University of Wollongong: PetaJakarta

uk: Комп'ютерні науки

description: The PetaJakarta Data Sharing Project aims to promote national and international research collaboration through the sharing of data related to the response of the city of Jakarta to flooding during the 2014/2015 monsoon season. The two data collections released as part of the PetaJakarta Collaborative Data Sharing Project will form an in-valuable suite of open, well described and richly connected data relating infrastructure and social media use in the context of flooding Jakarta. The data are all connected by their relevance to flooding, spatial location and temporal extents. These data will represent a unique insight to researchers seeking to understand the response of mega-city infrastructure to flooding in a developing nations context where social media data offer a potential alternative to limited pre-existing formal flood data networks. It should be noted that the two data collections released by this Collaborative Data Sharing Project are complimented by existing external data-sets relevant for researchers in this area. These are principally, the collection of historical flood extents released by BPBD under the OpenStreetMap license, and the ongoing acquisition of topographic map data undertaken by the Humanitarian OpenStreetMap team, also released under an OpenStreetMap license. While the direct inclusion of these data in this Data Collection is outside the scope of this project, and the data included by this Data Collection Project are valuable independently of these external data, it is important to appreciate the availability of these external data, helping to support future research projects beyond the PetaJakarta programme. The pilot study for PetaJakarta, in conjunction with the Regional Disaster Management Agency (BPBD) of the local government in Jakarta (BPBD), will proceed for one year from May 1 2014. This joint study will evaluate the potential for an integrated suite of geosocial media and infrastructure data, collected by PetaJakarta, to augment BPBD’s existing information system to support decision-making during flood response. The pilot study is building on significant existing research undertaken and data collected by the Co-CIs, including the mapping of over 1000 Km of waterways and hydrological infrastructure in Jakarta, and the development of a web-based open source platform to collect social media activity related to flood events. During the 2014/2015 monsoon season the PetaJakarta team will work with BPBD and Twitter to collect spatial data on social media activity during flooding, and augment existing hydrological infrastructure records. These data will form the key deliverables for the ANDS support PetaJakarta Data Sharing Project.

uk: вхід без авторизації


Erwartungswert

Michael Kohler

type: Person

cs: Matematika

de: Mathematik

fi: matematiikka

uk: Математика

en: Mathematics

fr: Mathématiques

da: Matematik

es: Matemáticas

nl: Wiskunde

de: Mathematik, Naturwissenschaften

uk: Математика, природничі науки

en: Mathematics, Natural Sciences

description: Die Vorlesung richtet sich an Studierende des Faches Mathematik. Sie gibt eine maßtheoretisch fundierte Einführung in die Wahrscheinlichkeitstheorie. Vorkenntnisse beim Verständnis von Wahrscheinlichkeiten (wie sie im vergangenen Semester in der Vorlesung „Einführung in die Stochastik“ vermittelt wurden) sind zum Verständnis nützlich. Die benötigten Grundlagen aus der Maß- und Integrationstheorie werden in der Vorlesung noch einmal kurz vorgestellt.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: de

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

Technische Universität Darmstadt

addressCountry: DE

addressLocality: Darmstadt

addressRegion: Hesse

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: Jingbo Wang (NCI) and Amir Aryani (ANDS) present the Neo4j queries that can help data managers to explore the connections between datasets, researchers, grants, and publications using the graph model and Research Data Switchboard. In addition, they discuss the recent paper on "Graph connections made by RD-Switchboard using NCI’s metadata", presented in the Reproducible Open Science workshop in Hannover earlier this month.

@language: en

uk: вхід без авторизації

name: Using Neo4j for exploring the research graph connections made by RD-Switchboard

Australian Research Data Commons (ARDC)

addressCountry: AU

addressLocality: Melbourne

addressRegion: Victoria


Vocabulary services

uk: Комп'ютерні науки

description: Rowan Brownlee from ANDS gave this presentation to the September 7, 2016 meeting of AVSIG, the Australian Vocabulary Special Interest Group. The presentation provides a brief overview of ANDS vocabulary services, along with a couple of starting points for finding vocabularies.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Ivan Hanigan takes us through using reproducible research pipelines to help disentangle health effects of environmental changes from social factors. Dave Connell covers the project cycle used at the Australian Antarctic Data Centre.

uk: вхід без авторизації

name: 23 (Research data) things Catchup - 06.09.2016


Erwartungswert und Dichte

uk: Математика, природничі науки

uk: вхід без авторизації


uk: Комп'ютерні науки

description: A spotlight on the ANDS Developer Tool Box -- Vocabulary Service API The Vocabulary Service API allows developers to integrate with the ANDS Vocabulary service using HTTP and a variety of data representations (including XML, JSON and RDF). This short video will give you a brief overview of the API and some of its practical use cases.

uk: вхід без авторизації

name: Cool Tools for Easy Rich Collections Descriptions - Vocab Service API: ANDS Developers Toolbox


uk: Комп'ютерні науки

description: Recording of a presentation given by Simon Cox (CSIRO) and Nick Car (Geoscience Australia) at the June 2017 AVSIG meeting. Nick and Simon gave an overview of ontologies and vocabularies, using five examples on the vocabulary/ontology spectrum.

uk: вхід без авторизації

name: Vocabularies & Ontologies: similarities & differences, definitions & structures


uk: Комп'ютерні науки

description: The ANDS Vocabulary Widget allows you to instantly add Data Classification capabilities to your data capture tools through the ANDS Vocabulary Service. The widget has been written in the style of a jQuery plugin, allowing complete control over styling and functionality with just a few lines of javascript.

uk: вхід без авторизації

name: Cool Tools In the Developers Toolbox - Vocabulary Widget


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Snippet - FAIR Findable #1 - Into to FAIR and F for Findable I: Finding PARADISEC


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Snippet - FAIR Findable #1 - Intro to FAIR and F for Findable II


uk: Комп'ютерні науки

description: #1 FINDABLE covers: -- an overview of the FAIR principles: their origins, Australian FAIR initiatives, what FAIR is (and what it is not) -- the 4 FINDABLE principles which underpin the discoverability of data -- resources to support institutional awareness and uptake of Findable principles to make your institutional data globally discoverable

uk: вхід без авторизації

name: FAIR Findable #1 - Into to FAIR and F for Findable - 30-08-17


uk: Комп'ютерні науки

description: #4 REUSABLE covers: -- an overview of the REUSABLE principles which bring together licensing, provenance and domain-relevant standards -- resources to support institutional awareness and uptake of Interoperable principles Speakers 1) Keith Russell, ANDS provides an overview of the principles behind the FAIR concept of how to make data Re-usable 2) Margie Smith (unrecorded), Geoscience Australia discussed why Provenance information is critical to data reuse and how GA have approached attaching provenance information to data 3) Nerida Quatermass from Creative Commons Australia @QUT presents on licensing frameworks and choosing a licence to make the data more Re-usable

uk: вхід без авторизації

name: FAIR Reusable #4 - R for Reusable - 20-09-17


uk: Комп'ютерні науки

description: A 1 min snippet where George outlines what he talks about in the full webinar: Provenance and Social Science data, on March 15th 2017.

uk: вхід без авторизації

name: Snippet - Documenting Data Transformations


uk: Комп'ютерні науки

description: Find out how the 23 (Research Data) Things will work, how to get more involved, how to signup to the catch-up webinars and much more.. Topics include: - Intro explaining the 23 (Research data) Things - Getting everyone connected via meetup -how & why & when - How the ALIA PD points will work - How the catch-up webinar sessions will work - How different groups are coming together around the region

uk: вхід без авторизації

name: 23 (research data) Things kick off webinar - 01.03.2016


uk: Комп'ютерні науки

description: The FAIR data principles were drafted by the FORCE11 group in 2015. The principles have since received worldwide recognition as a useful framework for thinking about sharing data in a way that will enable maximum use and reuse. This webinar series is a great opportunity to explore each of the 4 FAIR principles in depth - practical case studies from a range of disciplines and organisations from around Australia, and resources to support the uptake of FAIR principles.

uk: вхід без авторизації

name: FAIR Accessible #2 - A for Accessible I - 06-09-17


uk: Комп'ютерні науки

description: David Fitzgerald, Data Manager for the Australian Longitudinal Study of Women’s Health (ALSWH) presents how ALSWH makes a nationally significant longitudinal study with highly sensitive data accessible for others to reuse. The FAIR data principles were drafted by the FORCE11 group in 2015. The principles have since received worldwide recognition as a useful framework for thinking about sharing data in a way that will enable maximum use and reuse. This webinar series is a great opportunity to explore each of the 4 FAIR principles in depth - practical case studies from a range of disciplines and organisations from around Australia, and resources to support the uptake of FAIR principles.

uk: вхід без авторизації

name: Snippet - FAIR Accessible #2 - A for Accessible III


Vorlesung 1: Differenziation

uk: Математика, природничі науки

uk: вхід без авторизації


Vorlesung 10: Fourier-Reihen

uk: Математика, природничі науки

uk: вхід без авторизації


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 11: Fourier-Reihen, Funktionen in mehreren Variablen


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 12: Funktionen in mehreren Variablen: Stetigkeit


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 13: Vektorfelder und partielle Ableitung


Vorlesung 14: Partielle Ableitung

uk: Математика, природничі науки

uk: вхід без авторизації


Vorlesung 15: Totale Ableitung

uk: Математика, природничі науки

uk: вхід без авторизації


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 16: Satz von Taylor und Extrema


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 17: Extremwerte unter Nebenbedingungen


Vorlesung 18: Parameterintegral

uk: Математика, природничі науки

uk: вхід без авторизації


Vorlesung 19: Kurvenintegral

uk: Математика, природничі науки

uk: вхід без авторизації


Vorlesung 2: Differenziationsregeln

uk: Математика, природничі науки

uk: вхід без авторизації


Vorlesung 20: Potentialfelder

uk: Математика, природничі науки

uk: вхід без авторизації


Vorlesung 21: Gebietsintegral

uk: Математика, природничі науки

uk: вхід без авторизації


Vorlesung 22: Polarkoordinaten

uk: Математика, природничі науки

uk: вхід без авторизації


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 23: Zylinder und Kugelkoordinaten


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 24: Gauß'scher und Stokes'scher Integralsatz


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 3: Höhere Ableitungen und Stammfunktion


