uk: Комп'ютерні науки

description: GSM has been attacked in many different ways in the past years. But regardless of the protocol issues, there are also flaws in the logic of the mobile operators' services. One may think that finding an issue which affects only one specific operator in some country couldn't affect other operators. However, this is not the case as most of the operators are using the same equipment and have the same implementation of their services in all of the countries as the operator's group prefers to have a uniform service. This presentation examines different implementation flaws of mobile services which allows you to perform things like accessing someone else's online account, getting free Internet on your mobile device even when roaming, placing free mobile phone calls. Bogdan Alecu (@msecnet) works as a System Administrator for an IT services company and, during his free time, he is an Independent Security Researcher. He received his BSc in Business Information Systems from the "Alexandru Ioan Cuza" University of Iasi. Bogdan has researched for many years in mobile security, starting with Voice over IP and continuing with GSM. One of his research in the GSM security could allow a potential attacker to perform a remote SMS attack which can force mobile phones to send premium-rate text messages. Bogdan is also a frequent speaker at security conferences like DeepSec, EUSecWest, and DefCamp.

uk: вхід без авторизації

name: Business logic flaws in mobile operators services


Brandon Wiley

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: The greatest danger to free speech on the Internet today is filtering of traffic using protocol fingerprinting. Protocols such as SSL, Tor, BitTorrent, and VPNs are being summarily blocked, regardless of their legal and ethical uses. Fortunately, it is possible to bypass this filtering by reencoding traffic into a form which cannot be correctly fingerprinted by the filtering hardware. I will be presenting a tool called Dust which provides an engine for reencoding traffic into a variety of forms. By developing a good model of how filtering hardware differentiates traffic into different protocols, a profile can be created which allows Dust to reencode arbitrary traffic to bypass the filters. Dust is different than other approaches because it is not simply another obfuscated protocol. It is an engine which can encode traffic according to the given specifications. As the filters change their algorithms for protocol detection, rather than developing a new protocol, Dust can just be reconfigured to use different parameters. In fact, Dust can be automatically reconfigured using examples of what traffic is blocked and what traffic gets through. Using machine learning a new profile is created which will reencode traffic so that it resembles that which gets through and not that which is blocked. Dust has been created with the goal of defeating real filtering hardware currently deployed for the purpose of censoring free speech on the Internet. In this talk I will discuss how the real filtering hardware work and how to effectively defeat it. Brandon Wiley (@blanu) is a peer-to-peer pioneer who creates tools to circumvent Internet censorship. In 1999 he co-founded the Freenet project to create a censorship-resistant publishing platform. He is also known for the Curious Yellow superworm design. When working for BitTorrent, Inc. he was given the difficult task of trying to reason with the Internet service providers that were engaging in BitTorrent throttling. More recently he has been working for the Tor project on their next generation blocking-resistant protocols such as pyobfsproxy and obfs3. He is currently in the final stages of his PhD, where he is studying all of the most popular Deep Packet Inspection hardware and figuring out how to defeat it. His interests include Bayesian statistics, polymorphic encodings, and chiptune music.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: Defeating Internet Censorship with Dust, the Polymorphic Protocol Engine

DEF CON

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Комп'ютерні науки

description: Tired of the government being the only entity around that can keep tabs on a whole city at once? Frustrated by dictators du jour knowing more about you than you know about them? Fed up with agents provocateur slipping into your protests, rallies, or golf outings? Suffer no more, because CreepyDOL is here to help! With open-source software, off-the-shelf sensors, several layers of encryption, and a deployment methodology of "pull pin, point toward privacy insurance claimant," it allows anyone to track everyone in a neighborhood, suburb, or city from the comfort of their sofa. For just four easy hardware purchases of $131.95, you, too can move up from small-time weirding out to the big leagues of total information awareness: deploy CreepyDOL today! Brendan O'Connor (@USSJoin) is a geek of many trades. While he's a full-time law student at the University of Wisconsin in Madison (set to graduate in May 2014), his consultancy, Malice Afterthought, completed two DARPA Cyber Fast Track contracts during his first two years in law school. He has also taught information warfare for the DoD, played the violin (now for more than 21 years), obtained his Amateur Extra certification, and wished fervently that his two cats would think of him as more than (a provider of) food.

uk: вхід без авторизації

name: Stalking a City for Fun and Frivolity: “Pull pin, point toward privacy insurance claimant”


uk: Комп'ютерні науки

description: Over the last three years, Oracle Java has become the exploit author's best friend. And why not? Java has a rich attack surface, broad install base, and runs on multiple platforms allowing attackers to maximize their return-on-investment. The increased focus on uncovering weaknesses in the Java Runtime Environment (JRE) shifted research beyond classic memory corruption issues into abuses of the reflection API that allow for remote code execution. This talk focuses on the vulnerability trends in Java over the last three years and intersects public vulnerability data with Java vulnerabilities submitted to the Zero Day Initiative (ZDI) program. We begin by reviewing Java's architecture and patch statistics to identify a set of vulnerable Java components. We then highlight the top five vulnerability types seen in ZDI researcher submissions that impact these JRE components and emphasize their recent historical significance. The presentation continues with an in-depth look at specific weaknesses in several Java sub-components, including vulnerability details and examples of how the vulnerabilities manifest and what vulnerability researchers should look for when auditing the component. Finally, we discuss how attackers typically leverage weaknesses in Java. We focus on specific vulnerability types attackers and exploit kits authors are using and what they are doing beyond the vulnerability itself to compromise machines. We conclude with details on the vulnerabilities that were used in this year's Pwn2Own competition and review steps Oracle has taken to address recent issues uncovered in Java. Brian Gorenc (@MaliciousInput, @thezdi) is the Manager of Vulnerability Research in HP's Security Research organization. His primary responsibility is running the Zero Day Initiative (ZDI) program and doing root cause analysis on ZDI submissions. Brian's current research centers on discovering vulnerabilities in popular software, analyzing attack techniques, and identifying vulnerability trends. Prior to joining HP he worked for Lockheed Martin on the F-35 Joint Strike Fighter program where he led the development effort of the Information Assurance (IA) products in the JSF's mission planning environment. Jasiel Spelman (@WanderingGlitch) is a vulnerability analyst and exploit developer for the Zero Day Initiative (ZDI) program. His primary role involves performing root cause analysis on ZDI submissions to determine exploitability, followed by developing exploits for accepted cases. Prior to being part of ZDI, he was a member of the Digital Vaccine team where he wrote exploits for ZDI submissions and helped develop the ReputationDV service from TippingPoint. Jasiel's focus started off in the networking world but then shifted to development until transitioning to security. He has a B.A. in Computer Science from the University of Texas at Austin.

uk: вхід без авторизації

name: Java Every-Days: Exploiting Software Running on 3 Billion Devices


uk: Комп'ютерні науки

description: Windows boxes are running IPv6 by default so LANs are too. Internet is not yet ready for IPv6 worldwide, but... you can connect internal IPv6 networks to external IPv4 web sites with few packets. In this session you will see how using the new Evil FOCA tool, created to perform IPv6 networks attacks, it is possible to hack Internet IPv4 connections creating a man in the middle in IPv6 networks. And yes, it is only one point and click tool that does all for you. Evil FOCA does man in the middle IPv4, man in the middle IPv6, man in the middle IP4-IPv6, SSL strip, collects passwords, session cookies, and much more tricks. You will love this new Evil FOCA. Chema Alonso (@chemaalonso) is a Security researcher with Eleven Paths , a Telefonica Digital company. Chema holds respective a PhD in Compter Security on top of Computer Science and System Engineering degrees from Rey Juan Carlos University and Universidad Politecnica de Madrid. During his more than 12 years as a security professional, he has consistently been recognized as a Microsoft Most Valuable Professional (MVP). Chema is a frequent speaker at industry events and has been invited to present at information security conferences worldwide including Black Hat Briefings, Defcon, ShmooCON, DeepSec, HackCON, Ekoparty and RootedCon - He is a frequent contributor on several technical magazines in Spain, where he is involved with state-of-the-art attack and defense mechanisms, web security, general ethical hacking techniques and FOCA tools.

uk: вхід без авторизації

name: FeartheEvil FOCA: Attacking Internet Connections with IPv6


uk: Комп'ютерні науки

description: On the surface most common browsers look the same, function the same, and deliver web content to the user in a relatively uniformed fashion. Under the shiny surface however, the way specific user agents handle traffic varies in a number of interesting and unique ways. This variation allows for defenders to play games with attackers and scripted attacks in a way that most normal users will never even see. This talk will attempt to show that differences in how different user agents handle web server responses (specifically status codes) can be used to improve the defensive posture of modern web applications while causing headaches for the average script kiddy or scanner monkey! Chris John Riley (@ChrisJohnRiley) is a senior penetration tester and part-time security researcher working in the Austrian financial sector. With over 15 years experience in various aspects of Information Technology, Chris now focuses full time on Information Security. Chris is one of the founders of the PTES (Penetration Testing Execution Standard), regular conference attendee and avid blogger (blog.c22.cc), as well as being a regular contributor to the Metasploit project and generally getting in trouble in some way or another. When not working to break one technology or another, Chris enjoys long walks in the woods, candle light dinners and talking far too much on the Eurotrash Security podcast.

