uk: Комп'ютерні науки

description: Openness to responsibly disclosed external vulnerability research is crucial for modern software maintainers and security teams. Changes in upstream dependency code may have pulled the safety rug out from underneath widely trusted core libraries, leaving millions of services vulnerable to unsophisticated attacks. The impact of even a single reasonably well-distributed supply-chain security vulnerability will be felt by engineering teams across many applications, companies, and industries. We'd like to discuss an IP address parsing vulnerability first discovered in private-ip, a small and infrequently maintained yet critically important NodeJS package for determining if an IP address should be considered part of a private range or not. We'll talk about not only the implications of this CVE but taking the main idea and applying it across multiple programming languages in uniquely disturbing ways. Sometimes, the effects of code rot are even more far-reaching than we could possibly expect, and if you pull on a thread, it just keeps going. Sometimes, you get lucky when you know exactly what you're looking for. Sometimes, it's hard to convince other technically-minded folks that a seemingly trivial implementation flaw is dangerous in capable hands. This talk is beginner as well as advanced-friendly; we'll show you the basics a hacker or a programmer needs to know about IP address parsing and how to tell your octal from your decimal along the way. REFERENCES: Researchers involved in this work: - Victor Viale: https://github.com/koroeskohr, koroeskohr - Sick Codes: https://github.com/sickcodes, sickcodes - Kelly Kaoudis: https://github.com/kaoudis, kaoudis - John Jackson: https://www.johnjhacking - Nick Sahler: https://github.com/nicksahler, tensor_bodega - Cheng Xu: https://github.com/xu-cheng Selected press coverage (as of May '21) - https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/ - https://www.theregister.com/2021/03/29/netmask_cve/ - https://www.bleepingcomputer.com/news/security/python-also-impacted-by-critical-ip-address-validation-vulnerability/ Currently released advisories related to this work (as of May '21) - https://sick.codes/sick-2021-011/ - https://vuln.ryotak.me/advisories/6 - https://sick.codes/sick-2021-018/ - https://sick.codes/sick-2020-022/ Additional - https://sick.codes/universal-netmask-npm-package-used-by-270000-projects-vulnerable-to-octal-input-data-server-side-request-forgery-remote-file-inclusion-local-file-inclusion-and-more-cve-2021-28918/ - https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ - https://blog.dave.tf/post/ip-addr-parsing/ - https://security-tracker.debian.org/tracker/CVE-2021-29424 - https://security-tracker.debian.org/tracker/CVE-2021-29662 - https://www.npmjs.com/package/netmask - https://github.com/rs/node-netmask - https://bugs.python.org/issue36384#msg392423 - https://github.com/rust-lang/rust/pull/83652 - https://github.com/rust-lang/rust/issues/83648

uk: вхід без авторизації

name: Rotten code, aging standards, & pwning IPv4 parsing


Laura Abbott

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: Breaking TrustZone M: Privilege Escalation on LPC55S69

DEF CON

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Комп'ютерні науки

description: Diversified Industrial Control System (ICS) providers create a variety of ecosystems, which have come to operate silently in the background of our lives. Among these organizations, Mitsubishi Electric ranks among the most prolific. Because the operation of this ecosystem is so widely used in key manufacturing, natural gas supply, oil, water, aviation, railways, chemicals, food and beverages, and construction, it is closely-related to people's lives. For this reason, the security of this ecosystem is extraordinarily important. This research will enter the Mitsubishi ecosystem’s communication protocol, using it as a lens with which to deeply explore the differences between itself and other ecosystems. We will show how we successfully uncovered flaws in its identity authentication function, including how to take it over and show that such an attack can cause physical damage in different critical sectors. We’ll explain how we accomplished this by applying reverse engineering and communication analysis. This flaw allows attackers to take over any asset within the entire series of Mitsubishi PLCs, allowing command of the ecosystem and full control of the relevant sensors. A further complication is that making a fix to the various communication protocols in the ICS/SCADA is extremely difficult. We will also share the various problems we encountered while researching these findings and provide the most workable detection and mitigation strategies for those protocols. REFERENCES [1] https://ladderlogicworld.com/plc-manufacturers/ [2] https://www.mitsubishielectric.com/fa/products/cnt/plc/pmerit/case.html [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5594 [4] https://www.mitsubishielectric.com/fa/products/cnt/plc/pmerit/index.html

uk: вхід без авторизації

name: Taking Apart and Taking Over ICS & SCADA Ecosystems: A Case Study of Mitsubishi Electric