Vorlesung 4: Integrationsregeln

uk: Математика, природничі науки

uk: вхід без авторизації


Vorlesung 5: Bedeutung des Integrals

uk: Математика, природничі науки

uk: вхід без авторизації


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 6: Partialbruchzerlegung und uneigentliche Integrale


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 7: Uneigentliche Integrale und Potenzreihen


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 8: Taylor-Reihen und Taylorpolynome


uk: Математика, природничі науки

uk: вхід без авторизації

name: Vorlesung 9: Taylorreihe und Landausymbole


Ebenen im R³ und komplexe Zahlen

uk: Математика, природничі науки

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Der Algorithmen-Hype in Deutschland ist beeindruckend: 10 Jahre hinter dem US-amerikanischen Diskurs zurückbleibend, stehen Fragen zur Debatte, die in den 80ern in den Leuchttürmen der Wissenschaft Beantwortung fanden. Lösungen für Probleme algorithmischer Entscheidungsfindung für komplexe und neue Fälle sind teils bei uns bereits Gesetz - nur droht die Implementierung zu scheitern. Kybernetische Gesellschaftsmodelle können realisiert werden - doch ihre konstruktiven Prämissen sind längst gefallen. Das Gute ist: Lösungen liegen auf der Hand und werden hier vorgestellt.

uk: вхід без авторизації

name: Algorithmen und Künstliche Intelligenz: Wegweiser für Politik und Gesellschaft


Miscellaneous (13.7.2011)

uk: Комп'ютерні науки

description: This lecture provides an introduction to the fields of information retrieval and web search. We will discuss how relevant information can be found in very large and mostly unstructured data collections; this is particularly interesting in cases where users cannot provide a clear formulation of their current information need. Web search engines like Google are a typical application of the techniques covered by this course.

uk: вхід без авторизації

name: Technische Universität Braunschweig, Institut für Informationssysteme

addressLocality: Braunschweig

addressRegion: Lower Saxony


uk: Комп'ютерні науки

description: Can a bot break the law? Who is liable if a self-driving car crashes? Can a robot infringe copyright? Can a software developer go to jail for the actions of a machine learning algorithm? This talk will try to answer this and other questions regarding artificial intelligence and the law.

uk: вхід без авторизації

name: Robots behaving badly: Legal responsibility in the age of artificial intelligence


Crisis Response Makerspaces

uk: Комп'ютерні науки

description: A mid-wife in the mountains of Nepal, a surgeon under bombardment in Northern Syria – how can digital, distributed manufacturing support them to deliver basic needs and healthcare services they need? This session will present different innovative approaches to hacking the humanitarian aid system. Speakers will present their projects and discuss how they can support each other by creating a globally accessible open source catalogue and network of crisis response makerspaces.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: The use of data and information communication technologies (ICTs) by civil society organizations, governments, and private sector entities is now a mainstream, day-to-day part of how humanitarian and development projects happen. However, there are few real world examples of how to responsibly use these tools in ethical and effective ways that protect and respect human rights of some of the world’s most vulnerable people. What are greatest threats, harms and risks associated with using ICTs in humanitarian environments, and how might humanitarian actors mitigate these? Consequently, it is also often unclear how ICTs stand to benefit humanitarian action. The panelists will share their recent experiences trying to create best practices and design new technology for using data in extremely complex environments such as Jordan, the Palestinian Territories, and Lebanon.

uk: вхід без авторизації

name: Data Responsibility on the Front Lines: Protection and Security in Humanitarian Response


uk: Комп'ютерні науки

description: Manche Menschen leben schon heute mehr in der Virtuellen Realität als im so genannten „echten“ Leben. Doch diese Unterscheidung ist relativ, wie meine große Recherche 2017 sowohl in VR als auch aller Welt ergeben hat. Die Menschen machen das, was Forscher für die Zukunft vorhersagen: wir werden wählen zwischen Realitäten, in denen wir uns aufhalten. Die Virtuelle ist keine zweite-Klasse-Realität. Wie fühlt sie sich an für die Menschen, die sie schon jetzt ihrem echten Leben vorziehen?

uk: вхід без авторизації

name: VR stellt unseren Begriff vom echten Leben in Frage


uk: Комп'ютерні науки

description: Forensic Architecture is an independent research agency that undertakes historical and theoretical examinations of the history and present in articulating notions of public truth.

uk: вхід без авторизації

name: Forensic Architecture- Data against Devilry


uk: Комп'ютерні науки

description: The idea of Open Science is to enable more people to make valuable contributions to scientific research and develop solutions collectively, especially in low-resource settings. Due to pricey lab equipment much research output has been restricted to a few highly funded laboratories. In countries like Egypt and Cameroon, innovators and scientists are fixing, hacking and recreating tools using digital fabrication. Discuss with us Open Science Hardware and laboratory equipment as a common good.

uk: вхід без авторизації

name: Hacking the Ivory Tower: Towards Lab Equipment as a Common Good


uk: Комп'ютерні науки

description: Als Bitcoin geboren wurde, entfachte es bei vielen die Hoffnung auf ein alternatives Finanzsystem: dezentral, unabhängig von staatlicher Macht und Manipulation, kontrolliert von den Menschen selbst, schnell und günstig. Heute geht es gar nicht mehr um Währungen, sondern um Tokens, ICOs und Marktakpitalisierung. Das Ziel: Mehr altes Geld mit neuen Mitteln machen. Ist die Idee hinter Bitcoin gestorben? Bauen wir noch ein alternatives Finanzsystem – oder passen wir das alte nur an? Und was muss passieren, damit der Traum hinter Bitcoin doch noch wahr wird?

uk: вхід без авторизації

name: Kryptopia – oder altes Geld mit neuen Mitteln?


uk: Комп'ютерні науки

description: Spatial-Computing-Technologien wie Virtual (VR) und Augmented Reality (AR) stellen nicht einfach nur eine Fortentwicklung des Computer-Interfaces dar, sondern markieren den Beginn einer neuen Computer-Ära, in der digitale Virtualität selbstverständlicher Teil des Alltags und Realitätserlebens wird. Deshalb müssen wir verstehen, was Virtualität ist und wie sie im Alltag wirkt.

uk: вхід без авторизації

name: Spatial Computing – VR & AR als Grundlagen für eine neue Computer-Ära


uk: Комп'ютерні науки

description: How can technology acceleration be harnessed to tackle wicked problems, such as climate change, rapid urbanization, or feeding 10 billion people while regenerating natural ecosystems? This question is at the foundation of Good Tech Lab, which explores the frontiers of technology, entrepreneurship and finance, where pioneers tackle the world's biggest problems. In this talk, we will share some insights of our research on "impact tech" entrepreneurship, as well as the opportunities and challenges this movement is facing.

uk: вхід без авторизації

name: The New Frontiers of Technology and Impact


uk: Комп'ютерні науки

description: Wir werden in den nächsten zehn Jahren sehr stark mit dem Aufkommen von künstlicher Intelligenz konfrontiert werden. Sie wird viele Bereiche unseres Lebens fundamental verändern. Von Industrie 4.0 über autonome Maschinen bis hin zu Anwendungen in der Medizin verstärkt sich der Einsatz von Deep Learning – Systemen. Dabei stellt sich die Frage, inwieweit wir diesen neuen intelligenten Systemen vertrauen können. Wieviel Verantwortung geben wir ab?

uk: вхід без авторизації

name: Mensch und Maschine – wer programmiert wen?


uk: Комп'ютерні науки

description: When humans imagined robots and computers in the workplace, they have envisioned them as servants and supporters of mankind. However, in recent years, many online platforms, such as Uber or Amazon Mechanical Turk, are “employing” myriads of human workers for tasks supervised, controlled and managed by algorithms. How does it feel like when your boss is an AI algorithm? How do human workers react when the algorithm maltreats them? And how can platforms enable workers in platform mediated-work to regain their voice and autonomy? In this session, Lior Zalmanson and Thomas Gegenhuber will share their insights from their recent academic studies and outline future directions for labor relations in platform-mediated work.

uk: вхід без авторизації

name: When Algorithms are your Boss: Staying Human in Platform-Mediated Work


uk: Комп'ютерні науки

description: Facebook and Google suck up our personal data and turn it into fake news, engagement algorithms and “psychographic messaging” fed by Russian bots and digital stealth operatives trolling for Brexit and Donald Trump's election. A battle is looming over who will control this sea of data and artificial intelligence, with the needs of the public interest and private, Internet-based businesses often in conflict. What can be done to promote innovative policy approaches about the use of Big Data, and to develop a social economy for the digital age?

uk: вхід без авторизації

name: Who will control Big Data, the currency of the digital age?


uk: Комп'ютерні науки

description: In thematischen Karten werden die Werte einzelner Regionen zur besseren Übersicht oft in verschiedene Klassen eingeteilt und entsprechend farblich kodiert, um einen besseren Überblick zu erhalten. Der visuelle Eindruck solcher Choroplethen-Karten wird dabei durch die gegebene Werteverteilung, die Methode zur Datenklassifikation und die Farbwahl bestimmt. Konventionelle Klassifizierungsmethoden funktionieren datenbasiert und beachten dabei nicht den räumlichen Kontext der Daten. Verfolgen wir eine aufgabenorientierte Klassifikation.

uk: вхід без авторизації

name: Aufgabenorientierte Datenklassifikation in Choroplethen-Karten für die Erhaltung lokaler Extremwerte


Freies Undo in OSM: Overpass API 0.7.55

uk: Комп'ютерні науки

description: Die Funktionalität, die Achavi benötigt, bietet erst die neue Version 0.7.55 der Overpass API. Weiteres Ziel ist, ein Undo von unerwünschten Änderungen uneingeschränkt auch dann zu ermöglichen, wenn es darauf basierend schon Änderungen gegeben hat. Dafür ist ein eigenes Co-Datenmodell erforderlich. Für den Hauptteil des Vortrags sind alle Teilnehmer dann eingeladen, ihr Lieblings-OSM-Problem mitzubringen, um es live mit der Overpass API zu lösen.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: QKan ist ein System aus QGIS-basierten Plugins, das zur Vor- und Nachbereitung von Daten zu kommunalen Entwässerungssystemen im Zusammenhang mit hydrodynamischen Simulationen dient. Die Daten werden in einer SpatiaLite-Datenbank gespeichert und können sowohl mit Hilfe der Plugins als auch mit den QGIS-Funktionen verarbeitet werden. Es werden der aktuelle Stand sowie die nächsten geplanten Entwicklungsschritte vorgestellt.

