In our talk we will present some of the most ecsotic 'Change IP' packets for PLCs from various ICS protocols and investigate into why each vendor chose to implement it in one way or another. Furthermore, we will show how one can easily detect, prevent, and be protected against these change IP requests with applying custom snort rules.
Coffee Talk With Dr. Suzanne Schwartz
Linton Salmon, Program Manager, Microsystems Technology Office, Defense Advanced Research Projects Agency
This workshop is an introduction to building first-class host instrumentation capabilities with open-source technologies supported by leading security practitioners. Learn the ins and outs of Facebook’s osquery agent, exposing information from hundreds of sources across the major operating systems (Mac, Windows, and Linux). See how to tie this together across the infrastructure with Kolide’s Fleet. Throughout the workshop we will interact with osquery in example scenarios in order to build hands-on experience with these tools. We will begin with a dive into the capabilities of osquery. A brief introduction to the structured query language (SQL) used in osquery will be provided. Using this query language, we will learn to extract basic data, and move on to more advanced ways to associate data across subsystems. We will discuss the scheduled query facilities of osquery and how these can be tied into a logging and alerting pipeline. When we have built some familiarity with osquery, we will look at how to utilize these capabilities across the managed infrastructure. We will cover how to manage configurations and live query individual and groups of hosts with Kolide Fleet. The discussion of Fleet will be rounded out with an introduction to the command line interface, with suggestions for how to integrate with automation and source-control workflows.
DEF CON wants to help hackers anonymously submit bugs to the government: Let's discuss.
Friday at 09:00 in Track 1
45 minutes
Jeff Moss
Corbin Souffrant Leviathan Security
Pablo Breuer SOFWERX/The Donovan Group
Jennifer Granick ACLU
Chris Krebs DHS CISA
Runa Sandvik NY Times
Here’s the use case. You learn of a problem with a government system or some technology, and you want to do the right thing. You want to get the information into the right hands, but you’d be more comfortable sharing if you knew you couldn’t be identified as the messenger of the problem. Sound familiar?
This very problem has been the subject of a years-long conversation in the space between government and independent security research. The goal is to create a sturdy, anonymous system for hackers and researchers that shares your tip directly with the part of government that needs to know, and keeps you out of the equation. This is your chance to be part of the conversation. Join The Dark Tangent, the NYT’s Runa Sandvik, Leviathan’s Corbin Souffrant, SOFWERX and The Donovan Groups Pablo Breuer, the ACLU’s Jennifer Granick and the DHS CISA Christopher Krebs and have your voice heard.
Corbin Souffrant
Corbin Souffrant is a Security Consultant with Leviathan Security Group where his expertise spans several security domains. He has engaged in projects involving everything from firmware and device security, to application assessments, and even fuzzer development. Prior to this, he participated as a competitor in DARPA Cyber Grand Challenge (CGC), researched program analysis tooling, and reverse-engineered exploits from active malware samples.
Twitter: @loliponi
Pablo Breuer
Pablo Breuer is currently the director of US Special Operations Command Donovan Group and senior military advisor and innovation officer to SOFWERX. He's served at the National Security Agency and U.S. Cyber Command as well as being the Director of C4 at U.S. Naval Forces Central Command. He is a DoD Cyber Cup and Defcon Black Badge winner, and has been adjunct faculty at National University, California State University Monterey Bay, and a Visiting Scientist at Carnegie Mellon CERT/SEI. Pablo is also a founder and board member of The Diana Initiative, an InfoSec event focused on advancing the careers of women in cyber security.
Twitter: @sofwerx
Website: https://www.sofwerx.org
Jennifer Granick
Jennifer Granick fights for civil liberties in an age of massive surveillance and powerful digital technology. As the surveillance and cybersecurity counsel with the ACLU Speech, Privacy, and Technology Project, she litigates, speaks, and writes about privacy, security, technology, and constitutional rights. Granick is the author of the book American Spies: Modern Surveillance, Why You Should Care, and What To Do About It, published by Cambridge Press and winner of the 2016 Palmer Civil Liberties Prize.
Twitter: @granick
Website: https://americanspies.com
Christopher Krebs
Christopher Krebs serves as the first director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA). Mr. Krebs was originally sworn in on June 15, 2018 as the Under Secretary for the predecessor of CISA, the National Protection and Programs Directorate (NPPD). Mr. Krebs was nominated for that position by President Trump in February 2018.
Before serving as CISA Director, Mr. Krebs was appointed in August 2017 as the Assistant Secretary for Infrastructure Protection. In the absence of a permanent NPPD Under Secretary at the time, Mr. Krebs took on the role of serving as the Senior Official Performing the Duties of the Under Secretary for NPPD until he was subsequently nominated as the Under Secretary and confirmed by the Senate the following year.
Twitter: @CISAKrebs
Website: https://www.dhs.gov/person/christopher-c-krebs
Runa Sandvik
Runa Sandvik is the Director of Information Security for the Newsroom at The New York Times. She helped launch nytimes.com/tips in 2016 and has lead numerous digital security trainings to educate journalists about how to protect their data, communications and sources.
Twitter: @runasand
Website: https://encrypted.cc
The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
Sunday at 14:00 in Track 3
45 minutes | Demo, Tool
Bernhard Mueller ConsenSys Diligence
Daniel Luca
Ethereum smart contracts are Turing-complete programs that mediate transfers of money. It doesn't come as a surprise that all hell is breaking loose on the Ethereum blockchain.
In this talk, we'll introduce Karl, an Ethereum blockchain monitor, and Scrooge McEtherface, an auto-exploitation bot that extracts Ether from vulnerable smart contracts. Scrooge uses symbolic execution to detect vulnerable states that live up to three transactions deep and constructs exploit payloads using the Z3 constraint solver.
We'll also examine the game-theoretic consequences of Scrooge's existence. What if multiple bots compete for exploiting the same contracts? How about honeypots that counter-exploit bots? Is it possible to cheat those honeypots? When all is said and done, who is going to end up stealing money from whom?
During the talk, we'll show many examples for vulnerable contracts, honeypots, and counter-honeypots, explain the role of transaction ordering and frontrunning, and launch a little challenge for the audience.
Bernhard Mueller
Bernhard Mueller is an OG security engineer and researcher with experience in a variety of fields including Internet protocols, web apps, operating systems, server software and blockchain technology. His work in mobile and blockchain security has earned him two "Best Research" Pwnie Award nominations (and one win). In the Ethereum community he is known for creating the Mythril symbolic analyzer.
Twitter: @muellerberndt
LinkedIn: https://www.linkedin.com/in/bernhardm/
Daniel Luca
Daniel is a self-taught developer with experience in multiple programming languages. Having a hacker mindset he always tests the limits of software or hardware he interacts with. He likes to experiment with new technologies, always trying to develop his available toolchain. When he isn't glued to a computer screen, he likes to snowboard, read and meditate. He currently does security audits and builds tools for ConsenSys Diligence and the Ethereum ecosystem.
Twitter: @cleanunicorn
LinkedIn: https://www.linkedin.com/in/luca-daniel-5227267/
Return to Index - Add to 
- ics Calendar file
Meetups - Paris - Outside at base of Eiffel Tower - Friday - 06:00-06:59
Title:
DEFCON 27 4X5K run
DEF CON 27 Let's go for a run 4X5K Announcement
The 4X5K is returning to DefCon 27. Come running, because maybe you like your mornings sweaty! 0530 is the perfect time to either wind down your evening or start up your day! 0600 is of course the coolest time for a run in Vegas (It's only 80!) But who really cares, running is fun, let's go for a run!
Meet up at 0600 (6 AM) at the base of the Paris Hotel and Casino Eiffel tower outside on Thursday-Sunday (8/9-8/12/2019) for 5.1K fun run. Run departs at 0610. We've got two pace groups. The fast group is for people that run an average pace of around 9:00-minute miles or better. If you run slower than an average pace of 9:00-minute miles you're in the not fast group. This is basically so everyone ends up in the same place at the end. At either pace, do it all four days and it's a half marathon (21K).
Routes will vary but will mostly likely be strip-centric. Printed route maps will be displayed before the run.
Safety Brief: It's Vegas, weird stuff will happen, it always does. Be aware that wet concrete is super slippery, broken glass is not your friend, and randos abound! If people harass you, just keep running. You are fast, and they are lame. Some random people may want to join in. This is cool, until it's not. Watch for traffic along the route. It's going to be hot. Hydrate before, during, and after. There can be a surprising number of stairs to climb on these runs, especially when we run south along the strip. Help each other out. Don't die.
The organizers (of which there are very few) are interested in talking to sponsors and past attendees about how we can awesome up this event. We're looking at you, fitness tracker companies: maybe we'll stop dropping 0days if you buy us some water and bananas.
I will see you there.
Follow @Agent __ X __ & @whereiskurt on Twitter for updates, and follow the hashtag #DEFCON4X5K
DEF CON 27 Let's go for a run 4X5K Announcement
Return to Index - Add to
- ics Calendar file
WS - Flamingo - Lower Level - Red Rock VII - Friday - 14:30-18:30
Defending environments and hunting malware with osquery
Friday, 1430-1830 in Flamingo, Red Rock VII
Guillaume Ross Hacker
Julian Wayte Security Professional
In this workshop, you will learn how to defend Linux and Windows environments with osquery, using techniques that could easily be adapted to Mac and containerized environments. Then, we will look at how we can leverage osquery to hunt for malware and attackers, as well as how we could use osquery in a controlled environment to do some basic malware analysis.
We will cover osquery deployment scenarios and configurations as well as ways we can implement it to improve the security of servers and workstations.
Specifically, we will use osquery to monitor specific security configurations, detect lateral movement, detect malware, and even see how we can use it in lab environments to analyze malware.
If you have never used osquery before, this workshop will get you started. If you have used osquery before, this workshop will help you get the most out of it, by allowing you to develop queries and an understanding of the schema and how it can be applied to protect environments and detect attacks.
The topics covered will include:
* Setup, configuration and flags
* Logging results
* Building simple to complex queries
* Monitoring for lateral movement
* Tracking important security configurations on Windows and Linux
* Detecting malware
* Performing basic malware analysis on a VM with osquery
Skill Level Beginner
Prerequisites: Basic understanding of Linux and Windows. Mac and Docker optional. No knowledge of osquery itself is needed.
Materials: A computer with a SSH and RDP client. Linux and Windows systems in the cloud will be provided. Local Linux and Windows VMs are welcome as well, but not necessary.
Max students: 60
Registration: https://www.eventbrite.com/e/defending-environments-and-hunting-malware-with-osquery-red-rock-vii-tickets-63606251009
(Opens 8-Jul-19)
Guillaume Ross
Guillaume has worked as a security engineer and consultant, as a manager of blue teams, and way before that, as an enterprise IT person focused on endpoints. Guillaume is currently the Principal Security Researcher at Uptycs, finding new ways to defend systems using the power of osquery. He is also a trainer for Pluralsight, producing training content around topics such as network security monitoring.
Having worked for startups as well as Fortune50 companies, he knows how to build a security program, but having had to do the work, he also dislikes doing meaningless "best practices" work that has no practical value, and really enjoys leveraging the great open source software available to all of us.
Guillaume has spoken and given workshops at various conferences like BSidesLV, Thotcon and Northsec on many topics, including mobile security, endpoint security, logging and monitoring and much more.
Julian Wayte
Julian Wayte is a security professional with 20 years’ experience in IT data and security solutions. Julian graduated from the University of Western Australia with degrees in Mechanical Engineering and Computer Science. Hi early work was in Data Warehousing and CRM before helping to develop the NORA (Non Obvious Relationship Awareness) technology at SRD, which was later acquired by IBM. During his time at IBM, Julian worked with the Guardium Data Activity Monitoring and Data Encryption security products before becoming hooked on osquery and moving to Uptycs in 2019.
Return to Index - Add to
- ics Calendar file
BTVT - Flamingo - 3rd Floor- Savoy Room - Friday - 15:00-15:59
Detection At Google: On Corp And Cloud
Friday 15:00, Savoy Ballroom, Flamingo (Blue Team Village) (1H)
@fryx0r
is a Security Engineer on Google's detection and response team. He works out of the Sydney office, having previously worked for the Department of Defence, FireEye and Commonwealth Bank. He enjoys writing Golang and making memes, and in his spare time travels around the world running Magic the Gathering tournaments.
@JSteeleIR
is a Security Engineer with 6+ years of experience in Detection, Response, Forensics, Reverse Engineering, and Automation. Some of that's been at Google. Some has been in the cloud. Some of it was good. When not sparring in the cyberspaces, he can be found camping, collecting odd input devices (possibly using those to reimplement the less PAGER in Golang) or attempting (and failing) to sleep on a normal schedule.
An overview of detection at Google: An introduction to Google's Blue team and its technologies, and how we use currently available tools to investigate on Google Cloud (GCP). We will cover the structure and setup of our team; give a detailed explanation of the main tools and services we use (with an emphasis on the ones that are open source, so you can use them yourself); and delve deeply into how to do detection on GCP - going beyond finding simple misconfigurations and instead detailing how to use available tools and logs to increase visibility and find badness.
Return to Index - Add to
- ics Calendar file
WLV - Bally's - Palace Meeting Rooms 1-7 - off hallway to Event Center - Friday - 11:30-12:25
Nishant Sharma
Bio
Nishant Sharma is an R&D Manager at Pentester Academy and Attack Defense. He is also the Architect at Hacker Arsenal where he leads the development of multiple gadgets for WiFi pentesting such as WiMonitor, WiNX and WiMini. He also handles technical content creation and moderation for Pentester Academy TV. He has 7+ years of experience in information security field including 5+ years in WiFi security research and development. He has presented/published his work at Blackhat USA/Asia, DEF CON China, Wireless Village, IoT village and Demo labs (DEFCON USA). Prior to joining Pentester Academy, he worked as a firmware developer at Mojo Networks where he contributed in developing new features for the enterprise-grade WiFi APs and maintaining the state of art WiFi Intrusion Prevention System (WIPS). He has a Master's degree in Information Security from IIIT Delhi. He has also published peer-reviewed academic research on HMAC security. His areas of interest include WiFi and IoT security, AD security, Forensics and Cryptography.
@wifisecguy
Developing WiFi Access Point Rootkits
Abstract
"WiFi access point (AP) security is one of the most important aspect when it comes to securing networks. The compromise of a WiFI AP (which mostly also double-up as router in SOHO environments) can lead to several secondary attacks. There are multiple vectors which are used to compromise the WiFi AP ranging from default passwords to sophisticated 0-days. But, after compromising the device, avoiding detection and maintaining access are the most important areas which eventually dictates the impact of the compromise. In this presentation, we will cover how to develop rootkits for WiFi APs to achieve stealth and persistence. We will be using OpenWRT for the demos.
We will be covering the following in the presentation:
1. Introduction to OpenWRT
2. OpenWRT architecture and components
3. Understanding the OpenWRT build system
4. Compiling firmware
5. Compiling userspace application
5. Compiling kernel modules
6. Developing and deploying a hello-world rootkit
8. Adding capabilities to hello-world rootkit:
a - Hiding itself
b - Monitoring System calls
c - Resisting kill
d - Network stack backdoor
9. Conclusion and Q and A
Attendees will get access to cloud based build system lab so they can try out the compilation and tinker if code."
|
Return to Index - Add to
- ics Calendar file
CHV - Bally's Event Center - Friday - 17:00-17:50
Digital Vehicle Forensics
Eoin Bates
Fri 8/09 •
5:00 PM-5:50 PM
50 min talk
Digital Vehicle Forensics involves the acquisition and analysis of digital data (digital evidence) from various vehicle systems to assist in motor vehicle related investigations.
THIS WILL NOT BE RECORDED
Return to Index - Add to
- ics Calendar file
Night Life - Paris - Concorde B Ballroom - Friday - 19:30-25:59
Title:
Diversity Party
hacker outreach event
Follow T:@DefConOwasp for updates
Swing by to connect with others.
Come and meet cool groups and crews, we encourage you to come and take a space at the event : )
Come hang and meet others, make new friends, see what others are working on : )
Learn about & meet organizations that are working to bring empowerment and inclusion to the hacker community.
We are next to Blanket Fort Con: )
Return to Index - Add to
- ics Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 15:15-16:15
15:15-16:15
Documentary - Code Rush
Code Rush is a 2000 documentary following the lives of a group of Netscape engineers in Silicon Valley. It covers Netscape's last year as an independent company, from their announcement of the Mozilla open source project until their acquisition by AOL. It particularly focuses on the last-minute rush to make the Mozilla source code ready for release by the deadline of March 31, 1998, and the impact on the engineers' lives and families as they attempt to save the company from ruin.
7.3/10 IMDB, 4.6/5 Amazon.
Return to Index - Add to
- ics Calendar file
DC - Paris - Track 1 - Friday - 11:00-11:45
Don't Red-Team AI Like a Chump
Friday at 11:00 in Track 1
45 minutes | Demo, Tool
Ariel Herbert-Voss PhD student, Harvard University
AI needs no introduction as one of the most overhyped technical fields in the last decade. The subsequent hysteria around building AI-based systems has also made them a tasty target for folks looking to cause major mischief. However, most of the popular proposed attacks specifically targeting AI systems focus on the algorithm rather than the system in which the algorithm is deployed. We’ll begin by talking about why this threat model doesn’t hold up in realistic scenarios, using facial detection and self-driving cars as primary examples. We will also learn how to more effectively red-team AI systems by considering the data processing pipeline as the primary target.
Ariel Herbert-Voss
Ariel Herbert-Voss is a PhD student at Harvard University, where she specializes in adversarial machine learning, cybersecurity, mathematical optimization, and dumb internet memes. She is an affiliate researcher at the MIT Media Lab and at the Vector Institute for Artificial Intelligence. She is a co-founder and co-organizer of the DEF CON AI Village, and loves all things to do with malicious uses and abuses of AI.
Twitter: @adversariel
Return to Index - Add to
- ics Calendar file
DC - Paris - Track 4 - Friday - 10:00-10:45
Duplicating Restricted Mechanical Keys
Friday at 10:00 in Track 4
45 minutes | Exploit
Bill Graydon President and Principal, Physical Security Analytics
Robert Graydon Principal, GGR Security
Secure facilities in North America use lock systems like Medeco, Abloy, Assa and Mul-T-Lock partly to resist lock picking, but also to prevent the duplication and creation of unauthorised keys. Places such as the White House and the Canadian Parliament buildings go so far as to use a key profile exclusive to that facility to ensure that no-one is able to obtain key blanks on which to make a copy. However, there are tens of thousands of unrestricted key blank profiles in existence - many match very closely to these restricted key blanks, and can be used instead of the real blanks to cut keys on. Moreover, keys are just pieces of metal - we will present numerous practical techniques to create restricted keys without authorisation - including new attacks on Medeco, Mul-T-Lock and Abloy key control systems. We will touch on all aspects of key control, including patents and interactive elements, and discuss how to defeat them and how facility managers can fight back against these attacks.
Bill Graydon
Bill Graydon is a principal at GGR Security Consultants, and is active in research in electronic surveillance and alarm systems, human psychology in a secure environment and locking systems analysis. He received a Masters in computer engineering and a certificate in forensic engineering from the University of Toronto, applying this at GGR to develop rigorous computational frameworks to model and improve security in the physical world.
Website: https://ggrsecurity.com/DEFCON
Robert Graydon
Robert is a principal at GGR security. With a strong interest driving him forward, he is researching lock manipulation, picking, bypass, and other vulnerabilities, to discover and evaluate possible flaws or methods of attack. He has well-honed skills such as lock picking, decoding, locksmithing, as well as a thorough understanding of the mechanics and function of many types of high security locks, and electronic security systems and components, allowing him to effectively search for and test methods of cracking high security systems.
Return to Index - Add to
- ics Calendar file
DL - Planet Hollywood - Sunset 1 - Friday - 12:00 - 13:50
EAPHammer
Friday from 12:00 – 13:50 in Sunset 1 at Planet Hollywood
Audience: Offensive security professionals, security analysts and network administrators, executive leadership, end-users
Gabriel Ryan
EAPHammer is a toolkit for performing targeted rogue access point attacks against enterprise wireless infrastructure. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus has been placed on providing an easy-to-use interface that can be leveraged to execute powerful wireless attacks with minimal manual configuration.
This summer will mark the third anniversary of EAPHammer since it was released at DEF CON Demo Labs and BlackHat Arsenal in 2017. It's also the most exciting and complete version of the tool yet, with the addition of a number of features that were requested directly by users at Demo Labs in 2018.
EAPHammer now supports most of the bleeding edge attacks that have been discovered by the wireless community over the past few years, including:
- WPA3 Transition Mode and Security Group Downgrade Attacks
- Reflection and Invalid Curve attacks against EAP-pwd
- GTC-Downgrade, Fixed Challenge, and EAP Relay attacks against WPA/2-EAP
- PMKID attacks against WPA/2-PSK networks
- Known Beacons Attack and Legacy SSL Support
- External Certificate Handling and Import
Perhaps most excitingly, we've also included some never-before-seen attacks against Opportunistic Wireless Encryption (OWE), which is better known as "Enhanced Open".
https://github.com/s0lst1ce/eaphammer
Gabriel Ryan
Gabriel Ryan is an offensive security R&D and consultant at SpecterOps. He is the author of EAPHammer, a toolkit for performing targeted rogue access point attacks against enterprise wireless networks. Gabriel has presented at DEF CON, DerbyCon, Hackfest, and several Security BSides conferences on topics ranging from infrastructure security to access control protocols and red team tradecraft. His professional interests include wireless security, systems internals, low-level programming, and infrastructure automation.
Return to Index - Add to
- ics Calendar file
HHV - Bally's Event Center - Friday - 15:00-15:50
Ebolaphone Or Bust
SciaticNerd
Abstract
We should all invest in being lifelong learners. That much is a given. When challenged to come up with something new for a boss’s Summer Project, I combined my love of hunting for hardware with some software learning to set up my own phone system. This kicked off an adventure in questing for hardware and figuring out how to set things up. Expect to hear about how to find things, how simple is sometimes better, and we’ll even risk a live demo of how to prep and get ready to deploy one of the phones!
Bio
SciaticNerd has been working in the field of Digital Identity since 2002, first as a trainer, then advancing to trusted and engineering roles. Along the way he’s connected with people in the computing community who have a passion for helping others to learn and grow. He speaks and volunteers at several conferences, coordinates the San Antonio, Texas BSides conference, and attends and contributes to local groups. He also promotes and discusses involvement with computing, security, privacy, technology related activities through podcasts like Security Endeavors, Hackers with Bourbon, Grumpy Hackers, DangerousMinds, and others.
Return to Index - Add to
- ics Calendar file
Meetups - Planet Hollywood - Mezzanine Stage - Friday - 17:00-18:59
Title:
EFF Trivia
No description available
Return to Index - Add to
- ics Calendar file
BHV - Planet Hollywood - Melrose 1-3 Rooms - Friday - 10:15-10:59
10:15 AM: Employ Cybersecurity Techniques Against the Threat of Medical Misinformation
Speaker: Eric D Perakslis
Abstract: Medical misinformation has been labeled as one of the greatest public health threats of our time. Previously eradicated diseases, such as measles are occurring in clusters and causing deaths. The problem is complex with a mixture of private individuals and nation state actors all working to undermine the credibility of doctors and the US health system. In this piece, I will discuss our JAMA piece that calls for the use of an ethical cyber response to the threat of medical misinformation.
Speaker Bio: Eric Perakslis, PhD, is a Rubenstein Fellow at Duke University, where he focuses on data science that spans medicine, policy, information technology, and security. Eric is also Lecturer in Biomedical Informatics at Harvard Medical School, and Strategic Innovation Advisor to Mdecins Sans Frontires.
T: @eperakslis
Return to Index - Add to
- ics Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Friday - 13:30-13:59
Title:
Enabling HTTPS for home network devices using Let's Encrypt - Karl Koscher
ABSTRACT
Let's Encrypt has enabled rapid adoption of TLS across the long-tail of public-facing services. Unfortunately, there are still challenges in deploying TLS on home network devices, such as routers, TV tuners, and IoT hubs. These devices are commonly accessed by their non-routable, dynamically-assigned IP address, preventing traditional domain-validated certificates from being used. This talk introduces a new DNS-based service that allows home network devices to automatically request certificates that can be used with non-routable IP addresses.
BIO
Karl Koscher is a research scientist working at the University of Washington where he specializes in wireless and embedded systems security. Previously, he was a postdoctoral scholar working with Stefan Savage at UC San Diego. He received his Ph.D. from the University of Washington in 2014, where he was advised by Tadayoshi Kohno.
Return to Index - Add to
- ics Calendar file
DC - Paris - Track 4 - Friday - 11:00-11:45
Evil eBPF In-Depth: Practical Abuses of an
In-Kernel Bytecode Runtime
Friday at 11:00 in Track 4
45 minutes | Demo, Exploit
Jeff Dileo Research Director, NCC Group
eBPF (or "extended" Berkeley Packet Filter) is a bytecode instruction set and virtual machine used as a safe computing environment within the Linux kernel to perform arbitrary programmatic actions. It is a redesign of Linux's original in-kernel BPF bytecode VM used to power features like tcpdump filters. eBPF has an entirely different set of capabilities and instructions, with its primary goal being to serve as a JIT-able virtual machine instruction set that can be targeted by compilers of a memory-safe "restricted C" language. In the Linux kernel, it is actively being applied to anything and everything to provide performant programmatic capabilities to userland that extend traditionally kernel-based functionality.
In this exploit development focused talk, we will first introduce eBPF and discuss several nefarious techniques enabled by the technology. As we do so, we will cover the respective sets of APIs, file descriptor types, and other eBPF machinery that enable such techniques, building up from various forms of hidden IPC channels to full-fledged rootkits. Within this talk, we will walk through the implementations of the techniques we discuss so that attendees will walk away with the knowledge of how to implement their own variants. Along the way we will discuss novel container breakout techniques and interesting "dual-purpose" eBPF features that enable the development of mutative syscall hooks that work for processes that work for processes already attached by a debugger. Finally, we will provide insight on how defenders should begin to attempt to detect and recover from such abuses, when possible at all.
This presentation significantly extends on work we first presented at 35C3, which focused more heavily on the underlying aspects of general eBPF-based kernel tracing. In contrast, this talk will demo new techniques and include substantially improved versions of techniques presented previously as proofs-of-concept.
Jeff Dileo
Jeff Dileo (chaosdata) is a security consultant by day, and sometimes by night. He hacks on embedded systems, mobile apps and devices, web apps, and complicated things that don't have names. He likes candy and arguing about text editors and window managers he doesn't actually use.