uk: вхід без авторизації

name: Defense by numb3r5: Making problems for script kiddies and scanner monkeys


uk: Комп'ютерні науки

description: Are some Twitter users more naturally predisposed to interacting with social bots and can social bot creators exploit this knowledge to increase the odds of getting a response? Social bots are growing more intelligent, moving beyond simple reposts of boilerplate ad content to attempt to engage with users and then exploit this trust to promote a product or agenda. While much research has focused on how to identify such bots in the process of spam detection, less research has looked at the other side of the question—detecting users likely to be fooled by bots. This talk provides a summary of research and developments in the social bots arms race before sharing results of our experiment examining user susceptibility. We find that a users' Klout score, friends count, and followers count are most predictive of whether a user will interact with a bot, and that the Random Forest algorithm produces the best classifier, when used in conjunction with appropriate feature ranking algorithms. With this knowledge, social bot creators could significantly reduce the chance of targeting users who are unlikely to interact. Users displaying higher levels of extroversion were more likely to interact with our social bots. This may have implications for eLearning based awareness training as users higher in extraversion have been shown to perform better when they have greater control of the learning environment. Overall, these results show promise for helping understand which users are most vulnerable to social bots. Chris Sumner (@thesuggmeister) is a co-founder of the not-for-profit Online Privacy Foundation who actively participate in and contribute to the emerging discipline of Social Media Behavioral Residue research. Chris has previously spoken on this area of research at conferences including BlackHat, DEF CON, 44CON, the European Conference on Personality and the International Conference on Machine Learning and Applications. Randall Wald is a postdoctoral researcher investigating data mining and machine learning at Florida Atlantic University. Following his BS in Biology from the California Institute of Technology, Randall chose to shift his focus to computer science, applying his domain knowledge towards bioinformatics and building models to predict disease. He also studies machine learning for other domains, including machine condition monitoring, software engineering, and social networking.

uk: вхід без авторизації

name: Predicting Susceptibility to Social Bots on Twitter


Privacy in DSRC connected vehicles

uk: Комп'ютерні науки

description: To date, remote vehicle communications such as OnStar have provided little in the way of privacy. The planned DSRC system will become the first large-scale nationwide direct public participation network outside of the internet. Much information and misinformation has been spread on what the upcoming DSRC system is and can do, especially in the information security community. The recent field trial in the US of a connected vehicle infrastructure raises the level of concern amongst all who are aware of existing privacy issues. In this talk I will examine the current system high level design for North American vehicles, as set by international standards and used in a recent road test in Ann Arbor, Michigan, USA. I will consider privacy concerns for each portion of the system, identifying how they may be addressed by current approaches or otherwise considered solutions. I conclude with a discussion of the strategic value in engaging the privacy community during development efforts and the potential community role in raising privacy as a competitive advantage. Christie Dudley (@longobord) started her career with a BSEE with an emphasis in digital communications from the University of Kansas. A 15 year enterprise network engineer career, largely in finance and manufacturing followed. Starting with a study in anthropology she decided to change fields, eventually pursuing an old interest in communications security and privacy and a brief internship in hardware security. Seeking to combine her interests in technology and society she began pursuing the field from a new perspective, enrolling as JD candidate at Santa Clara Law. She now consults on privacy issues related to communications technology while completing her law degree. She has also cofounded Fork the Law, an effort to bridge the gap between technologists and legislation.

uk: вхід без авторизації


Android WebLogin: Google's Skeleton Key

uk: Комп'ютерні науки

description: Millions of businesses worldwide trust in Google Apps to run their organization's domain. The life-blood of these organizations is routinely stored with Google accounts and accessed with mobile devices. This talk explores how an adversary can parlay the compromise of a single Android device into a complete Google apps domain takeover. The attack vectors explored in this talk make use of various design considerations made by Google to enhance the user-experience and can be equally utilized with malware or physical device access. Several iterations of malicious Android applications were created using these techniques. The apps were then analyzed with multiple Android Anti-Virus products and subsequently published in Google's Play Store. The PoC iterations and analysis results provide some insight into the state of Google's Bouncer and Android malware analysis at the end-point. The final part of the talk is aimed at identifying best practices to minimize risk as well as guidelines for recovering from security incident. Craig Young (@CraigTweets) is a computer security researcher with Tripwire's Vulnerability and Exposures Research Team (VERT). He has identified and responsibly disclosed dozens of vulnerabilities in products from Google, Amazon, IBM, NETGEAR, and others. His research has resulted in numerous CVE assignments and recognition in the Google Application Security Hall of Fame. His BSides SF talk on Google's 2-step verification system provided the impetus for Google to deploy security fixes which make millions of Google users safer.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: The US National Security Agency has been public about the inevitability of mobile computing and the need to support cloud-based service use for secret projects. General Alexander, head of the NSA, recently spoke of using smartphones as ID cards on classified networks. And yet, mobile devices have a poor security track record, both as data repositories and as sources of trustworthy identity information. Cloud services are no better: current security features are oriented toward compliance and not toward real protection. What if we could provide a strong link between mobile device identity, integrity, and the lifecycle of data retrieved from the cloud using only the hardware shipped with modern smartphones and tablets? The good news is that we can do that with the trusted execution environment (TEE) features of the common system on a chip (SOC) mobile processor architectures using 'measurement-bound' encryption. This talk will describe how data can be encrypted to a specific device, how decryption is no longer possible when the device is compromised, and where the weaknesses are. I will demonstrate measurement-bound encryption in action. I will also announce the release of an open-source tool that implements it as well as a paper that describes the techniques for time-bound keys. This is likely the very same way that NSA will be protecting the smartphones that will be used for classified information retrieval. Come learn how your government plans to keep its own secrets and how you can protect yours. Dan Griffin (@JWSdan) is the founder of JW Secure and is a Microsoft Enterprise Security MVP. Dan is the author of the books Cloud Security and Control, published in 2012, and The Four Pillars of Endpoint Security, to be published in 2013, and is a frequent conference speaker. Dan holds a Master's degree in Computer Science from the University of Washington and a Bachelor's degree in Computer Science from Indiana University. Materials:

uk: вхід без авторизації

name: Protecting Data with Short-Lived Encryption Keys and Hardware Root of Trust


uk: Комп'ютерні науки

description: Reflected DOM Injection is a new attack vector that will be unveiled for the first time in our talk! We will explain the technique and show a live demo where we use it to hide malicious code within popular and trusted websites. Daniel Chechik is a veteran security researcher at Trustwave's SpiderLabs. Among other things, he specializes in malware analysis, web exploits detection, Trojan and botnet detection and neutralizing and defining security requirements for the Secure Web Gateway product. Prior to that, Daniel served in a technological unit as a security specialist in the IDF. During the service, Daniel specialized in CheckPoint Firewall equipment, AntiVirus products and other IT security products. Daniel, among other things, has spoken at the RSA conference, holds CEH and CCSE certificates and has a patent pending for 'Detecting Malware Communication on an Infected Computing Device'. Anat (Fox) Davidi is a security researcher at Trustwave's SpiderLabs. Her role includes vulnerability analysis, malware analysis and developing detection logic for the Secure Web Gateway product. Prior to that, Anat worked as a security consultant providing security reviews and penetration tests for organizations in various business sectors, ranging from banks and insurance companies to hi-tech corporations. Amongst other things, Anat has spoken at the RSA conference.

uk: вхід без авторизації

name: Utilizing Popular Websites for Malicious Purposes Using RDI


uk: Комп'ютерні науки

description: Since the publication of the cold boot attack on software disk encryption 5 years ago, there has been little progress on developing countermeasures and implementing defenses in the disk encryption technologies already in wide use. Furthermore, many users of full disk encryption have physical security habits that fall outside the security models of disk encryption software and thus are more vulnerable than they realize. After examining a set of effective, easily executable, attacks on off- the-shelf disk encryption, and contextualizing them in x86 system architecture, we examine recent research on means of mitigating these attacks. By integrating AES new instructions, x86 debugging registers, encrypted RAM, IOMMU, and the TPM into a combined encryption system, the difficulty of executing a successful attack is raised significantly. We will examine the construction of this system in detail, and, at a higher level, the role of full disk encryption in assuring meaningful security in the face of physical access. Source to an experimental version of the system will be made available. Daniel Selifonov has consulted for a handful of research oriented startups since 2007, and built systems for information technology where security was considered throughout design and implementation, rather than as an afterthought. His research interests in security include reverse engineering, applied cryptography, client side security, and user acceptable information system design. He believes that businesses, no matter the size, should have the tools to defend themselves without getting in the way of core operations, and that existing tools and building blocks require too much expert input to implement correctly.