uk: вхід без авторизації

name: QKan - QGIS Plugins zur Aufbereitung von Kanalnetzdaten für Simulationen: Aktueller Stand und weitere Ziele


uk: Комп'ютерні науки

description: GDAL, OGR, PDAL, GEOS und FDO - und am Ende brauchen doch alle FME? Die Open Source GIS-Welt bietet eine Vielzahl an Lösungen, davon sind viele Lebendig, andere geistern als nicht mehr gepflegte Werkzeuge immer noch im WWW herum, Der Vortrag stellt Lösungen für Datenkonvertierung und Systemmigration anhand von anschaulichen Beispielen vor dem Schwerpunkt der Migration von GI-Werkzeugen vor. Und warnt vor denen, die es eigentlich nicht mehr gibt.

uk: вхід без авторизації

name: Wir reden doch alle Standard - oder etwa nicht?: Was tun mit WMS, WFS und WCS, SHP, XML und MXD - MFG ?


uk: Комп'ютерні науки

description: Was lange währt wird auch released: 2018 wird die Metadatensoftware Metador in der neuen Version veröffentlicht werden. Monatelange Arbeit flossen in die Software rein, um viele Features zu implementieren: von einem CSW Plugin bis hin zu einer einfachen Erstellung von Formularen, der Validierung von Formularen und einigem mehr. Der Vortrag zeigt praktisch und nachvollziehbar, wie Metador bedient wird, der CSW funktioniert und wie eigene Formulare gebaut werden.

uk: вхід без авторизації

name: Neues in Metador, kurz vor der finalen Version: Konfomität, Anpassungen, CSW


Wie kommt der Schwimmbagger ins WebGIS

uk: Комп'ютерні науки

description: Am Beispiel ein Unternehmens aus der Rohstoffbranche wird eine vollkommen automatisierten Datenverarbeitungskette aufgezeigt. Ein Schwimmbagger nimmt während er über den Baggersee schwimmt und baggert kontinuierlich seine Geoposition auf und misst gleichzeitig zu jeder Geokoordinate die Wassertiefe. Diese Daten sollen in einem WebGIS dargestellt und wöchentlich aktualisiert werden. Wenn es aber nicht nur einen Bagger auf einem See gibt, sondern viele Bagger auf vielen Seen ist eine automatische Verarbeitung der Daten bis hin zum WMS gefordert.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: In OpenStreetMap werden zunehmend komplexe 3D-Modelle erstellt. Mit deren Detailgrad stoßen Mapper an die Grenzen dessen, was in OSM-Editoren sinnvoll zu bearbeiten ist. Wir haben daher eine offene Plattform zum Austausch frei lizenzierter Modelle geschaffen. Dinge der realen Welt – von der Parkbank bis zur Burg – können in einem dafür ausgelegten 3D-Editor erstellt werden und über das 3D Model Repository von jedermann mit OpenStreetMap verknüpft werden.

uk: вхід без авторизації

name: 3D Model Repository - Von der Parkbank bis zur Burg: Freie 3D-Modelle für OpenStreetMap


uk: Комп'ютерні науки

description: Dieser Vortrag stellt die jüngsten Entwicklungen im Bereich der darstellungsorientierten automatischen Generalisierung von offenen Geodaten vor. Ziel hiervon ist es, die Qualität automatisiert regelbasiert produzierter Kartendarstellungen in digitalen Karten zu verbessern. Anhand von Beispielen werden die Neuerungen und zusätzliche Anwendungsfelder vorgestellt und sowohl die Chancen als auch die Herausforderungen des darstellungsorientierten Ansatzes wie auch der Verwendung offener Geodaten erläutert.

uk: вхід без авторизації

name: Darstellungsorientierte Generalisierung von offenen Geodaten


uk: Комп'ютерні науки

description: Das Masterportal ist eine OGC-konforme, Open-Source (Mit-Lizenz) Web-GIS Lösung zur Generierung von digitalen Kartenanwendungen. Es basiert auf BackboneJS und Openlayers und wird aktiv von der Stadt Hamburg weiterentwickelt. Es ermöglicht ohne Programmierkenntnisse und unter geringem Aufwand thematische Kartenanwendungen zu erstellen, außerdem ist es leicht Erweiterbar und kann es als Framework zur Erstellung von komplexen Kartenanwendungen genutzt werden.

uk: вхід без авторизації

name: Master Portal: Das Open-Source Web-GIS der Stadt Hamburg


Neuerungen im GeoServer

uk: Комп'ютерні науки

description: Der GeoServer ist ein mächtiger OpenSource-Kartenserver, der in zahlreichen Projekten eingesetzt wird. Auf Basis offener Standards können mit dem GeoServer verschiedene Geodienste aus zahlreichen Datenquellen bereitgestellt werden. Die GeoServer-Community arbeitet laufend an Erweiterungen und Verbesserungen der Kernsoftware. Dieser Vortrag widmet sich den Entwicklungen der jüngeren Vergangenheit. Dabei wird das Ziel verfolgt einen möglichst breiten Überblick über die (neuen) Möglichkeiten zu schaffen statt auf die Details einzelner Features einzugehen.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Der Vortrag zeigt beispielhaft, wie ein umfassendes Gesamtkonzept einer solchen Geodaten-Architektur rein auf Basis von Freier Software aussehen kann. Dazu wird als Beispiel ein Zusammenspiel der Komponenten QGIS, GeoServer und SHOGun vorgestellt: QGIS fungiert dabei als Software am GIS-Arbeitsplatz und wird auch zur Kartenerstellung benutzt, Diese werden über ein Plugin in GeoServer und von dort letztendlich über das WebGIS-Framework SHOGun im Web an bestimmte Nutzergruppen veröffentlicht.

uk: вхід без авторизації

name: QGIS, GeoServer und SHOGun im Zusammenspiel


uk: Комп'ютерні науки

description: geOrchestra besteht aus einer Open Source Community um eine INSPIRE konforme Geodateninfrastruktur aufzubauen. Das Ergebnis ist eine anpassbare, interoperable und freie INSPIRE GDI, basierend auf den besten Open Source Komponenten.

uk: вхід без авторизації

name: geOrchestra: INSPIRE GDI mit Fachschalen


YAGA: Yet Another Geo Application

uk: Комп'ютерні науки

description: Das YAGA Development Team stellt seinen finalen Release von leaflet-ng2 1.0.0, einer ganularen Integration von Leaflet in Angular 2 und folgende Versionen, vor. Es werden Vorteile und Modularität des Frameworks herausgestellt. Zudem werden weitere Module und die künftige Roadmap rund um das Framework vorgestellt.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Ein Arbeitsbericht über die Verwendung des OGR GMLAS Treibers für die Nutzung der „ISYBAU-Austauschformate Abwasser (XML)“ in QGIS 3. Ziel ist einerseits die Anzeige von Kanälen, Schächten und Abwasserbauwerken (möglichst) auf Knopfdruck, andererseits eine freie ISYBAU-Schnittstelle zu anderen abwasserbezogenen QGIS-Projekten und Werkzeugen, wie z.B. den QKan Plugins oder der schweizerischen Abwasserfachschale QGEP, die auf diese Weise auch für Anwender aus Deutschland interessant werden könnte.

uk: вхід без авторизації

name: Jetzt in Ihrem QGIS: ISYBAU XML-Abwasserdaten: in der Hauptrolle der OGR GMLAS Treiber


uk: Комп'ютерні науки

description: Das NAS-XML-Format lässt sich ins QGIS laden, doch müssen die umfänglichen Relationen, die zwischen Geometrien und Tabellen vorhanden sind erst wieder aufgebaut werden, um die Daten sinnvoll zu nutze Alternativ zu den bewährten Lösungen, die die Installation einer PostGis-Datenbank erfordern, wird hier der Ansatz einer kompakten und transportablen Umsetzung mit SpatiaLite vorgestellt, bei dem am Ende sämtliche Daten inklusive Verknüpfungen zwischen Flurstücken und Eigentümern, sowie einer Auswertung der Flächennutzung in einer SQLITE-Datei vorliegen.

uk: вхід без авторизації

name: ALKIS kompakt mit SpatiaLite: ALKIS-Daten ohne Postgis-Installation


uk: Комп'ютерні науки

description: Im OSM-Umfeld werden Daten meist erst in eine Datenbank geladen, um diese hiernach wieder zu extrahieren. Im Zuge dessen entstehen bei großen Datensätzen hierbei häufig Flaschenhälse, die eine effiziente Verarbeitung verhindern. Dieser Talk schlägt Methoden vor, um Daten sequentiell in einer Pipelinestruktur zu verarbeiten, um ressourcenschonend und schneller als bestehende Lösungen Daten zu verarbeiten, filtern und zu transformieren.

uk: вхід без авторизації

name: Pipelinebasierte Erzeugung von Karten: Geodaten verarbeiten ohne Datenbanksystem


Datenqualität sicherstellen mit QGIS

uk: Комп'ютерні науки

description: QGIS bietet eine Reihe von Funktionen, um die Geometrien eines Datensatzes zu überprüfen und zu korrigieren. Der Vortrag gibt einen Ueberblick über die beiden Plugins 'Geometrychecker' und 'Topologychecker' und zeigt Gemeinsamkeiten und Unterschiede auf.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Die Geodatenerfassung mittels Elementen der Gamification bietet vielfältige Mehrwerte. Zugehörige Konzepte können genutzt werden, um passive Nutzer von OpenStreetMap (OSM) als aktive Datenproduzenten zu gewinnen. Bereits vorliegende Entwurfsmuster aus dem Game Design können im Rahmen der Geodatenerfassung in OSM angewendet werden, um diese abwechslungsreicher zu gestalten. Im Vortrag werden erste Ergebnisse einer in Heidelberg durchgeführten Fallstudie vorgestellt, in der verschiedene Varianten eines mobilen Prototypen miteinander verglichen werden.

uk: вхід без авторизації

name: Spielbasierte Ansätze in der Geodatenerfassung: Zum Einfluss von Spielelementen auf Anreizmechanismen von OpenStreetMap-Nutzern


uk: Комп'ютерні науки

description: Ob man nun Daten selber generiert oder Daten von Anbietern verwendet. Man kommt nicht umhin, diese auf geometrische und topologische Fehler zu prüfen und diese zu bereinigen. In diesem Vortrag werden wir etwas hinter die Kulissen schauen. Welche Unterstützung bieten die Methoden der GEOS Bibliothek im Vergleich zu QGIS eigenen Algorithmen? Wir werden QGIS Plugins zur Geometrieprüfung vorstellen und deren Ergebnisse vergleichen und Hintergründe beleuchten. Alternativen werden aufgezeigt und andere Lösungswege skizziert, wie z.B. über das GRASS Plugin.

