'Ghost Telephonist' Impersonates You Through LTE CSFB

Sunday at 11:00 in Track 4

45 minutes | Exploit

Yuwei Zheng Hacker

Lin Huang Hacker

One vulnerability in CSFB (Circuit Switched Fallback) in 4G LTE network will be presented. In the CSFB procedure, we found the authentication step is missing. This results in that an attacker can hijack the victim's communication. We named this attack as 'Ghost Telephonist'. Several exploitations can be made based on this vulnerability. When the call or SMS is not encrypted, or weakly encrypted, the attacker can impersonate the victim to receive the "Mobile Terminated" calls and messages or to initiate the "Mobile Originated" calls and messages. Furthermore, Telephonist Attack can obtain the victim's phone number and then use the phone number to make advanced attack, e.g. breaking Internet online accounts. These attacks can randomly choose victims, or target a given victim. We verified these attack with our own phones in operators' network in a small controllable scale. The experiments proved the vulnerability really exists. The attack doesn't need fake base station so the attack cost is low. The victim doesn't sense being attacked since no fake base station and no cell re-selection. Now we are collaborating with operators and terminal manufactures to fix this vulnerability.

Yuwei Zheng
Yuwei Zheng is a senior security researcher from Radio Security Research Dept. of 360 Technology. He has rich experiences in embedded systems over 10 years. He reversed blackberry BBM, PIN, BIS push mail protocol, and decrypted the network stream successfully in 2011. He successfully implemented a MITM attack for Blackberry BES based on a modified ECMQV protocol of RIM. He focuses on the security issues of embedded hardware and IOT systems. He was the speaker of DEF CON , HITB etc.

@huanglin_bupt

Lin Huang
Lin HUANG is a wireless security researcher and SDR technology expert, from Radio Security Research Dept. of 360 Technology. Her interests include the security issues in wireless communication, especially the cellular network security. She was the speaker of some security conferences, DEF CON , HITB, POC etc. She is the 3GPP SA3 delegate of 360 Technology.

Contributor Acknowledgement:

The Speakers would like to acknowledge Qing YANG, for his contribution to the presentation. Qing YANG is the founder of UnicornTeam & Radio Security Research Department in 360 Technology. He has rich experiences in information security area. He made presentations at BlackHat, DEF CON , CanSecWest, HITB, Ruxcon, POC, XCon, China ISC etc.

25 Years of Program Analysis

Sunday at 15:00 in 101 Track

45 minutes | Hacker History, Demo

Zardus (Yan Shoshitaishvili) Assitant Professor, Arizona State University

Last year, DARPA hosted the Cyber Grand Challenge, the culmination of humanity's research into autonomous detection, exploitation, and mitigation of software vulnerabilities. Imagine the CGC from the outside: huge racks of servers battling it out on stage, throwing exploit after exploit at each other while humans watch helplessly from the sidelines. But that vantage point misses the program analysis methods used, the subtle trade-offs made, and the actual capabilities of these systems. It also misses why, outside of the controlled CGC environment, most automated techniques don't quite scale to the analysis of real-world software!

This talk will provide a better perspective. On the 25th anniversary of DEFCON, we will go through these last 25 years of program analysis. We'll learn about the different disciplines of program analysis (and learn strange terms such as static, dynamic, symbolic, and abstract), understand the strength and drawbacks of each, and see if, and to what extent, they are used in the course of actual vulnerability analysis.

Did you know that every finalist system in the Cyber Grand Challenge used a combination of dynamic analysis and symbolic execution to find vulnerabilities, but used static analysis to patch them? Why is that? Did you know that, to make the contest feasible for modern program analysis techniques, the CGC enforced a drastically-simplified OS model? What does this mean for you, if you want to use program analysis while finding vulns and collecting bug bounties? Come to this talk, become an expert, and go on to contribute to the future of program analysis!

Zardus (Yan Shoshitaishvili)
Zardus is one of the hacking aces on Shellphish, the oldest-running CTF team in the world. He's been attending DEFCON since 2001, playing DEFCON CTF since 2009, and talking at DEFCON since 2015. Through this time, he also pursued a PhD in Computer Security, focusing on Program Analysis. The application of cutting-edge academic program analysis techniques to CTF (and, later, to his participation in the DARPA Cyber Grand Challenge, where he led Shellphish to a 3rd-place victory and a big prize payout) gave Zardus a unique understanding of the actual capabilities of the state of the art of program analysis, which in turn drove his research and culminated in the release of the angr binary analysis framework and the Mechanical Phish, one of the world's first autonomous Cyber Reasoning Systems.

Are all BSDs are created equally? A survey of BSD kernel vulnerabilities.

Sunday at 12:00 in Track 2

45 minutes | Demo

Ilja van Sprundel Director of penetration testing, IOActive

In this presentation I start off asking the question "How come there are only a handful of BSD security kernel bugs advisories released every year?" and then proceed to try and look at some data from several sources. It should come as no surprise that those sources are fairly limited and somewhat outdated.

The presentation then moves on to try and collect some data ourselves. This is done by actively investigating and auditing. Code review, fuzzing, runtime testing on all 3 major BSD distributions [NetBSD/OpenBSD/FreeBSD]. This is done by first investigating what would be good places where the bugs might be. Once determined, a detailed review is performed of these places. Samples and demos will be shown.

I end the presentation with some results and conclusions. I will list what the outcome was in terms of bugs found, and who -based on the data I now have- among the 3 main BSD distributions can be seen as the clear winner and loser. I will go into detail about the code quality observed and give some pointers on how to improve some code. Lastly I will try and answer the question I set out to answer ("How come there are only a handful of BSD security kernel bugs advisories released every year?").

Ilja van Sprundel
Ilja van Sprundel is experienced in exploit development and network and application testing. As IOActive's Director of Penetration Testing, he performs primarily gray-box penetration testing engagements on mobile (specializing in iOS) and runtime (specializing in Windows kernel) applications that require customized fuzzing and source code review, identifying system vulnerabilities, and designing custom security solutions for clients in technology development telecommunications, and financial services. van Sprundel specializes in the assessment of low-level kernel code and architecture/infrastructure design, having security reviewed literally hundreds of thousands of lines of code. However, as a Director, he also functions in a managerial capacity by overseeing penetration testing engagements, providing oversight regarding technical accuracy, serving as the point of contact between technical consultants and technical stakeholders, and ensuring that engagements are delivered on time and in alignment with customer's expectations. van Sprundel also is responsible to mentor and guide Associate-level consultants as they grow both their penetration testing and general consulting skillsets. He is the driver behind the team's implementation of cutting-edge techniques and tools, guided by both research and successful exploits performed during client engagements.

"Tick, Tick, Tick. Boom! You're Dead." — Tech & the FTC

Friday at 16:00 in Track 4

45 minutes

Whitney Merrill Privacy, eCommerce & Consumer Protection Counsel, Electronic Arts

Terrell McSweeny Commissioner, Federal Trade Commission

The Federal Trade Commission is a law enforcement agency tasked with protecting consumers from unfair and deceptive practices. Protecting consumers on the Internet and from bad tech is nothing new for the FTC. We will take a look back at what the FTC was doing when DEF CON first began in 1993, and what we've been doing since. We will discuss enforcement actions involving modem hijacking, FUD advertising, identity theft, and even introduce you to Dewie the e-Turtle. Looking forward, we will talk about the FTC's future protecting consumers' privacy and data security and what you can do to help.

Whitney Merrill
Whitney Merrill is a hacker, ex-fed, and lawyer. She's currently a privacy attorney at Electronic Arts (EA), and in her spare time, she runs the Crypto & Privacy Village (come say hi!). Recently, she served her country as an attorney at the Federal Trade Commission where she worked on a variety of consumer protection matters including data security, privacy, and deceptive marketing and advertising. Whitney received her J.D. and master's degree in Computer Science from the University of Illinois at Urbana-Champaign.

@wbm312

Terrell McSweeny
Terrell McSweeny serves as a Commissioner of the Federal Trade Commission. This year marks her fourth time at DEF CON . When it comes to tech issues, Commissioner McSweeny has focused on the valuable role researchers and hackers can play protecting consumer data security and privacy. She opposes bad policy and legislative proposals like mandatory backdoors and the criminalization of hacking and believes that enforcers like the FTC should work with the researcher community to protect consumers. She wants companies to implement security by design, privacy by design and data ethics design - but recognizes that, in the absence of regulation, enforcement and research are the only means of holding companies accountable for the choices they make in the ways that they hold and use consumer data.

@TMcSweenyFTC

(Un)Fucking Forensics: Active/Passive (i.e. Offensive/Defensive) memory hacking/debugging.

Saturday at 10:20 in Track 4

20 minutes | Hacker History, Art of Defense, Demo, Tool

K2 Director, IOACTIVE

How to forensic, how to fuck forensics and how to un-fuck cyber forensics.

Defense: WTF is a RoP, why I care and how to detect it statically from memory. Counteract "Gargoyle" attacks.

Defense: For one of DEF CON 24's more popular anti-forensics talks (see int0x80 - Anti Forensics). In memory (passive debugging) techniques that allows for covert debugging of attackers (active passive means that we will (try hard to) not use events or methods that facilities are detectable by attackers).

Offense: CloudLeech - a cloud twist to Ulf Frisk Direct Memory Attack

K2
K2 (w00w00, ADM, undernet, efnet, The Honeynet Project) is a devil in the details person who does not take themselves too serious and appreciates a good laugh. Earlier DEF CON presentations included polymorphic shellcode in the form of ADMMutate (see ADM Crew), low-level process detection, with page table analysis (Weird-Machine motivated shell code) and using the branch tracing store backdoor trick on Windows to counter Ransom ware, detect RoP (RunTime + HW Assisted) and draw cool graphs — "BlockFighting with a Hooker: BlockfFghter2!". All three of these are open source tools available github.com/K2 (EhTrace and inVtero.Net are under active development).

@ktwo_K2
GitHub: https://github.com/K2

$BIGNUM steps forward, $TRUMPNUM steps back: how can we tell if we're winning?

Saturday at 10:00 in Track 2

45 minutes

Cory Doctorow craphound.com, science fiction author, activist, journalist and blogger.

Is Net Neutrality on the up or down? Is DRM rising or falling? Is crypto being banned, or will it win, and if it does, will its major application be ransomware or revolution? Is the arc of history bending toward justice, or snapping abruptly and plummeting toward barbarism?

It's complicated.

A better world isn't a product, it's a process. The right question isn't, "Does the internet make us better or worse," its: "HOW DO WE MAKE AN INTERNET THAT MAKES THE WORLD BETTER?" We make the world better with code, sure, but also with conversations, with businesses, with lawsuits and with laws.

We don't know how to get to a better world, but we know which direction it's in, and we know how to hill-climb towards it. If we keep heading that way, we'll get *somewhere*. Somewhere good. Somewhere imperfect. Somewhere where improvement is possible.

Cory Doctorow
Cory Doctorow (craphound.com) is a science fiction author, activist, journalist and blogger - the co-editor of Boing Boing (boingboing.net) and the author of WALKAWAY, a novel for adults, a YA graphic novel called IN REAL LIFE, the nonfiction business book INFORMATION DOESN'T WANT TO BE FREE, and young adult novels like HOMELAND, PIRATE CINEMA and LITTLE BROTHER and novels for adults like RAPTURE OF THE NERDS and MAKERS. He works for the Electronic Frontier Foundation, is a MIT Media Lab Research Affiliate, is a Visiting Professor of Computer Science at Open University and co-founded the UK Open Rights Group. Born in Toronto, Canada, he now lives in Los Angeles.

@doctorow

A B C of Hunting

Thursday, 10:30 to 14:30 in Octavius 1

Julian Dana Mandiant / FireEye

We heard it all before. The old school SOC/CIRTs is not enough to fight the sophisticated attacks we see these days; being reactive to alerts and the known BAD model is not cutting it anymore. We need to move forward -> the CDC (Cyber Security Center) or the SOC/CIRT 2.0+, extra, super, plus! And, that means making the changes to become: Proactive, Predictive and Reactive too. And for that you need to start the HUNTING! .... BUT what is that? How do I do it? Where do I start? Which is the simplest for me as an analyst? Logs? Intelligence?

Let's start from the ABC... We will cover the theory and a few practical LABs. How to map the active Hunting to the Attack LyfeCycle. We will talk about the IOCs, Frequency Analysis (stacking). Intel driven LAB. And lastly ask you to use your imagination to create your own Hunting case.

Please get ready to talk, as it is going to be interactive (I'm not expecting to be the only one talking).

Prerequisites: Basic Incident Response knowledge. Basic security architecture knowledge. Basic log review knowledge. Basic OS knowledge.

Materials: The attendees should bring a laptop or a VM running Windows 7 or above with 2GB of RAM (4+ GB would be better) with connection to the Internet (the one provided by DEF CON works perfectly). Software: Spreadsheet editor, favorite text editor or log viewer. Admin rights to be able to install software if required.

Max students: 36 | Registration: https://dc25_dana.eventbrite.com (Sold out!)

Julian Dana
Julian is a Professional Services Director at Mandiant (a FireEye company). He has experience teaching IR, Network Investigations and other trainings. During his carrier, he has developed SOC/CIRTs, performed many penetration tests, responded to security breaches and worked on strategical security engagements for International Companies and Government institutions.

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

Friday at 12:00 in Track 3

45 minutes | Demo, Tool, Exploit

Orange Tsai Security Consultant from DEVCORE

We propose a new exploit technique that brings a whole-new attack surface to bypass SSRF (Server Side Request Forgery) protections. This is a very general attack approach, in which we used in combination with our own fuzzing tool to discover many 0days in built-in libraries of very widely-used programming languages, including Python, PHP, Perl, Ruby, Java, JavaScript, Wget and cURL. The root cause of the problem lies in the inconsistency of URL parsers and URL requesters.

Being a very fundamental problem that exists in built-in libraries, sophisticated web applications such as WordPress (27% of the Web), vBulletin, MyBB and GitHub can also suffer, and 0days have been discovered in them via this technique. This general technique can also adapt to various code contexts and lead to protocol smuggling and SSRF bypassing. Several scenarios will be demonstrated to illustrate how URL parsers can be exploited to bypass SSRF protection and achieve RCE (Remote Code Execution), which is the case in our GitHub Enterprise demo.

Understanding the basics of this technique, the audience won't be surprised to know that more than 20 vulnerabilities have been found in famous programming languages and web applications aforementioned via this technique.

Orange Tsai
Cheng-Da Tsai, also as known as Orange Tsai, is member of DEVCORE and CHROOT from Taiwan. Speaker of conference such as HITCON, WooYun and AVTokyo. He participates numerous Capture-the-Flags (CTF), and won 2nd place in DEF CON 22 as team member of HITCON.

Currently focusing on vulnerability research & web application security. Orange enjoys to find vulnerabilities and participates Bug Bounty Program. He is enthusiasm for Remote Code Execution (RCE), also uncovered RCE in several vendors, such as Facebook, Uber, Apple, GitHub, Yahoo and Imgur.

A Picture is Worth a Thousand Words, Literally: Deep Neural Networks for Social Stego

Saturday at 13:00 in Track 4

45 minutes | Tool

Philip Tully Principal Data Scientist, ZeroFOX

Michael T. Raggo Chief Security Officer, 802 Secure

Images, videos and other digital media provide a convenient and expressive way to communicate through social networks. But such broadcastable and information-rich content provides ample illicit opportunity as well. Web-prevalent image files like JPEGs can be disguised with foreign data since they're perceivably robust to minor pixel and metadata alterations. Slipping a covert message into one of the billions of daily posted images may be possible, but to what extent can steganography be systematically automated and scaled?

To explore this, we first report the distorting side effects rendered upon images uploaded to popular social network servers, e.g. compression, resizing, format conversion, and metadata stripping. Then, we build a convolutional neural network that learns to reverse engineer these transformations by optimizing hidden data throughput capacity. From pre-uploaded and downloaded image files, the network learns to locate candidate metadata and pixels that are least modifiable during transit, allowing stored hidden payloads to be reliably recalled from newly presented images. Deep learning typically requires tons of training data to avoid over fitting. But data acquisition is trivial using social networks' free image hosting services, which feature bulk uploads and downloads of thousands of images at a time per album.

We show that hidden data can be predictably transmitted through social network images with high fidelity. Our results demonstrate that AI can hide data in plain sight, at large-scale, beyond human visual discernment, and despite third-party manipulation. Steganalysis and other defensive forensic countermeasures are notoriously difficult, and our exfiltration techniques highlight the growing threat posed by automated, AI-powered red teaming.