uk: Комп'ютерні науки

description: Over the past few years, we have seen some novel presentations re-introducing the concept of HTTP request smuggling, to reliably exploit complex landscapes and systems. With advanced techniques, researchers were able to bypass restrictions and breach the security of critical web applications. This presentation will take a new approach, focusing on the response pipeline desynchronization, a rather unexplored attack vector in HTTP Smuggling. First, I will introduce a Desync variant, using connection-tokens to hide arbitrary headers from the backend. This technique does not abuse discrepancy between HTTP parsers, but instead relies on a vulnerability in the protocol itself! The issue was found and reported under Google’s Vulnerability Reward Program for a nice bounty! Next, I will show how it is possible to inject multiple messages at the backend server, mixing the pipeline’s connection order, and hijack users sessions from login requests. Finally, using a novel technique known as Response Scripting, I will demonstrate how to create malicious outbound messages using static responses as the building blocks. This will be leveraged to write custom responses and take control of one of the most popular protocols in history! REFERENCES: RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1 https://tools.ietf.org/html/rfc2616 RFC 7231: Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content https://tools.ietf.org/html/rfc7231 CHAIM LINHART, AMIT KLEIN, RONEN HELED, STEVE ORRIN: HTTP Request Smuggling https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf James Kettle: HTTP Desync Attacks: Request Smuggling Reborn https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn https://portswigger.net/research/http-desync-attacks-what-happened-next Emile Fugulin HTTP Desync Attacks with Python and AWS https://medium.com/@emilefugulin/http-desync-attacks-with-python-and-aws-1ba07d2c860f Amit Klein HTTP Request Smuggling in 2020 https://i.blackhat.com/USA-20/Wednesday/us-20-Klein-HTTP-Request-Smuggling-In-2020-New-Variants-New-Defenses-And-New-Challenges.pdf

uk: вхід без авторизації

name: Response Smuggling: Pwning HTTP 1 1 Connections


uk: Комп'ютерні науки

description: You’ve seen plenty of talks on exploiting, escalating, and exfiltrating the magical world of Google Cloud (GCP), but what about its buttoned-down sibling? This talk delves into the dark art of utilizing Apps Script to exploit G Suite (AKA Google Workspace). As a studious sorcerer, you’ll discover how to pierce even the most fortified G Suite enterprises. You’ll learn to conjure Apps Script payloads to bypass powerful protective enchantments such as U2F, OAuth app allowlisting, and locked-down enterprise Chromebooks. Our incantations don’t stop at the perimeter, we will also discover novel spells to escalate our internal privileges and bring more G Suite accounts under our control. Once we’ve obtained the access we seek, we’ll learn various curses to persist ourselves whilst keeping a low profile so as to not risk an unwelcome exorcism. You don’t need divination to see that this knowledge just might rival alchemy in value. REFERENCES: No real academic references, this is all original research gleaned from real-world testing and reading documentation.

uk: вхід без авторизації

name: Hacking G Suite: The Power of Dark Apps Script Magic


uk: Комп'ютерні науки

description: With attacks moving below the operating system and computer firmware vulnerability discovery on the rise, the need to keep current platforms updated becomes important and new technology is developed to help defend against such threats. Major computer manufacturers are adding capabilities to make it easier to update BIOS. Our research has identified multiple vulnerabilities in Dell's BiosConnect feature used for remote update and recovery of the operating system. These vulnerabilities are easy to exploit by an adversary in the right position, and are not prevented by protective technologies such as Secured Core PCs, BitLocker, BootGuard, and BIOS Guard. Join us and together we will explore the new attack surfaces introduced by these UEFI firmware update mechanisms -- including a full walk-through of multiple vulnerability findings and the methods we used to create fully working exploits that gain remote code execution within the laptop BIOS and their effects on the operating system.

uk: вхід без авторизації

name: High Stakes Updates: BIOS RCE OMG WTF BBQ


uk: Комп'ютерні науки

description: Microsoft Exchange Server is an email solution widely deployed within government and enterprises, and it is an integral part of both their daily operations and security. Needless to say, vulnerabilities in Exchange have long been the Holy Grail for attackers, hence our security research on Exchange. Surprisingly, we’ve found not only critical vulnerabilities such as ProxyLogon, but a whole new attack surface of Exchange. This new attack surface is based on a significant change in Exchange Server 2013, where the fundamental protocol handler, Client Access Service (CAS), splits into frontend and backend. In this fundamental change of architecture, quite an amount of design debt was incurred, and, even worse, it introduced inconsistencies between contexts, leading us to discover this new attack surface. To unveil the beauty of this attack surface and our novel exploitation, we’ll start by analyzing this architecture, followed by 7 vulnerabilities that consist of server-side bugs, client-side bugs, and crypto bugs found via this attack surface. In the end, these vulnerabilities are chained into 3 attack vectors that shine in different attack scenarios: ProxyLogon, ProxyShell, and ProxyOracle. These attack vectors enable any unauthenticated attacker to uncover plaintext passwords and even execute arbitrary code on Microsoft Exchange Servers through port 443, which is exposed to the Internet by ~400K Exchange Servers. This attack surface has its unparalleled impact for a reason: security researchers tend to find vulnerabilities from a certain perspective, such as digging for memory bugs, injections, or logic flaws, but we took a different approach by looking at Exchange from a high-level architectural view and captured this architecture-level attack surface, which yielded multiple vulnerabilities. We hope this brings a new paradigm to vulnerability research and inspires more security researchers to look into Exchange Server. Last but not least, we’ll provide hardening actions to mitigate such types of 0days in Exchange. # REFERENCES: * "Hunting for bugs, catching dragons" by Nicolas Joly in Black Hat USA 2019 * CVE-2020-0688 and CVE-2018-8302 from ZDI blog * CVE-2020-16875 from @steventseeley

