From 0 To Secure In 1 Min

uk: Комп'ютерні науки

description: Recent hacks to IaaS platforms reveled that we need to master the attack vectors used: Automation and API attack vector, insecure instances and management dashboard with wide capabilities. Those attack vectors are not unique to Cloud Computing but there are magnified due to the cloud characteristics. The fact is that IaaS instance lifecycle is accelerating, nowadays we can find servers that are installed, launched, process data and terminate - all within a range of minutes. This new accelerated lifecycle makes traditional security processes such as periodic patches, vulnerability scanning, hardening, and forensics impossible. In this accelerated lifecycle, there are no maintenance windows for patches or ability to mitigate vulnerability, so the security infrastructure must adapt to new methods. In this new thinking, we require automation of instance security configuration, hardening, monitoring, and termination. Because there are no maintenance windows, Servers must be patched before they boot up, security configuration and hardening procedures should be integrated with server installation and vulnerability scanning and mitigation processes should be automatic. In the presentation, we plan to announce the full version of a new open source tool called "Cloudefigo" and explain how it enables accelerated security lifecycle. We demonstrate how to launch a pre-configured, already patched instance into an encrypted storage environment automatically while evaluating their security and mitigating them automatically if a vulnerability is found. In the live demo, we leverage Amazon Web Services EC2 Cloud-Init scripts and object storage for provisioning automated security configuration, integrating encryption, including secure encryption key repositories for secure server's communication. The result of those techniques is cloud servers that are resilient, automatically configured, with the reduced attack surface. Speaker Bios: Nir is employed at NCR Corporation as the CISO of NCR Retail. Before the acquisition of Retalix by NCR, he was Chief Security Officer of R&D at the company. As part of his previous positions in the last decade, he worked as Chief Security Architect, Senior Technology Consultant, Application Security Consultant, Systems Infrastructure Security Consultant, and a Technological Trainer. While in these positions, Nir was not only consulting, but also performing hands-on activities in various fields, i.e. hardening, penetration testing, and development for personal/internal applications. In addition, Nir is a public speaker (spoke on BlackHat, DEF CON, OWASP, InfoSec etc.) and open source contributor. Among his contributions, he released an open source anti-defacement tool called AntiDef, and wrote a publication about QRbot, an iPhone QR botnet POC he developed. His latest open source tool is Cloudefigo, which planned to be presented in the conference. Nir has a BSc in Computer Science but his knowledge is based mainly on cowboy learning and information sharing with the techno-oriented communities. Moshe Ferber is an information security entrepreneur and one of the cornerstones of the information security industry in Israel, with over 20 years of experience in various industry the leading positions such as the Security manager for Ness Technologies and founder of leading MSSP services provider. Currently Mr. Ferber focuses in promoting innovation in the Israeli startup scene as an investor, lecturer and evangelist for various cloud security topics. Mr. Ferber is a popular industry speaker and promote cloud security best practices and official lecturer for the Cloud Security Alliance.

uk: вхід без авторизації


Ömer Coşkun

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: The recent research in malware analysis suggests state actors allegedly use cyber espionage campaigns against GSM networks. Analysis of state-sponsored malwares such like Flame, Duqu, Uruborus and the Regin revealed that these were designed to sustain long-term intelligence-gathering operations by remaining under the radar. Antivirus companies made a great job in revealing technical details of the attack campaigns, however, it exclusively has almost focused on the executables or the memory dump of the infected systems - the research hasn't been simulated in a real environment. GSM networks still use ancient protocols; Signaling System 7 (SS7), GPRS Tunneling Protocol (GTP) and the Stream Control Transmission Protocol (SCTP) which contain loads of vulnerable components. Malware authors totally aware of it and weaponing exploits within their campaigns to grab encrypted and unencrypted streams of private communications handled by the Telecom companies. For instance, Regin was developed as a framework that can be customized with a wide range of different capabilities, one of the most interesting ability to monitor GSM networks. In this talk, we are going to break down the Regin framework stages from a reverse engineering perspective - kernel driver infection scheme, virtual file system and its encryption scheme, kernel mode manager- while analyzing its behaviors on a GSM network and making technical comparison of its counterparts - such as TDL4, Uruborus, Duqu2. Speaker Bio: Omer works as an Ethical Hacker for KPN's (Royal Dutch Telecom) REDteam in Amsterdam, the Netherlands. He enjoys diving into lines of code to spot bugs, tinkering in front of the debugger and developing wise tactics/tools to break applications on his day to day work. Prior to joining KPN REDteam, Omer worked for companies like IBM ISS, Verizon and as an external government contractor. He holds an Honour's Engineering degree in Computer Science.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: Why Nation-State Malwares Target Telco Networks: Dissecting Technical Capabilities of Regin and Its Counterparts

DEF CON

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


Abusing Adobe Reader's JavaScript APIs

uk: Комп'ютерні науки

description: In this talk, we will provide insight into both the documented and undocumented APIs available in Adobe Reader. Several code auditing techniques will be shared to aid in vulnerability discovery, along with numerous proofs-of-concept which highlight real-world examples. We’ll detail out how to chain several unique issues to obtain execution in a privileged context. Finally, we’ll describe how to construct an exploit that achieves remote code execution without the need for memory corruption. Speaker Bios: Brian Gorenc is the manager of Vulnerability Research with Hewlett-Packard Security Research (HPSR). In this role, Gorenc leads the Zero Day Initiative (ZDI) program, which is the world’s largest vendor-agnostic bug bounty program. His focus includes analyzing and performing root-cause analysis on hundreds of zero-day vulnerabilities submitted by ZDI researchers from around the world. The ZDI works to expose and remediate weaknesses in the world’s most popular software. Brian is also responsible for organizing the ever-popular Pwn2Own hacking competitions. Prior to joining HP, Gorenc worked for Lockheed Martin on the F-35 Joint Strike Fighter (JSF) program. In this role, he led the development effort on the Information Assurance (IA) products in the JSF’s mission planning environment. Twitter: @maliciousinput Abdul-Aziz Hariri is a security researcher with Hewlett-Packard Security Research (HPSR). In this role, Hariri analyzes and performs root-cause analysis on hundreds of vulnerabilities submitted to the Zero Day Initiative (ZDI) program, which is the world's largest vendor-agnostic bug bounty program. His focus includes performing root-cause analysis, fuzzing and exploit development. Prior to joining HP, Hariri worked as an independent security researcher and threat analyst for Morgan Stanley emergency response team. During his time as an independent researcher, he was profiled by Wired magazine in their 2012 article, “Portrait of a Full-Time Bug Hunter”. Twitter: @abdhariri Jasiel Spelman is a vulnerability analyst and exploit developer for the Zero Day Initiative (ZDI) program. His primary role involves performing root cause analysis on ZDI submissions to determine exploitability, followed by developing exploits for accepted cases. Prior to being part of ZDI, Jasiel was a member of the Digital Vaccine team where he wrote exploits for ZDI submissions, and helped develop the ReputationDV service from TippingPoint. Jasiel's focus started off in the networking world but then shifted to development until transitioning to security. He has a BA in Computer Science from the University of Texas at Austin. Twitter: @wanderingglitch HP’s Zero Day Initiative, Twitter: @thezdi

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Get the latest information about how the law is racing to catch up with technological change from staffers at the Electronic Frontier Foundation, the nation’s premiere digital civil liberties group fighting for freedom and privacy in the computer age. This session will include updates on current EFF issues such as surveillance online and fighting efforts to use intellectual property claims to shut down free speech and halt innovation, discussion of our technology project to protect privacy and speech online, updates on cases and legislation affecting security research, and much more. Half the session will be given over to question-and-answer, so it's your chance to ask EFF questions about the law and technology issues that are important to you. Kurt Opsahl is the Deputy Executive Director and General Counsel of the Electronic Frontier Foundation. Nate Cardozo is a Staff Attorney on the Electronic Frontier Foundation’s digital civil liberties team. In addition to his focus on free speech and privacy litigation, Nate works on EFF's Who Has Your Back? report and Coders' Rights Project. Mark Jaycox is a Legislative Analyst for EFF. His issues include user privacy, civil liberties, surveillance law, and "cybersecurity." Peter Eckersley is Technology Projects Director for the Electronic Frontier Foundation. Nadia Kayyali is a member of EFF’s activism team. Nadia's work focuses on surveillance, national security policy, and the intersection of criminal justice, racial justice, and digital civil liberties issues. Corynne McSherry is the Legal Director at EFF, specializing in intellectual property, open access, and free speech issues. Her favorite cases involve defending online fair use, political expression, and the public domain against the assault of copyright maximalists. Twitter: @eff, @kurtopsahl