Philip Tully
Philip Tully is a Principal Data Scientist at ZeroFOX. He employs natural language processing and computer vision techniques in order to develop predictive models for combating security threats emanating from social networks. He earned his joint doctorate degree in computer science from the Royal Institute of Technology (KTH) and the University of Edinburgh, and has spoken at Black Hat, DEF CON , ShowMeCon and across the neuroscience conference circuit. He's a hackademic that's interested in applying brain-inspired algorithms to both blue and red team operations.

@phtully

Michael T. Raggo
Michael T. Raggo, Chief Security Officer, 802 Secure (CISSP, NSA-IAM, CSI) has over 20 years of security research experience. His current focus is wireless IoT threats impacting the enterprise. Michael is the author of "Mobile Data Loss: Threats & Countermeasures" and "data Hiding: Exposing Concealed Data in Multimedia, Operating Systems, Mobile Devices and Network Protocols" for Syngress Books, and contributing author for "Information Security the Complete Reference 2nd Edition". A former security trainer, Michael has briefed international defense agencies including the FBI and Pentagon, is a participating member of FSISAC/BITS and PCI, and is a frequent presenter at security conferences, including Black Hat, DEF CON , Gartner, RSA, DoD Cyber Crime, OWASP, HackCon, and SANS.

Abusing Certificate Transparency Logs

Friday at 15:00 in Track 4

45 minutes | Demo, Tool

Hanno Böck Hacker and freelance journalist

The Certificate Transparency system provides public logs of TLS certificates. While Certificate Transparency is primarily used to uncover security issues in certificates, its data is also valuable for other use cases. The talk will present a novel way of exploiting common web applications like Wordpress, Joomla or Typo3 with the help of Certificate Transparency.

Certificate Transparency has helped uncover various incidents in the past where certificate authorities have violated rules. It is probably one of the most important security improvements that has ever happened in the certificate authority ecosystem. In September 2017 Google will make Certificate Transparency mandatory for all new certificates. So it's a good time to see how it could be abused by the bad guys.

Hanno Böck
Hanno Böck is a hacker and freelance journalist. He regularly covers IT security issues for the German IT news site Golem.de and publishes the monthly Bulletproof TLS Newsletter. He also runs the Fuzzing Project, an effort to improve the security of free and open source software supported by the Linux Foundation's Core Infrastructure Initiative.

@hanno

Abusing Webhooks for Command and Control

Saturday at 11:20 in 101 Track

20 minutes | Demo, Tool

Dimitry Snezhkov Security Consultant, X-Force Red, IBM

You are on the inside of the perimeter. And maybe you want to exfiltrate data, download a tool, or execute commands on your command and control server (C2). Problem is - the first leg of connectivity to your C2 is denied. Your DNS and ICMP traffic is being monitored. Access to your cloud drives is restricted. You've implemented domain fronting for your C2 only to discover it is ranked low by the content proxy, which is only allowing access to a handful of business related websites on the outside.

We have all been there, seeing frustrating proxy denies or triggering security alarms making our presence known.
Having more choices when it comes to outbound network connectivity helps. In this talk we'll present a technique to establish such connectivity with the help of HTTP callbacks (webhooks). We will walk you through what webhooks are, how they are used by organizations. We will then discuss how you can use approved sites as brokers of your communication, perform data transfers, establish almost realtime asynchronous command execution, and even create a command-and-control communication over them, bypassing strict defensive proxies, and even avoiding attribution.

Finally, we'll release the tool that will use the concept of a broker website to work with the external C2 using webhooks.

Dimitry Snezhkov
Dimitry Snezhkov does not like to refer to himself in the third person ;) but when he does he is a Sr. Security Consultant for X-Force Red at IBM, currently focusing on offensive security testing, code hacking and tool building.

@Op_Nomad

Advanced Spectrum Monitoring with ShinySDR

Michael Ossmann

Dominic Spill

Saturday from 1600-1750 at Table One

Audience: Wireless, Defense

We have developed open source tools to monitor the RF spectrum at a high level and then drill down to individual signals, supporting both reverse engineering and signals intelligence. By automatically combining the results with OSINT data from regulatory bodies around the world, we are able to build up a picture of devices transmitting in an environment.

http://greatscottgadgets.com/spectrummonitoring

Michael Ossmann
Michael Ossmann is a wireless security researcher who makes hardware for hackers. Best known for the open source HackRF, Ubertooth, and GreatFET projects, he founded Great Scott Gadgets in an effort to put exciting, new tools into the hands of innovative people.

Dominic Spill
Dominic Spill is senior security researcher for Great Scott Gadgets. The US government recently labelled him as "extraordinary." This has gone to his head.

Advanced Wireless Attacks Against Enterprise Networks

Friday, 14:30 to 18:30 in Octavius 7

Gabriel Ryan Security Consultant, Gotham Digital Science

This workshop will instruct attendees on how to carry out sophisticated wireless attacks against corporate infrastructure. Students will learn how to attack and gain access to WPA2-Enterprise networks, bypass network access controls, and explore how wireless can be leveraged as a powerful means of lateral movement through an Active Directory environment.

Topics of interest include:

- Wireless Reconnaissance and Target Identification Within A Red Team Environment
- Attacking and Gaining Entry to WPA2-EAP wireless networks
- SMB Relay Attacks and LLMNR/NBT-NS Poisoning
- Data Manipulation and Browser Exploitation Using Wireless MITM Attacks
- Downgrading Modern SSL/TLS Implementations Using Partial HSTS Bypasses
- Firewall and NAC Evasion Using Indirect Wireless Pivots

Each student will receive a course package containing a comprehensive course guide and preconfigured virtual machines. External wireless adapters and other wireless networking hardware will be provided by the instructor, and material learned in the lectures will be practiced within a realistic lab environment. The instructor will make himself available via email for questions and guidance in the weeks leading up to and following the workshop.

Prerequisites: A previous wireless security background is helpful but not required.

Materials: Students will be required to bring their own laptops capable of running virtualization software such as VMWare or VirtualBox. Other than that, I plan on providing the necessary hardware to complete the workshop. Hardware that will be provided to students includes:

- 1 TP-Link WN722N external wireless interface per student
- wireless access points

Max students: 85 | Registration: https://dc25_ryan.eventbrite.com/ (Sold out!)

Gabriel Ryan
Gabriel Ryan is a security consultant and researcher with a passion for wireless and infrastructure testing. He currently works for Gotham Digital Science at their New York office, where he provides full scope red team penetration testing capabilities for a diverse range of clients. He also contributes heavily to his company's research division, GDS labs. Previously, Gabriel has worked as a penetration tester and researcher for the Virginia-based defense contractor OGSystems, and as a systems programmer for Rutgers University. He also is a member of the BSides Las Vegas senior staff, coordinating wireless security for the event. In his spare time, he enjoys live music, exploring the outdoors, and riding motorcycles.

All Your Things Are Belong To Us

Saturday at 11:20 in Track 4

75 minutes | Demo, Exploit

Zenofex Hacker

0x00string Hacker

CJ_000 Hacker

Maximus64 Hacker

Get out your rollerblades, plug in your camo keyboard, and fire up your BLT drive. It's 25 years later and we're still hacking the planet. The Exploitee.rs are back with new 0day, new exploits and more fun. Celebrating a quarter century of DEF CON the best way we know how: hacking everything!

Our presentation will showcase vulnerabilities discovered during our research into thousands of dollars of IoT gear performed exclusively for DEF CON. We will be releasing all the vulnerabilities during the presentation as 0days to give attendees the ability to go home and unlock their hardware prior to patches being released. As always, to give back to the community that has given us so much, we will be handing out free hardware during the presentation so you can hack all the things too!Come party with us while we make "All Your Things Are Belong To Us."

Zenofex
Zenofex (@zenofex) is a researcher with Exploitee.rs. Amir founded "Exploitee.rs" which is a public research group and has released exploits for over 45 devices including the Amazon FireTV, Roku Media Player and the Google Chromecast. Amir is also a member of Austin Hackers and has spoken at a number of security conferences including DEF CON, B-Sides Austin, and InfoSec Southwest.

@exploiteers
@zenofex

0x00string
0x00string (@0x00string) is hacker and security researcher, a recent addition to Exploitee.rs who has presented at BSidesSATX and ISSW. His previous published work includes Reverse Engineering The Kankun Smart Plug, and Hacking The Samsung Allshare Cast Hub. His hobbies include bug collecting and hacking all the things.

@0x00string

CJ_000
Cj_000 (@cj_000) is a researcher in the Cyber and Information Security directorate at *redacted* and also a member of Exploitee.rs. CJ has been involved in the release and responsible disclosure of vulnerabilities in a number of devices including TV's, media players, and refrigerators. CJ has presented at multiple DEF CON's and believes that a simple approach is often the most elegant solution.

@cj_000

Maximus64
Maximus64 (@maximus64_) is an undergraduate student at the University of Central Florida. Khoa enjoys a hardware based approach in researching embedded devices and is a master of the soldering iron. Khoa has disclosed numerous vulnerabilities in various set-top boxes and other "smart" devices to multiple vendors. He is currently listed on various "Security Hall of Fame" pages for successful bug bounty submissions including AT&T, Samsung and Roku.

@maximus64_

Amateur Digital Archeology

Thursday at 13:00 in 101 Track

45 minutes

Matt 'openfly' Joyce Hacker at NYC Resistor

'Digital Archeology' is actually the name of a Digital Forensics text book. But what if we used forensics techniques targetting cyber crime investigations to help address the void in Archeology that addresses digital media and silicon artifacts. At NYC Resistor in Brooklyn we've gotten into the world of Digital Archeology on several occasions and the projects have been enjoyable and educational.

Now, imagine what could happen if a bunch of hackers are able to get their hands on a laptop pulled off of a space shuttle.

Then come to our talk and find out what ACTUALLY happened. I bought a laptop at auction that claimed to be off a Shuttle Mission. It turns out to have been mostly authentic. This will be a little foray into the history of this device and what I could find out about it, and how I did that.

Spoiler Alert: We found out a lot.

Bonus: I may have found the sister laptop of this laptop (serial numbers match)

Matt 'openfly' Joyce
Matt Joyce hates writing in the third person. He is a hacker at NYC Resistor in Brooklyn. He used to do NASA shit for a project called Nebula. He currently is doing this talk in no way representing current or past employers. Matt's last talk was at the American Homebrewer's Association.

An ACE Up the Sleeve: Designing Active Directory DACL Backdoors

Friday at 16:00 in Track 3

45 minutes | Demo

Andy Robbins Red Team Lead

Will Schroeder Offensive Engineer

Active Directory (AD) object discretionary access control lists (DACLs) are an untapped offensive landscape, often overlooked by attackers and defenders alike. The control relationships between AD objects align perfectly with the "attackers think in graphs" philosophy and expose an entire class of previously unseen control edges, dramatically expanding the number of paths to complete domain compromise.

While DACL misconfigurations can provide numerous paths that facilitate elevation of domain rights, they also present a unique chance to covertly deploy Active Directory persistence. It's often difficult to determine whether a specific AD DACL misconfiguration was set intentionally or implemented by accident. This makes Active Directory DACL backdoors an excellent persistence opportunity: minimal forensic footprint, and maximum plausible deniability.

This talk will cover Active Directory DACLs in depth, our "misconfiguration taxonomy", and enumeration/analysis with BloodHound's newly released feature set. We will cover the abuse of AD DACL misconfigurations for the purpose of domain rights elevation, including common misconfigurations encountered in the wild. We will then cover methods to design AD DACL backdoors, including ways to evade current detections, and will conclude with defensive mitigation/detection techniques for everything described.

Andy Robbins
As a Red Team lead, Andy Robbins has performed penetration tests and red team assessments for a number of Fortune 100 commercial clients, as well as federal and state agencies. Andy presented his research on a critical flaw in the ACH payment processing standard in 2014 at DerbyCon and the ISC2 World Congress, and has spoken at other conferences including DEF CON , BSidesLV, ekoparty, ISSA International, and Paranoia Conf in Oslo. He has a passion for offensive development and red team tradecraft, and helps to develop and teach the "Adaptive Red Team Tactics" course at BlackHat USA.

@_wald0

Will Schroeder
Will Schroeder is a offensive engineer and red teamer. He is a co-founder of Empire/Empyre, BloodHound, and the Veil-Framework, developed PowerView and PowerUp, is an active developer on the PowerSploit project, and is a Microsoft PowerShell MVP. He has presented at a number of conferences, including DEF CON , DerbyCon, Troopers, BlueHat Israel, and various Security BSides.

@harmj0y

Android Tamer

Anant Shrivastava

Saturday from 1000-1150 at Table Three

Audience: Mobile (specifically Android)

Android Tamer is a project to provide various resources for Android mobile application and device security reviews. Be it pentesting, malware analysis, reverse engineering or device assessment. We strive to solve some of the major pain points in setting up the testing environments by providing various ways and means to perform the task in most effortless manner.

https://androidtamer.com/

Anant Shrivastava
Anant Shrivastava is an information security professional with nearly 10 years of hacking and teaching experience, with expertise in Mobile, Web Application, Networks and Linux Security. He is Regional Director Asia Pacific for NotSoSecure Global Services and has lead hacking training at some of the worlds top security conferences (BlackHat USA/EU/ASIA, Nullcon, g0s, c0c0n). Anant also leads Open Source project AndroidTamer (www.androidtamer.com) and CodeVigilant (www.codevigilant.com).

Applied Physical Attacks on Embedded Systems, Introductory Version

Friday, 10:30 to 14:30 in Octavius 7

Joe FitzPatrick Instructor & Researcher, Securing Hardware

Syler Clayton Security Engineer

Chris Castellano Senior Enterprise Windows Sysadmin

This workshop introduces several different relatively accessible interfaces on embedded systems. Attendees will get hands-on experience with UART, SPI, and JTAG interfaces on a MIPS-based wifi development board. After a brief architectural overview of each interface, hands-on labs will guide through the process understanding, observing, interacting with, and exploiting the interface to potentially access a root shell on the target.

Prerequisites: No hardware or electrical background is required. Computer architecture knowledge, Linux internals, command-line familiarity, and low-level programming experience all very helpful but not actually required.

Materials: All equipment, including laptops, will be provided for use in the class. Students will be provided with a lab manual that includes an equipment list of all materials used for the class.

Max students: 60 | Registration: https://dc25_fitzpatrick.eventbrite.com (Sold out!)

Joe FitzPatrick
Joe (@securelyfitz) is an Instructor and Researcher at https://SecuringHardware.com (@securinghw). Joe has spent over a decade working on low-level silicon debug, security validation, and penetration testing of CPUS, SOCs, and microcontrollers. He has spent the past 5 years developing and leading hardware security related training, instructing hundreds of security researchers, pen testers, hardware validators worldwide. When not teaching Applied Physical Attacks training, Joe is busy developing new course content or working on contributions to the NSA Playset and other misdirected hardware projects, which he regularly presents at all sorts of fun conferences.

Syler Clayton
Syler Clayton (@SylerClayton) is known in the homebrew scene for his work reverse engineering and developing exploits for the Nintendo 3DS and Wii U. Professionally, he has spent the past 5 years as a Security Engineer doing reverse engineering, exploit development, penetration testing & software development. Since 2015, Syler has led the Red Team for the Collegiate Cyber Defense Competition At-Large regional. In his free time, Syler enjoys hacking on embedded systems in the form of video games, racing drones, virtual reality & electric longboards.

Chris Castellano
Chris Castellano (@StealthyC) is a Senior Enterprise Windows Sysadmin, with a high focus in defensive security. Pew Pew.

Assembly Language is Too High Level

Friday at 15:00 in 101 Track

45 minutes | Demo, Tool, Exploit

XlogicX Machine Hacker

Do you have a collection of vulnerable programs that you have not yet been able to exploit? There may yet still be hope. This talk will show you how to look deeper (lower level). If you've ever heard experts say how x86 assembly language is just a one-to-one relationship to its machine-code, then we need to have a talk. This is that talk; gruesome detail on how an assembly instruction can have multiple valid representations in machine-code and vice versa. You can also just take my word for it, ignore the details like a bro, and use the tool that will be released for this talk: the Interactive Redundant Assembler (irasm). You can just copy the alternate machine code from the tool and use it in other tools like mona, use it to give yourself more options for self-modifying code, fork Hydan (stego) and give it more variety, or to create peace on earth.