Twitter: @chaosdatumz
Return to Index - Add to
- ics Calendar file
WS - Flamingo - Lower Level - Red Rock I - Friday - 10:00-13:59
Evil Mainframe Jr: Mainframe hacking from recon to privesc
Friday, 1000-1400 in Flamingo, Red Rock I
Soldier of Fortran Hacker
Big Endian Smalls Director of North American Operations for RSM Partners
Mainframes power every industry you care about. Yet hackers have no idea how to even begin approaching this these big iron beasts. Where do you even start? VTAM? CICS? TSO? This workshop aims to give you the tools and language you can use to hack a mainframe. Starting with reconnaissance and ending with privilege escalation this workshop will walk you through all the tools and techniques you can use to hack a mainframe in 2019. Students will be introduced to the platform by being allowed to explore the operating system and allowing students to understand the weaknesses within. Students will also get introduced to open source tools and libraries available for all the steps of a penetration test including Nmap, metasploit, python scripts, REXX scripts and even HLASM. The majority of the workshop will be spent performing instructor led hands on mainframe testing with the tools available. Goals for each segment will be laid out with appropriate time afforded to students to allow them the ability to gain a deep understanding of how a test could and should be performed. Exercises will be based on real world attack scenarios developed by the trainers. This training specifically focuses on z/OS.
Skill Level Intermediate
Prerequisites: Background in penetration testing/red team and knowledge of tools like nmap, metasploit and scripting languages like Python/Ruby
Materials: Laptop capable of running a VM, power for their laptop.
Max students: 24
Registration: https://www.eventbrite.com/e/evil-mainframe-jr-mainframe-hacking-from-recon-to-privesc-red-rock-i-tickets-63439560433
(Opens 8-Jul-19)
Soldier of Fortran
Philip Young, aka Soldier of FORTRAN, is a leading expert in all things mainframe hacking. Having spoken and taught at conferences around the world, including DEFCON, RSA, BlackHat and keynoting at both SHARE and GSE Europe, he has established himself as the thought leader in mainframe penetration testing. Since 2013 Philip has released tools to aid in the testing of mainframe security and contributed to multiple opensource projects including Nmap, allowing those with little mainframe capabilities the chance to test their mainframes. His hope is that through raising awareness about mainframe security more organizations will take their risk profile seriously.
Big Endian Smalls
Chad Rikansrud, aka Big Endian Smalls, is the Director of North American Operations for RSM Partners - a world leader in IBM mainframe security consulting services. Chad is a nationally recognized security industry speaker, with appearances at: DEF CON, RSA2017, SHARE, and other regional conferences. Most of Chad's 20-year career has been in technology leadership for the financial services industry where he has held various senior leadership positions, including worldwide datacenter operations, infrastructure and recovery responsibility, as well as enterprise-wide system z storage
Return to Index - Add to
- ics Calendar file
DL - Planet Hollywood - Sunset 3 - Friday - 14:00 - 15:50
EXPLIoT - IoT Security Testing and Exploitation Framework
Friday from 14:00 – 15:50 in Sunset 3 at Planet Hollywood
Audience: Offense, Hardware, IoT, Pentesters
Aseem Jakhar & Murtuja Bharmal
EXPLIoT is a framework for security testing and exploiting IoT products and IoT infrastructure. Source code and documentation - https://gitlab.com/expliot_framework/expliot It provides a set of plugins (test cases) which are used to perform the assessment and can be extended easily with new ones. The name EXPLIoT (pronounced expl-aa-yo-tee) is a pun on the word exploit and explains the purpose of the framework i.e. IoT exploitation. It can be used as a standalone tool for IoT security testing and more interestingly, it provides building blocks for writing new plugins/exploits and other IoT security assessment test cases with ease. EXPLIoT supports most IoT communication protocols, hardware interfacing functionality and test cases that can be used from within the framework to quickly map and exploit an IoT product or IoT Infrastructure. It will help the security community in writing quick IoT test cases and exploits. Currently, the framework has support for analyzing and exploiting various IoT, radio and hardware protocols including BLE, CAN, DICOM, MQTT, Modbus, I2C, SPI, UART We have released a comprehensive documentation including User and Developer guide to help the security community kick start quickly and easily with the framework.
https://gitlab.com/expliot_framework/expliot
Aseem Jakhar
Aseem Jakhar is the Director, research at Payatu Software Labs https://payatu.com a security testing company specialized in IoT, Embedded, cloud, mobile security. He is the founder of null-The open security community, a registered not-for-profit organization https://null.co.in and also organizes https://nullcon.net and https://hardwear.io security conferences. He has worked on various security software including UTM appliances, messaging/security appliances, anti-spam engine, anti-virus software, bayesian engine to name a few. He currently spends his time researching on IoT security and hacking things. He is an active speaker and trainer at security conferences like AusCERT, Black Hat, Brucon, Defcon, Hack.lu, Hack in Paris, Hack In The Box, PHDays and many more. He has authored various open source security software including:
- EXPLIoT - IoT Exploitation Framework
- DIVA (Damn Insecure and Vulnerable App) for Android
- Jugaad/Indroid - Linux Thread injection kit for x86 and ARM
- Dexfuzzer - Dex file format fuzzer
Murtuja Bharmal
Murtuja Bharmal is an application and network security enthusiast, having 15+ years of industry experience on the offensive as well as the defensive side of security. He is the Co-Founder and Director at Payatu Software Labs, a security testing company specialized in IoT, Embedded, cloud, mobile security. He is also the Founder of null (The Open Security Community) - http://null.co.in, nullcon (International security conference) - http://nullcon.net and hardwear.io security conference - http://hardwear.io. He has worked extensively on network and web application security assessment and served various financial organizations in India, Middle East, South East Asia, and Europe in a personal and professional capacity. He is X-IBMer and has worked on IBM-ISS (Internet Security System) product as Senior System Engineer. He started his career as a security product developer and developed a UTM (Unified Threat Management) product with features such as Firewall, IPS, VPN, and Application Proxies.
Return to Index - Add to
- ics Calendar file
WS - Flamingo - Lower Level - Red Rock VII - Friday - 10:00-13:59
Exploit Development for Beginners
Friday, 1000-1400 in Flamingo, Red Rock VII
Sam Bowne Proprietor, Bowne Consulting
Elizabeth Biddlecome Senior Researcher, Bowne Consulting
Learn how to take control of Windows and Linux servers running vulnerable software, in a hands-on CTF-style workshop. We begin with easy command injections and SQL injections, and proceed through binary exploits incuding buffer overflows on the stack and the heap, format string vulnerabilities, and race conditions.
After this workshop, you will understand how memory is used by software, and why computers are so easily tricked into executing bytes as code that entered the system as data.
We will exploit 32-bit and 64-bit Intel systems, and also ARM-based systems. We will examine modern Windows defenses in detail and learn how to defeat them, including ASLR, DEP, stack cookies, and SEHOP.
Previous experience with C and assembly language is helpful but not required. Participants will need a laptop that can run VMware or VirtualBox virtual machines.
All materials and challenges are freely available at samsclass.info, and will remain available after the workshop ends.
Skill Level Intermediate
Prerequisites: Familiarity with C programming and assembly language is helpful, but not essential.
Materials: A laptop capable of running a virtual machine in VMware or VirtualBox.
Max students: 70
Registration: https://www.eventbrite.com/e/exploit-development-for-beginners-red-rock-vii-tickets-63608704347
(Opens 8-Jul-19)
Sam Bowne
Sam Bowne is the proprietor of Bowne Consulting and an instructor at City College San Francisco, and has been teaching hacking and security classes for ten years. He has presented talks and workshops at Defcon, HOPE, RSA, BSidesLV, BSidesSF, and many other conferences. He
has a CISSP and a PhD and is a DEF CON Black Badge co-winner.
Elizabeth Biddlecome
Elizabeth Biddlecome is a senior researcher at Bowne Consulting, an independent consultant, and a part-time instructor at City College San Francisco, delivering technical training and mentorship to students and professionals. She leverages her enthusiasm for architecture,
security, and code to design and implement comprehensive information security solutions for business needs. Elizabeth enjoys wielding
everything from soldering irons to scripting languages in cybersecurity competitions, hackathons, and CTFs.
Return to Index - Add to
- ics Calendar file
CLV - Flamingo 3rd Floor - Reno I Room - Friday - 13:00-13:40
Exploiting IAM in the Google Cloud Platform
Speaker: Colin Estep
Twitter: @colinestep
Abstract: Identity and Access Management (IAM) in any public cloud provider can be tricky to configure appropriately. We've all seen the headlines about storage buckets being open to the public and exposing sensitive information, but what about the permissions we are giving our users and apps that run in our cloud environment? It's becoming more difficult to understand who has permissions over resources and what the implications of those permissions are as more controls proliferate across the public cloud providers.
In this talk, we will take a closer look at the Google Cloud Platform (GCP) IAM model. You'll be introduced to the relevant concepts to understand the different types of identities, IAM permissions, and scopes. We'll examine the permissions and scopes assigned to the compute engine service account created for you by default. Did you know that the default IAM policy for the compute engine service account includes the ability to impersonate other service accounts, among other things?
Most importantly, we'll learn how to leverage certain configurations of the service account to escalate privileges from a virtual machine. I will show a demo where I use a shell on a virtual machine to tear down another security control to allow data exfiltration out of the environment. By the end of the talk, you'll understand how to impersonate service accounts, conduct recon, and escalate your privileges from a virtual machine. You'll also get some ideas on how to mitigate against these attacks.
About Colin: Currently a threat researcher at Netskope focused on AWS and GCP. Colin was previously the CSO at Sift Security (acquired by Netskope), where he helped move the product towards breach detection for IaaS. He was a senior engineer on the security teams at Netflix and Apple before joining Sift. He was also a FBI Agent specializing in Cyber crime, where he spent a fair amount of time coordinating with other countries to locate and arrest malware authors and botnet operators.
Return to Index - Add to
- ics Calendar file
AIV - Bally's Resort (Indigo) Tower 26th Floor - Skyview Room 3 - end - Friday - 11:15-11:59
Exploratory Data Analysis: Why and How (in Python)
No description available
Return to Index - Add to
- ics Calendar file
AIV - Bally's Resort (Indigo) Tower 26th Floor - Skyview Room 3 - end - Friday - 13:30-14:15
Fighting Malware with Deep Learning
No description available
Return to Index - Add to
- ics Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Friday - 12:00-12:59
Title:
Fighting non consensual pornography the BADASS way - Katelyn Bowden
ABSTRACT
The BADASS army is an organization that started with one woman in Ohio, and within two years has helped thousands of people get their private images removed from unauthorized websites, helped pass laws criminalizing revenge porn, and teach victims the necessary tech skills to protect their private pictures and videos. Katelyn Bowden has brought this fight to a global level, and is here to talk about battling revenge porn the BADASS way. We will be discussing privacy laws, sensitive media storage, and safe sexting, along with the methodology of image abuse perpetrators.
BIO
Katelyn is the founder and CEO of BADASS- a nonprofit dedicated to fighting image based abuse online. Since starting the organization in 2017, BADASS has helped thousands victims of Non Consensual Pornography remove their photos and protect themselves, worked with platforms to prevent private images from being uploaded, and assisted in getting several statewide revenge porn laws put into place.
Return to Index - Add to
- ics Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 17:30-17:59
17:30-18:00
Film – Kung Fury
Kung Fury is a crowdfunded 2015 English-language Swedish martial arts action comedy short film written and directed by David Sandberg. It pays homage to 1980s martial arts and police action films.
8.0/10 IMDB, 4.7/5 Amazon.
Return to Index - Add to
- ics Calendar file
WS - Flamingo - Lower Level - Red Rock IV - Friday - 10:00-13:59
Finding Vulnerabilities at Ecosystem-Scale
Friday, 1000-1400 in Flamingo, Red Rock IV
Isaac Evans Hacker
r2c is writing and helping others write tools to exploit and eradicate entire vulnerability classes at scale. In this workshop, we'll show how to develop program analysis tools that can be depended on in analysis pipelines and quickly run at massive scale. If you've ever wondered "but surely, no programmer would upload something that does that do NPM" this is the place to be! Our command line tool for local analyzer development is freely available and publicly documented—we'll show you how to get started and invite you to collaborate with us on to build pipelines that use pre-computed intermediary representations that we already have. We'll also show how to use our collaborative triage tools with impact prioritization that can quickly allow turning these analysis results into bug-bounty submissions. No program (static/dynamic) analysis background required (though it is helpful!) Motivated developers should be able to make at least one bug bounty submission by the end of the workshop.
Skill Level Intermediate
Prerequisites: Basic programming knowledge (what is a function call?), able to run docker hello-world as user, able to write and run small programs, very comfortable with command line interfaces
Materials: Laptop with network access, OSX or Linux available (Windows ok with WSL installed)
Max students: 80
Registration: https://www.eventbrite.com/e/finding-vulnerabilities-at-ecosystem-scale-red-rock-iv-tickets-63608247982
(Opens 8-Jul-19)
Isaac Evans
Isaac Evans is the leader of a small startup working on giving security tools directly to developers. Previously, he conducted research into binary exploitation bypasses for techniques like control-flow integrity and novel hardware defenses on new architectures like RISC-V as a researcher at the US Defense Department under a SFS program and at MIT Lincoln Laboratory. Isaac received his BS/MS degrees in EECS from MIT. Other interests include next-generation programming languages, secure-by-design frameworks, software-defined radio, and the intersection of cryptography and public policy.
Return to Index - Add to
- ics Calendar file
HTS - Bally's Event Center - Friday - 13:30-14:15
Firmware Rewriting to Gain Persistence on Satcom Terminal
No description available
Return to Index - Add to
- ics Calendar file
DL - Planet Hollywood - Sunset 4 - Friday - 12:00 - 13:50
Flatline
Friday from 12:00 – 13:50 in Sunset 4 at Planet Hollywood
Audience: Hardware and OpSec.
East
Flatline is a deterministic hardware credential manager. It can generate passwords, burner accounts, shortlinks, and BIP39 seeds. Based on a single mnemonic seed, with Flatline it is possible to store millions of dollars in cryptocurrency, and shortlinks that map to sensitive or stolen data. Store a criminal empire in your head, maintain a map of leaked documents that are hosted on the internet while storing nothing on your local disk, or maintain access to your assets when your house burns down and you have to flee to eastern Europe.
https://gitlab.com/e4st/flatline
East
East is a professional megalomaniac and dedicated troll. He lives in an underground bunker on an island in the south Pacific, where he spends his days eating Doritos, playing Counter Strike, and plotting world domination. When he is not busy destabilizing foreign governments, his hobbies include trolling phone scammers, hang gliding, and golf.
Return to Index - Add to
- ics Calendar file
Night Life - Planet Hollywood - Apex Suite - Friday - 21:00-25:59
Title:
Florida Man Party
Florida Man Party
Return to Index - Add to
- ics Calendar file
BCV - Flamingo 3rd Floor - Laughlin III Room - Friday - 13:30-14:20
Forcing a trustworthy notion of sequential time
No description available
Return to Index - Add to
- ics Calendar file
Meetups - Planet Hollywood - Santa Monica 4 Room - Friday - 12:00-12:59
Title:
Friends of Bill W.
For all those Friends of Bill W. looking for a meeting or just a quiet moment to regroup, we have you covered with meetings throughout #DEFCON - Noon & 5pm Thurs-Sat, Noon Sun. The location is SANTA MONICA 4 in Planet Hollywood.
Return to Index - Add to
- ics Calendar file
Meetups - Planet Hollywood - Santa Monica 4 Room - Friday - 17:00-17:59
Title:
Friends of Bill W.
For all those Friends of Bill W. looking for a meeting or just a quiet moment to regroup, we have you covered with meetings throughout #DEFCON - Noon & 5pm Thurs-Sat, Noon Sun. The location is SANTA MONICA 4 in Planet Hollywood.
Return to Index - Add to
- ics Calendar file
BHV - Planet Hollywood - Melrose 1-3 Rooms - Friday - 11:00-11:45
11:00 AM: From buffer overflowing genomics tools to securing biomedical file formats
Speaker: Corey M. Hudson
Abstract: In this presentation we describe a previously unreported buffer overflow vulnerability in popular genomics alignment software package BWA. We will show how this exploit, combined with well-known attacks allows an attacker to access and modify patient data and manipulate genomic tests. We then show how this class of attacks constitutes a wider threat to global biomedical infrastructure and what a newly-formed team from Sandia National Labs, BioBright (private sector) & DARPA are doing about it.
Speaker Bio: Corey Hudson is a computational biologist at Sandia National Laboratories. Corey leads teams in cybersecurity, machine learning, synthbio and genomics. His main work is modeling and simulating cybersecurity risks in realistic and large-scale genomic systems and highly automated synthbio facilities.
T: @coreymhudson
Return to Index - Add to
- ics Calendar file
IOT - Flamingo 3rd Floor - Eldorado Ballroom - Friday - 14:15-14:59
"Never, ever claim your smart product is unhackable. Don't snort bath salts either. The Bitfi is/was a hardware brain-wallet for crypto currency. John McAfee was probably paid to promote it & wisely identified that it was unhackable.
@cybergibbons gathered a crack team of hardware and software researchers from across the world, including several of the team at PTP. Over a 2 week period they utterly ruined the Bitfi. A lot of this story is untold, particularly around the real-time disclosure and back-end coordination. We'll also look at what they could have done to improve their security & a quick look at the Bitfi 2.0 if it gets to market in time!
Since then, we've encountered and ruined many more products that made unhackable claims. We'll demo those too."
Bios:
Ken Munro, Lobbyist for IoT regulation, responsible disclosure chess-master. Speaker at BSides, OWASP, Defcon, BlackHat etc
Andrew Tierney, @cybergibbons That hardware guru who did the first PoC ransomware on IoT, discovered flaws in Z-Wave & pwned an entire fleet of ships. IoT destroyer par excellence
Return to Index - Add to
- ics Calendar file
RCV - Planet Hollywood - Celebrity 5 Ballroom - Friday - 16:30-16:59
Return to Index - Add to
- ics Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Friday - 10:30-10:59
Title:
Giving Cops the Finger: Compelled Device Decryption and the Fifth Amendment - Riana Pfefferkorn (Not Recorded)
ABSTRACT
You can unlock your smartphone with a passcode, your finger, even your face. When the cops demand you decrypt your phone or other device for them, can you successfully invoke your Fifth Amendment right against self-incrimination? Well, it depends. This talk quickly walks through the when, where, why, and how of compelled decryption and the Fifth Amendment under current case law. It ends with some practical takeaways, including "don't talk to the cops" and "stay out of Florida."
BIO
Riana Pfefferkorn is the Associate Director of Surveillance and Cybersecurity at the Stanford Center for Internet and Society. Her work focuses on investigating and analyzing the U.S. government's policy and practices for forcing decryption and/or influencing crypto-related design of online platforms and services, devices, and products, both via technical means and through the courts and legislatures.
Return to Index - Add to
- ics Calendar file
HTS - Bally's Event Center - Friday - 15:30-15:59
GMDSS including Automated Identification System (presentation on AIS; not the same as his talk on Sunday, which is an offensive security talk)
No description available
Return to Index - Add to
- ics Calendar file
DL - Planet Hollywood - Sunset 5 - Friday - 10:00 - 11:50
Hachi: An Intelligent threat mapper
Friday from 10:00 – 11:50 in Sunset 5 at Planet Hollywood
Audience: Defense, Malware, Threat Intelligence
Parmanand Mishra
ATT&CK framework has become a benchmark in the security domain. ATT&CK provides data about each technique used across different attack stages. Hachi was created to contribute to the ATT&CK community. Hachi is based on the radare2 framework and uses data provided by ATT&CK to map the symptoms of malware on ATT&CK matrix.
Following modules of Hachi make this tool a great addition to an analyst’s or company’s armaments:
• Threat Intel: Hachi provides threat intelligence data like a possible parent campaign or author of a malware file.
• Malware behavior: It uncovers core malware behaviors using automated static analysis coupled with symbolic execution to explore multiple execution paths and maps it on ATT&CK matrix.
• RESTful API: Hachi provides RESTful API which enables this tool to seamlessly integration with malware processing frameworks.
• Visualization: It allows for the creation of detailed visual reports.
• Integration with Threat Intel feeds: It can be integrated with different threat intelligence feeds for enhanced security or expanded insights.
The primary aim of this tool is to act as a force multiplier for the InfoSec community and aid the analysis of malware.
https://github.com/Kart1keya/Hachi
Parmanand Mishra
Parmanand Mishra is a security enthusiast who is currently working as Senior Malware Researcher at Qualys Inc. He works on malware analysis and adversary simulation based on ATT&CK and loves creating tools on the same. He has spoken at security conferences like c0c0n and goes by Kart1keya on GitHub.
Return to Index - Add to
- ics Calendar file
RCV - Planet Hollywood - Celebrity 5 Ballroom - Friday - 15:40-16:30
Return to Index - Add to
- ics Calendar file
Night Life - Planet Hollywood - Mezzanine Stage - Friday - 20:00-21:59
Title:
Hacker Jeopardy
No description available
Return to Index - Add to
- ics Calendar file
Night Life - Paris - Concorde C Ballroom - Friday - 19:30-25:59
Title:
Hacker Karaoke
Two great things that go great together! Join the fun as your fellow hackers make their way through songs from every era and style. Everyone has a voice and this is your opportunity to show it off! Quickly becoming a DEF CON tradition and a favorite of people from all skill levels.
Return to Index - Add to
- ics Calendar file
Meetups - Paris - Le Bar Du Sport Bar - Friday - 18:30-17:59
Title:
Hackers Against Brexit
Hi everyone.
We will once again be meeting for drinks at DEFCON. Everyone is welcome (yes, even if you voted for Brexit :D ). Details as follows:
Time: 6:30PM Date: Fri. 9th Aug Location: Le Bar Du Sport @ Paris Casino.
Mon Ami Gabi is right next door as well if you fancy grabbing a bite to eat before/after/during the meetup.
Safe travels to everyone joining us.
Oh and p.s. we will have badges this year, they will be going on a first come first served basis at 15/$20 each :-).
Forum
Return to Index - Add to
- ics Calendar file
CHV - Bally's Event Center - Saturday - 10:30-10:25
Hacking Android and qnx (What treasures lie inside your radio)
Neiko Rivera
Sat 8/10 •
10:30 AM-10:25 AM
25 min talk
Showing the inside of QNX and Android with a high overview of each system and there unique attributes. Finding common misconfigurations in Android systems, while also showing people how to extract and begin the process to reverse engineer (but no in depth reversing of apks).
Hardware hacking on systems to gain escalated privileges to obtain initial foothold on device and begin reverse engineering from there!
Return to Index - Add to
- ics Calendar file
DC - Paris - Track 2 - Friday - 10:00-10:45
Hacking Congress: The Enemy Of My Enemy Is My Friend
Friday at 10:00 in Track 2
45 minutes
Former Rep. Jane Harman President, The Wilson Center, Former Rep. (D-CA), aka Surfer Jane
Rep. James Langevin (D-RI)
Jen Ellis Director of Public Affairs, Rapid 7
Cris Thomas Director, X-Force Red Team, IBM, aka Space Rogue
Rep. Ted Lieu (D-CA)
A SIMULATED crisis is unfolding on a national scale, based loosely on the NotPetya attack of 2017. Triggered by a yet-unknown adversary, what started as a an isolated technical issue has quickly escalated into a society-wide event affecting millions of citizens, several industries, and spanning government jurisdictions. Who is in charge, how do they cooperate with others, and how do they make decisions? The Wilson Center, Hewlett Foundation and I Am The Calvary are teaming up to bring public policymakers together with security researchers and others to discover how our nation might respond to a wide-scale “cyber crisis”. Work in tandem with sitting Members of Congress to understand what levers of power Congress yields and how Members can address policy gaps in the future.
Former Rep. Jane Harman
The Hon. Jane Harman is President of the Wilson Center, a think tank in Washington, DC. She is a former nine-term Member of Congress who served on all the major security committees and represented an aerospace and technology hub in Southern California.
Twitter: @thewilsoncenter
Website:
https://www.wilsoncenter.org/person/jane-harman
Rep. James Langevin
The Hon. Jim Langevin represents Rhode Island's 2nd Congressional district. He is Chairman of the Emerging Threats and Capabilities Subcommittee and a senior member of the Cybersecurity and Infrastructure Protection Subcommittee. Rep. Langevin is a member of the House Majority Whip Steny Hoyer's Senior Whip Team, and is responsible for educating other Democratic Members on key issues.
Twitter: @jimlangevin
Website:
https://langevin.house.gov/about-me/full-biography
Jen Ellis
Jen Ellis is the Vice Preident of Community and Public Affairs at Rapid7. She works directly with security researchers, technology providers and operators, and government entities to help them understand and address cybersecurity challenges together.
Twitter: @infosecjen
Website: https://blog.rapid7.com/author/jen-ellis/
Cris Thomas
Cris Thomas works for IBM X-Force Red, and before that worked at Guardent, Trustwave, Tenable and others. Cris created the first security research think tank L0pht Heavy Industries and the video news show The Hacker News Network.
Twitter: @spacerog
Website: https://securityintelligence.com/author/cris-thomas/
Return to Index - Add to
- ics Calendar file
BCV - Flamingo 3rd Floor - Laughlin III Room - Friday - 12:00-12:25
Hacking Cryptocurrencies
No description available
Return to Index - Add to
- ics Calendar file
WS - Flamingo - Lower Level - Red Rock V - Friday - 10:00-13:59
Hacking ICS: From Open Source Tools to Custom Scripts
Friday, 1000-1400 in Flamingo, Red Rock V
Valerie Thomas Technical Lead, Securicon
Harry Regan Technical Lead, Securicon
Harry Thomas Technical Lead, Securicon
Recently, Industrial Control System (ICS) attacks have gained popularity in the media. However there are many misconceptions on what exactly ICS systems are and how they function. Although there are similarities to IT systems, there are a multitude of differences that an attacker needs to understand in order to properly assess this type of equipment. In this course, students will be introduced to what ICS is and isn't in terms of technology and functionality. Protocols such as Ethernet/IP, Modbus, and DNP3 will be discussed and illustrated in order for students to have a foundation to build their arsenal. Students will then explore openly available open source tools and examine the functionality of the protocols. After dissection of protocol commands and activities, the students will be led to create their own custom scripts that interact with ICS devices in the classroom.
Skill Level Beginner
Prerequisites: An understanding of basic networking concepts.
Materials: For those who want to participate in the hands-on portion of the workshop, a laptop with Kali Linux installed on the host or as a virtual machine.
Max students: 50
Registration: https://www.eventbrite.com/e/hacking-ics-from-open-source-tools-to-custom-scripts-red-rock-v-tickets-63608296126
(Opens 8-Jul-19)
Valerie Thomas
Valerie Thomas is the Technical Director and utilizes her Electrical Engineering education and security consulting background to incorporate a variety of evaluation techniques specific to ICS.
