, to deliver leading edge incident response and security operations capabilities. His 15+ year career includes:

· Supporting security incidents during the event and the subsequent remediation phases

· Implementing and managing IT security infrastructures for public and private organizations.

· Design and implement global SIEM infrastructure for F100 organizations

· Delivering training on advanced SIEM solutions and network discovery tools

· Presenting and publishing security articles on security vulnerabilities and best practices

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Drinking from LETHE: New methods of exploiting and mitigating memory corruption vulnerabilities

Daniel Selifonov Engineer, Skyport Systems Inc

Memory corruption vulnerabilities have plagued computer systems since we started programming software. Techniques for transforming memory corruption primitives into arbitrary code execution exploits have evolved significantly over the past two decades, from "smashing the stack for fun and profit" to the current apex of "just in time code reuse" while playing a cat and mouse game with similarly evolving defensive mitigations: from PaX/NX-bit to fine-grained ASLR and beyond. By contextualizing this battle between attack and defense, I will demonstrate new defense strategies based on augmenting fine-grained ASLR with memory disclosure mitigations to render existing exploitation techniques unreliable. Modifications to the Xen hypervisor exploiting hardware accelerated virtualization extensions on the modern Intel platform enable realizing these new defense strategies without imposing significant runtime CPU overhead.

Daniel Selifonov is currently an engineer focused on information security, and in prior consultancies has built systems for information technology where security was considered throughout design and implementation, rather than as an afterthought. His research interests in security include reverse engineering, applied cryptography, client side security, and user acceptable information system design.

Social media names/links:

* GitHub: https://github.com/thyth/

* Personal Website: http://thyth.com/

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Breaking SSL Using Time Synchronisation Attacks

Jose Selvi Senior Security Consultant, NCC Group

What time? When? Who is first? Obviously, Time is strongly present in our daily life. We use time in almost everything we do, and computers are not an exception to this rule. Our computers and devices use time in a wide variety of ways such as cache expiration, scheduling tasks or even security technologies. Some of those technologies completely relies on the local clock, and they can be affected by a clock misconfiguration.

However, since most operating system providers do not offer secure time synchronisation protocols by default, an attacker could manipulate those protocols and control the local clock. In this presentation, we review how different operating systems synchronise their local clocks and how an attacker could exploit some of them in order to bypass different well-known security protections.

Jose Selvi is a Senior Penetration Tester at NCC Group. His 11 years of expertise performing advanced security services and solutions in various industries (government, telecom, retail, manufacturing, healthcare, financial, technology...) include mainly penetration tests and information security research in new technologies. He is also a SANS Institute community instructor for penetration testing courses and a regular speaker at security conferences (mostly in Spain)

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

"Quantum" Classification of Malware

John Seymour Ph.D. student, University of Maryland, Baltimore County

Quantum computation has recently become an important area for security research, with its applications to factoring large numbers and secure communication. In practice, only one company (D-Wave) has claimed to create a quantum computer which can solve relatively hard problems, and that claim has been met with much skepticism. Regardless of whether it is using quantum effects for computation or not, the D-Wave architecture cannot run the standard quantum algorithms, such as Grover’s and Shor’s. The D-Wave architecture is instead purported to be useful for machine learning and for heuristically solving NP-Complete problems.

We'll show why the D-Wave and the machine learning problem for malware classification seem especially suited for each other. We also explain how to translate the classification problem for malicious executables into an optimization problem which a D-Wave machine can solve. Specifically, using a 512-qubit D-Wave Two processor, we show that a minimalist malware classifier, with cross-validation accuracy comparable to standard machine learning algorithms, can be created. However, even such a minimalist classifier incurs a surprising level of overhead.

John Seymour is a Ph.D. student at the University of Maryland, Baltimore County, where he performs research at the intersection of machine learning and information security. He's mostly interested in avoiding and helping others avoid some of the major pitfalls in machine learning, especially in dataset preparation (seriously, do people still use malware datasets from 1998?) In 2014, he completed his Master’s thesis on the subject of quantum computation applied to malware analysis. He currently works at CyberPoint International, a company which performs network and host-based machine learning, located in Baltimore, MD.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Insteon' False Security And Deceptive Documentation

Peter Shipley Security Researcher

Ryan Gooler

Insteon is a leading home automation solution for controlling lights, locks, alarms, and much more. More than forty percent of homes with automation installed use Insteon.

For the last fifteen years, Insteon has published detailed documentation of their protocols—documentation that is purposely misleading, filled with errors, and at times deliberately obfuscated. As my research over the last year has revealed, this sad state of affairs is the direct result of Insteon papering over the fact that it is trivial to wirelessly take control, reprogram, and monitoring any Insteon installation.

Worse still, the embedded nature of the Insteon protocol coupled with devices that do not support flash updates means that there are no current fixes or workarounds short of ripping out the Insteon products.

I will be presenting my research, and releasing tools demonstrating the vulnerabilities throughout the Insteon home automation system.

Peter Shipley has been working with security for over 30 years. In the late 80's he wrote one of the first network security scanners and maintained one of the first bug databases ( later used to seed similar lists at CERT and llnl.gov ). Around the same time Peter co-founded UC Berkeley's OCF (Open Computing Facility).

In the mid 90's Peter Shipley became a founding member of cypherpunks & setup up one of the first official PGP distribution sites.

In '98 (DEF CON 6) Peter Shipley did a independent security research on war-dialing, exposing a significant security problem that was being ignored in most corporate environments making phone security.

At DEF CON 9 Peter Shipley introduced wardriving to the world. Recently Peter has written and released several APIs using python to link various networked automation appliances via REST and other interfaces.

Peter Shipley currently manages for a dot-com by day, and helps raise two kids by night.

Ryan Gooler (@jippen) is a cloud security guy, known for luck, sarcasm, and getting into things. Avid lockpicker, lover of cats, and disrespector of authority.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Scared Poopless – LTE and *your* laptop

Mickey Shkatov Security researcher, Intel Advanced Threat Research.

Jesse Michael Security researcher

With today’s advancement in connectivity and internet access using 3G and LTE modems it seems we all can have a device that’s always internet capable, including our laptops, tablets, 2 in 1’s ultrabook. It becomes easier to be online without using your WiFi at all.  In our talk we will demonstrate and discuss the exploitation of an internal LTE modem from Huawei which can be found in a number of devices including laptops by HP.

Mickey Shkatov is a security researcher and a member of the Intel Advanced Threat Research team. His areas of expertise include vulnerability research, hardware and firmware security, and embedded device security. Mickey has presented some of his past research at DEF CON, Black Hat USA, BruCON, and BsidesPDX

Twitter: @laplinker

Jesse Michael has been working in security for over a decade and is currently a security researcher at a Fortune 50 company who spends his time causing trouble and finding low-level hardware security vulnerabilities in modern computing platforms.

Twitter: @jessemichael

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Angry Hacking - the next generation of binary analysis

Yan Shoshitaishvili PhD Student, UC Santa Barbara

Fish Wang PhD Student, UC Santa Barbara

Security has gone from a curiosity to a phenomenon in the last decade. Fortunately for us, despite the rise of memory-safe, interpreted, lame languages, the security of binaries is as relevant as ever. On top of that, (computer security) Capture the Flag competitions have skyrocketed in popularity, with new and exciting binaries on offer for hacking every weekend.

This all sounds great, and it is. Unfortunately, the more time goes by, the older we get, and the more our skills fade. Whereas we were happy to stare at objdump a decade ago, today, we find the menial parts of reversing and pwning more and more tiring and more and more difficult. Worse, while security analysis tools have been evolving to make life easier for us hackers, the core tools that we use (like IDA Pro) have remained mostly stagnant. And on top of that, the term "binaries" have expanded to regularly include ARM, MIPS, PPC, MSP430, and every other crazy architecture you can think of, rather than the nice, comfortable x86 of yesteryear.

New tools are required, and we're here to deliver. Over the last two years, we have been working on a next-generation binary analysis framework in an attempt to turn back the tide and reduce our mounting noobness. The result is called angr.

angr assists in binary analysis by providing extremely powerful, state-of-the-art analyses, and making them as straightforward to use as possible. Ever wanted to know *what freaking value* some variable could take on in a function (say, can the target of a computed write point to the return address)? angr can tell you! Want to know what input you need to trigger a certain code path and export a flag? Ask angr! In the talk, we'll cover three of the analyses that angr provides: a powerful static analysis engine (able to, among other things, automatically identify potential memory corruption in binaries through the use of Value-Set Analysis), its symbolic execution engine, and dynamic emulation of various architectures (*super* useful for debugging shellcode).

On top of that, angr is designed to make the life of a hacker as easy as possible -- for example, the whole system is 98% Python, and is designed to be a breeze to interact with through iPython. Plus, it comes with a nifty GUI with nice visualizations for symbolically exploring a program, tracking differences between different program paths, and understanding value ranges of variables and registers. Finally, angr is designed to be easily extensible and embeddable in other applications. We'll show off a semantic-aware ROP gadget finder ("are there any gadgets that write to a positive offset of rax but don't clobber rbx" or "given this program state, what are the gadgets that won't cause a segfault") and a binary diffing engine, both built on angr.

We've used angr to solve CTF binaries, analyze embedded devices, debug shellcode, and even dabble in the DARPA Cyber Grand Challenge. We'll talk about our experiences with all of that and will release angr to the world, hopefully revolutionizing binary analysis and making everyone ANGRY!

Yan and Fish are two members of Shellphish, a pretty badass hacking team famous for low SLA and getting the freaking exploit JUST A FREAKING MINUTE LATE. Their secret identities are those of PhD students in the security lab of UC Santa Barbara. When they're not CTFing or surfing, they're doing next-generation (what does that even mean?) security research. Their works have been published in numerous academic venues. For example, in 2013, they created an automatic tool, called MovieStealer, a tool to automatically break the DRM of streaming media services [1]. After taking 2014 to work on angr, in 2015, they followed this up with an analysis of backdoors in embedded devices [2].

Now, they've set their sights on helping the world analyze binaries faster, better, stronger, by revolutionizing the analysis tool landscape!

[1] https://www.usenix.org/conference/usenixsecurity13/technical-sessions/paper/wang_ruoyu

[2] http://www.internetsociety.org/doc/firmalice-automatic-detection-authentication-bypass-vulnerabilities-binary-firmware

Twitter: @zardus

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

High-Def Fuzzing: Exploring Vulnerabilities in HDMI-CEC

Joshua Smith Senior Security Researcher, HP Zero Day Initiative

The HDMI (High Definition Multimedia Interface) standard has gained extensive market penetration.  Nearly every piece of modern home theater equipment has HDMI support and most modern mobile devices actually have HDMI-capable outputs, though it may not be obvious.  Lurking inside most modern HDMI-compatible devices is something called HDMI-CEC, or Consumer Electronics Control.  This is the functionality that allows a media device to, for example, turn on your TV and change the TV’s input.  That doesn’t sound interesting, but as we'll see in this presentation, there are some very surprising things an attacker can do by exploiting CEC software implementations.  Then there's something called HEC or HDMI Ethernet Connection, which allows devices to establish an Ethernet connection of up to 100Mbit/s over their HDMI connections (newer HDMI standards raise the speed to 1Gbit/s).

Don't think your mobile phone implements CEC?  You might be wrong.  Most modern Android-based phones and tablets have a Slimport(r) connection that supports HDMI-CEC.  Ever heard of MHL (Mobile High-Definition Link)?  Think Samsung and HTC (among other) mobile devices, and many JVC, Kenwood, Panasonic, and Sony car stereos – as many as 750 million devices in the world so far.  Guess what?  MHL supports HDMI-CEC as well. Let's explore, and own, this attack space.

Kernelsmith is senior vulnerability researcher with Hewlett-Packard Security Research (HPSR).  In this role, he analyzes and performs root-cause analysis on hundreds of vulnerabilities submitted to the Zero-Day Initiative (ZDI) program, which represents the world’s largest vendor-agnostic bug bounty program. His focus includes analyzing and performing root-cause analysis on hundreds of zero-day vulnerabilities submitted by ZDI researchers from around the world. Joshua is also a developer for the Metasploit Framework and has spoken at a few conferences and holds a few certifications.

Prior to joining HP, Smith served in the U.S. Air Force in various roles including as an Intercontinental Ballistic Missile (ICBM) Crew Commander and Instructor, but more relevantly as a penetration tester for the 92d Information Warfare Aggressor Squadron. Post-military, he became a security engineer at the John Hopkins University Applied Physics Lab, where he began contributing to the Metasploit Framework. Smith performed research into weapons systems vulnerabilities as well as evasion and obfuscation techniques to add depth and realism to security device tests. Smith received a B.S. in Aeronautical Engineering from Rensselaer Polytechnic Institute and an M.A. in Management of Information Systems from the University of Great Falls.

Smith was drawn to ZDI for the chance to work with a world-wide network of security researchers while continuing his own vulnerability research.  When not researching software vulnerabilities, Josh enjoys raising his two young hackers-to-be and watching sci-fi since he can't play sports anymore (there's no tread left on his knees).

Twitter: @kernelsmith, @thezdi

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Dissecting the Design of SCADA Web Human Machine Interfaces (HMIs) - Hunting Vulnerabilities

Aditya K Sood Architect - Threat Research Labs, Elastica inc.

Human Machine Interfaces (HMIs) are the subsets of the Supervisory Control and Data Acquisition (SCADA) systems. HMIs are control panels that provide interfaces for humans to interact with machines and to manage operations of various types of SCADA systems. HMIs have direct access to SCADA databases including critical software programs. The majority of SCADA systems have web-based HMIs that allow the humans to control the SCADA operations remotely through Internet. This talk unveils various flavors of undisclosed vulnerabilities in web-based SCADA HMIs including but not limited to remote or local file inclusions, insecure authentication through clients, weak password hashing mechanisms, firmware discrepancies, hardcoded credentials, insecure web-services, weak cryptographic design, cross-site request forgery, and many others. This talk digs deeper into the design models of various SCADA systems to highlight security deficiencies in the existing SCADA HMI deployments. The research is driven with a motivation to secure SCADA devices and to build more intelligent solutions by hunting vulnerabilities in SCADA HMIs. The vulnerabilities presented in this talk are completely undisclosed and will be revealed for the first time with live demonstrations.

Aditya K Sood (Ph.D) is a senior security researcher and consultant. Dr. Sood has research interests in malware automation and analysis, application security, secure software design and cybercrime. He has worked on a number of projects pertaining to penetration testing specializing in product/appliance security, networks, mobile and web applications while serving Fortune 500 clients for IOActive, KPMG and others. He is also a founder of SecNiche Security Labs, an independent web portal for sharing research with security community. He has authored several papers for various magazines and journals including IEEE, Elsevier, CrossTalk, ISACA, Virus Bulletin, Usenix and others. His work has been featured in several media outlets including Associated Press, Fox News, Guardian, Business Insider, CBC and others. He has been an active speaker at industry conferences and presented at BlackHat, DEF CON, HackInTheBox, RSA, Virus Bulletin, OWASP and many others. Dr. Sood obtained his Ph.D from Michigan State University in Computer Sciences. Dr. Sood is also an author of "Targeted Cyber Attacks" book published by Syngress.

Company Website: http://www.elastica.net

Personal website: http://adityaksood.secniche.org

Twitter: @AdityaKSood

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Shall We Play a Game?

Tamas Szakaly Lead security researcher @ PR-Audit Ltd., Hungary

Everybody plays games, and a whole lot of people plays computer games. Despite this fact, very few of us, security researchers consider them as interesting targets. Granted, you won't likely be able to directly hack into a big corporate network via game exploits, but you could for example target the people running the company via their favorite games. Or their children's favorite games. Another scenario: you should consider that a hacked game could allow Not So Admirable people access to your internal network - which at first does not seem that big of a deal considering it's "just" a home network, but when you realize all your mobile phones, your TV set, your VOIP phones, your security cameras, and even your smart house sensors and controllers are part of that network, it looks much more scary.

Games are also interesting from a technical standpoint too, since they tend to be quite complex. The majority of them have networking, and they process complex data structures (maps, saved games, etc.) which makes them ideal fuzzing targets. But this talk is not about those kind of exploits. Hackers tend to ignore the low hanging fruits in favor of beautiful exploits, but we really shouldn't - bad guys don't care about how sophisticated some exploit is, they only care about the results. This is why I have decided to take a look around and see what's already there in the games that allows access to the gamers' network. Thus this research about how game scripting engines can be abused started.

I'll show in this talk that playing on custom game servers and playing community created maps could easily lead to code execution on our machines - more so, in most cases without the need to bypass the operating system's exploit mitigation techniques. My targets include popular games and game engines like CryEngine 3, Dota 2, Garry's Mod, ARMA3 and Digital Combat Simulator. I'll show a wide range of script abuse from a simple direct command execution in an unrestricted scripting environment through brute forcing a security camera via HTTP requests to complex script sandbox escapes.

Tamas is the lead IT security researcher at PR-Audit Ltd., a company focusing mainly on penetration testing and SIEM software developing. Previously he participated in a cooperation between ELTE Department of Meteorology and the Paks Nuclear Power Plant Ltd. which goal was to develop TREX, a toxic waste emission simulator using CUDA. The scene from RoboCop where the kid defeats the evil robot with just a laptop and a serial cable made a huge impression on him, and after seeing the movie, his path was set: he was bound to be a hacker. His first experiences in this field involved poking around various copy protection schemes, and for this day his favorite areas of expertise are the ones that require some mangling of binary files. Besides computer security he also loves mountain biking and flight simulators.

Twitter: @sghctoma

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

DIY Nukeproofing: a new dig at "data-mining"

3AlarmLampscooter enigmatic armored mammal

Does the thought of nuclear war wiping out your data keep you up at night? Don't trust third party data centers? Few grand burning a hole in your pocket and looking for a new Sunday project to keep you occupied through the fall? If you answered yes to at least two out of three of these questions, then 3AlarmLampscooter's talk on extreme pervasive communications is for you! You'll learn everything from calculating radiation half layer values to approximating soil stability involved in excavating your personal apocalypse-proof underground data fortress.

3AlarmLampscooter is an enigmatic armored mammal of the genus homo sapiens sapiens sapiens troglodytae found in caves and tunnels across the southeastern United States. As moderator of the subreddit /r/Neutron, 3AlarmLampscooter's enunciation espouses pervasive communication via excavation to protect from radiation and conflagration. When above-ground, 3AlarmLampscooter is a vocal transhumanism advocate developing 3D printed construction materials.

www.reddit.com/u/3AlarmLampscooter

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Hacking the Human Body/brain: Identity Shift, the Shape of a New Self, and Humanity 2.0

Richard Thieme Author and Professional Speaker, ThiemeWorks

This presentation is beyond fiction.

Current research in neuroscience and the extension and augmentation of senses is proceeding in directions that might sound to a twentieth century mind like science fiction. Progress is rapid but unevenly distributed: Some is directed by military, intelligence and corporate interests but beyond their concerns, we can discern the future shape of human identity itself in nascent forms.

The human body/brain is being hacked to explore radical applications for helping, healing, and harming this and future generations. Some can be done in garage-hacking style. The presenter, in fact, recently had lenses in both eyes removed and replaced with artificial ones engineered for the vision he wanted, a now-trivial surgery. The reach of new technologies promises an even more radical transformation in what it means to be human.

One area of research is the recovery of memories, the deletion of emotional charges from memories, the removal of specific memories, the alteration of the content of memories, and the implantation of new memories. Another seeks to read the mind at a distance and extract information. Another explores the use of genomes to understand and replicate thinking, feeling, and behavior patterns. Another implements mind-to-mind communication, using neuroscience to understand brains best suited for remote viewing as well as implants and non-invasive technologies that control the electromagnetic energies of the brain to enable psychokinesis, clairvoyance and telepathy.

Augmentation of human abilities is being achieved by splicing information from sensors integrated with existing neurological channels. To feel the magnetic field of the earth, see the infrared and ultraviolet parts of the electromagnetic spectrum, discern the yaw and pitch of airplanes, see and hear by going around our eyes and ears -- all this means we will experience the “self” in new ways.

Thieme concludes with quotes from remote viewer Joe McMoneagle, astronaut Edgar Mitchell, and his new novel FOAM to suggest the shape of the mind of the future. If you're 20 years old, you have at least a century of productive life ahead of you, so you had better be on board with the shape of your future selves. :-)

Richard Thieme is an author and professional speaker focused on the challenges posed by new technologies and the future, how to redesign ourselves to meet these challenges, and creativity in response to radical change and identify shift. He has explored issues raised in this DEF CON 23 presentation for 20 years but raises his game to outline the shape of the future self, defining it as a system open to modification and hacking, giving the term “biohacking” new and compelling meaning.

His column, "Islands in the Clickstream," was distributed to subscribers in sixty countries before collection as a book in 2004. When a friend at the NSA said after they worked together on intelligence issues, "The only way you can tell the truth is through fiction," he returned to writing short stories, 19 of which are collected in “Mind Games.” He is co-author of the critically extolled “UFOs and Government: A Historical Inquiry,” a 5-year research project using material exclusively from government documents and other primary sources, now in 50 university libraries. A recently completed novel FOAM explores the existential challenges of what it means to be human in the 21st century. “The UFO History Group” is exploring a second volume and Thieme is selecting “the best of” his diverse writings for “A Richard Thieme Reader” and writing more fiction.

Thieme's work has been taught at universities in Europe, Australia, Canada, and the United States, and he has guest lectured at numerous universities, including Purdue University (CERIAS), the Technology, Literacy and Culture Distinguished Speakers Series of the University of Texas, and the “Design Matters” lecture series at the University of Calgary. He keynoted a conference on metadata this spring for the U of Texas-San Antonio. He addressed the reinvention of “Europe” as a “cognitive artifact” for curators and artists at Museum Sztuki in Lodz, Poland and keynoted “The Real Truth: A World’s Fair” at Raven Row Gallery, London. He has spoken for the National Security Agency, the FBI, the Secret Service, the US Department of the Treasury, Los Alamos National Labs and has keynoted “hacker” and security conferences around the world.

Twitter and skype: neuralcowboy:

Facebook and LinkedIn: Richard Thieme

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

From 0 To Secure In 1 Minute — Securing IAAS

Nir Valtman CISO – Retail, NCR

Moshe Ferber Co-chairman of the board, Cloud Security Alliance Israel

Recent hacks to IaaS platforms reveled that we need to master the attack vectors used: Automation and API attack vector, insecure instances and management dashboard with wide capabilities. Those attack vectors are not unique to Cloud Computing but there are magnified due to the cloud characteristics. The fact is that IaaS instance lifecycle is accelerating, nowadays we can find servers that are installed, launched, process data and terminate - all within a range of minutes. This new accelerated lifecycle makes traditional security processes such as periodic patches, vulnerability scanning, hardening, and forensics impossible. In this accelerated lifecycle, there are no maintenance windows for patches or ability to mitigate vulnerability, so the security infrastructure must adapt to new methods. In this new thinking, we require automation of instance security configuration, hardening, monitoring, and termination. Because there are no maintenance windows, Servers must be patched before they boot up, security configuration and hardening procedures should be integrated with server installation and vulnerability scanning and mitigation processes should be automatic.

In the presentation, we plan to announce the full version of a new open source tool called "Cloudefigo" and explain how it enables accelerated security lifecycle. We demonstrate how to launch a pre-configured, already patched instance into an encrypted storage environment automatically while evaluating their security and mitigating them automatically if a vulnerability is found. In the live demo, we leverage Amazon Web Services EC2 Cloud-Init scripts and object storage for provisioning automated security configuration, integrating encryption, including secure encryption key repositories for secure server's communication. The result of those techniques is cloud servers that are resilient, automatically configured, with the reduced attack surface.

Nir is employed at NCR Corporation as the CISO of NCR Retail. Before the acquisition of Retalix by NCR, he was Chief Security Officer of R&D at the company. As part of his previous positions in the last decade, he worked as Chief Security Architect, Senior Technology Consultant, Application Security Consultant, Systems Infrastructure Security Consultant, and a Technological Trainer. While in these positions, Nir was not only consulting, but also performing hands-on activities in various fields, i.e. hardening, penetration testing, and development for personal/internal applications. In addition, Nir is a public speaker (spoke on BlackHat, DEF CON, OWASP, InfoSec etc.) and open source contributor. Among his contributions, he released an open source anti-defacement tool called AntiDef, and wrote a publication about QRbot, an iPhone QR botnet POC he developed. His latest open source tool is Cloudefigo, which planned to be presented in the conference. Nir has a BSc in Computer Science but his knowledge is based mainly on cowboy learning and information sharing with the techno-oriented communities.

Moshe Ferber is an information security entrepreneur and one of the cornerstones of the information security industry in Israel, with over 20 years of experience in various industry the leading positions such as the Security manager for Ness Technologies and founder of leading MSSP services provider. Currently Mr. Ferber focuses in promoting innovation in the Israeli startup scene as an investor, lecturer and evangelist for various cloud security topics. Mr. Ferber is a popular industry speaker and promote cloud security best practices and official lecturer for the Cloud Security Alliance.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Looping Surveillance Cameras through Live Editing of Network Streams

Eric Van Albert independent security researcher

Zach Banks independent security researcher

This project consists of the hardware and software necessary to hijack wired network communications. The hardware allows an attacker to splice into live network cabling without ever breaking the physical connection. This allows the traffic on the line to be passively tapped and examined. Once the attacker has gained enough knowledge about the data being sent, the device switches to an active tap topology, where data in both directions can be modified on the fly. Through our custom implementation of the network stack, we can accurately mimic the two devices across almost all OSI layers.