XlogicX
XlogicX hacks at anything low level. He's unmasked sanitized IP addresses in packets (because checksums) and crafts his own pcaps with just xxd. He feeds complete garbage to forensic tools, AV products, decompression software, and intrusion detection systems. He made evil strings more evil (with automation) to exploit high consumption regular expressions. Lately he has been declaring war on assembly language (calling it too high-level) and doing all kinds of ignorant things with machine code. More information can be found on xlogicx.net

@XlogicX

Attacking Active Directory and Advanced Methods of Defense

Thursday, 10:30 to 14:30 in Octavius 4

Adam Steed Associate Director, Protiviti

Andrew Allen Senior Consultant, Protiviti

This hands on workshop teaches you how to both attack and defend Active Directory. We will start by deploying an Active Directory environment using the typical security settings found in most medium to large organizations. Participants will then learn current common methods and tools used to exploit Active Directory against their test environments. Participants will create a hardened Active Directory environment using advanced methods to secure domain controllers from attack and then try to compromise their hardened environments.

Prerequisites: A basic to intermediate understanding of how Active Directory works including day to day administration of users and implementing group policy.

Materials: All participants will need be bring a laptop to the workshop that can be used to spin up virtual machines or have access to a personal AWS or Azure instance.

Max students: 72 | Registration: https://dc25_steed.eventbrite.com/ (Sold out!)

Adam Steed
Adam Steed prides himself in not just being an Information Security professional, but has been part of the culture that has defined Defcon for the last two decades. He has over 20 years of experience in working for Financial, Websites and Healthcare organizations. Currently Adam an Associate Director at Protiviti as part of the Security and Privacy practice. He has also spoken at Bsides and other events across the United States.

Andrew Allen
Andrew Allen is a senior consultant in the IT Security and Privacy Management Practice at Protiviti. He served as an Information Assurance Security Officer in the United States Army before receiving a B.S. in Information Science and Technology from Temple University. His career has centered on penetration testing and is an offensive PowerShell enthusiast.

Attacking and Defending 802.11ac Networks

Thursday, 14:30 to 18:30 in Octavius 5

Vivek Ramachandran Founder, Pentester Academy

Thomas d'Otreppe Wireless Security Researcher

802.11ac networks pose a significant challenge to existing Wi-Fi hacking tools and techniques. Unlike the previous generation of 802.11 networks, AC brings about significant complexities with features such as multi-user MIMO, advanced beamforming, up to 8 spatial streams, extremely high speeds (Gbps) and wide channel bandwidths 80-160. This workshop will help you "upgrade" your existing tools and techniques for both attacking and defending these networks. After this workshop, you will be able to create your own 802.11ac monitoring and attack platform.

Prerequisites: Working knowledge of Wi-Fi and Linux

Materials: We will be providing files which can downloaded to follow the class. Wireshark needs to be installed.

Max students: 90 | Registration: https://dc25_ramachandran.eventbrite.com (Sold out!)

Vivek Ramachandran
Vivek Ramachandran is the Founder and Chief Trainer at Pentester Academy. He discovered the Caffe Latte attack, broke WEP Cloaking, conceptualized enterprise Wi-Fi Backdoors, created Chellam - the world's first Wi-Fi Firewall and Chigula - a Wi-Fi data mining and IDS framework. He is also the author of multiple five star rated books which have together sold over 13,000+ copies worldwide and have been translated to multiple languages. Vivek started"SecurityTube.net"in 2007, a YouTube for security which current aggregates the largest collection of security research videos on the web. SecurityTube Training and Pentester Academy now serve thousands of customers from over 90 countries worldwide. Vivek's work on wireless security has been quoted in BBC online, InfoWorld, MacWorld, The Register, IT World Canada etc. places. He has spoken/trained at top conferences around the world including Black Hat USA, Europe and Abu Dhabi, Defcon, Hacktivity, Brucon and others

Thomas d'Otreppe
Thomas D'Otreppe is a wireless security researcher and author of Aircrack-ng, the most popular and complete suite of tools for WiFi network security assessments. He also created OpenWIPS-ng, an open source Wireless Intrusion Prevention System. Thomas is a contributor to the WiFi stack and toolset in Backtrack Linux, which has now become Kali Linux, the de facto top choice Linux distribution for penetration testing and vulnerability assessment across multiple technology domains. He is also known as an author of a pro-active wireless security course which has been delivered to large numbers of IT Security professionals worldwide. Thomas speaks and teaches in the Americas and Europe and is a well-known speaker at DefCon, BlackHat, DerbyCon, SharkFest, Mundo Hacker Day, BruCON and other venues

Attacking Autonomic Networks

Saturday at 14:00 in 101 Track

45 minutes | Demo, Exploit

Omar Eissa Security Analyst, ERNW GmbH

Autonomic systems are smart systems which do not need any human management or intervention. Cisco is one of the first companies to deploy the technology in which the routers are just "Plug and Play" with no need for configuration. All that is needed is 5 commands to build fully automated network. It is already supported in pretty much all of the recent software images for enterprise level and carrier grade routers/switches.

This is the bright side of the technology. On the other hand, the configuration is hidden and the interfaces are inaccessible. The protocol is proprietary and there is no mechanism to know what is running within your network.

In this talk, we will have a quick overview on Cisco's Autonomic Network Architecture, then I will reverse-engineer the proprietary protocol through its multiple phases. Finally, multiple vulnerabilities (overall 5) will be presented, one of which allows to crash systems remotely by knowing their IPv6 address.

Omar Eissa
Omar Eissa is a security Analyst working for ERNW. His interests are network security and reverse-engineering. He is a professional Cisco engineer with various years of experience in enterprise and ISPs networks. He has given talks and workshops at various telco events and conferences like Troopers17 and Black Hat USA 2017.

Backdooring the Lottery and Other Security Tales in Gaming over the Past 25 Years

Sunday at 11:00 in Track 2

45 minutes

Gus Fritschie CTO, SeNet International

Evan Teitelman Engineer, SeNet International

In this talk Gus and Evan will discuss the recent Hot Lotto fraud scandal and how one MUSL employee, Eddie Tipton, was able to rig several state lotteries and win $17 million (or perhaps more). Gus' firm is actively supporting the prosecution in this case. Evan was responsible for identifying and analyzing how Eddie was able to rig the RNG.

Details on the rigged RNG and other details from the case will be presented publicly for the first time during this talk.

For historical context other related attacks including the Ron Harris and hacking keno in the 1990's and a recent incident involving a Russian hacking syndicate's exploitation of slot machines will also be discussed.

Gus Fritschie
Gus Fritschie has been involved in information security since 2000. About 5 years ago (after his previous DEF CON presentation on iGaming security) he transitioned a significant portion of his practice into the gaming sector. Since then he has established himself and SeNet as the IT security leader in in gaming. He has supported a number of clients across the gaming spectrum from iGaming operators, land-based casinos, gaming manufacturer, lotteries, tribal gaming, and daily fantasy sports. In his free time he is a recreationally poker player (both online and B&M).

@gfritschie
@senetsecurity

Evan Teitelman
Bio coming soon.

BITSInject

Sunday at 10:20 in Track 3

20 minutes | Demo, Tool

Dor Azouri Security researcher, @SafeBreach

Windows' BITS service is a middleman for your download jobs. You start a BITS job, and from that point on, BITS is responsible for the download. But what if we tell you that BITS is a careless middleman? We have uncovered the way BITS maintains its jobs queue using a state file on disk, and found a way for a local administrator to control jobs using special modifications to that file

Comprehending this file's binary structure allowed us to change a job's properties (such as RemoteURL, Destination Path...) in runtime and even inject our own custom job, using none of BITS' public interfaces. This method, combined with the generous notification feature of BITS, allowed us to run a program of our will as the LocalSystem account, within session 0. So if you wish to execute your code as NT AUTHORITY/SYSTEM and the first options that come to mind are psexec/creating a service, we now add a new option: BITSInject.

Here, we will not only introduce the practical method we formed, but also: Reveal the binary structure of the state file for you to play with, and some knowledge we gathered while researching the service flow

We will also provide free giveaways: A one-click python tool that performs the described method; SimpleBITSServer - a pythonic BITS server; A struct definition file, to use for parsing your BITS state file

Dor Azouri
Dor Azouri is a security professional, having 6+ years of unique experience with network security, malware research and infosec data analysis. Currently doing security research @SafeBreach.

Brainwashing Embedded Systems

Thursday, 14:30 to 18:30 in Octavius 4

Craig Young Security Researcher, Tripwire

Lane Thames Security Researcher, Tripwire

JivaSecurity Research Engineer, Tripwire

Learning the secret incantations to make embedded systems carry out your will is not as hard as one might think. In the world of IoT, the hardened system is rare and most times a firmware image is more than enough to find and exploit weakness. This session explains in detail a process for going from zero-knowledge to zero-day on real-world devices without breaking a sweat. Attendees to this tutorial session will learn the ropes of firmware dissection, app decompilation, and manual fuzz testing in a hands-on hack lab. Participants will be provided with a customized Kali Linux virtual appliance and given access to several consumer devices for analysis. These techniques have been successfully employed by the author to identify over 100 CVEs on embedded/IoT devices as well as to win the 0-day and CTF tracks in the DEF CON 22 SOHOpelessly Broken router hacking competition.

Prerequisites: Intermediate *nix knowledge; proficiency with a shell (including writing BASH or similar scripts); strong understanding of HTTP. Familiarity with tools for working with HTTP is a big plus (i.e. cURL, Burp, urllib, etc)

Materials: Nothing is required but in order to make the most out of the workshop, students will want to have a laptop with an 802.11 adapter and virtualization software capable of running an x86_64 virtual machine from an OVA/OVF (e.g. VirtualBox or VMWare). Virtual machine files will be made available for download from the Internet before the workshop and it is best for participants to load the content in advance. The material will also be available on USB and a local file server.

Max students: 72 | Registration: https://dc25_young.eventbrite.com/ (Sold out!)

Craig Young
Craig Young is a computer security researcher with Tripwire's Vulnerability and Exposures Research Team (VERT). He has identified and responsibly disclosed dozens of vulnerabilities in products from Google, Amazon, IBM, NETGEAR, Adobe, HP, Apple, and others. His research has resulted in numerous CVE assignments and repeated recognition in the Google Application Security Hall of Fame. Craig's presentations on Google authentication weaknesses have led to considerable security improvements for all Google users. Craig won in track 0 and track 1 of the first ever SOHOpelessly Broken contest at DEF CON 22 by demonstrating 10 0-day flaws in SOHO wireless routers. His research into iOS WiFi problems more recently exposed CVE-2015-3728 that could allow devices to inadvertently connect to malicious hot spots. Craig has also successfully employed fuzzing techniques to find flaws in a variety of open source software including a memory corruption in MatrixSSL that could be used to achieve code execution on at least 100,000 Internet gateways.

Lane Thames
Lane Thames is a software development engineer and security researcher with Tripwire's Vulnerability and Exposure Research Team (VERT). As a member of VERT, Lane develops software that detects applications, devices, and operating systems along with vulnerability detection and management software. He also spends time looking for new vulnerabilities, contributing to the Tripwire State of Security blog, and understanding emerging cybersecurity threats. Lane received his PhD in Electrical and Computer Engineering from the Georgia Institute of Technology and has spent over 10 years working in information technology and software/hardware development. Lane worked for nCircle prior to their acquisition, and continues his research work now for Tripwire.

Jiva
Jiva is a Security Research Engineer on the Vulnerability and Exposures Research Team (VERT) at Tripwire. Prior to Tripwire, Jiva worked at Coalfire doing consulting/penetration testing, Dell SecureWorks as a network security analyst, and worked at UGA doing penetration testing on departmental web applications. Jiva went to school at the University of Georgia for a Bachelor's and Master's degree in Computer Science, and is a long time member of the CTF teams disekt and SecDawgs.

Breaking Bitcoin Hardware Wallets

Sunday at 10:00 in Track 3

20 minutes | Demo, Exploit

Josh Datko Principal Engineer, Cryptotronix LLC

Chris Quartier Embedded Engineer, Cryptotronix, LLC

The security of your bitcoins rests entirely in the security of your private key. Bitcoin hardware wallets help protect against software-based attacks to recover or misuse your key. However, hardware attacks on these wallets are not as well studied. In 2015, Jochen Hoenicke was able to extract the private key from a TREZOR using a simple power analysis technique. While that vulnerability was patched, he suggested the Microcontroller on the TREZOR, which is also the same on the KeepKey, may be vulnerable to additional side channel attacks.

In this presentation we will quickly overview fault injection techniques, timing, and power analysis methods using the Open Source Hardware tool, the ChipWhisperer. We then show how to apply these techniques to the STM32F205 which is the MCU on the Trezor and KeepKey. Lastly, we will present our findings of a timing attack vulnerability and conclude with software and hardware recommendations to improve bitcoin hardware wallets. We will show and share our tools and methods to help you get started in breaking your own wallet!

Josh Datko
Josh Datko is the owner of Cryptotronix, an embedded security consultancy. As a submarine officer, he was sent to Afghanistan to ensure that the Tailiban did not develop a submarine force—mission accomplished! He wrote a book on BeagleBones and crypto hardware which not many people have read, talked about embedded security at Portland BSides and HOPE, and presented a better way to make a hardware implant at DEF CON 22 which hopefully helped the NSA improve their spying.

Chris Quartier
Chris is the lead embedded hacker at Cryptotronix. He has worked at both big companies and IoT startups as an embedded developer working on bare metal and embedded linux board bring up, driver development, and trying to get those little logic analyzer clips to stay connected to a target. He's hacked on radios, rail guns, and fitness trackers but not all at the same time.

Breaking the x86 Instruction Set

Friday at 14:00 in Track 3

45 minutes | Demo, Tool

Christopher Domas Security Researcher, Battelle Memorial Institute

A processor is not a trusted black box for running code; on the contrary, modern x86 chips are packed full of secret instructions and hardware bugs. In this talk, we'll demonstrate how page fault analysis and some creative processor fuzzing can be used to exhaustively search the x86 instruction set and uncover the secrets buried in your chipset. We'll disclose new x86 hardware glitches, previously unknown machine instructions, ubiquitous software bugs, and flaws in enterprise hypervisors. Best of all, we'll release our sandsifter toolset, so that you can audit - and break - your own processor.

Christopher Domas
Christopher Domas is a cyber security researcher and embedded systems engineer, currently investigating low level processor exploitation. He is best known for releasing impractical solutions to non-existent problems, including the world's first single instruction C compiler (M/o/Vfuscator), toolchains for generating images in program control flow graphs (REpsych), and Turing-machines in the vi text editor. His more relevant work includes the binary visualization tool ..cantor.dust.. and the memory sinkhole x86 privilege escalation exploit.

@xoreaxeaxeax

Breaking Wind: Adventures in Hacking Wind Farm Control Networks

Saturday at 10:20 in 101 Track

20 minutes

Jason Staggs Security Researcher at the University of Tulsa

Wind farms are becoming a leading source for renewable energy. The increased reliance on wind energy makes wind farm control systems attractive targets for attackers. This talk explains how wind farm control networks work and how they can be attacked in order to negatively influence wind farm operations (e.g., wind turbine hijacking). Specifically, implementations of the IEC 61400-25 family of communications protocols are investigated (i.e., OPC XML-DA). This research is based on an empirical study of a variety of U.S. based wind farms conducted over a two year period. We explain how these security assessments reveal that wind farm vendor design and implementation flaws have left wind turbine programmable automation controllers and OPC servers vulnerable to attack. Additionally, proof-of-concept attack tools are developed in order to exploit wind farm control network design and implementation vulnerabilities.

Jason Staggs
Dr. Jason Staggs is an independent information security researcher with strong interests in critical infrastructure protection, telecommunications, penetration testing, network security and digital forensics. Jason has spoken at national and international conferences, authored various peer-reviewed publications and lectured undergraduate and graduate level courses on a variety of cyber security topics. His expertise in digital forensics has enabled him to provide invaluable assistance to law enforcement agencies at the local, state and federal levels in order to solve high-profile cybercrimes. In his spare time, Jason enjoys reverse engineering proprietary network stacks in embedded devices and diving through ancient RFCs to demystify obscure network protocols. Jason attended graduate school at The University of Tulsa where he earned his M.S. and Ph.D. degrees in Computer Science.

Bropy

Matt Domko

Saturday from 1400-1550 at Table Five

Provides simple anomaly based IDS capabilities using Bro. Bropy parses logs to generate network baselines using a simple Y/N interface, and the accompanying bro script generates logs for traffic outside of the baseline.

https://github.com/hashtagcyber/bropy

Matt Domko
"I'm just a guy playing with Legos. I crudely assemble the knowledge I have to build a solution for my problems."

Matt Domko is currently an Information Security instructor for Chiron Technology Services in Augusta, Georgia. His experiences as an enterprise administrator and cyber network defender for the United States Army are what drive his passion for network defense and "Blue Teaming". Bikes, Beards, and Karaoke

Build your stack with Scapy, for fun and profit

Thursday, 10:30 to 14:30 in Octavius 7

stryngs

Jack64

zero-x

802.11 is still the Wild West in 2017. It has been around since the 90's, yet as most things with the Internet, security has always been a bolt-on addition. Through passive and active observations over the past couple years, it occurred to us that a workshop on how to abuse wifi would be interesting. This in and of itself is a spiderweb. There are so many ways to approach it; jam it, DOS it, crack it, so forth and so on.