uk: вхід без авторизації

name: Panel - Ask the EFF: The Year in Digital Civil Liberties


DEF CON 23 CVE Closing Ceremonies

uk: Комп'ютерні науки

description: Contests Closing Ceremonies for DEF CON 23

uk: вхід без авторизації


uk: Комп'ютерні науки

description: DEF CON has changed for the better since the days at the Alexis Park. It has evolved from a few speaking tracks to an event that still offers the speakers, but also Villages, where you can get hands-on experience and Demo Labs where you can see tools in action. Of course, there is still the entertainment and Contest Area, as well as, Capture The Flag. There is so much more to DEF CON than there was in the past and it is our goal to help you get the best experience possible. In addition to introducing each of the different aspects and areas of DEF CON, we have a panel of speakers that will talk about how they came to be part of DEF CON and their personal experiences over the years. Speaker Bios: Mike Petruzzi has been hacking managers for over 25 years. Mike is a Senior Cyber Security Penetration Testing Specialist working at various Federal Civil Agencies for the last 15 years. Yup, that's the title he was given. Naturally, he got all his IT experience as the result of selling beer, wine and liquor. He has tricked everyone into believing that he can do anything at all. Twitter: @wiseacre_mike Nikita works full time for DEF CON doing stuff, and things. She is DEF CON’s administrator, director of the CFP review board, speaker liaison, workshop manager, and overall cat herder. Helping out over the past decade she has been involved in some capacity for over a dozen departments, activities, contests, and events. She provides annoyance, planning, and support in many ways, thus dubbed the “administrator of chaos”. If you hate the schedule, or are mad your talk was rejected, you can blame her. Nikita likes to think of herself as approachable, and loves to make people feel welcome at DEF CON, despite having R.B.F. Her hardest job yet was writing a serious third person bio. Twitter: @niki7a PushPin is an uptight, perfectionist, who is very rarely content working with idiots and enjoys his Jell-O Pudding cups. He can neither confirm nor deny working for any of the three letter agencies that oversee WMDs, high energy weapons [LASERS, YO], and play around with other countries. It is literally impossible to see him without his laptop at any given time during the day and has been told frequently to put it away in public; otherwise, you’ll find him at work devoid of any form of social life. I hate you all, seriously.. Twitter: @X72 Plug is a Mexican immigrant that immigrated to the States at age 18. While learning to read English found a 2600 magazine that lead him to his first LA2600 meeting in 1998, from that point forward he has been a computer security enthusiast. Over the years he has worked a System's Administrator with a focus in security, eventually moving full time to work in information security. Plug currently works as a Senior Security Engineer securing the network of a prominent finance and foreign exchange company. He is also working on a volunteer project to teach 5th graders basic computer security skills. In his free time he enjoys playing with synthesizers and modular systems, when possible he volunteers his time to computer security events. This is Russ’ 17th year as a DEF CON goon, and he has over 25 years experience in hacking. Russ first learned to program around the 1982 timeframe, when he received a Timex Sinclair, which used only programs keyed in via BASIC. He’s been involved in a numbers of aspects of DEF CON over the years, including the vendors, contests, DEF CON Groups, security, Hardware Hacking Village, and planning. Russ currently works a the Chief of Operations, where he depends heavily upon the other experienced hackers and goons that help run the world’s largest hacker conference.

uk: вхід без авторизації

name: DEF CON 101 - Panel II: Electric Boogaloo ('cause it never gets old)


DEF CON Comedy Inception

uk: Комп'ютерні науки

description: This year at DEF CON a former FAIL PANEL panelist attempts to keep the spirit alive by playing moderator. Less poetry, more roasting. A new cast of characters, more lulz, and no rules. Nothing is sacred, not the industry, not the audience, not even each other. Our cast of characters will bring you all sorts of technical fail, ROFLCOPTER to back it up. No waffles, but we have other tricks up our sleeve to punish, er, um, show love to our audience, all while raising money of the EFF and HFC. The FAIL PANEL may be dead, but the “giving” goes on. Speaker Bios: Larry Pesce is a Senior Security Analyst with InGuardians. His recent experience includes providing penetration assessment, architecture review, hardware security assessment, wireless/radio analysis, and policy and procedure development for a wide range of industries including those in the financial, retail, and healthcare verticals. Larry is an accomplished speaker, having presented numerous times at industry conferences as well as the co-host of the long running multi-award winning Security Podcast, Paul's Security Weekly. and is a certified instructor with the SANS Institute. Larry is a graduate of Roger Williams University. In his spare time he likes to tinker with all things electronic and wireless. Larry is an amateur radio operator holding his Extra class license and is regularly involved in emergency communications activities. In 1972 a crack commando unit was sent to prison by a military court for a crime they didn't commit. These men promptly escaped from a maximum security stockade.... making the decision to leave Amanda behind. Ms. Berlin is now rumored to have illegitimate children by Saudi Oil barons hidden all over the world in at least 27 countries but this can neither be confirmed nor denied. Amanda Berlin is a Network Security Engineer at Hurricane Labs. She is most well known for being a breaker of hearts, knees, and SJW's. Bringing "Jack of All Trades" back to being sexy, she has worked her fingers to the bone securing ISPs, Healthcare facilities, Artificial Insemination factories, and brothels. Amanda managed the internal phishing campaign at a medium size healthcare facility to promote user education about phishing and hacking through an awards based reporting program. She is a lead organizer for CircleCityCon, volunteers at many other conferences, and enjoys writing and teaching others. Twitter: @InfoSystir Chris Blow is a Senior Technical Advisor with Rook Security. His most recent experience includes: penetration testing, social engineering, red team exercises, policy and procedure guidance focused on HIPAA and PCI DSS, developing security awareness programs, performing HIPAA assessments and serving as a Qualified Security Assessor for the Payment Card Industry. @b10w In reality, his primary duties are to be told by various clients that “security is hard” and to just “accept the risk.” He’s also well-versed in being told to keep vulnerable assets and people “out of scope.” Chris is a graduate of Purdue University in West Lafayette, IN. Besides trying to keep up with all-things-InfoSec, Chris enjoys playing guitar, singing, and DJing. Twitter: @b10w illwill is a rogue blackhat as fuck subcontractor for top secret global governments. He spends his off time enjoying bubble baths, recovering from a debilitating injury as infosystir's former bean fluffer and hand carves realistic thrones made from discarded dildos found dumpster diving behind a porn store in Los Angeles. Dan Tentler likes to break things. He's also an expert on failure. Ask him about it. But ask with scotch. Twitter: @viss @chrissistrunk

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Let's Encrypt is a new certificate authority that is being launched by EFF in collaboration with Mozilla, Cisco, Akamai, IdenTrust, and a team at the University of Michigan. It will issue certificates for free, using a new automated protocol called ACME for verification of domain control and issuance. This talk will describe the features of the CA and available clients at launch; explore the security challenges inherent in building such a system; and its effect on the security of the CA marketplace as a whole. We will also update our place on the roadmap to a Web that uses HTTPS by default. Speaker Bios: Peter Eckersley is Chief Computer Scientist for the Electronic Frontier Foundation. He leads a team of technologists who watch for technologies that, by accident or design, pose a risk to computer users' freedoms—and then look for ways to fix them. They write code to make the Internet more secure, more open, and safer against surveillance and censorship. They explain gadgets to lawyers and policymakers, and law and policy to gadgets. Aside from Let's Encrypt, Peter's other work at EFF has included privacy and security projects such as Panopticlick, HTTPS Everywhere, SSDI, and the SSL Observatory; helping to launch a movement for open wireless networks; fighting to keep modern computing platforms open; and running the first controlled tests to confirm that Comcast was using forged reset packets to interfere with P2P protocols. Peter holds a PhD in computer science and law from the University of Melbourne. James Kasten is a PhD candidate in Computer Science and Engineering at the University of Michgan and a STIET fellow. James is also a contractor at the Electronic Frontier Foundation. His research focuses on practical network security and PKI. James has published on the state of TLS, its certificate ecosystem and its vulnerabilities. Most notably, James has helped design the protocol and launch the technology behind Let's Encrypt. Yan is a security engineer at Yahoo, mostly working on End-to-End email encryption and improving TLS usage. She is also a Technology Fellow at EFF and a core developer of Let's Encrypt, HTTPS Everywhere, Privacy Badger Firefox, and SecureDrop. Yan has held a variety of jobs in the past, ranging from hacking web apps to composing modern orchestra music. She got a B.S. from MIT in 2012 and is a proud PhD dropout from Stanford. Yan has been a speaker at HOPE, DEFCON 22, jQuerySF, Real World Crypto, SXSW, and various other human gatherings. She is @bcrypt on Twitter.

uk: вхід без авторизації

name: Lets Encrypt Minting Free Certificates to Encrypt the Entire Web


uk: Комп'ютерні науки

description: Security research is under attack. Updates to the Wassenaar Arrangement in 2013 established among its 41 member nations an agreement to place a variety of previously undesignated “cybersecurity items” under export control. After 18 months and a half-dozen open advisory meetings, the U.S. has taken the entire security research community by surprise with its proposed rule; we are confronted by a sweeping implementation with profound consequences for academia, independent research, commercial cybersecurity, human rights, and national security. While the outcome of this round of regulatory intervention is still uncertain, the fact that there will be more is not. This panel of experts will discuss the context, history, and general process of regulation, as well the related question of “weaponized” research in regulatory discourse. There is significant daylight between the relatively lax text of the Wassenaar Arrangement itself and the extraordinarily broad implementation proposed in the U.S. What will the practical effects of those differences be, and why did the U.S. diverge from the Wassenaar text? Regulators are, even now, still struggling to comprehend what the consequences of this new “cyber rule” might be. So, how are we to understand this regulatory process? What are its objectives? Its impacts? Its limits? How can we influence its outcomes? Eleventh-hour interventions are quickly becoming a hallmark of regulatory activities with implications for the wider world of information security; the fight here is almost exclusively a rearguard action. Without resorting to the usual polemics, what failures of analysis and advice are contributing to these missteps – on both sides? What interests might encourage them? How are security researchers being caught so off-balance? Come victory or despair in the present case, this panel aims to answer the question of whether there is a solution that prevents technology transfer to hostile nations while still enabling free markets, freedom of expression, and freedom of research. Speaker Bios: Dave Aitel (@daveaitel) is an offensive security expert whose company, Immunity, Inc., consults for major financial institutions, Fortune/Global 500s, etc. Matt Blaze (@mattblaze) is a professor in the computer science department at the University of Pennsylvania. Twitter: @mattblaze Nate Cardozo (@ncardozo) is a Staff Attorney with the Electronic Frontier Foundation. He focuses on the intersection of technology, privacy, and free expression. Jim Denaro (@CipherLaw; moderator) is the founder of CipherLaw, a Washington, D.C.-based intellectual property law firm and focuses his practice on legal and technical issues faced by innovators in information security. Mara Tam (@marasawr) is a semi-feral researcher and historian of policy, justice, culture, and security. Catherine “Randy” Wheeler has served as the Director of the Information Technology Controls Division in the Bureau of Industry and Security’s (BIS) Office of National Security and Technology Transfer Controls since June 2006.