We have developed several applications for this technology. Most notable is the editing of live video streams to produce a “camera loop,” that is, hijacking the feed from an Ethernet surveillance camera so that the same footage repeats over and over again. More advanced video transformations can be applied if necessary. This attack can be executed and activated with practically no interruption in service, and when deactivated, is completely transparent.

Eric is a recent MIT graduate who spends his days building 3D printers for Formlabs and his nights crawling around places he probably shouldn’t. He has taught seminars on lockpicking and physical security vulnerabilities to various audiences at the Institute, and done a small bit of security consulting work. When he runs out of projects to hack on, he reads the leaked NSA ANT catalog for ideas.

Zach is also a recent MIT graduate with over 0 years of security experience. He’s particularly interested in the security of embedded devices and knots. In his free time, he enjoys putting household appliances on the internet and refactoring his old code.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Machine vs. Machine: Inside DARPA’s Fully Automated CTF

Michael Walker Program Manager, DARPA/I2O

Jordan Wiens CTF A(p|nthro)pologist @vector35.com

For 22 years, the best binary ninjas in the world have gathered at DEF CON to play the world’s most competitive Capture-the-Flag. At DEF CON 24, DARPA will challenge machines to play this game for the first time, with the winner taking home a $2 million prize. This talk will include a first public look at the machines, teams, technology, and visualization behind Cyber Grand Challenge. The technology: machines that discover bugs and build patches? We’re bringing our qualifier results to show just how real this is. The teams: we’ll talk about the finalists who prevailed to make it to the CGC final round. Visualization: the product of CTF players working with game designers, this talk will include a live interactive demo of a graphical debugger for everyone that will let an audience follow along in real time. The machines: we’re bringing high performance computing to the DEF CON stage. The event: In 2016, machines will Capture the Flag! Follow DARPA Cyber Grand Challenge on Twitter: #DARPACGC

Mike Walker joined DARPA as a program manager in January 2013. His research interests include machine reasoning about software in situ and the automation of application security lifecycles.

Prior to joining DARPA, Mr. Walker worked in industry as a security software developer, Red Team analyst, enterprise security architect and research lab leader. As part of the Computer Science Corporation "Strikeforce" Red Team, Mr. Walker helped develop the HEAT Vulnerability Scanner and performed Red Team engagements. Serving as a principal at the Intrepidus Group, Mr. Walker worked on Red Teams that tested America's financial and energy infrastructure for security weaknesses. Also, on the DARPA SAFER Red Team, Mr. Walker discovered flaws in prototype communications technologies.

Mr. Walker has participated in various roles in numerous applied computer security competitions. He contributed challenges to DEF CON Capture the Flag (CTF) and competed on and led CTF teams at the highest levels of international competition. Mr. Walker was formerly a mentor of the Computer Security Competition Club at Thomas Jefferson High School for Science and Technology (TJHSST).

Jordan started his professional career at the University of Florida where he got to do a little bit of everything security related. His love of CTFs, however, drove him to a job at a government contractor where he honed his reverse engineering and vulnerability research skills. Now, his goal in life is to become a professional CTF e-sports caster so he founded a startup Vector 35 to try to get paid to do stuff with CTFs and gaming.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Pivoting Without Rights – Introducing Pivoter

Geoff Walton Senior Security Consultant for Cleveland-based TrustedSec

Dave Kennedy (ReL1K/HackingDave), founder of TrustedSec and Binary Defense Systems

One of the most challenging steps of a penetration test is popping something and not having full administrative level rights over the system. Companies are cutting back on administrative level rights for endpoints or how about those times where you popped an external web application and were running as Apache or Network Service? Privilege escalation or pillaging systems can be difficult and require extensive time if successful at all. One of the most challenging aspects around pentesting was the need to have administrative level rights, install your tools, and from there leverage the compromised machine as a pivot point for lateral movement in the network. Well, the time has changed. Introducing Pivoter – a reverse connection transparent proxy that supports the ability to pivot with ease. Pivoter is a full transparent proxy that supports the ability to use limited rights on a system to pivot to other systems and attack transparently from your system at home. Port scans, exploits, brute forcing, anything you could do like you were on that network is now available through Pivoter. As part of this talk, we’ll be releasing a new Metasploit module for shell DLL injection for AV evasion, a Linux version of Pivoter, a Windows version of Pivoter, and a PowerShell version of Pivoter. msf> run pivoter -> pentest as if you are on the internal network even if you don’t have admin rights. Also during this talk, we’ll be releasing a new major release of the Social-Engineer Toolkit (SET) which incorporates Pivoter into the payload delivery system.

Geoff Walton is a Senior Security Consultant for Cleveland-based TrustedSec. He joined after years of working in information security. Geoff’s expertise in pen testing, network security, and software analysis comes form over ten years experience in a variety of information technology roles including software development, network operations and information security specific functions; Geoff brings broad vision to assessments and penetration test engagements. Geoff has been part of diverse IT teams at organizations both large and small. He has experience across several industries including retail, professional services, and manufacturing.

Dave Kennedy is founder of TrustedSec and Binary Defense Systems. Both organizations focus on the betterment of the security industry from an offense and a defense perspective. David was the former Chief Security Officer (CSO) for a Fortune 1000 company where he ran the entire information security program. Kennedy is a co-author of the book "Metasploit: The Penetration Testers Guide," the creator of the Social-Engineer Toolkit (SET), and Artillery. Kennedy has been interviewed by several news organizations including CNN, Fox News, MSNBC, CNBC, Katie Couric, and BBC World News. Kennedy is the co-host of the social-engineer podcast and on a number of additional podcasts. Kennedy has testified in front of Congress on two occasions on the security around government websites. Kennedy is one of the co-authors of the Penetration Testing Execution Standard (PTES); a framework designed to fix the penetration testing industry. Kennedy is the co-founder of DerbyCon, a large-scale conference in Louisville Kentucky. Prior to Diebold, Kennedy was a VP of Consulting and Partner of a mid-size information security consulting company running the security consulting practice. Prior to the private sector, Kennedy worked for the United States Marine Corps and deployed to Iraq twice for intelligence related missions.

Twitter: @HackingDave

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

'DLL Hijacking' on OS X? #@%& Yeah!

Patrick Wardle, Director of R&D, Synack

Remember DLL hijacking on Windows? Well, turns out that OS X is fundamentally vulnerable to a similar attack (independent of the user's environment).

By abusing various 'features' and undocumented aspects of OS X's dynamic loader, this talk will reveal how attackers need only to plant specially-crafted dynamic libraries to have their malicious code automatically loaded into vulnerable applications. Through this attack, adversaries can perform a wide range of malicious actions, including stealthy persistence, process injection, security software circumvention, and even 'remote' infection. So come watch as applications fall, Gatekeeper crumbles (allowing downloaded unsigned code to execute), and 'hijacker malware' arises - capable of bypassing all top security and anti-virus products! And since "sharing is caring" leave with code and tools that can automatically uncover vulnerable binaries, generate compatible hijacker libraries, or detect if you've been hijacked.

Patrick Wardle is the Director of Research at Synack, where he leads cyber R&D efforts. Having worked at NASA, the NSA, and Vulnerability Research Labs (VRL), he is intimately familiar with aliens, spies, and talking nerdy. Currently, Patrick’s focus is on automated vulnerability discovery, and the emerging threats of OS X and mobile malware.

In his personal time, Patrick collects OS X malware and writes OS X security tools. Both can be found on his website Objective-See.com

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Stick That In Your (root)Pipe & Smoke It

Patrick Wardle Director of R&D, Synack

You may ask; "why would Apple add an XPC service that can create setuid files anywhere on the system - and then blindly allow any local user to leverage this service?" Honestly, I have no idea!

The undocumented 'writeconfig' XPC service was recently uncovered by Emil Kvarnhammar, who determined its lax controls could be abused to escalate one's privileges to root. Dubbed ‘rootpipe,' this bug was patched in OS X 10.10.3. End of story, right? Nope, instead things then got quite interesting. First, Apple decided to leave older versions of OS X un-patched. Then, an astute researcher discovered that the OSX/XSLCmd malware which pre-dated the disclosure, exploited this same vulnerability as a 0day! Finally, yours truly, found a simple way to side-step Apple's patch to re-exploit the core vulnerability on a fully-patched system. So come attend (but maybe leave your MacBooks at home), as we dive into the technical details XPC and the rootpipe vulnerability, explore how malware exploited this flaw, and then fully detail the process of completely bypassing Apple's patch. The talk will conclude by examining Apple’s response, a second patch, that appears to squash ‘rootpipe’…for now.

Patrick Wardle is the Director of Research at Synack, where he leads cyber R&D efforts. Having worked at NASA, the NSA, and Vulnerability Research Labs (VRL), he is intimately familiar with aliens, spies, and talking nerdy. Currently, Patrick’s focus is on automated vulnerability discovery, and the emerging threats of OS X and mobile malware.

In his personal time, Patrick collects OS X malware and writes OS X security tools. Both can be found on his website Objective-See.com

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Confessions of a Professional Cyber Stalker

Ken Westin Sr. Security Analyst with Tripwire Inc.

For several years I developed and utilized various technologies and methods to track criminals leading to at least two dozen convictions. In the process of recovering stolen devices, larger crimes would be uncovered including drugs, theft rings, stolen cars, even a violent car jacking. Much of the evidence in these cases would be collected by stolen devices themselves, such as network information, photos captured from laptops and cell phones, but often times there was additional data that would need to be gathered for a conviction. In this presentation I will walk through actual real cases and discuss in depth the technologies used and additional processes I went through utilizing open source data and other methods to target criminals. I will also discuss how these same tools and methods can be used against the innocent and steps users and developers can take to better protect privacy.

In this presentation here are a few examples of cases I worked on which I will reveal details of:

- How a theft ring targeting Portland, Oregon schools was unveiled leading to multiple convictions

- How I tracked and recovered $9K worth of stolen camera equipment sold multiple times a year after it was stolen based on data extracted from images online

- How mobile phones stolen from a wireless store were tracked leading to the arrest of a theft ring, leading to the conviction of six people and the recovery of a stolen car

- Embedding of custom designed trojan for thermal imaging devices for theft tracking and export controls

- Tracking of a stolen flash drive to a university computer lab and correlation of security camera and student access ID cards

- Tracking a stolen laptop across state lines and how I gathered mountains of evidence in another theft ring case

- Several other cases….

Ken is a security analyst and "creative technologist" with 15 years experience building and breaking things through the use/misuse of technology. His technology exploits and endeavors have been featured in Forbes, Good Morning America, Dateline, the New York Times and others. He has worked with law enforcement and journalists utilizing various technologies to unveil organized crime rings, recover stolen cars, even a car jacking amongst other crimes.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

How to Train Your RFID Hacking Tools

Craig Young Security Researcher, Tripwire VERT

With insecure low frequency RFID access control badges still in use at businesses around the world and high frequency NFC technology being incorporated into far more consumer products, RFID hacking tools are invaluable for penetration testers and security researchers alike. Software defined radio has revolutionized this field with powerful devices like Proxmark3 and RFIDler available for a modest price. 3D printing has also presented new opportunities for makers to create custom antennas and cases to fit specific tasks. While there is a lot of great information out there about how people use these tools, there is relatively little more than source code available for learning how to develop new firmware to equip these devices with purpose-built logic. This presentation will discuss the overall architecture of the Proxmark3 and RFIDler tools and provide tutorial style examples for enhancing the firmware. Proxmark3 development will be demonstrated by upgrading the stand-alone mode to support NFC operations. For the new kid on the block, RFIDler, we will take a look at how to tweak the system for optimal reliability using 3D printing and enhanced diagnostic tools.

Craig Young (@CraigTweets) is a computer security researcher with Tripwire's Vulnerability and Exposures Research Team (VERT). He has identified and responsibly disclosed dozens of vulnerabilities in products from Google, Amazon, IBM, NETGEAR, Adobe, HP, and others. His research has resulted in numerous CVE assignments and repeated recognition in the Google Application Security Hall of Fame. Craig's presentations on Google authentication weaknesses have led to considerable security improvements for all Google users. Craig won in track 0 and track 1 of the first ever SOHOpelessly Broken contest at DEF CON 22 by demonstrating 10 0-day flaws in SOHO wireless routers. Craig has more recently turned his attention to a different part of the wireless spectrum with research into home automation products as well as RFID/NFC technology.

Twitter: @CraigTweets

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Investigating the Practicality and Cost of Abusing Memory Errors with DNS

Luke Young Information Security Engineer, Hydrant Labs LLC

In a world full of targeted attacks and complex exploits this talk explores an attack that can simplified so even the most non-technical person can understand, yet the potential impact is massive:

Ever wonder what would happen if one of the millions of bits in memory flipped value from a 0 to a 1 or vice versa? This talk will explore abusing that specific memory error, called a bit flip, via DNS.

The talk will cover the various hurdles involved in exploiting these errors, as well as the costs of such exploitation. It will take you through my path to 1.3 million mis-directed queries a day, purchasing hundreds of domain names, wildcard SSL certificates, getting banned from payment processors, getting banned from the entire Comcast network and much more.

Luke Young (@innoying) - is a freshman undergraduate student pursuing a career in information security. As an independent researcher, he has investigated a variety of well-known products and network protocols for design and implementation flaws. His research at various companies has resulted in numerous CVE assignments and recognition in various security Hall of Fames. He currently works as an Information Security Intern at LinkedIn.

Twitter: @innoying

LinkedIn: www.linkedin.com/in/innoying

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Security Necromancy: Further Adventures in Mainframe Hacking

Philip Young aka Soldier of Fortran, Chief Mainframe Hacker

Chad "Bigendian Smalls” Rikansrud President of Mainframe Hacking

You thought they were dead didn't you? You thought "I haven't seen a mainframe since the 90s, no one uses those anymore." Well you're wrong. Dead wrong. If you flew or drove to DEF CON your information was hitting a mainframe. Did you use credit or cash at the hotel? Doesn't matter, still a mainframe. Did you pay taxes, or perhaps call 911? What about going to the doctor? All using mainframes. At multiple points throughout the day, even if you don't do anything, your data is going through some mainframe, somewhere. 1984? Yeah right, man. That's a typo. Orwell is here now. He's livin' large. So why is no one talking about them?

SoF & Bigendian Smalls, aka 'the insane chown posse', will dazzle and amaze with feats of hackery never before seen on the mainframe. From fully breaking network job entry (NJE) and their concept of trusted nodes, to showing you what happens when you design security in the 80s and never update your frameworks. We'll demonstrate that, yes Charlie Brown, you can in fact overflow a buffer on the mainframe. New tools will be released! Things like SET'n'3270 (SET, but for mainframes!) and VTAM walker (profiling VTAM applications). Updates to current tools will be released (nmap script galore!) everything from accurate version profiling to application ID brute forcing and beyond. You'll also learn how to navigate IBM so you can get access to your very own mainframe and help continue the research that we've started!

All of your paychecks rely on mainframes in one form or another, so maybe we should be talking about it.

Soldier of Fortran: Protect ya REXX! Soldier of Fortran has an unhealthy relationship with mainframes. Being a hacker from way back in the day (BBS and X.25 networks) he was always enamored by the idea of hacking mainframes. Always too expensive and mysterious he settled on hacking windows and linux machines. However, despite not having his own he conducted numerous security engagements against mainframes, slowly developing his skills, until 2010 when he finally got his very own. Not having to worry about system uptime or affecting users he dove in head first and was surprised by what he found. Ever since he has been telling anyone who will listen to him the importance of mainframe security, hacking and research. He’s spoken both domestically and internationallyon the topic, been a guest speaker at multiple conferences, developed tools for mainframe penetration testing and has even keynoted at large mainframe conferences about this topic.

Bigendian Smalls: BS ain't no chump, takin' apart everything as a child just to see how it works invariable led him to security. From BBSin' back in the day to placing second in the network forensics challenge last year he knows what he's doing. At work and at home he does vulnerability research, forensics and disassembly of all things both on hardware and software. Knowing no system is secure and seeing how closed the source, community and information around the mainframe is he got worried. Worried that the code was as secure as they said it was. Worried that because no one is looking, developers are getting away with murder. Sure, IBM says they got their shit together, but then again so does Oracle, CISCO, Fireeye etc . Having worked on mainframes for more than a decade he knows how frustrating this is. With books from the 80s and forum posts from the 90s being of very little value, he aims to help drive the future of mainframe security research.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Build a free cellular traffic capture tool with a vxworks based femoto

Yuwei Zheng Senior security researcher, Qihoo 360 Technology Co. Ltd.

Haoqi Shan Wireless/hardware security researcher, Qihoo 360 Technology Co. Ltd.

In recent years, more and more products, are integrated with cellular modem, such as cars of BMW, Tesla, wearable devices, remote meters, i.e. Internet of things. Through this way, manufactories can offer remote service and develop a lot of attractive functions to make their product more valuable. However, many vulnerabilities have also been introduced into these systems.

It puts new questions to black-box penetration testing engineer. How to capture the SMS command between the cellular modem and the remote server? How to intercept the data link?

Some existing solutions, such as USRP based OpenBTS, commercial product nanoBTS can be used to build a fake base station and capture data traffic. However all of them cannot access the real operator's core network so that they cannot capture real SMS and voice traffic.

With the inspiration from social engineering, we got a femto-cell base station from a telecom operator. After a series of hacking and modifications, we built it as a powerful SMS, voice and data link inception tool. Furthermore, not like a fake station, it’s a legal base station and authorized to access the operator’s core network. By this tool, we can conveniently explore vulnerabilities of cellular modem inside products.

Yuwei Zheng is a senior security researcher concentrated in embedded systems over 10 years. He had reversed blackberry BBM, PIN, BIS push mail protocol , and decrypted the network stream successfully in 2011. After that, one year later, he finished a MITM attack for blackberry BES, which based on a modified ECMQV protocol of RIM. At the Qtr4 of 2014, he entered wireless security research group, Unicorn Team, in Qihoo 360 China. Now he is focusing on the security issues of embedded hardware and IOT systems.

Twitter: @hwiosec

Haoqi Shan is currently a wireless/hardware security researcher in Unicorn Team, Qihoo 360 Technology Corporation. He obtained bachelor degree of electronic engineering in Harbin Engineering University, China, in 2015. He focuses on Wi-Fi penetration, GSM system, router/switcher hacking etc. Other research interests include mobile phone application security, reverse engineering on embedded devices such as femto-cell base station, video cameras.

Return to Top   -  Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -  WOS Talks List  -  WShops Talks List  -  DL Talks List

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Wall of Sheep Talks List

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

802.11 Monitoring with PCAP2XML/SQLite

Vivek Ramachandran, Founder, SecurityTube.net and Pentester Academy

802.11 monitoring, attack detection and forensics has always been hard. It's almost immpossible to get any meaningful inference if one relies only on Wireshark filters. This is why we created Pcap2XML/SQLite, a tool to convert 802.11 trace files into equivalent XML and SQLite formats. Every single packet header field is mapped to a corresponding SQLite column. This allows us to create arbitrary queries on the packet trace file and we will show how this can be used for attack detection and forensics with live examples.

Vivek Ramachandran (Twitter: @securitytube ) Vivek discovered the Caffe Latte attack, broke WEP Cloaking and publicly demonstrated enterprise Wi-Fi backdoors. He is the author of two best selling books on Wi-Fi Security and Pentesting which have sold over 13,000+ copies worldwide. He is the founder of SecurityTube.net and runs SecurityTube Training & Pentester Academy which has trained professionals from 90 countries. He has spoken and trained at a number of conferences including DEF CON, Black Hat USA / Europe / Abu Dhabi, Brucon, Hacktivity.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Creating REAL Threat Intelligence With Evernote

grecs, Founder, NovaInfosec.com

In the presentation that threat intel vendors do not want you to see, threat data from open source and home grown resources meets Evernote as the ultimate braindump repository with the outcome of producing real actionable threat intelligence that your organization can leverage to stop the bad guys. This presentation discusses an experiment of using Evernote as a informal threat intelligence management platform, the specific concepts and strategies used, and its overall effectiveness. Specific topics covered include the advantages of using an open and flexible platform that can be molded into an open/closed source threat data repository, an information sharing platform, and an incident management system. Although using Evernote in this way in large enterprises is probably not possible, organizations can apply the same reference implementation to build similarly effective systems using open source or commercial solutions.

Salvador Grec (Twitter: @grecs ) grecs has almost two decades of experience, undergraduate and graduate engineering degrees, and a really well known security certification. Despite his formal training, grecs has always been more of a CS person at heart going back to his VIC-20, Commodore 64, and high school computer club days. After doing the IT grind for five years, he discovered his love of infosec and has been pursuing this career ever since. Currently, he spends his days improving and architecting SOC solutions. At night he runs a local infosec website where he discusses his latest security research and offers his commentary on the world of cyber.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

The Digital Cockroach Bait Station: How to Build Spam Honeypots

Robert Simmons, Senior Threat Intelligence Researcher, ThreatConnect, Inc.

Spam honeypots are an excellent way to gather malware binaries as well as malicious URLs that attackers use to infect their targets. Many malware campaigns are shotgun blasts of emails sent to very large numbers of email addresses. If you can get your bait address on their list, they essentially send you a copy of the malware or the URL that leads to it. This talk will cover how to setup a spam honeypot for gathering these types of threats. It will also cover how to efficiently sort through the data coming in, what data points are valuable to include in your analysis, and finally how and where to share the threat data that you are gathering. The goal is to give one the tools they need to protect themselves from emerging threats as they appear in the wild.

Robert Simmons (Twitter: @MalwareUtkonos ) Robert is a Senior Threat Intelligence Researcher for ThreatConnect, Inc. With an expertise in building automated malware analysis systems based on open source tools, he has been tracking malware and phishing attacks and picking them apart for years. Robert has a background in biology, linguistics, and Russian area studies. He has lived extensively in Russia and Ukraine and has been known to swear profusely and constantly in Russian.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

dnstap - A Standard Interface to Real Time DNS Transaction Flows

Paul Vixie, CEO, Farsight Security, Inc.

DNS is a high volume low latency datagram protocol at the heart of the Internet -- it enables almost all other traffic flows. Any analysis of network traffic for security purposes will necessarily include contemporaneous DNS traffic which might have resulted from or directed that traffic. Netflow by itself can answer the question, "what happened?" but it cannot by itself answer the equally important question, "why?"

Collecting DNS query and response data has always been challenging due to the impedance mismatch between DNS as an asynchronous datagram service and available synchronous persistent storage systems. Success in DNS telemetry has historically come from the PCAP/BPF approach, where the collection agent reassembles packets seen 'on the wire' into DNS transaction records, with complete asynchrony from the DNS server itself. It is literally and always preferable to drop transactions from the telemetry path than to impact the operation a production DNS server in any way.

BPF/PCAP is not a panacea, though, since the complexity of state-keeping means that most passive DNS collectors are blind to TCP transactions, and all are blind to data elements which don't appear on the wire, such as cache purge or cache expiration events, or to "view" identifiers or current delegation point. The Farsight Security team has therefore designed a new open source and open protocol system called 'dnstap' with a transmission/reception paradigm that preserves the necessary lossiness of DNS transaction collection while avoiding the state-keeping of BPF/PCAP based systems.

This talk will cover passive DNS including collection, sharing, post-processing, database construction, and access, using the Farsight Security system as a model. 'dnstap' will be introduced in that context, including a status report and road-map.

Dr. Paul Vixie (Twitter: @paulvixie ) Paul is the CEO of Farsight Security. He previously served as President, Chairman and Founder of Internet Systems Consortium (ISC), as President of MAPS, PAIX and MIBH, as CTO of Abovenet/MFN, and on the boards of several for-profit and non-profit companies. He served on the ARIN Board of Trustees from 2005 to 2013, as ARIN Chairman in 2008 and 2009, and was a founding member of ICANN Root Server System Advisory Committee (RSSAC) and ICANN Security and Stability Advisory Committee (SSAC). He operated the ISC's F-Root name server for many years, and is a member of Cogent's C-Root team. He is a sysadmin for Op-Sec-Trust.

Paul has been contributing to Internet protocols and UNIX systems as a protocol designer and software architect since 1980. He wrote Cron (for BSD and Linux), and is considered the primary author and technical architect of BIND 4.9 and BIND 8, and he hired many of the people who wrote BIND 9. He has authored or co-authored a dozen or so RFCs, mostly on DNS and related topics, and of Sendmail: Theory and Practice (Digital Press, 1994). His technical contributions include DNS Response Rate Limiting (RRL), DNS Response Policy Zones (RPZ), and Network Telemetry Capture (NCAP). He earned his Ph.D. from Keio University for work related to DNS and DNSSEC, and was named to the Internet Hall of Fame in 2014.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Fishing To Phishing: It's All About Slimy Creatures

Wayne Crowder

Fishing at a professional level shares a lot of traits with security professionals. Deep analysis of the environment, weather, and water conditions. A passion and certain stubbornness are what successful professional fisherman have. A security analyst requires similar skills and motivations to achieve their objectives. Not surprisingly, if you can market yourself well, you don't have to be the best at either industry to make money. This talk will poke fun at both of the industries work in and love. The technology available now for those how like to chase slimy creatures is nothing short of amazing. The sonar and mapping market has made the learning curve on most lakes very short for those who can afford the devices. The growth of this industry has left these units open for an interesting security review.