Harry Regan
Harry Regan serves as the Vice President of Consulting Services and has over 40 years of experience in IT and ICS security environments.
Harry Thomas
Harry Thomas is the Lead ICS Security Consultant and performs risk, vulnerability, and penetration tests and assessments for a multitude of ICS organizations. He's developed countless IT and ICS indicators of compromise to help protect the ICS industries against threats. He utilized both offensive and defensive skills to create, design, and implement safe ICS security practices.
Return to Index - Add to
- ics Calendar file
CHV - Bally's Event Center - Friday - 13:00-13:50
Hacking into automotive clouds
Rotem Bar
fri 8/09 •
1:00 PM-01:50 PM
50 min talk
In this talk Rotem will share my experience about how he hacked different automotive clouds, techniques he used and goals pursued after connecting.
Rotem will talk about the main connectivity areas he looks for, supplier integrations and differences between normal clouds and automotive clouds. Once Rotem got a good foothold, Possible targets and places which can harm the most. Where can to jump next inside and how deep the rabbit hole goes.
In this talk Rotem will give real life examples of:
-
From zero to hero – Full backend control with examples
-
Common fails which allow me to jump between networks
-
Dangers of connected cars - Taking over a car from the cloud
-
How to break a production line
-
Cloud credentials leakage
Return to Index - Add to
- ics Calendar file
PHVW - Bally's Resort (Indigo) Tower 26th floor - Friday - 14:30-16:30
Hacking Kubernetes - Choose Your Own Adventure Style
Jay Beale, CTO of InGuardians
Kubernetes continues to gain steam, as developers build microservice-based applications and everyone moves to the software-defined data center. A small minority of our Infosec industry has experience attacking container orchestration systems like Kubernetes. We aim to address that shortage, culminating in an audience-directed Choose Your Own Adventure, "Hackers" movie-themed demo. In this demo-heavy talk, we will show you how to attack Kubernetes clusters and discuss what hardening techniques and freely available tools can break those attacks. We'll review the components of a Kubernetes cluster, then show how a threat actor can chain configuration vulnerabilities to pivot and escalate privilege, pilfer data and take over clusters and the cloud environments on which they run. To be clear, you'll see multiple attacks against real clusters from start to finish. You will also gain exposure to a new open source tool attack tool for Kubernetes called Peirates, available on Github. You will leave this talk with exposure to attacks against clusters that organizations have built themselves, as well as clusters provided by the major cloud providers, like AWS, Azure and GCP. You will be able to repeat specific attacks and know what defenses can break those attacks.
Jay Beale (Twitter: @jaybeale) works on Kubernetes and cloud native security, as a professional threat actor, a Kubernetes Contributor and as a member of the Kubernetes Security Audit working group. He's the architect and a developer on the Peirates attack tool for Kubernetes. In the past, Jay created two tools used by hundreds of thousands of individuals, companies and governments, Bastille Linux and the Center for Internet Security's first Linux/UNIX scoring tool. He has led training classes on Linux security and Kuberntes at the Black Hat, CanSecWest, RSA, and IDG conferences, as well as in private corporate training, since 2000. As an author, series editor and speaker, Jay has contributed to nine books and two columns and given over one hundred public talks. He is CTO of the information security consulting company InGuardians.
Return to Index - Add to
- ics Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Friday - 11:00-11:59
Hacking Kubernetes: Choose Your Own Adventure Style
Jay Beale, CTO of InGuardians
Many companies have deployed Kubernetes, but few infosec folks have experience attacking it. We aim to address that shortage, culminating in an audience-directed Choose Your Own Adventure, movie-themed demo against an intentionally-vulnerable cluster named Bust-a-Kube. You'll see how to attack Kubernetes clusters and learn what hardening techniques and freely available tools can break those attacks. We'll review the components of a Kubernetes cluster, then show how a threat actor can chain configuration vulnerabilities to pivot and escalate privilege, pilfer data and take over clusters. You will also gain exposure to a new open source Kubernetes attack tool called Peirates.
Jay Beale (Twitter: @jaybeale) works on Kubernetes and cloud native security, as a professional threat actor, a Kubernetes Contributor and as a member of the Kubernetes Security Audit working group. He's the architect and a developer on the Peirates attack tool for Kubernetes. In the past, Jay created two tools used by hundreds of thousands of individuals, companies and governments, Bastille Linux and the Center for Internet Security's first Linux/UNIX scoring tool. He has led training classes on Linux security and Kuberntes at the Black Hat, CanSecWest, RSA, and IDG conferences, as well as in private corporate training, since 2000. As an author, series editor and speaker, Jay has contributed to nine books and two columns and given over one hundred public talks. He is CTO of the information security consulting company InGuardians.
Return to Index - Add to
- ics Calendar file
AVV - Bally's Event Center - Friday - 14:00-14:30
Speaker – Dr. Will Roper and Jack Cable
Synopsis
Two years ago, the U.S Air Force opened its doors to hackers with the launch of the Hack the Air Force challenge. Since then, the Air Force has run numerous other bug bounty challenges, ranging from logistics sites to custom hardware and engaging thousands of hackers along the way. Hear from Assistant Secretary of the Air Force Dr. Will Roper and Defense Digital Service hacker Jack Cable on the Air Force’s engagement of hackers via bug bounties and future initiatives in aviation security. In this open discussion, we encourage attendees to share their thoughts on how the Air Force can continue to work with the security community to improve the state of aviation security.
About the Speakers
Dr. Will Roper, Assistant Secretary of the Air Force for Acquisition, Technology and Logistics.
Will Roper is a rare U.S. government specimen who is not just thinking about the future of warfare; he’s hacking the bureaucracy to make it happen. As the founder of the Strategic Capabilities Office, a vanguard defense agency that prides itself on breaking down tech, he introduced the Pentagon to new concepts such as smart-phone navigating weapons, big-data-enabled sensing, fighter avatars and swarming micro-drones. Roper currently oversees development and production for all Air Force air and spacecraft, weapons, and software programs. In this role, he’s challenging the system to seriously face cyber vulnerabilities and take realistic action.
Jack Cable is a coder turned white hat hacker and a rising sophomore at Stanford University. Jack is a top ranked hacker on the HackerOne bug bounty platform, having identified over 350 vulnerabilities in companies including Google, Facebook, Uber, Yahoo, and the U.S. Department of Defense. After placing first in the Hack the Air Force challenge, Jack began working this past summer at the Pentagon’s Defense Digital Service. There, Jack helped organize the Hack the Marine Corps competition held live in Las Vegas and advises policymakers on vulnerability disclosure. Jack was named one of Time Magazine’s 25 most influential teens for 2018. At Stanford, Jack studies computer science and launched Stanford’s bug bounty program, one of the first in higher education.
Return to Index - Add to
- ics Calendar file
BHV - Planet Hollywood - Melrose 1-3 Rooms - Friday - 16:15-16:59
4:15 PM: Hacking Wetware with Open Source Software and Hardware: The DIY Artificial Pancreas
Speaker: Jay Lagorio
Abstract: Managing diabetes revolves around stagnated tech from the 80s and 90s. Hackers took their lives into their hands by augmenting inadequate products after market. Building iterations of a DIY artificial pancreas and real-life examples of will be discussed and at least one will be working on the presenter. Replacing human intervention with technology betters quality of life. See what happens when hackers decide theyre not waiting around for government and the MedTech industry to do better.
Speaker Bio: Jay Lagorio, a software engineer and independent security researcher, has been building computers and networks and writing code nearly his entire life. He received a B.S. in Computer Science from UMBC in 2008 and an M. Eng. from the Naval Postgraduate School in 2015.
T: @jaylagorio
Return to Index - Add to
- ics Calendar file
DC - Paris - Track 1 - Friday - 13:00-13:45
HackPac: Hacking Pointer Authentication in iOS User Space
Friday at 13:00 in Track 1
45 minutes | Demo, Tool, Exploit
Xiaolong Bai
Min (Spark) Zheng
Pointer Authentication (in short, PAuth) is the latest security mechanism in iOS. It is proposed to protect the integrity of pointers with hardware-assisted encryption, thus eliminating the threats of code-reuse attacks. In PAuth, a cryptographic signature called PAC is calculated from a pointer value and inserted into the pointer. When the pointer is about to be used, the PAC is extracted and verified whether it is consistent with the original pointer value. In this way, PAuth is able to ensure that the pointers are not tampered. iOS deployed PAuth in user-space system services, protecting pointers that may affect the control flow and preventing code-reuse attacks like ROP and JOP.
However, in our study, we found that a fatal flaw in the implementation of iOS PAuth makes user-space system services till vulnerable to code-reuse attacks. The flaw is: iOS uses the same signing key in different user-space processes. This flaw allows a signed pointer from a malicious process can be correctly verified in a system service, thus making it possible to launch JOP. In this talk, we will explain how we found the flaw and why it is inevitable. In advance, we will demonstrate how to leverage this flaw and launch JOP attacks in a PAuth-protected system service. Also, we will propose a new tool, PAC-gadget, to automatically find JOP gadgets in PAuth-protected binaries.
Xiaolong Bai
Xiaolong Bai (twitter@bxl1989, github@bxl1989) is a security engineer in Alibaba Orion Security Lab. Before joining Alibaba, he received his Ph.D. degree in Tsinghua University. He has published several research papers on top conferences including IEEE S&P, Usenix Security, CCS, NDSS, and presented his research in Black Hat, DEF CON, HITB, CanSecWest, etc. He has been acknowledged by famous vendors, including Apple, Google, Facebook, Evernote, and Tencent for his contribution in discovering the vulnerabilities in their systems and improving the security of their products. He is a member of the OverSky team for private jailbreaking development.
Twitter: @bxl1989
Website: https://xiaolongbai.weebly.com/
Github: https://github.com/bxl1989/
Min (Spark) Zheng
Min (Spark) Zheng (twitter@SparkZheng, github@zhengmin1989) is a security expert in Alibaba Orion Security Lab. He received his Ph.D. degree in the CSE department of the CUHK. His research focuses on malware analysis, smartphone (Android & iOS) security, system design and implementation. Before receiving Alibaba A-Star offer award in 2015, he worked in FireEye, Baidu and Tencent. He was the champion of GeekPwn 2014 and AliCTF 2015. He won the “best security researcher” award in FIT 2016 for detecting the iOS/macOS vulnerabilities, XcodeGhost virus and WormHole RCE vulnerability. He is a member of the OverSky team for private jailbreaking development. He presented his research in DEF CON, HITB, BlackHat, RUXCON, etc.
Twitter: @SparkZheng
Return to Index - Add to
- ics Calendar file
WS - Flamingo - Lower Level - Red Rock VI - Friday - 10:00-13:59
Hands on Adversarial Machine Learning
Friday, 1000-1400 in Flamingo, Red Rock VI
Yacin Nadji Engineer, Security Scorecard
Machine learning has become commonplace in software engineering and will continue to grow in importance. Currently, most work focuses on improving classifier accuracy. However, as more and more models interact with the real world, practitioners must consider how resilient their models are against adversarial manipulation. Successful attacks can have serious implications, like crashing a car, misclassifying malicious code, or enabling fraud.
In this workshop, you will learn how to think like an adversary so that you can build more resilient machine learning systems. You'll discover how to use free and open source tools to construct attacks against and defenses for machine learning models, as well as how to holistically identify potential points of attack an adversary could exploit. You'll leave able to critically examine a machine learning system for weaknesses, mount attacks to surface problems, and implement and evaluate practical defenses.
Skill Level Intermediate
Prerequisites: Familiarity with Python (or similar programming language) and basic Machine Learning. For the latter, students that have preprocessed data and trained & evaluated a model will be in good shape to tackle the material.
Materials: Laptop capable of running Docker or Jupyter notebooks.
Max students: 70
Registration: https://www.eventbrite.com/e/hands-on-adversarial-machine-learning-red-rock-vi-tickets-63608585993
(Opens 8-Jul-19)
Yacin Nadji
Yacin Nadji is an engineer at Security Scorecard where he applies machine learning to identify companies' infrastructure and understand their security risk. He received his Ph.D. from the School of Computer Science at Georgia Institute of Technology with a focus in Computer Security. He has published 20 academic papers with hundreds of citations, many focused on applying ML to solve security problems.
Return to Index - Add to
- ics Calendar file
DC - Paris - Track 1 - Friday - 14:00-14:45
Harnessing Weapons of Mac Destruction
Friday at 14:00 in Track 1
45 minutes | Demo, Exploit
Patrick Wardle Chief Research Officer, Digita Security
Whenever a new Mac malware specimen is uncovered, it provides a unique insight into the offensive Mac capabilities of hackers or nation-state adversaries. Better yet, such discoveries provide fully-functional capabilities that may be weaponized for our own surreptitious purposes! I mean, life is short, why write your own?
We'll begin this talk by discussing the methodology of subverting existing malware for "personal use", highlighting both the challenges and benefits of such an approach.
Next, we'll walk-thru the weaponization of various Mac malware specimens, including an interactive backdoor, a file-exfiltration implant, ransomware, and yes, even adware. Customizations include various runtime binary modifications that will coerce such malware to accept tasking from our own C&C servers, and/or automatically perform actions on our behalf.
Of course, in their pristine state, such samples are currently detected by AV products. As such we'll also walk-thru subtle modifications that will ensure our modified tools remains undetected by traditional detection approaches.
In conclusion, we'll highlight novel heuristic methods that can generically detect such threats to ensure Mac users remain protected even from such weaponized threats.
Patrick Wardle
Patrick Wardle is the Chief Research Officer at Digita Security and founder of Objective-See. Having worked at NASA and the NSA, as well as presented at countless security conferences, he is intimately familiar with aliens, spies, and talking nerdy. Patrick is passionate about all things related to macOS security and thus spends his days finding Apple 0days, analyzing macOS malware and writing free open-source security tools to protect Mac users.
http://twitch.com/patrickwardle
Return to Index - Add to
- ics Calendar file
LPV - Bally's - Platinum II Ballroom - Friday - 13:00-13:59
Title:
History of Lockpicking
Presented By
Matt Ploessel
Abstract
[coming soon]
Return to Index - Add to
- ics Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 11:45-12:15
11:45-12:15
Houston, we have a problem: 86(R) H.B. 4371 is a no-go!
A.J. Santos, Assistant Professor, Ankara Yildirim Beyazit University, Faculty of Law
A Texas bill has been introduced that encourages the use of what is termed a “verified identity digital currency,” which is a currency that allows the true identities of the sender and the receiver to be known. In addition, the bill mandates the verification of senders’ identity when receiving funds from a non-verified currency. This talk will consider the meaning of “digital currency” with reference to Federal and State agency interpretations and relevant case law and then evaluate the potential impact of the bill on small businesses and the public at large.
Return to Index - Add to
- ics Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Friday - 17:00-17:59
Title:
How PKI and SHAKEN/STIR Will Fix the Global Robocall Problem - Mark B Cooper
ABSTRACT
There is a new ecosystem underway that will impact everyone, especially the irritated people in the U.S. who have received more than 48 billion robocalls last year. This new ecosystem will hopefully put an end to these annoying and fraudulent robocalls calls, which the Federal Communications Commission (FCC) estimates will constitute more than half of all phone calls placed in the U.S. this year. The FCC and major telecommunications companies including Comcast, AT&T, and T-Mobile are behind a new, global technology standard called SHAKEN/STIR (Signature-based Handling of Asserted Information using ToKENs and Secure Telephony Identity Revisited) to combat robocalls and caller ID spoofing. This new standard addresses the issue of commercial robocallers who are impersonating other callers and committing fraud via Caller ID.
Public key infrastructure (PKI) is the backbone of the SHAKEN/STIR global technology standard. In order for the entire ecosystem to work, it needs to be created with a trusted PKI system as the base, using digital signatures in every single call, which are verified and authenticated. SHAKEN/STIR uses digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure. The way it works is each telephone service provider obtains its digital certificate from a certificate authority that is trusted by other telephone service providers. The certificate technology enables the called party to verify that the calling number is accurate and has not been spoofed. In order to build this new ecosystem to facilitate stronger identities for each and every call generated, an effective PKI ecosystem must be implemented. Strong identities and controls will be needed to ensure call identities are trusted globally. PKI is the technology that will be used to identify and verify each phone call. SHAKEN/STIR will shift the identity details from the call originator to the trusted telephone company routing the call.
The industry technology infrastructure, telecommunications, and government entities needs to work together on a solution that will reduce fraud and put an end to robocalls. As this technology standard evolves and deployed, it is important to identify the security risks telecommunications companies will face and how enterprises can benefit from this work. Security will be required at every level of SHAKEN/STIR implementation.
BIO
Mark B. Cooper is president and founder of PKI Solutions. He has deep knowledge in all things Public Key Infrastructure (PKI) and has been known as The PKI Guy since his early days at Microsoft. PKI Solutions Inc. provides consulting, training and software solutions for Microsoft PKI and related technologies for enterprises around the world. Prior to founding PKI Solutions, Cooper was a senior engineer at Microsoft, where he was a PKI and identity management subject matter expert who designed, implemented and supported Active Directory Certificate Services (ADCS) environments for Microsofts largest customers.
Return to Index - Add to
- ics Calendar file
AIV - Bally's Resort (Indigo) Tower 26th Floor - Skyview Room 3 - end - Friday - 16:00-16:30
How to get over your malicious ex(tensions) using deep learning
No description available
Return to Index - Add to
- ics Calendar file
BHV - Planet Hollywood - Melrose 1-3 Rooms - Friday - 11:45-12:30
11:45 AM: How to Get Your Ass Kicked and Like It; Experiential Learning Through Gamification
Speaker: Corey M. Hudson
Abstract: The paradigm shift for cybersecurity crisis response training is here. If you want to prepare for a security breach, tabletop exercises and unpracticed runbooks arent enough. Organizations can now prepare for a worst day with an intense, immersive experience that builds your teams critical cybersecurity and leadership skills in a realistic and gamified environment. An organizations response and actions, or the lack thereof, can have a decisive impact on the end state or the aftermath.
Speaker Bio: JC is a proven executive, visionary, and story teller with 30+ years of security leadership experience. He served in multiple leadership and advisory roles and possesses extensive experience in building strategic cyber programs at the National level ISO missions in the most hostile environments.
T: @teamvega
Return to Index - Add to
- ics Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 15:15-16:30
15:15-16:30
How to Reach People in the Developing World
Zcash Foundation
The Zcash Foundation will be hosting a discussion on how to best reach those in the developing world. How can we give them the benefits of cryptocurrencies and share information with them? The station may continue past the allotted time.
Return to Index - Add to
- ics Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Friday - 14:30-14:59
Hunting Certificates and Servers
Sam Erb
From Shodan to Certificate Transparency, it is easier than ever to use TLS certificates for DNS hostname reconnaissance. However, these sources of data are either not free, infrequently updated or are not linked to a server IP address. This talk will survey existing resources & release a new, free service for finding TLS certificates in the IPv4 space!
Sam Erb (Twitter: @erbbysam) is a 2x black badge winner with Co9 in the Badge Challenge and is working to make the Internet a safer place.
Return to Index - Add to
- ics Calendar file
DC - Paris - Track 2 - Friday - 13:00-13:45
HVACking: Understand the Difference Between Security and Reality!
Friday at 13:00 in Track 2
45 minutes | Demo
Douglas McKee Senior Security Researcher, McAfee Advanced Threat Research
Mark Bereza Security Researcher, McAfee Advanced Threat Research
Like most modern devices, building controllers have increasingly become network connected, exposing them to a wider range of threats. If malicious actors could manipulate access control systems, boiler rooms, or temperature control for critical industrial systems, the potential for catastrophic damage is extreme.
McAfee's ATR team has discovered a 0-day vulnerability in a major building controller. This controller is a fully programmable native BACnet™ device designed to manage a wide range of building systems. By modifying BACnet broadcast traffic, a buffer overflow can be leveraged into a write-what-where (WWW) condition. This WWW leads to execution control, providing the attacker with a root shell and complete control over the device remotely. Because this attack vector is through BACnet broadcast traffic, there is no authentication mechanism for the target device, allowing anyone on the same network to communicate with it directly and exploit the vulnerability without authentication. Currently, there are over 500 of these devices connected to the internet running in BACnet/IP Broadcast Management Device (BBMD) mode. Utilizing this mode, broadcast traffic can travel over the internet, increasing the potentially devastating impact of this vulnerability.
This presentation will include a deep technical analysis of the vulnerability discovery process and demos illustrating an attack in a critical scenario. Finally, we will discuss the steps taken by the vendor to patch this vulnerability and demonstrate its effectiveness.
Douglas McKee
Douglas McKee is a senior security researcher for the McAfee Advanced Threat Research team, focused on finding new vulnerabilities in both software and hardware. Douglas has an extensive background in penetration testing, reverse engineering, malware analysis and forensics and throughout his career has provided software exploitation training to many audiences, including law enforcement. Douglas recently presented his research focused on hacking medical devices at DEF CON 26.
Twitter: @fulmetalpackets
Mark Bereza
Mark Bereza is a security researcher and new addition to McAfee's Advanced Threat Research team. A recent alumnus of Oregon State's CS systems program, Mark's work has focused primarily on vulnerability discovery and exploit development for embedded systems.
Return to Index - Add to
- ics Calendar file
DC - Paris - Track 2 - Friday - 16:00-16:30
I Know What You Did Last Summer: 3 Years of Wireless Monitoring at DEF CON
Friday at 16:00 in Track 2
20 minutes | Demo, Tool
d4rkm4tter (Mike Spicer) Hacker
For the past 3 years d4rkm4tter has been obsessed with monitoring the wireless networks at DEF CON. This talk will take you on a journey through the successes and failures that lead to the creation of the WiFiCactus and the over 1 TB of data captured. A history of each capture project including a summary of the most interesting pieces of data will be shown.
Many people spread a lot of fear, uncertainty and doubt about the wireless environments during DEF CON. This presentation aims to bring some clarity to what is really happening in the airwaves during one of the largest hacker conferences in the world. This will include presenting data on the attacks and sensitive information that exists in the airwaves. This presentation will demonstrate the risks of using wireless networks and information leaks that can be captured by anyone who is passively listening. Countermeasures and protection strategies will be provided to help you avoid having your data captured by those who might be listening.
With the number of connected devices around us, there has never been a better time to start wardriving or warwalking. Everyone is capable of profiling wireless data around them thanks to cheap hardware and open source tools. As hackers it is important for us to discover issues and vulnerabilities while validating claims of security by software and hardware vendors. Monitoring wireless communication is a great way to start validating those claims. All of the hardware and methods used will be provided so that anyone can do this type of monitoring on their own. Hack the Planet!
d4rkm4tter (Mike Spicer)
d4rkm4tter is a mad scientist hacker who likes to meddle with hardware and software. He is particularly obsessed with wireless. He has a degree in computer science from Southern Utah University which he has put to use building and breaking a wide array of systems. These include web application pentesting, wireless monitoring and tracking as well as good old fashioned reverse engineering. He is the creator of the #WiFiCactus and has been seen presenting Demolabs at DEF CON and DEF CON China Beta. He is a Kismet cultist and active in the wireless and wardriving communities.
Twitter: @d4rkm4tter
Website: palshack.org
Return to Index - Add to
- ics Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 15:15-18:59
15:15-19:00
i2p Workshop for Cryptocurrencies
zzz, i2p Developer
Stop by for an introduction to i2p, an anonymity network, and a workshop regarding how to use i2p properly in cryptocurrency implementations. This is an excellent opportunity to speak with world-class privacy network developers who take matters seriously. This time includes a long running Q&A period, so stop by if you have any questions, cryptocurrency-related or not, for the i2p team.
Return to Index - Add to
- ics Calendar file
ICS - Bally's Event Center - Friday - 16:30-16:59
ICS Threats - A Short Summary of the Past Year
August 9, 2019 4:30 PM
Get a high-level overview summary of the threats against ICS we've seen in the past year including techniques, actor attribution, motivation, and the intelligence lifecycle.
Speaker Information
Panelist Information
SCYTHE
Bryson is the Founder of SCYTHE, a start-up building a next generation attack emulation platform, and GRIMM, a boutique cybersecurity consultancy, and Co-Founder of the ICS Village, a non-profit advancing awareness of industrial control system security. He is a National Security Institute Fellow and an Advisor to the Army Cyber Institute. Prior, Bryson led an elite offensive capabilities development group. As a U.S. Army Officer, he served as a Battle Captain and Brigade Engineering Officer in support of Operation Iraqi Freedom before leaving the Army as a Captain. Bryson received his Bachelor of Science in Computer Science with honors from the United States Military Academy at West Point. He holds a Master’s Degree in Telecommunications Management from the University of Maryland, a Master’s in Business Administration from the University of Florida, and completed graduate studies in Electrical Engineering and Computer Science at the University of Texas.
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 14:00-14:30
Title:
If the Voting Machines are Insecure, Lets Just Vote on Our Phones!
2:00 PM If the Voting Machines are Insecure, Lets Just Vote on Our Phones!
Marian Schneider, President, Verified Voting
Return to Index - Add to
- ics
Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 16:45-17:15
16:45-17:15
If You Like It, Then You Should Have Put a Ring Signature On It
Sarang Noether, Ph.D, Monero Research Lab
The past year has seen excellent research focused on achieving better functionality, privacy, and efficiency for spend obfuscation in digital assets like Monero. This includes CLSAG, DLSAG, Lelantus, Omniring, RingCT 3.0, and Spartan. What are these constructions, what are their tradeoffs, and what could they mean for Monero and other privacy-focused projects? This talk assumes no mathematical background and will be accessible to everyone.
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Friday - 11:00-11:59
Title:
Implementing a Zero Knowledge Proof or, How to Write Bulletproofs in Rust - Cathie Yun
ABSTRACT
Zero knowledge proofs are powerful tools; come learn about how they work and what they enable! We'll get down and dirty in the details of Bulletproofs, a zero knowledge proof protocol that doesn't require trusted setup. I'll walk you through the math/crypto of Bulletproofs, alongside my open-source implementation in Rust. You'll walk away with an appreciation for zero knowledge proofs, a deeper understanding of Bulletproofs, and hopefully some interest in tinkering on or building systems with zero knowledge proof protocols yourself!