uk: вхід без авторизації

name: ProxyLogon - Just Tip of the Iceberg: A New Attack Surface on Exchange Server


uk: Комп'ютерні науки

description: With complete access to a system, Linux kernel rootkits are perfectly placed to hide malicious access and activity. However, running code in the kernel comes with the massive risk that any change to a kernel version or configuration can mean the difference between running successfully and crashing the entire system. This talk will cover how to use extended Berkley Packet Filters (eBPF) to create kernel rootkits that are safe, stable, stealthy, and portable. eBPF is one of the newest additions to the Linux kernel, designed to easily load safe, constrained, and portable programs into the kernel to observe and make decisions about network traffic, syscalls, and more. But that’s not it’s only use: by creating eBPF programs that target specific processes we can warp reality, presenting a version of a file to one program and a different version to another, all without altering the real file on disk. This enables techniques such as presenting a backdoor user to ssh while hiding from sysadmins, or smuggling data inside connections from legitimate programs. This talk will also cover how to use these same techniques in malware analysis to fool anti-sanbox checks. These ideas and more are explored in this talk alongside practical methods to detect and prevent this next generation of Linux rootkits. REFERENCES: - DEFCON 27 - Evil eBPF Practical Abuses of In-kernel Bytecode Runtime - A talk about abusing eBPF for exploitation and privilege escalation - eBPF Website - https://ebpf.io - A website by the eBPF community with documentation and links to existing projects - eBPF Slack - https://ebpf.io/slack - A Slack channel run by the eBPF community - Libbpf Bootstrap - https://github.com/libbpf/libbpf-bootstrap - A sample project designed to provide a template to creating eBPF programs with Libbpf

uk: вхід без авторизації

name: Warping Reality: Creating and Countering the Next Generation of Linux Rootkits


uk: Комп'ютерні науки

description: A recent vulnerability, CVE-2021-30657, neatly bypassed a myriad of foundational macOS security features such as File Quarantine, Gatekeeper, and Notarization. Armed with this capability attackers could (and were!) hacking macOS systems with a simple user (double)-click. Yikes! In this presentation we’ll dig deep into the bowels of macOS to uncover the root cause of the bug: a subtle logic flaw in the complex and undocumented policy subsystem. Moreover, we’ll highlight the discovery of malware exploiting this bug as an 0day, reversing Apple’s patch, and discuss novel methods of both detection and prevention. REFERENCES: “All Your Macs Are Belong To Us” https://objective-see.com/blog/blog_0x64.html “macOS Gatekeeper Bypass (2021 Edition)” https://cedowens.medium.com/macos-gatekeeper-bypass-2021-edition-5256a2955508 “Shlayer Malware Abusing Gatekeeper Bypass On Macos” https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/

uk: вхід без авторизації

name: Bundles of Joy: Breaking MacOS via Subverted Applications Bundles


TEMPEST Radio Station

uk: Комп'ютерні науки

description: TEMPEST is a cyber security term that refers to the use of electromagnetic energy emissions generated by electronic devices to leak data out of a target device. The attacks may be passive (where the attacker receives the emissions and recovers the data) or active (where the attacker uses dedicated malware to target and emit specific data). In this talk I present a new side channel attack that uses GPU memory transfers to emit electromagnetic waves which are then received and processed by the attacker. Software developed for this work encodes audio on one computer and transmits it to the reception equipment positioned fifty feet away. The signals are received and processed and the audio is decoded and played. The maximum bit rate achieved was 33kbit/s and more than 99% of the packets were received. Frequency selection not only enables maximization of signal quality over distance, but also enables the attacker to receive signals from a specific computer when several computers in the area are active. The software developed demonstrates audio packets transfers, but other types of digital data may be transmitted using the same technique. REFERENCES: Eck W. “Electromagnetic radiation from video display units: an eavesdropping risk?” Computers and Security, 4, no. 4: 269-286, 1985. Kuhn, M. G., and Anderson, R. J. Soft. “Tempest: Hidden Data Transmission Using Electromagnetic Emanations.” In Information Hiding (1998), ed. D. Aucsmith, vol. 1525 of Lecture Notes in Computer Science, (Springer): 124–142. Thiele, E., “Tempest for Eliza.” 2001. http://www.erikyyy.de/tempest/. Kania B., “VGASIG: FM radio transmitter using VGA graphics card.” 2009. http://bk.gnarf.org/creativity/vgasig/vgasig.pdf. Guri M., Kedma G., Kachlon A., Elovici Y. “AirHopper: Bridging the air-gap between isolated networks and mobile phones using radio frequencies.” In Malicious and Unwanted Software: The Americas (MALWARE), 2014 9th International Conference on IEEE, 2014: 58-67. 2pkaqwtuqm2q7djg,"OVERCLOCKING TOOLS FOR NVIDIA GPUS SUCK, I MADE MY OWN". 2015. https://1vwjbxf1wko0yhnr.wordpress.com/2015/08/10/overclocking-tools-for-nvidia-gpus-suck-i-made-my-own/ nvapioc project: https://github.com/Demion/nvapioc SDRplay API Specification v3, https://www.sdrplay.com/docs/SDRplay_API_Specification_v3.pdf Simon Rockliff's Reed-Solomon encoding-decoding code at http://www.eccpage.com/rs.c