We decided on the "ride the wave" approach. Take the existing infrastructure, and use it to your advantage by molding custom frames as you see fit. We feel this is under utilized and thus: demonstrations, beatings and examples should be given. ARP, ARP, ARP, who let the ARPs out. That is typically the battle cry for anything "LAN" these days. Pop the network, hop on the network, do your ARP, grab your MITM and go. Tried and true, it works, but it's outdated, oldskool and quite frankly, boring. Any hacker worth their salt should be able to arpspoof and ettercap. Any WIDS/WIPS should instantly lock on to what's going on and ban or alert accordingly. What we need, is a new approach.

Enter, Scapy. Without spending an hour on the wonders of Scapy and what it can do for you as a Pentester in this briefing, we'd quite frankly rather cut down to the nuts and bolts, and just, show you.

This workshop is going to center around Scapy and how you as a Pentester can use it to your advantage. Take the 802.11 and bend it to your will. Make it do your bidding and leave the SysAdmins scratching

Prerequisites: Familiarity with RFC 1149

Materials: - Laptop with bootable Linux of some variety
- Debian based is preferred
- apt is way easier than yum...
- WiFi NIC with Monitor Mode capability
- Curiosity

Max students: 85 | Registration: https://dc25_stryngs.eventbrite.com/ (Sold out!)

stryngs
stryngs has been into the scene since 2006 when he first discovered wifi. Since then he has learned and absorbed all he can. He has bothered many a person on the IRC. Though he might have perturbed you with his questions, he is grateful for the knowledge you bestowed upon him. Without the community, stryngs wouldn't be where he is today. As such, hopefully with this workshop, he is truly giving back to the community which brought him to where he is at today.

Jack64
João Pena Gil (Jack64) is a computer security researcher from Portugal, working in the field since 2015. Currently working at Checkmarx as the AppSec Analysis Team Leader by day and a Cobalt Core Researcher by night, Jack64's interests are broad in information security, ranging from networking protocols to application security and cryptography. Stryngs had a big influence in Jack64's interest in information security, sharing with him his proof-of-concept for airpwn-ng, which prompted Jack64 to learn more about 802.11 and the rest of the networking stack in general, leveraging the powerful capabilities of scapy and python. This is some of the knowledge he hopes to share in this workshop.

zero-x
Bio Coming Soon

Building Application Security Automation with Python

Thursday, 10:30 to 14:30 in Octavius 5

Abhay Bhargav CTO, we45

In an age of rapid-release applications, DevOps and small application security teams, the only way application security can scale, is with automation. In this workshop, I will introduce some key automation practices and techniques using Python that students can use in their own application security programs for quick wins. These techniques will predominantly focus on developing automation scripts harnessing API from Open Source Web Vulnerability Scanners (like OWASP ZAP), Building fuzzers harnessing features of tools like mitmproxy with as little as a few lines of code and using NoSQL databases for easy search and to generate powerful application security analytics. The session will be entirely hands-on, with a lot of coding and very little theory.

Prerequisites:
Knowledge of Python basics preferred but not required ( Basic Python skills are good enough. Knowledge of variables, loops, modules, imports and data structures would suffice). Examples with complete source code would be given to participants to study further. Hands-on exercises will be "templatized" to ensure that people are up and running quickly, even if they are not familiar with Python.

Materials:
Laptop with 64bit CPU (Mac/Win/*nix) is good with 8GB+ RAM (Host Machine) preferred, and atleast 50GB of free HDD to import a Virtualbox VM
For Windows Laptops please ensure that Virtualization is enabled at the BIOS to run the VM. There have been issues where Virtualization being disabled at the BIOS has resulted in the VM not working. Please ensure that you have the necessary permissions to change BIOS settings if required (especially for work/corporate laptops)
64 bit CPU is required. we would be using Docker images and docker doesn't support 32bit systems
Please have the latest version of Virtualbox installed on the laptop.

Max students: 50 | Registration: https://dc25_bhargav.eventbrite.com (Sold out!)

Abhay Bhargav
Abhay Bhargav is the CTO of we45, a focused Application Security company. Abhay is the author of two international publications. “Secure Java for Web Application Development� and “PCI Compliance: A Definitive Guide�. Abhay is a builder and breaker of applications, and has authored multiple applications in Django and NodeJS. He is a passionate Pythonista and loves the idea of automation in security. This passion prompted him to author the world’s first hands-on Security in DevOps workshop that has been delivered in multiple locations, and recently as a highly successful workshop at the OWASP AppSecUSA 2016, OWASP AppSecEU 2017 and OWASP Appsec USA 2017. In addition , Abhay speaks regularly at industry events including OWASP, ISACA, Oracle OpenWorld, JavaOne, and others.

bullDozer

Keith Lee

Saturday from 1400-1550 at Table Two

Audience: Offense

The tool allows you to supply a username and password that you have captured and cracked from Responder or other sources as well as an IP ranges, subnet or list of IP addresses.

The tool finds its way around the network and attempts to gain access into the hosts, finds and dumps the passwords/hashes, resuses them to compromise other hosts in the network.

Below are some of the places the tools look for hashes/passwords
1. SYSVOL
2. File Shares
3. Memory
4. Tokens (Incognito)
5. MSSQL service credentials
6. Unattend.xml, sysprep.xml, sysprep.inf

It will also exploit the Domain Controller if its vulnerable to MS14-069 and dump the hashes.
Pillaging the Corporate Network
The tool will also attempt to 'rob' the shares and hosts of the sensitive data/information.
1. Finding files whose filename have the word 'password' in it
2. Dump Wireless. WinVNC, UltraVNC, Putty, SNMP, Windows AutoLogon, Firefox Stored credentials,
3. Find KeePass Databases, FileZilla sitemanger.xml, Apache Httpd.conf, and etc. if they contain credentials.
4. Finding PII data and Credit Card Track Data from memory
5. Browser credentials

It will iterate and continue to test and exploit the systems until all hosts are compromised. Another useful feature is for attackers who want to find the right credentials in order to access a certain folder under the shares on the host.

For example, \\host1\share\private

You might have the account that allows you to access \\host1\share but you do not know which account you need to access \\host1\share\private.

Using the credentials the tool has captured and finds the 'right key' to the lock.

It is possible to disable any of the options (e.g. no memory search of PAN numbers) so to add a random delay to its operations so as to remain stealth.

We are planning to allow users to develop modules/plugins and encourage development so that its feature set can be extended.

Keith Lee
Keith Lee is a Senior Security Consultant with Trustwave's SpidersLabs Asia-Pacific. SpiderLabs is one of the world's largest specialist security teams, with over 100 consultants spread across North America, South America, Europe and the Asia Pacific. SpiderLabs has a focus on original security research and regularly presents at conferences such as BlackHat, DefCon, OWASP, Hack In The Box and Ruxcon. Keith is based out of Singapore and has primary focus is on providing penetration testing, social engineering and incident response services to clients in the Asia-Pacific region.

Bypassing Android Password Manager Apps Without Root

Sunday at 13:00 in Track 2

45 minutes | Demo, Exploit

Stephan Huber Fraunhofer SIT

Siegfried Rasthofer Fraunhofer SIT

Security experts recommend using different, complex passwords for individual services, but everybody knows the issue arising from this approach: It is impossible to keep all the complex passwords in mind. One solution to this issue are password managers, which aim to provide a secure, centralized storage for credentials. The rise of mobile password managers even allows the user to carry their credentials in their pocket, providing instant access to these credentials if required. This advantage can immediately turn into a disadvantage as all credentials are stored in one central location. What happens if your device gets lost, stolen or a hacker gets access to your device? Are your personal secrets and credentials secure?

We say no! In our recent analysis of well-known Android password manager apps, amongst them are vendors such as LastPass, Dashlane, 1Password, Avast, and several others, we aimed to bypass their security by either stealing the master password or by directly accessing the stored credentials. Implementation flaws resulted in severe security vulnerabilities. In all of those cases, no root permissions were required for a successful attack. We will explain our attacks in detail. We will also propose possible security fixes and recommendations on how to avoid the vulnerabilities.

Stephan Huber
Stephan Huber is a security researcher at the Testlab mobile security group at the Fraunhofer Institute for Secure Information Technology (SIT). His main focus is Android application security testing and developing new static and dynamic analysis techniques for app security evaluation. He found different vulnerabilities in well-known Android applications and the AOSP. In his spare time he enjoys teaching students in Android hacking.

Siegfried Rasthofer
Siegfried Rasthofer is a vulnerability- and malware-researcher at Fraunhofer SIT (Germany) and his main research focus is on applied software security on Android applications. He developed different tools that combine static and dynamic code analysis for security purposes and he is the founder of the CodeInspect reverse engineering tool. He likes to break Android applications and found various AOSP exploits. Most of his research is published at top tier academic conferences and industry conferences like DEF CON, BlackHat, HiTB, AVAR or VirusBulletin.

CableTap: Wirelessly Tapping Your Home Network

Saturday at 16:00 in Track 3

45 minutes | Demo, Tool, Exploit

Marc Newlin Security Researcher at Bastille Networks

Logan Lamb Security Researcher at Bastille Networks

Chris Grayson Founder and Principal Engineer at Web Sight.IO

We discovered a wide array of critical vulnerabilities in ISP-provided, RDK-based wireless gateways and set-top boxes from vendors including Cisco, Arris, Technicolor, and Motorola. Our research shows that it was possible to remotely and wirelessly tap all Internet and voice traffic passing through the affected gateways, impacting millions of ISP customers.

Imagine for a moment that you want a root shell on an ISP-provided wireless gateway, but you're tired of the same old web vulns. You want choice. Maybe you want to generate the passphrase for the hidden Wi-Fi network, or log into the web UI remotely using hard-coded credentials.

Don't have an Internet connection? Not to worry! You can just impersonate a legitimate ISP customer and hop on the nearest public hotspot running on another customer's wireless gateway. Once online, you can head on over to GitHub and look at the vulnerability fixes that haven't yet been pushed to customer equipment.

In this talk, we will take you through the research process that lead to these discoveries, including technical specifics of each exploit. After showcasing some of the more entertaining attack chains, we will discuss the remediation actions taken by the affected vendors.

Marc Newlin
Marc is a wireless security researcher at Bastille, where he discovered the MouseJack and KeySniffer vulnerabilities affecting wireless mice and keyboards. A glutton for challenging side projects, Marc competed solo in two DARPA challenges, placing third in the DARPA Shredder Challenge, and second in the first tournament of the DARPA Spectrum Challenge.

Logan Lamb
Logan joined Bastille Networks in 2014 as a security researcher focusing on applications of SDR to IoT. Prior to joining Bastille Networks, he was a member of CSIR at Oak Ridge National Lab where his focus was on symbolic analysis of binaries and red-teaming critical infrastructure.

Chris Grayson
Christopher Grayson (OSCE) is the founder and principal engineer at Web Sight.IO. In this role he handles all operations, development, and research efforts. Christopher is an avid computing enthusiast hailing from Atlanta, Georgia. Having made a habit of pulling things apart in childhood, Chris has found his professional home in information security. Prior to founding Web Sight.IO, Chris was a senior penetration tester at the security consultancy Bishop Fox, and a research scientist at the Georgia Institute of Technology. During his tenure at these organizations, Chris became a specialist in network penetration testing and in the application of academic tactics to the information security industry, both of which contributed to his current research focus of architecting and implementing high-security N-tier systems. Chris attended the Georgia Institute of Technology where he received a bachelor's degree in computational media, a master's degree in computer science, and where he organized and led the Grey H@t student hacking organization.

Call the plumber - you have a leak in your (named) pipe

Sunday at 14:00 in 101 Track

45 minutes | Demo

Gil Cohen CTO, Comsec group

The typical security professional is largely unfamiliar with the Windows named pipes interface, or considers it to be an internal-only communication interface.
As a result, open RPC (135) or SMB (445) ports are typically considered potentially entry points in "infrastructure" penetration tests.

However, named pipes can in fact be used as an application-level entry vector for well known attacks such as buffer overflow, denial of service or even code injection attacks and XML bombs, depending on the nature of listening service to the specific pipe on the target machine.

As it turns out, it seems that many popular and widely used Microsoft Windows-based enterprise applications open a large number of named pipes on each endpoint or server on which they are deployed, significantly increase an environment's attack surface without the organization or end user being aware of the risk.
Since there's a complete lack of awareness to the entry point, there's very limited options available to organizations to mitigate it, making it a perfect attack target for the sophisticated attacker.

In this presentation we will highlight how named pipes have become a neglected and forgotten external interface. We will show some tools that can help find vulnerable named pipes, discuss the mitigations, and demonstrate the exploitation process on a vulnerable interface.

Gil Cohen
Gil is an experienced application security instructor, architect, consultant and pentester just starting his 12th year in the field.

With past experience in the civilian, government and military cyber security industries, Gil currently serves as the CTO of Comsec Group, in charge of training, research, service lines, methodologies and quality assurance.

With a long time record as an SQL injection fanatic, Gil was responsible for publishing the "SQL Injection Anywhere" technique in 2010, which is currently in use in a variety of automated scanners in the market, and enables the blind detection and exploitation of potential injections in any part of the SQL statement.

He also has a taste for nostalgia, and has been working for a while on abuses to protocols that software developers would prefer to forget.

@Gilco83
www.facebook.com/gilc83

CellAnalysis

Pedro Cabrera

Saturday from 1600-1750 at Table Three

Audience: Defensive and mobile security

CellAnalysis is one more tool to be added to the pentester arsenal. Nowadays we can find other tools intended to find fake cells, most of them use active monitoring; that is, they monitor traffic coming to the SIM card on a smart phone, so that only cell attacks are scanned on the same network as the SIM card. CellAnalysis offers a different vision, it performs a passive traffic monitoring, so it does not require a SIM card or a mobile device, simply a OsmocomBB phone or compatible device SDR (rtlsdr, usrp, hackrf or bladerf) to start monitoring all the frequencies of the GSM spectrum.

http://www.fakebts.com/

Pedro Cabrera
Software Defined Radio and UAV enthusiast, Pedro Cabrera has worked over than 10 years in the main Spanish telecommunications operators, conducting security audits and pentesting in mobile and fixed networks. Besides working with the telecommunications operators, Pedro leads Open Source projects such as intrusion detection systems for GSM networks, which has led him to study the various fake 2G cells attacks and existing solutions. He has also collaborated in press articles on this topic, wardriving around Madrid City looking for how many and where fake stations can be found just walking. During this year he has participated in security events, training "Attacking 2G/3G Mobile Networks, Smartphones and Apps" (BlackHat Asia) and demonstrating how to remote inject commands to commercial drones; "All your bebop drones still belong to us: drone hijacking" (RootedCon) and showing how to intercept 2G calls and SMS under a frequency channel hopping network, using low cost SDR; HackRF and BladeRF.

Cisco Catalyst Exploitation

Friday at 17:00 in 101 Track

45 minutes | Demo

Artem Kondratenko Penetration Tester, Security Researcher

On March 17th, Cisco Systems Inc. made a public announcement that over 300 of the switches it manufactures are prone to a critical vulnerability that allows a potential attacker to take full control of the network equipment.

This damaging public announcement was preceded by Wikileaks' publication of documents codenamed as "Vault 7" which contained information on vulnerabilities and description of tools needed to access phones, network equipment and even IOT devices.

Cisco Systems Inc. had a huge task in front of them - patching this vast amount of different switch models is not an easy task. The remediation for this vulnerability was available with the initial advisory and patched versions of IOS software were announced on May 8th 2017.

We all heard about modern exploit mitigation techniques such as Data Execution Prevention, Layout Randomization. But just how hardened is the network equipment? And how hard is it to find critical vulnerabilities?

To answer that question I decided to reproduce the steps necessary to create a fully working tool to get remote code execution on Cisco switches mentioned in the public announcement.

This presentation is a detailed write-up of the exploit development process for the vulnerability in Cisco Cluster Management Protocol that allows a full takeover of the device.

Artem Kondratenko
Artem is a Penetration Tester at Kaspersky Lab. On time between red team engagements he is doing security research of software and hardware appliances. Author of multiple CVE's on VMware Virtualization Platforms (CVE-2016-5331, CVE-2016-7458, CVE-2016-7459, CVE-2016-7460). Enjoys contributing to the community by writing penetration testing tools such as Invoke-Vnc (PowerShell vnc injector, part of CrackMapExec) and Rpivot (reverse socks4 proxy, now part of BlackArch Linux Distro).