uk: вхід без авторизації

name: Licensed to Pwn: Weaponization and Regulation of Security Research


uk: Комп'ютерні науки

description: This talk will introduce you to Industrial Ethernet Switches and their vulnerabilities. These are switches used in industrial environments, like substations, factories, refineries, ports, or other homes of industrial automation. In other words: DCS, PCS, ICS & SCADA switches. The researchers focus on attacking the management plane of these switches, because we all know that industrial system protocols lack authentication or cryptographic integrity. Thus, compromising any switch allows the creation of malicious firmwares for further MITM manipulation of a live process. Such MITM manipulation can lead to the plant or process shutting down (think: nuclear reactor SCRAM) or getting into a unknown and hazardous state (think: damaging a blast furnace at a steel mill) Not only will vulnerabilities be disclosed for the first time, but the methods of finding those vulnerabilities will be shared. All vulnerabilities disclosed will be in the default configuration state of the devices. While these vulnerabilities have been responsibly disclosed to the vendors, SCADA/ICS patching in live environments tends to take 1-3 years. Because of this patching lag, the researchers will also be providing live mitigations that owner/operators can use immediately to protect themselves. At least four vendors switches will be examined: Siemens, GE, Garrettcom and Opengear. Colin Cassidy is a security consultant for IOActive where he focuses on Industrial Control Systems. He has a strong development and software engineering background. He is also a seasoned leader in the areas of security and software engineering. Before joining IOActive, Cassidy served for a number of years as Technical Manager and Security Technical Lead for IGE Energy Services, Ltd, part of GE Energy. He has hands-on experience with PowerOn Fusion, a leading Outage Management System/Distribution Management System (OMS/DMS) solution for electricity distribution management. He also led a team of developers in producing new functionality within the core product and worked with customers to understand their requirements. Colin Cassidy has a BSc (Hons) in Computing Science from the University of Glasgow. Twitter: @parttimesecguy Éireann Leverett hates writing bios in the third person. He once placed second in an Eireann Leverett impersonation contest. He likes teaching the basics, and learning the obscure. He is sometimes jealous of his own moustache for being more famous than he is. If he could sum up his life in one sentence; he wouldn't. That would be a life-sentence! He is primarily known for smashing the myth of the air-gap in industrial systems with his master's thesis, finding authentication bypasses for industrial ethernet switches, and working with incident response teams to improve their understanding of industrial control systems security. He believes security takes an awful lot more than penetration-testing and speaks often about the wider effects of embedded system insecurity. Twitter: @blackswanburst Robert M. Lee is a co-founder of Dragos Security LLC where he has a passion for control system protocol analysis, digital forensics, and threat intelligence research. He is also an active-duty U.S. Air Force Cyber Warfare Operations Officer where he has been a member of multiple computer network defense teams including his establishing and leading of a first-of-its-kind ICS/SCADA threat intelligence and intrusion analysis mission. Robert received his BS from the United States Air Force Academy and his MS in Cybersecurity Digital Forensics from Utica College. He is a passionate educator and teaches in the ICS and Forensics programs at SANS and is an Adjunct Lecturer at Utica College where he teaches in their MS Cybersecurity program. Robert is also the author of 'SCADA and Me' and is currently pursuing his PhD at Kings College London with research in control system cyber security. He routinely publishes academic and industry focused works in a wide variety of journals and publications; additionally he has presented at conferences around the world. Twitter: @RobertMLee

uk: вхід без авторизації

name: Switches Get Stitches: Episode 3: Then they were three of them.


uk: Комп'ютерні науки

description: The number of vulnerabilities in firmware disclosed as affecting Wintel PC vendors has been rising over the past few years. Although several attacks have been presented against Mac firmware, unlike their PC counterparts, all of them required physical presence to perform. Interestingly, when contacted with the details of previously disclosed PC firmware attacks, Apple systematically declared themselves not vulnerable. This talk will provide conclusive evidence that Mac's are in fact vulnerable to many of the software only firmware attacks that also affect PC systems. In addition, to emphasize the consequences of successful exploitation of these attack vectors, we will demonstrate the power of the dark side by showing what Mac firmware malware is capable of. Speaker Bios: Trammel Hudson enjoys taking things apart and understanding how they work. He presented the Thunderstrike firmware vulnerability at 31C3, created the Magic Lantern firmware for Canon cameras, and teaches classes at the Brooklyn hackerspace NYC Resistor. Twitter: @qrs Web: https://trmm.net/ Xeno Kovah's speciality area is stealth malware and its ability to hide from security software and force security software to lie. To combat such attacks he researches trusted computing systems that can provide much stronger security guarantees than normal COTS. He co-founded LegbaCore in 2014 to help improve security at the foundation of computing systems. He is also the founder and lead contributor to OpenSecurityTraining.info. He has posted 9 full days of class material material on x86 assembly, architecture, binary formats, and Windows rootkits to OpenSecurityTraining.info. Twitter: @XenoKovah Twitter: @legbacore Corey Kallenberg is a co-founder of LegbaCore, a consultancy focused on evaluating and improving host security at the lowest levels. His specialty areas are trusted computing, vulnerability research and low level development. In particular, Corey has spent several years using his vulnerability research expertise to evaluate limitations in current trusted computing implementations. In addition, he has used his development experience to create and improve upon trusted computing applications. Among these are a timing based attestation agent designed to improve firmware integrity reporting, and an open source Trusted Platform Module driver for Windows. Corey is also an experienced trainer, having created and delivered several technical courses. He is an internationally recognized speaker who has presented at BlackHat USA, DEF CON, CanSecWest, Hack in the Box, NoSuchCon, SyScan, EkoParty and Ruxcon. Twitter: @CoreyKal Twitter: @legbacore

uk: вхід без авторизації

name: ThunderStrike 2: Sith Strike: A MacBook firmware worm


uk: Комп'ютерні науки

description: Windows Management Instrumentation (WMI) is a remote management framework that enables the collection of host information, execution of code, and provides an eventing system that can respond to operating system events in real time. FireEye has recently seen a surge in attacker use of WMI to carry out objectives such as system reconnaissance, remote code execution, persistence, lateral movement, covert data storage, and VM detection. Defenders and forensic analysts have largely remained unaware of the value of WMI due to its relative obscurity and completely undocumented file format. After extensive reverse engineering, our team has documented the WMI repository file format in detail, developed libraries to parse it, and formed a methodology for finding evil in the repository. In this talk, we will take a deep dive into the architecture of WMI, reveal a case study in attacker use of WMI in the wild, describe WMI attack mitigation strategies, show how to mine its repository for forensic artifacts, and demonstrate how to detect attacker activity in real-time by tapping into the WMI eventing system. By the end of this talk, we will have convinced the audience that WMI is a valuable asset not just for system administrators and attackers, but equally so for defenders and forensic analysts. Speaker Bios: Matt Graeber is a reverse engineer in the FireEye Labs Advanced Reverse Engineering (FLARE) team with a varied background in reverse engineering, red teaming, and offensive tool development. Since joining FireEye, Matt has reversed a vast quantity of targeted and commodity malware samples and served as an instructor of Mandiant's Advanced Malware Analysis course. Matt is the author of various PowerShell modules used for pentesting and reverse engineering including PowerSploit and PowerShellArsenal. He has also been designated a Microsoft "Most Valuable Professional" in PowerShell. Twitter: @mattifestation Willi Ballenthin is a reverse engineer in the FLARE team who specializes in incident response and computer forensics. He can typically be found investigating intrusions at Fortune 500 companies and enjoys reverse engineering malware, developing forensic techniques, and exploring the cutting edge. Willi is the author of a number of cross-platform Python libraries including python-registry, python-evtx, and INDXParse.py. Twitter: @williballenthin Claudiu Teodorescu is a reverse engineer in the FLARE team. Prior to joining FireEye, Claudiu worked for Guidance Software, writing forensic parsers for different file formats to support the EnCase forensic tool. Also, as the Cryptographic Officer of the company, he supported EnCase integration with different disk/volume/file based encryption products including Bitlocker, McAfee EEPC, Checkpoint FDE, Symantec EEPC, etc.

uk: вхід без авторизації

name: WhyMI so Sexy? WMI Attacks, Real-Time Defense, and Advanced Forensics Analysis


`DLL Hijacking´ on OS X? #@%& Yeah!

uk: Комп'ютерні науки

description: Remember DLL hijacking on Windows? Well, turns out that OS X is fundamentally vulnerable to a similar attack (independent of the user's environment). By abusing various 'features' and undocumented aspects of OS X's dynamic loader, this talk will reveal how attackers need only to plant specially-crafted dynamic libraries to have their malicious code automatically loaded into vulnerable applications. Through this attack, adversaries can perform a wide range of malicious actions, including stealthy persistence, process injection, security software circumvention, and even 'remote' infection. So come watch as applications fall, Gatekeeper crumbles (allowing downloaded unsigned code to execute), and 'hijacker malware' arises - capable of bypassing all top security and anti-virus products! And since "sharing is caring" leave with code and tools that can automatically uncover vulnerable binaries, generate compatible hijacker libraries, or detect if you've been hijacked. Speaker Bio: Patrick Wardle is the Director of Research at Synack, where he leads cyber R&D efforts. Having worked at NASA, the NSA, and Vulnerability Research Labs (VRL), he is intimately familiar with aliens, spies, and talking nerdy. Currently, Patrick’s focus is on automated vulnerability discovery, and the emerging threats of OS X and mobile malware. In his personal time, Patrick collects OS X malware and writes OS X security tools. Both can be found on his website Objective-See.com

uk: вхід без авторизації


uk: Комп'ютерні науки

description: You may ask; "why would Apple add an XPC service that can create setuid files anywhere on the system - and then blindly allow any local user to leverage this service?" Honestly, I have no idea! The undocumented 'writeconfig' XPC service was recently uncovered by Emil Kvarnhammar, who determined its lax controls could be abused to escalate one's privileges to root. Dubbed ‘rootpipe,' this bug was patched in OS X 10.10.3. End of story, right? Nope, instead things then got quite interesting. First, Apple decided to leave older versions of OS X un-patched. Then, an astute researcher discovered that the OSX/XSLCmd malware which pre-dated the disclosure, exploited this same vulnerability as a 0day! Finally, yours truly, found a simple way to side-step Apple's patch to re-exploit the core vulnerability on a fully-patched system. So come attend (but maybe leave your MacBooks at home), as we dive into the technical details XPC and the rootpipe vulnerability, explore how malware exploited this flaw, and then fully detail the process of completely bypassing Apple's patch. The talk will conclude by examining Apple’s response, a second patch, that appears to squash ‘rootpipe’…for now. Speaker Bio: Patrick Wardle is the Director of Research at Synack, where he leads cyber R&D efforts. Having worked at NASA, the NSA, and Vulnerability Research Labs (VRL), he is intimately familiar with aliens, spies, and talking nerdy. Currently, Patrick’s focus is on automated vulnerability discovery, and the emerging threats of OS X and mobile malware. In his personal time, Patrick collects OS X malware and writes OS X security tools. Both can be found on his website Objective-See.com