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Phantom attack is a collection of attacks that evade Linux system call monitoring. A user mode program does not need any special privileges or capabilities to reliably evade system call monitoring using Phantom attack by exploiting insecure tracing implementations. After adversaries gain an initial foothold on a Linux system, they typically perform post-exploitation activities such as reconnaissance, execution, privilege escalation, persistence, etc. It is extremely difficult if not impossible to perform any non-trivial adversarial activities without using Linux system calls. Security monitoring solutions on Linux endpoints typically offer system call monitoring to effectively detect attacks. Modern solutions often use either ebpf-based programs or kernel modules to monitor system calls through tracepoint and/or kprobe. Any adversary operations including abnormal and/or suspicious system calls reveal additional information to the defenders and can trigger detection alerts. We will explain the generic nature of the vulnerabilities exploited by Phantom attack. We will demonstrate Phantom attack on two popular open source Linux system call monitoring solutions Falco (Sysdig) and Tracee (Aquasecurity). We will also explain the differences between Phantom v1 and v2 attacks. Finally, we will discuss mitigations for Phantom attack and secure tracing in the broader context beyond system call tracing. REFERENCES: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33505 https://i.blackhat.com/USA-20/Thursday/us-20-Lee-Exploiting-Kernel-Races-Through-Taming-Thread-Interleaving.pdf https://www.youtube.com/watch?v=MIJL5wLUtKE https://dl.packetstormsecurity.net/1005-advisories/khobe-earthquake.pdf

uk: вхід без авторизації

name: Phantom Attack: Evading System Call Monitoring


uk: Комп'ютерні науки

description: When researching methods for covert communications in the wireless space, we noticed most hackers are barely looking below the IP layer, and even the wireless guys are focused on creating their own radio (PHY layer) solutions rather than looking at what’s already available to them. We discovered a sweet spot that takes advantage of MAC layer protocols in LTE and 5G, enabling long range communication using other people’s networks, GSMA CVD-2021-0045. We can use SPARROW devices almost everywhere in a variety of scenarios, such as data exfiltration and command and control. Despite limited data rates, the new scheme can defeat known covert communication schemes with dedicated PHY in the following ways: - Maximum Anonymity: SPARROW devices do not authenticate with the host network while operating. This eliminates their exposure to network security and lawful intercept systems as well as spectrum scanners. Utilizing limited resources, they cause very minimal impact on the host network services. - More Miles per Watt: SPARROW devices can be several miles apart exploiting broadcast power of base stations or non-terrestrial technologies. The range can be further extended by deploying several of them in a geographically sparse mesh network. - Low Power & Low Complexity: SPARROW devices can utilize existing protocol implementation libraries installed on commodity SDRs. They can operate on batteries or harvest energy from the environment for long durations, just like real sparrows! REFERENCES: There are no direct references of prior study that I (Reza) have (aside from general knowledge of 5G standard and RF), however the following talks and items led me towards this discovery: - DEF CON Safe Mode - James Pavur - Whispers Among the Stars - https://www.youtube.com/watch?v=ku0Q_Wey4K0 - DNS Data Exfiltration techniques - My boss buying me a 5G base station emulator and saying "find something wrong with this!"

uk: вхід без авторизації

name: SPARROW: A Novel Covert Communication Scheme


uk: Комп'ютерні науки

description: The talk, "UFOs and Government: A Historical Inquiry" given at Def Con 21 has been viewed thousands of times. It was a serious well-documented exploration of the UFO subject based on Thieme's participation in research into the subject with colleagues. The book of that name is the gold standard for historical research into the subject and is in 100+ university libraries. This update was necessitated by recent UFO incidents and the diverse conversations triggered by them. Contextual understanding is needed to evaluate current reports from pilots and naval personnel, statements from senators and Pentagon personnel, and indeed, all the input from journalists who are often unfamiliar with the field and the real history of documented UFOs over the past 70 years. Thieme was privileged to participate with scholars and lifelong researchers into the massive trove of reports. We estimate that 95% can be explained by mundane phenomena but the remainder suggest prolonged interaction with our planetary society over a long period. Thieme also knows that when you know you don't know something, don't suggest that you do. Stay with the facts, stay with the data. Sensible conclusions, when we do that, are astonishing enough. Reality, as Philip K. Dick said, will not go away just because we refuse to believe in it.