uk: вхід без авторизації

name: A Password is Not Enough: Why disk encryption is broken and how we might fix it


uk: Комп'ютерні науки

description: It seems that every day there's a new NextGen firewall, whitelisting and blacklisting, DLP, or the latest technology thats suppose to stop us. But does it really stop "hackers"? Truth is, naw not really. In this talk we'll be showing off the latest bypass techniques for the "latest" hacker stoppers, using a universally whitelisted website as our middle man for a command and control, social engineering our way into some of the toughest companies, and showing off some techniques that work for us. This talk is about throwing misconceptions of protection and safety out the window, and going back the dirty south. Where thinking outside of the box is a requirement. We'll be releasing two new tools, one that makes meterpreter invisible over the network, and the other a shell that uses a popular third party as the command and control. A vulnerability scanner won't help you herrrrrrre. David Kennedy (@dave_rel1k) is founder and principal security consultant of TrustedSec - An information security consulting firm located in Cleveland Ohio. David was the former Chief Security Officer (CSO) for a Fortune 1000 where he ran the entire information security program. Kennedy is a co-author of the book "Metasploit: The Penetration Testers Guide," the creator of the Social-Engineer Toolkit (SET), and Artillery. Kennedy has presented on a number of occasions at Black Hat, Defcon, ShmooCon, BSIDES, Infosec World, Notacon, AIDE, ISACA, ISSA, Infragard, Infosec Summit, and a number of other security-related conferences. Kennedy has been interviewed by several news organizations including CNN, Fox News, and BBC World News. Kennedy is on the Back|Track and Exploit-DB development team and co-host of the Social-Engineer.org podcast. Kennedy is one of the co-authors of the Penetration Testing Execution Standard (PTES); a framework designed to fix the penetration testing industry. Kennedy is the co-founder of DerbyCon, a large-scale conference in Louisville Kentucky. Prior to Diebold, Kennedy was a VP of Consulting and Partner of a mid-size information security consulting company running the security consulting practice. Prior to the private sector, Kennedy worked for the United States Marine Corps and deployed to Iraq twice for intelligence related missions. Nick Hitchcock (@nick8ch) is a Senior Security Consultant at TrustedSec and has a relentless pursuit to break security and make things do things they were not meant to do. He also has experience working in the IT/information security field for several years and has performed large scale security assessments/penetration tests, risk assessments, forensic analysis, physical security assessments, social engineering engagements. In addition to secular work Nick is also actively involved in the Infosec community, being one of the organizers of DerbyCon and head of security for BSidesLV and BSidesDE. He also is a contributor to social-engineer.org and part of the Social Engineering CTF team at DEF CON. OSCP, GPEN

uk: вхід без авторизації

name: The Dirty South: Getting Justified with Technology


uk: Комп'ютерні науки

description: Right when you thought this topic had been beaten to death, something new emerges. This horse isn't dead yet! This talk will focus on a completely new vulnerability in the way some devices handle MsChapV2 and present some newer methods for capturing clear text credentials easily and without heavy processing power. We will walk you through a full attack against WPA2 enterprise networks using a special patched version of radius that makes this all possible. But wait, there's more! Act now, by coming to the talk, and you'll receive access to new automation tools to do a lot of the work for you. If you're lazy like us and would like access to credentials without a math degree this talk is for you! James Snodgrass enjoys pumping iron and flattening hats. His greatest aspiration in life is leveling his Ford truck and finding that next tight t-shirt. Josh Hoover (@wishbone1138) has spent over a decade in computer security, focused on digital forensics and penetration testing. He has been attending DEF CON for 14 years but this is the first time he has ever spoken at one.

uk: вхід без авторизації

name: BYO-Disaster and Why Corporate Wireless Security Still Sucks


uk: Комп'ютерні науки

description: I have a box on my desk that your CDMA cell phone will automatically connect to while you send and receive phone calls, text messages, emails, and browse the Internet. I own this box. I watch all the traffic that crosses it and you don't even know you're connected to me. Welcome to the New World, where I, not them, own the towers. Oh, and thanks for giving me the box... for free. This box is a femtocell, a low-power cellular base station given or sold to subscribers by mobile network operators. It works just like a small cell tower, using a home Internet connection to interface with the provider network. When in range, a mobile phone will connect to a femtocell as if it were a standard cell tower and send all its traffic through it without any indication to the user. The state-of-the-art authentication protecting cell phone networks can be an imposing target. However, with the rising popularity of femtocells there is more than one way to attack a cellular network. Inside, they run Linux, and they can be hacked. During this talk, we will demonstrate how we've used a femtocell for traffic interception of voice/SMS/data, active network attacks and explain how we were able to clone a mobile device without physical access. Doug DePerry (@dugdep) is a Senior Security Consultant at iSEC Partners in New York City. In addition to his day-to-day consultant duties, Doug is also responsible for helping manage employee/new hire training as well as the summer intern program. At iSEC Doug has recently taken a deeper interest in iOS and crypto assessments as well as architecture reviews and embedded systems. He has also written a whitepaper on HTML5 titled, 'HTML5 Security:The Modern Web Browser Perspective'. Prior to joining iSEC, Doug worked for various defense contractors and the US Army. Tom Ritter (@TomRitterVG) is a Senior Security Consultant at iSEC Partners, a frequenter of @nysecsec, and has far more ideas than time. He is interested in nearly all aspects of cryptography, privacy, anonymity, and pseudonymity; security; and traveling. He is located corporeally in New York City, virtually at http://ritter.vg, and meta- physically has been lost for quite some time.

uk: вхід без авторизації

name: Traffic Interception and Remote Mobile Phone: Cloning with a Compromised CDMA Femtocell


uk: Комп'ютерні науки

description: This talk will show attendees how they can do penetration testing with a network of small, battery-powered, penetration testing systems. The small devices discussed will be running a version of The Deck, a full-featured penetration testing and forensics Linux distro. The Deck runs on the BeagleBoard and BeagleBone family of devices (including the next-gen BeagleBone released in April aka the Raspberry Pi killer). These devices are easily hidden and can run for days to weeks off of battery power thanks to their low power consumption. Various configurations will be presented including a device the size of a deck of cards that is easily attached to the back of a computer which is powered by USB and can be connected inline with the computer's Ethernet connection. While each device running The Deck is a full-featured penetration testing platform, connecting systems together via 802.15.4 networking allows even more power and flexibility. Devices may be constructed for $70-$200 each depending on configuration with the typical device costing less than $100. Devices may be located up to 1 mile from each other and from the command console which could also be running The Deck or any other version of Linux. A powerful pentesting army is easily built for much less than the cost of an Apple MacBook Pro. Philip Polstra (@ppolstra) was born at an early age. He cleaned out his savings at age 8 in order to buy a TI99-4A computer for the sum of $450.Two years later he learned 6502 assembly and has been hacking computers and electronics ever since. Phil currently works as an Associate Professor and Hacker in Residence at a private Midwestern university. He teaches computer security and forensics. His current research focus involves use of microcontrollers and small embedded computers for forensics and pentesting. Prior to entering academia, Phil held several high level positions at well-known US companies. He holds a couple of the usual certs and degrees one might expect for someone in his position. Phil is also an accomplished aviator with several thousand hours of flight time. He holds 12 ratings including instructor, commerical pilot, mechanic, inspector, and avionics tech. When not working, he likes to spend time with his family, fly, hack electronics, and has been known to build airplanes. Over the last few years Phil has spoken on various USB-related topics at a number of conferences such as 44Con, NetSecure, ForenSecure, MakerFaire Detroit, THOTCON, GrrCON, DEF CON, and Black Hat. He has developed a number of cheap, fun, and useful devices for infosec and forensics professionals.

uk: вхід без авторизації

name: We are Legion: Pentesting with an Army of Low-power Low-cost Devices


uk: Комп'ютерні науки

description: "I'm from the government and I'm here to help you" takes on a sinister new meaning as jurisdictions around the world stumble over each other to 'set the people's data free'. NYC boasts in subway ads that 'our apps are whiz kid certified' (i.e. third party) which of course translates to 'we didn't pay for them, and don't blame us if somebody got it wrong and the bus don't come.' This session reports on my (and other people's) research aimed at prying out data that you're probably not supposed to have from Open Government Systems around the world. For example, Philadelphia, PA cavalierly posted the past 7 years of political contribution receipts which contained the full names and personal addresses of thousands of people, some of whom probably didn't want that information to be out there in such a convenient form. The entire database was also trivially downloadable as a CSV file and analysis of it yielded some fascinating and unexpected information. Referring back to classic computer science and accounting principles like 'least privilege' and 'segregation of duties' the presentation will suggest some ways to have our Open Data cake without letting snoopy people eat it. Tom Keenan (@drfuture) wrote his first machine and assembler language programs in 1965 and by 1972 was working as a systems programmer on the KRONOS and MULTICS operating systems. This led to a long career as a computer science professor, media commentator and writer about the human side of technology. He helped design one of the first automated DNA sequencing machines as well as a system for personal identification based on typing rhythm. He has a Masters in Engineering and a Doctorate from Columbia University and has held a number of credentials including CISSP but doesnít feel the need for that now. An award-winning journalist, he co-authored the 1984 CBC Radio IDEAS series "Crimes of the Future" and is currently writing a book on creepiness to be published by OR Books. Blog: http://decreeping.wordpress.com/ Materials:

uk: вхід без авторизації

name: Torturing Open Government Systems for Fun, Profit and Time Travel


uk: Комп'ютерні науки

description: Prior to 2013, the phrase 'Self Destructing Message' was most commonly associated with Inspector Gadget, Maxwell Smart, and the occasional Tom Cruise movie. With the advent of smartphone apps like Snapchat, Wickr, and Facebook Poke, the self-destructing message has left the world of 'International Men of Mystery' and arrived to the civilian world by way of smart phone applications. These apps, and others, claim to provide ephemeral or private messaging to assure senders that their messages are burnt after reading. A message can be encrypted, but that does not make it clandestine or deniable. Through the use of forensic images, packet captures, and API review - we have recovered a wide range of artifacts from messages before, after, and during transmission. We are neutral, fact finding, forensic examiners on a mission. A mission to seek truth and provide you with the results of our deep dive forensic review of self-destructing messaging smartphone apps. Andrea (Drea) London (@strozfriedberg) is a Digital Forensic Examiner in Stroz Friedberg's Dallas office. At Stroz Friedberg, Ms. London acquires and examines digital evidence from laptops, desktops and mobile phones in support of legal proceedings, criminal matters, and/or corporate investigations. Ms. London previously held positions at Arsenal Security Group and IBM's Internet Security Systems Emergency Response Team. At Arsenal, Ms. London was an integral part of the company's immediate response team for worldwide cyber security incidents. During this time she completed and has maintained certification as a Payment Application Qualified Security Assessor (PA QSA), Payment Card Industry (PCI QSA), and PCI Forensic Investigators (PFI), one of the first appointed by the PCI Council. At IBM, she acted as an official Quality Incident Response Assessor (QIRA) reporting PCI breaches to major card brands. Prior to her work for IBM, Ms. London was with the Air Force Office of Special Investigations (AFOSI), where she was one of two Airmen chosen for special duty assignment at the Defense Cyber Crime Center, and where she was tasked with testing and evaluating forensic software and hardware for the Center. StrozFriedberg.com Kyle O'Meara is a Digital Forensic Examiner in Stroz Friedberg's Washington, DC office. Mr. O'Meara is part of a national team of examiners skilled in performing forensic acquisitions, preserving data from a variety of electronic sources, and delivering astute analysis. He supports the firm's electronic discovery cases and also serves as a member of Stroz Friedberg's incident response practice. His work further entail forming and articulating concise opinions on complex technical matters which ultimately serve as expert testimony in depositions, trials and other proceedings. Prior to joining Stroz Friedberg, Mr. O'Meara was a Network Exploitation and Vulnerability Analyst for the National Security Agency (NSA) providing security guidance to the Army and Air Force. During this time, he performed computer forensics on a 6 month deployment to Iraq and served as a lead cryptanalyst for discovering malicious and vulnerable content in computer network operation projects. Mr. O'Meara holds a Master's of Science in Information Security Policy and Management from Carnegie Mellon University.