uk: вхід без авторизації

name: Stick That In Your (root) Pipe & Smoke It


uk: Комп'ютерні науки

description: Insteon is a leading home automation solution for controlling lights, locks, alarms, and much more. More than forty percent of homes with automation installed use Insteon. For the last fifteen years, Insteon has published detailed documentation of their protocols—documentation that is purposely misleading, filled with errors, and at times deliberately obfuscated. As my research over the last year has revealed, this sad state of affairs is the direct result of Insteon papering over the fact that it is trivial to wirelessly take control, reprogram, and monitoring any Insteon installation. Worse still, the embedded nature of the Insteon protocol coupled with devices that do not support flash updates means that there are no current fixes or workarounds short of ripping out the Insteon products. I will be presenting my research, and releasing tools demonstrating the vulnerabilities throughout the Insteon home automation system. Speaker Bios: Peter Shipley has been working with security for over 30 years. In the late 80's he wrote one of the first network security scanners and maintained one of the first bug databases ( later used to seed similar lists at CERT and llnl.gov ). Around the same time Peter co-founded UC Berkeley's OCF (Open Computing Facility). In the mid 90's Peter Shipley became a founding member of cypherpunks & setup up one of the first official PGP distribution sites. In '98 (DEF CON 6) Peter Shipley did a independent security research on war-dialing, exposing a significant security problem that was being ignored in most corporate environments making phone security. At DEF CON 9 Peter Shipley introduced wardriving to the world. Recently Peter has written and released several APIs using python to link various networked automation appliances via REST and other interfaces. Peter Shipley currently manages for a dot-com by day, and helps raise two kids by night. Ryan Gooler (@jippen) is a cloud security guy, known for luck, sarcasm, and getting into things. Avid lockpicker, lover of cats, and disrespector of authority.

uk: вхід без авторизації

name: Insteon' False Security and Deceptive Documentation


uk: Комп'ютерні науки

description: With the advent of the Internet of Things，more and more objects are connected via various communication protocols like Bluetooth，Z-wave，WiFi , ZigBee etc. Among those protocols ZigBee accounts for the largest market share，it has been adapted to various applications like WSN（Wireless Sensor Network），Smart Home . Over the last few years, large amount of research has been conducted on the security of ZigBee. In this presentation we will introduce a new technique to beat the security of ZigBee, we found the “signature” of the location of the security key . We will go through a specific example and share the thinking process along the way. The techniques used throughout this example can be generalized and used by other hardware reverse engineers. Speaker Bio: Li Jun is currently a hardware security intern in Unicorn Team of Qihoo 360 ,China. He is also a second year graduate student at Chengdu University of Information Technology. He received his bachelor’s degree from University of Electronic Science and Technology of China in 2013.During his college life, he switched between different majors, 2 years in Automobile Electronics,2 years in Electronic and Electric Engineering. He is interested in the security of the Internet of Things and the security of automobile electronics.

uk: вхід без авторизації

name: I'm A Newbie Yet I Can Hack ZigBee: Take Unauthorized Control Over ZigBee Devices


uk: Комп'ютерні науки

description: The Harness toolset aims to give penetration testers and red teams the ability to pull a remote powershell interface with all the same features of the native Powershell CLI and more. Several tools and utilities have been released to solve the powershell weaponization problem, but no freely available tool give operators the full capabilities of powershell through a remote interface. We’ll start the talk with a quick survey of the previous methods of weaponizing powershell, and then move into the capabilities of the Harness toolset which includes a fully interactive powershell CLI, and remote importing of modules across the wire without staging. We’ll conclude with taking a look at the underlying code that makes the toolset work, and briefly discuss planned features. The Harness toolset will be released open source in conjunction with this talk. Speaker Bio: Rich Kelley (@RGKelley5) is a security researcher and the co-founder of Gray Tier Technologies, a small InfoSec start-up based out of Alexandria, VA. After his time in the military he held positions as a network engineer, software engineer, and penetration tester for various government agencies. He recently moved into exploit development and reverse engineering, and is pretty sure he knows less than when he started. Twitter: @RGKelley5

uk: вхід без авторизації

name: Harness: PowerShell Weaponization Made Easy (or at least easier)


biotech and humanity 2.0

uk: Комп'ютерні науки

description: This presentation is beyond fiction. Current research in neuroscience and the extension and augmentation of senses is proceeding in directions that might sound to a twentieth century mind like science fiction. Progress is rapid but unevenly distributed: Some is directed by military, intelligence and corporate interests but beyond their concerns, we can discern the future shape of human identity itself in nascent forms. The human body/brain is being hacked to explore radical applications for helping, healing, and harming this and future generations. Some can be done in garage-hacking style. The presenter, in fact, recently had lenses in both eyes removed and replaced with artificial ones engineered for the vision he wanted, a now-trivial surgery. The reach of new technologies promises an even more radical transformation in what it means to be human. One area of research is the recovery of memories, the deletion of emotional charges from memories, the removal of specific memories, the alteration of the content of memories, and the implantation of new memories. Another seeks to read the mind at a distance and extract information. Another explores the use of genomes to understand and replicate thinking, feeling, and behavior patterns. Another implements mind-to-mind communication, using neuroscience to understand brains best suited for remote viewing as well as implants and non-invasive technologies that control the electromagnetic energies of the brain to enable psychokinesis, clairvoyance and telepathy. Augmentation of human abilities is being achieved by splicing information from sensors integrated with existing neurological channels. To feel the magnetic field of the earth, see the infrared and ultraviolet parts of the electromagnetic spectrum, discern the yaw and pitch of airplanes, see and hear by going around our eyes and ears -- all this means we will experience the “self” in new ways. Thieme concludes with quotes from remote viewer Joe McMoneagle, astronaut Edgar Mitchell, and his new novel FOAM to suggest the shape of the mind of the future. If you're 20 years old, you have at least a century of productive life ahead of you, so you had better be on board with the shape of your future selves. :-) Speaker Bio: Richard Thieme is an author and professional speaker focused on the challenges posed by new technologies and the future, how to redesign ourselves to meet these challenges, and creativity in response to radical change and identify shift. He has explored issues raised in this DEF CON 23 presentation for 20 years but raises his game to outline the shape of the future self, defining it as a system open to modification and hacking, giving the term “biohacking” new and compelling meaning. His column, "Islands in the Clickstream," was distributed to subscribers in sixty countries before collection as a book in 2004. When a friend at the NSA said after they worked together on intelligence issues, "The only way you can tell the truth is through fiction," he returned to writing short stories, 19 of which are collected in “Mind Games.” He is co-author of the critically extolled “UFOs and Government: A Historical Inquiry,” a 5-year research project using material exclusively from government documents and other primary sources, now in 50 university libraries. A recently completed novel FOAM explores the existential challenges of what it means to be human in the 21st century. “The UFO History Group” is exploring a second volume and Thieme is selecting “the best of” his diverse writings for “A Richard Thieme Reader” and writing more fiction. Thieme's work has been taught at universities in Europe, Australia, Canada, and the United States, and he has guest lectured at numerous universities, including Purdue University (CERIAS), the Technology, Literacy and Culture Distinguished Speakers Series of the University of Texas, and the “Design Matters” lecture series at the University of Calgary. He keynoted a conference on metadata this spring for the U of Texas-San Antonio. He addressed the reinvention of “Europe” as a “cognitive artifact” for curators and artists at Museum Sztuki in Lodz, Poland and keynoted “The Real Truth: A World’s Fair” at Raven Row Gallery, London. He has spoken for the National Security Agency, the FBI, the Secret Service, the US Department of the Treasury, Los Alamos National Labs and has keynoted “hacker” and security conferences around the world. Twitter and skype: neuralcowboy:

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Whether we want it to be or not, the Internet of Things is upon us. Network interfaces are the racing stripes of today's consumer device market. And if you put a network interface on a device, you have to make it do something right? That's where a Simple Object Access Protocol (SOAP) service comes in. SOAP services are designed with ease-of-access in mind, many times at the expense of security. Ludicrous amounts of control over device functionality, just about every category of vulnerability you can think of, and an all-around lack of good security practice about sums it up. In this talk, I will discuss this growing attack surface, demonstrate different methods for attacking/fuzzing it, and provide plenty of examples of the many dangers of insecure SOAP/ UPnP interfaces on embedded and "smart" devices along the way. Speaker Bio: Ricky "HeadlessZeke" Lawshae is a Security Researcher for DVLabs at HP TippingPoint with a medium-sized number of years' experience in professionally voiding warranties. He has spoken at the DEF CON, Recon, Insomni'hack, and Ruxcon security conferences, and is an active participant in the extensive Austin, TX hacker community. In his meager spare time, he enjoys picking locks, reading comic books, and drinking expensive beers. Twitter: @HeadlessZeke

uk: вхід без авторизації

name: Let's talk about SOAP, baby. Let's talk about UPnP.