uk: вхід без авторизації

name: AKA neuralcowboy - UFOs: Misinformation, Disinfo, and the Basic Truth


uk: Комп'ютерні науки

description: All I wanted was a camera to monitor my pumpkin patch for pests, what I found was a wireless security camera that spoke with an accent and asked to speak with my fax machine. Join me as I engage in a signals analysis of the Amiccom 1080p Outdoor Security Camera and hack the signal to reverse engineer the audio tones used to communicate and configure this inexpensive outdoor camera. This journey takes us through spectrum-analysis, APK decompiling, tone generation in Android and the use of Ghidra for when things REALLY get hairy. REFERENCES: - JADX: Dex to Java Decompiler - https://github.com/skylot/jadx - Efficiency: Reverse Engineering with ghidra - http://wapiflapi.github.io/2019/10/10/efficiency-reverse-engineering-with-ghidra.html - Guide to JNI (Java Native Interface) - https://www.baeldung.com/jni - JDSP - Digital Signal Processing in Java - https://psambit9791.github.io/jDSP/transforms.html - Understanding FFT output - https://stackoverflow.com/questions/6740545/understanding-fft-output - Spectral Selection and Editing - Audacity Manual - https://forum.audacityteam.org/viewtopic.php?t=100856 - Get a spectrum of frequencies from WAV/RIFF using linux command line - https://stackoverflow.com/questions/21756237/get-a-spectrum-of-frequencies-from-wav-riff-using-linux-command-line - How to interpret output of FFT and extract frequency information - https://stackoverflow.com/questions/21977748/how-to-interpret-output-of-fft-and-extract-frequency-information?rq=1 - Calculate Frequency from sound input using FFT - https://stackoverflow.com/questions/16060134/calculate-frequency-from-sound-input-using-fft?rq=1 - Introduction - Window Size - https://support.ircam.fr/docs/AudioSculpt/3.0/co/Window%20Size.html - Android: Sine Wave Generation - https://stackoverflow.com/questions/11436472/android-sine-wave-generation - Android Generate tone of a specific frequency - https://riptutorial.com/android/example/28432/generate-tone-of-a-specific-frequency - Android Tone Generator - https://gist.github.com/slightfoot/6330866 - Android: Audiotrack to play sine wave generates buzzing noise - https://stackoverflow.com/questions/23174228/android-audiotrack-to-play-sine-wave-generates-buzzing-noise

uk: вхід без авторизації

name: Why does my security camera scream like a Banshee?


uk: Комп'ютерні науки

description: When we write code, we often run many scanners for different purposes on our code - from linters, to testing, security scanning, secret scanning, and more. Scanning the code occurs on developers' machines and in CI/CD pipelines, which assumes the code is untrusted and unverified and based on this assumption scanners shouldn't have the ability to dynamically run code. Our research focuses on the many static analyzers out there if this is really the case. Many of the scanners allow different ways of interaction - From requesting external resources, overriding the configuration and to remote code execution as part of the process.This talk will be technical and show examples of well-known scanning tools and how we created code that attacks them. TLDR - When integrating and using new tools in our CI systems and especially when running on unverified code, Which tools can we trust and how can we scan safe untrusted code in a secure way? REFERENCES: https://github.com/jonase/kibit/issues/235 - Issue I raised in the past in one of the tools Hiroki Suezawa in a thread in cloud security forum talked about exploiting terraform plan https://cloudsecurityforum.slack.com/archives/CNJKBFXMH/p1584035704035800 This reference was released after I've started my research but nevertheless a good resource and has interesting perspectives and I will reference it: https://alex.kaskaso.li/post/terraform-plan-rce

uk: вхід без авторизації

name: Abusing SAST tools: When scanners do more than just scanning


uk: Комп'ютерні науки

description: Since the late great Barnaby Jack gave us “Jack Potting” in the late 2000s, there have been several talks on ATM network attacks, USB port attacks, and digital locks attacks which apply to several brands of ATM safes. In this session, I’ll discuss and demonstrate how most of these known attack vectors have been remediated, while several fairly simple attacks against the machine and the safe still remain. We’ll dive into how ATMs work, the steps I went through to become a “licenced ATM operator” which enabled my research, and how I identified the vulnerabilities. I’ll show how, with very little technical expertise and 20 minutes, these attacks lead directly past “secure” and allow attackers to collect a lot more than $200. REFERENCES Barnaby Jack - “Jackpotting Automated Teller Machines” - (2010) from DEFCON - https://www.youtube.com/watch?v=FkteGFfvwJ0 Weston Hecker - “Hacking Next-Gen ATM's From Capture to Cashout” - (2016) from DEFCON - https://www.youtube.com/watch?v=1iPAzBcMmqA Trey Keown and Brenda So - “Applied Cash Eviction through ATM Exploitation” (2020) from DEFCON - https://www.youtube.com/watch?v=dJNLBfPo2V8 Triton - “Terminal Communications Protocol And Message Format Specification” (2004) from Complete ATM Services - tinyurl.com/7nf2fdy5 Rocket ATM - “Hyosung ATM Setup Part 1 - Step by Step” (2018) from Rocket ATM - https://www.youtube.com/watch?v=abylmrBkOGM&t=3s Rocket ATM - “Hyosung ATM Setup Part 2 - Step by Step” (2018) from Rocket ATM - https://www.youtube.com/watch?v=IM9ZG46fwL8 Hyosung - “NH2600 Service Manual v1.0” (2013) From Prineta - https://tinyurl.com/c6jd4hd9 Hyosung - “NH2700 Operator Manual v1.2” (2010) From AtmEquipment.com - https://tinyurl.com/rp2cad8