We will take a fun journey researching a powerful, yet poorly implemented network device found on a lot of fishing boats. Abuse of the lack of controls can lead to a bad day on the water. Imagine a fishing pole that could also double as an omnidirectional Wi-Fi antennae showing the poached signals and "hot spots" of other anglers. The talk will be fun, a little tongue-in-cheek, but more importantly should show the risks of enabling Wi-Fi for just about every device with a display. The underlying hardware and software of the units will be discussed. If the fish aren't biting, the "custom" build loaded on a device can pass the time as if you were home. The talk will conclude with thoughts about a few other examples where screen sharing over Wi-Fi could lead to problems. I will challenge attendees to think differently about the Internet of Things and how hacking and security research is crucial to make things safer, smarter and better. Or, just come to watch fishing porn.

Wayne Crowder (Twitter: @wacbass ) After the dream of becoming a fisheries biologist was crushed under the reality of low pay for 8+ years of school, Wayne turned to his love of technology. IT and Security have been very kind to Wayne's fishing habit. For many years it supported him while he moonlighted as a professional fisherman. Stints on TV, radio and seminars for boat or outdoor shows has led to at least a dozen autographs. Incident response and threat intel keep him busy. Wayne is proud he has more fishing poles than certifications.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

From XSS to Root on Your NAS

Tony Martin, Software Security Architect

Home Network Attached Storage devices (NAS) are gaining in popularity because of the simplicity they offer to manage ever-growing amounts of personal data. The device's functionality is extending beyond a data store, adding functionality to become the central content management system, multimedia center, network management point and even automation hub for the home and small business. The devices offer accessibility to local and remote users as well as to untrusted users via data shares. These capabilities expose all stored data and the device itself to outside/remote attackers. This talk will demonstrate NEON TOOL; by leveraging multiple vulnerabilities, it allows a remote attacker to gain root access on a popular home NAS device. The talk will cover the problems that XSS, in conjunction with other weaknesses, can create. It will address how these vulnerabilities were uncovered, possible mitigations, how to work responsibly with the vendor to ensure a timely resolution and an investigation into the fixes employed.

Tony Martin ( https://www.linkedin.com/in/martintony ) Tony is a security architect at Fortune 100 networking company as part of the secure development lifecycle team. He likes green font with a black background and when bored, stuff tends to get broken –ethically. His areas of learning include software and system architecture / design with a flair for trying to build security from the start, implementing and breaking (or trying) applied crypto, and pen testing (hence this talk). Additionally, he loves training / teaching and enabling teams to build secure products. Tony volunteers many places including the Packet Hacking / Wall of Sheep Village.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Global Honeypot Trends

Elliot Brink

Many of my computer systems are constantly compromised, attacked, hacked, 24/7. How do I know this? I've been allowing it. This presentation will cover over one year of research running several vulnerable systems (or honeypots) in multiple countries including the USA, mainland China, Russia and others. We'll be taking a look at: a brief introduction to honeypots, common attacker trends (both sophisticated and script kiddie), brief malware analysis and the statistical analysis of attackers based on GeoIP. Are there differences in attacks based on where a computer system is located? Let's investigate this together! Beginners to the topic of honeypots fear not, the basics will be covered.

Elliott Brink (Twitter: @ebrinkster ) Elliott is an Information Security Consultant based out of Chicago, IL. He specializes in internal/external pentesting, security architecture, and social engineering engagements. He loves computer history, tracking bad guys, honeypots, an expertly crafted bloody mary and traveling the globe.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Hacker's Practice Ground

Lokesh Pidawekar, Cisco, Inc.

Learning Hacking legally and economically is not a myth anymore. You will witness how to create a practice ground to hone the skills of hacking. The talk will take you through infrastructure, tools and techniques of practicing hacking. It will also cover information about online hacking challenges and breaking into bug bounty programs. Expect lot of demos.

Lokesh Pidawekar (Twitter: @MaverickRocky02 ) Lokesh is Master's student in Information Assurance at Northeastern University, Boston. He has more than 4 years of experience in System hardening, Network architecture assessments and web application penetration testing. During last summer, he was software security intern at Cigital, Inc. where he worked on various mobile and web application penetration testing projects. He actively participates in bug bounty programs and responsibly disclosed vulnerabilities to various companies. He is president of ISSA-Northeastern University student chapter and recipient of ISC2 Graduate research scholarship.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Haking the Next Generation

David Schwartzberg, Senior Security Engineer, MobileIron

Kids are wired to learn. They are learning while they are playing, so why not give them an environment where they can play while they are learning. A combination of a speaking track, workshops, and an open area of stations complementing each other enables the attendees to expand and enlighten their technical interests. For innovation to perpetuate, it's imperative that today's young users are exposed to the bigger picture of how we got here and to help realize their potential. You can come learn more about how Hak4Kidz is making a difference and how you can potentially organize a Hak4Kidz in your local city.

David Schwartzberg (Twitter: @DSchwartzberg ) David is a Senior Security Engineer at MobileIron, a mobile security company, where he specializes in mobile and network security. Utilizing his 6 years accounting experience and combined 17 years InfoTech and InfoSec experience, he speaks regularly with technology executives and professionals to help protect their corporate secrets and stay compliant. In his spare time he co-founded Hak4Kidz, www.hak4dkiz.com , and has blogged for Dark Reading, Naked Security and Barracuda Labs. He has spoken at conferences such as Black Hat Arsenal, BSides, Converge, DerbyCON, GrrCON, OWASP AppSec, THOTCON, Wall of Sheep Village, (ISC)2 Congress and several others. David has earned several certifications in the field of Information Technology and Information Security. If you need to know the list of certifications, that's what Linkedin is for.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

How Machine Learning Finds Malware Needles in an AppStore Haystack

Theodora Titonis, Vice President of Mobile Security at Veracode

Machine learning techniques are becoming more sophisticated. Can these techniques be more affective at assessing mobile apps for malicious or risky behaviors than traditional means? This session will include a live demo showing data analysis techniques and the results machine learning delivers in terms of classifying mobile applications with malicious or risky behavior. The presentation will also explain the difference between supervised and unsupervised algorithms used for machine learning as well as explain how you can use unsupervised machine learning to detect malicious or risky apps.

What you will learn:

- Understand the difference between advanced machine learning techniques vs. traditional means.

- Recognize different types of algorithms used to improve mobile security.

- Understand how you can use unsupervised machine learning to detect malicious or risky apps.

Theodora Titonis Theodora is an innovative entrepreneur whose passion for technology began when she started programming computers at the age of seven. While pursuing computer science at The Ohio State University she focused her efforts on the challenging field of security. During the dotcom-era, Theodora architected systems and provided security expertise to federal government intelligence and defense agencies, leading financial institutions and Fortune 500 Companies.

Theodora served as the Founder, CEO, sole investor, and a patent assignee of Marvin Mobile. Veracode, Inc., the leader in cloud-based application security testing, acquired Marvin in September 2012. Ms. Titonis now serves as Veracode's Vice President of Mobile Security.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

I See You

Brian Wohlwinder, Manager of Threat Analysis, Fidelis Cybersecurity; Andrew Beard, Manager of Threat Systems, Fidelis Cybersecurity

In this talk, we will dive into the data captured during last years Wall of Sheep applications and protocols that are giving your away credentials. This is something that anyone, with the right level of knowledge and inclination, could certainly do with a few basic ingredients. We will enumerate them. The dataset we will focus on was gathered as part of the Wall of Sheep contest during DEF CON 22. While this data was gathered using an off the shelf technology, that platform will not be the topic we discuss. Rather, we will focus on the types and scope of data sent totally in the clear for all to see. Additionally, we will discuss the ramifications this might have in a less "friendly" environmen --where loss of one's anonymity, might really, really suck. Finally, we will discuss and recommend ways you can hamper this type of collection.

Brian Wohlwinder In his role as Manager of Threat for Fidelis Cybersecurity Systems, Brian is responsible for developing and evolving the company's threat detection strategy while synchronizing it with product strategy.  Before "retiring," Brian also held a number of roles, in a wide range of cyber programs within the Department of Defense and associated Joint Community; his military service includes stints as a Cyberspace Strategist for the Air Force Space Command, Mission Commander at the Joint Functional Component Command - Network Warfare, Chief of Space Systems Integration, Network Engineer, Programmer, Systems Analyst, and Rated Flight Engineer. In addition to extensive training in the military, Brian also received his Bachelor's degree in Computer Science from Charleston Southern University and a Master's degree in Business Administration from The Citadel Military College.

Andrew Beard Andrew is the Manager of Threat Systems for Fidelis Cybersecurity and is a native of the DC metro area. In his role, he manages a small team that is primarily responsible for processing threat intel at scale. He holds a B.S. in Computer Engineering from the University of Maryland, College Park, with a minor in Dance Dance Revolution. He is a connoisseur of astronaut ice cream and somewhat begrudgingly takes slow, meandering walks with his French Bulldog, Fudge. He is often accused of being Gordon Freeman's evil twin and insists that no one is too old to own action figures.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Is Your Android App Secure?

Sam Bowne, Instructor, City College San Francisco

It's easy to audit Android app security, and very important, because most of them have one or more of the OWASP Mobile Top Ten Risks. I tested the top ten US bank apps, stock trading apps, and insurance apps, and 70% of them were insecure. I'll demonstrate how to find SSL validation failures and how to add Trojans to vulnerable apps to create a Proof-of-Concept. Complete instructions for all these tests are available free at https://samsclass.info/ .

Sam Bowne (Twitter: @sambowne ) Sam has been teaching computer networking and security classes at CCSF since 2000. He has given talks at DEFCON, HOPE, BayThreat, LayerOne, and Toorcon, and taught classes and many other schools and teaching conferences. He has these things: BS, PhD, CEH, CISSP, WCNA, and a lot of T-shirts.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

MITM 101: Easy Traffic Interception Techniques Using Scapy

Bob Simpson, CIO, Finley & Cook, PLLC

Performing man-in-the-middle attacks takes a little planning and practice, but you will soon find that it is one of the most powerful and useful skills you can develop. Once you get the hang of it, Scapy makes it easy to target a specific box or a whole network, and whether you have physical access or remote penetration, you can use MITM to open up new possibilities.

Bob Simpson (Twitter: @bobby_simpson ) Bob is CIO for Finley & Cook, PLLC, a private accounting firm. He has been with the company for 8 years. Previously, he served as Security Architect for the Oklahoma Department of Human Services, and Senior Systems Engineer at iPolicy Networks, an intrusion prevention firm. Bob has system-wide design and project lead experience, including network architecture, security assessment and enforcement, and network software development. Mr. Simpson holds the CISSP, GCIH, GCIA, and GPEN, as well as MCSE and CCNA certifications. He serves on the SANS Advisory board and is a member InfraGard. Most recently, Bob has developed GhostSentry, a device for remote access logging and compliance.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Mobile Data Loss - Threats & Countermeasures

Michael Raggo, Director, Security Research, MobileIron

Current attack vectors indicate that malware, spyware, and other nefarious attacks are targeting mobile devices for financial gain, cyber espionage, or to simply damage company reputation. Additionally, the threat from the inside has also increased, leading to intentional and unintentional data leakage for many companies. This presentation will review best practices and strategies for controlling the dissemination of data on mobile devices by analyzing current mobile attack vectors and countermeasures.

Michael Raggo (Twitter: @MikeRaggo ) Michael applies over 20 years of security technology experience and evangelism to the technical delivery of Mobile Security Solutions. Mr. Raggo's technology experience includes mobile device security, penetration testing, wireless security assessments, compliance assessments, incident response and forensics, security research, and is a former security trainer. His publications include books for Syngress titled "Data Hiding" and McGraw Hill as a contributing author for "Information Security the Complete Reference 2nd Edition", as well as multiple magazine and online articles. He is also a participating member of the PCI Mobile Task Force. Mr. Raggo has presented on various security topics at numerous conferences around the world (BlackHat, DefCon, SANS, Gartner, DoD Cyber Crime, OWASP, InfoSec, etc.) and has even briefed the Pentagon and FBI.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

The Packets Made Me Do It: Getting Started with Distributed Full Packet Capture Using OpenFPC

Leon Ward

Network security analysts love to see packets, however most commercial security products don't record them, instead they provide packet-less event messages that can leave you asking yourself "Did that event really happen?" This talk investigates this situation and covers the history that lead the speaker to start an Open Source project that has helped him to enrich security detection events with packets as required.

OpenFPC is a packet capture framework that is designed to help retro-fit full packet data into external existing packet-less event generating tools (think Intrusion detection, firewalls, SIEMs, or log managers). Learn how to rapidly deploy a distributed full packet capture system using only a few commands, and then enrich other tools with it to augment your current event analysis process.

Leon Ward Leon has spent over ten years in "day jobs" working closely with both open source and proprietary network security tools. Following years of experience of helping to design and deploy large intrusion prevention deployments, he decided to focus on trying to advance the products themselves. While working as Director of Product Management at Sourcefire, he became responsible for network detection technologies including the famous Snort open source intrusion prevention engine. OpenFPC was started is a spare time "passion" project for Leon (read "not his day job") that enables him to stay knee-deep in packets and code.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Penetration Testing Using a Raspberry Pi

Joseph Muniz, Consultant at Cisco Systems and Security Researcher; Aamir Lakhani, Senior Cyber Security Researcher, Fortinet and FortiGuard Labs.

The Raspberry Pi is an $35 computer that can be used for small computing tasks and education purposes. However it can also be used as a penetration testing platform that allows for social engineering, advanced attacks, and other forms of evil. This talk will cover how we have used a raspberry pi to exploit networks.

Joseph Muniz Joseph is a consultant at Cisco Systems and security researcher. Joseph started his career in software development and later managed networks as a contracted technical resource. Joseph moved into consulting and found a passion for security while meeting with a variety of customers. He has been involved with the design and implementation of multiple projects ranging from Fortune 500 corporations to large federal networks. Joseph is the author and contributor of several books as well as speaker for popular security conferences. Check out his blog http://www.thesecurityblogger.com showcasing the latest security events, research and technologies.

Aamir Lakhani Aamir is a senior cyber security researcher and practitioner with Fortinet and FortiGuard Labs. He is responsible to provide IT security solutions to major global organizations. Lakhani has designed cyber solutions for defense and intelligence agencies, and has assisted organizations in defending themselves from active strike back attacks perpetrated by underground cyber groups.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

PowerShell for Penetration Testers

Nikhil Mittal

PowerShell has changed the way Windows networks are attacked. It is Microsoft's shell and scripting language available by default in all modern Windows computers. It can interact with .NET, WMI, COM, Windows API, Registry and other computers on a Windows network. This makes it imperative for Penetration Testers and Red Teamers to learn PowerShell. This talk looks at various attacks and tasks performed by penetration testers and red teamers during different phases of an assessment and utilize PowerShell to make them easy and much more powerful. Various techniques like in-memory shellcode execution from a Word macro, dumping system secrets in plain, using innovative communication channels, lateral movement, network relays, using Metasploit payloads without detection etc. would be discussed.

Nikhil Mittal (Twitter: @nikhil_mitt ) Nikhil is a hacker, infosec researcher, speaker and enthusiast. His area of interest includes penetration testing, attack research, defence strategies and post exploitation research. He has 6+ years of experience in penetration testing for his clients which include many global corporate giants. He is also a member of red teams of selected clients. He specializes in assessing security risks at secure environments which require novel attack vectors and "out of the box" approach. He has worked extensively on using Human Interface Device in Penetration Tests and PowerShell for post exploitation. He is creator of Kautilya, a toolkit which makes it easy to use Teensy in penetration tests and Nishang, a post exploitation framework in PowerShell. In his spare time, Nikhil researches on new attack methodologies and updates his tools and frameworks. He has spoken at conferences including DEF CON, BlackHat USA, BlackHat Europe, RSA China, and EuSecWest.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Real World Automation for Rapid Response

Monzy Merza, Chief Security Evangelist, Splunk

This talk will discuss how you can automate incident response, with an emphasis on the foundational capabilities required for auto-response and how those capabilities are integrated. It will also highlight specific examples of end-to-end threat detection, response and mitigation. Note that it is very challenging for a talk of this nature to be 'immediately useful' and still be vendor neutral. We are not promoting any specific vendor, but we have to use some specific examples in the security ecosystem to make the content actionable – otherwise it’s too generic.

We will not be promoting any specific vendor as cyber operations require an ecosystem solution. We will use specific, real world examples of threat-intel, endpoint, network and identity management systems from a number of open source and closed source providers. Splunk is not in the network business, or the threat-intel business or the asset and identity management business, so examples will include other open source and closed source technology vendors.

The audience will learn why a balanced approach is required across the infrastructure; how and why to tie the pieces together; and how to conduct faster threat detection and incident response.

Even if attendees don't have the exact product/vendor mix as our examples, they will learn how to think through and apply these tactics in their own environments.

Monty Merza (Twitter: @monzymerza ) Monzy serves as the Chief Security Evangelist at Splunk Inc. He has more than 15 years of tactical and cyber security research experience in government and commercial organizations. His experience includes vulnerability management, security product testing, penetration testing, adversary modeling, cyber tools and infrastructure development. Merza has served as content developer and instructor for cyber trainings and red/blue team exercises. He has also been an invited speaker at government and open conferences. Merza's current research is focused on integrated approaches to human driven and automated responses to targeted cyber attacks.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Remaining Covert in an Overt World

Michael Raggo, Director, Security Research, MobileIron; Chet Hosmer, Founder of WetStone Technologies, Inc.

With the explosion of social media, sharing apps, and an overall world of overtness, some of us are seeking ways to communicate covertly and protect our privacy. This has prompted the emergence of new and enhanced covert communications. This includes methods for hiding data within apps, communication protocols, and even enhanced techniques for hiding data within data. In this talk we'll explore the most recent techniques for secret communications and hiding data, while also exploring new ideas for covert storage in wearables, mobile devices, and more with walkthroughs and demos.

Michael Raggo (Twitter: @MikeRaggo ) Michael applies over 20 years of security technology experience and evangelism to the technical delivery of Mobile Security Solutions. Mr. Raggo's technology experience includes mobile device security, penetration testing, wireless security assessments, compliance assessments, incident response and forensics, security research, and is a former security trainer. His publications include books for Syngress titled "Data Hiding" and McGraw Hill as a contributing author for "Information Security the Complete Reference 2nd Edition", as well as multiple magazine and online articles. He is also a participating member of the PCI Mobile Task Force. Mr. Raggo has presented on various security topics at numerous conferences around the world (BlackHat, DefCon, SANS, Gartner, DoD Cyber Crime, OWASP, InfoSec, etc.) and has even briefed the Pentagon and FBI.

Chet Hosmer Chet is the Founder of Python Forensics, Inc. a non-profit organization focused on the collaborative development of open-source investigative technologies using Python.  Chet is also the founder of WetStone Technologies, Inc. and has been researching and developing technology and training surrounding forensics, digital investigation and steganography for over two decades. He has made numerous appearances to discuss emerging cyber threats including National Public Radio's Kojo Nnamdi show, ABC's Primetime Thursday, NHK Japan, CrimeCrime TechTV and ABC News Australia. He has also been a frequent contributor to technical and news stories relating to cyber security and forensics and has been interviewed and quoted by IEEE, The New York Times, The Washington Post, Government Computer News, Salon.com and Wired Magazine. He is the author of three recent Elsevier/Syngress Books: Python Passive Network Mapping (ISBN-13: 978-0128027219), Python Forensics (ISBN-13: 978-0124186767), and Data Hiding which is co/authored with Mike Raggo (ISBN-13: 978-1597497435). Chet serves as a visiting professor at Utica College where he teaches in the Cybersecurity Graduate program. He is also an Adjunct Faculty member at Champlain College in the Masters of Science in Digital Forensic Science Program. Chet delivers keynote and plenary talks on various cyber security related topics around the world each year. Chet resides with Wife Janet, Son Matthew along with his four legged family near Myrtle Beach, South Carolina.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Sniffing SCADA

Karl Koscher, Postdoctoral Researcher, University of California San Diego

Over the past few years, interest in ICS/SCADA systems security has grown immensely. However, most of this interest has been focused on IP-connected SCADA networks, largely ignoring numerous deployments relying on other technologies such as wireless serial links. In this talk, I'll introduce a new GNU Radio module which lets you sniff (and potentially speak with) SCADA networks that use a popular RF modem for their communications. I'll also describe the process of reverse-engineering the proprietary RF protocol used. Finally, I'll talk about the higher-layer protocols used in SCADA networks, including ModBus and DNP3, demonstrate how we are able to monitor the (unencrypted and unauthenticated) sensing and control systems used by a large electricity distribution network, and discuss some of its implications.

Karl Koscher (Twitter: @supersat ) Karl is a postdoctoral researcher at the University of California San Diego where he specializes in embedded systems security. In 2011, he and his collaborators were the first to demonstrate a complete remote compromise of a car over cellular, Bluetooth, and other channels. In addition to breaking systems, he also works on creating tools and technologies to enable developers to automatically find (and fix) potential security vulnerabilities in their embedded systems. Since earning his ham license at DEF CON 22 (and later upgrading to Amateur Extra), he has become interested in many aspects of wireless communications.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Tools and Techniques Used at the Wall of Sheep

Ming Chow, Wall of Sheep

Ming will demonstrate how to capture and analyze packets using the tools that are used by the shepherds at the Wall of Sheep. The tools include Wireshark, tcpdump, dsniff, and ettercap. Attendees do not need to have any networking or security experience but are expected to bring their own laptop. For the purpose of this session, a *nix environment will be used (e.g., Linux, Mac OS X).

Ming Chow (Twitter: @0xmchow ) Ming has been involved with the Wall of Sheep since DEF CON 15 (2007).

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Violating Web Services

Ron Taylor

The majority of today's mobile applications utilize some type of web services interface (primarily SOAP and REST) for connecting to back end servers and databases. Properly securing these services is often overlooked and makes them vulnerable to attacks that might not be possible via the traditional web application interface. This talk will focus on methods of testing the security of these services while utilizing commercial and open source tools. We will also highlight some web services of well-known sites that have been recently violated.

Ron Taylor (Twitter: @Gu5G0rman ) Ron has been working in the information security field for the past 16 years. He spent 10 years in consulting, gaining experience in many areas. For the past 7 years he has been working as an engineer for Cisco Systems in RTP. His focus is on Pen Testing Cisco products and working with the development teams to implement high security standards. He also holds certifications including GPEN, GCIH, GWAPT, RHCE, CCSP, CCNA, CISSP and MCSE. He is a SANS Mentor and one of the founders of BSides Raleigh.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Demo Labs Talks List

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

PortaPack H1 Portable SDR

Jared Boone, ShareBrained Technology

The PortaPack H1 turns a HackRF One software-defined radio into a portable, open-source radio research platform, consisting of an LCD screen, micro SD slot, audio interface, and controls. It's capable of signal monitoring, capture, and analysis, and fits in one hand.

Detailed Explanation of Tool:

The PortaPack H1 attaches to a HackRF One software-defined radio, and adds an LCD with touchscreen, audio interface, user controls, micro SD card, and a RTC battery. It utilizes the dual ARM Cortex-M processors on the HackRF One to provide a lightweight but capable radio research platform. Because of resource constraints, it was not possible to provide a complete operating system, so ChibiOS was utilized, with good results. Even with these constraints, this portable device can monitor, analyze, and record many types of narrowband radio signals. Since the design is open-source, developers can build on the existing software to support many other types of signals and applications.

Jared Boone is an open-source hardware hacker, obsessed with the privacy and security of radio technology. He runs ShareBrained Technology, where his projects sometimes turn into products.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

MozDef: The Mozilla Defense Platform

Jeff Bryner Security Researcher

MozDef is an open source SIEM overlay for Elastic Search that enables real-time alerting, investigations, incident response and automated defense in a modern, extensible fashion.

Jeff Bryner is best known to DEF CON from the kinectasploit presentations combining metasploit, nmap, nessus, etc with a 3D, real-time, gesture-based interface. With MozDef he's doing the same, but for defense.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

SpeedPhishing Framework (SPF)

Adam Compton Penetration Tester

SpeedPhishing Framework (SPF) is a new tool which can assist penetration testers in quickly/automatically deploying phishing exercises in minimal time. The tool, when provided minimal input (such as just a domain name), can automatically search for potential targets, deploy multiple phishing websites, craft and send phishing emails to the targets, record the results, generate a basic report, among performing other more advanced tasks.

Adam Compton has a background in software design/development and information security. He currently works as a penetration tester and has over 20 years of infosec experience, 15 years as a penetration tester. He has worked in both the government and private sectors for a variety of customers ranging from domestic and international governments, multinational corporations, and smaller local business.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Emanate Like a Boss: Generalized Covert Data Exfiltration with Funtenna

Ang Cui Chief Scientist, Red Balloon Security, Inc.

Funtenna is a software-only technique which causes intentional compromising emanation in a wide spectrum of modern computing hardware for the purpose of covert, reliable data exfiltration through secured and air-gapped networks. We present a generalized Funtenna technique that reliably encodes and emanates arbitrary data across wide portions of the electromagnetic spectrum, ranging from the subacoustic to RF and beyond.