uk: вхід без авторизації

name: Geometrie- und Topologiefehler finden und korrigieren: Möglichkeiten mit QGIS und GRASS GIS


Indexing (27.4.2011)

uk: Комп'ютерні науки

description: This lecture provides an introduction to the fields of information retrieval and web search. We will discuss how relevant information can be found in very large and mostly unstructured data collections; this is particularly interesting in cases where users cannot provide a clear formulation of their current information need. Web search engines like Google are a typical application of the techniques covered by this course.

uk: вхід без авторизації

name: Technische Universität Braunschweig, Institut für Informationssysteme


uk: Комп'ютерні науки

description: Die Fähigkeit zur Darstellung von 3D-Gebäuden ist heute beinahe schon Standard. Für eine umfassende dreidimensionale Abbildung der Welt müssen aber auch viele andere Objekte berücksichtigt werden, und OpenStreetMap bietet dafür beste Voraussetzungen. Am Beispiel des freien 3D-Renderers OSM2World werden die Möglichkeiten der OSM-Daten für das 3D-Rendering jenseits von Gebäuden gezeigt.

uk: вхід без авторизації

name: 3D: Mehr als Gebäude: OSM2World jenseits von Simple 3D Buildings


uk: Комп'ютерні науки

description: Energieeffizientes PKW Routing, manchmal auch Eco-Routing genannt, ist von der Idee nicht neu, aber kaum verbreitet und begrifflich undefiniert. Dieser Beitrag schafft hier Klarheit, zeigt das Potential für die Elektromobilität, diskutiert die besonderen Anforderungen, die energieeffizientes Routing an die Qualität von Straßenkarten stellt und untersucht die Eignung von OpenStreetMap für diesen Anwendungsbereich.

uk: вхід без авторизації

name: Energieeffizientes PKW Routing mit OpenStreetMap


uk: Комп'ютерні науки

description: Der Beitrag analysiert die Nutzerdatenhaltung von OpenStreetMap mit Blick auf die Vorgaben der Datenschutzgrundverordnung (DSGVO) und den sich daraus für das OpenStreetMap-Projekt ergebenden Anpassungsbedarf.

uk: вхід без авторизації

name: Datenschutz und die Daten der zu OpenStreetMap Beitragenden: Datenhaltung im Lichte der Datenschutzgrundverordnung


uk: Комп'ютерні науки

description: Dieser Vortrag präsentiert Forschungen zu OSM in Israel und Palästina. Es zeigt sich, dass OSM in Israel, ähnlich wie in vielen europäischen Ländern, von einer sehr aktiven lokalen community getragen wird. Eine palästinensische OSM-community hat sich jedoch bislang nicht gebildet. In Israel sind die OSM-Daten daher tendenziell auch dichter und reichhaltiger als in Palästina. Neben sozioökonomischen Strukturen scheint hier auch die Agenda von OSM eine Rolle für diese Ungleichheiten zu spielen.

uk: вхід без авторизації

name: OpenStreetMap in Israel und Palästina – zwei ungleiche Geschichten


uk: Комп'ютерні науки

description: Seit dem März 2016 entwickelt das Team von OpenachingDeutschland an einer neuen Webseiten Version auf Basis von Symfony und Bootstrap. In diesem Vortrag möchten wir euch mit auf die Reise nehmen und über unsere erreichten Ziele und genommen Hürden und Hindernisse berichten die eine so große Legacy Applikation mit sich bringt.

uk: вхід без авторизації

name: Refaktorieren oder grüne Wiese?: Die Reise von opencaching.de von einer Legacy Applikation zu Symfony Full Stack mit Responsive Webdesign.


uk: Комп'ютерні науки

description: Der Beitrag zeigt am Beispiel von Geo- und Vermessungsdaten Potenziale und Herausforderungen auf, die in einer umfänglichen Öffnung von Datenbeständen bei gleichzeitiger institutionalisierter Öffnung der Verwaltungen für offene Innovationen liegen. Darüber hinaus skizziert er einen möglichen Weg hin zu einer echten Kollaboration zwischen Staat und Gesellschaft und zeigt wie durch eine Kultur des -Gehört Werdens- zivilgesellschaftliche Akteure und Communities nachhaltig aktiviert werden können.

uk: вхід без авторизації

name: Potenziale und Herausforderungen eines Open Innovation-Ansatzes für offene Geo- und Vermessungsdaten der öffentlichen Verwaltung


GeoHealthCheck

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

description: As a matter of fact, it is all about time to reverse engineer the most complex piece of code. Code complicity techniques are usually used just to increase the time and effort needed for reverse engineering. The desired effect of code complicity can be magnified using mechanisms that decrease and narrow the allowed time frame for any reverse engineering attempt into few milliseconds. Such approach can be applied using a metamorphic engine that is aware of the time dimension. Beyond metamorphic applications for AV evasion, in this talk, we will present a novel approach to resist and evade reverse engineering using a remote metamorphic engine that generates diversified morphed machine code of a very short expiration lifetime. Our approach is based on a client-server model using challenge-response communication protocol made of morphed machine code rather than data. We will show how any reverse engineering attempt on such model will be forced to execute or emulate the morphed code. Thus the code will always have an upper hand to detect, evade and attack the reverse engineering environment. Our approach is immune to static code analysis as the functionalities and the communication protocol used are dynamically diversified remotely and do not exist in packed executable files. On the other hand, clock synchronized morphed machine code driven by a remote metamorphic engine would trap dynamic RE attempts in the maze of metamorphism. One that is immune to code tampering and reversing by detecting the non-self. We will present the fundamental difference between metamorphic and polymorphic techniques used to evade AV compared to the ones that can be used to resist RE. We will show how a remote diversified metamorphic self-modifying code with a very short expiration lifetime can detect, evade, and resist any code analysis, reverse engineering, machine learning and tampering attempts. Bio: Amor Abdelgawad is a security researcher and the founder of Immuneye. He has more than 15 years experience in software security and reverse engineering. He has experienced both sides of software security in vulnerability researching, penetration testing, reverse engineering, exploit development and the defensive side as a chief security officer for software companies running wide infrastructures. Amor is currently working as a security researcher where his main interests are analyzing malware, vulnerability researching and developing artificial software immunity.

uk: вхід без авторизації

name: The Remote Metamorphic Engine: Detecting, Evading, Attacking the AI and Reverse Engineering


uk: Комп'ютерні науки

description: So, you think you want to be a penetration tester, or you already are and don’t understand what the difference between you and all the other “so called” penetration testers out there. Think you know the difference between a Red Team, Penetration Test and a Vulnerability assessment? Know how to write a report your clients will actually read and understand? Can you leverage the strengths of your team mates to get through tough roadblocks, migrate, pivot, own and pillage? No? well this talk is probably for you then! We will go through the fascinating, intense and often crazily boring on-site assessment process. Talk about planning and performing Red Teams, how they are different, and why they can be super effective and have some fun along the way. I’ll tell you stories that will melt your face, brain and everything in between. Give you the answers to all of your questions you never knew you had, and probably make you question your life choices. By the end of this session you will be ready to take your next steps into the job you’ve always wanted, or know deep inside that you should probably look for something else. There will be no judgment or shame, only information, laughter and fun. Bio: Arch currently works on a Red Team for an agency with a 3 letter acronym. It’s not secret squirrel, or hush hush he just doesn’t like to talk about himself very much. He has 15 years of experience in penetration testing and cyber security with a background in control systems and security architecture.

uk: вхід без авторизації

name: So you think you want to be a penetration tester.


Six Degrees of Domain Admin

uk: Комп'ютерні науки

description: Active Directory domain privilege escalation is a critical component of most penetration tests and red team assessments, but standard methodology dictates a manual and often tedious process – gather credentials, analyze new systems we now have admin rights on, pivot, and repeat until we reach our objective. Then — and only then — we can look back and see the path we took in its entirety. But that may not be the only, nor shortest path we could have taken. By combining our concept of derivative admin (the chaining or linking of administrative rights), existing tools, and graph theory, we can reveal the hidden and unintended relationships in Active Directory domains. Bob is an admin on Steve’s system, and Steve is an admin on Mary’s system; therefore, Bob is effectively (and perhaps unintentionally) an admin on Mary’s system. While existing tools such as Nmap, PowerView, CrackMapExec, and others can gather much of the information needed to find these paths, graph theory is the missing link that gives us the power to find hidden relationships in this offensive data. The application of graph theory to an Active Directory domain offers several advantages to attackers and defenders. Otherwise invisible, high-level organizational relationships are exposed. All possible escalation paths can be efficiently and swiftly identified. Simplified data aggregation accelerates blue and red team analysis. Graph theory has the power and the potential to dramatically change the way you think about and approach Active Directory domain security. Bio: Andy Robbins is the Offensive Network Services lead for Veris Group’s Adaptive Threat Division. He has performed penetration tests and red team assessments for a number of Fortune 500 commercial clients and major U.S. Government agencies. In addition, Andy researched and presented findings related to a business logic flaw with certain processes around handling ACH files affecting thousands of banking institutions around the country at DerbyCon. He has a passion for offensive development and red team tradecraft, and helps to develop and teach the ‘Adaptive Red Team Tactics’ course at BlackHat USA. Rohan Vazarkr is a penetration tester and red teamer for Veris Group’s Adaptive Threat Division, where he helps assess fortune 500 companies and a variety of government agencies. Rohan has a passion for offensive development and tradecraft, contributing heavily to EyeWitness and the EmPyre projects. He has presented at BSides DC, and helps to develop and teach the ‘Adaptive Penetration Testing’ course at BlackHat USA. Will Schroeder is security researcher and red teamer for Veris Group’s Adaptive Threat Division. He is a co-founder of the Veil-Framework, developed PowerView and PowerUp, is an active developer on the PowerSploit project, and is a co-founder and core developer of the PowerShell post-exploitation agent Empire. He has presented at a number of security conferences on topics spanning AV-evasion, post-exploitation, red team tradecraft, and offensive PowerShell