uk: вхід без авторизації

name: The Evidence Self-Destructing Message Apps Leave Behind


uk: Комп'ютерні науки

description: In the past few decades the world has been dramatically transformed by technology. People have significantly evolved in how they interact with each other and the world; a side effect of this evolution is the drastic change in personal privacy. Private citizens, corporations, and governments all have different ideas on what privacy means and what information should be respected as private. Typically citizens don't realize their expectations of privacy are falsely held, or more accurately that they have very little privacy left. Regarding privacy, decades have gone by without any action to protect an individual's privacy against entities buying, selling, storing, and using your private data. Policy can take years to enact, and the minimal legislative action happening leans toward protecting special interest groups who have great political sway. Action needs to be taken. Policy needs to be created allowing businesses to operate while allowing individuals to keep their information private. In the 2013 Montana Legislative Session Daniel Zolnikov, with the support of Eric Fulton, worked to introduce comprehensive legislation to protect the privacy of the citizens of Montana. Daniel Zolnikov and Eric Fulton will talk about the ideas behind the bill, the process of drafting and introducing legislation, presenting the bill before committee and the public testimony process, and the politics of why the bill ultimately died. The speakers will end the talk with lessons learned and thoughts on how to effectively pass future privacy legislation. Eric Fulton (@Trisk3t) is a specialist in information security research and network penetration testing who regularly speaks on his research and work. In his spare time, Eric works with local students to provide hands-on security training, conducts independent security research on interesting projects, and occasionally works on legislation affecting privacy and technology. Eric currently works for SubSector Solutions which provides information security services and training. Daniel Zolnikov (@DanielZolnikov) is a State Representative for Montana. As a 26 year old Representative, Daniel is one of the few legislators who even remotely understands the threats and concerns of the collection of personal information. He spent his first session working to fill a policy vacuum where privacy and politics meet the road. Daniel sponsored multiple bills, including two pieces of privacy legislation. The first bill would have created the Montana Privacy Act. The second bill, which was signed into law, prevented law enforcement from obtaining cell phone location information without a warrant. For the sake of transparency, he uses his Facebook page www.facebook.com/danielzolnikov to post his votes. Daniel received his undergraduate degree from the University of Montana where he earned 3 business majors in Information Systems, Marketing and Management. As a Montanan, Daniel enjoys the finer things in life including shooting guns, fishing, and fighting tyranny.

uk: вхід без авторизації

name: The Politics of Privacy and Technology: Fighting an Uphill Battle


Getting The Goods With smbexec

uk: Комп'ютерні науки

description: Individuals often upload and execute a payload to a remote system during penetration tests for foot printing, gathering information, and to compromise additional hosts. When trying to remain stealthy, uploading a shell to a target may not be wise. smbexec takes advantage of native Windows functionality and SMB authentication to execute commands on remote Windows systems without having to upload a payload, decreasing the likelihood of being stopped by AntiVirus. The original intent of creating smbexec was to upload and execute obfuscated payloads using samba tools. Since the first PoC, it has expanded its capability to do more, including dumping local and domain cached password hashes, clear text passwords from memory, and stealing the NTDS.dit file from a Windows Domain controller all without the need for a shell on the victim. We will explore the creation of smbexec, the components behind it, and how to leverage its functionality to get the goods from a system without having to use a payload. Eric Milam (@Brav0Hax) is a principal security assessor on the Accuvant LABS enterprise assessment team with over fifteen (15) years of experience in information technology. Eric has performed innumerable consultative engagements including enterprise security and risk assessments, perimeter penetration testing, vulnerability assessments, social engineering, physical security testing, wireless assessments and extensive experience in PCI compliance controls and assessments. Eric is a project steward for the Ettercap project as well as creator and developer of the easy-creds and smbexec projects. IRC J0hnnyBrav0 Materials:

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Forensic fails illustrates the rather comedic attempts at "anti-forensics" by inept computer users trying to hide their tracks. We will recount real-life stories about folks whose level of hacker-mojo might aspire to 1337 status but fall a little short. This talk covers why and how these fails happened and illustrate the forensic artifacts and the techniques used to analyze them. Eric Robi (@ericrobi) is the founder of Elluma Discovery. He has been conducting forensic exams for 11 years and has served as a computer expert witness in Federal and State courts in matters involving computer hacking, trade secrets, murder, database forensics, email forgery, and electronic discovery. He has performed forensic examinations in many hundreds of cases. Eric has spoken multiple times at forensics conferences including CEIC and The Cybercrime summit. He holds a CCE certification among other things and is an active participant in the EDRM (Electronic Discovery Reference Model) and helped publish a model for reducing risk of confidential and private information dissemination. Michael Perklin is currently employed as a Senior Investigator within the Corporate Investigations department of an Enterprise class telecommunications firm. Throughout his career he has performed digital-forensic examinations on over a thousand devices and has processed petabytes of information for electronic discovery. Michael has spoken at security conferences internationally about a variety of topics including digital forensics, computer security, data hiding, and anti-forensics. Michael holds numerous security-related degrees, diplomas and certifications, is a member of the High Technology Crime Investigations Association, and is an avid information security nut who loves learning about new ways to break things.

uk: вхід без авторизації

name: Forensic Fails: Shift + Delete Won't Help You Here


VoIP Wars: Return of the SIP

uk: Комп'ютерні науки

description: NGN (Next Generation Network) is modern TDM/PSTN system for communication infrastructure. SIP (Session Initiation Protocol) Servers are center of NGN services, they provide signaling services. SIP based communication is insecure, because of protocol implementation. Based on this fact, NGN is not actually Next Generation. It can be hacked with old stuff, but a few new attack types will be demonstrated in this presentation. This presentation includes that basic attack types for NGN infrastructure, old school techniques for SIP analysis, a new hacking tool to analysis of SIP services and SIP Trust Hacking technique. Also a few fuzzing techniques will be explained in this presentation. SIP networks provide its services based on Trust Infrastructure. SIP Soft Switches trust each other and accept calls from trusted SIP servers. A new technique will be demonstrated in this presentation, Hacking Trust Relationships Between SIP Gateways. SIP trust will be detected and hacked with a sip trust analyzer tool. For explaining basic attack types, a few tools will be demonstrated such as footprinting, register, enumerator, bruteforcer, call analyzer and SIP proxy. Another dangerous thing is outdated software in NGN infrastructure. VoIP devices have responsibilities to serve signaling such as MSAN, MGW and Soft Switches. They support SIP protocol with vulnerable software which should be analyzed. New fuzzing techniques such as Response based fuzzing, MITM fuzzing and proxy tool usage will be explained. Fatih Ozavci (@fozavci) is a Security Researcher and Consultant of Viproy Security, Turkey. He is author of Viproy VoIP Penetration and Exploitation Testing Kit, also he has published a paper about Hacking of SIP Trust Relationships. He has discovered many unknown private security vulnerabilities, design and protocol flaws in VoIP environments for his customers. Also he analyzes VoIP design and implementation flaws, and helps to improve VoIP infrastructures as a service. While Fatih's primary areas of expertise are VoIP penetration testing, mobile application testing and IPTV testing, he is also well versed at network penetration testing, web application testing, reverse engineering, fuzzing and exploit development. In addition to that, he is a well-known speaker at many security events in Turkey. He is one of the speakers of Athcon 2013 and Blackhat Arsenal USA 2013, he will present his VoIP research and tools.

uk: вхід без авторизації


10,000 Yen into the Sea

uk: Комп'ютерні науки

description: The use of a pressure housing in an underwater vehicle can be difficult to implement without becoming a cost-center. Flipper will walk the audience through a new design for an Autonomous Underwater Glider which challenges assumptions about what is required or necessary to deploy sensors, transmitters, and payloads across long distances in the ocean. The speaker assumes no priory knowledge of subject matter & hopes the audience can help him to find new applications for this Open Source Hardware project. Flipper (@NickFLipper) is a hardware hacker obsessed with lowering the cost of underwater robots. Flipper spent 2 years as a member of his College's ROV team practicing waterproofing of CoTs components such as cameras, IMUs, and motors. These experiences inspired him to form the "Mesa College" team that participated in the 2011 & '12 AUVSI Robosub competition. During the first year of competition, the Mesa team took home a judges award for 'Innovation on a Budget'. Since that time Flipper has been employed by an EV manufacturer working to reduce the cost of high efficiency electric vehicles.