The Funtenna technique is hardware agnostic, can operate within nearly all modern computer systems and embedded devices, and is specifically intended to operate within hardware not designed to act as RF transmitters.

We believe that Funtenna is an advancement of current state-of-the-art covert wireless exfiltration technologies. Specifically, Funtenna offers comparable exfiltration capabilities to RF-based retroreflectors, but can be realized without the need for physical implantation and illumination.

We first present a brief survey of the history of compromising emanation research, followed by a discussion of the theoretical mechanisms of Funtenna and intentionally induced compromising emanation in general. Lastly, we demonstrate implementations of Funtenna as small software implants within several ubiquitous embedded devices such as VoIP phones and printers, and in common computer peripherals such as hard disks, console ports, network interface cards and more.

Ang Cui is the Chief Scientist of Red Balloon Security, Inc. with a Ph.D. from Columbia University. He has focused on developing new technologies to defend embedded systems against exploitation. During the course of his research, Ang has also uncovered a number of serious vulnerabilities within ubiquitous embedded devices like Cisco routers, HP printers and Cisco IP phones. Ang is also the author of FRAK and the inventor of Software Symbiote technology. Ang has received numerous awards on his research and is the recipient of the Symantec Graduate Fellowship.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

CANtact

Eric Evenchick freelance embedded systems developer

CANtact is an open source CAN to USB tool that integrates with the SocketCAN utilities on Linux. It provides a low cost way to connect to in-vehicle networks on modern automobiles.

This talk will present the hardware tool, and software tools that assist with working on in-vehicle networks. Some of these are custom development around CANtact, and other are existing open source utilities (ie, Wireshark and Kayak).

Eric Evenchick is a freelance embedded systems developer. While studying electrical engineering at the University of Waterloo, he worked with the University of Waterloo Alternative Fuels Team to design and build a hydrogen electric vehicle for the EcoCAR Advanced Vehicle Technology Competition. Eric has also worked on automotive firmware at Tesla Motors, and is a contributor for Hackaday.com.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Badge Jeopardy

Fuzzbizz Badge Hacker

Hacker Jeopardy on Windows makes Richard Stallman cry. Fix that by running it on your Defcon badge!

Required: Parallax-based DC badge

Fuzzbizz started showing up to Defcon as a total noob five years ago. He just moved to California from Ireland and has somehow managed to get roped into cofounding an infosec company. Hopefully he doesn't fuck it up.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

HamShield: A wideband VHF/UHF FM transceiver for your Arduino

Casey Halverson

The HamShield turns your Arduino into a VHF/UHF FM voice and data transceiver for the following frequencies:

136-170MHz, 200-260MHz, 400-520 MHz.

No need to worry about SDR and processing, as this is already taken care of on the chip level. The HamShield library provides easy voice and data capability and controls every aspect of the radio. New radio technologies and creations can be written in minutes using the Arduino IDE. The radio is plumbed into the Arduino, as well as a standard mobile headset jack. You can even plug it into your computer and control it with your Chrome browser. Multithreaded text messaging over APRS, anyone?

Casey Halverson is an Amateur Radio operator, earning his license when he was 14 years old. After working years with Arduino hardware, he dreamed of one day combining the rapid prototyping capabilities of the Arduino environment with Amateur Radio. Casey is also a Chrome developer, bringing the first Arduino IDE and programmer to the Chromebook (Chromeduino). When he is not hacking with hardware, he dabbles in security, from exposing the Nissan LEAF's third party data leakage to WiFi picture frames.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

The ShadyShield: Software-Defined Telephony for Arduino

Karl Koscher Researcher

The ShadyShield is an Arduino-compatible telephone interface for all of your old-school phone phreaking needs. The ShadyShield provides the raw analog audio, but what you do with that is up to you. We provide sample code implementing a 300 bps modem in software on the AVR, but the applications of the ShadyShield are only limited by your imagination. Want to build an auto-dialer? That’s easy. Want to implement a BBS in a small, discreet form factor? The ShadyShield provides extra RAM via the SPI bus and a microSD connector for mass storage. Need a dumb dial-up terminal in a pinch? The ShadyShield has an RCA jack for NTSC/PAL output. We’ll have some sample applications on display, plus a few surprises.

Karl Koscher is a postdoctoral researcher at the University of California San Diego where he specializes in embedded systems security. In 2011, he and his collaborators were the first to demonstrate a complete remote compromise of a car over cellular, Bluetooth, and other channels. In addition to breaking systems, he also works on creating tools and technologies to enable developers to automatically find (and fix) potential security vulnerabilities in their embedded systems. Since earning his ham license at DEFCON 22, he has become interested in many aspects of communication systems.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Digital Disease Tracking Web App

Efrain Ortiz

Dave Ewall

The tool is a an application that visualizes endpoint events into a timeline inspired by an epidemiological SIR graph. By plotting events over time by machine by event color type, its possible to spot patterns that the average endpoint security product misses. This free open source app is currently designed for one vendors endpoint security data, but is open to upgrading for other endpoint security products.

The Digital Disease Tracking Web App was developed as a after hours collaboration between Dave Ewall and Efrain Ortiz. Efrain Ortiz works at a large internet security company and Dave Ewall runs his own company.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

The Deck

Dr. Phil (Polstra) Professor Bloomsburg University of Pennsylvania

The Deck is a version of Linux for the BeagleBone and similiar boards. The Deck is also the name of devices running The Deck used for pentesting. There are a number of addons to The Deck including: The 4Deck: Forensics USB Write blocking AirDeck: Flying hacking drone MeshDeck: Command and control multiple devices with 802.15.4 networks USBDeck: HID and Mass Storage attacks.

Phil was born at an early age. He cleaned out his savings at age 8 in order to buy a TI99-4A computer for the sum of $450. Two years later he learned 6502 assembly and has been hacking computers and electronics ever since.

Dr. Phil currently works as a professor at Bloomsburg University of Pennsylvania. His research focus over the last few years has been on the use of microcontrollers and small embedded computers for forensics and pentesting. Phil has developed a custom pentesting Linux distro and related hardware to allow an inexpensive army of remote pentesting drones to be built using the BeagleBone Black computer boards. This work is described in detail in Phil's book "Hacking and Penetration Testing With Low Power Devices" (Syngress, 2015).

Prior to entering academia, Phil held several high level positions at well-known US companies. He holds a couple of the usual certs one might expect for someone in his position. When not working, he likes to spend time with his family, fly, hack electronics, and has been known to build airplanes.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

SWATtack – Smartwatch Attack Tool

Michael T. Raggo Director, Security Research, MobileIron, Inc

Security concerns about corporate data on smartwatches wasn’t a topical concern until the release of the Apple Watch, yet wearables and smartwatches have been around for years. Our research and subsequent tool, SWATtack, brings to light the existing vulnerabilities of these devices when paired to a corporate-enabled mobile device. SWATtack incorporates our research of identified and reported vulnerabilities surrounding smartwatches and automates attack methods for accessing these devices, and pilfering data from them. From this we hope to raise security awareness surrounding these devices to ensure that when they are used in numerous practical methods, that they are used in a secure and effective manner.

Michael T. Raggo, Director, Security Research, MobileIron, Inc. applies over 20 years of security technology experience to the technical delivery of Mobile Security Solutions. Mr. Raggo’s technology experience includes mobile device security, penetration testing, wireless security assessments, compliance assessments, incident response and forensics, security research, and is a former security trainer. His publications include books for Syngress titled “Data Hiding” and McGraw Hill as a contributing author for “Information Security the Complete Reference 2nd Edition”, as well as multiple magazine and online articles. He is also a participating member of the PCI Mobile Task Force. Mr. Raggo has presented on various security topics at numerous conferences around the world (Black Hat, DEF CON, SANS, Gartner, DoD Cyber Crime, OWASP, InfoSec, etc.) and has even briefed the Pentagon and FBI.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

CuckooDroid

Idan Revivo Mobile Malware Researcher, Check Point

CuckooDroid: an automated malware analysis framework based on the popular Cuckoo sandbox and several other open source projects. It features both static and dynamic APK inspection. Also, it provides techniques to prevent VM-detection, encryption key extraction, SSL inspection, API call trace, basic behavioral signatures and many other features. The framework is highly customizable and extensive - leveraging the power of the large, established Cuckoo community.

Idan is a mobile malware researcher at Check Point. He specializes in Android internals and sandboxing techniques. This includes automated static and dynamic malware analysis. He has a diverse security background which includes vulnerability analysis and electronic warfare providing him with a broad and unique perspective on the cyber arena. Although he mainly works with Android, Idan is an Apple enthusiast. Idan holds a bachelor's degree in Software Engineering, specializing in Mobile Systems.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Fiber Optic Tapping

Josh Ruppe

When you think of someone performing a standard man in the middle attack, what do you picture in your head? A network tap on copper cables? Someone using a WiFi Pineapple? Well what if the data being intercepted is leaving your home or coffee shop? Would you feel safer if your data was inside an optical fiber? You shouldn't. Fiber optics are just as susceptible to tapping as any other method of communication. In my demo lab, I will show you how fiber optic tapping works, how to conceal a tapping setup and how to defend against such an attack.

Tool Details: The tool I am using is known as a "Fiber Optic Clip-On Coupler". It is used by technicians to access talk fibers for testing purposes. However, it can also be used to "tap" the fiber without the need of a terminated end. The tool allows you to safely bend the fiber which in turn causes light to leak out through the fiber optic cladding. This enables complete and often undetected theft of data through a process not surprisingly known as "bending".

Josh Ruppe has been working in information security for a little over a decade, and is currently working as a Security Engineer in Atlanta, GA. Josh's primary focus is on penetration testing, but also dabbles in web application security, cryptography and reverse engineering.

Twitter: @josh_ruppe

Website: www.joshruppe.com

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Ombuds

Nick Skelsey Systems Programmer

Ombuds resists censorship by storing public statement's in Bitcoin's block chain. It is meant to be used along side existing social media platforms to protect and distribute statements created by bloggers, activists and dissidents living under oppressive regimes. But if you are just worried that Twitter might delete your shitpost, you can use Ombuds to store it forever on the block chain.

Nick is a 2015 graduate from the School of Engineering and Applied Science at U.Va. He has worked at Distil Networks, Parse.ly and the Tom Tom Founders Festival as a front-end and backed web developer. He calls himself a systems programmer.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Sphinx

Takehiro Takahashi Security Researcher

Sphinx is a highly scalable open source security monitoring tool that offers real-time auditing and analysis of host activities. It works by having clients forward various types of event logs including process execution with cryptographic signature (MD5 hash), network activity, dll/driver loading, as well as miscellaneous system events to a Sphinx server where each event is recorded and analyzed.

With Sphinx, you can quickly find an answer to questions like:

- can we get a list of every event that happened on machine X between date Y and date Z?

- can we graphically trace what happened on my computer in the last 10 minutes because I feel there's something weird going on?

- who has run a piece of malware whose existence cannot be detect by our existing Anti-Virus product on our network?

- give me a list of program executions as well as dll loads whose reputation is questionable or bad.

- are there Office application making outbound connection to China?

- are there any dlls injected into explorer.exe whose digital signature does not belong to Microsoft?

You can build both simple and complex queries to search for threats. These queries can be run recurringly, and send alerts whenever there's a hit.

Tool details:

Sphinx works by having clients forward various types of event logs including process execution history with program's digital fingerprint (MD5 hash), network activity, dll/driver loading, as well as miscellaneous system events to a Sphinx server where each event is recorded and analyzed. These events are primarily generated through Sysmon, Microsoft's Sysinternal tool, and delivered to the server using nxlog, a robust open source log management tool.

On the server side, Sphinx receives the incoming data using Logstash, a popular log management tool with horizontal scalability. Logstash loads several plug-ins (including Sphinx's own Logstash plug-in) in order to normalize the data for analysis. The Sphinx plugin is primarily responsible for adding reputation information for events with MD5 hash. Sphinx uses the following sources to build its reputation table:

National Software Reference Library (NSRL), a project of the National Institute of Standards and Technology (NIST) which maintains a repository of known software, file profiles and file signatures for use by law enforcement and other organizations involved with computer forensic investigations. VirusTotal, a subsidiary of Google, is a free online service that analyzes files and URLs enabling the identification of viruses, worms, trojans and other kinds of malicious content detected by antivirus engines and website scanners.

VirusShare, a repository of malware samples to provide security researchers, incident responders, forensic analysts, and the morbidly curious access to samples of malicious code.

Finally, normalized data is stored in an Elasticsearch server. Elasticsearch is a highly scalable, open-source full-text search engine based on Apache Lucene. Users can use Sphinx's web UI to build/run queries, and detect threats. The web front end is also capable of graphically browsing program execution history or create an alert using saved queries. For example, you can have an alert set to trigger whenever Sphinx sees a program execution whose reputation is 'Harmful' OR 'Potentially Harmful' OR 'Unknown'.

Takehiro Takahashi is an individual security researcher, and formerly a vulnerability researcher at IBM X-Force, and a senior security engineer at large enterprise where he designed and developed scalable monitoring and automation tools for malware threats.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Haka - An open source security oriented language

Mehdi Talbi Security Researcher, Stormshield

Haka is an open source security oriented language that allows to specify and apply security policies on live captured traffic. The scope of this language is twofold. First of all, Haka is featured with a grammar allowing to specify network protocols and their underlying state machine. The specification covers text-based protocols (e.g. http) as well as binary-based protocols (e.g. dns). Secondly, Haka enables the specification of fined-grained security rules allowing end-users to filter unwanted packets and report malicious activities. Haka enables on the fly packet modification which allows to setup complex mitigation scenarios in case of attack detection. The main goal of Haka is to abstract low-level and complex tasks such as memory management and stream reassembly to non-developer experts. Haka aims to provide a simple and quick way to express security controls on existing, specific (e.g. scada) or new protocols (e.g. protocols over http).

Mehdi Talbi, PhD, is a security researcher at Stormshield where he contributes to the Haka open source project. His main interests are vulnerability exploitation techniques, reverse engineering, intrusion detection and network forensics. He has published more than 10 peer-reviewed papers in computer security conferences (ICICS, ARES), journals (Journal in Computer Virology) and magazines (MISC).

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

QARK - Android Exploitation and Static Code Analysis Tool

Tony Trummer Penetration Tester, LinkedIn

Tushar Dalvi Senior Information Security Engineer, LinkedIn

QARK is an automated scanning and exploitation framework, for Android applications. It is designed to locate vulnerabilities and provide dynamically generated, Proof-of-Concept exploitation code, customized for the specific application being tested.

It can be used in a scriptable fashion, for integration into existing SDLC processes, or interactively, by security auditors, with the need to assess a fully built application, as it has the flexibility to work on either raw source code or previously built APKs. It even creates nice findings reports to keep your pointy-haired boss, client or compliance wonks happy.

QARK currently includes checks for improper TLS implementations, insecure Inter-Process Communications, insecure WebView configurations and several other common security vulnerabilities.

Additionally, QARK can serve as your Android security testing Swiss army knife. It includes a manual testing APK allowing you to configure various testing scenarios without having to write all the nasty Java yourself.

Most importantly, QARK has been designed to encourage a community-based approach to application security, by eliciting contributions from the open-source community, allowing for all Android app developers and testers to share in a common body of knowledge for securing their applications.

So, stop by for a demonstration or further details, find a 0-day in your Android app and learn how you can contribute to, and benefit from, QARK. Hurry before we get too drunk!

Tony has been working in the IT industry for nearly 20 years and has been focused on application security for the last 5 years. He is currently an in-house penetration tester for LinkedIn, running point on their mobile security initiatives and has been recognized in the Android Security Acknowledgements. When he’s not hacking, he enjoys thinking about astrophysics, playing devil’s advocate and has been known to dust his skateboard off from time-to-time.

Tushar Dalvi is a security enthusiast, and currently works as a Senior Information Security Engineer at LinkedIn. He specializes in the area of application security, with a strong focus on vulnerability research and assessment of mobile applications. Previously, Tushar has worked as a security consultant at Foundstone Professional Services (McAfee) and as a Senior developer at ACI Worldwide.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Rudra

Ankur Tyagi (7h3rAm) Malware Research Engineer, Qualys Inc

Rudra aims to provide a developer-friendly framework for exhaustive analysis of pcap files (later versions will support more filetypes). It provides features to scan pcaps and generates reports that include pcap's structural properties, entropy visualization, compression ratio, theoretical minsize, etc. These help to know type of data embedded in network flows and when combined with flow stats like protocol, Yara and shellcode matches eventually help an analyst to quickly decide if a test file deserves further investigation.

Ankur is working with Qualys Inc. as a Malware Research Engineer. On the Internet, he goes by the handle 7h3rAm and usually blogs here: http://7h3ram.github.io/.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Shevirah

Georgia Weidman Founder, Bulb Security LLC

Shevirah (formerly the Smartphone Pentest Framework) is a provider of testing tools for assessing and managing the risk of mobile devices in the enterprise and testing the effectiveness of enterprise mobility management solutions. Shevirah allows security teams and consultants to integrate mobility into their risk management and penetration testing programs.

Georgia Weidman is a penetration tester, security researcher, and trainer. She holds a MS in computer science as well as holding CISSP, CEH, and OSCP certifications. Her work in the field of smartphone exploitation has been featured in print and on television internationally. She has provided training at conferences such as Blackhat USA, Brucon, and Security Zone to excellent reviews. Georgia founded Bulb Security LLC, a security consulting firm specializing in security assessments/penetration testing, security training, and research/development. She was awarded a DARPA Cyber Fast Track grant to continue her work in mobile device security culminating in the release of the open source project the Smartphone Pentest Framework (SPF). Georgia is a member of the spring 2015 cohort at the Mach37 cyber accelerator, founding Shevirah Inc. to create product solutions for assessing and managing the risk of mobile devices in the enterprise and testing the effectiveness of enterprise mobility management solutions. She is the author of Penetration Testing: A Hands-on Introduction to Hacking from No Starch Press.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

SecBee - An automated ZigBee security scanner

Tobias Zillner Senior IS Auditor, Cognosec

The tool demonstrated will be a ZigBee security testing tool. It is basically a kind of ZigBee vulnerability scanner. So developers and security testers can check the actual product implementation for ZigBee specific vulnerabilities.

Currently it supports command injection, scan for enabled join, sniff network keys in plaintext and encrypted with the ZigBee default key and a return to factory device reset.

A complete device takeover feature is under development. The final goal is to test for the correct application and implementation of every ZigBee security service.

Tobias works as Senior IS Auditor at Cognosec in Vienna. He conducts information systems audits in order to assess compliance to relevant internal and external requirements and to provide a customer’s management with an independent opinion regarding the effectiveness and efficiency of IT systems. Furthermore, Tobias evaluates and assures security of Information Technology by performing webapplication and web service penetration tests, source code analysis as well as network and infrastructure penetration tests. He has a Bachelor degree in Computer and Media Security, a Master degree in IT Security and a Master degree in Information Systems Management. Tobias’ expertise also applies to the IT Governance, Risk and Compliance domains. He also holds a wide range of certifications like CISSP, CISA, QSA, CEH, ITIL or COBIT.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Workshops Talks List

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Embedded System Design: From Electronics to Microkernel Development

Rodrigo Maximiano Antunes de Almeida Professor, Federal University of Itajubá

Las Vegas Ballroom 7

Saturday, 09:00 - 13:00 (Break) 14:00 to 18:00

Max class size: 40

The workshop consists of a introduction on the embedded systems design. At first part of the workshop we'll build a simple electronic embedded system design (microcontroller+LCD). This system will be used as target platform. Using this platform the low level side of C language as bit-wise operations, pointers to fixed memory addresses and microcontroller peripherals access will be presented. In the second part of the workshop a full embedded microkernel will be developed. Some programming structures and libraries will be coded by the presents to suit the low memory requirements of the embedded system. They will have a better understanding on the electronics-programming relationship and how these questions can impact on the kernel development. The attendants will get a deep knowledge in the kernel basic functions (processes scheduling, i/o drivers controller, etc) and its relation to electronics circuitry. Its recommended to bring your laptop to the practical activities.

Rodrigo is a professor at Federal University of Itajubá, where he earned a PhD by developing a safer real time operational system for low cost microcontrollers. He has 8 years working with embedded systems, developing projects both in home and electro-medical appliances. He teaches classes on electronics, microcontrollerers and embedded operational systems to electronic engineering students. His researches include topics on hardware development, firmware, RTOS security, microkernels and autonomous control systems. Rodrigo has presented on DEFCON, ESC and BSides conferences, mostly talking about embedded development and related security issues.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Violent Python

Sam Bowne Security Researcher

Las Vegas Ballroom 5

Friday, 09:00 - 13:00

Max class size: 50

Even if you have never programmed before, you can quickly and easily learn how to make custom hacking tools in Python. In hands-on projects, participants will create tools and hack into test systems, including:

- Port scanning

- Login brute-forcing

- Port knocking

- Cracking password hashes

- Sneaking malware past antivirus engines

- With just a few lines of Python, it's easy to create a keylogger that defeats every commercial antivirus product, from Kaspersky to FireEye.

Technical Requirements

Participants need a computer (Windows, Mac, or Linux) with VMware Player or VMware Fusion. USB thumbdrives will be available with Kali Linux to use. All the class materials are freely available on my Web page (samsclass.info) for anyone to use.

Prerequisite Knowledge

Participants should be familiar with basic networking and security concepts like TCP/IP and brute force attacks. Previous programming experience is helpful but not necessary.

Sam Bowne has been teaching computer networking and security classes at CCSF since 2000. He has given talks at DEFCON, HOPE, BayThreat, LayerOne, and Toorcon, and taught classes at many other schools and teaching conferences.

He has these things: BS, PhD, CEH, CISSP, WCNA, and a lot of T-shirts.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Security Auditing Mobile App

Sam Bowne Security Researcher

Las Vegas Ballroom 5

Saturday, 09:00 - 13:00

Max class size: 50

Android apps are very insecure—-70% of the ones I’ve tested have vulnerabilities in the OWASP Mobile Top Ten. iOS apps have similar problems, but they are ten times less common, in my tests. It’s simple to test for common vulnerabilities with a few free tools: Android Studio, Genymotion, Burp, and apktool.

We will test for insecure network transmission, insecure local storage, and insecure logging. But the most common problem is failure to verify app signatures, so that apps can be modified and Trojan code can be added. Students will do that to a real financial app, creating a proof-of-concept that leaks out private data such as username and password.

Participants must bring laptops. Macs work best, but PCs can also be used. Linux works better than Windows. Students will set up their laptops, find vulnerabilities in real apps, and exploit them. Also bring any mobile devices you'd like to test, such as iPhones.

Sam Bowne has been teaching computer networking and security classes at CCSF since 2000. He has given talks at DEFCON, HOPE, BayThreat, LayerOne, and Toorcon, and taught classes at many other schools and teaching conferences.

He has these things: BS, PhD, CEH, CISSP, WCNA, and a lot of T-shirts.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Running KALI on a Raspberry PI and other fun tricks

Dallas Security Researcher

Las Vegas Ballroom 4

Saturday, 09:00 - 13:00 (Break) 14:00 to 18:00

Max class size: 25

Like Hacking? Like Hardware? Lets have some fun with both. Go here to pay for your kit and reserve your space.

Registration Will close to allow time to get kits on July 20. Some kits will be onsite, very few. You can still reserve a spot if you have your own hardware (see eventbrite site above).

We are going to provide a list of “parts to order” hopefully if you want to bring your own, and kits to sell at Defcon. (I recommend kit, but its up to you.). In either case we will need to reserve you a spot in the class to ensure there is enough room for power, laptops, etc. Kits are targeted to be very close to the actual cost of the hardware and goodies.

We will discuss Raspberry Pi as a hardware platform, build a stock OS and then build a Kali installation with all kinds of tips and tricks around security, programming, using the Raspberry PI, wireless hacking and more as we go through it! You will leave with a complete setup ready to go when you are done. This will include a Raspberry Pi, Wireless Card, Memory, Case, Keyboard, LCD Display and more surprises (if you get the kit). You will need to bring your laptop to have the best experience, but can be done without (but not recommended). A manual link will be included as well. You will leave with a great platform for expanding into programming, security or home automation.

We are still working it out, but the seating will be limited, and we want to ensure you have everything you need to go through the class. Currently scheduled for the Saturday of Defcon, we will also work around those who want to leave for a talk and come back. But once the class closes, we cant get anyone else in. This is scheduled as an 8 hour class, but will work with you to jump in and out for a few talks (if you want to). There will be a break for lunch as well. Keep in mind we may have a few guests drop in to say hello, add to the discussion or give out freebies…so look forward to that.

You don’t have to be an expert, just have a fair understanding of networking and a desire to learn and share. We are going to talk about and walk through a lot of topics involving the hardware, sensors, cameras, software, OS and capabilities. You will need your laptop.

Pre-Order kit will be approx $135.00 and be ready for you when you get to the class, you will assemble in class. Kit essentially includes..:

- Raspberry Pi 2 w/ Case

- 2 – 8 Gig SD Cards loaded with Kali and Raspbian image

- Wireless USB ‘Card’

- Micro Combo Keyboard / Mouse (Wireless)

- Micro Composite Display w/ cable (for Raspberry Pi 2)

- MicroUSB AC Adapter

- Network Cable from your PC to Pi

- Other Goodies in the Kit.