uk: Комп'ютерні науки

description: The security of SSL/TLS is built on a rickety scaffolding of trust. At the core of this system is an ever growing number of Certificate Authorities that most people (and software) take for granted. Recent attacks have exploited this inherent trust to covertly intercept, monitor and manipulate supposedly secure communications. These types of attack endanger everyone, especially when they remain undetected. Unfortunately, there are few tools that non-technical humans can use to verify that their HTTPS traffic is actually secure. We will present our research into the technical and political problems underlying SSL/TLS. We will also demonstrate a tool, currently called “Canary”, that will allow all types users to validate the digital certificates presented by services on the Internet. Speaker Bios: Evilrob is a Security Engineer and Penetration Tester with over 14 years of experience with large network architecture and engineering. His current focus is on network security architecture, tool development, and high-assurance encryption devices. He currently spends his days contemplating new and exciting ways to do terrible things to all manner of healthcare related systems in the name of safety. Twitter: @knomes xaphan is a "Senior Cyber Security Penetration Testing Specialist" for a happy, non-threatening US government agency. He has been a penetration tester for 17 years, but maintains his sanity with a variety of distractions. He is the author of several ancient and obsolete security tools and the creator of DEFCOIN. Twitter: @slugbait

uk: вхід без авторизації

name: TLS Canary: Keeping your dick pics safe(r)


uk: Комп'ютерні науки

description: My neighbor’s kid is constantly flying his quad copter outside my windows. I see the copter has a camera and I know the little sexed crazed monster has been snooping around the neighborhood. With all of the hype around geo-fencing and drones, this got me to wondering: Would it be possible to force a commercial quad copter to land by sending a low-level pulse directly to it along the frequencies used by GPS? Of course, radio signal jamming is illegal in the U.S and, frankly, it would disrupt my electronics, too. In this presentation, we’ll look at some of the research and issues we encountered, when we attempted to force land two commercial drones (the new DJI Phantom 3 and the Parrot Bepop Drone) by sending GPS signals directly at the drones (while staying under the threshold for jamming and not disrupting anyone else). Speaker Bio: Michael Robinson has over 15 years of computer security experience and is currently a computer and mobile device forensic examiner in the Washington, DC area, where he deals with intrusion analysis, incident response, and criminal cases. For over four years he ran IT and IA operations for a Department of Defense agency. He has conducted research on security of mobile devices and is starting to play around in the drone space. He teaches computer forensics at the graduate level at Stevenson University in Maryland.

uk: вхід без авторизації

name: Knocking my neighbor's kid's cruddy drone offline.


Hacking a Linux-Powered Rifle

uk: Комп'ютерні науки

description: TrackingPoint is an Austin startup known for making precision-guided firearms. These firearms ship with a tightly integrated system coupling a rifle, an ARM-powered scope running a modified version of Linux, and a linked trigger mechanism. The scope can follow targets, calculate ballistics and drastically increase its user's first shot accuracy. The scope can also record video and audio, as well as stream video to other devices using its own wireless network and mobile applications. In this talk, we will demonstrate how the TrackingPoint long range tactical rifle works. We will discuss how we reverse engineered the scope, the firmware, and three of TrackingPoint's mobile applications. We will discuss different use cases and attack surfaces. We will also discuss the security and privacy implications of network-connected firearms. Speaker Bios: Runa A. Sandvik is a privacy and security researcher, working at the intersection of technology, law and policy. She is a technical advisor to both the Freedom of the Press Foundation and the TrueCrypt Audit Project, and a member of the review board for Black Hat Europe. Twitter: @runasand Michael Auger is an experienced IT Security specialist with extensive experience in integrating and leveraging IT security tools. He has leveraged a wide range of IT security solutions, integrating them, to deliver leading edge incident response and security operations capabilities.

uk: вхід без авторизації


Cracking CryptoCurrency Brainwallets

uk: Комп'ютерні науки

description: Imagine a bank that, by design, made everyone's password hashes and balances public. No two-factor authentication, no backsies on transfers. Welcome to "brainwallets", a way for truly paranoid cryptocurrency users to wager their fortunes on their ability to choose a good password or passphrase. Over the last decade, we've seen the same story play out dozens of times - a website is broken into, the user database is posted online, and most of the password hashes are cracked. Computers are now able make millions, billions or even trillions of guesses per second. Every eight character password you can type on a standard keyboard and every combination of five common english words could be tried in less than a day by today's botnets. Can people come up with passphrases able to stand up to that when money is on the line? Let's find out. For this talk, I will be releasing my high speed brainwallet cracker, "Brainflayer". I'll cover a history of brainwallets, safer passphrase-based wallet generation, passphrase security, in-the-wild cracking activity, and how I accidently stole 250 Bitcoins (and tracked down the owner to give them back). Ryan Castellucci has been interested in cryptography since childhood when his parents gave him a copy of "Codes, Ciphers and Secret Writing". He soon learned to program and wrote a tool to crack simple substitution ciphers. More recently, he co-spoke with Dan Kaminsky at DEF CON 22 and was a finalist in the 2014 Underhanded Crypto Contest. For his day job at White Ops, he finds new and exciting ways to tease out the subtle differences between bots and human-controlled web browsers.

uk: вхід без авторизації


Separating Bots from the Humans

uk: Комп'ютерні науки

description: There’s an escalating arms race between bots and the people who protect sites from them. Bots, or web scrapers, can be used to gather valuable data, probe large collections of sites for vulnerabilities, exploit found weaknesses, and are often unfazed by traditional solutions like robots.txt files, Ajax loading, and even CAPTCHAs. I’ll give an overview of both sides of the battle and explain what what really separates the bots from the humans. I’ll also demonstrate and easy new tool that can be used to crack CAPTCHAs with high rates of success, some creative approaches to honeypots, and demonstrate how to scrape many “bot-proof” sites. Speaker Bio: Ryan Mitchell is Software Engineer at LinkeDrive in Boston, where she develops their API and data analysis tools. She is a graduate of Olin College of Engineering, and is a masters degree student at Harvard University School of Extension Studies. Prior to joining LinkeDrive, she was a Software Engineer building web scrapers and bots at Abine Inc, and regularly does freelance work, building web scrapers for clients, primarily in the financial and retail industries. Ryan is also the author of two books: “Instant Web Scraping with Java” (Packt Publishing, 2013) and “Web Scraping with Python” (O’Reilly Media, 2015) Twitter: @Kludgist Amazon Author Page: http://www.amazon.com/Ryan-Mitchell/e/B00MQI8TVQ Website: http://ryanemitchell.com

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Many hackers today are using process memory infections to maintain stealth residence inside of a compromised system. The current state of forensics tools in Linux, lack the sophistication used by the infection methods found in real world hacks. ECFS (Extended core file snapshot) technology, https://github.com/elfmaster/ecfs is an innovative extension to regular ELF core files, designed to be used as forensics-friendly snapshots of process memory. A brief showcasing of the ECFS technology was featured in POC||GTFO 0x7 (Innovations with core files). However this talk will reveal deeper insight on the many features of this technology, such as full symbol table reconstruction, builtin detection heuristics, and how common binutils such as objdump, and readelf can be used to quickly identify complex infections such as PLT/GOT hooks and shared library injection. We will also cover the libecfs API that was created specifically for malware and forensics analysts who aim to implement support for ECFS snapshots into new or existing malware detection software. While the ECFS core format was initially designed for runtime malware and forensics purposes, another very neat aspect to this technology was quickly extrapolated on; the ECFS snapshots can also be reloaded into memory and executed. Very similar to VM snapshots, which opens many more doors for research and exploration in a vast array of areas from dynamic analysis to migrating live processes across systems. ECFS is still a work in progress, but for those who understand the arduous nature of dissecting a process and identifying anomalies, will surely acquire a quick respect for the new technology that makes all of this so much easier. Speaker Bio: Ryan 'elfmaster' O'Neill is a computer security researcher at Leviathan Security and the maintainer of Bitlackeys.org, a hub for much of his independent research. He is a Reverse engineer, and a Software engineer, who also specializes in the ELF binary format, and delivers on going workshops in this area to interested parties, including the US government. Ryan has worked on many security technologies including but not limited to: Maya's Veil : anti-tamper / anti-exploitation protection for Linux ELF binaries VMA Vudu : automated forensics analysis of process runtime infections in Linux kernelDetective : Linux kernel forensics software Ryan has produced alot of research and publications in areas pertaining to Linux kernel and userland malware, such as "Linux kprobe instrumentation from phrack 66", and is author of soon to be released book "The art of Linux binary analysis" which focuses on everything from ELF internals to Linux Viruses, and Binary protection techniques. Ryan has been involved in the computer security scene since 1999.

uk: вхід без авторизації

name: Advances in Linux process forensics Using ECFS


uk: Комп'ютерні науки

description: Gary Numan said it best. Cars. They’re everywhere. You can hardly drive down a busy freeway without seeing one. But what about their security? In this talk I’ll reveal new research and real attacks in the area of wirelessly controlled gates, garages, and cars. Many cars are now controlled from mobile devices over GSM, while even more can be unlocked and ignitions started from wireless keyfobs over RF. All of these are subject to attack with low-cost tools (such as RTL-SDR, GNU Radio, HackRF, Arduino, and even a Mattel toy). We will investigate how these features work, and of course, how they can be exploited. I will be releasing new tools and vulnerabilities in this area, such as key-space reduction attacks on fixed-codes, advanced "code grabbers" using RF attacks on encrypted and rolling codes, and how to protect yourself against such issues. By the end of this talk you’ll understand not only how vehicles and the wirelessly-controlled physical access protecting them can be exploited, but also learn about various tools for car and RF research, as well as how to use and build your own inexpensive devices for such investigation. Ladies and gentlemen, start your engines. And other people’s engines. Samy Kamkar is a security researcher, best known for creating The MySpace Worm, one of the fastest spreading viruses of all time. He (attempts to) illustrate terrifying vulnerabilities with playfulness, and his exploits have been branded: “Controversial”, -The Wall Street Journal “Horrific”, -The New York Times “Now I want to fill my USB ports up with cement”, -Gizmodo He’s demonstrated usurping typical hardware for surreptitious means such as with KeySweeper, turning a standard USB wall charger into a covert, wireless keyboard sniffer, and SkyJack, a custom drone which takes over any other nearby drones allowing them to be controlled as a massive zombie swarm. He’s exposed issues around privacy, such as by developing the Evercookie which appeared in a top-secret NSA document revealed by Edward Snowden, exemplifying techniques used by governments and corporations for clandestine web tracking, and has discovered and released research around the illicit GPS and location tracking performed by Apple, Google and Microsoft mobile devices. He continues to produce new research and tools for the public as open source and open hardware. Twitter: @samykamkar

uk: вхід без авторизації

name: Drive it like you Hacked it: New Attacks and Tools to Wireles


Ubiquity Forensics: Your iCloud and You

uk: Комп'ютерні науки

description: Ubiquity or "Everything, Everywhere” - Apple uses this term describe iCloud related items and its availability across all devices. iCloud enables us to have our data synced with every Mac, iPhone, iPad, PC as well as accessible with your handy web browser. You can access your email, documents, contacts, browsing history, notes, keychains, photos, and more all with just a click of the mouse or a tap of the finger - on any device, all synced within seconds. Much of this data gets cached on your devices, this presentation will explore the forensic artifacts related to this cached data. Where is the data stored; how to look at it; how is it synced; and what other sensitive information can be found that you may not have known existed! Speaker Bio: Sarah is an digital forensic analyst who has worked with various federal law enforcement agencies. She has performed a variety of investigations including computer intrusions, criminal, counter intelligence, counter-narcotic, and counter terrorism. Sarah's research and analytical interests include Mac forensics, mobile device forensics, digital profiling, and malware reverse engineering. Sarah has presented at many industry conferences including; Shmoocon, CEIC, various Bsides, DEF CON, and the SANS DFIR Summit. Sarah is author and instructor of the SANS Mac Forensic Analysis Course - FOR518.