@artkond, https://github.com/artkond,
https://artkond.com

CITL and the Digital Standard - A Year Later

Friday at 12:00 in 101 Track

45 minutes | Art of Defense

Sarah Zatko Chief Scientist, Cyber ITL

A year ago, Mudge and I introduced the non-profit Cyber ITL at DEF CON and its approach to automated software safety analysis. Now, we'll be covering highlights from the past year's research findings, including our in-depth analysis of several different operating systems, browsers, and IoT products.

Parts of our methodologies have now been adopted by Consumer Reports and rolled into their Digital Standard for evaluating safety, security, and privacy, in a range of consumer devices. The standard defines important consumer values that must be addressed in product development, with the goal of enabling consumer organizations to test, evaluate, and report on whether new products protect consumer security, safety, and privacy.

Sarah Zatko
Sarah Zatko is the Chief Scientist at the Cyber Independent Testing Lab (CITL), where she develops testing protocols to assess the security and risk profile of commercial software. She also works on developing automated reporting mechanisms to make such information understandable and accessible to a variety of software consumers. The CITL is a non-profit organization dedicated to empowering consumers to understand risk in software products. Sarah has degrees in Math and Computer Science from MIT and Boston University. Prior to her position at CITL, she worked as a computer security professional in the public and private sector.

cyber-itl.org

Controlling IoT devices with crafted radio signals

Friday at 13:00 in 101 Track

45 minutes | Demo, Tool

Caleb Madrigal Hacker, FireEye/Mandiant

In this talk, we'll be exploring how wireless communication works. We'll capture digital data live (with Software-Defined Radio), and see how the actual bits are transmitted. From here, we'll see how to view, listen to, manipulate, and replay wireless signals. We'll also look at interrupting wireless communication, and finally, we'll even generate new radio waves from scratch (which can be useful for fuzzing and brute force attacks). I'll also be demoing some brand new tools I've written to help in the interception, manipulation, and generation of digital wireless signals with SDR.

Caleb Madrigal
Caleb Madrigal is a programmer who enjoys hacking and mathing. He is currently working as a senior software engineer on Incident Response software at Mandiant/FireEye. Most of his recent work has been in Python, Jupyter, Javascript, and C. Caleb has been into security for a while... in high school, he wrote his own (bad) cryptography and steganography software. In college, he did a good bit of "informal pen testing". Recently, Caleb has been playing around with SDR, IoT hacking, packet crafting, and a good bit of math/probability/AI/ML.

@caleb_madrigal, calebmadrigal.com

CrackMapExec

Marcello Salvati

Saturday from 1400-1550 at Table Three

Audience: Network Defense and Offense

Ever needed to pentest a network with 10 gazillion hosts with a very limited time frame? Ever wanted to Mimikatz entire subnets? How about shelling entire subnets? How about dumping SAM hashes ? Share spidering? Keeping track of all the credentials you pillaged? (The list goes on!) And doing all of this in the stealthiest way possible? Well look no further than CrackMapExec! CrackMapExec (a.k.a CME) is a modular post-exploitation tool written in Python that helps automate assessing the security of *large* Active Directory networks. Built with stealth in mind, CME follows the concept of "Living off the Land": abusing built-in Active Directory features/protocols to achieve it's functionality and allowing it to evade most endpoint protection, IDS and IPS solutions. Although meant to be used primarily for offensive purposes, CME can be used by blue teams as well to assess account privileges, find misconfigurations and simulate attack scenarios. In this demo the author will be showing off v4.0, a major update to the tool bringing more feature and capabilities than ever before! If you are interested in the latest and greatest Active Directory attacks/techniques, weaponizing them at scale and general cool AD stuff this is the demo for you!

https://github.com/byt3bl33d3r/CrackMapExec

Marcello Salvati
Marcello Salvati (@byt3bl33d3r) is a security consultant who's really good at writing bios. He's so good at writing bios that he was awarded the 'The Best Bio Ever from *insert date when bios became a thing* to 2017" award. (Totally legit award. Don't Google it, Bing it).

His boss Liz asked him about ten times to re-write his bio because "It was too good. He had to make it less good. We didn't want people to cry in shame when they read it. It was like a poem ... sniff.. *a single tear is shed*".

By day a security consultant, by night a tool developer who discovered a novel technique to turn tea, sushi and dank memes into somewhat functioning code he has recently devoted his attention to the wonderful rabbit hole that is Active Directory which has become his favorite thing to 0wn.

Crypt-Keeper

Maurice Carey

Saturday from 1400-1550 at Table Four

Audience: Anyone who wants to run a service to securely exchange files.

Crypt-Keeper is a service for securely exchanging files.

Equipment Requirements (Network Needs, Displays, etc): A display or protector would be great. The app will be running on AWS, so a network connection will be needed as well.

https://github.com/mauricecarey/crypt-keeper

Maurice Carey
"Maurice is the Principle Software Engineer at TargetSmart, a small company focused on big data problems, where he is helping create and scale their customer facing software platform for future business growth. Previously, Maurice has worked as a Software Architect focusing on data analytics and micro-services, and as a software engineer at companies like General Motors and Amazon.com.

Maurice has been a speaker or presenter publicly at many local meet ups and small conferences, as well as presenting papers at the IEEE International Conference on Program Comprehension (ICPC), and IEEE Enterprise Distributed Object Computing (EDOC) conferences.

Maurice received a Bachelor's Degree in Computer Science and PhD in Computer Science from Arizona State University while establishing himself as an entrepreneur working his way through school writing code for various clients.

D0 No H4RM: A Healthcare Security Conversation

Saturday at 20:00 - 22:00 in Modena Room

Evening Lounge

Christian "quaddi" Dameff MD MS Hacker

Jeff "r3plicant" Tully MD Hacker

Beau Woods Deputy director of the Cyber Statecraft Initiative in the Brent Scowcroft on International Security

Joshua Corman Director of the Cyber Statecraft Initiative at the Atlantic Council's Brent Scowcroft Center

Michael C. McNeil Privacy and security expert, Philips Healthcare

Jay Radcliffe Senior Security Consultant and Researcher, Rapid7

Suzanne Schwartz, MD, MBA Associate Director for Science & Strategic Partnerships, FDA'Center for Devices & Radiological Health (CDRH)

Previously a free-flowing, fast moving conversation between old friends and new colleagues in a dimly lit and alcohol soaked off-strip hotel suite, the third annual edition of "D0 No H4rm" moves to the better lit and even more alcohol soaked auspices of the DEF CON 25 Evening Lounge for a two hour session that links makers, breakers, and wonks in the healthcare space for a continuation of what may be one of the most important conversations in all of hackerdom- how to ensure the safety and security of patients in a system more connected and vulnerable than ever before. Join physician researchers quaddi and r3plicant, and researcher turned wonk Beau Woods as they offer an update on the state of the field and curate an interactive and engaging panel before breaking out the bottle and getting social. Continuing a tradition that has sparked professional connections, project ideas, and enduring friendships, "D0 No H4rm" aims to offer a prescription for the future, and we want your voice to be heard.

Christian "quaddi" Dameff MD MS
Christian (quaddi) Dameff is an emergency medicine physician, former open capture the flag champion, prior DEF CON speaker, and researcher. Published works include topics such as therapeutic hypothermia after cardiac arrest, novel drug targets for myocardial infarction patients, and other Emergency Medicine related works with an emphasis on CPR optimization. Security research topics including hacking critical healthcare infrastructure and medical devices. This is his thirteenth DEF CON.

@cdameffMD

Jeff "r3plicant" Tully MD
Jeff Tully is an anesthesiologist, pediatrician, and researcher with an interest in understanding the ever-growing intersections between health care and technology. Prior to medical school he worked on "hacking" the genetic code of Salmonella bacteria to create anti-cancer tools, and throughout medical training has remained involved in the conversations and projects that will secure healthcare and protect our patients as we face a brave new world of remote care, implantable medical devices, and biohacking.

@jefftullymd

Beau Woods
Beau Woods is the deputy director of the Cyber Statecraft Initiative in the Brent Scowcroft on International Security. His focus is the intersection of cyber (yes, he'll drink for that) security and the human condition, primarily around Cyber Safety. This comes out of the I Am The Cavalry initiative, ensuring the connected technology that can impact life and safety is worthy of our trust. Beau started his career working at a regional health provider, protecting patients by defending medical data and devices.

@beauwoods

Joshua Corman
Joshua Corman is the director of the Cyber Statecraft Initiative at the Atlantic Council's Brent Scowcroft Center and a founder of I am The Cavalry (dot org). Corman previously served as CTO for Sonatype, director of security intelligence for Akamai, and in senior research and strategy roles for The 451 Group and IBM Internet Security Systems. He co-founded @RuggedSoftware and @IamTheCavalry to encourage new security approaches in response to the world's increasing dependence on digital infrastructure. Josh's unique approach to security in the context of human factors, adversary motivations, and social impact has helped position him as one of the most trusted names in security. He also serving as an adjunct faculty for Carnegie Mellon's Heinz College and on the 2016 HHS Cybersecurity Task Force.

Dark Data

Friday at 15:00 in Track 3

45 minutes

Svea Eckert NDR

Andreas Dewes PhD

A judge with preferences for hard core porn, a police officer investigating a cyber-crime, a politician ordering burn out medication - this kind of very personal and private information is on the market. Get sold to who is willing to pay for.

In a long time experiment, with the help of some social engineering techniques, we were able to get our hands on the most private data you can find on the internet. Click stream data of three million German citizens. They contain every URL they have looked at, every second, every hour, every day for 31 days. In our talk we will not only show how we got that data, but how you can de-anonymize it with some simple techniques.

This data is collected worldwide by big companies, whose legal purpose is to sell analytics and insights for marketers and businesses. In the shadow of Google and Facebook, companies have evolved, their names unknown to a broader public but making billions of dollars with your data. The new oil of the 20th century.

Our experiment shows in a drastic way, what the youngest decision reversing the Broadband Privacy Rule means. What the consequences for everyday life could be, when ISPs are allowed to sell your browsing data. And why that piece of regulation from the FCC was so important regarding privacy and constitutional rights.

Svea Eckert
Svea Eckert works as a freelance journalist for Germany's main public service broadcaster "Das Erste" (ARD). She is researching and reporting investigative issues for the PrimeTime news shows and high quality documentaries. Her main focus lies on new technology: computer and network security, digital economics and data protection.

Bigger projects and documentaries are for example "Superpower Wikileaks?" (ARD), "Facebook - Billion Dollar Business friendship" (ARD), her first book "Monitored and spied out: Prism, NSA, Facebook & Co" and in 2015 "Netwars" (ARD). Svea Eckert studied "Journalism and Communications" and Economics in Hamburg. She completed her journalistic training at NDR, Hamburg and Hannover.

Twitter: @sveckert
Website: www.sveaeckert.de

Andreas Dewes
Andreas Dewes is a trained physicist with a PhD in experimental quantum computing and a degree in quantitative economics. He has a passion for data analysis and software development. He has received numerous awards for his work on data analysis and his work on data privacy and big data has been featured in the national and international press.

Twitter: @japh44
Github: adewes

DC to DEF CON: Q&A with Congressmen James Langevin and Will Hurd

Saturday at 15:00 - 17:00 in Capri Room

Lounge Format

Representative James Langevin (D-RI)

Representative Will Hurd (R-TX)

Ever wondered if there was such thing as a “hacker-friendly� member of Congress? We found some and convinced them to come to DEF CON so you can meet them too! In this first-of-its-kind DEF CON session, two of the most hacker-friendly Congress critters will join DEF CON for an engaging and interactive session with the security research community.

Join the Atlantic Council’s Cyber Statecraft Initiative for a candid discussion with Representatives Will Hurd (R-TX) and James Langevin (D-RI). The two Congressmen will share their thoughts on the latest developments in cybersecurity policymaking on the Hill and provide a unique opportunity for the audience to ask questions, exchange ideas, and maybe even answer some of the Congressmen’s questions.

Rep. Will Hurd (R-TX)
Rep Hurd was born and raised in San Antonio, Texas. He attended John Marshall High School and Texas A&M University, where he majored in Computer Science and served as Student Body President.

After college, Will served as an undercover officer in the CIA in the Middle East and South Asia for nearly a decade, collecting intelligence that influenced the National Security agenda. Upon leaving the CIA, he became a Senior Advisor with a cybersecurity firm, covering a wide range of complex challenges faced by manufacturers, financial institutions, retailers, and critical infrastructure owners. He was also a partner with a strategic advisory firm helping businesses expand into international markets.

In 2015, Will was elected to the 114th Congress and currently serves on the Committee of Oversight and Government Reform and chairs the Information Technology Subcommittee. He also sits on the Committee on Homeland Security and is the Vice Chair of the Border and Maritime Security Subcommittee. In 2017, Will was appointed by Speaker Ryan to serve on the House Permanent Select Intelligence Committee, to replace Representative Mike Pompeo upon his confirmation as Director of the CIA.

Rep. James Langevin (D-RI)
Rep. Langevin first ran for office in 1986, when he was elected a Delegate to Rhode Island’s Constitutional Convention and served as its secretary. Two years later, he won election to the Rhode Island House of Representatives.

In 1994, Langevin defeated a Republican incumbent to become the nation’s youngest Secretary of State. He transformed the office into “the people’s partner in government� and took on the challenge of reforming Rhode Island’s outdated election system. Langevin also established the state’s Public Information Center and, with Brown University, published “Access Denied,� which examined the General Assembly’s compliance with the Open Meetings Law and documented routine and widespread violations.

In 1998, Langevin easily won re-election to his second term as Secretary of State, achieving the largest plurality of any general officer in this century, and in 2000, he made a successful run for the U.S. House of Representatives, where he has served the Second Congressional District ever since.

Langevin graduated from Rhode Island College and earned a Master’s Degree in Public Administration from the Kennedy School of Government at Harvard University. He resides in Warwick, Rhode Island

DC to DEF CON: Q&A with Congressmen James Langevin and Will Hurd

Sunday at 15:00 in 101 Track

Representative James Langevin (D-RI)

Representative Will Hurd (R-TX)

Joshua Corman Director of the Cyber Statecraft Initiative at the Atlantic Council's Brent Scowcroft Center

The past year has seen major disruptions at the intersection of security and society. “Cybersecurity� has been thrust into the public consciousness frighteningly widely and quickly. Issues of public policy impact our colleagues and our community, beyond the technology layer. Some in the public policy community are actively encouraging our community to engage, recognizing the need for a technically literate voice of reason from the security research community. DEF CON is proud to host two members of Congress, who braved their way from DC to DEF CON as ambassadors from their community to ours.

Joshua Corman will engage Rep. Jim Langevin (D-RI) and Rep. Will Hurd (R-TX), in a candid, on-the-record “fireside chat� style conversation. DEF CON attendees will hear their perspectives on the state of cyber policy and what can be done to improve technical literacy in the dialogs. The members will also reflect on their experience at DEF CON, hanging out with hackers, and how they can make their voice known in the public policy conversation.

Rep. Will Hurd (R-TX)
Rep Hurd was born and raised in San Antonio, Texas. He attended John Marshall High School and Texas A&M University, where he majored in Computer Science and served as Student Body President.

After college, Will served as an undercover officer in the CIA in the Middle East and South Asia for nearly a decade, collecting intelligence that influenced the National Security agenda. Upon leaving the CIA, he became a Senior Advisor with a cybersecurity firm, covering a wide range of complex challenges faced by manufacturers, financial institutions, retailers, and critical infrastructure owners. He was also a partner with a strategic advisory firm helping businesses expand into international markets.

In 2015, Will was elected to the 114th Congress and currently serves on the Committee of Oversight and Government Reform and chairs the Information Technology Subcommittee. He also sits on the Committee on Homeland Security and is the Vice Chair of the Border and Maritime Security Subcommittee. In 2017, Will was appointed by Speaker Ryan to serve on the House Permanent Select Intelligence Committee, to replace Representative Mike Pompeo upon his confirmation as Director of the CIA.

Rep. James Langevin (D-RI)
Rep. Langevin first ran for office in 1986, when he was elected a Delegate to Rhode Island’s Constitutional Convention and served as its secretary. Two years later, he won election to the Rhode Island House of Representatives.

In 1994, Langevin defeated a Republican incumbent to become the nation’s youngest Secretary of State. He transformed the office into “the people’s partner in government� and took on the challenge of reforming Rhode Island’s outdated election system. Langevin also established the state’s Public Information Center and, with Brown University, published “Access Denied,� which examined the General Assembly’s compliance with the Open Meetings Law and documented routine and widespread violations.