uk: вхід без авторизації

name: No Key? No PIN? No Combo? No Problem! P0wning ATMs For Fun and Profit


PINATA PIN Automatic Try Attack

uk: Комп'ютерні науки

description: A brute force attack is a trial-and-error method used to obtain information such as user passwords or personal identification numbers (PINs). This attack methodology should be impossible to apply to the actual secured EMV bank cards. In this talk, we will analyze how an inadequate implementation could rely on an extreme and sophisticated PIN brute force attack against 10,000 combinations from 4 digit PIN that could affect millions of contact EMV cards.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: The DEF CON 27 badge employed an obscure form of wireless communication: Near Field Magnetic Inductance (NFMI). The badges were part of a contest and while poking through the firmware for hints I noticed a buffer overflow flaw. All it required to exploit it was an oversized packet… via a chip with no datasheet and no documentation on the proprietary protocol. Thus started a 2 year odyssey. I used Software Defined Radio tools to study the signal’s modulations. I built a receiver in GNURadio and Python to convert signals into symbols, symbols obfuscated by a pattern that I had to deduce while only controlling a fraction of the bytes. Data was encoded in those symbols using proprietary convolution for even bits and Trellis Code Modulation for odd bits. I then reversed their bizarre CRC and wrote tools to craft and send packets. Using those tools I chained bugs in 2 chips and remotely crashed the badge. However, limitations in the NFMI protocol made more sophisticated attacks impossible. But after a year and a half invested, I was not about to give up. I soldered leads to middle layer traces, extracted and reverse engineered the NFMI firmware, fixed their protocol, and patched a badge FW to patch the NFMI FW. At long last I achieved what may be the world’s first, over-the-air, remote code exploit via NFMI.

uk: вхід без авторизації

name: OTA remote code execution on the DEF CON 27 badge via NFMI


uk: Комп'ютерні науки

description: Honoring the term, the variety of technologies in the Big Data stack is hugely BIG. Many complex components in charge of transport, storing, and processing millions of records make up Big Data infrastructures. The speed at which data needs to be processed and how quickly the implemented technologies need to communicate with each other make security lag behind. Once again, complexity is the worst enemy of security. Today, when conducting a security assessment on Big Data infrastructures, there is currently no methodology for it and there are hardly any technical resources to analyze the attack vectors. On top of that, many things that are considered vulnerabilities in conventional infrastructures, or even in the Cloud, are not vulnerabilities in this stack. What is a security problem and what is not a security problem in Big Data infrastructures? That is one of the many questions that this research answers. Security professionals need to count on a methodology and acquire the necessary skills to competently analyze the security of such infrastructures. This talk presents a methodology, and new and impactful attack vectors in the four layers of the Big Data stack: Data Ingestion, Data Storage, Data Processing and Data Access. Some of the techniques that will be exposed are the remote attack of the centralized cluster configuration managed by ZooKeeper; packet crafting for remote communication with the Hadoop RPC/IPC to compromise the HDFS; development of a malicious YARN application to achieve RCE; interfering data ingestion channels as well as abusing the drivers of HDFS-based storage technologies like Hive/HBase, and platforms to query multiple data lakes as Presto. In addition, security recommendations will be provided to prevent the attacks explained. REFERENCES: I plan to release a white paper at the conference, in the white paper there will be all the references. Anyway, as the attacks are novel, the references are related to infrastructure stuff mostly, not so much about security.

uk: вхід без авторизації

name: The Unbelievable Insecurity of the Big Data Stack


uk: Комп'ютерні науки

description: We present a novel class of DNS vulnerabilities that affects multiple DNS-as-a-Service (DNSaaS) providers. The vulnerabilities have been proven and successfully exploited on three major cloud providers including AWS Route 53 and may affect many others. Successful exploitation of the vulnerabilities may allow exfiltration of sensitive information from service customers' corporate networks. The leaked information contains internal and external IP addresses, computer names, and sometimes NTLM hashes. The number of organizations vulnerable to this weakness is shocking. Over a few hours of DNS sniffing, we received sensitive information carried by DNS update queries from ~1M Windows endpoints from around 15,000 potentially vulnerable companies, including 15 Fortune 500 companies. In some organizations, there were more than 20,000 endpoints that actively leaked their information out of the organization. We will review possible mitigations to this problem and solutions for both DNSaaS providers and managed networks. REFERENCES: I. Microsoft Windows DNS Update algorithm explained - https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-dns-dynamic-updates-windows-server-2003 II. An excellent blog post by Matthew Bryant on hijacking DNS Updates abusing a dangling domain issue on Guatemala State's Top Level Domain - https://thehackerblog.com/hacking-guatemalas-dns-spying-on-active-directory-users-by-exploiting-a-tld-misconfiguration/