uk: вхід без авторизації


Medical Devices: Pwnage and Honeypots

uk: Комп'ютерні науки

description: We know medical devices are exposed to the Internet both directly and indirectly, so just how hard is it to take it to the next step in an attack and gain remote administrative access to these critical life saving devices? We will discuss over 20 CVEís Scott has reported over the last year that will demonstrate how an attacker can gain remote administrative access to medical devices and supporting systems. Over 100 remote service and support credentials for medical devices will be presented. So is an attack against medical devices a reality or just a myth? Now that we know these devices have Internet facing exposure and are vulnerable to exploit, are they being targeted? We will release and present six months of medical device honeypot research showing the implications of these patient care devices increasing their connectivity. Speaker Bios: Scott Erven is an Associate Director at Protiviti. He has over 15 years of information security and information technology experience with subject matter expertise in medical device and healthcare security. Scott has consulted with the Department of Homeland Security, Food and Drug Administration and advised national policymakers. His research on medical device security has been featured in Wired and numerous media outlets worldwide. Mr. Erven has presented his research and expertise in the field internationally. Scott also has served as a subject matter expert and exam writer for numerous industry certifications. His current focus is on research that affects human life and public safety issues inside todayís healthcare landscape. Mark Collao is a Security Consultant at Protiviti. He has over 5 years of experience in information security consulting, primarily in network and application penetration tests, red team assessments, and social engineering exercises. Mark also researches botnet activity and maintains several custom protocol and application honeypots on the net. He holds an Offensive Security Certified Professional (OSCP) certification, is a member of the MWCCDC red team, and graduated from DePaul University

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Kerberos “Golden Tickets” were unveiled by Alva “Skip” Duckwall & Benjamin Delpy in 2014 during their Black Hat USA presentation. Around this time, Active Directory (AD) admins all over the world felt a great disturbance in the Force. Golden Tickets are the ultimate method for persistent, forever AD admin rights to a network since they are valid Kerberos tickets and can’t be detected, right? This talk explores the latest Active Directory attack vectors and describes how Golden Ticket usage can be detected. When forged Kerberos tickets are used in AD, there are some interesting artifacts that can be identified. Yes, despite what you may have read on the internet, there are ways to detect Golden & Silver Ticket usage. Skip the fluff and dive right into the technical detail describing the latest methods for gaining and maintaining administrative access in Active Directory, including some sneaky AD persistence methods. Also covered are traditional security measures that work (and ones that don’t) as well as the mitigation strategies that disrupts the attacker’s preferred game-plan. Prepare to go beyond “Pass-the-Hash” and down the rabbit hole. Some of the topics covered: Sneaky persistence methods attackers use to maintain admin rights. How attackers go from zero to (Domain) Admin MS14-068: the vulnerability, the exploit, and the danger. “SPN Scanning” with PowerShell to identify potential targets without network scans (SQL, Exchange, FIM, web servers, etc.). Exploiting weak service account passwords as a regular AD user. Mimikatz, the attacker’s multi-tool. Using Silver Tickets for stealthy persistence that won’t be detected (until now). Identifying forged Kerberos tickets (Golden & Silver Tickets) on your network. Detecting offensive PowerShell tools like Invoke-Mimikatz. Active Directory attack mitigation. Kerberos expertise is not required since the presentation covers how Active Directory leverages Kerberos for authentication identifying the areas useful for attack. Information presented is useful for both Red Team & Blue Team members. Speaker Bio: Sean Metcalfe is the Chief Technology Officer at Dan Solutions, a company that provides Microsoft platform engineering and security expertise. Mr. Metcalf is one of about 100 people in the world who holds the elite Microsoft Certified Master Directory Services (MCM) certification. Furthermore, he assisted Microsoft in developing the Microsoft Certified Master Directory Services certification program for Windows Server 2012. Mr. Metcalf has provided Active Directory and security expertise to government, corporate, and educational entities since Active Directory was released. He currently provides security consulting services to customers with large Active Directory environments and regularly posts useful Active Directory security information on his blog, ADSecurity.org. Follow him on Twitter @PyroTek3 Twitter: @PyroTek3 Web: ADSecurity.org

uk: вхід без авторизації

name: Red vs Blue: Modern Active Directory Attacks & Defense


uk: Комп'ютерні науки

de: Geowissenschaften (ohne Geographie)

uk: Науки про Землю(крім географії)

en: Geosciences (excl. Geography)

uk: Бібліотекознавство, документознавство

en: Information and Library Sciences

de: Mathematik, Naturwissenschaften

uk: Математика, природничі науки

en: Mathematics, Natural Sciences

de: Geisteswissenschaften

uk: Гуманітарні науки

en: Humanities

@language: de

uk: вхід без авторизації

name: Die Datenlaube: Neues Wissen und Daten aus alten Texten – Mit Wikisource, Wikidata und mit Commons

Technische Informationsbibliothek (TIB)

addressCountry: DE

addressLocality: Hanover

addressRegion: Lower Saxony

name: Berufsverband Information Bibliothek e. V. (BIB)


keywords: E-Books Haftanstalten Digitale_Teilhabe

uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

description: Als Partner des Landes Berlin konnte die ZLB 2019 Häftlingen erstmals E-Books und weitere digitale Angebote über das Internet zugänglich machen. In dem Vortrag stellen wir das Pilotprojekt vor.

uk: вхід без авторизації

name: Bibliotheken für alle? Digitale Bibliotheksangebote in Haftanstalten


uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

uk: вхід без авторизації

name: Ein Vorschlag für die Sichtbarmachung der Qualität von Forschungsdaten am Beispiel des DataCite-DOI


cs: Matematika

de: Mathematik

fi: matematiikka

uk: Математика

en: Mathematics

fr: Mathématiques

da: Matematik

es: Matemáticas

nl: Wiskunde

uk: Математика, природничі науки

description: We will introduce the notion of perfectoid spaces. The theory can be seen as a kind of rigid geometry of infinite type, and the most important feature is that the theories over (deeply ramified extensions of) Q_p and over F_p((t)) are equivalent, generalizing to the relative situation a theorem of Fontaine-Wintenberger, and also implying a strong form of Faltings's almost purity theorem. This method of changing the characteristic is then applied to deduce many cases of the weight-monodromy conjecture.

uk: вхід без авторизації

name: Fondation mathématique Jacques Hadamard (FMJH)

name: 4/6 Perfectoid Spaces and the Weight-Monodromy Conjecture

name: Institut des Hautes Études Scientifiques (IHÉS)

addressCountry: FR

addressLocality: Bures-sur-Yvette

addressRegion: Île-de-France


uk: Математика, природничі науки

uk: вхід без авторизації

name: 3/6 Perfectoid Spaces and the Weight-Monodromy Conjecture


uk: Математика, природничі науки

uk: вхід без авторизації

name: 2/6 Perfectoid Spaces and the Weight-Monodromy Conjecture


uk: Математика, природничі науки

uk: вхід без авторизації

name: 1/6 Perfectoid Spaces and the Weight-Monodromy Conjecture


uk: Комп'ютерні науки

uk: Науки про Землю(крім географії)

uk: Бібліотекознавство, документознавство

uk: Математика, природничі науки

uk: Гуманітарні науки

uk: вхід без авторизації

name: Fachsession Geowissenschaften, Kartographie und Geobasisdaten


Datensicherheit für Startups

uk: Комп'ютерні науки

description: Datensicherheit für Startups - ein Vortrag von Prof. Dr.-Ing. Sabine Wieland in Zusammenarbeit mit dem Leipziger Startup-Cafe 1. Was müssen Startups in Sachen Datensicherheit beachten, wo lauern Fallstricke und wie schütze ich mein Unternehmen vor Cyberkriminellen!

uk: вхід без авторизації

name: Hochschule für Telekommunikation Leipzig

addressLocality: Leipzig

addressRegion: Saxony


uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

description: Zurückziehen von wiss. Artikeln als „Selbstreinigungsprozess“ der Wissenschaft (#retractions): Überblick und Vorschläge, wie sich #Bibliotheken einbringen können.

uk: вхід без авторизації

name: Zurückgezogene Artikel in wissenschaftlichen Zeitschriften (Retractions): Ein Thema für wissenschaftliche Bibliotheken?!


keywords: bibliometrie opendata

uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

description: Gemeinsam mit den Teilnehmer*innen wird der im Projekt ROSI entwickelte Prototyp getestet. Dieser Prototyp ermöglicht die Visualisierung von offenen szientometrischen Indikatoren.