In 1998, Langevin easily won re-election to his second term as Secretary of State, achieving the largest plurality of any general officer in this century, and in 2000, he made a successful run for the U.S. House of Representatives, where he has served the Second Congressional District ever since.

Langevin graduated from Rhode Island College and earned a Master’s Degree in Public Administration from the Kennedy School of Government at Harvard University. He resides in Warwick, Rhode Island

Dealing the perfect hand - Shuffling memory blocks on z/OS

Saturday at 16:00 in 101 Track

45 minutes | Demo, Tool

Ayoul3 Pentester, Wavestone

Follow me on a journey where we p0wn one of the most secure platforms on earth. A giant mammoth that still powers the most critical business functions around the world: The Mainframe! Be it a wire transfer, an ATM withdrawal, or a flight booking, you can be sure that you've used the trusted services of a Mainframe at least once during the last 24 hours. In this talk, I will present methods of privilege escalation on IBM z/OS: How to leverage a simple access to achieve total control over the machine and impersonate other users. If you are interested in mainframes or merely curious to see a what a shell looks like on MVS, you're welcome to tag along.

Ayoul3
Ayoub is a pentester working for Wavestone, a consulting firm based in France. He got interested in Mainframe security in 2014 when, during an audit, he noticed the big security gap between this platform and standard systems like Windows and Unix. A gap that makes little sense since z/OS has been around for a while and is used by most major companies to perform critical business operations: wire transfer, claim refunds, bookings, etc.

If you want to test some of the tools showcased during the talk, you can check out his tools: https://github.com/ayoul3/

@ayoul3__

Death By 1000 Installers; on macOS, it's all broken!

Friday at 14:00 in Track 2

45 minutes | Demo, Exploit

Patrick Wardle Chief Security Researcher, Synack

Ever get an uneasy feeling when an installer asks for your password? Well, your gut was right! The majority of macOS installers & updaters are vulnerable to a wide range of priv-esc attacks.

It began with the discovery that Apple's OS updater could be abused to bypass SIP (CVE-2017-6974). Next, turns out Apple's core installer app may be subverted to load unsigned dylibs which may elevate privileges to root.

And what about 3rd-party installers? I looked at what's installed on my Mac, and ahhh, so many bugs!

Firewall, Little Snitch: EoP via race condition of insecure plist
Anti-Virus, Sophos: EoP via hijack of binary component
Browser, Google Chrome: EoP via script hijack
Virtualization, VMWare Fusion: EoP via race condition of insecure script
IoT, DropCam: EoP via hijack of binary component
and more!

...and 3rd-party auto-update frameworks like Sparkle -yup vulnerable too!

Though root is great, we can't bypass SIP nor load unsigned kexts. However with root, I discovered one could now trigger a ring-0 heap-overflow that provides complete system control.

Though the talk will discuss a variety of discovery mechanisms, 0days, and macOS exploitation techniques, it won't be all doom & gloom. We'll end by discussing ways to perform authorized installs/upgrades that don't undermine system security."

Patrick Wardle
Patrick Wardle is the Chief Security Researcher at Synack, and founder of Objective-See. Having worked at NASA and the NSA, and as well as presented at many security conferences, he is intimately familiar with aliens, spies, and talking nerdy. Currently, Patrick's focus is on automated vulnerability discovery, and the emerging threats of OS X and mobile malware. In his personal time, Patrick collects OS X malware and writes free OS X security tools.

@patrickwardle, objective-see.com

DEF CON 101 Panel

Thursday at 16:00 in 101 Track

105 minutes | Hacker History, Audience Participation

HighWiz Founder, DC101

Malware Unicorn

Niki7a Director of Content & Coordination, DEF CON

Roamer CFP Vocal Antagonizer, DEF CON

Wiseacre

Shaggy

The DEF CON panel is the place to go to learn about the many facets of DEF CON and to begin your DEF CONian Adventure. Here you will begin your adventure that will include more than just listening in the talk tracks. You can get hands-on experience in the Villages and witness amazing feats of programming in Demo Labs. You may even display your own powers by participating in a contest or two in the Events and Contest Area. The panel will give you what you need to know to navigate DEF CON to your best advantage. We have speakers who will regale you with tales of how they came to be at DEF CON and (hopefully) inspire you with their personal experiences. Oh yeah, there is the time honored "Name the Noob", with lots of laughs and even some prizes.

HighWiz
Born of glitter and moon beams, HighWiz is the things that dreams are made of and nightmares long to be... Years ago, with the help of some very awesome people, he set about to create an event that would give the n00bs of DEF CON a place to feel welcomed and further their own pursuit of knowledge. HighWiz is the fabled Man on the Mountain whom people seek to gain a taste of his forbidden knowledge. He is a rare sighting at DEF CON only to be glimpsed by those lucky few.

Malware Unicorn
As a girl growing up, she was told she could be anything so she decided to be a unicorn. Ever since, she has made it her mission to ensure the truth is out there. Do not attempt to use malware pickup lines on her as she will pull them apart and you risk having your face impaled. Though she is fierce, she is also graceful, peaceful and determined. She is also an awesome artist.

Niki7a
There is truly only one sorceress that ensures the machinations of Def Con continue to move. She is both in tune with the magic and digital functions and is the power behind the CFP board from start to finish as well as the coordination of so many other activities behind the curtain. She works tirelessly year-round to make sure everything runs smoothly. Also, she is fun at parties and awesome AF.

@niki7a

Roamer
Appearing in a cloud of (cigarette) smoke, Roamer is a man full of whiskey and ideas. He has appeared at DEF CON since before (almost) the beginning. He is a renown author, speaker, pontificator and is famous for giving the most entertaining Worldwide Wardrive talk. He is also the Grand Vizier of All Things Vendor - you are welcome.

Wiseacre
Wiseacre was introduced to DEF CON by Roamer. Though he appeared at his first DEF CON because of the Capture the Flag contest, Roamer and HighWiz showed him how to make DEF CON so much more than simply attending the talks. From then on he made a point to participate in as much as he could. Of course, this was all within the limits of social anxiety so, if it allowed participation as a wallflower, he was in! Now, he wants to make sure everyone else gets to know as much as possible about this year's conference. In his private life, Mike hacks managers and is happy anyone listens to him at all. Mike would like to thank Highwiz for everything.

Shaggy
Shaggy has the Voice of Barry White, the brains of Albert Einstein and the soul of Bea Arthur. He has a few philosophies on life: He believes that while the righteous keep moving forward, those with clean hands become stronger and stronger . That the field of battle between God and Satan is the human soul. It is in the soul that the battle rages every moment of life. He also believes that one should Start by doing what's necessary; then do what's possible; and suddenly you are doing the impossible. Because You learn to speak by speaking, to study by studying, to run by running, to work by working, and just so, you learn to love by loving. All those who think to learn in any other way deceive themselves.

Demystifying Windows Kernel Exploitation by Abusing GDI Objects.

Saturday at 13:00 in 101 Track

45 minutes | Demo, Exploit

5A1F (Saif El-Sherei) Security Analyst, SensePost

Windows kernel exploitation is a difficult field to get into. Learning the field well enough to write your own exploits require full walkthroughs and few of those exist. This talk will do that, release two exploits and a new GDI object abuse technique.

We will provide all the detailed steps taken to develop a full privilege escalation exploit. The process includes reversing a Microsoft's patch, identifying and analyzing two bugs, developing PoCs to trigger them, turning them into code execution and then putting it all together. The result is an exploit for Windows 8.1 x64 using GDI bitmap objects and a new, previously unreleased Windows 7 SP1 x86 exploit involving the abuse of a newly discovered GDI object abuse technique.

5A1F (Saif El-Sherei)
Saif is a senior analyst with SensePost. He has a keen interest in exploit development and sharing everything he learns. Over the years he has released several exploitation tutorials, examples and a grammar-based browser fuzzer, wadi (DEF CON 23).

@saif_sherei

Digital Vengeance: Exploiting the Most Notorious C&C Toolkits

Saturday at 15:00 in Track 4

45 minutes | Demo, Tool, Exploit

Professor Plum Hacker

Every year thousands of organizations are compromised by targeted attacks. In many cases the attacks are labeled as advanced and persistent which suggests a high level of sophistication in the attack and tools used. Many times, this title is leveraged as an excuse that the events were inevitable or irresistible, as if the assailants' skill set is well beyond what defenders are capable of. To the contrary, often these assailants are not as untouchable as many would believe.

If one looks at the many APT reports that have been released over the years some clear patterns start to emerge. A small number of Remote Administration Tools are preferred by actors and reused across multiple campaigns. Frequently sited tools include Gh0st RAT, Plug-X, and XtremeRAT among others. Upon examination, the command and control components of these notorious RATs are riddled with vulnerabilities. Vulnerabilities that can be exploited to turn the tables from hunter to hunted.

The presentation will disclose several exploits that could allow remote execution or remote information disclosure on computers running these well-known C&C components. It should serve as a warning to those actors who utilize such toolsets. That is to say, such actors live in glass houses and should stop throwing stones.

Professor Plum
Professor Plum is an experienced reverse engineer, developer, and digital forensics examiner. He holds a graduate degree in Information Security from Johns Hopkins University, and has worked numerous computer incident investigations spanning the globe. He currently works as a Senior Threat Researcher for a Fortune 500 cybersecurity company and previously worked for the Department of Defense performing vulnerability research, software development, and Computer Network Operations.

@professor__plum

DNS - Devious Name Services - Destroying Privacy & Anonymity Without Your Consent

Saturday at 12:00 in Track 3

45 minutes | Art of Defense

Jim Nitterauer Senior Security Specialist, AppRiver, LLC

You've planned this engagement for weeks. Everything's mapped out. You have tested all your proxy and VPN connections. You are confident your anonymity will be protected. You fire off the first round and begin attacking your target. Suddenly something goes south. Your access to the target site is completely blocked no matter what proxy or VPN you use. Soon, your ISP contacts you reminding you of their TOS while referencing complaints from the target of your engagement. You quickly switch MAC addresses and retry only to find that you are quickly blocked again!

What happened? How were you betrayed? The culprit? Your dastardly DNS resolvers and more specifically, the use of certain EDNS0 options by those resolvers.

This presentation will cover the ways in which EDNS OPT code data can divulge details about your online activity, look at methods for discovering implementation by upstream DNS providers and discuss ways in which malicious actors can abuse these features. We will also examine steps you can take to protect yourself from these invasive disclosures.

The details covered will be only moderately technical. Having a basic understanding of RFC 6891 and general DNS processes will help in understanding. We will discuss the use of basic tools including Wireshark, Packetbeat, Graylog and Dig.

Jim Nitterauer
Currently a Senior Security Specialist at AppRiver, LLC., his team is responsible for global network deployments and manages the SecureSurf global DNS infrastructure and SecureTide global spam & virus filtering infrastructure as well as all internal applications. They also manage security operations for the entire company. He holds a CISSP certification. He is also well-versed in ethical hacking and penetration testing techniques and has been involved in technology since the late 1980s when punch cards were still a thing.

Jim has presented at NolaCon, ITEN WIRED, BSides Las Vegas, BSides Atlanta, CircleCityCon and several smaller conferences. He regularly attends national security conferences and is passionate about conveying the importance of developing, implementing and maintaining security policies for organizations. His talks convey unique and practical techniques that help attendees harden their security in practical and easy-to-deploy ways.

Jim is a senior staff member with BSides Las Vegas, a member of the ITEN WIRED Planning Committee and the president of the Florida Panhandle (ISC)2 Chapter. When not at the computer, Jim can be found working out, playing guitar, traveling or just relaxing with an adult beverage.

Twitter: @jnitterauer
LinkedIn: https://www.linkedin.com/in/jnitterauer/

DNS-Exfil-Suite

Nolan Berry

Cory Schwartz

Saturday from 1600-1750 at Table Two

Audience: I think the best audience here would be PenTesters, DNS Engineers and people looking to learn more about DNS based attack methods.

Our tool kit provides multiple methods of data exfiltration, infiltration and botnet command and control systems using 100% DNS traffic that is either hard to detect or impossible to detect.

https://github.com/ndberry/DNS_Exfil_Tool

Nolan Berry
DNS Engineer
-----------
Nolan has been working with DN for 2 years and has always been very interested in security. His passion for both security and DNS has led him to work and develop a platform for DNS exploitation in an attempt to raise awareness of known but under appreciated security flaws.

Cory Schwartz
Site Reliability Engineer
Twitter
----------
Cory has a past working on signals intelligence and processing after graduating with a degree in cryptography he served in the Air Force and then as a government contractor helping the intelligence community. After that he worked at Rackspace on CloudStorage and systems automation. Now he is an SRE at Twitter in San Fransisco.

DOOMed Point of Sale Systems

Saturday at 15:00 in Track 3

45 minutes | Demo, Exploit

trixr4skids Security Engineer

In response to public security breaches many retailers have begun efforts to minimize or completely prevent the transmission of unencrypted credit card data through their store networks and point of sale systems. While this is definitely a great improvement over the previous state of affairs; it places the security of transactions squarely in the hands of credit card terminals purchased from third party vendors. These terminals have a security posture that is often not well understood by the retail chains purchasing them. To better understand if the trust placed in these devices is warranted, the attack surface and hardening of a commonly deployed credit card terminal series is reviewed and a discussion of reverse engineered security APIs is presented. Despite the reduced attack surface of the terminals and hardened configuration, attacks that allow recovery of magstripe track data and PIN codes are demonstrated to be possible.

trixr4skids
trixr4skids is a security engineer and a recovering consultant. He enjoys hardware hacking, reverse engineering, the occasional webapp RCE, robots, beer, and of course robots that bring him beer. As a child he enjoyed taking apart everything he could get his hands on in a quest to figure out how it worked (his parents did not always appreciate this). He could never figure out what the green rectangles with the black rectangles on them did and often resorted to smashing them with a hammer to see what was inside. Since then he has learned more effective ways to go about discovering the secrets those black things are hiding and even how to make them do different things than intended. His current research projects include attacking embedded devices based on the rabbit 2000/3000 CPUs, studying the security of payment card systems, and hacking anything interesting that he can buy off eBay.

@trixr4skids

Driving down the rabbit hole

Saturday at 12:00 in 101 Track

45 minutes | Demo

Mickey Shkatov Security Researcher, McAfee.

Jesse Michael Security Researcher, McAfee.

Oleksandr Bazhaniuk Security Researcher

Over the past few years, cars and automotive systems have gained increasing attention as cyber-attack targets.  Cars are expensive.  Breaking cars can cost a lot.  So how can we find vulnerabilities in a car with no budget?  We’ll take you with us on a journey from zero car security validation experience through the discovery and disclosure of multiple remotely-exploitable automotive vulnerabilities.  Along the way, we’ll visit a wrecking yard, reassemble (most) of a 2015 Nissan Leaf in our lab, discuss how we picked our battles, fought them, and won.  During our talk, we’ll examine the details of three different classes of vulnerabilities we found in this vehicle, how they can be exploited, and the potential ramifications to the owner of their real-world exploitation.  We’ll also discuss the broader scope of the vulnerabilities discovered, how they extend beyond just this specific vehicle, and what the industry can do better to prevent these types of problems in the future.

Mickey Shkatov
Mickey Shkatov is a security researcher and a member of the McAfee Advanced Threat Research team. His areas of expertise include vulnerability research, hardware and firmware security, and embedded device security

@HackingThings

Jesse Michael
Jesse Michael has been working in security for over a decade and is currently a member of the McAfee Advanced Threat Research team who spends his time causing trouble and finding low-level hardware security vulnerabilities in modern computing platforms

@jessemichael

Oleksandr Bazhaniuk
Oleksandr Bazhaniuk is a security researcher and reverse engineer with background in automation of binary vulnerability analysis. He is also a co-founder of DCUA, the first DEF CON group in Ukraine.

@ABazhaniuk

EAPHammer

Gabriel Ryan

Saturday from 1600-1750 at Table Five

Audience: Offensive security professionals, red teamers, penetration testers, researchers.

EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on providing an easy-to-use interface that can be leveraged to execute powerful wireless attacks with minimal manual configuration. To illustrate how fast this tool is, here's an example of how to setup and execute a credential stealing evil twin attack against a WPA2-TTLS network in just two commands:

# generate certificates
./eaphammer --cert-wizard

# launch attack
./eaphammer -i wlan0 --channel 4 --auth ttls --wpa 2 --essid CorpWifi --creds

Features:
* Steal RADIUS credentials from WPA-EAP and WPA2-EAP networks.
* Perform hostile portal attacks to steal AD creds and perform indirect wireless pivots
* Perform captive portal attacks
* Built-in Responder integration
* Support for Open networks and WPA-EAP/WPA2-EAP
* No manual configuration necessary for most attacks.
* No manual configuration necessary for installation and setup process

https://github.com/s0lst1c3/eaphammer

Gabriel Ryan
Gabriel Ryan is a security consultant and researcher with a passion for wireless and infrastructure testing. He currently works for Gotham Digital Science at their New York office, where he provides full scope red team penetration testing capabilities for a diverse range of clients. He also contributes heavily to his company's research division, GDS Labs. Previously, Gabriel has worked as a penetration tester and researcher for the Virginia-based defense contractor OGSystems, and as a systems programmer for Rutgers University. He also is a member of the BSides Las Vegas senior staff, coordinating wireless security for the event. In his spare time, he enjoys live music, exploring the outdoors, and riding motorcycles.