uk: вхід без авторизації


uk: Комп'ютерні науки

description: There are multiple x86 processors in your monitor! OSD, or on-screen-display controllers are ubiquitous components in nearly all modern monitors. OSDs are typically used to generate simple menus on the monitor, allowing the user to change settings like brightness, contrast and input source. However, OSDs are effectively independent general-purpose computers that can: read the content of the screen, change arbitrary pixel values, and execute arbitrary code supplied through numerous control channels. We demonstrate multiple methods of loading and executing arbitrary code in a modern monitor and discuss the security implication of this novel attack vector. We also present a thorough analysis of an OSD system used in common Dell monitors and discuss attack scenarios ranging from active screen content manipulation and screen content snooping to active data exfiltration using Funtenna-like techniques. We demonstrate a multi-stage monitor implant capable of loading arbitrary code and data encoded in specially crafted images and documents through active monitor snooping. This code infiltration technique can be implemented through a single pixel, or through subtle variations of a large number of pixels. We discuss a step-by-step walk-through of our hardware and software reverse-analysis process of the Dell monitor. We present three demonstrations of monitoring exploitation to show active screen snooping, active screen content manipulation and covert data exfiltration using Funtenna. Lastly, we discuss realistic attack delivery mechanisms, show a prototype implementation of our attack using the USB Armory and outline potential attack mitigation options. We will release sample code related to this attack prior to the presentation date. Bio: Dr. Ang Cui is the Founder and Chief Scientist of Red Balloon Security. Dr. Cui received his PhD from Columbia University in 2015. His doctoral dissertation, titled “Embedded System Security: A Software-based Approach”, focused exclusively on scientific inquiries concerning the exploitation and defense embedded systems. And has focused on developing new technologies to defend embedded systems against exploitation. During the course of his research, he has uncovered a number of serious vulnerabilities within ubiquitous embedded devices like Cisco routers, HP printers and Cisco IP phones. Dr. Cui is also the author of FRAK and the inventor of Software Symbiotic technology. And has received various awards on his work on reverse engineering commercial devices and is also the recipient of the Symantec Graduate Fellowship and was selected as a DARPA Riser in 2015. Latin Kataria is a Principal Research Scientist at Red Balloon Security. His research focus is on the defense and exploitation of embedded devices. Latin earned his master’s degree from Columbia University and a bachelor’s degree from Delhi College of Engineering. Previously, he has worked as a System Software Developer at NVIDIA and as an Associate Software Engineer at Mcafee. Francois Charbonneau is a embedded security researcher who spent the better part of his career working for the Canadian government until he got lost and wondered into New York City. He now works as a research scientist for Red Balloon Security where he lives a happy life, trying to make the world a more secure place, one embedded device at a time.

uk: вхід без авторизації

name: A Monitor Darkly: Reversing and Exploiting Ubiquitous OSD Controllers


uk: Комп'ютерні науки

description: Many Bluetooth Low Energy (BLE) enabled deadbolts and padlocks have hit the market recently. These devices promise convenience and security through smartphone control. We investigated sixteen of these products from multiple vendors and discovered wireless vulnerabilities in most of them. Using a $50 antenna, we successfully picked vulnerable locks from over 400 meters away. In this presentation we introduce open source tools to crack each of the vulnerable BLE locks. Furthermore, after surveying the open source Bluetooth hacking tools currently available, we find very little support for BLE. So, to make discovering and range finding to BLE devices easier, we introduce a new open source war-walking tool compatible with both Bluetooth Classic and BLE Bio:. Anthony Rose is an electrical engineer with five years of network security experience. His prior work includes traffic and quality optimization for wireless video protocols. Currently he focuses on Bluetooth security and wireless penetration testing. Ben Ramsey, PhD, CISSP, has over a decade of experience in network security research. His work focuses on critical infrastructure protection and low power wireless protocols, such as ZigBee, Z-Wave, and Bluetooth Low Energy. He has published in several academic journals and has presented research at multiple conferences, including GLOBECOM, MILCOM, SenseApp, and ShmooCon.

uk: вхід без авторизації

name: Picking Bluetooth Low Energy Locks from a Quarter Mille Away


uk: Комп'ютерні науки

description: It's recently become easier and less expensive to create malicious GSM Base Transceiver Station (BTS) devices, capable of intercepting and recording phone and sms traffic. Detection methods haven't evolved to be as fast and easy to implement. Wireless situational awareness has a number of challenges. Categorically, these challenges are usually classified under Time, Money, or a lot of both. Provisioning sensors takes time, and the fast stuff usually isn’t cheap. Iterative improvements compound the problem when you need to get software updates to multiple devices in the field. I’ll present a prototype platform for GSM anomaly detection (called SITCH) which uses cloud-delivered services to elegantly deploy, manage, and coordinate the information from many independent wireless telemetry sensors (IoT FTW). We’ll talk about options and trade-offs when selecting sensor hardware, securing your sensors, using cloud services for orchestrating firmware, and how to collect and make sense of the data you’ve amassed. Source code for the prototype will be released as well. The target audience for this lecture is the hacker/tinkerer type with strong systems and network experience. A very basic understanding of GSM networks is a plus, but not required. Bio: Ashmastaflash is a native of southeast Tennessee and a recent transplant to San Francisco. He entered the security domain through systems and network engineering, spent a number of years in network security tooling and integration, and currently works in R&D for CloudPassage.

uk: вхід без авторизації

name: SITCH: Inexpensive, coordinated GSM anomaly detection


uk: Комп'ютерні науки

description: Managed Code Rootlets (MCRs) are terrifying post-exploitation attacks that open the doors for cementing and expanding a foothold in a target network. While the concept isn’t new, practical tools for developing MCRs don’t currently exist. Ere Metula released ReFrameworker in 2010 with the ability to inject attack modules into the C# runtime, paving the way for MCRs, but the tool requires the attacker to have knowledge of intermediate languages, does not support other runtimes, and is no longer maintained. Worse yet, the ‘write once, run anywhere’ motto of managed languages is violated when dealing with runtime libraries, forcing the attacker to write new exploits for each target platform. This talk debuts a free and open source tool called JReFrameworker aimed at solving the aforementioned challenges of developing attack code for the Java runtime while lowering the bar so that anyone with rudimentary knowledge of Java can develop a managed code rootlet. With Java being StackOverflow’s most popular server side language of 2015 the Java runtime environment is a prime target for exploitation. JReFrameworker is an Eclipse plugin that allows an attacker to write simple Java source to develop, debug, and automatically modify the runtime. Best of all, working at the intended abstraction level of source code allows the attacker to ‘write once, exploit anywhere’. When the messy details of developing attack code are removed from the picture the attacker can let his creativity flow to develop some truly evil attacks, which is just what this talk aims to explore. Bio: Ben Holland is a PhD student at Iowa State University with experience working on two high profile DARPA projects. He has extensive experience writing program analyzers to detect novel and sophisticated malware in Android applications and served on the ISU team as a key analyst for DARPA’s Automated Program Analysis for Cybersecurity (APAC) program. He’s lectured on security topics for university courses in program analysis and operating system principles. Ben has given multiple talks at professional clubs as well as security and academic conferences. His past work experience has been in research at Iowa State University, mission assurance at MITRE, government systems at Rockwell Collins, and systems engineering at Wabtec Railway Electronics. Ben holds a M.S. degree in Computer Engineering and Information Assurance, a B.S. in Computer Engineering, and a B.S. in Computer Science. Currently he serves on the ISU team for DARPA’s Space/Time Analysis for Cybersecurity (STAC) program.

uk: вхід без авторизації

name: Developing Managed Code Rootkits for Java Runtime Environment


uk: Комп'ютерні науки

description: In this presentation we are going to explain and demonstrate step by step in a real attack scenario how a remote attacker could elevate privileges in order to take control remotely in a production seismological network located at 183mts under the sea. We found several seismographs in production connected to the public internet providing graphs and data to anyone who connects to the embed web server running at port 80. The seismographs provide real time data based in the perturbations from earth and surroundings, we consider this as a critical infrastructure and is clear the lack of protection and implementation by the technicians in charge. We are going to present 3 ways to exploit the seismograph which is segmented in 3 parts: Modem (GSM, Wi-Fi, Satellite, GPS,Com serial) {web server running at port 80 , ssh daemon} Sensor (Device collecting the data from ground or ocean bottom) Battery (1 year lifetime) Apollo server (MAIN acquisition core server) These vulnerabilities affect the Modem which is directly connected to the sensor , a remote connection to the modem it’s all that you need to compromise the whole seismograph network. After got the root shell our goal is execute a post exploitation attack , This specific attack corrupts/modifies the whole seismological research data of a country/ area in real time. We are going to propose recommendations and best practices based on how to deploy a seismological network in order to avoid this nasty attacks. Bio: Bertin Jervis Bonilla is a security researcher focused in offensive security, reverse engineering and network attacks and defense, Bertin has been speaker in several security conferences in his country and latin america such OWASP Latin Tour , DragonJAR conference and EKOPARTY, He is the founder of NetDB - The Network Database project , a computer fingerprint/certificate driven search engine. Formerly is a network engineer working for a five letters us networking company in San Jose Costa Rica. James Jara is the founder and CTO of NETDB.IO , a search engine of internet of things focused in info-security research. He likes Bitcoin Industry, Open Source and framework development and gave various presentations on security conferences like EkoParty. Interested machine learning for mobile, Internet of Things (IoT) devices and industrial systems used in critical infrastructure networks. Sport-coder!