BIO
Cathie was an applied cryptographer at Chain and Interstellar. She enjoys working on open-source zero knowledge proof implementations and protocols for confidentiality in blockchain systems. She has a background in distributed systems and cryptography from MIT. When she isn't designing better blockchain protocols, she can be found climbing tall rocks and performing aerial silks.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 3 - Friday - 12:00-12:45
Infiltrating Corporate Intranet Like NSA ̶Pre-auth RCE on Leading SSL VPNs
Friday at 12:00 in Track 3
45 minutes | Demo, Exploit
Orange Tsai
Principal Security Researcher from DEVCORE
Member of HITCON(Hacks in Taiwan Conference)
Member of CHROOT Security Group
Captain of HITCON CTF team
Meh Chang Security Researcher from DEVCORE
Member of HITCON CTF team
Computer security is now a public policy issue. Election security, blockchain, "going dark," the vulnerabilities equities debate, IoT safety , data privacy, algorithmic security and fairness, critical infrastructure: these are all important public policy issues with a strong Internet security component. But while an understanding of the technology involved is fundamental to crafting good policy, there is little involvement of technologists in policy discussions. This is not sustainable. We need public-interest technologists: people from our fields helping craft policy, and working to provide security to agencies and groups working in the broader public interest. We need these people in government, at NGOs, teaching at universities, as part of the press, and inside private companies. This is increasingly critical to both public safety and overall social welfare. This talk both describes the current state of public-interest technology, and offers a way forward for us individually and collectively for our field. The defining policy question of the Internet age is this: How much of our lives should be governed by technology, and under what terms? We need to be involved in that debate.SSL VPNs protect corporate assets from Internet exposure, but what if SSL VPNs themselves are vulnerable? They’re exposed to the Internet, trusted to reliably guard the only way to intranet. However, we found pre-auth RCEs on multiple leading SSL VPNs, used by nearly half of the Fortune 500 companies and many government organizations. To make things worse, a “magic” backdoor was found to allow changing any user’s password with no credentials required! To show how bad things can go, we will demonstrate gaining root shell from the only exposed HTTPS port, covertly weaponizing the server against their owner, and abusing a hidden feature to take over all VPN clients!
In such complicated closed-source systems, gaining root shell from outside the box certainly ain’t easy. It takes advanced web and binary exploitation techniques to struggle for a way to root shell, which involves abusing defects in web architectures, hard-core Apache jemalloc exploitation and more. We will cover every detail of all the dirty tricks, crazy bug chains, and the built-in backdoor. After gaining root shell into the box, we then elaborate on post exploitation and how we hack back the clients. In addition, we will share the attack vectors against SSL VPNs to kick start researches on similar targets. On the other hand, from our previous experience, we derive general hardening actions that mitigate not only all the above attacks, but any other potential 0days.
In summary, we disclose practical attacks capable of compromising millions of targets, including tech giants and many industry leaders. These techniques and methodologies are published in the hope that it can inspire more security researchers to think out-of-the-box; enterprises can apply immediate mitigation, and realize that SSL VPN is not merely Virtual Private Network, but also a “Vulnerable Point of your Network”.
Orange Tsai
Cheng-Da Tsai, also as known as Orange Tsai, is the principal security research of DEVCORE and the member of CHROOT security group from Taiwan. He has spoken at conferences such as Black Hat USA/ASIA, DEF CON, HITCON, HITB, Hack.lu and CODEBLUE. He participates in numerous Capture-the-Flags (CTF), and also the team captain of HITCON, which won 2nd place in DEF CON 22/25.
Currently, he is focusing on application security and 0day research. Orange enjoys finding vulnerabilities and participating in Bug Bounty Programs. He is enthusiastic about Remote Code Execution (RCE), and uncovered RCEs in several vendors, such as Facebook, Uber, Apple, GitHub, Amazon, Yahoo, Netflix and Imgur.
Twitter: @orange_8361
Website: http://blog.orange.tw/
Meh Chang
Tingyi Chang, also known as Meh Chang, is a security researcher at DEVCORE. She focuses on binary program analysis and exploitation. She is a member of HITCON and 217 CTF team and has won the second place of DEF CON 25.
Twitter: @mehqq_
Return to Index - Add to
- ics
Calendar file
HHV - Bally's Event Center - Friday - 12:00-12:30
Infrared: New Threats Meet Old Devices
Wang Kang
Abstract
Before the Bluetooth technology kicks in, infrared remote control has been widely used. Many systems still use IR as their control interface. With the proliferation of new smart devices with IR-related components, such as face recognition systems, night vision infrared cameras, slow motion cameras, etc., this ancient technology may bring some new attack surfaces.
First, we will demonstrate a new attack scenario. After a COTS security camera is pwned through Internet, the infrared night vision fill light could be flashed to control devices such as TV and AC. In this way, dumb devices that were originally considered to be air-gapped will also face security threats from the network side. With much greater TX power, larger area could be influenced. Additional attack surfaces will also be discussed.
Second, we will demonstrate the use of an electric drill and a pure mechanical design similar to a fan blade, constructed as a Spatial Light Modulator. We will demonstrate how to construct a remote control signal that can be recognized by COTS IR remote control from still infrared light. Who said hacking an electric fan doesn’t matter?
Third, we will analyze the frame structure of an infrared remote control signal by utilizing a smartphone with 960fps ‘Super Slow-mo’ function as a poor man’s logic analyzer.
Bio
Wang Kang is a Security Expert of Alibaba Group, focusing on security issues of IoT, cyber-physical system, V2X, and trusted computing. He is a contributor of Linux Kernel, (TDD-LTE USB Dongle support) as well as a founder of the Tsinghua University Network Administrators. He was a speaker at Black Hat {Europe 2015, USA 2017, USA 2018, Asia 2019}, Virus Bulletin 2018, HITB {Dubai 2018, AMS 2019}.
Return to Index - Add to
- ics
Calendar file
RTV - Flamingo 3rd Floor - Laughlin I,II Rooms - Friday - 16:00-16:59
Injections Without Border: An anatomy of a Serverless Event Injections
Serverless applications have seen a significant rise in adoption in the past year. Along with its advantages, serverless architecture presents new security challenges. Some of these security threats are equal to those we know from traditional application development and some take a new form.
One particular example is the Injection attacks. Yes, SQL/NoSQL, OS and Code Injection attacks, they all still exist. But, when dealing with a monolithic application we only have one way in. What happens when we move to serverless architecture and we lose the perimeter? code is no longer executed directly, but is executed through cloud events. Whether it's a file upload, an email sent, a notification received or a simple log entry.
In this talk, I will examine the Serverless #1 risk: Event Injection and will demonstrate injection attacks form multiple event types.
About Tal Melamed: In the past year, Tal been experimenting in offensive and defensive security for the serverless technology, as part of his role as Head of Security Research at Protego Labs. Specializing in AppSec, he has more than 15 years of experience in security research and vulnerability assessment, previously working for leading security organizations such as Synack, AppSec Labs, CheckPoint, and RSA. Tal is also the leader and creator of the OWASP Serverless Top 10 and DVSA projects.
Twitter: @_nu11p0inter | @dvsaowasp
Return to Index - Add to
- ics
Calendar file
LPV - Bally's - Platinum II Ballroom - Friday - 11:00-11:40
Title:
Insider Attacks on Master Key Systems
Presented By
Matt Burrough
Abstract
As a lock enthusiast and professional pentester, I think a lot about ways to quickly or reliably gain access to restricted areas without relying on my picks. This talk will cover several ways to perform escalation of privilege in the physical world.
Return to Index - Add to
- ics
Calendar file
PHVW - Bally's Resort (Indigo) Tower 26th floor - Friday - 16:45-18:45
Intel-driven Hunts for Nation-state Activity Using Elastic SIEM
Sean Donnelly, CEO, Resolvn, Inc.
Peter Hay, Director of Strategy and Innovation, Resolvn, Inc.
Hunting for advanced threats can be a daunting task for network defenders. In this workshop we’ll demystify threat hunting by guiding attendees through the development and execution of network traffic and host analysis workflows. Using a six-stage model, attendees will leverage threat intelligence to plan and conduct 20 small hunts, configuring and tuning their defensive tool-suite along the way. The use of IOC-based, tool-based, and TTP-based detection methods will ultimately lead to the discovery of nation-state activity on a complex, near-to-spec enterprise network.
Sean Donnelly (Twitter: @resolvn) is the CEO of Resolvn, Sean is a passionate cybersecurity researcher with extensive experience in the industry. As an active-duty U.S. Navy Cryptologic Warfare Officer, Sean worked for the National Security Agency (NSA) before becoming the Technical Director of the Navy Blue Team (NBT). Sean has developed internal tools for threat detection, such as the NBT’s Blue P.E.A.R and Expanse’s ETHIR, trained countless service members on detection techniques, and led critical security operations around the world. He holds CISSP, GPEN, and OSCP certifications along with a B.S. and M.S. from the United States Naval Academy and Boston University, respectively.
Peter Hay (Twitter: @ResolvnPete) is Resolvn’s director of strategy and innovation, Pete has an extensive and diverse background in technology driven fields including Computer Network Operations (CNO), Network Forensics, and Nuclear Chemistry. From his Navy service in leading a quick-response team of NSA cryptologists and developers who designed solutions to some of the agency’s most vital problems, to delivering multi-domain cyber security training to thousands of students world-wide, or applying for cyber security patents in the U.S. and Europe, Pete continues to stretch the edges of technology, its use, and application.
Return to Index - Add to
- ics
Calendar file
LPV - Bally's - Platinum II Ballroom - Friday - 10:15-10:45
Title:
Intro to Lockpicking
Presented By
TOOOL
Abstract
New to lock picking? Haven't picked in a year and need a refresher? Don't know a half-diamond from a turner? This talk is for you! Join one of our knowledgable village volunteers as we walk you through the very basics of lock picking, from how to hold your tools to the theory behind the technique that makes lock picking possible.
Return to Index - Add to
- ics
Calendar file
LPV - Bally's - Platinum II Ballroom - Friday - 12:00-12:30
Title:
Intro to Lockpicking
Presented By
TOOOL
Abstract
New to lock picking? Haven't picked in a year and need a refresher? Don't know a half-diamond from a turner? This talk is for you! Join one of our knowledgable village volunteers as we walk you through the very basics of lock picking, from how to hold your tools to the theory behind the technique that makes lock picking possible.
Return to Index - Add to
- ics
Calendar file
LPV - Bally's - Platinum II Ballroom - Friday - 14:15-14:45
Title:
Intro to Lockpicking
Presented By
TOOOL
Abstract
New to lock picking? Haven't picked in a year and need a refresher? Don't know a half-diamond from a turner? This talk is for you! Join one of our knowledgable village volunteers as we walk you through the very basics of lock picking, from how to hold your tools to the theory behind the technique that makes lock picking possible.
Return to Index - Add to
- ics
Calendar file
CHV - Bally's Event Center - Friday - 15:00-15:25
Intro to UDS
ac0rn
Fri 8/09 •
3:00 PM-3:25 PM
25 min talk
"What is UDS and how can it help me hack cars?"
The goal of this talk is to give a brief introduction to UDS (ISO 14229), what the capabilities of UDS are, why automotive ECUs implement it, and how it is useful in hacking cars. The talk will have examples using standard Linux socketcan interfaces as well as CanCat scripts to help people discover UDS devices and services on their own vehicles.
Return to Index - Add to
- ics
Calendar file
WLV - Bally's - Palace Meeting Rooms 1-7 - off hallway to Event Center - Friday - 16:00-16:55
Hak5: Darren Kitchen, Dallas Winger, Marc Egerton, Tim Mossey
Bio
Darren Kitchen, Dallas Winger, Marc Egerton, and Timothy Mossey make up the Hak5 dev team. Collectively they cultivate pineapples and wrangle code to bring top pentest tools to the cloud and beyond. While it's a mystery which of the four is the true UT99 instagib master, there is no doubting their combined powers ability to summon captain planet...or a script kiddie.
@hak5darren
@notkorben
@justfoxtrot
@timzor
Introducing new Hak5 gear! The Signal Owl, Screen Crab and Shark Jack ^_^
Abstract
"Unlike the cheese, the WiFi Pineapple does not stand alone. Learn all about the latest Hak5 tools dropping - the brand new Signal Owl, Screen Crab and Shark Jack - as well as updates to the entire arsenal and a cloud management platform to take your pentest to the next level. Join the Hak5 team for a lively presentation and a sneak peek into what's right around the corner.
"
|
Return to Index - Add to
- ics
Calendar file
RTV - Flamingo 3rd Floor - Laughlin I,II Rooms - Friday - 17:30-18:30
Introduction and Application of Covert Channels
Red Teams must operate under the radar, and one way to achieve that, or delay discovery of a communication method, is by using covert channels. In this talk, Aaron will quickly touch on the history and science behind covert channels, before diving into how they can be used to conceal active C2 channels. This talk will also cover a walkthrough of a stealthy ICMP covert channel, and general methodology of developing new covert channels for other protocols or communication mediums.
About Aaron "dyn" Grattafiori: Aaron "dyn" Grattafiori leads the Red Team at Facebook, where he focuses on offensive security, vulnerability research, adversary simulation, and performing bold full scope operations. Aaron has spoken at national security conferences such as Black Hat and DEFCON as well as regional conferences such as Toorcon and SOURCE. This will be Aaron's 16th DEFCON. Twitter: @dyn___
Return to Index - Add to
- ics
Calendar file
WS - Flamingo - Lower Level - Red Rock V - Friday - 14:30-18:30
Introduction to Reverse Engineering With Ghidra
Friday, 1430-1830 in Flamingo, Red Rock V
Wesley McGrew Hacker
Tyler Holland Operator-Analyst, HORNE Cyber
The open-source release of the NSA's Ghidra disassembler gives software reverse engineers a free option for high-capability interactive analysis of binary code. Many software reverse engineering (SRE) practitioners have been spending time since the release learning about Ghidra and bringing it into their workflow. It also gives those new to SRE a toolset to learn with that is not restricted by commercial license costs or "demo" limitations.
The purpose of this workshop is to teach beginners, with no prior experience in software reverse engineering, about the analysis of software in the Ghidra disassembler. We'll cover the following major topics, with high degree of interaction between the instructors and students:
- Defining software reverse engineering terms
- Setting up an environment for Ghidra
- Ghidra configuration and usage
- Linking and Loading
- Data types
- C data types and constructs in assembly
- Simple anti-RE tricks and how to analyze them
- Methodology for approaching unknown programs (prioritization, analysis)
- Analysis exercise with a malware sample
Skill Level Beginner
Prerequisites: Students should have experience with at least one high-level programming language. C is preferred, but experience with any other language should provide you with the experience necessary to at least read C code. You will not be required to *write* code. No prior software reverse engineering experience is required.
Materials: Students that wish to "follow along" in Ghidra and participate in hands-on exercises should bring a laptop. Laptops should be running a 64-bit operating system (macOS, Windows, or Linux), and have at least 4GB RAM (more preferred, especially if you're using virtual machines). Before the workshop, please download and install OpenJDK and Ghidra as described in the instructions at https://ghidra-sre.org/ . We can troubleshoot installation problems in-class, but don't count on reliable/fast network access, so try to get it set up ahead of time.
We will be analyzing *live malware* provided to you on USB. You will need to have administrative capability on your laptop in order to disable or set exclusions on your AV software. While we will not be intentionally executing code (this course is limited to static analysis), you are expected to take whatever measures necessary to protect yourself, to include: bringing a "burner" laptop, having backups, virtualization, and/or common sense.
If you do not bring a laptop, you can still get some good exposure to reverse engineering with Ghidra! I'll be working in Ghidra most of the time on the projector, and you may coordinate with another student to collaboratively discuss what you're looking at on a shared laptop.
Max students: 50
Registration: https://www.eventbrite.com/e/introduction-to-reverse-engineering-with-ghidra-red-rock-v-tickets-63609250982
(Opens 8-Jul-19)
Wesley McGrew
As Director of Cyber Operations at HORNE Cyber, Wesley McGrew oversees and participates in offense-oriented services for clients in many areas, including finance, healthcare, manufacturing, and national critical infrastructure. He has presented on topics of penetration testing and and malware analysis at DEF CON and Black Hat USA. He teaches a self-designed course on reverse engineering to students at Mississippi State University, using real-world, high-profile malware samples. Wesley has a Ph.D. in Computer Science from Mississippi State University for his research in vulnerability analysis of SCADA HMI systems.
Tyler Holland
Tyler Holland is an Operative-Analyst at HORNE Cyber, where he conducts penetration testing, red teaming, and application security engagements. Tyler is an expert in reverse engineering malicious software in support of incident handling engagements.
Return to Index - Add to
- ics
Calendar file
WS - Flamingo - Lower Level - Red Rock IV - Friday - 14:30-18:30
Introduction to Sandbox Evasion and AMSI Bypasses
Friday, 1430-1830 in Flamingo, Red Rock IV
Anthony Rose Co-founder, Blockchain Security
Jacob "Hubble" Krasnov Co-founder, Blockchain Security
Vincent "Halycon" Rose Software Engineer
Microsoft is constantly adapting their security to counter new threats. Specifically, the introduction of the Microsoft Antimalware Scripting Interface (AMSI) and its integration with Windows Defender has significantly raised the bar. In this hands-on class, we will learn the methodology behind obfuscating malware and avoiding detection. Students will explore the inner workings of Windows Defender and learn to employ AMSI bypass techniques and obfuscate malware using Visual Basic (VB) and Powershell. Then identify and evade sandbox environments to ensure the payloads are masked when arriving at the intended target. The final capstone will be tying all the concepts together.
In this workshop we will:
1. Introduce AMSI and explain its importance
2. Learn to analyze malware scripts before and after execution
3. Understand how obfuscate code to avoid AMSI and Windows Defender
4. Detect and avoid sandbox environments
Skill Level Beginner
Prerequisites: None
Materials: Students will need a laptop with VMWare or Virtualbox (installed and working).
Max students: 80
Registration: https://www.eventbrite.com/e/introduction-to-sandbox-evasion-and-amsi-bypasses-red-rock-iv-tickets-63609241955
(Opens 8-Jul-19)
Anthony Rose
Anthony 'C01_' Rose, CISSP, is the Co-founder of BC Security and Lead Pentester at Merculite Security. He has more than a decade's worth of experience as an Electrical Engineer, managing Red and Blue teams, and hacking buffoonery. His work focuses on wireless network penetration and non-IP based system security with an emphasis on embedded systems security. He has presented at DEF CON 24 and RSA 2017.
Jacob "Hubble" Krasnov
Jake "Hubble" Krasnov is the Co-founder of BC Security. He has spent most of his career as an Astronautical Engineer but has transitioned to cybersecurity. He has spent the last three years developing embedded system cyber testing tools and as a member and Red Team Lead.
Vincent "Halycon" Rose
Vincent "Halcyon" Rose is a software engineer with experience in cloud services. He has a decade of experience in software development and networking. Recently, his focus has been on building ad-serving technologies, web and ad-tracking applications.
Return to Index - Add to
- ics
Calendar file
ICS - Bally's Event Center - Friday - 15:30-15:59
IT/OT Convergence - Are We There Yet?
August 9, 2019 3:30 PM
Call it convergence, alignment, cooperation, or what you will, not only are IT networks being used to carry OT information and control instructions, traditional OT manufacturers are adding traditional IT features into their products and traditional IT manufacturers are looking at the opportunity to step into the OT world. Jack will discuss this and other aspects of the convergence of IT and OT. There is still resistance and in cases, a lack of understanding about IT/OT convergence, the objectives, and what needs to be done. In order to have convergence of IT/OT, we must first define, or at least set a goal for convergence.
Speaker Information
Panelist Information
Parsons Government Services
Jack D. Oden is self-motivated, energetic, and accomplished, has 20 years’ experience in negotiating system improvements between users and engineers; developing, acquiring, operating, analyzing, designing, and programming quality, user-oriented systems. He provides services to customers on industrial control systems security for critical infrastructure, advises on compliance with legal, regulations and policy, leads information technology subject matter experts in operating systems and networking, managed five projects over 25 years, managed two full-scale computer operations and a cybersecurity operation center, and built a 67,000 sqft office complex, including four sensitive compartmented information facilities. He has over 46 years’ experience in leadership, Jack is a retired U.S. Army Lieutenant Colonel, holds a Masters in Business Administration, Management from University of Texas at San Antonio and Bachelors in Business Administration, Accounting from Texas A&M University, is a Certified Information Systems Security Professional, Global Industrial Cyber Security Professional, Project Management Professional, and SCADA Security Architect.
Return to Index - Add to
- ics
Calendar file
CLV - Flamingo 3rd Floor - Reno I Room - Friday - 12:20-12:59
Keynote - Cloudy Vision: How Cloud Integration Complicates Security
Speaker: Sean Metcalf
Twitter: @PyroTek3
Abstract: The cloud is compelling and in many cases necessary for organizations to effectively operate.
Cloud security on the other hand is not as clear. Many cloud services need a hook into the on-premises environment in order to synchronize users and groups. Additionally, the cloud security controls vary by provider in availability, capability, and cost. This results in a disjointed view of user authentication, security, and potential configuration issues.
This talk explores some common cloud configuration scenarios and the associated security issues.
About Sean: Sean Metcalf is founder and principal consultant at Trimarc (www.TrimarcSecurity.com), a professional services company which focuses on improving enterprise security. He is one of about 100 people in the world who holds the Microsoft Certified Master Directory Services (MCM) certification, is a Microsoft MVP, and has presented on Active Directory & Microsoft Cloud attack and defense at Black Hat, BSides, DEF CON, DerbyCon, Microsoft BlueHat, Shakacon and Walmart Sp4rkCon security conferences. He currently provides security consulting services to customers and posts interesting Active Directory security information on his blog, ADSecurity.org
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 13:30-13:59
Title:
Keynote Remarks: Senator Ron Wyden (OR)
1:30 PM Keynote Remarks: Senator Ron Wyden (OR)
Return to Index - Add to
- ics
Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 10:30-11:30
10:30-11:30
Keynote Speech: Monero Introduction and Investor Perspective
Daniel Kim, Founder and President of Sweetwater Digital Asset Consulting, LLC
Learn the basics of Monero and its community. Monero provides benefits to society that all Defcon attendees benefit from. Daniel will express the importance of holders and advocates for cryptocurrencies. He will describe a set of concepts and frameworks to examine market data.
Return to Index - Add to
- ics
Calendar file
BCV - Flamingo 3rd Floor - Laughlin III Room - Friday - 10:00-10:50
Keynote: Responding to Firefox 0-days
No description available
Return to Index - Add to
- ics
Calendar file
ASV - Flamingo 3rd Floor - Mesquite Room - Friday - 10:00-10:59
"The Abridged History of Application Security"
Application Security began in the early 60's where plain text password storage, no password policy, poor access control and other massive security problems were the norm. This talk with review the history of application security to help illustrate not just how much application security has gotten better, but also how the rate of positive change has been getting better as well. This fun ride through the history of application security is meant to inspire those who work in the industry. We are often looking closely at failure and insecurity, but when we step back and look at our industry historically, we can all see just how much things truly are getting better.
Return to Index - Add to
- ics
Calendar file
RTV - Flamingo 3rd Floor - Laughlin I,II Rooms - Friday - 09:00-09:59
Kube-Red C2 Operations on Kubernetes
This talk explores deploying and dynamically generating C2 services on Kubernetes! Everything will be extremely practical with walkthroughs of detailed deployment configurations. Building containers for popular C2 platforms, such as Cobalt Strike, and many others, will be covered. Rapidly deploying complex C2 infrastructure using tools such as Kops and Drone and managing DNS and TLS using Kubernetes will be discussed. Attendees will learn how to build complex redirecting logic to sandbag defenders, using the rewriting and filtering capabilities found in the Nginx Ingress Controller, and the Istio Service Mesh. In addition, monitoring the health of implants using Prometheus will be reviewed.
About Larry Suto: Larry is an independent security consultant based out of Oakland, CA. He spends a lot of time researching using cloud infrastructure for all types of security testing. He spends some time on Windows security as well. Twitter: @larrysuto
Return to Index - Add to
- ics
Calendar file
LPV - Bally's - Platinum II Ballroom - Friday - 16:00-16:45
Title:
Law School for Lock Pickers
Presented By
Preston Thomas
Abstract
No, Virginia, lockpicks aren't "illegal". Like lockpicking itself, the law of lockpicking is esoteric, widely misunderstood, and occasionally a source of hilarity when interpreted by outsiders. Class is in session as TOOOL Board member and practicing attorney Preston Thomas hosts a lighthearted law school for locksporters, laying out the legal logic, busting myths, and telling stories. Expect raucous Q&A, real talk, and absolutely zero legal advice.
Return to Index - Add to
- ics
Calendar file
Meetups - Paris - Napoleons Corner Bar - Friday - 18:00-19:59
Title:
Lawyers Meet
If you're a lawyer (recently unfrozen or otherwise), a judge or a law student please make a note to join Jeff McNamara at 18:00 on Friday, August 9th, for a friendly get-together, drinks, and conversation. Location: Inside the Napoleons Bar just outside of the Paris Speaking Tracks.
Return to Index - Add to
- ics
Calendar file
CHV - Bally's Event Center - Friday - 16:00-16:50
Legal Over-the-Air Spoofing of GNSS and its Effects on Autonomous Vehicles
Victor Murray
Fri 8/09 •
4:00 PM-4:50 PM
50 min talk
Many systems depend on accurate location information from Global Navigation System Satellites (GNSS) for normal operation. Public GNSS lacks integrity mechanisms and is vulnerable to spoofing. U.S. Federal law does not allow over-the-air spoofing of GNSS or other signals, which makes assessment of vulnerabilities difficult outside of an enclosed laboratory environment. This research proved the usefulness of a Mobile GNSS Spoofing System that enables legal, real-world evaluation of GNSS vulnerabilities. The mobile spoofing system was used to evaluate vulnerabilities in an Unmanned Ground Vehicle (UGV). The UGV GNSS was exploited using several different attacks including forced lane switching, driving off the road, and stopping the vehicle.
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 2 - Friday - 14:00 - 15:50
Let's Map Your Network
Friday from 14:00 – 15:50 in Sunset 2 at Planet Hollywood
Audience: Defense, Monitoring
Pramod Rana
Let’s Map Your Network (LMYN) aims to provide an easy to use interface to security engineer and network administrator to have their network in graphical form with zero manual error. It is utmost important for any security engineer to understand their network first before securing it. In a mid to large level organisation’s network having a network architecture diagram doesn’t provide the complete understanding and manual verification is a nightmare. Hence in order to secure entire network it is important to have a complete picture of all the systems which are connected to your network, irrespective of their type, function, technology etc. BOTTOM LINE - YOU CAN'T SECURE WHAT YOU ARE NOT AWARE OF. LMYN does it in two phases:
1. Learning: In this phase LMYN 'learns' the network by performing the network commands and querying the APIs and then builds graph database leveraging the responses. User can perform any of the learning activities at any point of time and LMYN will incorporate the results in existing database.
2. Monitoring: This is a continuous process, where LMYN monitors the 'in-scope' network for any changes, compare it with existing information and update the graph database accordingly.
https://github.com/varchashva/LetsMapYourNetwork
Pramod Rana
Pramod Rana works as a Senior Security Engineer with Coupa Software (The All-In-One Business Spend Management Platform). Pramod is responsible for implementing DevSecOps functions in Coupa like penetration testing, threat modelling, secure source code review. He has presented at Black Hat Europe 2018 before. He loves to do offensive security research, coding and running in his personal time.