uk: вхід без авторизації

name: Bibliometrische Visualisierungen auf dem Prüfstein – Versuch einer bibliothekarischen Perspektive


uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

uk: вхід без авторизації

name: International Image Interoperability Framework - IIIF


uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

uk: вхід без авторизації

name: Discovery-Entwicklung in Kooperation mit Pilotanwendern: Am Beispiel der Neuentwicklung von DigiBib IntrOX


uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

description: Was ist #DataAnalytics und wie hilft es bei evidenzbasierten Beratungen im #scholcomm #openaccess Bereich? Und welche Rolle spielen dabei offene und reproduzierbare Analyseprozesse?

uk: вхід без авторизації

name: Data Analytics für wissenschaftliche Information: Anwendungsgebiete und Lernwege


uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

uk: вхід без авторизації

name: "Making it easy - OER für Bibliothekare*innen"


uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

uk: вхід без авторизації

name: Forschungsdatenmanagement gestern, heute und morgen zwischen FAIR, CARE und EOSC

name: Berufsverband Information Bibliothek e. V. (BIB)


GND meets Wikibase

keywords: GND Wikibase

uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

description: Ist Wikibase die Software und technisch überzeugende Plattform, um Regeln zur GND-Modellierung, zu Eigenschaften und Relationen diskutieren und dokumentieren zu können? Erste Antworten im Vortrag.

uk: вхід без авторизації


keywords:
Stadterweiterung Wien
Stadterweiterung Barcelona

de: Architektur, Innenarchitektur

uk: Архітектура, дизайн інтер'єру

en: Architecture, Interior Architecture

description: Im ersten Semester wird eine Einführung in die Methodik der Disziplin gegeben und die Stadtbaugeschichte im Zeitraum von den Anfängen bis in die Mitte des 19. Jahrhunderts thematisch präsentiert.

uk: вхід без авторизації

name: Neoabsolutistische Macht, bürgerliches Selbstbewusstsein und marxistischer Idealismus: Die Wiener Ringstrasse und Ildefonso Cerdas Ensanche für Barcelona

name: Eidgenössische Technische Hochschule Zürich (ETH Zürich)

addressCountry: CH

addressLocality: Zurich

addressRegion: Zurich


keywords: Mietskaserne Villenkolonie

uk: Архітектура, дизайн інтер'єру

uk: вхід без авторизації

name: Vom architektonischen Einschub zum Stadterweiterungsplan: Berlin von Karl Friedrich Schinkel bis James Hobrecht


keywords:
Napoléon III.
GRand Croisée
Hausmannisierung

uk: Архітектура, дизайн інтер'єру

uk: вхід без авторизації

name: Die Konstruktion der bürgerlichen Stadt: Georges-Eugène Haussmann verwandelt Paris in die Hauptstadt des 19. Jahrhunderts


uk: Комп'ютерні науки

description: Materials from renewable feedstocks may cause significant environmental impacts due to land use and land use change related to feedstock sourcing. Whilst these impacts are clearly spatially-dependent, spatially-resolved impact assessment is often hampered by lack of data, and in some cases, methods or models. In addition, the location and impacts of production are likely to change in the future, e.g. due to the consequences of climate change and due to sourcing trends in a growing economy and considering geopolitical conditions. This discussion forum will focus on 1) Methods that can be used to track the current locations of crop production systems in complex supply chains to support spatially resolved impact assessment and 2) Methods and tools to predict future locations of crops in the context of megatrends such as climate change and increasing demand for agricultural raw materials. 3) Advances of methods for spatially resolved consideration of environmental impacts of land use change will also be covered in this LCA forum.

uk: вхід без авторизації

name: 67th LCA Discussion Forum - Wrap up and announcements


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 67th LCA Discussion Forum - Discussion 3


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Integrated modelling to assess land use change impacts on ecosystem service provision −Prospects for LCIA


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Life cycle assessment needs predictive spatial modelling for biodiversity and ecosystem services


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Assessing the global biodiversity impacts of land use


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Quantifying biodiversity impacts of land use change


New Land Use Change Guidance

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Incorporating FAO trade and production database to estimate supply chain location information for agricultural products


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Estimating the Variability of Greenhouse Gas Footprints of Crude Palm Oil production in Indonesia


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Recent developments in indirect Land-Use Change (iLUC) modelling land uses changes


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 67th LCA Discussion Forum - Discussion 2


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Land use change projections –linking economic constraints and constraints of the physical environment


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Interdisciplinary approaches to Land Use Change allocation


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Modelling land use for global biodiversity assessments: Discrete allocation at 10 arc-seconds


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 67th LCA Discussion Forum - Discussion 1


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Learnings from Greenconcept - how to deal with multifunctionality and data availability

name: Eidgenössische Technische Hochschule Zürich (ETH Zürich)


73rd LCA - Discussion 2

uk: Комп'ютерні науки

uk: вхід без авторизації


73rd LCA - Discussion 1

uk: Комп'ютерні науки

uk: вхід без авторизації


Update of electronics in ecoinvent

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Data centre as driver for industrial carbon reduction


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Global Energy Footprint of IoT Semiconductors


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Indirect effects of digitalisation on the environment


73rd LCA - Discussion 4

uk: Комп'ютерні науки

uk: вхід без авторизації


73rd LCA - Discussion 3

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: LCA of multifunctional devices, networks and digital services - an industry perspective


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Environmental assessment of cloud services in data centers - Methodological challenges


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Supply chain transparency for coffee - what are the synergies between blockchain and LCA


uk: Комп'ютерні науки

uk: вхід без авторизації

name: LCA of bioleaching in indium recovery from LCD-waste: an ex-ante Approach


Wrap up and anouncement

uk: Комп'ютерні науки

uk: вхід без авторизації


Energy implications of the move from TV

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Digital media consumption and its environmental impact


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Global supply chain analysis of material - related impacts on ICT (MRIO approach)


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Lifesaving - Assessing environmental implication of service life extension of mobile devices from multiple perspectives


uk: Комп'ютерні науки

uk: вхід без авторизації

name: LCA methodology challenges and opportunities for ICT products


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Opportunities and Risks of the Digital Transformation for the Environment


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Digital sobriety and its implications on the environmental impacts of cloud computing


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 73rd LCA - Digital Transformation - Welcome and introduction to the day


Keynote: Open Learning Analytics

uk: Комп'ютерні науки

uk: вхід без авторизації

Universität Potsdam

addressLocality: Potsdam

addressRegion: Brandenburg


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Informatikunterricht und Medienbildung - Pflicht oder Kür?


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Technische Informationsbibliothek (TIB) (Konferenzaufzeichnung)

name: Research Data and Open Science in the Russian University Environment


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Abstracting and Indexing as an enabling interface between open science and grey literature – The approach of the Aquatic Sciences and Fisheries Abstracts service


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Strategies for Teaching and Learning about Grey Literature


uk: Комп'ютерні науки

uk: вхід без авторизації

name: An Open Platform for FAIR Conference Metadata


uk: Комп'ютерні науки

description: Currently there is a deluge of ‘off-piste’ collaborative authoring going on in Open Science, the adoption of: software versioning systems like GitHub for writing; simulations and code in platforms like Jupyter; or in ‘real time’ web authoring ‘operational transformation algorithm’ based software like Etherpad. Yes, the ‘digital plumbing’ of this publishing flood is just not in place. How do we ID these documents, reuse them for example? These questions have been asked and answered before, but are outside the fast moving, forward looking tech world. As an example, Ted Nelson coined the term ‘transclusion’ (Nelson 1987) back in the ‘80s. Transclusion is a step on from the ‘hyperlink’, another Nelson term, where not just the link of a target is included in a document but instead the whole content (AKA live linked embedding). Currently if you want to link and include another document fragment in your document with persistence, it’s unlikely to work. The panelists will explore how this exciting field can better support research.

uk: вхід без авторизації

name: The Open Science Publishing Flood and Collaborative Authoring


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Going Green – Publishing Academic Grey Literature in Laboratory Collections on HAL


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Open Educational Resources and Library & Information Science: towards a common framework for methodological approaches and technical solutions


Is Open Science FAIR for Stakeholders?

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Is the Production and Use of Grey Marine Literature a Model for Open Science?


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Open Science and Collaborative Working in Energy System Research


Wrap-up and announcements, Farewell

uk: Комп'ютерні науки

description: The concept of Circular Economy is gaining popularity in Europe and elsewhere. Both the recycling of waste and a (recycling friendly) eco-design are components of a Circular Economy. How can LCA support the creation of a Circular Economy? How can LCA be used to ensure a positive balance of efforts and benefits? How shall substituted materials and products be accounted for, who can claim the benefit, and how is resource quality taken into consideration? How can wastes and resources be managed to minimize their environmental impacts? How can products be designed in an eco-friendly manner to close material cycles? The 3rd discussion forum this year will give the floor to representatives from industry, authorities, academics, and organisations to present new applications and approaches of LCA in combination with various other environmental assessment tools (e.g. MFA, LCA and/or mathematical optimization) to manage wastes and resources sustainably and to support decision-making towards a circular economy. A focus will be laid on factors relevant for the benefits of the circular economy, such as waste and resource quality aspects and their influence on the recycling system, as well as product quality. Finally, examples of LCA applications for eco-design, waste management and systemic analyses across sectors will be shown.

uk: вхід без авторизації

name: Eidgenössische Technische Hochschule Zürich (ETH Zürich)


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 63rd LCA Discussion Forum - Welcome and introduction: How can LCA support the Circular Economy?


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Urban Mining for a Circular Economy: Focus on metals and developing countries perspective


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Valuation of Circular economy in Swiss environmental policy


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Recycling contaminants: chemicals in the paper product cycle


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Recycling and LCA: Choices and results: How can LCA support the creation of a Circular Economy? How can LCA be used to ensure a positive balance of efforts and benefits?


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Recommendations about how to model substituted materials based on the LCA case study of the construction and demolition waste management in Lombardy


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 63rd LCA Discussion Forum - Panel Discussion


keywords:
Drozda, Jiri
Klozova, Tereza

uk: Комп'ютерні науки

uk: вхід без авторизації

name: Technische Informationsbibliothek (TIB) (Konferenzaufzeichnung)

name: Hidden Grey Heritage of Science and Research from Pre-Internet Era


Open Access: A never-ending transition?