uk: вхід без авторизації


RFID Hacking: Live Free or RFID Hard

uk: Комп'ютерні науки

description: Have you ever attended an RFID hacking presentation and walked away with more questions than answers? This talk will finally provide practical guidance on how RFID proximity badge systems work. We'll cover what you'll need to build out your own RFID physical penetration toolkit, and how to easily use an Arduino microcontroller to weaponize commercial RFID badge readers — turning them into custom, long-range RFID hacking tools. This presentation will NOT weigh you down with theoretical details, discussions of radio frequencies and modulation schemes, or talk of inductive coupling. It WILL serve as a practical guide for penetration testers to understand the attack tools and techniques available to them for stealing and using RFID proximity badge information to gain unauthorized access to buildings and other secure areas. Schematics and Arduino code will be released, and 100 lucky audience members will receive a custom PCB they can insert into almost any commercial RFID reader to steal badge info and conveniently save it to a text file on a microSD card for later use (such as badge cloning). This solution will allow you to read cards from up to 3 feet away, a significant improvement over the few centimeter range of common RFID hacking tools. Some of the topics we will explore are: Overview of best RFID hacking tools available to get for your toolkit Stealing RFID proximity badge info from unsuspecting passers-by Replaying RFID badge info and creating fake cloned cards Brute-forcing higher privileged badge numbers to gain data center access Attacking badge readers and controllers directly Planting PwnPlugs, Raspberry Pis, and similar devices as physical backdoors to maintain internal network access Creating custom RFID hacking tools using the Arduino Defending yourself from RFID hacking threats This DEMO-rich presentation will benefit both newcomers and seasoned professionals of the physical penetration testing field. Francis Brown (@security_snacks) CISA, CISSP, MCSE, is a Managing Partner at Bishop Fox (formerly Stach & Liu), a security consulting firm providing IT security services to the Fortune 1000 and global financial institutions as well as U.S. and foreign governments. Before joining Bishop Fox, Francis served as an IT Security Specialist with the Global Risk Assessment team of Honeywell International where he performed network and application penetration testing, product security evaluations, incident response, and risk assessments of critical infrastructure. Prior to that, Francis was a consultant with the Ernst & Young Advanced Security Centers and conducted network, application, wireless, and remote access penetration tests for Fortune 500 clients. Francis has presented his research at leading conferences such as Black Hat USA, DEF CON, RSA, InfoSec World, ToorCon, and HackCon and has been cited in numerous industry and academic publications. Francis holds a Bachelor of Science and Engineering from the University of Pennsylvania with a major in Computer Science and Engineering and a minor in Psychology. While at Penn, Francis taught operating system implementation, C programming, and participated in DARPA-funded research into advanced intrusion prevention system techniques.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: As the music industry transitioned from physical to digital distribution, they have forgotten the one thing they hold most dear to them: Their DRM. Many browser-based music streaming services use no DRM to secure their music. By doing this, they leave their library of high quality songs free for the picking. This presentation details the use of JavaScript to circumvent the security of several browser-based music streaming services. By reverse engineering the code for several music players, it is possible to mimic the music player to download songs rather than stream them. Many services that are too difficult or obfuscated to reverse engineer can still be exploited by intercepting streaming traffic and making identical requests to downloads songs. This presentation covers the basics of music streaming, demonstrates browser-based traffic logging to identify and download music files, and describes the use of JavaScript to mimic the legitimate player in order to bypass security. The end result is a Google-Chrome extension which will allow users to download songs as they stream them. Franz Payer (@franz780) is a programmer at Tactical Network Solutions in Columbia, MD. At TNS, Franz develops for several research and development projects, including the company's commercial Reaver Pro software. Franz is a freshman at the University of Maryland, majoring in computer science in the Cybersecurity honors program. Prior to college, Franz led his high school's cybersecurity team, gh0stsec.

uk: вхід без авторизації

name: Exploiting Music Streaming with JavaScript


uk: Комп'ютерні науки

description: Differences in packet headers allow tools like nmap to fingerprint operating systems. My new approach to packet normalization removes these header differences. Starting TTL, TCP Options used, and TCP Option order, after normalization, are the same from one packet to the next no matter which operating system sends it. If we normalized the packets transiting our network, could we keep nmap, and tools like it from remotely fingerprinting hosts? It turns out that we can, and we can for most hosts on our network. The proof of concept that I developed (idguard) does just that. A Linux Kernel module, it will be installed as part of the embedded firmware of a Linux-based router, and placed on the local network. Idguard will then give all the packets flowing through the router the same starting TTL, the same selection of TCP options, and the same TCP option order, causing nmap to fail in its attempt to fingerprint hosts on the network. In this session, we'll review packet normalization techniques and how they can be applied to the traffic flowing through our switches to make hosts that they support resistant to fingerprinting, even by nmap. We'll walk through the process from start to finish, from the selection and design of the transformations (some old, some new), to the development of the proof of concept, and finally to the demonstration of idguard itself on a RouterBoard model RB450 router. Followed up by a discussion of the issues involved, the challenges to overcome, and the obstacles to deploying this in a production environment. While ultimately something for the network switch, idguard is suitable for any Linux based router capable of loading and using kernel modules, and will be available for you to take home when we are done so that you can try it for yourself. It uses the packet normalization techniques that I developed, and it is more than enough to show you that while it is not currently an existing feature of switches like DHCP and IGMP snooping, it should be. Gregory Pickett CISSP, GCIA, GPEN, is an Intrusion Analyst for Fortune 100 companies by day and a penetration tester for Hellfire Security by night. As a penetration tester, his primary areas of focus and occasional research are network and host penetration testing with an interest in using background network traffic to target and exploit network hosts using their own traffic against them. He holds a B.S. in Psychology which is completely unrelated but interesting to know. While it does nothing to contribute to how he makes a living, it does demonstrate how screwed up he actually is.

uk: вхід без авторизації

name: Let's Screw with nMap: Nosey Little Bastard aren't you?


uk: Комп'ютерні науки

description: M2M, IoT, whatever buzzword you want to use, telecoms are predicting and preparing for a huge increase in embedded, connected devices within the next 10 years and predict spectrum utilization will increase even faster in the next 5 years. One of the ways this growth will be addressed is with cognitive radio networks. This talk will discuss the new kinds of security issues that are faced by these networks, particularly TV Whitespace. It will NOT presuppose knowledge of RF engineering and will work up from the basics of what cognitive radio is to the security challenges it faces, many of which are not yet solved. It will also release a new hardware platform for building and breaking cognitive radio networks. Hunter Scott is a computer engineer who can't not build things. His work is in robotics, embedded systems, and lately, RF engineering. He recently discovered that working at a startup is really fun. Materials:

uk: вхід без авторизації

name: Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks


uk: Комп'ютерні науки

description: Common wisdom dictates that web applications serving sensitive data must use an encrypted connection (i.e., HTTPS) to protect data in transit. Once served, that same sensitive data must be protected at rest, either through encryption, or more appropriately by not storing the sensitive data on disk at all. In the past, web browser disk caching policies maintained a distinction between HTTP and HTTPS requests, typically refusing to cache HTTPS requests. With today's bandwidth- and performance-hungry AJAX and HTML5 applications, most modern browsers treat all content (including HTTPS) as safe to cache to disk unless explicitly restricted by the server. This silent "shift" of responsibility from browser to web-application server has eluded both secure web-application and safe-browsing paradigms, leaving consumers exposed. Even OWASP recommended guidelines for creating secure web applications are wrong regarding this topic [1]. We tested over thirty sites that provide personal financial, health, and insurance-related information to determine what, if any, sensitive information was cached to disk and the results were surprising. Over 70% of tested sites cached sensitive information, ranging from account balances to bank-check images, bank statements, and full credit reports. We will discuss not only the technical details of these caching vulnerabilities, but also the history behind the "shift" in cache policy responsibility, the breakdown in conventional wisdom concerning web application and web-browser security policies, the ramifications of caching PII to disk, and the potential widespread violation of most compliance standards, including PCI, HIPAA, SOX, and government standards such as FIPS or Common Criteria. Jacob Thompson is a security analyst at Independent Security Evaluators, a Baltimore, Maryland, company specializing in high-end, custom security assessments of computer hardware and software products. Jacob holds an M.S. in Computer Science from the University of Maryland, Baltimore County. His primary security interests include analyzing commercial software products for design flaws and other vulnerabilities, reverse engineering, and cryptography. Prior to joining ISE, Jacob served as a Computer Science teaching assistant and briefly worked as an intern software engineer developing desktop and embedded applications for process control systems.

uk: вхід без авторизації

name: C.R.E.A.M. - Cache Rules Evidently Ambiguous, Misunderstood


uk: Комп'ютерні науки

description: Bit errors in computer memory, when they occur in a stored domain name, can cause Internet traffic to be directed to the wrong Internet location potentially compromising security. When a domain name one bit different from a target domain is registered, this is called "bitsquatting". This presentation builds on previous work in this area presented by Artem Dinaburg at Blackhat 2011. Cisco's research into bitsquatting has revealed several previously unknown vectors for bitsquatting. Cisco has also discovered several new mitigations which do not involve installation of error correcting memory, nor the mass registration of bitsquat domains. In fact some of the new mitigations have the potential to render the problem of bitsquatting to the dustbin of history. Jaeson Schultz (@jaesonschultz) is a Threat Research Engineer for Cisco's Threat Research and Communications (TRAC) Team. Cisco's TRAC team is dedicated to advancing the state-of-the-art of threat defense and enhancing the value of Cisco's security products. Jaeson has over 20 years' experience in Information Security, working previously for companies such as Counterpane, Brightmail, and IronPort. Jaeson's computer experience ranges from hardware hacking, to log analysis and security policy recommendation, to thwarting misuse of Internet application layer protocols like DNS, HTTP, and SMTP. Prior to working in Information Security, Jaeson studied Computer Science at the University of Nevada at Las Vegas. Jaeson also currently holds an Amateur Extra radio license from the FCC under the call sign K8YJO.