Return to Index - Add to
- ics
Calendar file
RCV - Planet Hollywood - Celebrity 5 Ballroom - Friday - 13:20-13:50
Return to Index - Add to
- ics
Calendar file
CHV - Bally's Event Center - Friday - 15:30-15:55
Lojack'd - pwning car alarms, vehicle trackers and immobilisers
Ken Munro
Fri 8/09 •
3:30 PM-3:55 PM
25 min talk
Research by us has revealed direct CAN injection remote via APIs, which we intend to present the detail of live.
Viper Alarms uses a back-end from CalAmp, the manufacturer of LoJack. We'll show how the LoJack vehicle tracking & recovery device could be compromised and recovery of a stolen vehicle prevented.
This research lead us on to compromise of OEM-approved vehicle trackers and immobilisers. The rabbit hole went very deep indeed.
This is a story of systemic compromise through weak platform providers and outsourced security.
Return to Index - Add to
- ics
Calendar file
AIV - Bally's Resort (Indigo) Tower 26th Floor - Skyview Room 3 - end - Friday - 14:45-15:30
Loss Is More! Improving Malware Detectors by Learning Additional Tasks
No description available
Return to Index - Add to
- ics
Calendar file
HHV - Bally's Event Center - Friday - 14:00-14:50
Making A Less Shitty Sao: How To Use Kicad To Build Your First Pretty Pcb
Steve Ball (hamster)
Abstract
SAOs are everywhere at Defcon, but for many, it’s hard to imagine how to design and manufacture them. In this talk, we’ll go through the process of taking artwork to a final PCB that is ready to order. Along the way we’ll talk about different PCB layers and their effects in art, schematic capture, and options available at the board house.
Bio
hamster has been making badges for dczia and dc801 for the last 5 years, and has been an all-around hardware hacker for many more. He enjoys bending commercial design software to the silly and open sourcing the result.
Return to Index - Add to
- ics
Calendar file
BTVW - Flamingo - Lower Level - Valley Of Fire 1 - Friday - 14:00-17:59
Malware Traffic Analysis Workshop
Friday 14:00, Valley Of Fire 1, Flamingo (4H)
@malware_traffic
based in Texas, specializes in traffic analysis of malware and suspicious network activity. After more than 21 years in the US Air Force, Brad transitioned to cyber security in 2010. He is currently a Threat Intelligence Analyst for Palo Alto Networks Unit 42. Brad is also a volunteer handler for the Internet Storm Center (ISC) and has posted more than 140 diaries at isc.sans.edu. He routinely blogs technical details and analysis of infection traffic at www.malware-traffic-analysis.net, where he's provided over 1,600 malware and pcap samples to a growing community of information security professionals.
This workshop that focuses on infection traffic for hosts running Microsoft Windows. It begins with setting up Wireshark and identifying hosts in network traffic. Participants review malware infections and learn tips to identify indicators of malicious activity. The training ends with an evaluation where participants review pcaps and compose incident reports.
Return to Index - Add to
- ics
Calendar file
WS - Flamingo - Lower Level - Red Rock II - Friday - 10:00-13:59
Malware Triage - Analyzing The Modern Malware Delivery Chain
Friday, 1000-1400 in Flamingo, Red Rock II
Sergei Frankoff Co-Founder, Open Analysis
Sean Wilson Co-Founder, Open Analysis
Malspam with an attached malicious document has now become the standard delivery vector for most criminal malware. In order to evade detection it is not uncommon for these malicious documents to execute a long chain of scripts involving macros, Javascript, and PowerShell before downloading the final payload. As a result incident responders and malware analysts need to be comfortable analyzing different document formats, and script languages to make sense of these delivery chains.
In this workshop you will work through the triage of a live malware delivery chain that includes a malicious document, malicious scripts, and a final malware payload. During this process you will be exposed to different document formats, and malscripts while you practice the skills required to manually analyze these delivery chains. This workshop focuses on the fundamental analysis techniques used when identifying, deobfuscating, and analyzing maldocs and malscripts. However, we will also provide an introduction to some free and open source tools that can be used to speed up the analysis process.
This workshop is aimed at junior incident responders, hobby malware analysts, and general security or IT practitioners who are interested in learning more about the malware triage process. If you have no experience with malware analysis but you have a good understanding of scripting languages like VBScript, and Javascript, and you are familiar with windows internals you should have no problem completing the workshop.
You will be provided with a VirtualMachine to use during the workshop, please make sure to bring a laptop that meets the following requirements. Your laptop must have VirtualBox or VMWare installed and working prior to the start of the course. Your laptop must have at least 60GB of disk space free, preferably 100GB. Your laptop must also be able to mount USB storage devices. Make sure you have the appropriate dongle if you need one.
Skill Level Beginner
Prerequisites: None
Materials: Students will be provided with a VirtualMachine to use during the workshop. They will need to bring a laptop that meets the following requirements:
- The laptop must have VirtualBox or VMWare installed and working prior to class.
- The laptop must have at least 60GB of disk space free, preferably 100GB.
- The laptop must be able to mount USB storage devices (ensure you have the appropriate dongle if you need one).
Max students: 35
Registration: https://www.eventbrite.com/e/malware-triage-analyzing-the-modern-malware-delivery-chain-red-rock-ii-tickets-63609242958
(Opens 8-Jul-19)
Sergei Frankoff
Sergei is a co-founder of Open Analysis, and volunteers as a malware researcher. When he is not reverse engineering malware Sergei is focused on building automation tools for malware analysis. Sergei is a strong believer in taking an open, community approach to combating cyber crime. He actively contributes to open source tools and tries to publish as much analysis as possible. With over a decade of experience Sergei has held roles both as the manager of an incident response team, and as a malware researcher.
Sean Wilson
Sean is a co-founder of Open Analysis, and volunteers as a malware researcher. He splits his time between reverse engineering malware and building automation tools for incident response. He is an active contributor to open source security tools focused on incident response and analysis. Sean brings over a decade of experience working in a number of incident response and application security roles with a focus on security testing and threat modelling. In his free time Sean loves fly fishing.
Return to Index - Add to
- ics
Calendar file
HTS - Bally's Event Center - Friday - 15:00-15:30
Maritime cyber policy and regulation
No description available
Return to Index - Add to
- ics
Calendar file
HTS - Bally's Event Center - Friday - 11:30-11:59
Maritime Pen Testing 101: Don’t poop on the poop deck
No description available
Return to Index - Add to
- ics
Calendar file
BCV - Flamingo 3rd Floor - Laughlin III Room - Friday - 14:30-16:10
Mathematical Background of Blockchain Cryptography
No description available
Return to Index - Add to
- ics
Calendar file
BTVW - Flamingo - Lower Level - Valley Of Fire 2 - Friday - 13:30-15:29
MEDIC! Malware Response 101 From The Trenches
Friday 13:30, Valley Of Fire 2, Flamingo (2H)
@krypt3ia
is a security professional with over 13 years experience specializing in areas such as DFIR Ethical Hacking/Pen Testing, Social Engineering Information, Security Auditing, ISO27001, Threat Intelligence Analysis, Steganography Application and Detection.
Many of you out there may be in the information security field but how many of you know how to respond to a phishing and malware outbreak? It seems to be a common theme in companies that the ideal is that tools will be the end all be all in mitigating threats but the reality is that many times one will find themselves staring at a screen of alerts about malware and phishing waves coming in and no one really knows how to approach reversing the malware quickly and responding appropriately on a shoe string, which, many companies sadly find themselves doing. This workshop will show you how to triage a malware situation using tools and techniques easily found online. With a little know how and understanding of how malware works outside of the exotic APT you hear about, you too can learn how to respond without the benefit of a huge budget for security tools and even perhaps enough responders.
Return to Index - Add to
- ics
Calendar file
BHV - Planet Hollywood - Melrose 1-3 Rooms - Friday - 19:15-19:59
7:15 PM: Medical Device Incident Response, Forensics, and ITs Challenges
Speaker: Sam Buhrow
Abstract: Performing incident response (IR) and forensics on Medical devices is met with unique challenges due to manufacturers focus on longevity, but not security. This creates an environment with OSs that are outdated, making live acquisitions almost impossible and conducting Dead Box forensics a standard practice. In this talk, we will cover some of the experiences we have had with medical device forensics, artifacts found (and not found), and the unique security concerns encountered.
Speaker Bio: Sam is a cybersecurity practitioner that has had the opportunity to do, manage, or lead nearly every role in cyber, and has been in every vertical except Energy. Sam was told he wouldnt go to college by his high school counselor. He graduated Summa Cum Laude.
Return to Index - Add to
- ics
Calendar file
BHV - Planet Hollywood - Melrose 1-3 Rooms - Friday - 12:30-14:30
12:30 PM: Medical Simulations Panel
Speaker:
Abstract:
Speaker Bio:
T:
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Friday - 13:00-13:30
Title:
Migrating to quantum-safe cryptography to protect against the quantum hackers - Christian Paquin
ABSTRACT
A non-trivial quantum computer would break the public key cryptography in use today. They might be at least a decade away, but nothing prevents adversaries to record and store selected internet traffic today for later quantum-assisted decryption. It is therefore prudent to start the migration to quantum-safe cryptography.
NIST is well underway in its post-quantum standardization process. Adoption of these quantum-safe alternatives will however depend on the progress in integrating them into internet standards and systems. We describe how TLS and SSH can be adapted to use post-quantum cryptography. We examine various design considerations and report on our experiences in adding post-quantum and hybrid key exchange and authentication to these protocols. We describe the Open Quantum Safe project, which enables developers and researchers to experiment with post-quantum cryptography in various languages, applications, and protocols, including via our forks of OpenSSL and OpenSSH.
Finally, we report on the performance of this new cryptography, and demonstrate conventional and post-quantum hybrid TLS 1.3 and SSH connections.
BIO
Christian Paquin - I am a crypto specialist in Microsoft Research's Security and Cryptography team. Im currently involved in projects related to post-quantum cryptography, such as the Open Quantum Safe project. Im also leading the development of U-Prove, a privacy-enhanced authentication technology. In my time at MSR, Ive worked on projects involving various privacy-enhancing technologies, smart cloud encryption (e.g., searchable and homomorphic encryption), and the intersection of AI and security. Prior to joining Microsoft in 2008, I was the Chief Security Engineer at Credentica, a crypto developer at Silanis Technology working on digital signature systems, and a security engineer at Zero-Knowledge Systems working on TOR-like systems.
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Friday - 15:00-15:59
Title:
MITM mixed mode butterfly key privacy attack - Ben Brecht
ABSTRACT
Butterfly key expansion (BKE) is a somewhat novel concept to create almost indefinitely new matching public and private keys independently of each other based on a seed (or caterpillar) key pair and a shared expansion function. Although this concept was invented for credential provisioning to Vehicle-to-Everything (V2X) communication devices (DOI:10.1109/VNC.2013.6737583) these characteristics makes it interesting for all low bandwidth, low computational power, low secure storage devices. The BKE protocol allows for efficient generation of massive amounts of certificates with no single PKI component knowing which certificate belongs to which device - as required in V2X communication. The approach has since been utilized and implemented and is about to be standardized in IEEE 1609.2.1. One optimization of the butterfly key expansion protocol is called "unified butterfly key expansion" (UBK) (https://eprint.iacr.org/2018/089.pdf), which is about to be included in IEEE 1609.2.1 as well. While learning about this protocol and being involved in the deployment of PKI systems implementing it, I discovered an issue with a scenario where some CAs would implement the "traditional" BKE mechanism and other CAs the UBK approach - which is happening, e.g., in the US, where BKE is already in production and UBK will be soon: the RA in this case could pretend to implement UBK, where in fact it works with a BKE CA. This way the RA could break one of the central privacy characteristics of the butterfly key expansion protocol: no single PKI component is able to know which public keys/certificates belong to the same device.
BIO
Ben started his career in the automotive industry in 2010. Since 2013, he has been a Program Manager responsible for the global rollout of connected car technology. He was assigned to work in the U.S. to work on Vehicle-to-Everything (V2X) security in 2015. He is currently the Vice Chair of the 5GAA WG7 "security & privacy" and involved in security topics for V2X communication.
Return to Index - Add to
- ics
Calendar file
RGV - Flamingo - 3rd Floor - Carson City II - Friday - 14:00-14:59
Title:
Modern Rogue
Brian Brushwood of the Modern Rogue discuss some of their unique applications of and approaches to being a Rogue in the present day.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 4 - Friday - 13:00-13:45
More Keys Than A Piano: Finding Secrets In Publicly Exposed Ebs Volumes
Friday at 13:00 in Track 4
45 minutes | Demo, Tool
xBen "benmap" Morris Security Associate, Bishop Fox
Did you know that Elastic Block Storage (Amazon EBS) has a "public" mode that makes your virtual hard disk available to anyone on the internet? Apparently hundreds of thousands of others didn't either, because they're out there exposing secrets for everyone to see.
I tore apart the petabytes of data for you and have some dirty laundry to air: encryption keys, passwords, authentication tokens, PII, you name it and it's here. Whole (virtual) hard drives to live sites and apps, just sitting there for anyone to read. So much data in fact that I had to invent a custom system to process it all.
There's a massive Wall of Sheep out there on the internet, and you might not have even noticed that you're on it. Actually, you should stop reading and go check that out right now.
xBen "benmap" Morris
Ben Morris is a Security Associate at Bishop Fox, a consulting firm providing cybersecurity services to the Fortune 500, global financial institutions, and high-tech startups. In this role, he focuses on application penetration testing, network penetration testing, and red-teaming.
Ben also enjoys performing drive-by pull requests on security tools and bumbling his way into vulnerabilities in widely used PHP and .NET frameworks and plugins. Ben has also contributed to Root the Box, a capture the flag security competition.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 1 - Friday - 15:00-15:45
MOSE: Using Configuration Management for Evil
Friday at 15:00 in Track 1
45 minutes | Demo, Tool
Jayson Grace Penetration Tester, Splunk
Configuration Management (CM) tools are used to provision systems in a uniform manner. CM servers are prime targets for exploitation because they are connected with key machines. The tools themselves are powerful from a security standpoint: they allow an attacker to run commands on any and every connected system. Unfortunately, many security professionals do not have CM experience, which prevents them from using these tools effectively. MOSE empowers the user to weaponize an organization’s CM tools without having to worry about implementation-specific details.
MOSE first creates a binary based on user input. Once transferred to the CM server and run, this binary dynamically generates code that carries out the desired malicious behavior on specified systems. This behavior can include running arbitrary system commands, creating or deleting files, and introducing backdoors. MOSE puts the generated code in the proper place so that all targeted systems will run it on their next check-in with the server, removing the need for the user to integrate it manually.
CM tools are a powerful resource, but they have a barrier to entry. MOSE aims to remove this barrier and make post exploitation more approachable by providing a tool to translate the attacker's desired task into commands executable by the CM infrastructure.
Jayson Grace
Jayson Grace is a Penetration Tester on the Product Security Team at Splunk. Previously he founded and led the Corporate Red Team at Sandia National Laboratories. He holds a BS in Computer Science from the University of New Mexico, which gave him some great knowledge and also made him fatter and added a bunch of grey hairs. He has also previously worked as a tool developer, system administrator, and DevOps engineer. Jayson is passionate about empowering engineers to create secure applications, as well as coming up with novel automation methods to break things.
Twitter: @Jayson_Grace
Website:
https://techvomit.net
Return to Index - Add to
- ics
Calendar file
Night Life - Planet Hollywood - Melrose 4 - Friday - 20:00-21:30
Title:
Movie Night - Logan's Run
The world is clean and bright, and everyone is pretty, but hang on to 29 as long as you can.
Return to Index - Add to
- ics
Calendar file
Night Life - Planet Hollywood - Melrose 4 - Friday - 22:00-23:30
Title:
Movie Night - Star Trek: The Motion Picture
OG Status. Even when the effects were rudimentary and the line readings... were...peculiar.. Star Trek saw a future where mankind had transcended scarcity and war and needed to venture outward to find social strife to meddle in. Also, LCARS.
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Napoleon's Piano Bar - Friday - 23:00-23:59
Title:
Music - Acid-T a.k.a DJ SmOke
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Track 1 - Vendome ABC - Friday - 22:00-22:59
Title:
Music - Amplitude Problem ft. YT Cracker - GLOWZONE
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Napoleon's Piano Bar - Friday - 25:00-25:59
Title:
Music - ASHSLAY
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Planet Hollywood - Gallery Nightclub - Friday - 24:00-24:59
Title:
Music - DJ St3rling - GLOWZONE
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Planet Hollywood - Gallery Nightclub - Friday - 25:00-25:59
Title:
Music - DJ%27 - GLOWZONE
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Track 1 - Vencome ABC - Friday - 23:45-24:30
Title:
Music - Dualcore - GLOWZONE
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Track 1 - Vendome ABC - Friday - 21:00-21:59
Title:
Music - E.ghtB.t - GLOWZONE
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Planet Hollywood - Gallery Nightclub - Friday - 22:00-22:59
Title:
Music - Icetre Normal - GLOWZONE
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Track 1 - Vendome ABC - Friday - 25:15-26:15
Title:
Music - Magik Plan
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Track 1 - Vendome ABC - Friday - 24:30-25:15
Title:
Music - MC Frontalot - GLOWZONE
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Planet Hollywood - Gallery Nightclub - Friday - 23:00-23:59
Title:
Music - Miss Jackalope - GLOWZONE
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Napoleon's Piano Bar - Friday - 22:00-22:59
Title:
Music - S7a73farm
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Napoleon's Piano Bar - Friday - 21:00-21:59
Title:
Music - Steph Infection
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Planet Hollywood - Gallery Nightclub - Friday - 21:00-21:59
Title:
Music - Terrestrial Access Network - GLOWZONE
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Napoleon's Piano Bar - Friday - 24:00-24:59
Title:
Music - Wil Austin
No description available
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Track 1 - Vendome ABC - Friday - 23:00-23:45
Title:
Music - YT Cracker - GLOWZONE
No description available
Return to Index - Add to
- ics
Calendar file
ICS - Bally's Event Center - Friday - 16:00-16:30
Nation State Supply Chain Attacks for Dummies -or- Chipping Cisco Firewalls
August 9, 2019 4:00 PM
Back in October 2018, Bloomberg recounted a Chinese supply-chain attack on Supermicro motherboards used in servers for Amazon, Apple and more. Here is how I replicated it, on a Cisco firewall, with a shoestring budget, and how you can too.
Speaker Information
Panelist Information
Coke & Strippers YouTube Channel
The award winning Monta Elkins is known as the infamous creator of the diet Coke and wire Strippers electronics youtube channel, aka Coke & Strippers for short: https://tinyurl.com/y6vpmbw4 As a small child, Monta entertained himself by memorizing Pi -- backwards
Return to Index - Add to
- ics
Calendar file
HTS - Bally's Event Center - Friday - 12:00-12:30
National Security Council and Special Assistant for Cyber
No description available
Return to Index - Add to
- ics
Calendar file
HTS - Bally's Event Center - Friday - 16:00-16:30
Navigation including ECDIS, GPS, and radar
No description available
Return to Index - Add to
- ics
Calendar file
AIV - Bally's Resort (Indigo) Tower 26th Floor - Skyview Room 3 - end - Friday - 13:00-13:30
Network defenders in a data scientist world
No description available
Return to Index - Add to
- ics
Calendar file
WLV - Bally's - Palace Meeting Rooms 1-7 - off hallway to Event Center - Friday - 10:30-11:25
Iceman
Bio
Iceman is administrator for the Proxmark3 forum, maintainer of github Proxmark3 repo, iceman fork of chameleon mini and Proxmark3. Some people might even say that I know one or two things about Proxmark3, Usually looking into all kind of rfid based systems.
@herrmann1001
News from Proxmark land
Abstract
The presentation will give your a view from then to now and future happenings of the Proxmark3 realm.
|
Return to Index - Add to
- ics
Calendar file
IOT - Flamingo 3rd Floor - Eldorado Ballroom - Friday - 16:15-16:59
Traditional IoT botnets operate pretty much like shooting fish in a barrel. With an elephant gun. A service running on a port. A weak password or a lame vulnerability and you've got yourself a few hundred thousand zombies. This "space", however, is getting crowded and botnet masters will start looking for alternatives. This talk will show one of the possible futures - leveraging cloud platforms to mass hack hundreds of thousands of devices. We'll start with a quick 'n dirty crash course for those just getting started with IoT hacking, a brief glimpse into the current status of IoT botnets and get down to business with showing our research on a few popular IoT brands with demos for each finding. Worth mentioning that some of the vulnerabilities haven't been patched at the time of this submission (6 months after our initial report to the vendor) so odds are that we'll be popping some connect-back shells from cameras behind NAT live, on stage.
Bio:
Alex "Jay" Balan is the Chief Security Researcher and Spokesperson for Bitdefender. His career is focused on Information Security, Innovation and Product Strategy, fields in which he has so far accumulated over 15 years of experience. He drove the vision for Bitdefender's UNIX-based security solutions before kickstarting an ambitious project that would advance the company's R&D department and steer a good part of the company's focus towards technology and innovation.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 3 - Friday - 13:00-13:45
No Mas – How One Side-Channel Flaw Opens Atm, Pharmacies and Government Secrets Up to Attack
Friday at 13:00 in Track 3
45 minutes | Demo, Exploit
phar ioactive
Hacking ‘high security’ electronic locks has become a bit of a hobby, but what if you identify an unpatchable design pattern that unlocks buckets of cash and government secrets? How long do wait before telling ‘people’? let’s talk about how these locks are designed, where they fail and we can rip this band-aid off together.
phar
Mike Davis is a hardware security researcher and consultant with IOActive, and for some reason still responds to ‘phar’.
Return to Index - Add to
- ics
Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Friday - 15:00-15:59
Old Tech vs New Adversaries. Round 1... Fight!
Joseph Muniz, Security Architect at Cisco
Aamir Lakhani, Lead Researcher at Fortinet
Security venders are struggling to keep up with the tactics used by adversaries. What happens when you use really old technology as a security strategy rather than bleeding edge tech? Can ransomware infect a Commodore 64 or Windows 3.0? What happens when malware attempts to compromise a Sega Genesis? Could an adversary successfully pivot and exfiltrate data from a network running CatOS? This talk will answer these and other questions regarding how modern threats react to really old technology. Research includes running various forms of modern malware on old technologies as well as permitting cybercriminals access to really old networks to see how they handle the situation. Speakers are authors of a handful of books including a recent title on digital forensics.
Joseph Muniz (Twitter: @SecureBlogger) and Aamir Lakhani (Twitter: @aamirlakhani) together have spoken at various conferences including the infamous Social Media Deception RSA talk quoted by many sources found by searching "Emily Williams Social Engineering". Both speakers have written books together including a recent title "Digital Forensics for Network Engineers" released on Cisco Press late February 2018. They have been friends for years and continue to collaborate on research and other projects.
Return to Index - Add to
- ics
Calendar file
AIV - Bally's Resort (Indigo) Tower 26th Floor - Skyview Room 3 - end - Friday - 10:00-10:15
Opening Remarks
No description available
Return to Index - Add to
- ics
Calendar file
HTS - Bally's Event Center - Friday - 11:00-11:30
Opening Remarks
No description available
Return to Index - Add to
- ics
Calendar file
WLV - Bally's - Palace Meeting Rooms 1-7 - off hallway to Event Center - Friday - 13:00-13:55
Kent Britain
Bio
Kent Britain has developed over 1000 specialized antennas for Government Agencies, Military Programs, Commerical Products, and Hobby uses Come listen to ways to improve your receive system.
Alex Zakharov
Bio
Optimizing Antennas, Filters, and Amps for your SDR
Abstract
Care and feeding of Software Defined Radios We will cover the various kinds of antennas available to optimized your SDR radio for different types of spectrum monitoring. We will also explain why RF filters are necessary on most SDR's and when Low Noise Amplifiers help, and when Low Noise Amplifiers hurt reception.
|
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 6 - Friday - 14:00 - 15:50
OSfooler-NG: Next Generation of OS fingerprinting fooler
Friday from 14:00 – 15:50 in Sunset 6 at Planet Hollywood
Audience: Defense
Jaime Sanchez
An outsider has the capability to discover general information, such as which operating system a host is running, by searching for default stack parameters, ambiguities in IETF RFCs or non-compliant TCP/IP implementations in responses to malformed requests. By pinpointing the exact OS of a host, an attacker can launch an educated and precise attack against a target machine. There are lot of reasons to hide your OS to the entire world: Revealing your OS makes things easier to find and successfully run an exploit against any of your devices. Having and unpatched or antique OS version is not very convenient for your company prestige. Imagine that your company is a bank and some users notice that you are running an unpatched box. They won't trust you any longer! In addition, these kind of 'bad' news are always sent to the public opinion. Knowing your OS can also become more dangerous, because people can guess which applications are you running in that OS (data inference). For example if your system is a MS Windows, and you are running a database, it's highly likely that you are running MS-SQL. It could be convenient for other software companies, to offer you a new OS environment (because they know which you are running). And finally, privacy; nobody needs to know the systems you've got running. OSfooler was presented at Blackhat Arsenal 2013. It was built on NFQUEUE, an iptables/ip6tables target which delegate the decision on packets to a userspace. It transparently intercepted all traffic that your box was sending in order to camouflage and modify in real time the flags in TCP/IP packets that discover your system. OSfooler-NG has been complete rewriten from the ground up, being highly portable, more efficient and combining all known techniques to detect and defeat at the same time: Active remote OS fingerprinting: like Nmap Passive remote OS fingeprinting: like p0f v2 Commercial engines like Sourcefire’s FireSiGHT OS fingerprinting Some additional features are: No need for kernel modification or patches Simple user interface and several logging features Transparent for users, internal process and services Detecting and defeating mode: active, passive & combined Will emulate any OS Capable of handling updated nmap and p0f v2 fingerprint database Undetectable for the attacker
https://github.com/segofensiva/OSfooler-ng
Jaime Sanchez
Jaime Sánchez (aka @segofensiva) has worked for over 20 years as a specialist advisor for large national and international companies, focusing on different aspects of security such as consulting, auditing, training, and ethical hacking techniques. He holds a Computer Engineering degree and an Executive MBA. In addition, he holds several certifications, like CISA , CISM , CISSP , just to name a few, and a NATO SECRET security clearance, as a result of his role as advisory of many law enforcement organizations, banks and large companies in Europe and Spain. He has spoken in renowned security conferences nationally and internationally, as in RootedCON , Nuit du Hack , Black Hat , Defcon , DerbyCON , NocOnName , Deepsec , Shmoocon or Cyber Defence Symposium , among others. As a result of his researches, he has notified security findings and vulnerabilities to top companies and vendors, like Banco Popular, WhatsApp, Snapchat, Microsoft, Apple etc. He is a frequent contributor on TV (TVE, Cuatro, LaSexta, Telecinco), press (El Pais, El Mundo, LA Times, NBC News) and radio programs, and writes a blog called 'SeguridadOfensiva'
Return to Index - Add to
- ics
Calendar file
RCV - Planet Hollywood - Celebrity 5 Ballroom - Friday - 15:15-15:40
Return to Index - Add to
- ics
Calendar file
SEV - Bally's Jubilee Tower - 3rd Floor - Las Vegas Ballroom - Friday - 17:05-17:35
Friday August 09 2019 1705 30 mins
OSINT in The Real World
Practical OSINT techniques are not just applicable in a day-to-day infosec job but can also benefit every aspect of your life. Expressed through personal stories and walk-throughs of real investigations I will show you how OSINT makes you more effective at any job and safer in the real world.