uk: вхід без авторизації


uk: Комп'ютерні науки

description: What is the root cause of memory and network traffic bloat? Our current research using tools we previously released Badger at Black Hat in 2014 and the Kobra released at BsidesLV 2015 shows a 40 percent increase in outside unique IP traffic destinations and a 400 percent increase in data transmitted towards these destinations. But through the course of the research we found currently used IRP monitoring tools were lacking to help produce enough information to forensically investigate the exfiltration of user metadata. Pinworm is a sniffer that shows all created IRPs created in the kernel in I/O devices. The IRPs are correlated with the processes that created them and the called driver stack. With network traffic data we are off to the races. Using pinworm which we released this week, we will show forensic case studies from cradle to grave of what happens when you do things online in social media sites. Like all of our previously released tools, Pinworm is a framework including server side code you can use to collect and display user metadata inline in browser frames. Does this metadata collection happen in the browser, in user land, or in the kernel? Come to our talk and find out. We will demonstrate the collection of user metadata and collecting this information in a live browser session. Then we will show you how to intercept your personal data before it leaves your computer keeping your privacy, well, private. BYOTFH (Bring your own tin foil hat). Bio: bigezy has spent his career defending critical infrastructure hacking it from the inside to keep things from blowing up. Bigezy got his black badge from DEF CON in 2003. Bigezy currently works as a cyber security researcher at a place where these things are done. During the last 25 years, Bigezy has worked at fortune 500 companies in the electric sector, financial sector, and telecom. He has spoke at numerous conferences worldwide including bsidesLV and the DEF CON Crypto and Privacy village last year. Bigezy is also the president of Hackie Ergo Sum in Paris France. @bigezy_ When you are a one legged boogeyman slash system internals hacker, every kick is a flying kick. saci takes pride in his disdain for hypocrisy. We are sure you have seen him around in the usual places, and maybe you think you know who he is. But, you will never quite know who he is until you come to the talk.

uk: вхід без авторизації

name: An introduction to Pinworm : Man In The Middle for your metadata


uk: Комп'ютерні науки

description: Security assessments of embedded and IoT devices often begin with testing how an attacker could recover firmware from the device. When developers have done their job well you’ll find JTAG locked-up, non-responsive serial ports, locked-down boot, and perhaps even a home brewed secure-boot solution. In this session you’ll learn details of a useful hardware/software penetration technique to attempt when you’ve run out of easier options. We’ve used this technique on two commercial device security assessments successfully and have refined the technique on a series of test devices in the lab. This session will cover the prerequisites for successful application of the technique and give you helpful hints to help your hack! Best of all this technique, while a bit risky to the hardware, is easy to try and doesn’t require specialized equipment or hardware modification. We are going to take pieces of metal and stab them at the heart of the hardware and see what happens. For the hardware/firmware developer you’ll get a checklist that you can use to reduce your vulnerability to this sort of attack. Bio: Brad Dixon once told his parents that if they gave him a Commodore 64 it would be the last computer he’d ever want. He never got that Commodore 64. Nevertheless Brad managed to become a computer nerd at a young age. Brad studied Computer Engineering at Georgia Tech and jumped into embedded software engineering. He worked for many years helping developers to design embedded Linux into telecom, network, and mobile products. Brad also took a turn as a product manager for embedded development tools and a mobile location analytics product. At Carve Systems he hacks IoT, embedded, and Linux systems

uk: вхід без авторизації

name: pin2pwn: How to Root an Embedded Linux Box with a Sewing Needle


uk: Комп'ютерні науки

description: Much of the time and attention dedicated to modern network security focuses on detecting the contemporary vulnerabilities and exploits which power the breaches that make the headlines. With almost all of the emphasis is placed around the endless cycle of new entry points, we are often overlooking what is perhaps one of the most profoundly interesting aspects of modern network breaches; the post-exploit communication of a compromised system to the attacker—known as command and control. Once malware has compromised an end system, the tables are turned against the attackers; we go from being on defense, to being on offense. Attackers are constantly evolving their techniques and have become incredibly creative in attempting to hide their tracks, maintain control of compromised systems, and exfiltrate sensitive data. This presentation will explore how command and control channels have evolved against traditional defenses, where they are today, future predictions on their evolution, and most importantly, how you can go on the offense to protect your organization by identifying and disrupting command and control channels in your network. Bio: Brad Woodberg is a Group Product Manager at Proofpoint Inc, leading the Emerging Threats product line. Prior to his current role at Proofpoint, he spent six years at Juniper Networks as a layer 7 security product manager and product line engineer. Prior to Juniper he worked for a security consulting company in Ann Arbor Michigan for four years delivering a variety of network security technologies and services. He is a four-time published author of network security books through O’Reilly and Syngress. He has spoken at several security conferences including DEF CON 19, CanSecWest 2011, SEMAPHOR and other regional talks. Brad is also an active mentor to up and coming security engineers who share a similar interest and passion in all things network security.

uk: вхід без авторизації

name: Malware Command and Control Channels -a journey into Darkness-


uk: Комп'ютерні науки

description: Through cooperation between browser vendors and standards bodies in the recent past, numerous standards have been created to enforce stronger client-side control for web applications. As web appsec practitioners continue to shift from mitigating vulnerabilities to implementing proactive controls, each new standard adds another layer of defense for attack patterns previously accepted as risks. With the most basic controls complete, attention is shifting toward mitigating more complex threats. As a result of the drive to control for these threats client-side, standards such as SubResource Integrity (SRI), Content Security Policy (CSP), and HTTP Public Key Pinning (HPKP) carry larger implementation risks than others such as HTTP Strict Transport Security (HSTS). Builders supporting legacy applications actively make trade-offs between implementing the latest standards versus accepting risks simply because of the increased risks newer web standards pose. In this talk, we'll strictly explore the risks posed by SRI, CSP, and HPKP; demonstrate effective mitigation strategies and compromises which may make these standards more accessible to builders and defenders supporting legacy applications; as well as examine emergent properties of standards such as HPKP to cover previously unforeseen scenarios. As a bonus for the breakers, we'll explore and demonstrate exploitations of the emergent risks in these more volatile standards, to include multiple vulnerabilities uncovered quite literally during our research for this talk (which will hopefully be mitigated by d-day). Bio: Bryant Zadegan is an application security advisor and mentor at Mach37, a security accelerator focused on pouring substantial dollars into new security technologies. When not driving developers to embrace AppSec in continuous integration, Bryant punches holes in Amazon, Google, Reddit, etc. On days when he'd rather not touch computers, he's usually nowhere to be found near DC. Ryan Lester is the CEO and chief software architect for Cyph, a web-based one-click end-to-end-encrypted communications service funded in part by Mach37, Virginia's Center for Innovative Technology, and the Goel Fund. Since departing SpaceX, Ryan has dedicated the better part of a year and a half to the vision of accessible encrypted communication. Unsurprisingly, when he isn't working on building the logic for Cyph, he's usually looking for ways to break it.

uk: вхід без авторизації

name: Abusing Bleeding Edge Web Standards for AppSec Glory


uk: Комп'ютерні науки

description: It is not uncommon that a software reverse engineer finds themselves desiring to execute a bit of code they are studying in order to better understand that code or alternatively to have that code perform some bit of useful work related to the reverse engineering task at hand. This generally requires access to an execution environment capable of supporting the machine code being studied, both at an architectural level (CPU type) and a packaging level (file container type). Unfortunately, this is not always a simple matter. The majority of analysts do not have a full complement of hosts available to support a wide variety of architectures, and virtualization opportunities for non-intel platforms are limited. In this talk we will discuss a light weight emulator framework for the IDA Pro disassembler that is based on the Unicorn emulation engine. The goal of the project is to provide an embedded multi-architectural emulation capability to complement IDA Pro’s multi-architectural disassembly capability to enhance the versatility of one of the most common reverse engineering tools in use today. Bio: Chris Eagle is a registered hex offender. He has been taking software apart since he first learned to put it together over 35 years ago. His research interests include computer network operations, malware analysis and reverse/anti-reverse engineering techniques. He is the author of The IDA Pro Book and has published a number of well-known IDA plug-ins. He is also a co-author of Gray Hat Hacking. He has spoken at numerous conferences including Black Hat, DEF CON , Shmoocon, and ToorCon. Chris also organized and led the Sk3wl of r00t to two DEF CON Capture the Flag championships and produced that competition for four years as part of the DDTEK organization.

uk: вхід без авторизації

name: Emulating all (well many) of the things with Ida


How to Overthrow a Government

uk: Комп'ютерні науки

description: Direct from the mind of the guy who bought you the "I will kill you" presentation at DEF CON 23, is another mind bending, entertaining talk. This time it’s bigger and badder than before. Are you sick and tired of your government? Can’t wait another 4 years for an election? Or do you want to be like the CIA and overthrow a government overseas for profit or fun? If you answered yes to one or more of these questions than this talk is for you! Why not create your own cyber mercenary unit and invoke a regime change to get the government you want installed? After all, if you want the job done right, sometimes you have to do it yourself. Find out how over the last 60 years, governments and resource companies have been directly involved in architecting regime changes around world using clandestine mercenaries to ensure deniability. This has been achieved by destabilizing the ruling government, providing military equipment, assassinations, financing, training rebel groups and using government agencies like the CIA, Mossad and MI-5 or using foreign private mercenaries such as Executive Order and Sandline. Working with Simon Mann an elite ex SAS soldier turned coup architect who overthrew governments in Africa, Chris Rock will show you how mercenary coup tactics directly applied to digital mercenaries to cause regime changes as the next generation of "Cyber Dogs of War". Chris will walk you through a cyber regime change from start to finish on a real country and show you how to architect a coup achieving the same result as a traditional mercenary operation without any blood spilt. This will include taking ownership of all facets of government including finance, telecommunications, transportation, commercial companies and critical infrastructure such a power, water and oil. You will learn: • Traditional military mercenary coup tactics used by the infamous 32 Battalion in Africa, Executive Order and Sandline that can be directly applied to a cyber mercenary regime change. • How to architect a cyber coup using advisor’s, hackers and the general populace, using misinformation, professional agitators, false information and financing. • How to gather intelligence to analyze a government’s systemic weaknesses on financial, societal values and political climates that is leader or country specific to structure your attack. • How to identify and prioritize government resources, infrastructure and commercial companies and how to use these compromised assets to stage the coup. • Combine physical and digital techniques and have the best of both worlds to own a countries infrastructure. • Hot to manipulate the media using propaganda targeting journalists flawed multiple "source" rules for a story. • The Grand finale of a cyber regime change on a real country from beginning to end using the above techniques with operational footage. Come to this talk and find out how you too can be your own dictator, benevolent or merciless that part is up to you. Chris Rock presented "I will kill you" at DEF CON 23 has been active in the security industry for the last 20 years and is the founder and CEO of Kustodian, a specialized security company that specializes in Security Operations Centres, Penetration testing and independent research. Kustodian is an Australian, Middle East and Hong Kong registered company that has been operational for over 10 years. Chris has also spent 12 years in the banking sector and provides security services around the world for small, medium and large companies. Chris Rock also created SIEMonster, an open source, scalable, free Security Incident and Event Management (SIEM) as a commercial alternative to Splunk, ArcSight and AlienVault. SIEMonster can be run on Amazon AWS or Virtual machines and details can be found on www.siemonster.com Twitter: @_kustodian_