uk: вхід без авторизації

name: Examining the Bitsquatting Attack Surface


uk: Комп'ютерні науки

description: You have identified a vulnerability and may have developed an exploit. What should you do with it? You might consider going to the vendor, blogging about it, or selling it. There are risks in each of these options. This 20-minute session will cover the legal risks to security researchers involved in publishing or selling information that details the operation of hacks, exploits, vulnerabilities and other techniques. This session will provide practical advice on how to reduce the risk of being on the wrong end of civil and criminal legal action as a result of a publication or sale. James Denaro (@CipherLaw) is the founder of CipherLaw, a Washington, D.C.-based consultancy and focuses his practice on the legal, technical, and ethical issues faced by innovators in information security. Jim is a frequent speaker and writer on the subject of intellectual property issues in information security and has experience in a wide range of technologies, including intrusion detection and prevention, botnet investigation, malware discovery and remediation, and cryptography. Jim has completed professional coursework at MIT and Stanford in computer security and cryptography. He also holds technical certifications from the Cloud Security Alliance (CCSK) and Cisco Systems (CCENT), and has passed the CISSP examination (pending certification). Before becoming an attorney, Jim spent obscene amounts of time looking at PPC assembly in MacsBug Jim is a registered patent attorney and is admitted to practice in the District of Columbia, California, Maryland, and Virginia. Jim has undergraduate degrees in computer engineering and philosophy and is currently pursuing graduate legal studies in national security at Georgetown. Jim was formerly with the international law firms of Morrison & Foerster and Perkins Coie before founding CipherLaw.

uk: вхід без авторизації

name: How to Disclose or Sell an Exploit Without Getting in Trouble


Making Of The DEF CON Documentary

uk: Комп'ютерні науки

description: Early in 2012, to commemorate the 20th year of the conference, Jason Scott was asked if he would be interested in filming a documentary about DEF CON, whose policies and attendees have traditionally rejected media scrutiny and access. He was interested. Working with his producer, Rachel Lovinger, and a crew of six, Jason filmed for most of 2012, including five 20-hour days in Las Vegas last year, and then spent another 9 months editing 278 hours of footage into what has become DEF CON: The Documentary. The finished film will premiere at DEF CON XXI. Jason and Rachel will provide a look behind the scenes: discussing the planning and production process for this immense project, the ups and downs, and the learned lessons. Plus, we'll show some of the stranger footage you won't get to see in the final film. Jason Scott (@textfiles) is a historian, archivist, activist and documentary filmmaker who has made two films before DEF CON, called BBS and GET LAMP. He has spoken at DEF CON a dozen times and it gets harder every. Single. Time. Rachel Lovinger (@rlovinger) is a content strategist, movie buff, and documentary geek. She's been involved in a variety of film projects, but none of them compared to the intense shooting schedule of "The DEFCON Documentary." Having known Jason Scott for 25 years and having been to DEFCON several times, she somehow still agreed to help produce this film.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This presentation introduces the underlying protocols on automobile communication system networks of passenger vehicles and evaluates their security. Although reliable for communication, vehicle protocols lack inherit security measures. This work focuses strongly on controller area networks (CANs) and the lack of authentication and validation of CAN messages. Current data security methods for CAN networks rely on the use of proprietary CAN message IDs along with physical boundaries between the CAN bus and the outside world. As we all know, security through obscurity is not true security. These message IDs can be reverse engineered and spoofed to yield a variety of results. This talk discusses methods for reverse engineering proprietary CAN messages. These reverse engineered messages are then injected onto the CAN bus of a 2003 Mini Cooper with the help of cheap Arduino hardware hacking. Additionally, a proof of concept will be demonstrated on how to build your own rogue CAN node to take over a CAN network and potentially manipulate critical components of a vehicle. The proof of concept demonstrates taking full control of the instrument cluster using the reverse engineering methods presented. Jason Staggs is currently a graduate student in computer science and a security research assistant at the Institute for Information Security (iSec) at The University of Tulsa. He also is involved with The University of Tulsa's Crash Reconstruction Research Consortium (TU-CRRC) where he occasionally gets to hack and wreck a variety of vehicles. Before attending graduate school, Jason worked as a cyber-security analyst for a leading information security firm, True Digital Security in Tulsa, OK. Jason holds a Bachelors degree in Information Assurance and Forensics from Oklahoma State University along with several industry certifications. His research interests include network intrusion detection systems, digital forensics, critical infrastructure protection, and reverse engineering.

uk: вхід без авторизації

name: How to Hack Your Mini Cooper: Reverse Engineering Controller Area Network (CAN) Messages on Passenger Automobiles


uk: Комп'ютерні науки

description: PowerShell is a scripting language included with all modern Windows operating systems, which, among other features, provides access to the Win32 API and the capability to run scripts on remote servers without writing to disk. PowerShell scripts bypass application white listing, application-signing requirements, and generally bypass anti-virus as well. While all of these characteristics are very desirable to a penetration tester, rewriting penetration test tools in PowerShell would be time consuming. Instead, I will show how to combine PowerShell and assembly to reflectively load existing EXE's and DLL's without writing to disk, triggering anti-virus, or triggering application whitelisting. I'll finish with several demonstrations of the Invoke-ReflectivePEInjection script in action. Joe Bialek (@JosephBialek) is currently a Security Engineer on the Office 365 Red Team at Microsoft where he does security research, red teaming, penetration testing, tool development, and code review. Joe was a contributor to Microsoft's Pass the Hash guidance paper, and has been a contributor to other large security efforts within the company. Prior to his role at Microsoft, Joe graduated from Western Washington University with a Bachelors degree in Computer Science.

uk: вхід без авторизації

name: PowerPwning: Post-Exploiting By Overpowering PowerShell


uk: Комп'ютерні науки

description: On-chip debug (OCD) interfaces can provide chip-level control of a target device and are a primary vector used by hackers to extract program code or data, modify memory contents, or affect device operation on-the-fly. Depending on the complexity of the target device, manually locating available OCD connections can be a difficult and time consuming task, sometimes requiring physical destruction or modification of the device. In this session, Joe will introduce the JTAGulator, an open source hardware tool that assists in identifying OCD connections from test points, vias, or components pads. He will discuss traditional hardware reverse engineering methods and prior art in this field, how OCD interfaces work, and how JTAGulator can simplify the task of discovering such interfaces. Joe Grand (@joegrand) is an electrical engineer and hardware hacker. He runs Grand Idea Studio (www.grandideastudio.com) and specializes in the design of consumer and hobbyist embedded systems. He created the electronic badges for DEFCON 14 through 18 and was a co-host of Discovery Channel's Prototype This. Back in the day when he was known as Kingpin, he was a member of the infamous hacker group L0pht Heavy Industries.

uk: вхід без авторизації

name: JTAGulator: Assisted Discovery Of On-Chip Debug Interfaces


uk: Комп'ютерні науки

description: Ever been attacked by malicious code leaving unknown files all over your computer? Trying to figure out if a file is encrypted or just compressed? Is the file really something else? Is there hidden data? Are you short on time! This talk leads you through file identification and analysis using some custom FREE tools that apply statistics and visualization to answer these questions and more. You can often identify files by their statistical picture and I am going to show you how. We can find some hidden data (steganalysis), easily determine if an executable file is packed or obfuscated, find appended data, figure out if the file is really what it purports to be and even aid in reversing XOR encryption. The final proof of concept program allows you to statistically identify (i.e. no magic numbers or header information used) some file types autonomously for an entire hard drive. The Windows-based tools (mostly math so adaptable to Linux) and source code are free! John Ortiz is currently a senior computer engineering consultant for Harris/Crucial Security Inc. working as a reverse exploit engineer. In this position, he develops and analyzes vulnerabilities and exploits for various software. Prior to working at Crucial, he spent 5 years at SRA International and 5 years at General Dynamics developing various defense related software, researching data hiding techniques, and analyzing malware. In a second role, Mr. Ortiz developed and teaches a Steganography course for the University of Texas at San Antonio (UTSA). It covers a broad spectrum of data hiding techniques in both the spatial and transform domains including least significant bit, discrete cosine transform, echo hiding, hiding in executables, and hiding in network protocols. For the course, Mr. Ortiz developed several steganographic programs for testing and analysis. Mr. Ortiz holds two master's degrees from the Air Force Institute of Technology, one in Electrical Engineering and one in Computer Engineering and a BSEE from Rose-Hulman Institute of Technology.

uk: вхід без авторизації

name: Fast Forensics Using Simple Statistics and Cool Tools: What's all the FFUSS about?