Edge cases in web hacking

Saturday, 10:30 to 14:30 in Octavius 5

John Poulin Principal Application Security Consultant, nVisium

Learn how to identify, exploit, and chain web-app vulnerabilities that you don't see every day. These vulnerabilities will include Server-Side Template Injection, Serialization vulnerabilities and more. We will identify how common protection mechanisms in languages such as Ruby on Rails, Django and PHP can be bypassed/exploited.

Prerequisites: Basic experience with common web hacking, including Cross-Site Scripting, SQL Injection, Remote Code Execution and more.

Materials: Laptop with VMWare or Virtualbox.

Max students: 90 | Registration: https://dc25_poulin.eventbrite.com (Sold out!)

John Poulin
John is a Principal Application Security Consultant who specializes in web application security. John has over 9 years of experience in development, management, and code analysis of web applications. John specializes in Ruby on Rails applications, but is happy to work in any MVC framework. John is leading the development of a tool called Httpillage, which provides the ability to perform distributed attacks against web applications. He also plays a role in developing and maintaining nVisium's internal security services. John graduated from the University of Maine with a degree in Computer Science and a minor in German.

Evading next-gen AV using artificial intelligence

Saturday at 11:00 in Track 4

20 minutes | Demo

Hyrum Anderson Technical Director of Data Science, Endgame

Much of next-gen AV relies on machine learning to generalize to never-before-seen malware. Less well appreciated, however, is that machine learning can be susceptible to attack by, ironically, other machine learning models. In this talk, we demonstrate an AI agent trained through reinforcement learning to modify malware to evade machine learning malware detection. Reinforcement learning has produced game-changing AI's that top human level performance in the game of Go and a myriad of hacked retro Atari games (e.g., Pong). In an analogous fashion, we demonstrate an AI agent that has learned through thousands of "games" against a next-gen AV malware detector which sequence of functionality-preserving changes to perform on a Windows PE malware file so that it bypasses the detector. No math or machine learning background is required; fundamental understanding of malware and Windows PE files is a welcome; and previous experience hacking Atari Pong is a plus.

Hyrum Anderson
Hyrum Anderson is technical director of data scientist at Endgame, where he leads research on detecting adversaries and their tools using machine learning. Prior to joining Endgame he conducted information security and situational awareness research as a researcher at FireEye, Mandiant, Sandia National Laboratories and MIT Lincoln Laboratory. He received his PhD in Electrical Engineering (signal and image processing + machine learning) from the University of Washington and BS/MS degrees from Brigham Young University. Research interests include adversarial machine learning, deep learning, large-scale malware classification, active learning, and early time-series classification.

Exploitation/Malware Forward Engineering

Saturday, 14:30 to 18:30 in Octavius 5

Sean Dillon Senior Security Analyst, RiskSense, Inc.

Zachary Harding Senior Security Analyst, RiskSense, Inc.

Windows post-exploitation is the penetrating step of every penetration test if you're on a Windows network. You're obviously swimming in shells (it's Windows after all), but you aren't in full control yet. Your best account is Network Service and you want Enterprise Admin.

Elevating privileges, either through bypassing UAC or finding local exploits, stealing tokens, pivoting to other systems, scanning the local network, dumping credentials. There are few open source tools available, such as PowerShell Empire, Koadic C3, and Metasploit's Meterpreter. We will go through the low-level code that makes it all work.

The training will explore shellcode, COM, WMI, Windows API, and .NET, and how these open source tools bring it all together. You will walk away with the knowledge to write your own plugins for these systems, as well as your own custom malware. An in-depth understanding of antivirus detection and evasion will be included. This workshop is a focus on the code, not just the tactics.

Prerequisites: Programming knowledge, one or all of the following: x86/x64, Python, JavaScript, PowerShell, Ruby, C Pentesting knowledge: Basic Windows post-exploitation

Materials: Bring favorite OS and code editor, Windows VMs, WiFi.

Max students: 90 | Registration: https://dc25_dillon.eventbrite.com (Sold out!)

Sean Dillon
Sean Dillon is a senior security analyst at RiskSense, Inc. He has an established research focus on attacking the Windows kernel, and was the first to reverse engineer the DOUBLEPULSAR SMB backdoor. He is a co-author of the ETERNALBLUE Metasploit module and other contributions to the project. He has previously been a software engineer in the avionics and insurance industries, and his favorite IDE is still GW-Basic on DOS.

Zachary Harding
Zach Harding is a senior security analyst at RiskSense, Inc. Zach formerly served in the US Army as a combat medic. He, along with Sean Dillon and others, improved leaked NSA code to release the "ExtraBacon 2.0" Cisco ASA exploit package. He is an avid tester of every penetration tool he can get a hold of. You know the guy who's always looking for available public WiFi, or fiddling with a kiosk machine? That's Zach.

Exploiting 0ld Mag-stripe information with New technology

Thursday at 15:20 in 101 Track 2

20 minutes | Demo, Tool, Exploit

Salvador Mendoza Hacker

A massive attack against old magnetic stripe information could be executed with precision implementing new technology. In the past, a malicious individual could spoof magstripe data but in a slow and difficult way. Also brute force attacks were tedious and time-consuming. Technology like Bluetooth could be used today to make a persistent attack in multiple magnetic card readers at the same time with audio spoof.

Private companies, banks, trains, subways, hotels, schools and many others services are still using magstripe information to even make monetary transactions, authorize access or to generate "new" protocols like MST(Magnetic Secure Transmission) During decades the exploitation of magstripe information was an acceptable risk for many companies because the difficulty to achieve massive attacks simultaneously was not factible. But today is different.

Transmitting magstripe information in audio files is the faster and easier way to make a cross-platform magstripe spoofer. But how an attacker could transmit the audio spoof information to many magnetic card readers at the same time? In this talk, we will discuss how an attacker could send specific data or achieve a magstripe jammer for credit card terminals, PoS or any card reader. Also, how it could be implemented to generate brute force attacks against hotel door locks or tokenization processes as examples.

Salvador Mendoza
Salvador Mendoza is a security researcher focusing in tokenization processes, mag-stripe information and embedded prototypes. He has presented on tokenization flaws and payment methods at Black Hat USA, DEF CON, DerbyCon, Ekoparty, BugCON and Troopers. Salvador designed different tools to pentest mag-stripe and tokenization processes. In his designed toolset includes MagSpoofPI, JamSpay, TokenGet and lately SamyKam.

@Netxing
Blog: salmg.net

Exploiting Continuous Integration (CI) and Automated Build systems

Sunday at 11:00 in Track 3

45 minutes | Demo, Tool, Exploit

spaceB0x Sr. Security Engineer at LeanKit Inc.

Continuous Integration (CI) systems and similar architecture has taken new direction, especially in the last few years. Automating code builds, tests, and deployments is helping hordes of developers release code, and is saving companies a great amount of time and resources. But at what cost? The sudden and strong demand for these systems have created some widely adopted practices that have large security implications, especially if these systems are hosted internally. I have developed a tool that will help automate some offensive testing against certain popular CI build systems. There has been a large adoption of initiating these builds through web hooks of various kinds, especially changes to public facing code repositories. I will start with a brief overview of some of the more popular CI tools and how they are being used in many organizations. This is good information for understanding, at a high level, the purpose of these systems as well as some security benefits that they can provide. From there we will dive into specific examples of how these different CI implementations have created vulnerabilities (in one case to a CI vendor themselves). Last we will explore the tool, its purpose, and a demonstration of its use. This tool takes advantage of the configurations of various components of the build chain to look for vulnerabilities. It then has the capability to exploit, persist access, command and control vulnerable build containers. Most of the demonstration will revolve around specific CI products and repositories, however the concepts are applicable across most build systems. The goal here is to encourage further exploration of these exploitation concepts. The tool is built "modularly" to facilitate this. If you are new to CI and automated build systems, or if you have been doing it for years, this talk and tool will help you to better secure your architecture

spaceB0x
spaceB0x is extremely dedicated to his work in information security. He is the Sr. Security Engineer at a software company called LeanKit. He likes, and occasionally succeeds at, security dev-opsing, web application and network penetration testing, and some other security things. He has written tools for secure key management within automation infrastructures, capturing netflow data, and pwning automated build systems. He loves the hacker community, learning new things, and exploring new ideas.

@spaceB0xx
Website: www.untamedtheory.com

Free and Easy DFIR Triage for Everyone: From Collection to Analysis

Saturday, 10:30 to 14:30 in Octavius 6

Alan Orlikoski

Dan M.

The hardest part of Digital Forensics and Incident Response (DFIR) is getting a meaningful look at "the goods". The digital artifact collection and parsing process usually requires a lot of time, money, or both. Wouldn't it be nice if there was a way to do this with a straightforward tool chain that was 100% free*, easy to setup, didn't require a PHD in coding, GitHub command mastery, and endless hours of "Where the @%^@$ did that dependency come from and how do I get it?" This course is a tutorial to the CyLR, CDQR, Forensics Virtual Machine (CCF-VM) where attendees will learn how to establish a working collection, data processing, and analysis solution for any size environment.

Attendees will setup and learn to use their own CCF-VM that includes: secure data collection from Windows and Linux Hosts, automated processing, and meaningful presentation of the data. After the data has been collected and processed, attendees will learn how to optimize dashboards for common kill chain analysis and Data Stacking.

*Your time must be worthless and your hardware free flowing

Prerequisites: Functional knowledge of Digital Forensics and Incident Response (DFIR) fundamentals including; the IR life-cycle, artifact collection and preservation, Timeline analysis, and modern threat kill chains. Attendee should have a working knowledge of network fundamentals, Windows and Linux configurations, and virtualization. Familiarization with VMWare / VirtualBox, Python, ElasticSearch, Kibana, and Plaso is ideal but not required.

Materials: A laptop capable of running either VirtualBox or VMWare software with 100GB Free HD space and; 8Gb Ram and an i5 equivalent processor (minimum), 16Gb Ram and i7 equivalent processor (preferred). All software is available from GitHub while virtual machines and data files will be available at the course. A 32Gb USB3.0 flash drive with the software, virtual machines, and data files will be made available for the attendees at a cost of $20 (materials fee).

Max students: 30 | Registration: https://dc25_orlikoski.eventbrite.com (Sold out!)

Alan Orlikoski
Alan has over 17 years of experience in both private and public sectors of the IT industry, with over 11 years of experience leading cyber security related projects. He has an extensive forensics background, written multiple open source forensic tools, profiled on the SQRRL Threat Hunter Blog, and presented at multiple security conferences. Alan has been a leader in some of the largest incident response and security operations center development programs in the history of multiple Fortune 100 companies. He also teaches Historical European Martial Arts (yup, he knows how to fight with a sword, poleaxe, spear...you get the picture)

Dan M.
Dan is a broad-spectrum technology professional with 18 years of experience, 13 in direct performance of Digital Forensics and Incident Response (DFIR). Dan has served as a contributor, Technical Lead, and Practice Lead for a Fortune 10 Incident Response service. In this role, Dan provided oversight to the goals and delivery of the service as well as a functioning as a senior incident handler and critical incident lead. Dan's investigation experience includes support for basic forensic analysis up through responses to complete enterprise breach scenarios. During this work Dan contributed to the patent development of enterprise threat intelligence sharing technologies. Dan has also been a presenter at events such as FIRST, Evanta, HTCIA, APWG, IEEE and many customer engagements.

Friday the 13th: JSON attacks!

Sunday at 14:00 in Track 4

45 minutes | Demo, Exploit

Alvaro Muñoz Principal Security Researcher,Hewlett Packard Enterprise

Oleksandr Mirosh Senior Security QA Engineer, Hewlett Packard Enterprise

2016 was the year of Java deserialization apocalypse. Although Java Deserialization attacks were known for years, the publication of the Apache Commons Collection Remote Code Execution (RCE from now on) gadget finally brought this forgotten vulnerability to the spotlight and motivated the community to start finding and fixing these issues.

One of the most suggested solutions for avoiding Java deserialization issues was to move away from Java Deserialization altogether and use safer formats such as JSON. In this talk, we will analyze the most popular JSON parsers in both .NET and Java for potential RCE vectors.

We will demonstrate that RCE is also possible in these libraries and present details about the ones that are vulnerable to RCE by default. We will also discuss common configurations that make other libraries vulnerable.

In addition to focusing on JSON format, we will generalize the attack techniques to other serialization formats. In particular, we will pay close attention to several serialization formats in .NET. These formats have also been known to be vulnerable since 2012 but the lack of known RCE gadgets led some software vendors to not take this issue seriously. We hope this talk will change this. With the intention of bringing the due attention to this vulnerability class in .NET, we will review the known vulnerable formats, present other formats which we found to be vulnerable as well and conclude presenting several gadgets from system libraries that may be used to achieve RCE in a stable way: no memory corruption — just simple process invocation.

Finally, we will provide recommendations on how to determine if your code is vulnerable, provide remediation advice, and discuss alternative approaches.

Alvaro Muñoz
Alvaro Muñoz (@pwntester) works as Principal Software Security Researcher with HPE Security Fortify, Software Security Research (SSR). His research focuses on different programming languages and web application frameworks searching for vulnerabilities or unsafe uses of APIs. Before joining the research team, he worked as an Application Security Consultant helping enterprises to deploy their application security programs. Muñoz has presented at many Security conferences including DEF CON , RSA, AppSecEU, Protect, DISCCON, etc and holds several infosec certifications, including OSCP, GWAPT and CISSP, and is a proud member of int3pids CTF team. He blogs at http://www.pwntester.com.

@pwntester

Oleksandr Mirosh
Oleksandr Mirosh has over 9 years of computer security experience, including vulnerability research, penetration testing, reverse engineering, fuzzing, developing exploits and consulting. He is working for HPE Software Security Research team investigating and analyzing new threats, vulnerabilities, security weaknesses, new techniques of exploiting security issues and development vulnerability detection, protection and remediation rules. In the past, he has performed a wide variety of security assessments, including design and code reviews, threat modelling, testing and fuzzing in order to identify and remove any existing or potentially emerging security defects in the software of various customers.

From "One Country - One Floppy" to "Startup Nation" - the story of the early days of the Israeli hacking community, and the journey towards today's vibrant startup scene

Saturday at 16:00 in Track 2

45 minutes | Hacker History

Inbar Raz Principal Researcher, PerimeterX Inc.

Eden Shochat Equal Partner, Aleph

The late 80's and early 90's played a pivotal role in the forming of the Israeli tech scene as we know it today, producing companies like Checkpoint, Waze, Wix, Mobileye, Viber and billions of dollars in fundraising and exits. The people who would later build that industry were in anywhere from elementary school to high school, and their paths included some of the best hacking stories of the time (certainly in the eyes of the locals). The combination of extremely expensive Internet and international dial system, non-existent legal enforcement and a lagging national phone company could not prevent dozens of hungry-for-knowledge kids from teaching themselves the dark arts of reversing, hacking, cracking, phreaking and even carding. The world looked completely different back then and we have some great stories for you. We will cover the evolution of the many-years-later-to-be-named-Cyber community, including personal stories from nearly all categories. Come listen how the Israeli Cyber "empire" was born, 25 years ago, from the perspectives of 2:401/100 and 2:401/100.1.

Inbar Raz
Inbar has been reverse engineering for nearly as long as he has been living. It started with a screwdriver, pliers, wire cutters, and his grandfather's ECG machine, and gradually transitioned into less destructive research. In 1984, aged 9, he started programming on his Dragon 64. At 13 he got his first PC - Amstrad PC1512 - and within a year was already into reverse engineering. It wasn't long before he discovered how to access the X.25 network, Bitnet and Fidonet, and through high-school he was a key figure in the Israeli BBS scene.

Inbar spent most of his career in the Internet and Data Security field, and the only reason he's not in jail right now is because he chose the right side of the law at an early age. In fact, nowadays he commonly lectures about Ethical Hacking and Coordinated Vulnerability Disclosure.

Inbar specializes in outside-the-box approach to analyzing security and finding vulnerabilities, and is currently the Principal Researcher at PerimeterX, researching and educating the public on Automated Attacks on Websites.