uk: вхід без авторизації


uk: Комп'ютерні науки

description: For 48 years, 9-1-1 has been /the/ emergency telephone number in the United States. It’s also been mired in 48-year-old technology. So let’s just put that on the internet, right? What could possibly go wrong? Without the radical segmentation of the PSTN, the move to IP networks (even the private, managed kind) will bring new 9-1-1 capabilities AND new vulnerabilities. This talk builds on the work of quad, r3plicant, and Peter Hefley (see &lquo;Hacking 911: Adventures in Destruction, Disruption, and Death,&rquo; DEF CON 22, http://ow.ly/10AvZh). It provides an overview of NG9-1-1 architecture and security concerns, and identifies critical attack surfaces that Public Safety Answering Points need to monitor and secure. Familiarity with NENA’si3 and NG-SEC standards may be helpful, but is not required. Bio: CINCVolFLT (Trey Forgety) is Director of Government Affairs for NENA: The 9-1-1 Association. He previously served as a Presidential Management Fellow in the U.S. Department of Homeland Security’s Office of Emergency Communications, with rotations in the Federal Communications Commission’s Public Safety and Homeland Security Bureau, and the U.S. Department of Commerce’s National Telecommunications and Information Administration. A sometimes-piratical sailor and inveterate tinkerer, CINCVolFLT’s recent activities have included work on establishing a backup timing source for telecom networks to ensure service during GPS outages or jamming, and serving as pro bono counsel to QueerCon.He holds a B.S. in Applied Physics and a J.D., both from the University of Tennessee (GO VOLS!). AK3R303 (Alex Kremlin) is Managing Partner and CTO of SecureSet, which is a cybersecurity services provider specializing in education and startup acceleration. Previously, AK3R303 was a Technology Strategist with the U.S. Department of Homeland Security and a Guest Researcher at the National Institute of Standards and Technology focusing on public safety and mobile communications network security. He holds a B.A. from Fordham University where he studied nuclear game theory through the political science department in Beijing, China. He holds an M.A. in National Security & Strategic Studies from the US Naval War College, and is an M.S. / Ph.D. candidate at the CU Boulder College of Engineering & Applied Sciences in Telecom Engineering.

uk: вхід без авторизації

name: NG9-1-1: The Next Gen of Emergency Ph0nage


uk: Комп'ютерні науки

description: Deep learning and neural networks have gained incredible popularity in recent years. The technology has grown to be the most talked-about and least well-understood branch of machine learning. Aside from it’s highly publicized victories in playing Go, numerous successful applications of deep learning in image and speech recognition has kickstarted movements to integrate it into critical fields like medical imaging and self-driving cars. In the security field, deep learning has shown good experimental results in malware/anomaly detection, APT protection, spam/phishing detection, and traffic identification. This DEF CON 101 session will guide the audience through the theory and motivations behind deep learning systems. We look at the simplest form of neural networks, then explore how variations such as convolutional neural networks and recurrent neural networks can be used to solve real problems with an unreasonable effectiveness. Then, we demonstrate that most deep learning systems are not designed with security and resiliency in mind, and can be duped by any patient attacker with a good understanding of the system. The efficacy of applications using machine learning should not only be measured with precision and recall, but also by their malleability in an adversarial setting. After diving into popular deep learning software, we show how it can be tampered with to do what you want it do, while avoiding detection by system administrators. Besides giving a technical demonstration of deep learning and its inherent shortcomings in an adversarial setting, we will focus on tampering real systems to show weaknesses in critical systems built with it. In particular, this demo-driven session will be focused on manipulating an image recognition system built with deep learning at the core, and exploring the difficulties in attacking systems in the wild. We will introduce a tool that helps deep learning hackers generate adversarial content for arbitrary machine learning systems, which can help make models more robust. By discussing defensive measures that should be put in place to prevent the class of attacks demonstrated, we hope to address the hype behind deep learning from the context of security, and look towards a more resilient future of the technology where developers can use it safely in critical deployments. Bio: Clarence Chio graduated with a B.S. and M.S. in Computer Science from Stanford, specializing in data mining and artificial intelligence. He currently works as a Security Research Engineer at Shape Security, building a product that protects high valued web assets from automated attacks. At Shape, he works on the data analysis systems used to tackle this problem. Clarence spoke on Machine Learning and Security at PHDays, BSides Las Vegas and NYC, Code Blue, SecTor, and Hack in Paris. He had been a community speaker with Intel, and is also the founder and organizer of the ‘Data Mining for Cyber Security’ meet up group, the largest gathering of security data scientists in the San Francisco Bay Area.

uk: вхід без авторизації

name: Machine Duping: Pwning Deep Learning Systems


uk: Комп'ютерні науки

description: “Super Smash Bros: Melee.” - Furrowed brows, pain in your thumbs, trash talk your Mom would blush to hear. That sweet rush of power you once knew as you beat all the kids on your block will be but a distant memory as SmashBot challenges you to a duel for your pride — live on stage. SmashBot is the Artificial Intelligence I created that plays the cult classic video game Smash Bros optimally. It can’t be bargained with. It can’t be reasoned with. It doesn’t feel pity, remorse, or fear. This final boss won’t stop until all your lives are gone. What started as a fun coding project in response to a simple dare grew into an obsession that encompassed the wombs-combo of hacking disciplines including binary reverse engineering, AI research, and programming. When not used to create a killer doomsday machine, these same skills translate to hacking Internet of Things (IoT) devices, developing shell code, and more. Forget about Internet ending zero-day releases and new exploit kits. Come on down and get wrecked at a beloved old video game. Line up and take your turn trying to beat the AI yourself, live on the projectors for everyone to see. When you lose though, don’t run home and go crying to yo Momma. Bio: Dan Petro is a Security Associate at Bishop Fox, a security consulting firm providing services to the Fortune 500, global financial institutions, and high-tech startups. In this role, he focuses on application and network penetration testing. He has presented at numerous conferences, including Black Hat USA, DEF CON , HOPE, BSides, and ToorCon. He has also been a featured guest speaker at Arizona State University, South Mountain Community College, and the Dark Reading University series. Dan has been quoted in various industry and mainstream publications such as Business Insider, Wired, The Guardian, and Mashable among others. He is widely known for the tools he has created: the Chromecast-hacking device, the RickMote ContRoller, and Untwisted, a tool used for breaking pseudorandom number generators. He also organizes Root the Box, a capture the flag security competition. Additionally, Dan often appears on local and national news to discuss topical security issues. Dan holds a Master’s Degree in Computer Science from Arizona State University and doesn’t regret it.

uk: вхід без авторизації

name: Game over, man! Reversing Video Games to Create an Unbeatable AI Player: SmashBot


uk: Комп'ютерні науки

description: DEF CON has changed for the better since the days at the Alexis Park. It has evolved from a few speaking tracks to an event that still offers the speakers, but also Villages, where you can get hands-on experience and Demo Labs where you can see tools in action. Of course, there is still the Entertainment and Contest Area, as well as Capture The Flag. There is so much more to DEF CON than there was in the past and it is our goal to help you get the best experience possible. In addition to introducing each of the different aspects and areas of DEF CON, we have a panel of speakers that will talk about how they came to be part of DEF CON and their personal experiences over the years. Oh yeah, there is the time honored "Name the Noob", lots of laughs and maybe even some prizes. Plus, stay for the after party. Seriously, there is an after party. How awesome is that?

uk: вхід без авторизації

name: DEF CON 101 Panel - PANEL III: Rise of the Noobs!


uk: Комп'ютерні науки

description: Historically, machine learning for information security has prioritized defense: think intrusion detection systems, malware classification and bonnet traffic identification. Offense can benefit from data just as well. Social networks, especially Twitter with its access to extensive personal data, bot-friendly API, colloquial syntax and prevalence of shortened links, are the perfect venues for spreading machine-generated malicious content. We present a recurrent neural network that learns to tweet phishing posts targeting specific users. The model is trained using spear phishing pen-testing data, and in order to make a click-through more likely, it is dynamically seeded with topics extracted from timeline posts of both the target and the users they retweet or follow. We augment the model with clustering to identify high value targets based on their level of social engagement such as their number of followers and retweets, and measure success using click-rates of IP-tracked links. Taken together, these techniques enable the world’s first automated end-to-end spear phishing campaign generator for Twitter. Bios: John Seymour is a Data Scientist at ZeroFOX, Inc. by day, and Ph.D. student at University of Maryland, Baltimore County by night. He researches the intersection of machine learning and InfoSec in both roles. He’s mostly interested in avoiding and helping others avoid some of the major pitfalls in machine learning, especially in dataset preparation (seriously, do people still use malware datasets from 1998?) He has spoken at both DEF CON and BSides, and aims to add BlackHat USA and SecTor to the list in the near future. Philip Tully is a Senior Data Scientist at ZeroFOX, a social media security company based in Baltimore. He employs natural language processing and computer vision techniques in order to develop predictive models for combating threats emanating from social media. His pivot into the realm of infosec is recent, but his experience in machine learning and artificial neural networks is not. Rather than learning patterns within text and image data, his previous work focused on learning patterns of spikes in large-scale recurrently connected neural circuit models. He is an all-but-defended computer science PhD student, in the final stages of completing a joint degree at the Royal Institute of Technology (KTH) and the University of Edinburgh.

uk: вхід без авторизації

name: Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing on Twitter


Mouse Jiggler: Offense and Defense

uk: Комп'ютерні науки

description: A group of highly-armed individuals has just stormed into your office. They are looking to pull data from your computers which are protected with full disk encryption. In order to prevent your screen saver from activating they will likely immediately insert a mouse jiggler to prevent your screensaver lock from activating. This talk will present ways of detecting and defending against such assaults on your system by mouse jiggler wielding individuals. It will also show you how to build your own simple mouse jiggler. Nothing beyond basic Linux usage is required to understand this talk. Attendees will leave with several ways to defend against mouse jigglers and the knowledge of how to create their own mouse jigglers. Phil was born at an early age. He cleaned out his savings as a boy in order to buy a TI99-4A computer for the sum of $450. Two years later he learned 6502 assembly and has been hacking computers and electronics ever since. Dr. Phil currently works as a professor at Bloomsburg University of Pennsylvania. His research focus over the last few years has been on the use of microcontrollers and small embedded computers for forensics and pentesting. Phil has developed a custom pentesting Linux distro and related hardware to allow an inexpensive army of remote pentesting drones to be built using the BeagleBone Black computer boards. This work is described in detail in Phil's book "Hacking and Penetration Testing With Low Power Devices" (Syngress, 2015). Phil has also published books on Linux Forensics (Pentester Academy, 2015), USB Forensics (Pentester Academy, 2016), and Windows Forensics (Pentester Academy, 2016). Prior to entering academia, Phil held several high level positions at well-known US companies. He holds a couple of the usual certs one might expect for someone in his position. When not working, he likes to spend time with his family, fly, hack electronics (find his Daddy and Daughter Electronics show on YouTube), and has been known to build airplanes.