Blucat: Netcat For Bluetooth

uk: Комп'ютерні науки

description: TCP/IP has tools such as nmap and netcat to explore devices and create socket connections. Bluetooth has sockets but doesn't have the same tools. Blucat fills this need for the Bluetooth realm. Blucat can be thought of as a: debugging tool for bluetooth applications device exploration tool a component in building other applications Blucat is designed to run on many different platforms (including Raspberry Pi) by abstracting core logic from native code using the Bluecove library to interact with a variety of Bluetooth stacks. This talk will go over the objectives, designs, and current results of the project. More information is at http://blucat.sourceforge.net/ . Joseph Paul Cohen is a Ph.D. student at the University of Massachusetts Boston. He has worked for large finance, IT consulting, and startup software companies. He now focuses on computer science research in areas of machine learning and cyber security education.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: "Theoretical" targeted rootkits need to play by different rules than the common malware that ends up filling our inboxes with spam and attempting to steal our CC numbers... The costs involved of getting popped are huge in comparison, the value is in the secrecy of being truly hidden and embedded for the long term. I've spent the past year considering what the next level of rootkits would look like and how we can protect ourselves against them. This talk will cover a handful of advanced hiding mechanisms at a technical level. The talk will also touch on legal implications and existing frameworks for expensive advanced threats. Josh 'm0nk' Thomas (@m0nk_dot) Security researcher, mobile phone geek, mesh networking evangelist and general breaker of things electronic. Typical projects of interest span the hardware / software barrier and rarely have a UI. m0nk has spent the last year or two digging deep into Android and iOS internals, with a major focus on both the network stack implementation and the driver and below hardware interfaces. He uses IDA more frequently than Eclipse (and a soldering iron more than both). His life dreams are to ride a robot unicorn on a moonlit beach and make the world a better place, but mostly the unicorn thing... Josh is currently employed by the nice people @ Accuvant LABS and the very mean people @ MonkWorks, LLC.

uk: вхід без авторизації

name: Boutique Kit: Playing WarGames with expensive rootkits and malware


BYOD PEAP Show

uk: Комп'ютерні науки

description: The onslaught of Bring Your Own Device(s) in recent years places a new focus on the security of wireless networks. In "The BYOD PEAP Show", Josh Yavor explores fundamental flaws in one of the most common and widely supported 802.1x authentication protocols used by countless corporate WPA2-Enterprise networks today. A series of events in the recent past created a situation in which PEAP can no longer be used safely. In this talk, we will re-trace this path and investigate how the combination of BYOD, new technology and new tools led to this situation. A live demonstration with audience participation will punctuate the danger of supporting PEAP. Attendees will leave with an understanding of the underlying flaws, methods of exploitation, a set of tools and most importantly, how to secure WPA2-Enterprise networks that currently support PEAP. A new tool, peapshow, will be released after DEF CON and will make testing and exploitation of this issue truly trivial. Besides, this is DEF CON. Someone has to mess with the WiFi. Josh Yavor (@schwascore) is a Security Engineer at iSEC Partners, an information security firm specializing in application, network, and mobile security. At iSEC, Josh specializes in web application security and network penetration testing. Josh holds a MS in Computer, Information and Network Security from DePaul University. At DePaul, he focused on network security while also developing an interest in incident response and SCADA/ICS. Prior to working at iSEC, Josh operated an independent IT consulting and managed services business with a special focus on security related projects.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Password and PIN systems are often encountered on mobile devices. A software approach to cracking these systems is often the simplest, but in some cases there may be no better option than to start pushing buttons. This talk will cover automated PIN cracking techniques using two new tools and discuss the practicality of these attacks against various PIN-secured systems. Robotic Reconfigurable Button Basher (R2B2) is a ~$200 robot designed to manually brute force PINs or other passwords via manual entry. R2B2 can operate on touch screens or physical buttons. R2B2 can also handle more esoteric lockscreen types such as pattern tracing. Capacitive Cartesian Coordinate Bruteforceing Overlay (C3BO) is a combination of electronics designed to electrically simulate touches on a capacitive touch screen device. C3BO has no moving parts and can work faster than R2B2 in some circumstances. Both tools are built with open source software. Parts lists, detailed build instructions, and STL files for 3d printed parts will be available for download. A lucky volunteer will get to have their PIN cracked live on stage!. Justin Engler (@justinengler) is a Senior Security Engineer for iSEC Partners. Justin specializes in mobile and application security. Justin has previously spoken at DEF CON and BlackHat. Justin is not a roboticist, but will play one on DEF CON TV. Paul Vines is a student at University of Washington and an iSEC Security Engineering Intern.

uk: вхід без авторизації

name: Electromechanical PIN Cracking with Robotic Reconfigurable Button Basher (and C3BO)


uk: Комп'ютерні науки

description: Domain Controllers are the crown jewels of an organization. Once they fall, everything in the domain falls . Organizations go to great lengths to secure their domain controllers, however they often fail to properly secure the software used to manage these servers. This presentation will cover unconventional methods for gaining domain admin by abusing commonly used management software that organizations deploy and use. Justin Hendricks works on the Office 365 security team where he is involved in red teaming, penetration testing, security research, code review and tool development.

uk: вхід без авторизації

name: So You Think Your Domain Controller is Secure


uk: Комп'ютерні науки

description: SIM cards can do more than just authenticate your phone with your carrier. Small apps can be installed and run directly on the SIM separate from and without knowledge of the phone OS. Although SIM Applications are common in many parts of the world, they are mostly unknown in the U.S. and the closed nature of the ecosystem makes it difficult for hobbyists to find information and experiment. This talk, based on our experience building SIM apps for the Toorcamp GSM network, explains what (U)SIM Toolkit Applications are, how they work, and how to develop them. We will explain the various pieces of technology involved, including the Java Card standard, which lets you write smart card applications using a subset of Java, and the GlobalPlatform standard, which is used to load and manage applications on a card. We will also talk about how these applications can be silently loaded, updated, and interacted with remotely over-the-air. Karl Koscher (@supersat) is a PhD student studying security and privacy at the University of Washington. His research covers a wide variety of areas, but he primarily focuses on security for embedded systems. Most recently, he was one of the primary researchers that demonstrated that modern cars are vulnerable to multiple remote exploits, which can affect nearly every physical system in the car. Eric Butler (@codebutler) is a software engineer with an interest in security, privacy, and usability. He's known for creating Firesheep, an easy to use tool that clearly demonstrated the risks of HTTP session hijacking attacks, and prompted major websites including Facebook, Twitter, and Hotmail to improve their security. He also created FareBot, an Android app that reads data from common NFC transit cards sparking a discussion around the privacy of these systems.

uk: вхід без авторизації

name: The Secret Life of SIM Cards: writing, building, loading, and using code on SIM cards.


How to use CSP to stop XSS

uk: Комп'ютерні науки

description: Crosssite scripting attacks have always been a mainstay of the OWASP Top 10 list. The problem with detecting XSS is that you can't go looking at web log traffic to determine if a request contains an actual cross site scripting attack attempt, much less one that will actually succeed against your defenses. Our work has helped reveal some nuances with implementing content security policy to help detect and prevent XSS attacks across a major website. This talk will demonstrate a new python based tool that we are open sourcing for Defcon that combines client and server based whitelisting mechanisms to verify unauthorized scripts (I.e. XSS) running on a page, mixed content, and inline javascript across a site. Kenneth Lee (@Kennysan) is a product security engineer at Etsy.com working on everything from HTTP security headers to shattering the site with new vulnerabilities. Previously, Kenneth worked at FactSet Research Systems preventing The Hackers from stealing financial data. He went to Columbia and got an MS in computer science focusing on computer security. Between sweet hacks, Kenneth enjoys drinking tea and force feeding Etsy's operations team with Japanese chocolates.

uk: вхід без авторизації


LosT - Welcome and Making of the Badges

uk: Комп'ютерні науки

description: LosT welcomes everyone to the conference and discusses the making of the DEF CON Badges.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: In typical military operations, the advantage goes to the offense because the initiator controls the timing and is able to concentrate forces. A good defense is designed to undermine the advantage of the offense. Proactive defense approaches include: masking (obfuscation), maneuvering, and hardening of critical capabilities. The other alternative, which is often characterized as resiliency or mission assurance, is to employ methods which deny the objectives of the offense. The expertise resident in the hacker community can improve both proactive defense and mission assurance. Lt. Gen. Robert Elder (USAF, retired) joined the George Mason University faculty as a research professor with the Volgenau School of Engineering following his retirement from the Air Force as the Commander of 8th Air Force and U.S. Strategic Command's Global Strike Component. He currently conducts research in the areas of integrated command and control, operational resiliency in degraded environments, strategic deterrence, and the use of modeling to support national security decision-making. He also serves as a senior advisor to the Cyber Innovation Center in Louisiana. General Elder was the first commander of Air Force Network Operations and led the development of the cyberspace mission for the Air Force. General Elder also served as Commandant of the Air War College, and holds a doctorate in engineering from the University of Detroit.