You will need your laptop to connect to the Pi once we get the OS installed and operational, unless you enjoy looking at a very small screen.

Internet is generally unreliable, so we will base the class assuming it may not work well, but if it does you will have additional options.

Taught by JD ‘Dallas’ Landrit, who currently works in Security for a major Oil and Gas company somewhere in the Midwest. Often popping up around the world at hacker spaces, conferences, Makerfaire and other fun places – occasionally speaking and geeking out with friends. He likes to hang out with his old government buddies, explore third-world countries and Goon while at Defcon, of which this will be his 12th straight year.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Crypto for Hackers: The Workshop

Eijah Founder, demonsaw

Las Vegas Ballroom 5

Friday and Saturday, 14:00 to 18:00

Max class size: 50

Love Crypto? Hate DRM? Then let's hack the shit out of AACS together.

Crypto for Hackers: The Workshop is the continuation of the Crypto for Hackers talk. We'll spend 4 hours working our way through a variety of C++ crypto exercises designed specifically for Def Con attendees. We'll implement and use all five types of crypto algorithms discussed in the talk, including ciphers (e.g. AES), hash functions (e.g. SHA-512), hash-based message authentication codes (e.g. HMAC-SHA-512), key agreement schemes (e.g. Diffie-Hellman), and password-based key derivation functions (e.g. PBKDF2).

Next we'll put our new crypto knowledge to the test and attempt to reproduce the AACS memory hack I did when I released the first Blu-Ray device key to the world: AA856A1BA814AB99FFDEBA6AEFBE1C04. You'll have actual PowerDVD memory dumps that you'll need to parse, analyze, and then figure out how to reverse engineer. I'll provide guidance and oversight, but you'll be the one writing the code, exploiting the vulnerabilities, and finding the AACS encryption keys.

Please note that this is an intermediate-level, technical workshop and requires that all attendees have a strong working knowledge of C++. While attending the Crypto for Hackers talk is extremely helpful, it is not required. As part of the workshop I'm providing a free and open-source crypto library that I wrote called demoncrypt. This is the same library used by demonsaw, the secure and anonymous content sharing application that I launched last year at Def Con. Bring your laptop, your favorite C++ 11 compiler (>= gcc 4.7 or msvc 2013), and a strong attitude of civil disobedience.

Eijah is the founder of demonsaw, a secure and anonymous content sharing platform, and a Senior Programmer at a world-renowned game development studio. He has over 15 years of software development and IT Security experience. His career has covered a broad range of Internet and mid-range technologies, core security, and system architecture. Eijah has been a faculty member at multiple colleges, has spoken about security and development at conferences, and holds a master’s degree in Computer Science. Eijah is an active member of the hacking community and is an avid proponent of Internet freedom.

Twitter: @demon_saw

Web: https://www.demonsaw.com

Facebook: https://www.facebook.com/Demonsaw

Github: https://github.com/eijah/demonsaw

Email: eijah at demonsaw dot com

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

The Art of VoIP Hacking

Fatih Ozavci Security Researcher

Christos Archimandritis Security Researcher

Las Vegas Ballroom 6

Saturday, 09:00 - 13:00 (Break) 14:00 to 18:00

Max class size: 50

VoIP attacks have evolved, and they are targeting Unified Communications (UC), commercial services, hosted environment and call centres using major vendor and protocol vulnerabilities. This workshop is designed to demonstrate these cutting edge VoIP attacks, and improve the VoIP skills of the incident response teams, penetration testers and network engineers. Signalling protocols are the centre of UC environments, but also susceptible to IP spoofing, trust issues, call spoofing, authentication bypass and invalid signalling flows. They can be hacked with legacy techniques, but a set of new attacks will be demonstrated in this workshop. This workshop includes basic attack types for UC infrastructure, advanced attacks to the SIP and Skinny protocol weaknesses, network infrastructure attacks, value added services analysis, Cdr/Log/Billing analysis and Viproy use to analyse signalling services using novel techniques. Also the well-known attacks to the network infrastructure will be combined with the current VoIP vulnerabilities to test the target workshop network. Attacking VoIP services requires limited knowledge today with the Viproy Penetration Testing Kit (written by Fatih). It has a dozen modules to test trust hacking issues, information collected from SIP and Skinny services, gaining unauthorised access, call redirection, call spoofing, brute-forcing VoIP accounts, Cisco CUCDM exploitation and debugging services using as MITM. Furthermore, Viproy provides these attack modules in the Metasploit Framework environment with full integration. The workshop contains live demonstration of practical VoIP attacks and usage of the Viproy modules.

In this hands-on workshop, attendees will learn about basic attack types for UC infrastructure, advanced attacks to the SIP protocol weaknesses, Cisco Skinny protocol hacking, hacking Cisco CUCDM and CUCM servers, network infrastructure attacks, value added services analysis, Cdr/Log/Billing analysis and Viproy VoIP pen-test kit to analyse VoIP services using novel techniques. New CDP, CUCDM and Cisco Skinny modules and techniques of Viproy will be demonstrated in the workshop as well.

Who should attend

Penetration testers, VoIP engineers, security engineers, internal auditors and all hackers who have a wireless card and a VM player.

Workshop Requirements

Participants should have an up to date Kali Linux virtual machine with Metasploit Framework. (The disk image will be provided by the tutors)

Christos Archimandritis has nearly 5 years’ of experience in information security consulting, having performed various security assessments for clients in the banking, telecom and government sector. Prior to joining Sense of Security, he was a senior security consultant with a major consulting company in Europe. While working there, he performed network and web application penetration tests, mobile application penetration tests and wireless assessments for various clients in Europe and the Middle East. Before that, he worked in the European branch of a major company in the automotive sector, developing solutions for the company’s SAP and Business Objects environments as well as administering the company’s data warehouse.

Linkedin : http://gr.linkedin.com/pub/chris-archimandritis/52/580/478

Fatih Ozavci is a Security Researcher, Principal Security Consultant with Sense of Security, and the author of the Viproy VoIP Penetration Testing Kit. Fatih has discovered several previously unknown security vulnerabilities and design flaws in IMS, Unified Communications, Embedded Devices, MDM, Mobility and SAP integrated environments for his customers. He has completed several unique penetration testing services during his career of more than 15 years. His current research is based on securing IMS/UC services, IPTV systems, attacking mobile VoIP clients, VoIP service level vulnerabilities, SaaS, mobility security testing, hardware hacking and MDM analysis. Fatih has presented his VoIP and mobile research at BlackHat USA’14, DefCon 22 and 21, Troopers’15, Cluecon 2013 and Ruxcon 2013. He has also provided VoIP and Mobility Security Testing workshop at AustCert’14, Kiwicon'15 and Troopers'15 events.

Homepage : http://viproy.com/fozavci

Linkedin : http://tr.linkedin.com/pub/fatih-ozavci/54/a71/a94

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

iOS Application exploitation

Prateek Gianchandani Security Researcher

Las Vegas Ballroom 4

Friday, 09:00 - 13:00 (Break) 14:00 to 18:00

Max class size: 50

This will be an introductory course on exploiting iOS applications. The training will be based on exploiting Damn Vulnerable iOS app and other vulnerable apps which are written by the trainer in order to make people understand the different kinds of vulnerabilities in an iOS application. This course will also discuss how a developer can secure their applications using secure coding and obfuscation techniques. After the workshop, the students will be able to successfully pentest and secure iOS applications.

The following vulnerabilities in iOS applications will be discussed…

- Insecure Data Storage

- Extension Vulnerabilities

- Attacks on third party libraries

- Jailbreak Detection

- Runtime Manipulation

- Piracy Detection

- Sensitive information in memory

- Transport Layer Security (http, https, cert pinning)

- Client Side Injection

- Information Disclosure

- Broken Cryptography

- Security Decisions via Untrusted input

- Side channel data leakage

- Application Patching

It is recommended that users bring their own jailbroken iOS devices for trying out the demos. Any jailbroken device (iPhone, iPod, iPad) running up to iOS 8.4 will be fine.

Prateek Gianchandani, an OWASP member and contributor has been working in the infosec industry for about 5 years. He is currently working as an Information security engineer for an airlines company. During his five years, he has performed a number of penetration tests on mobile and web applications and even developed a lot of applications for the App Store. His core focus area is iOS application pentesting and exploitation. He is also the author of the open source vulnerable application named Damn Vulnerable iOS app and also runs a popular blog series on iOS application security at http://highaltitudehacks.com/security.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Advanced Cyber Exercises

Andrea Guerber Delta Risk LLC, A Chertoff Company

Las Vegas Ballroom 7

Friday, 09:00 - 13:00

Max class size: 50

This workshop discusses the rationale, types, structure, organization, execution, and value of cyber exercises. The course discusses the four phases of exercises: objective setting, planning, execution, and evaluation, compares methodologies with the national HSEEP (Homeland Security Exercise and Evaluation Program) and highlights execution considerations and risk management of "live-fire" cyber exercises on operational networks. Students are presented an overview of advanced cyber exercises, moving beyond traditional table-top exercises, and the considerations for running cyber exercises on both operational and closed-range networks.

Andrea Guerber is a Senior Associate with Delta Risk, LLC. She has 10 years of experience developing advanced cyber exercise methodologies for the US military, as well as state, local, and tribal levels that can be used in the context of the Homeland Security Exercise Evaluation Program (HSEEP) to improve the cyber defense of critical infrastructure and key resource sectors. She managed the Delta Risk effort that developed the scenario for, and supported planning and execution of, FEMA’s National Level Exercise in 2012 – the first tier-one exercise that focused on a large-scale cyber attack. She is a technical leader and innovator in cyber warfare operations with military information operations experience, understanding defensive and adversary tactics and their application to defensive operations.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Exploited Host Analysis

Robin Jackson WT Forensics

Ed Williams WT Forensics

Las Vegas Ballroom 1

Friday & Saturday, 09:00 - 13:00 (Break) 14:00 to 18:00

Max class size: 50

Exploited Host Analysis is an 8 hour overview into the various techniques used to examine a host machine and it's corresponding network traffic to determine what happened, who did it and when. The course will briefly cover the fundamentals of Digital Forensic analysis including Locard's Exchange Principle, the order of volatility, methods and tools for acquisition and proper evidence documentation and handling. After the overview students will be led through various scenarios including:

- Packet capture analysis

- Memory Analysis using Volatility

- Log file analysis

- Deobfuscation and analysis of a web shell

- Disk analysis including timeline creation

- Registry analysis and deobfuscation of registry only malware

There will be a ton of examples and the emphasis will be upon the use of free and open source tools to achieve results. Of course we'll only really scratch the surface of each topic but we'll give you plenty of online resources to continue your exploration of Digital Forensics.

Ed Williams and Robin Jackson are the DC3 Forensics Challenge US Overall Winners as well as the EC-Council International Civilian winners for 2010. Both Ed and Robin had a long history with computers,incident response and digital forensics. After their 2010 win they formed WT Forensics, a Montana based LLC dedicated to bringing security services, training and Digital Forensics / Incident Response (DFIR) to their home state. Robin is currently a Master Security Consultant for Hewlett Packard's Digital Investigation Service. Ed is currently a DFIR investigator for the State of Montana's Department of Administration.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

ARM for Pentesters

Aseem Jakhar Security Researcher

Las Vegas Ballroom 6

Friday, 09:00 - 13:00 (Break) 14:00 to 18:00

Max class size: 20

The workshop is aimed at Pentesters and security professionals who want to get into pentesting ARM based systems such as smart phones, IoT devices, TVs etc. We will use Android as the ARM based platform for the workshop and take a deep dive into ARM assembly, Android Native development components, buffer overflows and shellcoding. The workshop introduces the attendees to the ARM Android platform including the intrinsic technical details and security issues using a balanced proportion of theory and extensive hands-on and exercises. It provides a base for the attendees to start researching on ARM based systems.

Modules

- Android Native Dev Primer

- ARM Architecture

- Assembly

- Call conventions

- Shellcoding

- Runtime Code injection using Indroid

- Buffer overflows

Aseem Jakhar is the Director, Research at Payatu Technologies Pvt Ltd http://payatu.com a boutique security testing company. He is well known in the security community as the founder of null -The open security community, registered not-for-profit organization http://null.co.in and also the founder of nullcon security conference http://nullcon.net and hardwear.io security conference http://hardwear.io He has extensive experience in system programming, security research, consulting and managing security software development projects. He has worked on various security software including UTM appliances, messaging/security appliances, anti-spam engine, anti-virus software, Transparent HTTPS proxy with captive portal, bayesian spam filter to name a few. He is an active speaker at security and open source conferences; some of the conferences he has spoken at include AusCERT, Defcon, Hack.lu, Black Hat, PHDays, Xcon, Cyber security summit - Bangalore, Cocon, OSI Days - Bangalore, Clubhack, Gnunify. His research includes Linux remote thread injection, automated web application detection and dynamic web filter. He is the author of open source Linux thread injection kit -Jugaad and Indroid which demonstrate a stealthy in-memory malware infection technique.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Analyzing Internet Attacks with Honeypots

Ioannis Koniaris Security Engineer, Yelp

Las Vegas Ballroom 3

Friday, 09:00 - 13:00

Max class size: 50

In the field of computer security, honeypots are systems aimed at deceiving malicious users or software that launch attacks against the servers and network infrastructure of various organizations. They can be deployed as protection mechanisms for an organization’s real systems, or as research units to study and analyze the methods employed by human hackers or malware. In this workshop we will outline the operation of two research honeypots, by manual deployment and testing in real time. A honeypot system will undertake the role of a web trap for attackers who target the SSH service in order to gain illegal server access. Another one will undertake the role of a malware collector, usually deployed by malware analysts and anti-virus companies to gather and securely store malicious binary samples. We will also talk about post-capturing activities and further analysis techniques. As an example, we will see how to index all the captured information in a search engine like Elasticsearch and then utilize ElastAlert, an easy to use framework to setup meaningful alerting. Lastly, visualization tools will be presented for the aforementioned systems, plus a honeypot bundle Linux distribution that contains pre-configured versions of the above tools and much more related utilities, which can make the deployment of honeypots in small or large networks an easy task.

Ioannis is an Information Security engineer and researcher, working to protect company assets, data and operations. His general interests are programming, security, development operations (DevOps) and cloud computing while his academic interests include honeypots, honeyclients, botnet tracking, malware analysis, intrusion detection and security visualization. Ioannis has released a number of utilities to aid information security professionals using honeypots. Some of them are Kippo-Graph, Honeyd-Viz and HoneyDrive; a self-contained honeypot bundle Linux distribution. These tools are used by numerous university researchers, various CERT teams worldwide and have also been included in the “Proactive detection of security incidents II – Honeypots” report by ENISA (European Union Agency for Network and Information Security).

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Offensive and Defensive: Android Reverse Engineering

Tim "Diff" Strazzere Red Naga

Jon "jcase" Sawyer Red Naga

Caleb Fenton Red Naga

Las Vegas Ballroom 2

Friday, 09:00 - 13:00 (Break) 14:00 to 18:00

Max class size: 40

Thinking like an attacker, you will learn to identify juicy Android targets, reverse engineer them and find vulnerability and write exploits. We will deep dive into reverse engineeriing Android frameworks, applications, services and boot loaders with the end goal of rooting devices.

Approaching from a defensive perspective, we will learn quickly triage applications to determine maliciousness, exploits and weaknesses. After learning triage skills we will deep dive into malicious code along while dealing with packers, obfuscators and anti-reversing techniques.

Between the two aspects of this class, you should walk away with a basic overall of your reversing engineering knowledge and a strong understanding of how to further develop your skills specifically for mobile platforms.

Prerequisites:

We would expect students to know minimal reverse engineering concepts, would also be good though not required to have some of the following non-free tools;

- IDA Pro

- Hopper

- JEB

Tim "diff" Strazzere is a Lead Research and Response Engineer at Lookout Mobile Security. Along with writing security software, he specializes in reverse engineering and malware analysis. Some interesting past projects include having reversing the Android Market protocol, Dalvik decompilers and memory manipulation on mobile devices. Past speaking engagements have included DEFCON, BlackHat, SyScan, HiTCON and EICAR, QSPI.

Jon "Justin Case" Sawyer - Father of four, and CTO of Applied Cybersecurity LLC. Jon likes to spend his nights with a fine (cheap) glass of wine, writing exploits for the latest Android devices. When not researching vulnerabilities or writing exploits, he dabbles in dalvik obfuscation.

Caleb Fenton is a security researcher at SourceClear. His focus is reverse engineering and application security. Past projects include generic Dalvik deobfuscation, Android app tampering detection and prevention, and automated Android app modification.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

From Spam to Threat Intel

Robert Simmons Senior Threat Intelligence Researcher, ThreatConnect, Inc

Las Vegas Ballroom 7

Friday, 14:00 to 18:00

Max class size: 30

You get massive amounts of spam. I get massive amounts of spam. I love to get massive amounts of spam, and I try to find ways to get more spam every day. Why? Because it is a rich source of threat data!

The author of a new variant of Zeus has just finished a build and is going to spray the internet with copies of it. Why should you wait until someone submits it to an online virus scanner when you can have the bad guy email it directly to you!

This workshop will walk you through three basic tools that will allow you to turn your deluge of spam first into usable data, then convert it into usable threat intel. The first tool is ElasticSearch. You will learn how to convert all your spam’s component parts into a JSON document and ingest it using ElasticSearch. It can then be visualized to make pretty graphs. From there, you have two basic vectors of maliciousness: URLs and Attachments. You will then learn how to use the tool Thug, a low interaction honey client, to analyze the URLs. In the other department, attachments, you will learn how to use Cuckoo Sandbox to analyze the email attachments along with any payload binaries captured by Thug. Fortunately both of these tools produces JSON output, and you will learn how to feed that back into ElasticSearch for final analysis and visualization. You will learn a small bit of Python code (nothing to be afraid of) that will do some basic data transformation and data movement from tool to tool.

This is not a workshop about how to build or muck around with putting the system together. All the components that we will use come pre-configured so we can dive right into understanding the tools’ output and comprehending how to extract actionable intelligence from these tools.

Students are expected to provide his or her own laptop for the duration of the workshop. Windows, Linux, or Mac OS X are all acceptable, but please make sure its an up-to-date version. Additionally, please have the current version of VirtualBox installed and make sure that VMs are able to communicate using the wireless network adapter. This free software can be downloaded from https://www.virtualbox.org/wiki/Downloads

Robert Simmons is a Senior Threat Intelligence Researcher for ThreatConnect, Inc. With an expertise in building automated malware analysis systems based on open source tools, he has been tracking malware and phishing attacks and picking them apart for years. Robert is also the author of PlagueScanner, an open source virus scanner framework.

Robert, also known as Utkonos, has a background in biology, linguistics, and Russian area studies. He has lived extensively in Russia and Ukraine and has been known to swear profusely and constantly in Russian.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Excuse me, your RFID is showing

Valerie Thomas Securicon

Terry Gold IDanalyst LLC

Las Vegas Ballroom 3

Friday, 14:00 to 18:00

Max class size: 30

In the hacking world, physical access is king. Many organizations rely on RFID technology to control physical access to a variety of assets, critical infrastructure and core operations but few understand its proprietary architecture and real-world implementation. This workshop covers how physical access control systems work from the ground up including architecture, common policy, and components. We'll deep dive into the world of RFID starting with raw data analysis via oscilloscope and move on to access card technology data structures and formats. Then we'll put it all together to form attacks on various card technologies that can be utilized in red team operations in a variety of environments.

For students who wish to participate in the hands-on portion of the workshop, a laptop with Windows 7 or 8 (native or virtual machine) is required. Tweet questions to @hacktress09 and @TerryGold2048 with #YourRFIDIsShowing.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

From 0 To Pwnd - The Ultimate Social Engineering Primer

Valerie Thomas Securicon

Las Vegas Ballroom 3

Saturday, 09:00 - 13:00 (Break) 14:00 to 18:00

Max class size: 50

Are you a pen tester in need of social engineering training? Perhaps you just want an understanding of what social engineering is all about. This workshop has something for everyone. First we'll begin with the basics of social engineering and why it works, then dive into non-traditional topics such as spycraft, acting, pressure sales, and the psychology behind them. Next we'll build upon that knowledge to create social engineering attacks. We'll cover the steps of the social engineering process from planning to post-attack including real-world examples. We'll end the day with the basics of appearance hacking and utilizing social engineering in physical penetration testing.

Thursday  -  DC Talks Index  -   DC Speakers Index  -   DC Talks List  -   WOS Talks List  -   WShops Talks List  -   DL Talks List

Social Engineering Village

Friday, August 7

16:00

Yellow Means Proceed with Caution - Applied De-escalation for Social Engineering

Noah Beddome

Directing the nature and dynamic of social interactions is at the heart of social engineering. One of the most impactful forms of this is being able to make a functional interaction out of a hostile or uncomfortable one. During this talk we will look at the different levels of intensity within interactions and ways to manage them.

BIO: Noah Beddome is Former Marine and a present security consultant. His professional focus is on attack simulation with special emphasis on physical and interpersonal social engineering.

Friday, August 7

17:00

“I Didn’t Think it was Loaded” and Other Mental Derps

Michele Fincher

How many of you have ever yelled “Hey, watch this!” and lived to tell the tale? This year’s exciting glimpse into psychology and its application to security is around the fun topic of decision-making. Psychologists estimate that we make thousands of decisions a day. THOUSANDS. Now, many of these are trivial, but at least some of them have the potential to impact the security of your organization. We all think we’re great decision makers, and we’re all wrong at some point in our lives. Join me to get a better understanding of how and why we make our choices, and what you can do to improve your skills and guide your users to a happier (and safer) place!

BIO: Michele Fincher is the Chief Influencing Agent of Social-Engineer, Inc., possessing over 20 years experience as a behavioral scientist, researcher, and information security professional. Her diverse background has helped solidify Social-Engineer, Inc.’s place as the premier social engineering consulting firm.

As a US Air Force officer, Michele’s assignments included the USAF Academy, where she was a National Board Certified Counselor and Assistant Professor in the Department of Behavioral Sciences and Leadership. Upon separating from the Air Force, Michele went on to hold positions with a research and software development firm in support of the US Air Force Research Laboratory as well as an information security firm, conducting National Security Agency appraisals and Certification and Accreditation for federal government information systems.

At Social-Engineer, Inc., Michele is a senior penetration tester with professional expertise in all facets of social engineering vectors, assessments, and research. A remarkable writer, she is also the talent behind many of the written products of Social-Engineer, Inc., including numerous reports and assessments, blog posts, and the Social-Engineer Newsletters.

Michele has her Bachelor of Science in Human Factors Engineering from the US Air Force Academy and her Master of Science in Counseling from Auburn University. She is a Certified Information Systems Security Professional (CISSP).

Friday, August 7

18:00

Understanding Social Engineering Attacks with Natural Language Processing

Ian Harris

Social engineering attacks are a growing problem and there is very little defense against them since they target the human directly, circumventing many computer-based defenses. There are approaches to scan emails and websites for phishing attacks, but sophisticated attacks involve conversation dialogs which may be carried out in-person or over the phone lines. Dialog-based social engineering attacks can employ subtle psychological techniques which cannot be detected without an understanding of the meaning of each sentence.

We present a tool which uses Natural Language Processing (NLP) techniques to gain an understanding of the intent of the text spoken by the attacker. Each sentence is parsed according to the rules of English grammar, and the resulting parse tree is examined for patterns which indicate malicious intent. Our tool uses an open-source parser, the Stanford Parser, to perform parsing and identify patterns in the resulting parse tree. We have evaluated our approach on three actual social engineering attack dialogs and we will present those results. We are also releasing the tool so you can download it and try it for yourself.

BIO: Ian G. Harris is currently Vice Chair of Undergraduate Education in the Computer Science Department at the University of California Irvine. He received his BS degree in Computer Science from Massachusetts Institute of Technology in 1990. He received his MS and PhD degrees in Computer Science from the University of California San Diego in 1992 and 1997 respectively. His field of interest includes validation of hardware systems to ensure that the behavior of the system matches the intentions of the designer. He also investigates the application of testing for computer security. His group’s security work includes testing software applications for security vulnerabilities and designing special-purpose hardware to detect intrusions on-line.

Friday, August 7

19:00

I Am Not What I Am: Shakespeare and Social Engineering

John Ridpath

Teeming with experts in manipulation – from Machiavellian villains like Iago and Richard III, to more playful tricksters like Puck and Viola – William Shakespeare’s plays offer a surprising and fresh perspective on the art of social engineering. Via a deep analysis of the language and actions of these characters, we will explore Shakespeare’s skill in pretexting, spearphishing and baiting. With his mastery of the English language and appreciation of human psychology, there’s still a lot to learn from Shakespeare.

BIO: John Ridpath is Head of Product at Decoded. Most recently, he has worked on creating Hacker in a Day: a one day course designed to initiate non-technical audiences into the world of cybersecurity. Having studied an MA in Shakespeare at UCL, his early career spanned software development, journalism and lecturing.

Friday, August 7

20:00

Classify Targets to Make Social Engineering Easier to Achieve

Heng Guan

There are so many factors (culture, age, gender, level of vigilance, when to choose…) will affect the realization of each Social Engineering action. Since information gathering is needed, why not classify the targets first to increase the success rate? When people get trained, how to accomplish social engineering once more? This is a discussion about how to bypass the human WAF according to different characteristics, as a complement to existing research.