Ryan MacDougall: @joemontmania
Ryan MacDougall is a Senior Social Engineer Pentester for Social-Engineer LLC, who has over 20 years’ experience in the information technology world and 6 years in the security space specifically. Currently a trainer for SECOM’s OSINT classes which have been seen at Blackhat, DerbyCon, and numerous public and private sessions.
Return to Index - Add to
- ics
Calendar file
BCV - Flamingo 3rd Floor - Laughlin III Room - Friday - 12:30-13:20
Panel Discussion: Privacy : Enabler or Hindrance to the Success of Blockchain based currencies
No description available
Return to Index - Add to
- ics
Calendar file
DC - Planet Hollywood - Firesides Lounge - Friday - 22:15-22:59
Panel: DEF CON Groups
Friday at 22:15 in Firesides Lounge
45 minutes
Brent White / B1TK1LL3R Global Coordinator
Jayson E. Street Ambassador
Darington Web Master
April Wright Welcoming Committee & Liaison
Tim Roberts (byt3boy) Volunteer
Casey Bourbonnais Volunteer
s0ups Social media
Do you love DEF CON? Do you hate having to wait for it all year? Well, thanks to DEF CON groups, you're able to carry the spirit of DEF CON with you year round, and with local people, transcending borders, languages, and anything else that may separate us!In this fireside chat, your DEF CON groups team who works behind the scenes to make DCG possible will invite group leaders to share how they started their groups, how they found meeting space, how they decide what content to present each meeting, and other topics. Potential new group leaders can find out how to start and run a local group, and existing group leaders and members can share and get operational ideas for running the best group possible. During the Fireside chat, we'll have the ability to keep it an open forum for questions and ideas, as well as a great opportunity to meet other groups.
Brent White / B1TK1LL3R
Twitter: @brentwdesign
Jayson E. Street
Twitter: @jaysonstreet
Darington
Twitter: @darington
April Wright
Twitter: @aprilwright
Tim Roberts (byt3boy)
Twitter: @ZanshinH4x
Casey Bourbonnais
Twitter: @Bourbonnais_c
s0ups
Twitter: @ynots0ups
Return to Index - Add to
- ics
Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Friday - 16:00-16:59
Patching: It's Complicated
Cheryl Biswas
Patching – it's complicated. Organizations at every level struggle with security updates in a fundamental process that seems more like a necessary evil than a best practice. The fact is, one size does not fit all when security patches get issued and things can go very wrong. What actually determines enterprise patching cycles? How should we prepare for the pernicious spread of unpatched BYOD that gets connected? We need to go beyond just finding the sweet spot between mitigating business risk with vulnerability exposure. Because the cure isn't supposed to be worse than the disease.
Cheryl Biswas (Twitter: @3ncr1pt3d) is a Strategic Threat Intel Analyst with a major bank in Toronto, Canada. Previously, she was a Cyber Security Consultant with KPMG and worked on security audits and assessment, privacy, breaches, and DRP. Her experience includes project management, vendor management and change management. Cheryl holds an ITIL certification and a degree in Political Science. Her areas of interest include APTs, mainframes, ransomware, ICS SCADA, and building threat intel. She actively shares her passion for security online, as a speaker and a volunteer at conferences, and by encouraging women and diversity in Infosec as a founder and member of the "The Diana Initiative".
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 2 - Friday - 12:00 - 13:50
PcapXray
Friday from 12:00 – 13:50 in Sunset 2 at Planet Hollywood
Audience: Defense, Forensics, Networks
Srinivas Piskala Ganesh Babu
PcapXray is a Network Forensics tool that performs pcap visualization to help/speed up traffic investigation offline. [ in n00b terms, Draws a Network Map and Highlights what needs to be looked for in a packet capture. ]
* Creates visual drawing (map) of a pcap file and highlights/extracts details for faster/robust traffic forensics/analysis
* Reverse Engineer a Pcap [Packet Capture] File ( Wireshark always is the best goto ), PcapXray plays as a sidecar to speed things up with the investigation ( where/what to look at/for? )
* Promote navigation of a packet capture
* Accomplish Simple goal In the best way ( I could not easily find an offline tool to draw/map/highlight a pcap file ) --> [ Just for Security Fun! ]
Capabilities include
* Converting a packet capture into a diagram/graph/visual representation
* Segregating and filtering with respect to traffic type, the current list includes HTTP, HTTPS, Tor, Possible Malicious, ICMP, DNS
* Extracting payload and present traffic on a session/flow basis
* Enriching the traffic data with host scans to generate Reports
* Identifying covert communication and possibility to extract files included in the traffic
https://github.com/Srinivas11789/PcapXray
Srinivas Piskala Ganesh Babu
Sri is a Security Software Engineer at Oblong Industries spending time on collaborative-conferencing platform security. During other times, he has fun with security, capturing flags & building tools at https://srinivas11789.github.io and github.com/srinivas11789.
Return to Index - Add to
- ics
Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 14:45-15:15
14:45-15:15
Perspectives of Privacy: Blockchain as a Boundary Object
Robin “midipoet” Renwick, Ph.D
This talk presents the methodology, findings and conclusions of a boundary theory based Information Systems research project completed at University College Cork, Ireland. Perspectives of privacy have been analyzed from five key social worlds within the blockchain industry (users, regulators, cryptographic researchers, corporate architects, and protocol developers) through semi-structured interviews, conducted in 2018. The study attempts to distinguish the similarities and differences that exist between interdependent groups of agents. Communicating benign and internecine perspectives, ideologies, and approaches to the development of privacy enhancing technologies is viewed as method through which conflict and division may be mitigated against as the industry evolves further into the 21st century.
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 2 - Friday - 10:00 - 11:50
PhanTap (Phantom Tap)
Friday from 10:00 – 11:50 in Sunset 2 at Planet Hollywood
Audience: Red Teams, it could also be used by Blue Teams.
Diana Dragusin & Etienne Champetier
PhanTap (phantom tap) is an ‘invisible’ network tap aimed at red teams. With limited physical access to a target building, this tap can be installed inline between a network device and the corporate network. PhanTap is silent in the network and does not affect the victim’s traffic, even in networks having NAC (Network Access Control 802.1X - 2004). PhanTap will analyze traffic on the network and mask its traffic as the victim device. It will mount a tunnel back to a remote server, giving the attacker a foothold in the network for further exploitation and pivoting. The physical device for PhanTap is currently a small, inexpensive and disposable router running OpenWrt, we've been testing the GL.iNet GL-AR150. Moreover, PhanTap is fully based on Linux packages and can be ported to any Linux distribution.
Diana Dragusin
Diana Dragusin is currently a Senior Security Consultant at NCC Group, where she performs a variety of types of penetration tests, with a focus on networks, hardware, and embedded systems. Diana previously worked as a Network Security Architect, with the goal of building more secure internal and external infrastructures. In addition to hardware hacking, Diana also enjoys applying her creativity and curiosity to world travel and the culinary arts.
Etienne Champetier
Etienne Champetier is an Operations Engineer at Anevia (a video software company). Day to day he troubleshoots complex ecosystems with lots of vendors and moving parts (i.e. uses tcpdump and strace), automates everything he can with Ansible, helps migrate Anevia softwares to Kubernetes, and does all kinds of small developments. He loves to understand how everything works and he contributes to open source software, like OpenWrt, when he can (@champtar on Github).
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 5 - Friday - 12:00 - 13:50
Phishing Simulation
Friday from 12:00 – 13:50 in Sunset 5 at Planet Hollywood
Audience: Defense
Jyoti Raval
Phishing Simulation tool mainly aims to increase phishing awareness & understanding by providing an intuitive tutorial and customized assessment to assess people's action on any given situation without performing actual phishing activity; and further gives analysis of what is the current awareness posture of targeted users.
The tool has below modules:
- Tutorial -> To increase the awareness by providing an interactive and intuitive tutorial
- Assessment -> To evaluate the current understanding and actions of user on any given situation
- Setup Test -> This module let's any user to create the customized campaign and target multiple users at same time
- Analysis -> Graphical representation to understand the current awareness posture
https://github.com/jenyraval/Phishing-Simulation
Jyoti Raval
Jyoti Raval works as a Senior Web Application Security Analyst with Qualys. Jyoti is responsible for researching on improving Dynamic Application Security Testing(DAST)Tool, perform web application pen-testing; and understanding new security trends. She is also OWASP Pune chapter leader. She loves to assess things and hence presenting an assessment tool ;)
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 2 - Friday - 12:00-12:45
Phreaking Elevators
Friday at 12:00 in Track 2
45 minutes | Demo
WillC
This is a comprehensive dive into the current emergency phones with an in-depth look at the phones used in elevators. This talk will provide unique insight into a topic that hasn't been covered before: Elevator Phones. During this talk, I will discuss the commonality between elevator phone brands. I will cover a new, never before released, set of default passwords these system use. I will show a tool kit and how to use it to access elevator phones locally, as well as remotely. In addition, I will show how to reprogram a phone , how to make the elevator state its location, and how to alert the passenger that help is on the way. Finally, I will demonstrate some attacks, including how you can use elevator phones as listening devices to silently listen to conversations of people inside an elevator. I’m WillC, your elevator operator, let's go for a ride!
WillC
Will has grown up with a passion for making things. He has done a number of high voltage projects and recently been taking in interest in information security competing in a number of different CTFs across the country. Will also helps run the Car Hacking Village. He works bringing in the infosec and maker community to Macchina.
Twitter: @Willcaruana
Return to Index - Add to
- ics
Calendar file
RGV - Flamingo - 3rd Floor - Carson City II - Friday - 17:00-17:59
Title:
Pickpocketing Workshop
Pickpocketing Workshop with James Harrison. Space will be limited. Sign-up is available
here.
Return to Index - Add to
- ics
Calendar file
RGV - Flamingo - 3rd Floor - Carson City II - Friday - 16:00-16:59
Title:
Pickpocketing
James Harrison, a magician and pickpocket, demonstrates his skills on stage, and shows us how we may apply some of these principles to larger approaches in Social Engineering.
Return to Index - Add to
- ics
Calendar file
ICS - Bally's Event Center - Friday - 15:00-15:30
Pin the tail on the cyber owner
August 9, 2019 3:00 PM
Determining who owns cyber risk when securing ICS in plants and facilities can be a bit of a challenge; there are owners of assets, technologies, operations, management, and even investors/governments. Security issues, gaps, and outright holes can quickly become “incidents" if proper ownership is not understood. Here, we will play a game to determine who has ownership of the things that can break -- that is, when a plant experiences a loss of operational view, denial of control, or manipulation of sensors or instruments.
Speaker Information
Panelist Information
GRIMM
Ryan is a Principal at GRIMM, a boutique cybersecurity consultancy. He brings a unique perspective to how things break and why organizations should care. Enjoy the talk.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 1 - Friday - 16:00-16:30
Please Inject Me, a x64 Code Injection
Friday at 16:00 in Track 1
20 minutes | Demo
Alon Weinberg Security Researcher, Deep Instinct
Malware authors are always looking for new ways to achieve code injection, thereby allowing them to run their code in remote processes. Code Injection allows hackers to better hide their presence, gain persistence and leverage other processes’ data and privileges.
Finding and implementing new, stable methods for code injection is becoming more and more challenging as traditional techniques are now widely detected by various security solutions or limited by native OS protections.
Inject-Me is a new method to inject code to a remote process in x64. Inject-Me is in fact “injection-less” – the remote (target) process is manipulated to read data from the injecting process, copy and execute it. The manipulation is mainly based on abusing ReadProcessMemory and calling conventions in X64. In addition to presenting Inject-Me, the talk will mention a generalized approach to copying data in remote processes to recreate shellcode from the injecting process.
Alon Weinberg
Alon Weinberg is a security researcher at Deep Instinct. Prior to joining Deep Instinct two years ago, Alon served in the IDF for 4.5 years in an elite cyber unit as a security researcher.
As part of his role in Deep Instinct, Alon is in charge of finding new ways to enhance and develop protection and defense mechanisms. Alon leverages his experience in offensive operations, OS internals and programming to explore attack surfaces in Windows and macOS, analyze malware and research attack vectors and evasion techniques. Alon is a cross-fit junky and enjoys riding his motorcycle whenever his training routine allows it.
LinkedIn: https://www.linkedin.com/in/alon-weinberg-2a7742142/
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 1 - Friday - 16:30-16:50
Poking the S in SD cards
Friday at 16:30 in Track 1
20 minutes | Demo, Tool, Exploit
Nicolas Oberli Cybersecurity Expert, Kudelski security
Ever wonder why the S in SD cards stands for Secure? Well, it turns out that it is possible to read and/or write protect these cards by software using specific commands. As you might expect, this process isn’t as "secure" as the name implies leading to multiple issues. This talk will present some of these features and the vulnerabilities discovered while poking at cards from various manufacturers. The equipment used in this talk is quite easily attainable allowing for easy replication and learning about these attacks.
Nicolas Oberli
Nicolas works as a security researcher for Kudelski Security in Switzerland. His research focuses on embedded devices and communication protocols. In his spare time, he now spends more time designing CTF challenges than solving them. He is also one of the main developers of the Hydrabus hardware hacking tool and part of the BlackAlps security conference committee.
Twitter: @Baldanos
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 4 - Friday - 14:00-14:45
Practical Key Search Attacks Against Modern Symmetric Ciphers
Friday at 14:00 in Track 4
45 minutes | Demo
Daniel "ufurnace" Crowley Research Baron, X-Force Red
Daniel Pagan Student, Georgia Tech
In theory, brute force key recovery attacks against modern ciphers like AES should be impractical with the current state of computer hardware. It's often said that recovering an AES key should take longer than the remainder of the life of the sun. However, this assumes that keys are chosen properly, and that there is no way to determine whether a key is the correct one after a candidate key is used to decrypt a captured ciphertext.
In practice, these conditions do not always hold. In much the same way that hash functions are impossible to reverse but hash cracking is still a practical attack, in the real world it is often possible to perform practical key search attacks. In this talk, we will discuss the common mistakes and common conditions that allow for practical brute force recovery of keys for modern block ciphers such as AES. We will also discuss optimizations to speed up key search efforts, and present our FOSS tool, which implements our approach.
Daniel "ufurnace" Crowley
Daniel Crowley is the head of research and a penetration tester for X-Force Red. Daniel denies all allegations regarding unicorn smuggling and questions your character for even suggesting it. Daniel is the primary author of both the Magical Code Injection Rainbow, a configurable vulnerability testbed, and FeatherDuster, an automated cryptanalysis tool. Daniel enjoys climbing large rocks and is TIME magazine's 2006 person of the year. Daniel has been working in the information security industry since 2004 and is a frequent speaker at conferences including Black Hat, DEF CON, Shmoocon, and SOURCE. Daniel does his own charcuterie and brews his own beer. Daniel's work has been included in books and college courses. Daniel also holds the noble title of Baron in the micronation of Sealand.
Daniel Pagan
Daniel Pagan is a student at Georgia Tech, a DEF CON TV goon, and a Lord in the micronation of Sealand.
Return to Index - Add to
- ics
Calendar file
CLV - Flamingo 3rd Floor - Reno I Room - Friday - 16:00-17:59
Pragmatic Cloud Security Automation
Speaker: Rich Mogull
Twitter: @rmogull
Abstract: Automating cloud security operations takes a little more than slapping together a quick lambda to fix an open S3 bucket (but that isn't a bad start). In this workshop we will cover the major categories of security automations and present practical implementation techniques. Come prepared to build your own (or use our starter scripts) as we:
- Review the three major categories of automations- guardrails, workflows, and orchestrations.
- Build demo versions of each (in AWS, bring your own account), incorporating techniques including assessments, event-driven guardrails, and an incident response workflow.
- See demonstrations of cross-product orchestrations that integrate commercial tools.
- Learn the tricks of the trade, based on 10 years of hands-on research and implementation (for realz, check the intertubes if you don't believe us).
- See what it takes to implement automations at global scale.
About Rich: Rich Mogull, Analyst & CEO.Rich has twenty years experience in information security, physical security, and risk management. These days he specializes in cloud security and DevSecOps, having starting working hands-on in cloud nearly 10 years ago. He is also the principle course designer of the Cloud Security Alliance training class, primary author of the latest version of the CSA Security Guidance, and actively works on developing hands-on cloud security techniques. Prior to founding Securosis, Rich was a Research Vice President at Gartner on the security team. Prior to his seven years at Gartner, Rich worked as an independent consultant, web application developer, software development manager at the University of Colorado, and systems and network administrator.
Rich is the Security Editor of TidBITS and a frequent contributor to industry publications. He is a frequent industry speaker at events including the RSA Security Conference, Black Hat, and DefCon, and has spoken on every continent except Antarctica (where he's happy to speak for free -- assuming travel is covered).
Return to Index - Add to
- ics
Calendar file
IOT - Flamingo 3rd Floor - Eldorado Ballroom - Friday - 15:15-15:59
"Remember the good old fun sport, where people bought random hard drives from eBay and did forensics on them?
Did you know you can do the same thing with used IoT devices too? Most end-users have no idea what kind of information their devices are storing and how to securely clean their devices (if that even is possible). Lets explore together what the risks are and how we can extract that data.
Many IoT devices collect a lot of data and log files. Of course, most of this data is sent to the Cloud. However, often this data is also stored locally on the device and never deleted in the lifetime of those devices, not even on a factory reset (in contrast to Smart Phones nowadays). This might surprise many people, and especially end users might not be aware of that. Due to the design of IoT devices, there is usually no real way, like for notebooks or PCs, for end users to clean the devices before they sell them on eBay or discard them. The devices may hold sensitive information like Wi-Fi credentials, nearby access points, cloud communication log files, maps, or audio samples.
In this talk I will show some examples of interesting IoT devices from various vendors and how to extract the corresponding information.
We will use software methods (rooting) and hardware methods (flash dumping). Using this information, I will show how I am able to find the original owner of the device. Also I discuss various challenges and tricks of the methods, and how to prevent this kind of data leakage for yourself.
Bios:
Dennis is a grad student at Northeastern University and TU Darmstadt. He was a member of one European ISP's CERT for several years. While being interested in physical security and lockpicking, he enjoys applied research and reverse engineering malware and all kinds of smart devices. His latest area of research is reverse engineering of various IoT ecosystems. He has presented at the Chaos Communication Congress, REcon BRX and DC 26.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 1 - Friday - 12:00-12:45
Process Injection Techniques - Gotta Catch Them All
Friday at 12:00 in Track 1
45 minutes | Tool
Itzik Kotler Co-Founder & CTO at SafeBreach
Amit Klein VP Security Research at SafeBreach
When it comes to process injection in Windows, there are only 6-7 fundamental techniques, right? Wrong. In this talk, we provide the most comprehensive to-date “Windows process injection” collection of techniques. We focus on Windows 10 x64, and on injections from running 64-bit medium integrity process to another running 64-bit medium integrity process, without privilege elevation. We pay special attention to the new Windows protection technologies, e.g. CFG and CIG. We differentiate between memory write primitives and execution techniques, and discuss memory allocation strategies. Our collection is curated, analyzed, tabulated, with straight-forward, research-grade PoCs. We tested each technique against Windows 10 x64 with and without protections, and we report on the requirements, limitations, and quirks of each technique. And of course – no decent DEF CON presentation is complete without new attacks. We describe a new memory writing primitive which is CFG-agnostic. We describe a new “stack bombing” execution method (based on the memory write primitive above) that is inherently safe (even though overwriting the stack is a-priori a dangerous and destabilizing action). Finally, we release a library of all write primitives and execution methods, so users can generate “tailor-made” process injections.
Itzik Kotler
Itzik Kotler is CTO and Co-Founder of SafeBreach. Itzik has more than a decade of experience researching and working in the computer security space. He is a recognized industry speaker, having spoken at DEF CON, Black Hat USA, Hack In The Box, RSA, CCC and H2HC. Prior to founding SafeBreach, Itzik served as CTO at Security-Art, an information security consulting firm, and before that he was SOC Team Leader at Radware. (NASDQ: RDWR).
Website: http://www.ikotler.org
Twitter: @itzikkotler
Amit Klein
Amit Klein is a world renowned information security expert, with 28 years in information security and over 30 published technical and academic papers on this topic. Amit is the VP Security Research at SafeBreach, responsible for researching various infiltration, exfiltration and lateral movement attacks. Before SafeBreach, Amit was the CTO for Trusteer (acquired by IBM) for 8.5 years. Prior to Trusteer, Amit was chief scientist for Cyota (acquired by RSA) for 2 years, and prior to that, director of Security and Research for Sanctum (acquired by Watchfire, now part of IBM security division) for 7 years. Amit has a B.Sc. from the Hebrew University in Mathematics and Physics (magna cum laude, Talpiot program), recognized by InfoWorld as a CTO of the year 2010 , and has presented at BlackHat USA, DEF CON, NDSS, OWASP Global (keynote), InfoCom, DSN, HITB, RSA, OWASP EU, CertConf, BlueHat, CyberTech, APWG and AusCERT (keynote).
Website: http://www.securitygalore.com/
Return to Index - Add to
- ics
Calendar file
HTS - Bally's Event Center - Friday - 14:15-14:30
Propulsion
No description available
Return to Index - Add to
- ics
Calendar file
RTV - Flamingo 3rd Floor - Laughlin I,II Rooms - Friday - 10:30-11:30
Puny Charge your Phishing Campaigns
Verizon's 2019 Data Breach Investigation Report (DBIR) indicates that malware is delivered via email in 94% of investigated breaches. Business Email Compromise (BEC) is on the rise. Phishing is still a problem for most organizations. A good phishing campaign is still an easy win for a Red Teamer, though it’s a constant cat-and-mouse game as email gateways deploy new techniques for anti-spoofing and malware detection. This talk will discuss research and browser/app testing around using Puny Code to create solid doppelganger domains for phishing campaigns, watering hole attacks and other creative shenanigans. Using techniques discussed in this talk, you all be able to clone your target's domain name(s) appearing identical to the naked eye. Passing SSL/TLS verification, bypassing security awareness training, and any in-house phishing campaigns your Blue Team might have implemented, this is a $12 technique you must see.
About Michael Wylie: Michael Wylie, MBA, CISSP is the Director of Cybersecurity Services at Richey May Technology Solutions. In his role, Michael is responsible for delivering information assurance by means of vulnerability assessments, cloud security, penetration tests, risk management, and training. Michael has developed and taught numerous courses for the U.S. Department of Defense, Moorpark College, California State Universities, and for clients around the world. Michael is the winner of the SANS Continuous Monitoring and Security Operations challenge coin and holds the following credentials: CISSP, CCNA R&S, CCNA CyberOps, GPEN, TPN, CEH, CEI, VCP-DCV, CHPA, PenTest+, Security+, Project+, and more. Twitter: @TheMikeWylie
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 16:30-16:59
Title:
Putting Voters First: Expanding Options to Vote
4:30 PM Putting Voters First: Expanding Options to Vote
Amber McReynolds, Executive Director, National Vote at Home Institute
Return to Index - Add to
- ics
Calendar file
HHV - Bally's Event Center - Friday - 11:00-12:50
Rapid Prototyping For Badges
Securelyfitz and friends
Abstract
Messy wires can get the job done, but leveling up your hardware hacking sometimes requires some custom circuit boards.
This workshop will be a crash course in rapid prototyping for hardware hacking. We’ll start you off with a complete schematic for flashing some LEDs. After a brief lecture about how PCBs are made, you’ll get to adjust your schematic, layout components in Eagle or KiCAD PCB layout software, and customize it with some artwork. With help, you’ll manufacture a PCB on a PCB Mill, and if time permits you can assemble it in class or bring it to the HHV/SSV to assemble.
You’ll walk away with your own custom PCB badge with flashy lights and a better understanding of how to make your own custom PCBs in the future.
Bio
Joe FitzPatrick (@securelyfitz) is an Instructor and Researcher at SecuringHardware.com. Joe has spent over a decade working on low-level silicon debug, security validation, and penetration testing of CPUS, SOCs, and microcontroller. He has spent the past 5 years developing and leading hardware security-related training, instructing hundreds of security researchers, pen-testers, hardware validators worldwide. When not teaching classes on applied physical attacks, Joe is busy developing new course content or working on contributions to the NSA Playset and other misdirected hardware projects, which he regularly presents at all sorts of fun conferences.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 4 - Friday - 16:30-16:50
Re: What's up Johnny? – Covert Content Attacks on Email End-to-End Encryption
Friday at 16:30 in Track 4
20 minutes | Demo, Exploit
Jens Müller Ruhr University Bochum
We show practical attacks against OpenPGP and S/MIME encryption and digital signatures in the context of email. Instead of targeting the underlying cryptographic primitives, our attacks abuse legitimate features of the MIME standard and HTML, as supported by email clients, to deceive the user regarding the actual message content. We demonstrate how the attacker can unknowingly abuse the user as a decryption oracle by replying to an unsuspicious looking email. Using this technique, the plaintext of hundreds of encrypted emails can be leaked at once. Furthermore, we show how users could be tricked into signing arbitrary text by replying to emails containing CSS conditional rules. An evaluation shows that 17 out of 19 OpenPGP-capable email clients, as well as 21 out of 22 clients supporting S/MIME, are vulnerable to at least one attack. We provide different countermeasures and discuss their advantages and disadvantages
Jens Müller
Jens Müller is a PhD student at the Chair for Network and Data Security, Ruhr University Bochum, Germany. His research interests are legacy protocols and data formats, for which he loves to investigate what could possibly go wrong in a modern world. He has experience as a speaker on international security conferences (BlackHat, IEEE S&P, OWASP) and as a freelancer in network penetration testing and security auditing. Besides breaking thinks, he develops free open source software, for example, tools related to network printer exploit^H^H^H^H^H^H^H, um, "debugging".