uk: вхід без авторизації

name: Alternative Approaches to Leverage and Defend Cyberspace


uk: Комп'ютерні науки

description: Homeowners, apartment complexes, and businesses throughout the United States and Canada have purchased locks from one of the leading manufacturers in the country in the belief that they were secure. Advertising represents they are the highest grade of residential security available as a result of security ratings from different Standards organizations. While the design of this lock effectively resists certain forms of covert and forced entry that are common with other mechanical cylinders, there are also what we perceive as serious design flaws that will allow these locks to be opened, bypassed, or decoded in seconds. Because this is one of the most popular locks in America, the consumer needs to understand the inherent security vulnerabilities in order to assess their risk. In this presentation we analyze the design of this lock and earlier similar designs implemented by other manufacturers. The focus is on a failure of the design engineers to understand different methods of bypass and to protect against them, and why standards and what they purport to define may be misleading and misrepresent the real security of a product.Consumers rely upon the representations of manufacturers and the security ratings of locks by Underwriters Laboratory and the Builders Hardware Manufacturers Association to assure them of the quality and resistance to attack of the locks they buy. We present evidence that millions of homeowners and businesses that have implemented these locks can be vulnerable to simple methods of entry of which they may not be aware.This is a classic example of insecurity engineering in a very clever and unique mechanical lock. Unfortunately, the very unique mechanism also provides the basis for several incredibly simple attacks that can be performed with a minimum of time, tools and training. Marc Weber Tobias is an investigative attorney and security specialist living in Sioux Falls, South Dakota. He is the principal attorney for Investigative Law Offices, P.C. and as part of his practice represents and consults with lock manufacturers, government agencies and corporations in the U.S. and overseas regarding the design and bypass of locks and security systems. Marc and his associates also conduct technical fraud investigations and deal with related legal issues. Marc has authored five police textbooks, including "Locks, Safes, and Security", which is recognized as a primary reference for law enforcement and security professionals worldwide. The second edition, a 1400 page two- volume work, is utilized by criminal investigators, crime labs, locksmiths and those responsible for physical security. A ten-volume multimedia edition of his book (LSS+) is also available online. Marc has written extensively about the security vulnerabilities of products and has appeared in numerous television and radio interviews and news reports as well as magazine articles during the past thirty years. He is a member of several professional organizations including the American Bar Association (ABA, American Society for Industrial Security (ASIS), Associated Locksmiths of America (ALOA), Association of Firearms and Tool mark Examiners (AFTE), American Polygraph Association (APA) and the American Police Polygraph Association (APPA). Tobias Bluzmanis was born in Caracas, Venezuela. Tobias came to the United States in 1995 and was granted citizenship in 2000. He has been a professional locksmith for the past 20 years. Tobias is an expert in Covert Methods of Entry and has developed many unique forms of bypass, custom tools, including a decoder for Medeco locks, which was the impetus for the book "Open in Thirty Seconds".

uk: вхід без авторизації

name: A Failure of Imagination: Kwikset Smartkey and Insecurity Engineering: One of the most secure and insecure locks in America


uk: Комп'ютерні науки

description: Reverse Engineering is the supreme discipline in analyzing malware, how else would you find out all capabilities of a malicious sample? But this task gets trickier nearly every day, as malware authors apply new techniques to evade analysis. Even worse, documentation of said techniques is barely existent, which makes our job even harder. This talk will focus on the challenges of a specifically thorny piece of malware, detected as Backdoor.Win32.Banito. It will discuss the palette of anti-analysis measures found and show a path through a multi-threaded file-infecting spy bot. The talk will try to shed some light on the merely shallow documentation of the binary layout of Windows Structured Exception Handling (SEH), point out complications in analyzing object oriented C++ binaries and give an insight on how to tackle multi-threaded executables. Marion Marschalek (@pinkflawd) is currently employed at IKARUS Security Software GmbH based in Vienna, Austria. She is working as Malware Analyst and in Incident Response for two years now. Besides that Marion teaches basics of malware analysis at University of Applied Sciences St. Pölten. She has a technical degree, achieved through three different universities on three different continents. In March this year Marion won the Female Reverse Engineering Challenge 2013, organized by RE professional Halvar Flake.

uk: вхід без авторизації

name: A Thorny Piece Of Malware (And Me): A Talk about Exception Handlers, VfTables, Multi-Threading and other Nastiness


uk: Комп'ютерні науки

description: The rapidly changing threat landscape has finally provided relevant business justification for commercial companies to invest in developing cybersecurity intelligence that used to be the domain of the government -- and they are doing it at a pace that is making the value of government "Classified" cybersecurity information increasingly irrelevant. The organic intelligence being developed by private companies and the informal cybersecurity intelligence coming out of the research community and some "Invitation Only" or "You're Not Invited" groups is simply more actionable and more valuable than that provided by the government. While the federal government will always, and should always, have important visibility of the threat, the evolution of technology is giving the private sector the means to develop sophisticated, high quality information that rivals the government. Mark Weatherford is a Principal at The Chertoff Group and advises clients on a broad array of cybersecurity services. As one of the nation's leading experts on cybersecurity, Mr. Weatherford works with organizations around the Nation and around the world by creating comprehensive security strategies for core business operations and objectives. Mr. Weatherford also serves on the Advisory Board at both Cylance and Coalfire and is a member of the Bipartisan Policy Commission Electric Grid Cyber Security Initiative and the Idaho National Laboratory Strategic Advisory Group (SAG) for Electric Grid Resilience. Prior to joining The Chertoff Group, Mr. Weatherford was appointed as the Department of Homeland Security's first Deputy Under Secretary for Cybersecurity. Before joining DHS, Mr. Weatherford was the Vice President and Chief Security Officer at the North American Electric Reliability Corporation (NERC) where he directed the cybersecurity and critical infrastructure protection program and worked with electric utility companies across North America. Prior to NERC, Mr. Weatherford was appointed by Governor Arnold Schwarzenegger to serve as California's first Chief Information Security Officer and was also the first Chief Information Security Officer for the State of Colorado, where he was appointed by two successive governors. As a former U.S. Navy Cryptologic Officer, Mr. Weatherford led the United States Navy's Computer Network Defense operations and the Naval Computer Incident Response Team (NAVCIRT). Mr. Weatherford earned a bachelor's degree from the University of Arizona, amaster's degree from the Naval Postgraduate School and holds the Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications. He was one of the Information Security magazine "Security 7 Award" winners in 2008, was awarded SC Magazine's "CSO of the Year" award in 2010, and was named one of the "10 Most Influential People in Government Information Security" by GovInfoSecurity in both 2012 and 2013.

uk: вхід без авторизації

name: The Growing Irrelevance of US Govt Cybersecurity Intelligence Info


uk: Комп'ютерні науки

description: If it's electronic, it makes noise. Not necessarily noise that you and I can hear, of course -- unless you know how to tune in. The air around us is filled with bloops, bleeps, and bzzts of machines going about their business, betraying their existence through walls or even from across the street. The unintentional noise lurking among intentional signals can even reveal what the machine is currently doing when it thinks it's keeping that information to itself. Attacks exploiting electromagnetic radiation, such as TEMPEST, have long been known, but government-sized budgets are no longer needed to procure the radio equipment. USB television receiver dongles can be used as software-defined radios (SDR) that cost less than a slice of Raspberry Pi. The goal of this talk is to show you that anyone with twenty bucks and some curiosity can learn a great deal about your computers and other equipment without ever leaving a trace, and you shouldn't neglect this risk when managing your organization's security. Melissa Elliott (better known as 0xabad1dea) is a professional security bug finder who has seen unspeakable horrors in corporate codebases from around the world. Her very name causes systems to crash, especially ones that use jQuery. Her hobbies include programming the Nintendo Entertainment System, criticizing other people's C code, and an interest in radio emissions that resulted from a trip to the National Radio Astronomy Observatory in Green Bank, West Virginia.

uk: вхід без авторизації

name: Noise Floor: Exploring the world of unintentional radio emissions


Abusing NoSQL Databases

uk: Комп'ютерні науки

description: The days of selecting from a few SQL database options for an application are over. There is now a plethora of NoSQL database options to choose from: some are better than others for certain jobs. There are good reasons why developers are choosing them over traditional SQL databases including performance, scalabiltiy, and ease-of-use. Unfortunately like for many hot techologies, security is largely an afterthought in NoSQL databases. This short but concise presentation will illustrate how poor the quality of security in many NoSQL database systems is. This presentation will not be confined to one particular NoSQL database system. Two sets of security issues will be discussed: those that affect all NoSQL database systems such as defaults, authentication, encryption; and those that affect specific NoSQL database systems such as MongoDB and CouchDB. The ideas that we now have a complicated heterogeneous problem and that defense-in-depth is even more necessary will be stressed. There is a common misconception that SQL injection attacks are eliminated by using a NoSQL database system. While specifically SQL injection is largely eliminated, injection attack vectors have increased thanks to JavaScript and the flexibility of NoSQL databases. This presentation will present and demo new classes of injection attacks. Attendees should be familiar with JavaScript and JSON. Ming Chow (@tufts_cs_mchow) is a Lecturer at the Tufts University Department of Computer Science. His areas of work are in web and mobile engineering and web security. He teaches courses largely in the undergraduate curriculum including the second course in the major sequence, Web Programming, Music Apps on the iPad, and Introduction to Computer Security. He was also a web application developer for ten years at Harvard University. Ming has spoken at numerous organizations and conferences including the High Technology Crime Investigation Association - New England Chapter (HTCIA-NE), the Massachusetts Office of the Attorney General (AGO), John Hancock, OWASP, InfoSec World (2011 and 2012), DEF CON 19 (2011), the Design Automation Conference (2011), Intel, and the SOURCE Conference (Boston 2013). Ming's projects in information security include building numerous CTF challenges, Internet investigations, HTML5 and JavaScript security, and Android forensics.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Everyone's heard the claim: Security through obscurity is no security at all. Challenging this claim is the entire field of steganography itself - the art of hiding things in plain sight. Most people know you can hide a text file inside a photograph, or embed a photograph inside an MP3. But how does this work under the hood? What's new in the stego field? This talk will explore how various techniques employed by older steganographic tools work and will discuss a new technique developed by the speaker which embodies both data hiding and data enciphering properties by encoding data inside NTFS volumes. A new tool will be released during this talk that will allow attendees to both encode and decode data with this new scheme. Michael Perklin (@mperklin) is currently employed as a Senior Investigator within the Corporate Investigations department of an Enterprise class telecommunications firm. Throughout his career he has performed digital-forensic examinations on over a thousand devices and has processed petabytes of information for electronic discovery. Michael has spoken at security conferences internationally about a variety of topics including digital forensics, computer security, data hiding, and anti-forensics. Michael holds numerous security-related degrees, diplomas and certifications, is a member of the High Technology Crime Investigations Association, and is an avid information security nut who loves learning about new ways to break things.

uk: вхід без авторизації

name: ACL Steganography: Permissions to Hide Your Porn