uk: вхід без авторизації


Cheating at Poker: James Bond Style

uk: Комп'ютерні науки

description: Ever dreamed of cleaning up at poker, but afraid that you are not good enough to do it on your own? Fear not! The chinese underground got you covered with high-tech concealed cheating devices that automatically read marked cards and whisper them in your ear through an ear-piece. Seems too good to be true? Well those James Bond devices are the real deal: we were able to get our hands onto one of those pricey gadget and they really work. They even come with additional gizmos, like a camera hidden in a key car, that would have made Q proud. Come to our talk to get an in-depth analysis of how those high tech devices work, see it in action and learn which techniques and tools we built to detect them so you don’t end up being the whale at your next poker game. Bio: Elie leads Google’s anti-abuse research, where he invents new ways to protect the company’s users against cyber-criminal activities and Internet threats. He recently worked on improving Gmail security, and made Chrome safer and faster by implementing better cryptography. Games hacking has been a long time hobby for Elie, who spends far too much time playing Hearthstone and Starcraft. He managed to turn his passion for games to Defcon talks and award winning academic papers. Born in Paris, France, Elie wears berets and love to do cards tricks when in good company. Celine Bursztein is the founder of PetSquare, a startup dedicated to pet owners and animal lovers. She’s crazy about animals and building a product about them was a great way to combine her biology and engineering skills (she holds a PhD in biology and a master’s degree in computer science). When Celine is not busy visiting every zoo on the planet or playing WoW, she picks every lock she can. She discovered this lock picking passion when she successfully cracked her father’s safe at the tender age of 7.

uk: вхід без авторизації


All Your Solar Panels belong to Me

uk: Комп'ютерні науки

description: I got myself a new toy: A solar array… With it, a little device by a top tier manufacturer that manages its performance and reports SLAs to the cloud. After spending a little time describing why it tickled me pink, I’ll walk you through my research and yes, root is involved! Armed with the results of this pen test, we will cover the vendor’s reaction to the bee sting: ostrich strategy, denial, panic, shooting the messenger and more. Finally, not because I know you get it, but because the rest of the world doesn’t, we’ll cover the actual threats associated with something bound to become part of our critical infrastructure. Yes, in this Shodan world, one could turn off a 1.3MW solar array but is that as valuable as using that device to infiltrate a celebrity’s home network? Bio: Fred Bret-Mounet’s descent into the underworld of security began as a pen tester at @stake. Now, he leads a dual life—info sec leader by day, rogue hacker by night. His life in the shadows and endless curiosity has led to surprising home automation hacks, playing with Particle Photons and trying to emulate Charlie & Chris’ car hacking on his I3.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Common hotspot software like Chilispot and Sputnik allow anyone to set up a restricted WiFi router or Ethernet network with a captive portal, asking for money, advertising, or personal information in exchange for access to the Internet. In this talk I take a look at how these and similar restrictive networks work, how they identify and restrict users, and how with a little preparation we can reach the Internet regardless of what barriers they throw up. Bio: Grant Bugher has been hacking and coding since the early 90’s and working professionally in information security for the last 12 years. He is currently a security engineer for a cloud service provider, and has previously been an architect, program manager and software engineer on a variety of online services, developer tools and platforms. Grant is a prior speaker at BlackHat and DEF CON and a regular DEF CON attendee since DEF CON 16. Most of his research and work is on cloud computing and storage platforms, application security, and detecting & investigating attacks against web-scale applications.

uk: вхід без авторизації

name: Bypassing Captive Portals and Limited Networks


Exposing Snooping Tor HSDir Relays

uk: Комп'ютерні науки

description: Tor is a widely used anonymity network that protects users' privacy and and identity from corporations, agencies and governments. However, Tor remains a practical system with a variety of limitations, some of which were indeed exploited in the recent past. In particular, Tor's security relies on the fact that a substantial number of its nodes do not misbehave. Previous work showed the existence of malicious participating Tor relays. For example, there are some Exit nodes that actively interfere with users' traffic and carry out man-in-the-middle attacks. In this work we expose another category of misbehaving Tor relays (HSDirs), that are integral to the functioning of the hidden services and the dark web. The HSDirs act as the DNS directory for the dark web. Because of their nature, detecting their malicious intent and behavior is much harder. We introduce, the concept of honey onions (honions), a framework to detect misbehaving Tor relays with HSDir capability. By setting up and deploying a large scale honion over Tor for more than 72 days, we are able to obtain lower bounds on misbehavior among HSDirs. We propose algorithms to both estimate the number of snooping HSDirs and identify them, using optimization and feasibility techniques. Our experimental results indicate that during the period of our work at least 110 such nodes were snooping information about hidden services they host. We reveal that more than half of them were hosted on cloud infrastructure and delayed the use of the learned information to prevent easy traceback. Furthermore, we provide the geolocation map of the identified snooping Tor HSDirs Bio: Guevera Noubir holds a PhD in Computer Science from EPFL and is currently a Professor at Northeastern University. His research focuses on privacy, and security. He is a recipient of the National Science Foundation CAREER Award (2005). He led the winning team of the 2013 DARPA Spectrum Cooperative Challenge. Dr. Noubir held visiting research positions at Eurecom, MIT, and UNL. He served as program co-chair of several conferences in his areas of expertise such as the ACM Conference on Security and Privacy in Wireless and Mobile Networks, and IEEE Conference on Communications and Network Security. He serves on the editorial board of the ACM Transaction on Information and Systems Security, and IEEE Transaction on Mobile Computing. Amirali Sanatinia is a Computer Science PhD candidate at Northeastern advised by Professor Guevara Noubir, and holds a Bachelors degree in CS from St Andrews University. His research focuses on cyber security and privacy, and was covered by venues such as MIT Technology Review and ACM Tech News. He is also the OWASP Boston NEU Student chapter founder and leader.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: LTE is a more advanced mobile network but not absolutely secure. Recently there already some papers those exposed the vulnerabilities of LTE network. In this presentation, we will introduce one method which jointly exploits the vulnerabilities in tracking area update procedure, attach procedure, and RRC redirection procedure, and finally can force a targeted LTE cellphone to downgrade into a malicious GSM network, then consequently can eavesdrop its data traffic or even voice call. This attack is not a simple DoS attack. It can select the targeted cellphone by filtering the IMSI number (IMSI catcher function), so it will not influence the other cellphones and keep them still in the real network. Further more, it can force the cellphone into the malicious network that we setup (a fake network) or we assign (operator’s network), therefore the cellphone has no chance to choose other secure network. This is the danger point of this attack. Bio: Haiqi Shan, currently a wireless/hardware security researcher in Unicorn Team. He focuses on GSM system, router/switcher hacking etc. Other research interests include reverse engineering on embedded devices such as femto-cell base station. He has gave presentations about GSM devices hacking and wireless hacking suit on DEF CON, Cansecwest, Syscan Wanqiao Zhang, is a communication security researcher, from Unicorn Team of Qihoo 360 China. She received her master degree in electronic information engineering form Nanjing University of Aeronautics and Astronautics in 2015. Fascinated by the world of wireless security, she is currently focus on the security research of the GPS system and the cellular network

uk: вхід без авторизації

name: LTE Redirection: Forcing Targeted LTE Cellphone into Unsafe Network


uk: Комп'ютерні науки

description: In this talk, I'll share how I won 4 Twitter contests per day, every day, for 9 months straight. I'll discuss the methods I used, the delightfully random and surprising things I won, and how to run a Twitter contest to prevent people like me from winning. Bio: Hunter Scott is an electrical and computer engineer with over 7 years of experience designing and implementing hardware systems. He has lead electrical development on a variety of projects, from robotics to communication systems. He has experience in improvising and quickly building prototype and proof of concept designs as well as implementing mission critical, high reliability designs. He has a degree in computer engineering from Georgia Tech and is currently working at a startup you've never heard of (yet!). His work has been featured in publications such as Gizmodo, Quartz, Engadget, CNN, The Chicago Tribune, The Guardian, and NPR. His other projects can be seen at hscott.net.

uk: вхід без авторизації

name: RT2Win: 50 lines of Python made me the luckiest guy on Twitter


Anti-Forensics AF

uk: Комп'ютерні науки

description: This presentation is the screaming goat anti-forensics version of those ‘Stupid Pet Tricks’ segments on late night US talk shows. Nothing ground-breaking here, but we’ll cover new (possibly) and trolly (definitely) techniques that forensic investigators haven’t considered or encountered. Intended targets cover a variety of OS platforms. Bio: int0x80 is the rapper in Dual Core. Drink all the booze, hack all the things!

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Secure Channel (Schannel) is Microsoft's standard SSL/TLS Library underpinning services like RDP, Outlook, Internet Explorer, Windows Update, SQL Server, LDAPS, Skype and many third party applications. Schannel has been the subject of scrutiny in the past several years from an external perspective due to reported vulnerabilities, including a RCE. What about the internals? How does Schannel guard its secrets? This talk looks at how Schannel leverages Microsoft's CryptoAPI-NG (CNG) to cache the master keys, session keys, private and ephemeral keys, and session tickets used in TLS/SSL connections. It discusses the underlying data structures, and how to extract both the keys and other useful information that provides forensic context about connection. This information is then leveraged to decrypt session that use ephemeral cipher suites, which don't rely on the private key for decryption. Information in the cache lives for at least 10 hours by default on modern configurations, storing up to 20,000 entries for client and server each. This makes it forensically relevant in cases where other evidence of connection may have dissipated. Bio: Jake Kambic is a DFIR researcher and network penetration tester

uk: вхід без авторизації

name: Cunning with CNG: Soliciting Secrets from Schannel