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: How Open Science Influences next Developments in Grey Literature


uk: Комп'ютерні науки

uk: вхід без авторизації

name: AccessGrey: Securing Open Access to Grey Literature for Science and Society


uk: Комп'ютерні науки

uk: вхід без авторизації

name: From Digitization and Digitalization to Digital Transformation: A Case for Grey Literature Management


uk: Комп'ютерні науки

uk: вхід без авторизації

name: P3ML's Grey Literature: Jupyter Notebooks


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Open Access in the Academy: Developing a Library Program for Campus Engagement


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Unbreaking our Knowledge Sharing Workflows?


A Networking Approach to the Smart Grid

uk: Комп'ютерні науки

description: Several powerful forces are gathering to make fundamental and irrevocable changes to the century-old grid. This next-generation grid, often called the `smart grid,' will incorporate novel elements such as storage, electric vehicles, and distributed generation, with these elements interconnected by a pervasive communication infrastructure. The smart grid promises to improve the reliability and efficiency of the grid and simultaneously reduce its carbon footprint, making it `greener.' However, many essential aspects of the smart grid exist only on paper-- the introduction of the smart grid raises nearly as many problems as it solves. Our research hypothesis is that the concepts and techniques pioneered by the Internet, the fruit of four decades of research in this area, are directly applicable to the solution of some of these problems. This is because both the Internet and the electrical grid are designed to meet fundamental needs, for information and for energy, respectively, by connecting geographically dispersed suppliers with geographically dispersed consumers. I will discuss this hypothesis in some detail, then present selected projects from the research agenda of the ISS4E (Information Systems and Science for Energy) lab at the University of Waterloo that further explore its consequences. (joint work with Catherine Rosenberg, University of Waterloo)

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Today, the large-scale compromise of Internet hosts serves as a platform for supporting a range of criminal activity in the so-called Internet underground economy. In this talk I will quickly survey work that our group has performed over the past decade on the problems posed by these threats, and how our research directions have evolved over time. In the remainder of the talk, I will describe recent work that our group has performed, including the ecosystem of CAPTCHA- solving service providers and an end-to-end analysis of the spam value chain. Using extensive measurements over months of diverse spam data, broad crawling of naming and hosting infrastructures, and product purchases from a wide variety of spam-advertised sites, I'll characterize the relative prospects for anti-spam interventions at multiple levels. -- This work is part of a larger effort within the Collaborative Center for Internet Epidemiology and Defenses (CCIED), a joint NSF Cybertrust Center with UCSD and ICSI, and an ONR MURI collaboration.

uk: вхід без авторизації

name: Exploring the Technical and Economic Factors Underlying Internet Scams


uk: Архітектура, дизайн інтер'єру

description: Affen der Stoffe – Sempers System und die Faszination des Elastischen - «Dieser Stoff ist gleichsam der Affe unter den Nutzmaterien» rief Gottfried Semper verzweifelt und zugleich fasziniert aus, als er in seinem Stil über die Eigenschaften des Kautschuks berichtete, welche die Kategorien seines System zu sprengen schienen. Werkstoffe, welche die Eigenschaften anderer Materialien nachahmen und sich dem Formwillen des Gestalters zu leicht fügen, galten lange als moralisch minderwertig. Dennoch entdeckte die moderne Architektur die Formen der Elastizität früh für sich; sie begleiteten das «kunstvolle Spiel der unter dem Licht versammelten Baukörper» wie ihr Schatten. Ein Blick auf das Werk von Jože Plečnik, Josep Jujol, Sergio Musmeci oder Miguel Fisac verrät, wie der Affe der Elastizität die Starrheit der festgefügten Systeme in den «technischen und tektonischen Künsten» austrickste, und damit zur Entstehung neuer Denkmodelle beitrug.

uk: вхід без авторизації

name: Abschiedsvortrag Ákos Moravánszky: Affen der Stoffe – Sempers System und die Faszination des Elastischen

name: Eidgenössische Technische Hochschule Zürich (ETH Zürich)


uk: Архітектура, дизайн інтер'єру

description: Begrüssung Prof. Sacha Menz, Vorsteher Departement Architektur, ETH Zürich Vortrag Prof. Dr. phil Georg Franck-Oberaspach, Professor für EDV-gestützte Methoden in Architektur und Raumplanung, Technische Universität, Wien Eine Ausstellung des Instituts gta in Zusammenarbeit mit Bearth & Deplazes Architekten.

uk: вхід без авторизації

name: Ausstellungseröffnung Bearth & Deplazes. Amurs - Begrüssung, Vortrag


uk: Архітектура, дизайн інтер'єру

description: Das Future Cities Laboratory in Singapur startet in Zürich in eine Dialogserie. Dabei treffen Architekten aus Südostasien auf europäische Kollegen und lancieren eine Debatte zwischen den beiden global wichtigen Regionen. Südostasien durchläuft momentan einen massiven Boom wirtschaftlichen und demografischen Wachstums, der zu einer schier unglaublichen Geschwindigkeit der Urbanisierung führt. Als Folge davon erlebt die Bauproduktion und –entwicklung eine Blütezeit. Europa hingegen ist in einem Status der „Reflektion“ angelangt, in dem einerseits Verdichtungen urbaner und architektonischer Strukturen vorherrschen und andererseits nach neuen Märkten gesucht wird. Auf diesem globalen Parkett wirken Architekten aus den beiden Regionen vermehrt aufeinander ein, es entstehen neue Formen der Kollaboration und der Konkurrenz.

uk: вхід без авторизації

name: Architekturdialog 2016: European - South East Asian Architectural Dialogue


uk: вхід без авторизації

name: Kraft Material Form - Geschichte des Tragwerksentwurfs - Aus der Erfahrung eines Ingenieurs


description: Nanoparticles for cancer applications are increasingly able to move, sense, and interact the body in a controlled fashion, an affordance that has led them to be called robots. The challenge is to discover how trillions of nanobots can work together to improve the detection and treatment of tumours. Towards this end, the field of swarm robotics offers tools and techniques for controlling large numbers of robots with limited capabilities. Our swarm strategies are designed in realistic simulators using bio-inspiration, machine learning, and crowdsourcing. Strategies are then translated to 1000-robot swarms or preliminary tissue-on-a-chip devices.

uk: вхід без авторизації

name: Distinguished Seminar in Robotics, Systems & Control: From Swarm of Flying Robotics to Nanomedicine


uk: Архітектура, дизайн інтер'єру

description: Lecture Charbonnet/Heiz Made in ETH Portraits I - IV

uk: вхід без авторизації

name: Lecture Charbonnet/Heiz Made in ETH 07.05.2013


Monch Cluster Seminar for New Users

uk: Комп'ютерні науки

description: The new cluster "Monch", installed at the Swiss National Supercomputing Centre CSCS, is introduced to the user community.

uk: вхід без авторизації


Nanocarbons in Condensed Matter

de: Physik, Astronomie

fi: fysiikka, tähtitiede

uk: Фізика, Астрономія

en: Physics, Astronomy

fr: Physique, Astronomie

da: Fysik, Astronomi

es: Física, Astronomía

nl: Natuurkunde, Astronomie

uk: Математика, природничі науки

description: For more than half a century, Mildred Dresselhaus has studied the fundamental properties of carbon – carbon as graphite, the dark, flaky mineral with which our pencils are pointed, and carbon as liquid, the element with the highest melting point in nature; carbon that is insulator one moment, superconductor the next. Her research helped usher in the age of nanotechnology, the wildly popular effort to downsize electronic circuits, medical devices and a host of other products to molecular dimensions. Dr. Dresselhaus won the 2012 Kavli Prize in Nanoscience. This award joins a very long list of laurels, among them the National Medal of Science, the Enrico Fermi Award, the presidencies of the American Physical Society and the American Association for the Advancement of Science and many others.

uk: вхід без авторизації


description: Preliminary estimates heavily influence the fate of a project as they are crucial during the initial decision-making process. Little attention has been given to the development of models for estimating the construction material quantities (CMQs) needed for the different elements that comprise a project. If the required CMQs can be accurately estimated, current unit costs can be included to determine the project cost by creating a pre- liminary estimate with a clear separation between technical estimates (quantities) and market fluctuations in prices (cost of materials and labor). The goal of this work was to develop a method- ology to make accurate preliminary estimates of the CMQs used in construction projects. The pro- posed methodology uses three techniques (RA, NN, CBR) which interact with each other to provide Preliminary estimates heavily influence the fate of a project as they are crucial during the initial decision-making process. Little attention has been given to the development of models for estimating the construction material quantities (CMQs) needed for the different elements that comprise a project. If the required CMQs can be accurately estimated, current unit costs can be included to determine the project cost by creating a pre- liminary estimate with a clear separation between technical estimates (quantities) and market fluctuations in prices (cost of materials and labor). The goal of this work was to develop a method- ology to make accurate preliminary estimates of the CMQs used in construction projects. The pro- posed methodology uses three techniques (RA, NN, CBR) which interact with each other to provide accurate results. The methodology was used to estimate 234 CMQs of structures from cement plant projects. The results obtained exceeded industry standards for preliminary estimates.

uk: вхід без авторизації

name: Public Presentation of Doctoral Thesis: A Methodology to Make Accurate Preliminary Estimates of Construction Material Quantities for Construction Projects


Calatrava: „Stations"

uk: Архітектура, дизайн інтер'єру

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: „Science in Perspective“ Talk N° 1 – Internet and Trust


description: ETH Zurich Alum, Pascal Kaufmann, Founder and Visionary of Starmind speaks on "The State of Artificial Intelligence in a Nutshell - The Symbiosis of Man and Machine." Kaufmann, a technology entrepreneur, pushes the limits of the unknown. Obsessed with robots, cyborgs, artificial intelligence and brain research, this ETH neuroscience graduate researched the interface between living brains and robots at medical school in the U.S. where he formulated his vision “to think with the power of 1’000 brains” opening a new field called “Brain Technology.”

uk: вхід без авторизації

name: Lecture Pascal Kaufmann: The State of Artifical Intelligence in a Nutshell – On the Symbiosis of Man and Machine