@inbarraz
https://www.linkedin.com/in/inbar-raz-90a7913/

Eden Shochat
Eden Shochat builds stuff, most recently Aleph, +$330MM venture capital fund; The Junction, voted #1 startup program in Israel; face.com, a massive face recognition API acquired by Facebook; Aternity, the leading user-centric enterprise IT platform, acquired by Riverbed; and GeekCon, Europe's biggest makers conference. Eden grew up in Nigeria, where he was bored into assembly programming for the Z80 chip, graduated into the demo and cracking scenes while being thrown out of high-school but ended up being a (somewhat) productive member of society.

@eden
https://www.linkedin.com/in/edens/

From Box to Backdoor: Using Old School Tools and Techniques to Discover Backdoors in Modern Devices

Thursday at 11:00 in 101 Track

45 minutes

Patrick DeSantis Senior Security Research Engineer, Cisco Talos

Stringing together the exploitation of several seemingly uninteresting vulnerabilities can be a fun challenge for security researchers, penetration testers, and malicious attackers. This talk follows some of the paths and thought processes that one researcher followed while evaluating the security of several new "out of the box" Industrial Control System (ICS) and Internet of Things (IoT) devices, using a variety of well known exploitation and analysis techniques, and eventually finding undocumented, root-level, and sometimes un-removable, backdoor accounts.

Patrick DeSantis
Patrick DeSantis is a security researcher with Cisco Talos and focuses his efforts on discovery and exploitation of vulnerabilities in technologies that have an impact on the physical world, such as Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA), Internet of Things (IoT), and anything else that looks like it's asking to be hacked. Patrick's background includes work in both the public and private sectors, as well as a pile of information security certifications and a few college degrees.

@pat_r10t

Fuzzapi

Abhijeth Dugginapeddi

Lalith Rallabhandi

Srinivas Rao

Saturday from 1000-1150 at Table One

Audience: AppSec, Web/Mobile Developers, DevOps

Fuzzapi is a REST API pen testing tool that automatically does a bunch of checks for vulnerabilities on your APIs. Rather than a tool that only identifies vulnerabilities in web services, we have built a platform that enables everyone to test and understand a large range of API vulnerabilities that exist in both web and mobile applications. After seeing the benefits of Automating REST API pen testing using a basic Fuzzapi tool, the authors have decided to come up with a better version which can automatically look into vulnerabilities in APIs from the time they are written. REST APIs are often one of the main sources of vulnerabilities in most web/mobile applications. Developers quite commonly make mistakes in defining permissions on various cross-platform APIs. This gives a chance for the attackers to abuse these APIs for vulnerabilities. Fuzzapi is a tool written in Ruby on Rails which helps to quickly identify such commonly found vulnerabilities in APIs which helps developers to fix them earlier in SDLC life cycle. The first released version of the tool only has limited functionalities however, the authors are currently working on releasing the next version which will completely automate the process which saves a lot of time and resources.

https://www.youtube.com/watch?v=43G_nSTdxLk&t=321s

Abhijeth Dugginapeddi
Abhijeth D (@abhijeth) is a Security Consultant working for a bank in Australia. Previously worked with Adobe Systems, TCS and Sourcenxt. Security Enthusiast in the fields of Penetration Testing, Application/Mobile/Infrastructure Security. Believes in need for more security awareness and free responsible disclosures. Got lucky in finding few vulnerabilities with Google, Yahoo, Facebook, Microsoft, Ebay, Paypal, etc and one among Top 5 researchers in Synack a bug bounty platform. Also interested in Social media Marketing, Digital Marketing and Web designing.

Lalith Rallabhandi
Lalith Rallabhandi (@lalithr95) currently works as a Security Intern at Shopify. He has previously worked with Hackerrank, Zomato and Google Summer of Code. Likes to code, break stuff mostly with web applications and is a Ruby on rails Enthusiast. Found bugs with Google, Microsoft, Facebook, Badoo, Twitter etc.

Srinivas Rao

Game of Chromes: Owning the Web with Zombie Chrome Extensions

Sunday at 13:00 in 101 Track

45 minutes | Demo

Tomer Cohen R&D Security Team Leader, Wix.com

On April 16 2016, an army of bots stormed upon Wix servers, creating new accounts and publishing shady websites in mass. The attack was carried by a malicious Chrome extension, installed on tens of thousands of devices, sending HTTP requests simultaneously. This "Extension Bot" has used Wix websites platform and Facebook messaging service, to distribute itself among users. Two months later, same attackers strike again. This time they used infectious notifications, popping up on Facebook and leading to a malicious Windows-runnable JSE file. Upon clicking, the file ran and installed a Chrome extension on the victim's browser. Then the extension used Facebook messaging once again to pass itself on to more victims.

Analyzing these attacks, we were amazed by the highly elusive nature of these bots, especially when it comes to bypassing web-based bot-detection systems. This shouldn't be surprising, since legit browser extensions are supposed to send Facebook messages, create Wix websites, or in fact perform any action on behalf of the user.

On the other hand, smuggling a malicious extension into Google Web Store and distributing it among victims efficiently, like these attackers did, is let's say - not a stroll in the park. But don't worry, there are other options.

Recently, several popular Chrome extensions were found to be vulnerable to XSS. Yep, the same old XSS every rookie finds in so many web applications. So browser extensions suffer from it too, and sadly, in their case it can be much deadlier than in regular websites. One noticeable example is the Adobe Acrobat Chrome extension, which was silently installed on January 10 by Adobe, on an insane number of 30 million devices. A DOM-based XSS vulnerability in the extension (found by Google Project Zero) allowed an attacker to craft a content that would run Javascript as the extension.

In this talk I will show how such a flaw leads to full and permanent control over the victim's browser, turning the extension into zombie. Additionally, Shedding more light on the 2016 attacks on Wix and Facebook described in the beginning, I will demonstrate how an attacker can use similar techniques to distribute her malicious payload efficiently on to new victims, through popular social platforms - creating the web's most powerful botnet ever.

Tomer Cohen
Tomer Cohen leads the team at Wix.com responsible for all R&D and production systems security. Previous to that, Tomer has worked as an application security expert in several firms. Tomer was also one of the founders of "Magshimim" cyber training program, which teaches development and cyber security among high-school students in the periphery of Israel.

Game of Drones: Putting the Emerging "Drone Defense" Market to the Test

Saturday at 16:00 in Track 4

45 minutes | Art of Defense, Demo, Tool

Francis Brown Partner, Bishop Fox

David Latimer Security Analyst, Bishop Fox

When you learned that military and law enforcement agencies had trained screaming eagles to pluck drones from the sky, did you too find yourself asking: "I wonder if I could throw these eagles off my tail, maybe by deploying delicious bacon countermeasures?" Well you'd be wise to question just how effective these emerging, first generation "drone defense" solutions really are, and which amount to little more than "snake oil".

There is no such thing as "best practices" when it comes to defending against "rogue drones", period. Over the past 2 years, new defensive products that detect and respond to "rogue drones" have been crawling out of the woodwork. The vast majority are immature, unproven solutions that require a proper vetting.

We've taken a MythBusters-style approach to testing the effectiveness of a variety of drone defense solutions, pitting them against our DangerDrone. Videos demonstrating the results should be almost as fun for you to watch as they were for us to produce. Expect to witness epic aerial battles against an assortment of drone defense types, including:

• trained eagles and falcons that hunt "rogue drones"
• fighter drones that hunt and shoot nets
• drones with large nets that swoop in and snatch up 'rogue drones'
• surface-to-air projectile weapons, including bazooka-like cannons that launch nets, and shotgun shells containing nets
• signal jamming and hijacking devices that attack drone command and control interfaces
• even frickin' laser beams and Patriot missiles!

We'll also be releasing DangerDrone v2.0, an upgraded version of our free Raspberry Pi-based pentesting quadcopter (basically a ~$500 hacker's laptop, that can also fly). We'll be giving away a fully functional DangerDrone v2.0 to one lucky audience member!

So come see what's guaranteed to be the most entertaining talk this year and find out which of these dogs can hunt!

Francis Brown
Francis Brown, CISA, CISSP, MCSE, is a Managing Partner at Bishop Fox (formerly Stach & Liu), a security consulting firm providing IT security services to the Fortune 1000 and global financial institutions as well as U.S. and foreign governments. Before joining Stach & Liu, Francis served as an IT Security Specialist with the Global Risk Assessment team of Honeywell International where he performed network and application penetration testing, product security evaluations, incident response, and risk assessments of critical infrastructure. Prior to that, Francis was a consultant with the Ernst & Young Advanced Security Centers and conducted network, application, wireless, and remote access penetration tests for Fortune 500 clients.

Francis has presented his research at leading conferences such as Black Hat USA, DEF CON , RSA, InfoSec World, ToorCon, and HackCon and has been cited in numerous industry and academic publications.

Francis holds a Bachelor of Science and Engineering from the University of Pennsylvania with a major in Computer Science and Engineering and a minor in Psychology. While at Penn, Francis taught operating system implementation, C programming, and participated in DARPA-funded research into advanced intrusion prevention system techniques.

David Latimer
David Latimer is a Security Analyst at Bishop Fox, a security consulting firm providing IT security services to the Fortune 500, global financial institutions, and high-tech startups. In this role, he focuses on network and web application penetration testing.

He won a state Cisco Networking Skills competition for Arizona in 2013. He has acted as a network engineer for one of Phoenix's largest datacenters, PhoenixNAP, where he architected large-scale virtualization clusters and assisted with backup disaster recovery services.

Genetic Diseases to Guide Digital Hacks of the Human Genome: How the Cancer Moonshot Program will Enable Almost Anyone to Crash the Operating System that Runs You or to End Civilization...

Sunday at 12:00 in Track 4

45 minutes

John Sotos Chief Medical Officer, Intel Corporation

The human genome is, fundamentally, a complex open-source digital operating system (and set of application programs) built on the digital molecules DNA and RNA.

The genome has thousands of publicly documented, unpatchable security vulnerabilities, previously called "genetic diseases." Because emerging DNA/RNA technologies, including CRISPR-Cas9 and especially those arising from the Cancer Moonshot program, will create straightforward methods to digitally reprogram the genome in free-living humans, malicious exploitation of genomic vulnerabilities will soon be possible on a wide scale.

This presentation shows the breathtaking potential for such hacks, most notably the exquisite targeting precision that the genome supports — in effect, population, and time — spanning annoyance to organized crime to civilization-ending pandemics far worse than Ebola.

Because humans are poor at responding to less-than-immediate threats, and because there is no marketplace demand for defensive technologies on the DNA/RNA platform, the hacker community has an important role to play in devising thought-experiments to convince policy makers to initiate defensive works, before offensive hacks can be deployed in the wild. Hackers can literally save the world... from ourselves.

John Sotos
John Sotos is Chief Medical Officer at Intel Corporation. He has been programming computers continuously since 1970, excepting four years of medical school at Johns Hopkins, where he also trained as a transplantation cardiologist. His professional interests include hacking the medical diagnostic process, first with a book on edge cases, called "Zebra Cards: An Aid to Obscure Diagnosis," followed by six years as a medical technical consultant on the popular television series "House, MD." His masters degree in artificial intelligence is from Stanford, and he is a co-founder of Expertscape.com. He is a long-time air rescue flight surgeon for the National Guard; however, the opinions presented here are his own, and do not necessarily represent those of the Department of Defense or Intel.

www.intel.com
www.sotos.com

Get-$pwnd: Attacking Battle-Hardened Windows Server

Saturday at 10:00 in Track 3

20 minutes | Demo, Tool

Lee Holmes Principal Security Architect, Microsoft

Windows Server has introduced major advances in remote management hardening in recent years through
PowerShell Just Enough Administration ("JEA"). When set up correctly, hardened JEA endpoints can provide
a formidable barrier for attackers: whitelisted commands, with no administrative access to the underlying
operating system.

In this presentation, watch as we show how to systematically destroy these hardened endpoints by exploiting
insecure coding practices and administrative complexity.

Lee Holmes
Lee Holmes is the lead security architect of Microsoft's Azure Management group, covering Azure Stack,
System Center, and Operations Management Suite. He is author of the Windows PowerShell Cookbook,
and an original member of the PowerShell development team.

Ghost in the Droid: Possessing Android Applications with ParaSpectre

Sunday at 10:20 in Track 4

20 minutes | Demo, Tool

chaosdata Senior Security Consultant, NCC Group

Modern Android applications are large and complex, and can be a pain to analyze even without obfuscation - static analysis can only get one so far, the debugger sucks, Frida doesn't give you enough access to the Java environment, and editing smali or writing Xposed hooks can be time consuming and error prone. There has to be a better way!

What if we could inject a command line REPL into an app to drive functionality? And what if we could also make writing function hooks fast and easy?

In this talk, I will introduce ParaSpectre, a platform for dynamic analysis of Android applications that injects JRuby into Android applications. It bundles a hook configuration web API, a web application interface to configure and edit hooks, and a connect-back JRuby REPL to aid application exploration from the inside-out. It supports various selectors to match classes and methods, can be reconfigured on-the-fly without requiring a device reboot, and takes the pain out of writing method hooks for Android apps.

ParaSpectre is for developers and security researchers alike. While not itself a debugger, it provides a level of access into a running application that a debugger generally won't.

chaosdata
chaosdata(aka "Jeff") is a security consultant by day, and sometimes by night. He hacks on embedded systems, mobile apps and devices, web apps, and complicated things that don't have names. He also likes exotic candies.

@chaosdatumz

GibberSense

Ajit Hatti

Saturday from 1000-1150 at Table Two

Audience: Cryptologers, crypt analysts, forensic investigators, developers and testers.

On your forensics and investigation assignment found a Gibberish string or unknown file and dont know what is it? Throw it to GibberSense, it might try to make some sense out of it.

Not sure if a file is encrypted, encoded or obfuscated using substitution ciphers? Gibbersense can give you statistical analysis of the contents and gives you direction for further investigation and also gives you an excellent visualization.

Being an extensible framework, Gibbersense gives tools for simple xor encryption, frequency analysis, which gives basic cryptanalysis capabilities.

An Open Source Initiative GibberSense is an experimental tool for improving investigations.

https://github.com/smxlabs/gibbersense

Ajit Hatti
Ajit Hatti has been contributing on secure usage of cryptography from past 5 years and currently focusing on the security issues of BlockChain related Technologies. He is an author of LAMMA & GibberSense tools which help in securing crypto and PKI Implementatinos.

Ajit is founder of SecurityMonx and is also working in collaboration with Payatu on futuristic projects. He also co-founded Null Open Security Community and has worked with Symantec, Emerson, ZScaler, IBM and Bluelane as a Security Researcher.

Ajit has presented his work at BlackHat DEFCON Crypto-n-Privacy Village and organizes Nullcon in India. He loves to Run & Volunteer at BSides LV and organizes The World Run by Hackers.

GoFetch

Tal Maor

Sunday from 1000-1150 at Table Three

Audience: Enterprise, Applied Security, Windows domain, Defense and offense

GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application. The tool first loads a path of local admin users and computers generated by BloodHound and convert it to its own attack plan format. Once the attack plan is ready, it advances towards the destination according to the plan, step by step by successively apply remote code execution techniques and compromising credentials with Invoke-Mimikatz, Mimikatz and Invoke-Psexec.

A video of the Python version was published here: https://www.youtube.com/watch?v=dPsLVE0R1Tg A video of Invoke-GoFetch will be published soon. BloodHound Application - https://github.com/BloodHoundAD/BloodHound

Tal Maor
Tal Maor is a Security Researcher at Microsoft who has a passion for creating tools which makes life easy and more secured. Prior to Microsoft, Tal was developing intelligence platforms in a leading company, and previously served in the IDF intelligence unit for four years. Tal holds a B.Sc degree in Computer Science.

GreatFET

Dominic Spill

Michael Ossmann

Saturday from 1200-1350 at Table Three

Audience: Hardware & Offense

GreatFET is an open source hardware hacking platform. In addition to support for common protocols such as SPI, USB, JTAG, and UART, GreatFET also allows us to implement arbitray protocols, as well as GPIO and acting as a logic analyser. Add on boards, known as neighbors, allow us to build on the flexibility of GreatFET and rapidly create new tools. Example neighbors include radio platforms, software defined infrared transceivers, and interfaces for hardware hacking.

Hardware: https://github.com/greatscottgadgets/greatfet Software/firmware: https://github.com/dominicgs/GreatFET-experimental

Dominic Spill
Dominic is a senior security researcher at Great Scott Gadgets, where he builds open source tools for reverse engineering communication protocols.

Michael Ossmann
Michael is a wireless security researcher who makes hardware for hackers. He founded Great Scott Gadgets in an effort to put exciting, new tools into the hands of innovative people.