BIO: I am one of the few women security researcher & engineer working at TOPSEC, a leading company ranked first in Chinese information security market firewalls and hardware more than 10 consecutive years, having approximately 2000 workers. Graduated from Nanjing University of Aeronautics and Astronautics, one of China’s leading universities of science and engineering. Bachelor of Computer Science and Technology.

Saturday, August 8

16:00

Breaking in Bad! (I’m the one who doesn’t knock)

Jayson Street

I start off the talk describing each one of the below listed attack vectors I use. I tell a story from each of them I show video of me breaking into a bank in Beirut Lebanon. I show video of gaining access to USA State Treasury office. The most important part of my talk is not that at all. I spend the entire last half of the talk creating a security awareness talk! Where I go into ways to spot me (or any attacker) I show the different tools and devices users should be aware of. I show how users should approach a situation if someone like me is in the building or interacting with them online. I basically use this talk to entertain the security people in the audience enough that they will take this back to their work and share my PowerPoint and video of my talk with their executives and co-workers.

BIO: Jayson E. Street is an author of Dissecting the hack: The F0rb1dd3n Network and Dissecting the hack: The V3rb0t3n Network from Syngress. Also creator of http://dissectingthehack.com He has also spoken at DEFCON, DerbyCon, UCON and at several other CONs and colleges on a variety of Information Security subjects. His life story can be found on Google under Jayson E. Street *He is a highly carbonated speaker who has partaken of Pizza from Beijing to Brazil. He does not expect anybody to still be reading this far but if they are please note he was chosen as one of Time’s persons of the year for 2006.

Saturday, August 8

17:00

Twitter, ISIL, and Tech

Tim Newberry

There is a concerted effort by researchers to understand how the Islamic State of Iraq and Levant (ISIL) is capable of influencing and radicalizing socially vulnerable audiences around the world via digital means. These efforts are demonstrated in a limited body of research that are often times rooted in conventional processes, therefore, having limited direct application to today’s dynamic, open-source digital environment. This environment affords a challenging, yet unique, opportunity to employ open source machine learning techniques guided by social learning and routine activities theory from the criminological field of study. This presentation will discuss a human driven, but machine assisted framework for identifying ISIL methods and victims in order to facilitate an effective counter-narrative for engaging the victims prior to influence happening. The framework utilizes historically based research designs to develop the frameworks, but machine learning to train classification algorithms utilizing data pulled from the Twitter API for modern application. The Scikit-Learn set of tools for Python were used to rapidly prototype tools for data mining and data analysis.

BIO: Timothy Newberry is a former Naval Officer and subject matter expert in digital training design and adversarial use of the internet. As a co-founder of White Canvas Group, Tim was selected to create, design, and implement a program for the CIAs Counter Terrorism Center producing measurable results against global terror networks. Tim has provided countless hours of subject matter expertise and creative design support to US Special Operations Forces (SOF) in developing alternative technical solutions for existing mission requirements within SOF. Since founding WCG, Tim has built technologies like GridMeNow, a location-based service for enhanced situational awareness, which has since been spun off into its own company. Tim has also been a noted speaker at venues such as the Global Information Operations conference in London and the World Wide Information Operations conference in Washington DC.

Prior to White Canvas Group, Tim was a Submariner for eight years of active duty service while completing various assignments in the Pacific, Iraq and Washington DC areas. He is a 2000 graduate from the United States Naval Academy where he earned a B.S. in Computer Science and graduated with distinction. He has an M.S. in Engineering Management from Catholic University of America, a masters level equivalent in Nuclear Engineering for US Naval Nuclear Power Plant operations, and is currently a PhD candidate at the University of New Haven where his focus is on the intersection of new age digital challenges and criminal justice.

Saturday, August 8

18:00

A Peek Behind the Blue Mask: The Evolution of the SECTF

Chris Hadnagy

Join HumanHacker in an in-depth exploration of the mysterious world of the SECTF. From a small competition demonstrating a live compromise of fortune 500 companies to a full-scale village, how has the Social Engineering CTF evolved? What are the greatest takeaways from hosting 6 years of CTF competitions? It’s not often you get to hear what goes on behind the scenes. This informative talk will help social engineers, pentesters and future SECTF contestants alike understand how the Social Engineering CTF works. How are results calculated? What attack vectors have the highest success rate? What’s in a theme? What implications does the contest have for the world of SE and the state of corporate security? He’ll discuss expectations from the highest caliber social engineers and how he’s seen social engineering attacks evolve throughout the years. Part education, part documentary, this presentation is an ode to all things SE from the man who started it all.

BIO: When struck by lightning Chris Hadnagy was transformed into loganWHD and infused with the power of social engineering and the ability to identify the weak point in any physical security system. Countering the natural instinct to use his powers for self gain, Chris has spent his time teaching others in the lost arts of many security topics and spreading knowledge through articles and interviews published in local, national, and international magazines and tv shows and books. Hidden amongst normal mortals as the Chief Human Hacker of Social-Engineer, Inc, Chris currently lives a hidden life as the lead developer of Social-Engineer.Org and is the author of a few books on social engineering. If you are in trouble, and no one else can help, you can contact Chris online at www.social-engineer.com or twitter at @humanhacker

Saturday, August 8

19:00

Understanding End-User Attacks – Real World Examples

Dave Kennedy

ct: From our own analysis, phishing attacks for the first time are the number one attack vector superseding direct compromises of perimeter devices. Endpoints are now subjective to a number of different types of attacks and it’s all around targeting the user. This talk will walk through a number of targeted attacks that elicit social engineering aspects in order to gain a higher percentage of success against the victims. Additionally, we’ll be covering newer techniques used by attackers to further their efforts to move laterally in environments. Social engineering is here to stay and the largest risk we face as an industry – this talk will focus on how we can get better.

Bio: Dave Kennedy is founder of TrustedSec and Binary Defense Systems. Both organizations focus on the betterment of the security industry from an offense and a defense perspective. David was the former Chief Security Officer (CSO) for a Fortune 1000 company where he ran the entire information security program. Kennedy is a co-author of the book “Metasploit: The Penetration Testers Guide,” the creator of the Social-Engineer Toolkit (SET), and Artillery. Kennedy has been interviewed by several news organizations including CNN, Fox News, MSNBC, CNBC, Katie Couric, and BBC World News. Kennedy is the co-host of the social-engineer podcast and on a number of additional podcasts. Kennedy has testified in front of Congress on two occasions on the security around government websites. Kennedy is one of the co-authors of the Penetration Testing Execution Standard (PTES); a framework designed to fix the penetration testing industry. Kennedy is the co-founder of DerbyCon, a large-scale conference in Louisville Kentucky. Prior to Diebold, Kennedy was a VP of Consulting and Partner of a mid-size information security consulting company running the security consulting practice. Prior to the private sector, Kennedy worked for the United States Marine Corps and deployed to Iraq twice for intelligence related missions.Directing the nature and dynamic of social interactions is at the heart of social engineering. One of the most impactful forms of this is being able to make a functional interaction out of a hostile or uncomfortable one. During this talk we will look at the different levels of intensity within interactions and ways to manage them.

Saturday, August 8

20:00

Phishing: Recon to Creds with the SpeedPhishing Framework

Adam Compton & Eric Gershman

This presentation will quickly explore some of the common phishing attack tools and techniques. Additionally, there will be a demo of a new tool, which can assist penetration testers in quickly deploying phishing exercises in minimal time. The tool can automatically search for potential targets, deploy multiple phishing websites, craft/send phishing emails, record the results, generate a basic report, among other bells and whistles.

Bios: Adam Compton currently works as a penetration tester and has over 20 years of infosec experience, 15 years as a penetration tester. He has worked in both the government and private sectors for a variety of customers ranging from domestic and international governments, multinational corporations, and smaller local business.

Eric Gershman is currently working on the security team for a group that manages large systems that enable researchers to do “Big Science”. Prior to working in security Eric pursued a bachelors degree in Information Technology at the University of Central Florida. During his time at UCF, he worked as a technician on a large help desk, research intern for an Anti-Virus company and finally as a Linux Systems Administration for several Department of Defense projects.

Speaker: Walter Powell aka Mr_Br!ml3y

Biosecurity and information security share a common vocabulary and threat environment due to the shared infection paradigm. Since both biosecurity and information security exist in an environment with pervasive and continuously evolving threats, both fields utilize similar methods to reduce risk: controlled access to facilities (isolation), maintenance of 'safe' environment (sanitation), user training (education), and ongoing checks for hazards (monitoring). The main differences between the two are ease of attack (virtual vs. physical) and costs/penalties for failure.

Walter Powell aka Mr_Br!ml3y

Mr_Br!ml3y grew up farming and liked it so much he went into information technology at the first opportunity. He has 5 years full-time infosec experience and strong side interests in biology and chemistry. He is currently trying to social engineer some department into paying for his PhD.

Speaker: Michael Goetzman @Goetzman

The advent of rapid 'Next-Generation' DNA sequencing methods has greatly accelerated biological and medical discovery steering society into a paradigm shift, the genomic era, of personalized medicine. This trend promises an affordable insight into your personal genome potentially giving individual’s personal advantages. What information is hidden within a strand of DNA and what are implications of accessing this data? Will these rapid advancements enhance humanity without sacrificing ethics and personal exposure? Can society overcome challenges stemming from emerging technologies such as massive internet accessible databases and cloud storage?

Michael Goetzman

Twitter: @Goetzman

Website: http://goetzman.co

Michael Goetzman is an Information Security Specialist for a midwestern nonprofit collection of 18 hospitals employing over 22,000 associates. His responsibilities include the confidentially of electronic medical records and general protection of sensitive data. Michael holds a masters of science in management involving international studies in Havana, Cuba studying healthcare related technologies and earned his CISSP. On his free time, Michael enjoys exotic rides in zeppelins, soaring in experimental planes, and piloting colorful hot air balloons. Michael believes in freedom of non-harmful information, equality before the law, the advancement of scientific research, and the individual imperative.

Speakers:

David Whitlock david.r.whitlock

Jasmina Aganovic @JasminaAganovic

A Hacker needs intimate and thorough understanding of the internal workings of a system to successfully and elegantly manipulate that system; along with the chutzpah to do so. ;)

Living tissue is active matter; it dissipates free energy while maintaining itself in a viable state. This requires a Control system that reduces the degrees of freedom of the system to only those desired.

All disorders are disorders of control. Either Control allowed physiology to get into a bad state, or Control did not get physiology out of a bad state.

Bio-hacking requires understanding physiology from the perspective of Control.

Good design heuristics make modular systems with designed interfaces. Evolution didn't do that. Modern living environments are very different than environments our ancestors evolved in. Not surprising a number of disorders that are common in the urban developed world are rare to unknown in the rural undeveloped world; things like diabetes, obesity, allergies, inflammatory disorders. This observation has lead to the “hygiene hypothesis”; the idea that there is a “factor” associated with “dirt” or lack of “hygiene” that is protective. This presents the hypothesis that the loss of ammonia oxidizing bacteria through modern bathing practices adversely affects the background nitric oxide level and so perturbs all NO-mediated control pathways, with no threshold.

The importance of the background level of nitric oxide will be discussed in the context of a component of the human microbiome; ammonia oxidizing bacteria living on the skin and converting ammonia in sweat into nitrite and nitric oxide so as to set the background NO/NOx level to avoid nitropenia.

David Whitlock

Facebook: david.r.whitlock

Company Website: http://aobiome.com

David Whitlock is Chief Scientist/co-founder of AOBiome and discovered that AOB are commensal organisms for many eukaryotes. He received his MS and BS in Chemical Engineering from MIT.

Jasmina Aganovic

Twitter: @JasminaAganovic

Company Website: http://aobiome.com

Jasmina is a consumer goods entrepreneur who received her degree in chemical and biological engineering from MIT. Her unconventional path combined her technical background with roles at personal care brands.

Speaker: Avani Wildani

Neural networks in the brain are sparsely connected, composed of components with an over 50% failure rate, and still amazingly consistent in their high-level behavior over time. We are building models of biologically plausible neural networks to help explain how the brain can protect against a malicious adversary while keeping networks tiny, low power, and easily trained. Using parameters taken from the somatosensory cortex, we have built a simulator to show the relationships between connectivity and severity of possible attacks. Some prior knowledge of distributed system design is helpful, and we'll teach you all of the neuroscience you need to know.

Avani Wildani

Dr. Avani Wildani (neuron) is a postdoctoral fellow at the Salk Institute, where she is applying her background in distributed systems to exploring the security profile of computational neurobiology. Her Ph.D. work included finding correlated disk activity by analyzing block I/O traces collected through tapping the SATA bus. She believes that the best way of understanding how a system is designed is to understand the attacks it can and cannot defend against. She is usually found with Toool, tinkering with something small and sharp.

Speakers:

Christian "quaddi" Dameff MD @CDameffMD

Jeff "r3plicant" Tully MD @JeffTullyMD

Peter Hefley @PeterHefley

We live in a world shaped by the hacker ethos. Systems underlying the backbone of our daily lives - from government to finance to entertainment - have grown and evolved based in part on the ingenuity and input of people like you. What happens when we take that drive to understand, tinker, and (most of all) improve, and turn it towards the most complex system on Earth? Welcome to the world of biohacking.

Join two doctors/hackers and an infosec security pro as they take a deep dive into the realm of implantable mods, from the smallest DIY project to the cutting-edge in academic and industrial prototypes. This talk will also outline principles of successful human modification as well as highlight the need for caution at a time when innovation and imagination is pursued at the expense of security. But above all else, this talk is a celebration of the pioneering spirit of grinder culture and a call for hackers to continue to shape the future of what may be the most important movement in human history.

Christian "quaddi" Dameff MD

Twitter: @CDameffMD

Christian (quaddi) Dameff is an emergency medicine physician, former open capture the flag champion, prior Defcon speaker, and researcher. Published works include topics such as therapeutic hypothermia after cardiac arrest, novel drug targets for myocardial infarction patients, and other Emergency Medicine related works with an emphasis on CPR optimization. His most recent focus is on biohacking, medical device security, and critical medical infrastructure cyber security. He can’t spell words well. This is his tenth Defcon.

Jeff "r3plicant" Tully MD

Twitter: @JeffTullyMD

Jeff Tully is a pediatric physician and researcher with an interest in understanding the ever-growing intersections between health care and technology. Prior to medical school he worked on “hacking” the genetic code of Salmonella bacteria to create anti-cancer tools but now spends a majority of his time dreaming of a world where human beings will be able to upload their consciousness into utterly immersive simulations of the Star Wars universe.

Peter Hefley

Twitter: @PeterHefley

Peter Hefley has no medical device implants because he is squeamish about blood and cutting oneself open. With experience in information security consulting and penetration testing, he'd like to help lay the groundwork for body modifications and biohacking in a way that prevents folks' brains from getting pwned.

Speaker: Alex Smith @CyberiseMe

http://cyberise.me

Ever cloned an office access card but been afraid you'd be caught and searched? In this talk I'll show you how to clone RFID cards to subdermal implants to avoid detection.

This talk will cover the basics of RFID security, card cloning and RFID implants. It will focus on the AT5577 chip in the new implantable form factor and show how to use it to access RFID controlled security systems.

Alex Smith

Twitter: @CyberiseMe

Implant Store: http://cyberise.me

Alex is a DIY cyborg, aka grinder. He designs, builds and implants cybernetic devices.

Speaker: Alejandro Hernández @nitr0usmx

Electroencephalography (EEG) is a non-invasive method for the recording and the study of electrical activity of the brain taken from the scalp. The source of these brain signals is mostly the synaptic activity between brain cells (neurons). EEG activity is represented by different waveforms per second (frequencies) that can be used to diagnose or monitor different health conditions such as epilepsy, sleeping disorders, seizures, Alzheimer disease, among other clinical uses. On the other hand, brain signals are used for many other research and entertainment purposes, such as neurofeedback, arts and neurogaming.

A brief introduction of BCIs (Brain-Computer Interfaces) and EEG will be given in order to understand the risks involved in our brain signals processing, storage and transmission.

Live demos include the visualization of live brain activity, the sniffing of brain signals over TCP/IP as well as flaws in well-known EEG applications when dealing with some corrupted samples of the most widely used EEG file formats (e.g. EDF). This talk is a first approach to demonstrate that many EEG technologies are prone to common network and application attacks.

Finally, best practices and regulatory compliance on digital EEG will be discussed.

Alejandro Hernández

Twitter: @nitr0usmx

Consultant with passion for different topics in security such as penetration testing, OSINT and fuzzing. Currently working for the security firm IOActive, where he had had the chance to work for a variety of Fortune 500 companies in different countries such as Mexico, USA, UK, South Korea, Netherlands and South Africa.

Co-author of DotDotPwn, a Directory Traversal fuzzer presented at BlackHat USA Arsenal 2011 and Melkor, an ELF file format fuzzer presented in Arsenal in 2014.

He enjoys cyberpunk movies, with dystopian scenarios, Hi-Tech and social decadence.

Speaker: Keoni Gandall

It is predicted that the ability to read/write DNA cheaply at scale will revolutionize biology, but what happens after the DNA has been printed? I will explain the basics of genetic engineering at home and how it can be useful now and in the future. This talk will cover building a basic lab, DNA design and assembly, transformation of actual living organisms, and the relevant safety and security concerns. If time permits, I will talk about open source projects and engineering principles as applied to genetics. I will also briefly explain how this applies to human genome editing, even though I have been referring to the genetic engineering of microbes. This talk should provide you with a better understanding of genetic engineering and how to get started at home or a local hackerspace.

Keoni Gandall

Keoni Gandall is currently a student at Edison High School as well as an active member of the DIYbio community. Over the past two years, he has worked in the liulab at UCI with in vivo directed evolution systems, at LA Biohackers as a main contributor to their iGEM project, and at home doing independent research & development. In 2013, he won first place at the Broadcom Masters national science fair for creating an Archaea plasmid using his home lab. This is his second year at DefCon and he is still here to learn, but he is even more excited to share the basics of genetic engineering with the larger hacker community. Keoni is dedicated to the practical development of new biological technologies in the 21st century.

Speaker: Johan Sosa @johansosa

Find out how genetically modified organisms are created. This talk for will focus introducing the basics of DIY genetic engineering for the uninitiated. With the knowledge provided in this talk, you can get started on the path to doing citizen science and maybe even making the next great scientific breakthrough (with a lot dedication, discipline, and focus). Learn how a protein that's part a bacterial immune system can be used to edit an organism genes. Find out how a the equivalent of Denial of Service attacks are used to smuggle DNA into yeast cells. Get info on what equipment is needed to get started in the emerging field of synthetic biology.

Johan Sosa

Twitter: @johansosa

Johan's day job is IT security, but at night he's immersed in science. He has been involved with DIY Biology projects for about two years. With help from many, he leads the lab work for the Real Vegan Cheese project. The Real Vegan Cheese project, which won a Gold medal at the 2014 iGEM competition, aims to produce milk proteins via yeast and thus enable a source of cheese that doesn't require animals.

Catatonic

Bio

He has three great loves in his life, his wife, his computer, and his whiskey.

TospoVirus: Weaponizing Wifi Pineapple Vulnerabilities

Abstract

Responsible disclosure of bugs in the Hak5 Wifi Pineapple, release of corresponding metasploit modules, and a walk through of weaponizing these bugs into a functioning worm originally designed for release at DEFCON23. Including novel methods for near proximity, low bandwidth, data ex-filtration in utilizing 802.11x packets.

| @catatonicprime |

Cyb3r-Assassin

Bio

In 2000, Chris released his first commercial app, Advanced Timer, which was the most widely adopted time candle chart utility in the commodities day trading practice in the early 2000s. Chris also developed the first Instant Messaging proxy platform for the AIM protocol in 2001. These applications were designed as early remote social engineering tools functioning as communication drop bots and incognito mail platforms. In 2007, Chris was an early adopter of smart phone development where he built custom ROMs for the windows PPC platform. More recently, Chris has spent time working in cryptography with the goal of ensuring the protection of sensitive information no matter where it travels, and focusing on internal IT architectural and administration vulnerabilities. Chris's passion for network intrusion and coding expertise led him to develop a comprehensive framework for wireless network intrusion, N4P, which is featured in the repository of Pentoo Linux. In addition to his technical expertise, Chris is a noted writer, and was recognized as a finalist for best new security blogger by the Security Bloggers Council at the 2014 RSA Security conference. Chris has also enjoyed speaking at national security events. Prior to his career in InfoSec, Chris spent 11 years at a national level and 8 as professional competitor in Motocross before retiring as a competitor to focus on his InfoSec career. He still serves as a mentor and trainer in the motocross community.

Wireless Pentesting So Easy A Cave Man Can Do It

Abstract

Chris will discuss wireless penetration testing using the network management suite he has written called n4p. N4p takes the pain away from system network device management during wireless pentests (WPA2 WPS) and the lengthy command memorization while bringing the ease of a highly modularized framework based design for efficient offensive tasks.

N4p incorporates hashcat for cracking pcap handshakes by converting pcaps to hcaps and running your pre defined rules. Wireless enterprise radius hacking with hostapd is also included. N4p also brings you the only solution for more incognito minded individuals by controlling your VPN and device bridges on the fly. By doing this we provide your MITM attacks with a strong attack base you could take nearly anywhere from SSLstrip to pulling off elaborate phishing with SET and redirection in iptables.

N4p provides you with a well planned out comprehensive iptables base script that provides adapter and port limitations out of the box for your rogue AP. You could restrict your victim's activity onto specific ports for easy of monitor/sniffing and be alerted real time with the ip of any new victims connecting.

| |

Karl Koscher

Bio

Karl Koscher is a postdoctoral researcher at the University of California San Diego where he specializes in embedded systems security. In 2011, he and his collaborators were the first to demonstrate a complete remote compromise of a car over cellular, Bluetooth, and other channels. In addition to breaking systems, he also works on creating tools and technologies to enable developers to automatically find (and fix) potential security vulnerabilities in their embedded systems. Since earning his ham license at DEFCON 22 (and later upgrading to Amateur Extra), he has become interested in many aspects of wireless communications.

DSP for SDR

Abstract

The barrier to entry in software-defined radio is now almost non-existent. Wide band, receive-only hardware can be obtained for as little as $10, and tools like gqrx and SDR# make it extremely easy to get started listening to signals. However, there is a steep learning curve graduating from an SDR script kiddie to developing your own SDR tools. In this talk, I’ll cover the basic theory behind software-defined radios digital signal processing, and digital communication, including I/Q samples, FIR filters, timing and carrier recovery, and more.

| |

Michael Calabro

Bio

Michael Calabro is a Senior Engineer at Booz Allen Hamilton Engineering Services where he is a technical leader of the Communications Center of Excellence. He has worked on digital communication systems and software defined radios for 7+ years and holds an MSEE focused in wireless communications. He regularly consults as a subject matter expert on commercial, government, and custom communication standards and systems.

Software Defined Radio Performance Trades and Tweaks

Abstract

This workshop is targeted at new and experienced software defined radio (SDR) operators, developers, and enthusiasts seeking a better end-to-end system understanding, and anyone looking to maximize their SDR’s performance. Commercially available SDRs (e.g. USRPs, RTL-SDRs, BladeRFs, etc) are commonly used to fuzz wireless interfaces, deploy private cellular infrastructure, conduct spectrum surveys, and otherwise interact with a wide variety of custom and commercial devices. This workshop focuses on the key parameters and performance drivers in SDR setup and operation that elevate these common platforms to the level of fidelity required to interact seamlessly with commercial devices and networks.

The workshop will begin by surveying different SDR hardware architectures and summarizing the performance tradespaces of several of SDR applications (e.g. collection/survey/transmit). Then the workshop will break down into three main content focuses:

Understanding SDR Hardware: Breakdown common RF frontend and receiver architectures. Identify and derive key performance parameters, and when they will bound performance. Topics covered will include: Noise figure calculation, internal amplification, Frequency selectivity, external RF chains, and noise sources.

Understanding SDR Platform Objectives: Collection, transmission, surveying, and other applications, each present unique challenges to SDRs and will be limited by different dimensions of SDR processing and/or setup configuration. Topics covered include: real-time processing, host buffering, sampling, guard-intervals, framework selection (GRC vs REDHAWK vs MATLAB vs custom), and frequency and time domain signal representation.

Optimizing and Improving Performance: Now that the hardware and platform trade space have been characterized, how do attendees meet and exceed the performance requirements of their application? We will present specific examples for several common platforms (RTL-SDR and USRP). Topics covered will include clock selection, ADC dynamic range, FPGA/SoC offloading, RFIC configuration, CIC filters, sampling, DC biases, antenna selection & pointing, host buffering / processing, and cost-performance trades.

| |

Tim O'Shea

Bio

GNU Radio Developer, Software Radio and Machine Learning Researcher -- Currently serving as research faculty at Virginia Tech Research Center in Arlington, VA

GNU Radio Tools for Radio Wrangling and Spectrum Domination

Abstract

An overview of modern tools available in GNU Radio and the greater GNU Radio ecosystem for building, testing, inspecting and playing with radio system physical layers in gory detail.

| |

Wireless Warrior

Bio

Wireless Warrior is a long-time cypherpunk with significant writings and contributions. He has worked with notables, including: Adam Back, David Chaum, Bram Cohen, Zooko Wilcox-O’Hearn, Jon Callas and Bruce Schneier. He has 10+ years experience in aerospace (plus 3 years at a successful commercial crypto and wireless company at the director level) with emphasis on secure communication. He is a founding member of GnuRadio (with Eric Blossom and John Gilmore).