Twitter: @jensvoid
Websites: https://www.nds.ruhr-uni-bochum.de/chair/people/jmueller/
https://hacking-printers.net/
Return to Index - Add to
- ics
Calendar file
SEV - Bally's Jubilee Tower - 3rd Floor - Las Vegas Ballroom - Friday - 18:15-18:45
Friday August 09 2019 1815 30 mins
Red Teaming Insights and Examples from Beyond the Infosec Community
Red Teaming isn’t just pen testing. Red team approaches and techniques are widely used in the military, intelligence community, and throughout the private sector. Every institution, from the Marines Corps to pharmaceutical giants, experiences the same organizational pathologies that make the unable to identify blind spots, challenge assumptions, or consider adversarial perspective. This talk will describe why red team approaches are needed, and offer concrete examples of where and how they have been used effectively. These practical tips and best practices of what makes red teams succeed will be intuitively useful to members of the information security community.
Micah Zenko: @micahzenko
Micah Zenko is the Director of Research and Learning at McChrystal Group, and columnist at Foreign Policy magazine. Previously, he worked at the Council on Foreign Relations, Harvard’s Kennedy School of Government, and the State Department’s Office of Policy Planning. Zenko consults with military commands, law enforcement agencies, the private sector, and nonprofit research organizations. He is the author of three books, including Red Team: How to Succeed by Thinking Like the Enemy. He has a PhD in political science from Brandeis University, and a Wisconsin bartender license.
Friday August 09 2019 1850 30 mins
Return to Index - Add to
- ics
Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 12:15-13:15
12:15-13:15
Regulation Station
A.J. Santos, Assistant Professor, Ankara Yildirim Beyazit University, Faculty of Law
Stop by this workshop with cryptocurrency regulation questions.
Return to Index - Add to
- ics
Calendar file
IOT - Flamingo 3rd Floor - Eldorado Ballroom - Friday - 13:15-13:59
A discussion of the latest in the how the law is coming for the IoT, especially in the realm of whether or not cybersecurity is considered a manufacturing or design defect to allow product liability law to be used to sue manufacturers, installers, retailers, and others associated with IoT devices. If your house burns down due to a hacker, who can be sued.
Bio:
Amit Elazari Bar On is a Director of Global Cybersecurity Policy at Intel Corporation and a Lecturer at UC Berkeley’s School of Information Master in Information and Cybersecurity. She holds a JSD from UC Berkeley School of Law and graduated summa cum laude three prior degrees. Her research in information security law and policy has appeared in leading technology law journals, presented at conferences such as RSA, Black Hat, USENIX Enigma, USENIX Security, BsidesLV, BsidesSF and DEF CON, and featured at leading news sites such as The Wall Street Journal, The Washington Post and the New York Times. In 2018, she received a Center for Long Term Cybersecurity grant for her work on private ordering regulating information security, exploring safe harbors for security researchers. She practiced law in Israel.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 4 - Friday - 15:00-15:45
Relaying Credentials Has Never Been Easier: How to Easily Bypass the Latest NTLM Relay Mitigations
Friday at 15:00 in Track 4
45 minutes | Demo, Tool, Exploit
Marina Simakov Senior Security Researcher @Preempt
Yaron Zinar Senior Security Researcher Lead @Preempt
Active Directory has always been a popular target for attackers, with a constant rise in attack tools attempting to compromise and abuse the main secrets storage of the organization. One of the weakest spots in Active Directory environments lies in the design of one of the oldest authentication protocols – NTLM, which is a constant source of newly discovered vulnerabilities. From CVE-2015-0005, to the recent LDAPS Relay vulnerability, it is clear why this protocol is one of the attackers’ favorites.
Although there are offered mitigations such as server signing, protecting the entire domain from NTLM relay is virtually impossible. If it weren’t bad enough already, we will present several new ways to abuse this infamous authentication protocol, including a new critical zero-day vulnerability we have discovered which enables to perform NTLM Relay and take over any machine in the domain, even with the strictest security configuration, while bypassing all of today's offered mitigations. Furthermore, we will present why the risks of this protocol are not limited to the boundaries of the on-premises environment and show another vulnerability which allows to bypass various AD-FS restrictions in order to take over cloud resources as well.
Marina Simakov
Marina Simakov is a security researcher at Preempt, with a special interest in network security and authentication protocols. Prior to Preempt, Marina served as a Security Researcher at Microsoft for several years. She holds an M.Sc. in computer science, with several published articles, with a main area of expertise in graph theory. Marina previously spoke at various security conferences such as Black Hat, BlueHat IL and DEF CON.
Yaron Zinar
Yaron Zinar is a Lead Security Researcher at Preempt, delivering the industry’s first Identity and Access Threat Prevention. Previously, Yaron spent over 12 years at leading companies such as Google and Microsoft where he held various positions researching and leading big data, machine learning and cyber security projects. Yaron is an expert on Windows Authentication protocols, among his team latest finding are CVE-2017-8563 and CVE-2018-0886, which he presented in Black Hat last year. Yaron holds an M.Sc. in Computer Science with focus on statistical analysis.
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 10:45-10:59
Title:
Remarks by CISA Director Chris Krebs
10:45 AM Remarks by CISA Director Chris Krebs
Christopher Krebs, Director, Department of Homeland Securitys Cybersecurity and Infrastructure Security Agency
Return to Index - Add to
- ics
Calendar file
WS - Flamingo - Lower Level - Red Rock III - Friday - 14:30-18:30
Reverse Engineering Android Apps
Friday, 1430-1830 in Flamingo, Red Rock III
Sam Bowne Proprietor, Bowne Consulting
Elizabeth Biddlecome Senior Researcher, Bowne Consulting
Practice finding flaws in real Android apps in this fun, CTF-style hands-on workshop, and you will be ready to avoid making security errors in your own apps.
Android apps are very easy to unpack, analyze, modify, and repack; partly because of the open nature of the system, and partly because most companies neglect basic security measures. In this workshop, participants will hack apps from Wells Fargo, Microsoft, Lyft, WhatsApp, Whole Foods, IBM, Harvard, Progressive, the Indian government, and other large organizations. We will find insecure network transmissions, broken cryptography, improper logging, and pervasive lack of binary protections. We will also analyze the way iOS apps use network transmissions, and observe serious vulnerabilities in iOS apps from major companies.
We will analyze Android internals in details, using the Drozer attack framework to inspect and manipulate intents to exploit insecure activities and content providers. We will perform a protection level downgrade attack on an Android 4.3 device, removing security protections from the Twitter app.
All class materials are freely available on the Web, and will remain available after the workshop. All vulnerabilities were reported to the affected companies long ago, where appropriate.
Equipment: participants must bring a laptop that can run VirtualBox machines. The host system can use Mac OS (best), Linux (OK) or Windows (usable but limited). We will use free Android emulators and a Kali virtual machine. They will be available as free downloads, and also locally on USB sticks.
Skill Level Intermediate
Prerequisites: Familiarity with basic networking and security concepts.
Materials: A laptop capable of running VirtualBox.
Max students: 90
Registration: https://www.eventbrite.com/e/reverse-engineering-android-apps-red-rock-iii-tickets-63609248976
(Opens 8-Jul-19)
Sam Bowne
Sam Bowne is the proprietor of Bowne Consulting and an instructor at City College San Francisco, and has been teaching hacking and security classes for ten years. He has presented talks and workshops at Defcon, HOPE, RSA, BSidesLV, BSidesSF, and many other conferences. He has a CISSP and a PhD and is a DEF CON Black Badge co-winner.
Elizabeth Biddlecome
Elizabeth Biddlecome is a senior researcher at Bowne Consulting, an independent consultant, and a part-time instructor at City College San Francisco, delivering technical training and mentorship to students and professionals. She leverages her enthusiasm for architecture,
security, and code to design and implement comprehensive information security solutions for business needs. Elizabeth enjoys wielding everything from soldering irons to scripting languages in cybersecurity competitions, hackathons, and CTFs.
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 4 - Friday - 10:00 - 11:50
Reverse Engineering Embedded ARM with Ghidra
Friday from 10:00 – 11:50 in Sunset 4 at Planet Hollywood
Audience: Offense, Defense, AppSec, Mobile, Hardware
Max Compston
The ARM processor is the most prevalent processor in the world. ARM devices encompass mobile phones, network devices and appliances, and devices comprising what is now called the Internet of Things. Before April 2019, the only professional tool available for Reverse Engineering ARM processors was IDA Pro. With the release of Ghidra by the National Security Agency (NSA) to the Open Source Community this April, a professional grade Reverse Engineering tool is now available for ARM. This Demo Lab setup will include a Linux Host Laptop running Ubuntu Linux. The target system is an embedded Raspberry Pi ARM v8a running Ubuntu Linux Core. This demonstration will consist of static Reverse Engineering a demonstration Banking Application daemon using Ghidra. Static analysis of the fictitious application with this tool should reveal areas prone to PLT/GOT infection. This analysis will focus on shared libraries prone to infection. Next, an Injection / Hook program will perform Linux PTRACE Injection / Function Hooking on the Banking Application. The function hooking is based upon the results from the Ghidra analysis performed earlier. The hook function will send the user data back to our host using a method unknown to the developer of the Banking Application.
Max Compston
Max Compston is the Principal Software Engineer with Embedded Software Solutions. He has 30+ years of embedded software development experience. He has worked for 20+ years as a government defense contractor developing embedded systems. He has worked 10+ years in the commercial sector on mobile devices, network devices, network access points and IPTV set-tops. Max has a love of the outdoors. He plays tennis, hikes, bikes and is always training for his next triathlon. He has an undergraduate education in Computer Science with graduate work in Computer Security and Info Assurance.
Return to Index - Add to
- ics
Calendar file
PHVW - Bally's Resort (Indigo) Tower 26th floor - Friday - 09:00-11:59
Reverse Engineering Malware 101
Amanda Rousseau, Facebook
This workshop provides the fundamentals of reversing engineering (RE) Windows malware using a hands-on experience with RE tools and techniques. Attendees will be introduced to RE terms and processes, followed by basic x86 assembly, and reviewing RE tools and malware techniques. It will conclude by attendees performing a hands-on malware analysis that consists of Triage, Static, and Dynamic analysis.
Prerequisites: Basic understanding of programming C/C++, Python, or Java
Amanda Rousseau (Twitter: @malwareunicorn) absolutely loves malware. She was as a Senior Malware Researcher at Endgame who focused on dynamic behavior detection both on Windows and OSX platforms. She worked as a malware researcher at FireEye before joining Endgame. She previously worked a reverse engineer and computer forensic examiner working for DoD forensic investigations and commercial incident response engagements. She received her MS in Information Systems Engineering from Johns Hopkins University. Research interests include malware evasion techniques, dynamic behavior classification, and developing runtime detections.
Return to Index - Add to
- ics
Calendar file
HHV - Bally's Event Center - Friday - 10:00-10:50
Reversing Corruption In Seagate Hdd Translators, The Naked Trill Data Recovery Project
Allison Marie Naaktgeboren MrDe4d
Abstract
Translation tables are a dynamic component of HDD firmware that translate logical addresses to physical locations on the disk. Corrupted translators can be the cause of drive failures in drives that appear undamaged and are without physical trauma. That failure can be reversed in many cases. We will present ways to identify if a drive’s translator has been corrupted for the Moose & Pharaoh drive families specifically, how to force a translator rebuild, and open source tool(s) to help you repair the translator.
Data recovery is a notoriously secretive field. Very little information about firmware and its internal data structures is public. Knowledge should be open source. By sharing what we’ve learned we hope to open this field up to more people, encourage repair, encourage re-use rather than disposal of hard drives, and encourage further publicly shared research. After the talk, attendees should be able to fix this type of error themselves in HDDs of the appropriate families using a TTL converter and the supplied code. Familiarity with the basic components of hard drive firmware is helpful, but not required.
Bio
MrDe4d is the lead Data Recovery Engineer and founder of Revenant Data Recovery. She is also a hobbyist embedded systems security researcher. She leads local workshops in Binary and Assembly CTF challenges. She has presented at conferences such as HushCon and Teardown, as well as at other hackerspaces around the USA. In 2017 she co-founded PASCAL Hackerspace and in 2019 co-founded the QultoftheQuantumQapybaras CTF team. She is passionate about learning, freedom of information, promoting self-advocacy, and hacking the planet!
Allison Marie Naaktgeboren is a Software Engineer with security roots at Signal Sciences. She has written and regretted code at Mozilla, Amazon, Cisco, FactSet Research Systems, and the Biorobotics Laboratory of the Robotics Institute. She holds a Bachelor’s Degree in Computer Science from Carnegie Mellon University. Allison leads classes on computer science fundamentals, cofounded & captains the QultoftheQuantumQapybaras CTF team, and mentors disadvantaged high school students in robotics, software, and hardware hacking.
Return to Index - Add to
- ics
Calendar file
LPV - Bally's - Platinum II Ballroom - Friday - 15:00-15:45
Title:
Safecracking, the insecurity you (probably) never thought of
Presented By
Jared Dygert
Abstract
I'll explain the inner workings of group 2 safe locks in order to ensure everyone has a solid grasp of how they work. Then go into the flaws of the design and show how to exploit those flaws in non-destructive ways to obtain the combination. I'll cover variations of several techniques used in each step that give different trade-offs in accuracy vs. speed. I'll also briefly cover the differences in some group 2 safe locks and how to take those changes into account during manipulation.
Return to Index - Add to
- ics
Calendar file
HTS - Bally's Event Center - Friday - 12:30-13:30
Seasteading is the creation of floating ocean cities as a revolutionary solution to some of the world’s most pressing problems, including rising sea levels, sustainable food supplies, poor governance, etc. The first single-family, affordable seastead was launched off the coast of Thailand in February 2019. A lucky few were able to visit and become the first Certified Seasteaders. They were inspired to plan for a SeaBnB and other business ventures to grow the first seasteading community, until the Thai Navy confiscated the seastead. In this presentation, Carly Jackson will describe the challenges faced and overcome by the pioneering seasteaders.
Carly Jackson
Certified Seasteader and Operations Manager, The Seasteading Institute
Speaker Bio: Carly Jackson joined the Seasteading community after meeting a group of seasteaders at a conference in August 2017. She has dreamed of living on a seastead ever since. She has worked and volunteered for a number of nonprofit organizations and political organizations, building communities and training activists. In April, she became a Certified Seasteader by visiting the first affordable, single-family seastead off the coast of Thailand.
Return to Index - Add to
- ics
Calendar file
Night Life - Planet Hollywood - London Club - Friday - 22:00-25:59
Title:
SecKC the work, Again party
SecKC is back. But this time, they're shooting for the stars! Roll up on your favorite thoroughbred and make sure to bring your intergalactic western gear. Outlaws and sheriffs alike are welcome!
This party is happening in a beautiful old cabaret club that will be getting the SecKC mojo treatment ;) And music will be provided by none other than Keith Myers, Archwisp, and Professor S! Come join us for dancing, games, and other various shenanigans. The party starts at 10:00 and goes until the last hacker leaves!
SECKC THE WORLD, AGAIN
Return to Index - Add to
- ics
Calendar file
CLV - Flamingo 3rd Floor - Reno I Room - Friday - 15:25-15:50
Security Battle Wounds from a Cloud SRE
Speaker: Jane Miceli
Twitter: @janemiceli
Abstract: Learn about a breach, what happens in the aftermath and why I can't tell my peers what happen. Learn the fallout and more importantly what application developers aren't thinking about.
About Jane: Enterprise Cloud Architect, 9 years exp in cloud, former lead cloud SRE
Return to Index - Add to
- ics
Calendar file
AIV - Bally's Resort (Indigo) Tower 26th Floor - Skyview Room 3 - end - Friday - 10:45-11:15
Seeing is deceiving: The rise of AI-synthesized fake media
No description available
Return to Index - Add to
- ics
Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 12:15-13:08
12:15-13:08
Selected Short Films
Mariana 627
Kurt is a lone technician aboard a remote monitoring outpost deep in space. Before he can leave his station, he must first train an interfacing AI system.
In:Sight
In a world where memories can be digitally recorded and replayed. A young woman discovers her true origins by viewing her father’s memories.
Eldritch Code
A dedicated IT-guy must stop a computer virus from spreading, unaware about the cosmic horrors he is about to release.
Nano
Nanotechnology administered into bloodstream can sync with apps to augment human genome. A new law mandating the procedure meets resistance from hacktivists.
Return to Index - Add to
- ics
Calendar file
BTVT - Flamingo - 3rd Floor- Savoy Room - Friday - 17:30-17:59
Serverless Log Analysis On AWS
Friday 17:30, Savoy Ballroom, Flamingo (Blue Team Village) (30M)
@gkapoglis
an Incident Responder at Verizon Media where I have the chance to work on complex problems at scale! I am originally from Greece and have been living in the US for the past 4 years. Got my Master’s in Cybersecurity from Stevens Institute of Technology in Hoboken NJ and hold GCIH and GNFA from GIAC.
In this talk we will go over traditional log analysis methods for AWS Cloudtrail logs and why we needed to find a better way of performing such investigations. We will then dive into AWS Athena which is essentially a serverless hive on the cloud “too many buzzwords alert” and how we use it to perform log analysis on the cloud under a centralized, efficient and transparent framework. We will go over use cases and examples of investigations, showcase investigations and showcase how Athena helped us perform more efficiently than the traditional methods mentioned before. Additionally, we will mention use cases for other type of log analysis like apache access logs, ELB and ALB logs, etc. Lastly, we will demo AWS Athena and analyze over 50GB of logs in under 1 minute, all done on the cloud serverless without the need to spin up any instances or servers. In the end, we will describe the countless possibilities for future work which include, automation, threat hunting and continuous monitoring of your AWS environment.
Return to Index - Add to
- ics
Calendar file
SEV - Bally's Jubilee Tower - 3rd Floor - Las Vegas Ballroom - Friday - 15:30-16:20
Friday August 09 2019 1530 50 mins
SEVillage – 10 Year Anniversary – A Look Back At What Has Changed
It was 10 years ago it all started in a tiny little squalid room. Hundreds of people packed in to see a new type of event – one that made headlines and scared the world. 10 years later – what has changed, where are we? what can we learn from the last decade?
Chris Hadnagy: @humanhacker
Chris is a professional social engineer with over 17 years of experience. His passion is understanding the why not just the what. Chris has had the opportunity to work with some of the world’s greatest minds in learning how to use skills that might not be too common to be infused in this industry. You can find out more by looking at www.social-engineer.com
Return to Index - Add to
- ics
Calendar file
HTS - Bally's Event Center - Friday - 11:00-11:30
Sinking Ships & Stealing Containers from Ports: exploiting EDIFACT
No description available
Return to Index - Add to
- ics
Calendar file
LBV - Flamingo - Carson City II Room - Friday - 13:00-13:59
Title:
So You Want to Rob a Bank: Overt Ops Timing & Practise
Return to Index - Add to
- ics
Calendar file
RCV - Planet Hollywood - Celebrity 5 Ballroom - Friday - 12:20-12:45
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 6 - Friday - 10:00 - 11:50
soFrida - Dynamic Analysis Tool for Mobile Apps with Cloud Backend
Friday from 10:00 – 11:50 in Sunset 6 at Planet Hollywood
Audience: Offense: Mobile Application Pentesters, Hackers Defense: Cloud Backend Operators Mobile Application Developers who use cloud SDK
Hyunjun Park & Soyeon Kim
Mobile app developers are increasingly using cloud services to implement features such as storage, push notifications, and user data analysis. Popular cloud service including AWS provides SDK and credential keys that allow mobile apps to authenticate and authorize cloud resources so that developers can implement features by calling APIs. However, we identify a vulnerability that those credential keys can be obtained by attackers. Within this demo, we will present how to steal cloud credential keys with soFrida: a dynamic analysis tool, powered by Frida. With soFrida, security researchers or engineers can quickly collect Android APKs and analyze cloud vulnerabilities in Android apps, helping to prevent serious security incidents such as data leaks. We have discovered 2,700 potentially vulnerable mobile apps by using soFrida and currently collaborate with the cloud service provider to eliminate security vulnerabilities. Detailed statistics can be found on our website:https://sofrida.github.io
https://sofrida.github.io
Hyunjun Park
Hyunjun Park is a senior engineer of Samsung SDS in South Korea and a graduate student of SANE Lab at Korea University (Supervisor: Seungjoo Gabriel Kim). His daily job is pentesting a broad range of Samsung products including smartphone, smart TV, wearable devices, etc. He also serves as the main staff of Kimchicon Security Conference in South Korea.
Soyeon Kim
Soyeon Kim is a security researcher of Samsung SDS in South Korea. She is mainly doing a security assessment of Samsung IoT products. She is interested in analyzing Android apps and IOS apps using Frida.
Return to Index - Add to
- ics
Calendar file
IOT - Flamingo 3rd Floor - Eldorado Ballroom - Friday - 11:30-11:59
Internet of Things (IoT) devices have always been vulnerable to a variety of security issues. In 2013, Independent Security Evaluators (ISE) performed research on IoT devices that showed how rich feature sets could be leveraged to compromise devices. Today, we show that security controls put in place by device manufacturers are insufficient against attacks carried out by remote adversaries. This talk summarizes some of the best stories from our research project aimed to uncover and leverage new techniques to circumvent these new security controls in embedded devices.
Bio:
Rick Ramgattie @RRamgattie is a Senior Security Analyst and Team Lead at Independent Security Evaluators (ISE), where he conducts high-end, custom security assessments of computer hardware, software products, and manages a team of security researchers. As someone who appreciates the art of reverse engineering, he has taken part in hands-on security assessments of complex systems, IoT devices, and many different native and mobile applications. Rick enjoys RE, exploit dev, and reading.
Ian Sindermann, a Security Analyst at Independent Security Evaluators (ISE), as well as a researcher for ISE’s newly formed research division, ISE Labs. His day-to-day duties include conducting rigorous security assessments on a wide variety of web applications, researching the security posture of various IoT devices, and sharing knowledge whenever possible. His background is somewhat varied, with a primarily self-taught education, prior experience as a wannabe Linux admin, and a childhood spent as a traveling performer. Interests include hardware hacking, legacy systems, mainframes, and whatever tech obscurities he can get his hands on.
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 3 - Friday - 12:00 - 13:50
Spartacus as a Service (SaaS)
Friday from 12:00 – 13:50 in Sunset 3 at Planet Hollywood
Audience: Offense for the end user
Mike Kiser
The Third Servile War was over. The slave army has been defeated, and the survivors are offered a pardon by their Roman captors. The only requirement was that they identify Spartacus, their leader (Kirk Douglas). Rather than give away his identity, however, they all begin to yell out "I'm Spartacus!"—thus preserving his anonymity by overwhelming the Romans with possibilities. (Spoiler alert: they all die as a result.) "Spartacus as a Service (SaaS)" is an open-source proof-of-concept is introduced that facilitates these obfuscation techniques. This will allow for automatic obfuscation of a chosen identity on a small scale, and lessons learned from its usage will be discussed. Current version at: https://github.com/derrumbe/Spartacus-as-a-Service Open-source tool written largely in Node.js under an MIT license OAuth is used for authentication and authorization Content is generated via a Markov chain using sources such as Jane Austen, political platforms, and Aaron Franklin’s book on BBQ Amazon Mechanical Turk may be used to circumvent captchas Note that this is not a tool that *prevents* targeted advertising — instead it seeks to dilute the value of information that companies know about a user. It obfuscates the real content so that outsiders cannot tell what the real content (or in some cases, who the person) actually is.
https://github.com/derrumbe/Spartacus-as-a-Service
Mike Kiser
Mike Kiser is insecure. He has been this way since birth, despite holding a panoply of security roles over the past 20 years—that might imply otherwise. In spite of this, he has designed, directed, and advised on large-scale security deployments for a global clientele. He is currently in a long-term relationship with fine haberdashery, is a chronic chronoptimist (look it up), and delights in needlessly convoluted verbiage. He is obsessed with identity’s role in security and is the co-host of a podcast illuminating all things identity. He warmly embraces the notion that security is more of a state of mind than a destination.
Return to Index - Add to
- ics
Calendar file
Meetups - Planet Hollywood - Mezzanine Stage - Friday - 15:05-16:30
Title:
SpellCheck: The Hacker Spelling Bee
Forum
Return to Index - Add to
- ics
Calendar file
CLV - Flamingo 3rd Floor - Reno I Room - Friday - 14:50-15:25
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 14:30-15:30
Title:
State and Local Preparations on Election Security in the Aftermath of the Mueller Report
2:30 PM State and Local Preparations on Election Security in the Aftermath of the Mueller Report
Secretary Alex Padilla, Secretary of State of California
Noah Praetz, Election Consultant; former Director of Elections, Cook County, Illinois
Barb Byrum, Ingham County Clerk, Ingham County, Michigan
Amber McReynolds, Executive Director, National Vote at Home Institute
Eric Geller (moderator), Cybersecurity Reporter, Politico
Return to Index - Add to
- ics
Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Friday - 12:00-12:59
StegoAugmented Malware
Mike Raggo, CSO at 802 Secure
Chet Hosmer, Owner of Python Forensics
As adversaries look for new methods of creating malware, steganography has seen a resurgence. In this session, we'll review this black art and uncover recent steganographic malware weaponizing techniques. We'll cover techniques that include file and image embedding techniques invisible to malware and intrusion detection systems, methods of exploiting weak networking protocols for covert communications, mischievous IoT devices, and cloud data hiding methods. But we don't stop there, our organic research has uncovered numerous other ways in which malware could be embedded in an effort to prepare threat researchers with the knowledge to improve their tools and fortify their networks.
Mike Raggo (Twitter: @DataHiding) is Chief Security Officer at 802 Secure and has over 20 years of security research experience. His current focus is wireless IoT threats impacting the enterprise. Michael is the author of "Mobile Data Loss: Threats & Countermeasures" and "Data Hiding" for Syngress Books, and contributing author for "Information Security the Complete Reference 2nd Edition". A former security trainer, Michael has briefed international defense agencies including the FBI and Pentagon, and is a frequent presenter at security conferences, including Black Hat, DEF CON, Gartner, DoD Cyber Crime, OWASP, HackCon, and SANS.