uk: вхід без авторизації

name: New class of DNS Vulns Affecting DNS-as-Service Platforms


uk: Комп'ютерні науки

description: Contact Sick Codes on Twitter: https://twitter.com/sickcodes How I hacked the entire American Food Supply Chain over the course of 3 months, assembled a team of hacker strangers, and how we used a "full house" of exploits on almost every aspect of the agriculture industry. See the process in which it happened, the private exploits we used, the vectors we attacked from, and how it could happen again, or be happening right now. How the ongoing analytics arms race affects everyone, and how Tractor companies have metastasized into Tech companies, with little to no cyber defenses in place. Learn how farms are not like they used to be; telemetry, crop & yield analytics, and more telemetry. REFERENCES: https://github.com/sickcodes/Docker-OSX https://github.com/sickcodes/osx-serial-generator https://www.vice.com/en/article/akdmb8/open-source-app-lets-anyone-create-a-virtual-army-of-hackintoshes https://www.bleepingcomputer.com/news/security/python-also-impacted-by-critical-ip-address-validation-vulnerability/ https://sick.codes/sick-2021-012/ https://sick.codes/sick-2021-031/ https://sick.codes/leaky-john-deere-apis-serious-food-supply-chain-vulnerabilities-discovered-by-sick-codes-kevin-kenney-willie-cade/ https://www.vice.com/en/article/4avy8j/bugs-allowed-hackers-to-dox-all-john-deere-owners https://www.youtube.com/watch?v=rB_SleNKBus wabaf3t https://twitter.com/wabafet1 D0rkerDevil https://twitter.com/D0rkerDevil ChiefCoolArrow https://twitter.com/ChiefCoolArrow johnjhacking https://twitter.com/johnjhacking rej_ex https://twitter.com/rej_ex w0rmer https://twitter.com/0x686967 https://climate.com/press-releases/transform-data-into-value-with-climate-fieldview/14 https://www.agriculture.com/news/business/john-deere-to-acquire-precision-plting_5-ar50937 https://www.reuters.com/article/us-monsanto-m-a-deere-idUSKBN17X2FZ https://twitter.com/sickcodes/status/1385218039734423565?s=20

uk: вхід без авторизації

name: The Agricultural Data Arms Race - Exploiting a Tractor Load of Vulns


uk: Комп'ютерні науки

description: Since 2007, Amazon has sold tens of millions of Kindles, which is impressive. But this also means that tens of millions of people can be hacked through a software bug in those same Kindles. Their devices can be turned into bots, their private local networks can be compromised, and perhaps even information in their billing accounts can be stolen. The easiest way to remotely reach a user's Kindle is through an e-book. A malicious book can be published and made available for free access in any virtual library, including the Kindle Store, or sent directly to the end-user device via Amazon services. While you might not be happy with the writing in a particular book, nobody expects to download one that is malicious. No such scenarios have been publicized. Antiviruses do not have signatures for e-books. But... we succeeded in making a malicious book for you. If you open this book on a Kindle device, it causes a hidden piece of code to be executed with root rights. From this moment on, you lost your e-reader, account and more. Want to know the details?

uk: вхід без авторизації

name: I know how to take over your Kindle with an e-book


Fuzzing Linux with Xen

uk: Комп'ютерні науки

description: Last year we've successfully upstreamed a new feature to Xen that allows high-speed fuzzing of virtual machines (VMs) using VM-forking. Recently through collaboration with the Xen community external monitoring of VMs via Intel(r) Processor Trace has also been upstreamed. Combined with the native Virtual Machine Introspection (VMI) capability Xen now provides a unique platform for fuzzing and binary analysis. To illustrate the power of the platform we'll present the details of a real-world fuzzing operation that targeted Linux kernel-modules from an attack-vector that has previously been hard to reach: memory exposed to devices via Direct Memory Access (DMA) for fast I/O. If the input the kernel reads from DMA-exposed memory is malformed or malicious - what could happen? So far we discovered: 9 NULL-pointer dereferences; 3 array index out-of-bound accesses; 2 infinite-loops in IRQ context and 2 instances of tricking the kernel into accessing user-memory but thinking it is kernel memory. The bugs have been in Linux for many years and were found in kernel modules used by millions of devices. All bugs are now fixed upstream. This talk will walk you through how the bugs were found: what process we went through to identify the right code-locations; how we analyzed the kernel source and how we analyzed the runtime of the kernel with Xen to pinpoint the input points that read from DMA. The talk will explain the steps required to attach a debugger through the hypervisor to collect kernel crash logs and how to perform triaging of bugs via VM-fork execution-replay, a novel technique akin to time-travel debugging. Finally, we'll close with the release of a new open-source tool to perform full-VM taint analysis using Xen and Intel(r) Processor Trace. REFERENCES: https://github.com/intel/kernel-fuzzer-for-xen-project https://www.youtube.com/watch?v=3MYo8ctD_aU