Covert Wireless: Practical Hacker LPI-LPD

Abstract

Unlike commercial and consumer wireless, based on standards emphasizing cost, speed and interoperability, secure military and intel gear pays careful attention to low probability of detection and intercept (LPD/LPI) and traffic analysis. Their major tech focus is at the PHY layer using proprietary methods. Until the advent of Software Defined Radio the technology and cost to implement such protection were beyond all but the very well-funded. This presentation will review some of the publicly known capabilities of government monitoring and the practicality of defeating them using SDR, cypherpunk and varients of even amateur radio tech.

| |

Balint Seeber

Bio

A software engineer by training, Balint is a perpetual hacker, and the guy behind spench.net. His passion is extracting interesting information from lesser-known data sources and visualizing them in novel ways. Lately, he has become obsessed with Software Defined Radio and all that can be decoded from the ether. When not receiving electromagnetic radiation, he likes to develop interactive web apps for presenting spatial data. Originally from Australia, he moved to the United States in 2012 to pursue his love of SDR.

Covert Wireless: Practical Hacker LPI-LPD

Abstract

Unlike commercial and consumer wireless, based on standards emphasizing cost, speed and interoperability, secure military and intel gear pays careful attention to low probability of detection and intercept (LPD/LPI) and traffic analysis. Their major tech focus is at the PHY layer using proprietary methods. Until the advent of Software Defined Radio the technology and cost to implement such protection were beyond all but the very well-funded. This presentation will review some of the publicly known capabilities of government monitoring and the practicality of defeating them using SDR, cypherpunk and varients of even amateur radio tech.

SIGINT and Blind Signal Analysis with GNU Radio + Advanced SDR

Abstract

- "Signal fundamentals

- Properties that can be exploited for blind signal analysis

- Modulation schemes

- Periodicity in symbols

- Repetition in frames

- Bursty vs. continuous signals

- Techniques

- Auto-correlation

- Cyclostationary analysis

- Decoding

- Demodulation

- Common additions: scrambling, error correction

- De-framing

- Checksums

- Enhancements (briefly)

- Direction Finding

- Physical layer fingerprinting

- Advanced SDR with USRPs

- Burst mode

- Arbitrary sample rates

- Digital tuning

- Frequency hopping

| |

Darren Kitchen

Bio

Darren Kitchen is the founder of Hak5, an Internet television show inspiring hackers and IT pros since 2005. Breaking out of the 1990s phone phreak scene, Darren has continued to foster his passion for information security throughout his career as a systems administrator, presenter and now creator of nefarious penetration testing tools. He also pwns you at Unreal Tournament.

Rollin' down the street sniffin' WiFi, sippin on Pineapple Juice

Abstract

"Why crack the network when you can be the network? Join Sebastian Kinne and Darren Kitchen of Hak5 as they slice the WiFi Pineapple down to its core. From tracking and reporting to recon and targeting. From the next generation rogue access point to the future of the fruit. Learn what's possible with the WiFi Pineapple Mark V. Plus, adventures in not getting arrested on the Golden Gate Bridge.

| |

Sebastian Kinne

Bio

Sebastian Kinne is the lead developer of the WiFi Pineapple. Prior to hacking fruits, he reverse engineered MMORPG network protocols while completing his BSc in Computer Science. As an avid speaker, trainer and wireless enthusiast, he has probably tracked your smartphone's WiFi in a demo or two.

Rollin' down the street sniffin' WiFi, sippin on Pineapple Juice

Abstract

"Why crack the network when you can be the network? Join Sebastian Kinne and Darren Kitchen of Hak5 as they slice the WiFi Pineapple down to its core. From tracking and reporting to recon and targeting. From the next generation rogue access point to the future of the fruit. Learn what's possible with the WiFi Pineapple Mark V. Plus, adventures in not getting arrested on the Golden Gate Bridge.

| |

JP ".ronin" Dunning

Bio

JP Dunning (.ronin) is a professional “breaker of things”. He has performed research and testing in security for over a decade. Primarily areas of play include portable, wireless, physical, and hardware security. He has developed and contributed to multiple projects including Katana: Multi-Boot Security Suite, The Glitch, SpoofTooph, BlueRanger, and CavitySearch.

Wireless World of the Internet of Things

Abstract

The Internet of Things is a new spin old technology. Basically bringing to life all the "things" in our world, from door knobs to light bulbs. This presentation will talk about the wireless technologies integrated into these products along with some of there existing and potential risk, focusing predominantly on the favored ZIgBee and Z-Wave wireless protocols.

| |

Mike Ryan

Bio

Mike Ryan is a Bluetooth expert and knows literally nothing about any other subject.

Seeing Blue: Tools, Tricks, and Techniques for Messin' with Bluetooth™

Abstract

Join Mike and Dominic Spill for a hands-on workshop on how to use the latest and greatest tools and techniques to attack Bluetooth devices. This workshop serves as an intro to using Ubertooth to monitor classic Bluetooth and Bluetooth Smart (BLE). We will also cover cracking BLE crypto and give an intro to Bluetooth reconnaissance using open source tools and inexpensive off-the-shelf hardware.

| @mpeg4codec |

Dominic Spill

Bio

Dominic Spill is the lead maintainer of Ubertooth and full-time malingerer.

Seeing Blue: Tools, Tricks, and Techniques for Messin' with Bluetooth™

Abstract

Join Mike and Dominic Spill for a hands-on workshop on how to use the latest and greatest tools and techniques to attack Bluetooth devices. This workshop serves as an intro to using Ubertooth to monitor classic Bluetooth and Bluetooth Smart (BLE). We will also cover cracking BLE crypto and give an intro to Bluetooth reconnaissance using open source tools and inexpensive off-the-shelf hardware.

| @mpeg4codec |

Travis Goodspeed

Bio

Merchant of Dead Trees and Licensed Proselytizer of the Gospel of the Weird Machines with Pwnage, PoC, and Secular Rock.

PSK31 Modulation Polyglots

Abstract

| |

Vivek Ramachandran

Bio

Vivek Ramachandran is the Founder and Chief Trainer at SecurityTube.net. He discovered the Caffe Latte attack, broke WEP Cloaking, a WEP protection schema in 2007 publicly at Defcon and conceptualized enterprise Wi-Fi Backdoors. He is also the author of the book "Backtrack 5 Wireless Penetration Testing". He runs SecurityTube Trainings and Pentester Academy currently taken by infosec professionals in 75 countries. He also conducts in-person trainings in the US, Europe and Asia. Vivek's work on wireless security has been quoted in BBC online, InfoWorld, MacWorld, The Register, IT World Canada etc. places. He has spoken/trained at top conferences around the world including Black Hat USA, Europe and Abu Dhabi, Defcon, Hacktivity, Brucon, ClubHack, SecurityByte, SecurityZone, Nullcon, C0C0n etc. Twitter: @securitytube

Automating Live WPA/WPA2 Attacks with Wpa_Supplicant

Abstract

In this workshop you will learn how to automate Wpa_supplicant to conduct live attacks on WPA/WPA2 PSK and Enterprise networks. We will be using Wpa_supplicant's control interface for automation via Python. We will be touching upon both the wpactrl wrapper as well as the DBUS API to demonstrate custom scripts for attacks.

WPA Enterprise hacking

Abstract

In this workshop, we will look at the different tools and techniques available to create honeypots and exploit WPA/WPA2 Enterprise networks. Our focus for this talk will be PEAP and EAP-TTLS but the principles taught can be extended to other EAP types as well.

| |

Mister_X

Bio

Thomas d'Otreppe "Mister X" is a wifi hacker and the author of Aircrack-ng, a Wi-Fi auditing suite as well as OpenWIPS-ng, an open source WiFi Intrusion Prevention System. He has designed Offensive-Security WiFu, a proactive wireless security course, with Mati Aharoni (muts) and also contributes to Kali Linux (and contributed to BackTrack Linux). He works as a software developer for MainNerve.

WPA Enterprise hacking

Abstract

In this workshop, we will look at the different tools and techniques available to create honeypots and exploit WPA/WPA2 Enterprise networks. Our focus for this talk will be PEAP and EAP-TTLS but the principles taught can be extended to other EAP types as well.

| @aircrackng | @openwipsng |

JoshInGeneral

Bio

Joshua currently works doing Incident Response in the Washington DC Area where he is part of the security group NovaHackers. Previously he worked for the Federal Reserve Board doing Unix and Network Administration, he has a Masters degree from UNC Charlotte in Security and Privacy, was the founder of the 49th Security Division. This year will be his 3rd time competing in the Defcon WCTF.

Additional activities he enjoys researching web vulnerabilities, looking for intel on pastedump sites, traveling, playing xbox and trying out new places to eat with friends.

Meeting People Over Wifi

Abstract

"From day one when you buy a piece of wireless technology, whether it be just a cell phone, laptop or a fitbit, you get a wireless signature. In this talk we will talk about some of the things that can identify you in an environment and how people can track you. We will look at bluetooth scanning apps that you can use every day to track people inconspicuously from your phone, while walking, metroing, or as a passenger in a car driving. (Note: Some of this will require additional hardware, but we will show how you would do this via a laptop if you can't/don't want to buy additional hardware)

I will also be sharing how I was able to identify certain individuals who where around me was around me while traveling.

There will be a demo and walk anyone that is interested how they can do the same on their laptop right away. Depending on the setup of the room this year, this may mean one on one walking around or having individuals following along and field questions from the front of the room when experiencing problems.

Individuals that attend this presentation should be able to:

- Use their Android or iPhone to identify bluetooth in their environment

- Use Kismet (Android or Laptop) to identify users via wifi connections

| |

"DNS and the Future of Authenticity" - indolering

DNS is the keystone of the internet, the interface that allows us to attach semantic meaning to the world’s largest distributed computing system. It is the basis of the most widely used remote function call interface: the web browser’s address bar. From the browser, to SSH, to email, the Domain Name System is what we use to bootstrap the identity of programs, servers, and people.

Yet this key/value data store from the 80’s is insecure and increasingly prone to censorship. We have had the tools needed to make DNS cryptographically verifiable and decentralized for some time but the initial implementations failed. Thankfully, after years of research and trial-and-error, we finally have practical and deployable solutions.

This talk covers the benefits a cryptographically verifiable domain name system and the state of decentralized DNS. It debunks common myths about DNSSEC and explains why it is vital to a decentralized DNS. It finishes with an overview of Namecoin, outlining past challenges that have stymied widespread adoption and potential solutions.

Indolering is a usability engineer and focuses on security related usability research. He is a recent graduate, the lead usability engineer for the Namecoin project, and has a similar day job at EasyDNS.

"Getting into the Trust Store We Trust" - Ajit Hatti

It all starts with Trust Stores. Booting in to a trusted OS, managing sensitive information, establishing a secure channel for Communication across the networks or any transaction involving PKI.

Lets try and understand more about the Trust Stores, how do they work, how malwares and attackers (can) use different ways to manipulate the Trust Stores & what we can do to detect and secure such attempts.

Ajit Hatti is a Co-founder of “null -Open security community”, His work is focused on Infrastructure Security, providing Trusted Computing On Hostile Platforms & most of his papers are in social interest. Invented the widely exploited “Applanting” attack.

Previously worked on secure applications of Cryptography at Symantec Corporation. He has worked as an Engineer and Security Researcher with security companies like IBM-ISS, Bulelane, Zscaler in past.

He has previously presented his security research at BlackHat, NullCon, Ground Zero Summit & C0C0N

"Using Privacy and Crypto Tools" - Edmond Rogers (bigezy) & Shane Rogers (bust3r)

This talk will discuss tools you can use to ensure your privacy online. What options are available now to protect your privacy in your personal computing device and the cloud? We’ve all heard of tools like PGP and OTR, but we’ll show you some newer tools with which you may not be familiar. This will include the best way to encrypt your email, providing privacy in cloud storage, and managing encryption keys. We will also step through how to install these tools. From there we will also discuss how to keep your privacy intact showing ways to clean cookies and other tracking data that accumulates in your devices.

Edmond Rogers was actively involved as an industry participant in many research activities in ITI’s TCIPG Center, including work on NetAPT (the Network Access Policy Tool) and LZFuzz (Proprietary Protocol Fuzzing). Rogers was a security analyst for a fortune 500 investor-owned utility, where his responsibilities included cyber security of SCADA networks. Before that, he was a security manager and network architect for a transfer agent for 43% of all mutual funds. Rogers leverages his wealth of experience to assist ITI researchers in creating laboratory conditions that closely reflect real-world configurations.

Shane Rogers (no relation) is working toward his Master's in Computer Science as an ICSSP scholar at the University of Illinois at Urbana Champaign. He has worked as a research assistant for Information Trust Institute at UIUC focusing on OpenFlow enabled software defined networks and as an EO&T Systems Engineering Intern at Boeing Defense, Space, and Security. He is also the ACM chair of the Open Network Security Monitoring (@OpenNSM) group at UIUC and in his free time likes nothing better than answering questions from his family members about how to fix their smartphones. Have you tried turning it off and back on again?

"Peerio: Productivity with end-to-end encryption" - Nadim Kobeissi

Peerio is a desktop and mobile productivity app that combines messaging with cloud file storage and sharing, as well as contacts management and everything else you need to be productive. Peerio does what you'd expect from a Gmail + Google Drive hybrid, except it comes with end-to-end encryption built in from the ground up.

Nadim Kobeissi is a PhD researcher studying applied cryptography at INRIA's PROSECCO lab. He is interested in provable security, usable encryption, formal logic, JavaScript and the web. His software projects, which have focused on making encryption and online privacy more ubiquitous, include Cryptocat, an encrypted instant messaging platform, miniLock, a modern standard for file encryption, and Peerio, a full-featured open source productivity platform with end-to-end encryption. Originally from Lebanon, Nadim completed his undergraduate studies in 2013 in Montréal, Canada, and currently resides in Paris.

"Keynote: Crypto & Privacy Village" - Whitney Merrill (@wbm312), Justin Culbertson (@jus341), Peter Teoh (@pteoh), Tony Arcieri (@bascule), Jorge Lacoste (@lacosteaef), and Nadia Kayyali (@NadiaKayyali)

Welcome to the Crypto & Privacy Village. Come and learn all about the Village and the humans behind the scenes. We will announce some cool crypto puzzles we have planned and talk about our first electronic badge. Come and learn how you can participate and get involved.

Whitney Merrill is an attorney and graduate student in computer science at the University of Illinois at Urbana-Champaign specializing in information security, computer crime, privacy, surveillance, and Internet law. Her current research focuses on Android privacy, digital forensics, and the legal and usability issues surrounding encryption. She is a member of the Illinois Security Lab, and in her spare time Whitney runs the Crypto & Privacy Village. She loves solving puzzles and recently staying up late creating them.

Justin, aka Neon, helps run the Crypto & Privacy Village from the website to puzzles. He is also a DC DarkNet Operative and a member of the defcoin community! Come say hi to get a taste of those decentralized, digital hacker coins.

Peter Teoh leads the software security and compliance function for his current employer. He has worked in the tech industry since the last century in a variety of roles from network security, to data protection and privacy. Pete has been attending DEF CON since DC19 and was a speaker at DC22. In his spare time he hoards electronic gadgets and is an honorary cat lady.

Tony Arcieri works on the Platform Security Team at Square. These days he dabbles in cryptography. In the past he made the Celluloid actor framework for Ruby and the Reia programming language.

Jorge Lacoste swizzles bits and harvests blue smoke from ICs. This is his 6th DEF CON. Say hello if you see him. Jorge is also the principle designer of the first ever CPV electronic badge.

Nadia Kayyali got the opportunity to work with Crypto & Privacy Village as a member of EFF’s activism team. Nadia's work at EFF focuses on surveillance, national security policy, and the intersection of criminal justice, racial justice, and digital civil liberties issues. Nadia has given privacy trainings to a wide variety of audiences in the U.S., from artists to Black Lives Matter activists. Nadia previously served as the 2012 Bill of Rights Defense Committee Legal Fellow where they worked with grassroots groups to restrict the reach of overbroad national security policies. They earned their B.A. from UC Berkeley, where they majored in Cultural Anthropology and minored in Public Policy. They received their J.D. from UC Hastings.

"Keynote: Underhanded Crypto Contest" - Adam Caudill (@adamcaudill) & Taylor Hornby (@DefuseSec)

The Underhanded Crypto Contest is a research project to better document the state of the art in malicious crypto implementations and designs - and through that understand, lead to better training for reviewers and better detection of flaws, accidental or otherwise. Starting this year, the Underhanded Crypto Contest will be working closely with the Crypto & Privacy Village - this year we are running two short challenge contests; details available on underhandedcrypto.com. Starting next year, the winners of the main event will be announced here.

Adam Caudill is an independent security researcher and software developer with a primary focus on application security, secure communications, and cryptography. He is active in the open source community, writes on security and related topics, and is an advocate for user rights and privacy. His work has been cited by many media outlets and publications around the world, from CNN to Wired and countless others.

Taylor Hornby is a recent graduate and independent security researcher focusing on topics ranging from human usability to side channel information leakage. He has contributed to the open source community by performing both volunteer and paid security audits of popular code, as well as by creating developer-friendly security libraries.

"Life of PII: A Day in the Life of Your Personally Identifiable Information" - Alisha Kloc

As privacy issues move into public awareness, it’s important for consumers to understand what companies, governments, and other entities are doing with their private data. What really happens after you click “Submit”? How well-protected is your data? How do companies keep it safe — from unscrupulous data collectors, from overreaching governments, from malicious actors or just plain overly-curious employees? With Google as an example, take a look at the lifecycle of an average consumer’s PII, or personally identifiable information, from its entry into a website to its deletion from the site’s servers. Learn how private data is currently protected, and find out what you can do to safeguard your data and encourage more companies to implement strong data privacy protections.

Alisha Kloc is a security and privacy engineer at Google, where she protects users’ data from unauthorized access and misuse. Before Google she built security systems for several governments as a security engineer at Boeing. She is passionate about data security and user privacy, and believes that more openness around and sharing of corporate privacy policies, practices, and procedures will help companies and users develop a much stronger sense of, and appreciation for, data privacy and security.

"Opening Backdoors: The Importance of Backdoor Research" - Adam Caudill

The world of security research is fraught with ethical dilemmas, and open research on how to backdoor and subvert systems certainly brings its fair share. Releasing code for an intentionally flawed encryption implementation or a design for a system that appears to be secure, but in fact allows an attacker to easily recover secret data - this pushes the limits of doing more harm than good, yet is critically important for defenders. Without solid research into how systems could be effectively and efficiently backdoored, defenders quickly fall behind, giving clever attackers a strong upper hand. Defenders, those charged with reviewing code and designs may be able to easily detect the cliched sending emails with credit card numbers, but how prepared are they for a better class of attacker? This talk seeks to cover both the need for the information gained, especially through events such as the Underhanded Crypto Contest, and the risks that it presents.

Adam Caudill is an independent security researcher and software developer with more than 15 years of experience. He primarily focuses on application security, secure communications, and cryptography, though also works with hardware, embedded systems, and related technologies. His research and writing has been cited by media outlets and publications around the world. Active blogger, open source contributor, and advocate for user privacy and protection. Adam is also the founder of the Underhanded Crypto Contest.

"How to Engineer a Cryptographic 'Front Door'" - Karl Koscher

With technology companies embracing strong encryption, the US Government is now pushing for cryptographic “front doors” that would allow law enforcement to break encryption with a warrant. But is it even possible to build these “front doors” without introducing vulnerabilities that could be maliciously exploited? In this talk, I’ll sketch out a potential solution (and what I believe NSA/FBI wants to implement, based on their public statements) using public key cryptography, threshold secret sharing, and cryptographic hardware. I will also explain why “front doors” are still a bad and unworkable idea.

Karl Koscher is a postdoctoral researcher at the University of California San Diego where he specializes in embedded systems security. In 2011, he and his collaborators were the first to demonstrate a complete remote compromise of a car over cellular, Bluetooth, and other channels. In addition to breaking systems, he also works on creating tools and technologies to enable developers to automatically find (and fix) potential security vulnerabilities in their embedded systems.

"Let's Talk about Let's Encrypt" - Bill Budington

Let's Encrypt is a new Certificate Authority. It will provide free X509 certificates in an automated way, with close to no deployment overhead. Currently, requesting and deploying X509 certificates is a tedious and costly process - both in terms of vendor and labor costs. Our studies show that it often takes between 1 to 3 hours to go thorough the entire process of setting up HTTPs on a webserver. Let's Encrypt will reduce that time to a matter of minutes for the initial setup, and mere seconds for renewals.

William Budington is a Software Engineer at the EFF, where he works on Let's Encrypt as well as other technology projects. He's also a developer for SecureDrop, an anonymous document submission platform. As a crypto-enthusiast, he's taken part in the W3C Web Crypto Working Group and is excited to see the web grow as a platform for cryptographic applications. He loves hacker spaces and getting together with other techies to tinker, code, share, and build the technological commons.

"Machine Learning and Manipulation" - Jennifer Helsby (redshiftzero)

The wealth of data available in the modern age has enabled the use of machine learning methods and other data science methods in a range of new areas. Current applications include ranking items in social media feeds, optimizing advertisements, and surveillance and predictive policing by government and law enforcement. This talk will discuss some of the potential ethical and privacy issues associated with the widespread use of machine earning algorithms. Most suffer from a lack of transparency in their design and operation. Mass social engineering is feasible through the use of individualized messages crafted by adaptive algorithms. Subtle manipulation would be very difficult to detect by individuals but can have significant social impact. In addition, biases in input datasets used for training algorithms treated as impartial can systematize discrimination against certain populations. Faced with these challenges, some potential avenues for ameliorating these problems will be discussed, both in terms of policy and technology. As a community, we need to better understand and monitor the role of these methods in society in order to ensure that we build and support systems that are resistant to misuse.

Jennifer Helsby (@redshiftzero) is a researcher and scientist. She is currently a Data Science for Social Good fellow at the University of Chicago where she works on the application of data analysis and machine learning methods to problems with positive social impact. She also is a co-organizer of Cryptoparty Chicago, which teaches people about privacy issues and digital security practices. Before that, she completed a Ph.D. in Astrophysics at the Kavli Institute for Cosmological Physics at the University of Chicago where she did theoretical and computational work studying the large scale distribution of galaxies in the universe.

"Beginner Crypto for Application Developers" - Justin Engler

Are you a software application developer who wants to add secure storage or communication to your application, but you have no idea where to start? This talk will quickly lay out the basics of how to add crypto to your application in a straightforward manner. No math, no cryptonerd technobabble, just simple practical techniques to use and pitfalls to avoid.

Justin breaks into programs for a living. This includes both private and publicly-released work on open and closed source messaging and privacy applications. Justin has been breaking into programs for a living for 5 years, and has been doing IT and security work for over 10 years. He has previously spoken at DEFCON, Toorcon, Black Hat, and several regional conferences.

"Breaking RSA - new cryptography for a post-quantum world" - Jennifer Katherine Fernick

As we move into a new paradigm of computation, almost all of our assumptions about the security of our current cryptosystems are wrong. Large-scale quantum computers are known to be able to execute algorithms capable of efficient factoring and discrete logarithm computations. Unfortunately, most of the public-key cryptography widely used on the Internet today - including RSA and Elliptic Curve Cryptography - is based on the presumed hardness of these exact problems. In this talk, I introduce quantum computation and the practical realities it will have on popular cryptosystems - both technically, as well as from the perspective of a variety of use cases. From here, I introduce the new mathematics we're currently building to replace RSA in a post-quantum world, and the entirely new cryptanalytic tools we'll need to use to construct it.

Jennifer Katherine Fernick is security researcher and PhD candidate in Cryptography & Quantum Information at the Institute for Quantum Computing at the University of Waterloo. Her research involves cryptology and quantum computation - specifically, in looking for cryptographic algorithms that will be resistant to cryptanalytic attacks from adversaries with access to quantum computers. She is a founding member of the European Telecommunications Standards Institute's industry specification group on Quantum-Safe Cryptography, which aims to find and standardize quantum-resistant alternatives to our current cryptographic infrastructure. Previously, she has studied for a Master of Engineering in Systems Design Engineering and holds a BSc in Cognitive Science & Artificial Intelligence.

"Should we trust crypto frameworks? A story about CVE-2015-2141." - Anton Karpov

The presentation will cover details of a bug (CVE-2015-2141) I found in the Rabin-Williams (RW) digital signature system implementation in the well-known Crypto++ (http://cryptopp.com) framework. The bug is misuse of "blinding" technique that should prevent timing attacks but results in an ability to recover a private key having only two signatures of one message.

Anton has worked in the information security industry since 2000. He began his career as a Penetration Tester and ISO 27002 Auditor in security consultancy and later became one of the first Certified PCI DSS Auditors in Russia. In 2009 Anton joined the Global Information Security team at Barclays Bank, where he was a member of the Security Assessment and Penetration Testing teams. Anton joined Yandex in 2011 as Chief Information Security Officer, where he built and now manages the Information Security Department.