Chet Hosmer (Twitter: @chethosmer) is an international author, educator & researcher, and founder of Python Forensics, Inc., a non-profit research institute focused on the collaborative development of open source investigative technologies using the Python programming language. Chet is also a Visiting Professor at Utica College in the Cybersecurity Graduate Program, where his research and teaching is focused on data hiding, active cyber defense and security of industrial control systems. Additionally, Chet is an Adjunct Professor at Champlain College in the Digital Forensics Graduate Program, where his research and teaching is focused on solving hard digital investigation problems using the Python programming language.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 3 - Friday - 16:00-16:30
Surveillance Detection Scout - Your Lookout on Autopilot
Friday at 16:00 in Track 3
20 minutes | Demo, Tool
Truman Kain Sr. Information Security Analyst at Tevora
Surveillance detection routes are a daily occurrence for clandestine operatives and agents all over the world. These mentally taxing counter-surveillance measures often mean the difference between life and death. Surveillance Detection Scout hopes to ease that burden. Scout currently supports Tesla Models S, 3 and X, running license plate recognition on 3 camera feeds to alert you in real time if you're being followed. When you park, Scout remains vigilant, implementing familiar face detection as well. By combining timestamped vehicle location data & video, computer vision and an intuitive web interface, it becomes apparent that Scout has just as many offensive as defensive applications. Over time, SDS captures and reports on observed patterns of life, allowing you to quickly gain an overview of your surroundings (or your target) with minimal effort. Whether you're conducting or evading surveillance, Scout has got your 6.
Truman Kain
Truman Kain has a background in design and marketing, which he utilized to develop Dragnet, an intuitive, AI-powered social engineering framework released at DEF CON 26. This year, he has combined his machine learning and design experience to make Surveillance Detection Scout look and feel as OEM as possible.
Twitter: @trumankain
Return to Index - Add to
- ics
Calendar file
SEV - Bally's Jubilee Tower - 3rd Floor - Las Vegas Ballroom - Friday - 17:40-18:09
Friday August 09 2019 1740 30 mins
Swing Away: How to Conquer Impostor Syndrome
“It is estimated that nearly 70% of people will experience signs or symptoms of Impostor Syndrome.” Too many people get stuck in a self-doubt loop. This is when feelings of being an impostor creep in. Billy Boatright is part of the nearly 30% that have not. Billy will share with you how an early failure and a “pep talk” from an all-time great has allowed him to avoid persistent feelings of self-doubt. Whether it’s your next social engineering engagement or giving a talk at a conference, Billy will also share ways that can help us all avoid the self-sabotage of Impostor Syndrome. Billy will also dive into the “Hero Worship” culture that social media created.
Billy Boatright: @fuzzy_l0gic
Billy began his social engineering career without even knowing it. He was a bartender on the Las Vegas Strip for the better part of a decade. He won numerous awards from all over the world as a Top-ranked Flair Bartender. He has taken the skills he learned behind the bar to the Information Security world. Billy has been a Judge for the Social Engineering Capture the Flag event at Defcon. He is also the namesake for the BSides Las Vegas Social Engineering Capture the Flag Championship Belt. Billy also volunteers time and expertise to the Las Vegas ISSA Chapter as a Board Member. He is also a member of the BSides Las Vegas Senior Staff.
Billy has multiple degrees and numerous certifications. However, when asked about them he will gladly quote George Moriarty, “The shining trophies on our shelves can never win tomorrow’s game.”
Return to Index - Add to
- ics
Calendar file
DL - Planet Hollywood - Sunset 6 - Friday - 12:00 - 13:50
TaintedLove
Friday from 12:00 – 13:50 in Sunset 6 at Planet Hollywood
Audience: AppSec
Benoit Côté-Jodoin
TaintedLove is a dynamic security analysis tool for Ruby. It leverages Ruby's object tainting and monkey patching features to identify potentially vulnerable code paths at runtime. TaintedLove is library agnostic and provides a simple framework to extend the detection of unsafe method usage and user input tracking.
https://github.com/shopify/tainted_love
Benoit Côté-Jodoin
Benoit is an Application Security Engineer at Shopify having a strong interest in web application security and vulnerability research. Sometimes an active CTF player, he has taken part in multiple competitions with the team DCIETS/NorthernCoalition.
Return to Index - Add to
- ics
Calendar file
CHV - Bally's Event Center - Friday - 14:30-14:55
Tell Me Lies - Automotive LIDAR and Low-Tech Obfuscation
Rick Hansen
Fri 8/09 •
2:30 PM-2:55 PM
25 min talk
What will it mean if LIDAR becomes ubiquitous in autonomous vehicles?
Join us for an exploration of a LIDAR’s operation, network attack surface, and the development of low-tech countermeasures that render solid objects invisible and turn thin air into a virtual wall of steel.
Return to Index - Add to
- ics
Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Friday - 13:00-13:59
The Art of Detection
Jay Dimartino, Head of Detections and Countermeasures at Fidelis Cybersecurity
Ever inherited a security rule you were afraid to modify? Ever import a Yara rule only to have the alerts blow up in your face? Does your SEIM or security appliance keep you up at night with email alerts? The Art of Detection focuses on the methodology of writing and sharing accurate detections to make you a better detection author. Gain confidence in managing false positives, learn rule sharing best practices, tackle large monolithic detections, and write detections that feed other detections. Learn the importance of your intelligence test data, and if your intelligence streams could be causing bias.
Jay Dimartino is a Threat Researcher for Fidelis Cybersecurity and Head of Detections & Countermeasures. He has been doing Malware Reverse Engineering for over nine years and also has several industry certifications including the GREM and GCFA.
Return to Index - Add to
- ics
Calendar file
BCV - Flamingo 3rd Floor - Laughlin III Room - Friday - 17:10-17:59
The CryptoCurrency Security Standard (CCSS)
No description available
Return to Index - Add to
- ics
Calendar file
BTVT - Flamingo - 3rd Floor- Savoy Room - Friday - 17:00-17:30
The Cyber Threat Intelligence Mindset
Friday 17:00, Savoy Ballroom, Flamingo (Blue Team Village) (30M)
@ch33r10
works for a Financial Services Fortune 500 Company. She is a graduate of the SANS 2017 Women’s Academy, has an MBA in IT Management, and currently holds the CFR, GSEC, GCIH, GCFE, GMON, GDAT, and GPEN certifications. She is a member of the Financial Services Information Sharing and Analysis Center (FS-ISAC), Yara Exchange, and FuzzySnugglyDuck. @ch33r10 serves as an Advisor for a Cybersecurity Apprenticeship Program in Chicago and she is on the Advisory Board of SANS EMEA CyberThreat 2019 with the National Cyber Security Centre in London and SANS Purple Team Summit.
What if I told you that it is possible for blue teamers to practice CTI everyday?! With minimal guidance and insight, blue teamers can learn how to see things through the eyes of a cyber threat intel analyst. We’ll step through multiple examples of how a CTI analyst would view data, intel, analysis, and situations so you can gain helpful perspectives when performing analysis for your organization. Learn about the cognitive biases and logical fallacies that are killing your analysis and what to do about it. Take away CTI strategies that you can use in your org day one back from Hacker Summer Camp.
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 4 - Friday - 16:00-16:30
The JOP ROCKET: A Supremely Wicked Tool for JOP Gadget Discovery, or What to Do If ROP Is Too Easy
Friday at 16:00 in Track 4
20 minutes | Demo, Tool
Dr. Bramwell Brizendine Assistant Professor of Computer and Cyber Sciences, Dakota State University
Dr. Joshua Stroschien Assistant Professor of Cyber Security/Network & Security Administration, Dakota State University
Return-oriented Programming (ROP) has been the predominate code-reuse attack for over a decade, but there are other options. Many mitigations can detect ROP due to heuristics, but these fail to detect Jump-oriented Programming (JOP). The JOP ROCKET is a reverse engineering framework dedicated to facilitating JOP exploits. It allows hackers to discover JOP gadgets. This includes dispatcher gadget's, which helps to subvert and direct the control flow, and functional gadgets, our primitives. This tool provides numerous options to give hackers flexibility on how to find gadgets, to narrow and expand possibilities. Additionally, the tool uses opcode-splitting to discover many unintended gadgets. All gadgets are classified based on operation as well as registers used and affected. Thus, hackers could easily obtain the desired functional gadgets, such as MOV EBX, [VALUE], using simple language commands. Because of JOP's much more complex set up, the tool provides this classification, so time isn’t wasted hunting through results.
JOP is rarely done in the wild. Part of that complexity is in set up, but another part is the lack of dedicated tools. Having to find JOP gadgets manually could be time-consuming and require expertise. JOP ROCKET simplifies that, allowing the JOP gadgets to be found quickly and easily.
This talk will give brief content on ROP, and then it introduces JOP and its history. Then we will dive into JOP ROCKET, discussing its features, how to use it to find JOP gadgets, and how to set up your own JOP exploit. We will then demo the tool.
Dr. Bramwell Brizendine
Dr. Bramwell Brizendine graduated with a Ph.D. in Cyber Operations in May, 2019. He holds master's degrees in Computer Science and Information Assurance. Bramwell is a professor at Dakota State University where he teaches topics such as reverse engineering, software exploitation, and malware analysis. Bramwell is the creator of the the JOP ROCKET, or the Jump-oriented Programming Reversing Open Cyber Knowledge Expert Tool. Bramwell has been interested in code-reuse attacks for several years. Bramwell was overcome by the urge to present a tool that made JOP more practical and useful for hackers who may wish to attempt using this more arcane class of code-reuse attacks. The JOP ROCKET is a by product of his doctoral dissertation.
Dr. Joshua Stroschien
Dr. Josh Stroschien is a professor at Dakota State University. Dr. Josh Stroschein teaches undergraduate and graduate courses in cyber security with a focus on malware analysis, reverse engineering and software exploitation. His research interests include malware analysis and software exploitation. Outside of DSU, you can find Josh providing training at such venues as DerbyCon, Hack-In-The-Box and ToorCon.
Website: https://0xevilc0de.com
Return to Index - Add to
- ics
Calendar file
RCV - Planet Hollywood - Celebrity 5 Ballroom - Friday - 10:20-10:59
Return to Index - Add to
- ics
Calendar file
DC - Paris - Track 2 - Friday - 11:00-11:45
The Tor Censorship Arms Race: The Next Chapter
Friday at 11:00 in Track 2
45 minutes | Tool
Roger Dingledine The Tor Project
Tor is a free-software anonymizing network that helps people around the world use the Internet in safety. But who cares how good Tor's privacy is, if your government prevents you from reaching the Tor network?
In the beginning, some countries filtered torproject.org by DNS (so we made website mirrors and an email autoresponder for downloading Tor), and then some countries blocked Tor relays by IP address (so we developed bridges, which are essentially unlisted relays), and then some countries blocked Tor traffic by Deep Packet Inspection (so we developed pluggable transports to transform Tor flows into benign-looking traffic).
Then things got weird, with China's nationwide active probing infrastructure to enumerate bridges, with Amazon rolling over to Russia's threats when Telegram used "domain fronting" to get around blocking, with Turkey blocking Tor traffic by DPI in more subtle ways, with Venezuela and Ethiopia and Iran trying new tricks, and more.
In this talk I'll get you up to speed on all the ways governments have tried to block Tor, walk through our upcoming steps to stay ahead of the arms race, and give you some new—easier—ways that let you help censored users reach the internet safely.
Roger Dingledine
Roger Dingledine is president and co-founder of the Tor Project, a nonprofit that develops free and open source software to protect people from tracking, censorship, and surveillance online.
Wearing one hat, Roger works with journalists and activists on many continents to help them understand and defend against the threats they face. Wearing another, he is a lead researcher in the online anonymity field, coordinating and mentoring academic researchers working on Tor-related topics. Since 2002 he has helped organize the yearly international Privacy Enhancing Technologies Symposium (PETS).
Among his achievements, Roger was chosen by the MIT Technology Review as one of its top 35 innovators under 35, he co-authored the Tor design paper that won the Usenix Security "Test of Time" award, and he has been recognized by Foreign Policy magazine as one of its top 100 global thinkers.
Twitter: @RogerDingledine
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 17:00-17:30
Title:
Thirty Years Behind the Ballot Box: A firsthand look at the multiple factors preventing fair, effective and secure elections in America
5:00 PM Thirty Years Behind the Ballot Box: A firsthand look at the multiple factors preventing fair, effective and secure elections in America
Ion Sancho, former Supervisor of Elections, Leon County, Florida
Return to Index - Add to
- ics
Calendar file
BTVW - Flamingo - 3rd Floor- Savoy Room - Friday - 09:00-12:59
Threat Hunting With The Elastic Stack
Friday 09:00, Savoy Ballroom, Flamingo (Blue Team Village) (4H)
@CyberPraesidium
brings over 12 years of diverse experience in cyber security, IT, and law. He leads Polito's commercial services including vulnerability assessments, penetration testing, incident response, forensics, and threat hunting. Prior to joining Polito, Ben worked on APT hunt teams at federal and commercial clients. He holds CISSP, GCFA, GWAPT, and Splunk Power User certifications.
@politoinc
has over 10 years of federal and commercial expertise in the field of Endpoint and Mobile based Intrusion Detection and Protection, Network Security, e-Discovery, Mobile Application Security, and Penetration Testing. Jeffrey holds a Masters of Science in Digital Forensics from George Mason Univ. along with a Bachelors in Business IT from St Johns Univ. Jeffrey also has earned certifications such as GIAC Certified Forensic Analyst, Encase Examiner and Encase E-Discovery, Xways, and Cellebrite Certifications.
With all new logs and revamped material from our 2018 workshop, this year's hands-on training will walk attendees through leveraging the open source ELK (Elastic) stack to proactively identify malicious activity hiding within diverse data sets. The basic tools and techniques taught during this class can be used to investigate isolated security incidents or implemented at scale for continuous monitoring and threat hunting. Attendees will be provided with access to a preconfigured ELK cluster and extensive sample logs containing malicious events waiting to be discovered on a simulated enterprise network. New for this year, attacker artifacts will be mapped to the MITRE ATT&CK Framework and tagged accordingly in the provided logs to help demonstrate the value of log enrichment, showcase both common and novel real-world attacker TTPs, and leverage a methodological approach to adversary and anomaly detection. Emphasis will be placed on live demos and practical training exercises throughout. The training will conclude with a friendly CTF tournament to give attendees the opportunity to collaborate and compete on teams in order to put their learning into practice and win some prizes.
Return to Index - Add to
- ics
Calendar file
HTS - Bally's Event Center - Friday - 14:30-14:59
TROMMEL Demo – Sift through embedded device files, from firmware, to identify potential vulnerable indicators
No description available
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 13:00-13:30
Title:
Trustworthy Elections: Evidence and Dispute Resolution
1:00 PM Trustworthy Elections: Evidence and Dispute Resolution
Philip Stark, Professor of Statistics and Associate Dean of Mathematical and Physical Sciences, University of California, Berkeley
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 17:30-17:59
Title:
UnclearBallot: Automated Ballot Image Manipulation
5:30 PM UnclearBallot: Automated Ballot Image Manipulation
Kartikeya Kandula, Graduate Student, University of Michigan
Jeremy Wink, Undergraduate Student, University of Michigan
Return to Index - Add to
- ics
Calendar file
WS - Flamingo - Lower Level - Red Rock III - Friday - 10:00-13:59
Understanding and Analyzing Weaponized Carrier Files
Friday, 1000-1400 in Flamingo, Red Rock III
Ryan Chapman Incident Response Analyst
Weaponized carrier files, such as PDF and Office docs, are used in various attack campaigns in order to compromise victims. In this workshop, we'll cover the file formats, associated weaponization methods, and analysis techniques of the attack code used with these types of files. We'll pull apart PDF object streams, deobfuscate JavaScript code, and analyze PDf-based attacks. For Office docs, we'll review the OLE file format; take a gander at VBA-based macros; extract, deobufscate, and debug the VBA code; and identify indicators of compromise. We'll be using a Windows-based malware VM along with tools such as oledump, PDFStreamDumper, the MS VBA Editor, and more!
Skill Level Intermediate
Prerequisites: This workshop will cover the file formats for both PDF and Office (e.g. docx) files. If you've never analyzed such a file for maliciousness, fear not! We'll be covering the basics. If you have programming/scripting experience, great. If not, don't worry. If you have worked to deobfuscate code, fantastic. If not, meh.
Materials: You will want to bring a laptop equipped with the following:
- The laptop will probably need at least 4GB of RAM, as you'll need to be able to run your host OS (doesn't matter which, I and my room proctors can help with any of them) along with a Windows 10 VM.
- Please try to have a USB port available. I will have USB 3.0 drives with me the day of the workshop. These drives will be FAT-formatted (nothing fancy) and contain the files required for the workshop. I will also pop the files on to a cloud-based file sharing service well ahead of the workshop for folks whom like to setup early.
- VM software! You'll need software to run a VM, such as VMware or VirtualBox. Doesn't matter if you're on a Mac with VMware Fusion, Windows, Linux, whatever. As long as you can run a VM (and take at least one snapshot), we're solid!
- If you do not have a Windows 10 malware analysis machine, please check out https://www.microsoft.com/en-us/evalcenter/evaluate-windows, as you can grab a trial of Windows that will work just fine for this workshop
- Speaking of MS products, you're going to want (in order to follow along with VBA file debugging), a copy (evaluation version works fine) of MS Office. Version doesn't really matter, but the more recent the better. Again, check out the MS Evaluation center for a copy of Office that you can use: https://www.microsoft.com/en-us/evalcenter/evaluate-office-365-proplus
- Python! You'll want to have Python installed (2.7.x preferred). I'll have an offline installer available should you need it (make sure you have that USB port available!)
-- I'll be providing some Python-based scripts for analysis, along with some tools such as PDFStreamDumper ahead of the workshop. I will provide direct links to the files as provided by the developers. I will also be providing carrier file samples ahead of time and on the workshop USB.
Max students: 90
Registration: https://www.eventbrite.com/e/understanding-and-analyzing-weaponized-carrier-files-red-rock-iii-tickets-63608133640
(Opens 8-Jul-19)
Ryan Chapman
Ryan Chapman is an incident response (IR) analyst with a background in host and network forensic analysis; malware analysis; threat intelligence; and all the other fun facets of the blue team realm. Prior to working in IR, Ryan worked as a technical trainer for many years. Outside of work, Ryan spends time with his family, gets tapped on the jiu jitsu mats, and plays plenty of Street Fighter. Hadouken!
Return to Index - Add to
- ics
Calendar file
Night Life - Paris - Rivoli A Ballroom - Friday - 21:00-24:59
Title:
VETCON II
Back again! VETCON is a Party thrown by Veterans for everyone! Come join in as veterans from all branches come together to celebrate and take on challenges that you only hear about in movies. Space force recruiting? Airmen in a chair race? Military drill displays? All this and more. It's time to raise hell the way our people in uniform are famous for.
Twitter: @VetConActual
Standing orders to Report to VETCON II
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 10:00-10:45
Title:
Welcome and Kick-off
10:00 AM Welcome and Kick-off
Harri Hursti, Co-Founder, DEF CON Voting Village; Founding Partner, Nordic Innovation Labs
Matt Blaze, Co-Founder, DEF CON Voting Village; Professor of Law and McDevitt Chair for the Department of Computer Science, Georgetown University
Jake Braun, Co-Founder, DEF CON Voting Village; Executive Director, University of Chicago Harris Cyber Policy Initiative
Return to Index - Add to
- ics
Calendar file
MOV - Bally's - Resort (Indigo) Tower 26th Floor - Skyview 4 - end of - Friday - 10:00-10:30
10:00-10:30
Welcome to the Monero Village!
Diego “rehrar” Salazar
This talk will explain the fundamentals of Monero and explain the theme for this year: “foundations of digital money.” Diego will introduce the list of events and thank all the volunteers who contributed to make the village a reality. He will highlight important events during Defcon to watch out for.
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 11:30-12:30
Title:
What Role Can Journalists Play in Securing Elections?
11:30 AM What Role Can Journalists Play in Securing Elections?
Kevin Collier, Reporter, CNN
Kim Zetter, Cybersecurity & National Security Reporter
Eric Geller, Cybersecurity Reporter, Politico
Maggie MacAlpine (moderator), Co-Founder, Nordic Innovation Labs
Return to Index - Add to
- ics
Calendar file
VMV - Planet Hollywood - Melrose 4 Room - Friday - 12:30-12:59
Title:
While the Bots Distracted You: Hacking the Electorate
12:30 PM While the Bots Distracted You: Hacking the Electorate
Evanna Hu, CEO and Partner, Omelas
Ben Dubow, CTO and President, Omelas
Return to Index - Add to
- ics
Calendar file
CPV - Planet Hollywood - Celebrity 1,2 Ballrooms - Friday - 14:00-14:59
Title:
Who Belongs Where? How to Effectively Integrate Your Company's Privacy, Legal, & Security Teams - Various
ABSTRACT
You've got a whole pack of privacy lawyers, cybersecurity team members, a CISO, a CTO, a CPO, a General Counsel, privacy engineers, security engineers, and more. Where do you put them? Who reports to who? There is a robust and lively debate going on among CISOs, CPOs, GCs, and others about structuring privacy and security teams efficiently and effectively within an organization. Sit in and listen to that debate here - and maybe take away some recommendations for your own teams.
BIO
Suchi is a data privacy and cybersecurity lawyer (@SuchiPahi). She was supposed to be a doctor, but went rogue and wound up in law school arguing about the CFAA. After 4 years of working on some of the most incredible incidents as a cybersecurity lawyer and of helping companies of all sizes set up privacy and security practices, she decided to leave the law firm life so that she could do more tech law things.
Robin Andruss - Director, Privacy Operations at Twilio has over 15 years experience in privacy, audit, and compliance. Currently, as a Director, Privacy Operations for Twilio, Robin leads a variety of internal strategic privacy initiatives to help Twilio meet its internal and external privacy commitments.
Prior to Twilio, Robin's privacy career includes privacy roles from Google, Yahoo and TrustArc and developed a strong background in project and process management, financial audit and compliance (Sarbanes Oxley internal/process audits), and consulting from Deloitte.
Marina is a well-established change agent in technology and cyber security with over 15 years of experience developing and delivering cyber security and IT strategy and programs. She has extensive experience aligning cyber strategy with business strategy while executing enterprise wide initiatives. Marina has expertise in risk management, data strategy and governance, security controls, information technology implementation and transformation, training, and project management. As Planned Parenthood Federation of Americas (PPFA) and Planned Parenthood Action Funds CISO, she works with senior leadership team to provide technical and cyber security expertise to mature the security posture of the Federation.
Mike has over twenty years of experience in the security industry. Hes currently enjoying some well earned time off after a year and a half as Lyfts first CISO where he had overall responsibility for their cybersecurity efforts. Prior to Lyft, he spent nine years at Salesforce in various roles, ultimately building and growing their world class Detection and Response organization. He started his career prototyping intrusion detection systems for battlefield networks.
Fred is yet another privacy and cybersecurity lawyer, with a background in cybercrime defense. As GitHubs Associate Corporate Counsel, he works closely with their security teams on bug bounty policy, incident response, and breach notifications. When not lawyering, Fred enjoys shell script kludges and improbable vehicles.
Return to Index - Add to
- ics
Calendar file
Night Life - Planet Hollywood - Mezzanine Stage - Friday - 22:00-23:59
Title:
Who's Slide is it anyway?
No description available
Return to Index - Add to
- ics
Calendar file
SEV - Bally's Jubilee Tower - 3rd Floor - Las Vegas Ballroom - Friday - 16:30-16:59
Friday August 09 2019 1630 30 mins
Why Vigilantism Doesn’t Work
Fighting child abuse is dirty work. Does getting dirty justify the ends? Join our new COO as he discusses the very important topic.
Shane McCombs: @InnocentOrg
McCombs comes to ILF uniquely primed with more than 20 years of experience in the tech industry, combined with more than a decade of experience in C-level roles. In those critical capacities, McCombs led enterprise-wide initiatives within project management, customer relationship management and acquisition, policies and procedures, process improvement, and infrastructure. McCombs is also an accomplished public speaker and trainer, focused on change management, professionalism, social engineering, and corporate security. In the past, McCombs volunteered for the Autism Hope Alliance and currently donates his time to local business as a trusted advisor.
Return to Index - Add to
- ics
Calendar file
WLV - Bally's - Palace Meeting Rooms 1-7 - off hallway to Event Center - Friday - 14:00-15:55
Eric Johnson
Bio
31 year wireless engineer. Antennas, cellular, Wi-Fi design
@ej_wireless
Wi-Fi 6 Tech deep dive
Abstract
802.11ax (Wi-Fi 6). Discussion of Antenna and Modulation techniques used with Wi-Fi and new radio features used with Wi-Fi 6
|
Return to Index - Add to
- ics
Calendar file
PHVW - Bally's Resort (Indigo) Tower 26th floor - Friday - 12:15-14:15
Wireshark for Incident Response & Threat Hunting
Michael Wylie, Director of Cybersecurity Services, Richey May Technology Solution
This workshop will take student’s Wireshark skills to the next level with a heavy emphasis on incident response, threat hunting, and malicious network traffic analysis. We will begin with a brief introduction to Wireshark and other Network Security Monitoring (NSM) tools/concepts. Placement, techniques, and collection of network traffic will be discussed in detail. Throughout the workshop, we’ll examine what different attacks and malware look like in Wireshark. Students will then have hands-on time in the lab to search for Indicators of Compromise (IOCs) and a potential breach to the network. There will be plenty of take home labs for additional practice.
Michael Wylie (Twitter: @TheMikeWylie) is the Director of Cybersecurity Services at Richey May Technology Solutions. In his role, Michael is responsible for delivering information assurance by means of vulnerability assessments, cloud security, penetration tests, risk management, and training. Michael has developed and taught numerous courses for the U.S. Department of Defense, Moorpark College, California State Universities, and for clients around the world. Michael is the winner of the SANS Continuous Monitoring and Security Operations challenge coin and holds the following credentials: CISSP, CCNA R&S, CCNA CyberOps, GPEN, TPN, CEH, CEI, VCP-DCV, CHPA, PenTest+, Security+, Project+, and more.
Return to Index - Add to
- ics
Calendar file
PHVT - Bally's Resort (Indigo) Tower 26th floor - Friday - 17:00-17:59
Your Phone is Using Tor and Leaking Your PII
Milind Bhargava, Manager at Deloitte Canada
Adam Podgorski, Manager at Deloitte Canada
Do you have a cellphone? Do you run apps on it? Your personal information is most probably traversing over TOR without your knowledge or consent. As part of our research, we identified a surprising amount of unencrypted, sensitive and confidential user data originating from mobile devices traversing the TOR network, which included: GPS coordinates, WiFi BSSID, and general keys typed by the user. In some cases, we were able to build a complete user profile from physical movements to purchasing habits. At the end of the day, how comfortable are you that anyone can track you?
Milind Bhargava is a Manager with Deloitte's Risk Advisory team where he performs security audits and assessments, leads the incident response team. He also leads his own security consulting company that is known for Darknet Threat Intelligence Research.
Adam Podgorski is a Manager at Deloitte Canada. He has managed and lead the delivery of a broad range of IT strategies and multiple technical advisory engagements. He presented at Black Hat in 2017.
Return to Index - Add to
- ics
Calendar file