"Where are the privacy-preserving services for the masses?" - Hadi Asghari

We seldom see incremental trade-offs offered between privacy and other qualities in online services. Many markets are dominated by large firms offering services for "free" and in exchange for personal data. There are less popular offerings in the other extreme, providing privacy and anonymity in exchange for lower performance and convenience. Offerings in between the two extremes are not common, despite post-Snowden surveys showing that a third of consumers find privacy very important. The absence of services to fill this market gap is puzzling. I hypothesize that a number of fundamental economic reasons make it hard for commercial, privacy-enhanced services to compete with the two extremes on scale. These include: difficulty in trusting privacy claims, the usefulness of data in designing and securing services, network effects, and the high value of targeted ads. In economic terms these induce market failures and if proven have regulatory consequences, for instance with regards to competition law. I am embarking on new research in this area, and would like to present the idea to privacy enthusiasts, coders, and entrepreneurs producing privacy-preserving services to receive input for my research.

Hadi Asghari is an assistant professor at Delft University of Technology in the Netherlands and a visiting fellow at Princeton's Center for Information Technology Policy (CITP) starting this fall. His research focuses on the economics of cybersecurity and online privacy. Prior to moving to the Netherlands, he worked as a software and network engineer in Iran.

"Breaking CBC, or Randomness Never Was Happiness" - Dr. Albert H. Carlson (ECCSmith) & Patrick Doherty

Hiding patterns in encrypted messages to make the transmission look like random symbols is the goal of cryptography. However, all ciphers do not completely disguise those patterns, making decryption possible. In response to this problem, modes were introduced to break up patterns and to increase the “randomness” of an encrypted message. In the case of Cipher Block Chaining mode (CBC) the randomizing material is the cipher text from the preceding block. CBC uses a “feed forward” algorithm and a regular structure that provides attackable data. In fact, there is so much information in the structure and associated data that CBC wrapped around ANY cipher can be efficiently broken.

We show that by using the blocks of the CBC algorithm both linear and non-linear encryptions using CBC can be broken. Further, we show that no linear cipher (such as a permutation or XOR cipher) is safe when used in conjunction with the mode and that non-linear ciphers (such as AES) are also vulnerable. Using the Birthday Paradox to predict how much data is needed to allow for decryption. This talk will demonstrate the break and show the mathematical background of the attack.

Dr. Albert Carlson began his hacking career soon after he began taking programming courses in High School in Chicago in 1975. Upon completion of his BSCompEng degree from the University of Illinois at Urbana in 1981, he joined the US Army as a Military Intelligence Officer specializing in Electronic Warfare and Cryptography. Retiring due to injury, he then began a 25 year career in engineering that included work in consumer, military, and designing utility substation security systems.

Dr. Carlson returned to school at the University of Idaho in 2002. There he completed his Master’s degree and PhD, both in Computer Science and specializing in Advance Set Theory and Cryptography. His dissertation, accepted in June of 2012, had as its’ subject: applying Set Theoretic Estimation to decryption.

In 2013 Dr. Carlson joined the faculty of Fontbonne University on the staff of the Math and Computer Science department. His research team studies the use of patterns in natural language and how they relate to set and information based attacks on ciphers. Dr. Carlson’s research interests include: cryptography, set theoretic estimation, natural language, patterns in language, physical security, critical infrastructure protection, and hardware security.

Patrick Doherty is a senior at Fontbonne University and will graduate in December of 2015. He is majoring in Computer science and plans on earning a graduate degree in the same field. He is the Project manager for the Research team.

"WORKSHOP: How Do I Tails? A Beginner's Guide to Anonymous Computing" - Forrest (Forbo)

Tails is The Amnesic Incognito Live System. Think of it as 'private browsing on steroids'. It is a fully bootable Debian-based distro that is designed from the ground up to protect your anonymity and privacy. All traffic is routed through Tor by default. In addition to many basic applications, it includes utilities designed to prevent information leaks.

It is used by whistleblowers, journalists & their sources, political activists living under oppressive regimes, victims of domestic abuse and many more. Edward Snowden, Glenn Greenwald and Laura Poitras all used it throughout the process of bringing the NSA's overreach to light, and continue to use it today.

In this workshop, we will be covering more fully what Tails is, what it is used for, how to get your own copy up & going, as well as special considerations to take when it comes to operational security. Step-by-step instructions for creating your own bootable copy will be provided for your convenience.'

Forbo is a penetration tester with a background in network and systems administration. An EFF member and volunteer, he helped people to learn about privacy protecting technologies at last year's Crypto & Privacy Village. When he's not protesting the NSA's mass surveillance, he pretends to be a DJ mixing bumpity-bumpity-boom computer music, particularly trance, breaks, and drum & bass.

"What is Bitcoin Tumbling and why do it?" - Sean Thomas Jones

Bitcoin and other crypto-currencies have become a very big deal since its inception in January 2009 when the very first transaction was recorded to the blockchain. Since this time multiple other crypto-currencies have come into existence, an entire crypto-currency market has been created and the technology is making waves in the overall economy.

As with all technology it can be used for good or bad and Bitcoin is no different. The technology has grown in popularity and many people desire to use it in a secure, anonymous manner that would make it difficult to identify them. One option would be the use of a Bitcoin Tumbler. This tool was created because every Bitcoin transaction is written to a public ledger called the blockchain. Anyone can track Bitcoins as they are transferred between addresses.

When used properly the process of tumbling Bitcoin may increase your chances of remaining anonymous. This tool is useful to people looking to maintain their privacy, those who may be in restrictive countries or someone looking to make a purchase without it being tracked back to them. It also may be used to launder stolen Bitcoins, make illegal purchases or avoid leaving the paper trail found with traditional currencies.

Sean Thomas Jones is an accomplished information security professional and father of three. He has many years of experience securing and defending networks and hardening applications by using best practices, tools and technologies. Sean recently won the World Championship Title Belt in Spaghetti Monster Wrestling by defeating his children in the royal rumble. Along with this Championship, Sean also holds the SANS/GIAC Incident Handler, Intrusion Analysis and Web Application Penetration Tester Certifications along with the ITIL Foundation Certification. He practices his craft as a Cyber Crime Researcher at AlertLogic in Texas, which is affectionately called "GOD's Country" or the Lone Star State" and owes his success to his wonderful and patient wife.

"The design and implementation of a white-listed, end to end encrypted status application" - David Dahl

The design and implementation of a white-listed, end to end encrypted status application, or how we can have nice (private social network) things. The general line about privacy and social networking goes like this: "You can either have an easy to use and very social system with ads and data-mining or you can use GPG and like it". While there are many technical hurdles to overcome, the burden for a designer of a "private Twitter" or "private Facebook Wall" lies chiefly with user experience that rises above that of all of the difficult to use privacy tools we depend on today. In this talk, the code, frameworks, data structures, database queries and front-end UX will be examined, discussed and demoed in a working "Twitter-like" status update application.

David Dahl is the director of the Crypton project at SpiderOak. Crypton is a end to end encrypted application framework for mobile and desktop applications. In a previous life, David was a Senior Privacy Engineer at Mozilla Corporation where he helped edit the W3C Web Crypto API specification and created the Web Console in Firefox. Before this episode, he was a Software Engineer at Industrial Light & Magic working on the artists' knowledge base. He hacks on Zero-Knowledge software in his bunker somewhere in the Middle-West.

"The Death of Privacy" - Stealth

How did we let it get this bad and what you can do to get some of yours back.

Over the years our individual freedoms and personal privacy rights have steadily been eroded. But it is not just the fault of the government or the NSA. Many of our own choices and changes in cultural norms have helped make this happen. In this talk I will explore how things got out of hand and why. While it may be too late to go back to that age of innocence, we can face the future better informed and prepared to protect our security and reclaim our rights to personal privacy.

Involved in computers since the dark ages (before WWW). The first computer I hacked was an IBM 1130 mainframe. Designed and built my first personal computer running CPM on a Z80 in the late 70s. Built large scale WANs for Fortune 500 companies during the 80s. Developed eCommerce sites and managed web developers during the 90s. Since 2000 I have been an Information security and computer forensics expert and have acquired a lifetime of experience to share in many aspects of the tech industry. .A Defcon goon for 22 years and longtime privacy advocate.

"CrypTag: Building Encrypted, Taggable, Searchable Zero-knowledge Systems" - Steven Phillips

Internet users should be able to access their data from anywhere without having to trust the web applications and cloud services storing that data.

But there's a problem. Zero-knowledge storage systems are often impractical for web apps because they can't perform often-essential functionality on behalf of the user, such as search, since they don't have the password to decrypt that data in order to search it, and you can't search encrypted data. Or can you?

This presentation introduces CrypTag, a library that enables Go programmers to easily build applications that store encrypted user data that users can tag and securely, efficiently, remotely search by those tags without revealing anything about the nature of said data to the party storing it. That is, CrypTag is a library for easily creating encrypted, taggable, searchable zero-knowledge systems.

This talk covers the tricks behind how CrypTag works, the pros and cons of using CrypTag versus alternatives, includes a live demo of a useful open source CrypTag-based program, and is suitable for anyone who knows what a server is and is excited about leveraging encryption to help everyday users and geeks alike.

Steven Phillips is a Philosopher and computer programmer. He studied Philosophy and mathematics at UC Santa Barbara before co-founding the cleverly-named Santa Barbara Hackerspace in 2010. In 2012, after heeding the warnings of Jacob Appelbaum and Julian Assange of an ever-growing surveillance state, he co-founded The Cloak Project ("TCP" for short) with AJ Bahnken. TCP has since produced the secure chat programs LanChat and Cloakcast, as well as cryptographic utility libraries written in the Go programming language.

Steven is passionate about human Greatness, social justice, democratizing forces, and revolutionary projects.

"Making Email Dark" - Ladar Levison & Fred Nixon

This talk will focus on the Dark Internet Mail Environment (DIME), a standards based, collaborative effort to create an elegant technical solution which is capable of protecting the privacy of email. DIME is focused on making the end-to-end encryption of email messages automatic, provides for message confidentiality, author verification, and minimizes the leakage of metadata. The DIME standards dramatically reduce the amount of trust individual users must place in service providers. The new standards, which we hope will someday succeed OpenPGP, have been designed to resist manipulation by advanced persistent threats. During this short presentation, we will provide a compressed discussion of the DIME standards, followed by a project update, where we hope to showcase the DIME implementation effort.

Ladar Levison is the Owner and Operator of Lavabit, LLC, an email service founded in 2004 (and originally named Nerdshack), Lavabit has always been focused on protecting the privacy of its user's communications. Levison created Lavabit because he believes that privacy is a fundamental, inalienable right, and a prerequisite for afunctioning, free and fair democratic society. This led Lavabit to reach, at its peak, over 410,000 users. Then, on August 8, 2013, and in response to a court decision which required Lavabit to surrender its TLS private key, Levison made the bold decision to suspend operations, and refuse to remain silent, and "complicit in crimes against the American people." Since then Levison has been vigorously defending the right to speak freely, and privately on the Internet. As the principal force behind the Dark Mail Initiative, Levison has also been working on a technical solution for the problem of email privacy.

Fred Nixon is a developer, based in Atlanta, and working to implement the Dark Internet Mail Environment. Fred has worked for Mindspring, Earthlink, and General Electric in Research and Development, creating scalable, distributed systems for communications and core ISP services. He is an advocate for speech and privacy rights, and the technology to support those rights for everyone.

"STDs are the least of your worries when Cyber Cancer Prognosis is imminent" - Chris Brown (BigBiz)

Crypto and privacy are BIG concerns when dealing with any type of threat but when dealing with STDs (we refuse to acknowledge APT - anyone who mentions advanced persistent threats shall be thrown out of the talk ;>)

Mr. Brown has been a Info/Cyber Security Instructor since 2004 and in the IT business since 1997. Currently traveling and teaching as a Sr. Technical Instructor for FireEye, he has previously taught for ArcSight (Pre-HP acquisition), Dept of Army Europe, contract trained for Microsoft, HP, Comptia and ISC2. Mr. Brown has also worked various Cyber Security Analyst and InfoSecurity positions for Northrop Grumman, Raytheon, DRS and a few other defense contractors. Mr. Brown has traveled extensively both on a domestic and international level and has seen the good, the bad and the ugly regarding a broad range of topics that relate to crypto, privacy, intrusion-problem set actors and detection & defense TTPs/SOPs that work and haven't worked.

"Protecting global email - status & the road ahead" - Per Thorsheim

In the spring of 2014 starttls.info was launched. A simple service to measure and grade the RFC 3207 STARTTLS support of the mailservers for any given domain, it was quickly embraced by ACLU and EFF. Used as a reference site, major service providers around the world were persuaded very quickly to implemented support for RFC 3207.

This talk will summarize the history & current status of worldwide RFC3207 adoption. It will also look at upcoming solutions that will further enhance the security of email and keep the bad guys from unlawfully intercepting & monitoring your private communication.

Above average interested in Passwords. The guy who has convinced the Norwegian government to recommend (& soon standardize) the use of RFC 3207 STARTTLS, as the first country in the world to do so.

"Engineering Responsible Data Governance - A Privacy by Design Primer" - Steven F. Fox

The data “gate keepers” – companies that gather and process data using technologies ranging from mobile/wearable devices to Big Data – have the opportunity to be the guardians of privacy. This role can be realized only through the work of practitioners that can design for data security and privacy. While RSA Conference sparked the vision in my minds of management, this session calls upon the DefCon community to make it happen.

This talk uses case studies to explore Privacy by Design (PbD), a systems engineering approach that accounts for privacy throughout a lifecycle. Attendees will learn how to apply the seven principles of PbD to account for privacy concerns while delivering on a system’s business requirements. They will also learn how to become trusted advisors to organization working to integrate PbD into their development programs.

Steven F. Fox is an infosec polymath – bringing a cross-disciplinary, international perspective to the practice of information security; combining his security architecture/engineering, consulting, an IT Audit and systems engineering expertise with principles from behavioral/organizational psychology to address security challenges. He is a blogger covering IT Governance, Risk Management and IT-Business fusion topics. He also volunteers his time to the Ponemon Institute and Circle City Con.

"Modern Crypto: 15 Years of Advancement in Cryptography" - Steve Weis

This talk presents a general introduction to some of the most interesting developments in cryptography from 2000 onward. We'll present a high-level explanation of recent crypto developments, what applications they may enable, and how they may become more important in the coming years.

Topics may include modern elliptic curves, pairing-based cryptography, fully homomorphic cryptography, functional cryptography, obfuscation, and post-quantum cryptography.

Steve Weis is a software engineer at Facebook, where he most recently helped release support for PGP. Previously, Steve was co-founder & CTO of PrivateCore, a security startup acquired by Facebook in 2014. In the past, Steve was a technical director at AppDirect and a member of the applied security group at Google.

While at Google, Steve created Google 2-step verification and the Keyczar cryptographic library. Steve received a PhD in computer science from MIT where he was advised by Ron Rivest. Steve's interests include cryptography, security, theoretical computer science, and entrepreneurship.

"CFSSL: the evolution of a PKI toolkit" - Nick Sullivan

In July 2014, CloudFlare released CFSSL, an open source toolkit for TLS and PKI written in Go. CFSSL can be used as a lightweight certificate authority (CA), a certificate chain bundler--and now--a TLS configuration scanner. One year later, CloudFlare is excited to announce CFSSL 1.1 and cfssl.org, the home on the web for the CFSSL development team. This presentation will cover the challenges of the project and how it evolved from an internal tool for CloudFlare's Railgun product into a software library used by several high-profile organizations including the "Let's Encrypt" project.

Nick Sullivan is a cryptography and security enthusiast. He founded and built the security team at CloudFlare, one of the world's leading web security companies. He is a digital rights management pioneer in his work building Apple’s multi-billion dollar iTunes store. He holds an MSc in Cryptography and a BMath in Pure Mathematics.

"IMSI Catcher Counter-Surveillance" - Freddy Martinez

This talk will address how activists can detect IMSI Catchers around political protests and how to do some practical counter-surveillance. We will very briefly discuss the capabilities of IMSI catchers and then launch into a discussion about detection and evasion. In the talk we will describe practical (cheap / off the shelf) solutions that we have actually used in various scenarios. Lastly we will describe future work in this area.

Freddy studied graduate level physics now works as a Linux SysAdmin. His current focus is on privacy/digital rights, free and open source projects, and FOIA work including multiple lawsuits against the City of Chicago.

"Hacking Quantum Cryptography" - Marina (bt3)

Alice and Bob’s quest through the fascinating quantum mechanics world as a way to avoid archvilainess Eve eavesdropping. In 1994, Peter Shor showed that many of the cryptosystems used today can be broken using a quantum computer. This idea will be explained together with a short overview of qubit systems. Next, we will see how quantum computing gives rise to the possibility of quantum key distribution with unparalleled security. We will end with a brief discussion on post-quantum cryptography concepts.

Marina is an information security engineer at Yelp, in San Francisco. She finished her PhD in Physics last year, at the University of Stony Brook in New York. During graduate school she researched theoretical and computational Physics at several national laboratories, such as NASA Goddard Space Center, Los Alamos National Laboratory, and Brookhaven National Laboratory. She is an avid CTF player and her first computer was a 386, when she was 5 years-old.

"Teaching Privacy Using Red Team Strategies: An Undergraduate General Education Curriculum" - Robert Olson (nerdprof)

Privacy is very important concept that, unfortunately, many undergraduate students don’t encounter frequently in their chosen courses of study. Often, when it is discussed, it’s discussed using a deeply philosophical approach to which students may have a difficult time connecting. This approach also often fails to connect privacy with many of the important technical nuances that can have a significant impact on modern privacy debates.

This talk will discuss an alternative approach used in a Spring 2015 undergraduate general education course titled Hacking, Surveillance, and Privacy. The goal of this class was to take a technical approach to teaching privacy concepts in order to ensure students would understand the technical details of modern privacy debates in an addition to the philosophical concepts.

Students were given hands-on experiences with penetration testing tools so that they might better understand how computer security impacts privacy while seeing first-hand how their privacy might be violated. Students were exposed to data-mining techniques so that they might understand the privacy implications of large-scale data collection. Finally, students were exposed to privacy tools so that they might understand the challenges in protecting one’s privacy against modern threats.

Robert Olson is currently an instructor in the Department of Computer and Information Sciences at the State University of New York at Fredonia, where he teaches courses in security, data mining, and programming. He holds two graduate degrees in Interdisciplinary Studies (Cognitive Science) and Management Information Systems as well as several professional certifications. He has spoken at the Def Con 22 Crypto / Privacy Village, BSides Rochester, and several academic conferences. Most recently, his research has been focused on designing penetration testing agents and exploring new ideas in privacy protecting network protocols.

"Skip, Freak, and Logjam: Moving past a legacy of weakness in TLS" - Karthikeyan Bhargavan

The Transport Layer Security (TLS) protocol suffers from legacy bloat: after 20 years of evolution, it features many versions, extensions, and ciphersuites, some of which are obsolete and known to be insecure. Implementations and deployments of TLS deal with this complexity by implementing composite state machines that allow new and old features to coexist for interoperability, while waiting for deprecated features to be disabled over time. Getting this composition right is tricky, and any flaw can result in a serious attack that bypasses the expected security of TLS.

This talk will discuss three recent vulnerabilities discovered in our group: SKIP uses state machine flaws in Oracle’s JSSE to hijack TLS connections between a Java client and any web server; FREAK uses legacy support for export-grade RSA cipher suites to break into connections between mainstream browsers and 25% of the web; Logjam exploits a protocol flaw to confuse DHE key exchanges into using export-grade Diffie-Hellman groups. These attacks rely on a combination of protocol-level weaknesses, implementation bugs, and weak cryptography. The talk will advocate principled methods to avoid such weaknesses in the future, such as software verification and new robust designs for new protocols like TLS 1.3.

Karthik is a researcher at INRIA, the French national lab for computer science. He is based in Paris where he leads a team called Prosecco (“programming securely with cryptography”) and is the principal investigator of an ERC starting grant on provably secure implementations of cryptographic protocols. Karthik and his colleagues develop new programming languages like F* (fstar-lang.org) and use them to build and verify protocols like TLS (milts.org).

Along the way, they sometimes find and disclose implementation bugs and protocol flaws like Triple Handshake (secure-resumption.com), FREAK (smacktls.com), and Logjam (weakdh.org). Partly as a consequence of these attacks, and partly motivated by stronger security theorems for the web, Karthik is loosely involved with the TLS working group in the design on TLS 1.3. Karthik was trained at IIT New Delhi and the University of Pennsylvania. Before coming to Paris in 2009, he worked as a researcher at Microsoft Research in Cambridge, England for several years.

My first ICS pwnage.

Location: Bronze One

Time: 1000 Friday

Speaker: Larry Pesce is a Senior Security Analyst with InGuardians

Want to get your start with some really simple ICS protocols? How about we go all the way back to 1979 and poke at unauthenticated protocols that are still used today, Modbus. It would be nice to play without breaking some real systems so here are a few things that you can use to practice practicing the basics.

Bio: Larry Pesce is a Senior Security Analyst with InGuardians. His recent experience includes providing penetration assessment, architecture review, hardware security assessment, wireless/radio analysis, and policy and procedure development for a wide range of industries including those in the financial, retail, and healthcare verticals. In his spare time he likes to tinker with all things electronic and wireless. Larry is an amateur radio operator holding his Extra class license and is regularly involved in emergency communications activities

Vulnerability Inheritance in Industrial Systems

Location: Bronze One

Time: 1300 Friday

Speaker: K. Reid Wightman, Directory Digital Bond Labs

The ICS software and hardware ecosystem is fairly opaque to outsiders, but OEM relationships exist everywhere. Shared hardware and shared software components mean that vulnerabilities which affect one product line may apply to others. We attempt to unravel some of the relationships through examples of 3rd-party vulnerability inheritance, and discuss what can be done to help vendors and end users track vulnerabilities.

Bio: Reid Wightman is Director of Digital Bond Labs, where he finds new vulnerabilities in ICS software, firmware, and hardware for vendors and end users. He served as a consultant and security officer for IOActive, and also performed red team testing for an industrial equipment vendor employee to promote security awareness within the company. In a former life, he performed offensive security research for the United States government.

Electric Grid: A Multiplayer Game of Destruction

Location: Bronze One

Time: 1000 Saturday

Speaker: Kenneth Shaw, Jerel Culliss, IOActive

We brought you this year "Electric Grid: A Multiplayer Game of Destruction" and now we will teach you how to play it! The game is composed of compromised portions of an electric grid which players can control with the end-goal of destroying parts of the electric grid system. It will require cooperation or cunning from players to bring it down. Are you up to the challenge? We will explain the details of how the game was created, how realistic the simulations are, and what a well positioned attacker could hope to achieve. Further, our research in the are focuses on minimum compromised nodes for system failure, resonances and more!

The Little Pump Gauge that Could: Attacks Against Gas Pump Monitoring Systems

Location: Bronze One

Time: 1300 Saturday

Speaker: Kyle Wilhoit, Stephen Hilt, Trend Micro

Over a period of months, several Guardian AST gas pump monitoring systems were attacked. These attacks occurred on real pump monitoring systems, but also on systems that we controlled, created, and deployed. We watched these attackers, what they did, and performed intelligence gathering on the nefarious actors. Details and intelligence on whom the attackers were, possible motivations behind the attacks, and detailed indicators of compromise will be shared in this.

Bio: Kyle Wilhoit is a Sr. Threat Researcher at Trend Micro on the Future Threat Research Team. Kyle focuses on original threat, malware, vulnerability discovery/analysis and criminal activity on the Internet. He also hunts for new malware like a rabid dog. Prior to joining Trend Micro, he was at Fireeye hunting badness and puttin' the bruising on cyber criminals and state sponsored entities as a Threat Intel guy. Prior to Fireeye, he was the lead incident handler and malware guy at a large energy company, focusing on ICS/SCADA security and targeted persistent threats. He has also worked at a Tier 1 ISP playing with malware. Kyle is also involved with several open source projects and actively enjoys reverse engineering things that shouldn't be.

Bio: Stephen Hilt has been in Information Security and Industrial Control Systems (ICS) Security for around 10 years. With a Bachelors Degree from Southern Illinois University, he started working for a large power utility in the South East of the United States. There Stephen gained an extensive background in Security Network Engineering, Incident Response, Forensics, Assessments and Penetration Testing. That is where Stephen started focusing on ICS Assessments, then moved to working as an ICS Security Consultant and Researcher for one of the most foremost ICS Security Consulting groups in the world. In 2014, Stephen was named as having one of the coolest hacks by dark reading for his PLCPwn, a weaponized PLC. As well, he has published numerous ICS Specific Nmap Scripts to Identify ICS protocols via native commands. Stephen now is at Trend Micro as a Sr. Threat Researcher, continuing ICS research, and diving into other areas of research. Over the past 10 years, Stephen has learned how to build, defend and attack ICS networks.

Raspberry PI, a little IO with SDN equals "control network in a box"

Location: Bronze One

Time: 1100, 1400 Friday and Saturday ***This talk will not be recorded***

Speaker: Matthew E. Luallen, CYBATI

Come attend and participate in this hands-on session to learn about control system cybersecurity. Seating for hands-on access will be limited to the first 15 participants while others can glean and watch. Concisely learn the simple and complex challenges to ICS cybersecurity through scenarios in this concise 45 minute session.

© 1992-2015 DEF CON Communications, Inc. All Rights Reserved | DEF CON Policies