uk: вхід без авторизації


Hacking the Apple AirTags

uk: Комп'ютерні науки

description: Apple’s AirTags enable tracking of personal belongings. They are the most recent and cheapest device interacting with the Apple ecosystem. In contrast to other tracking devices, they feature Ultrawide-band precise positioning and leverage almost every other Apple device within the Find My localization network. Less than 10 days after the AirTag release, we bypassed firmware protections by glitching the nRF52 microcontroller. This opens the AirTags for firmware analysis and modification. In this talk, we will explain the initial nRF52 bypass as well as various hacks built on top of this. In particular, AirTags can now act as phishing device by providing malicious links via the NFC interface, be cloned and appear at a completely different location, used without privacy protections that should alert users as tracking protection, act as low-quality microphone by reutilizing the accelerometer, and send arbitrary data via the Find My network. Besides these malicious use cases, AirTags are now a research platform that even allows access to the new Ultrawide-band chip U1. REFERENCES: LimitedResults nRF52 APPROTECT Bypass: https://limitedresults.com/2020/06/nrf52-debug-resurrection-approtect-bypass/ Positive Security’s Send My Research for sending arbitrary data via the find my network: https://positive.security/blog/send-my Colin O’Flynn’s notes on the AirTag Hardware: https://github.com/colinoflynn/airtag-re

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Microsoft Exchange Server is one of the most famous mail servers in the world. It not only stores a large amount of sensitive corporate information, but also plays an important role in Microsoft Active Directory, so it has become a high-value target for both APT groups and red teams. In the past few months, some high-risk vulnerabilities in Exchange Server have been exposed, which mainly target vulnerable ASP.NET code. But the architecture of Exchange Server is complicated, and its attack surface is not limited to ASP.NET, this talk will analyze and attack Exchange Server from a different perspective. I will share the following two new vulnerabilities I found, as well as the new attack surfaces and how I chained several techniques to successfully exploit them in detail. 1. One of them can result in arbitrary mailbox takeover, attackers can read emails, download attachments, send emails, etc. as any Exchange user. 2. The other can lead to remote code execution on Exchange Server, attackers can gain local administrator privileges and execute arbitrary commands. Furthermore, there is an interesting point, even if you have applied the latest Exchange Server patches, your Exchange Server may still be compromised by this type of attack. For red teams, Exchange Server RCE is only the beginning. Usually, there are some high-privileged domain users and groups on Exchange Server, I will also introduce a new method in depth to help you perform lateral movement and even privilege escalation to Domain Admin after achieving Exchange Server RCE. These vulnerabilities have been reported to MSRC and the exploit tools will be released after the talk.

uk: вхід без авторизації

name: Vulnerability Exchange: One Domain Account for More Than Exchange Server


Timeless Timing Attacks

uk: Комп'ютерні науки

description: 25 years ago, the first timing attacks against well-known cryptosystems such as RSA and Diffie-Hellman were introduced. By carefully measuring the execution time of crypto operations, an attacker could infer the bits of the secret. Ever since, timing attacks have frequently resurfaced, leading to many vulnerabilities in various applications and cryptosystems that do not have constant-time execution. As networks became more stable and low-latency, it soon became possible to perform these timing attacks over an Internet connection, potentially putting millions of devices at risk. However, attackers still face the challenge of overcoming the jitter that is incurred on the network path, as it obfuscates the real timing values. Up until now, an adversary would have to collect thousands or millions of measurements to infer a single bit of information. In this presentation, we introduce a conceptually novel way of performing timing attacks that is completely resilient to network jitter. This means that remote timing attacks can now be executed with a performance and accuracy that is similar as if the attack was performed on the local system. With this technique, which leverages coalescing of network packets and request multiplexing, it is possible to detect timing differences as small as 100ns over any Internet connection. We will elaborate on how this technique can be launched against HTTP/2 webservers, Tor onion services, and EAP-pwd, a popular Wi-Fi authentication method. REFERENCES: See page 15 to 17 in our paper for a list of references: https://www.usenix.org/system/files/sec20-van_goethem.pdf

uk: вхід без авторизації


uk: Комп'ютерні науки

description: In 2020, security researchers reported a record number of Windows vulnerabilities. We were curious what superpowers will we get from researching this huge number of vulnerabilities? Can we leverage our findings to discover 0-days? We decided to go back in time to 2016 to search for patterns and automatically classify all the public vulnerabilities since then. We believed that only by connecting the dots to a bigger picture, we will be able to come back 2021 with the success of achieving our goal. We adopted a new approach, in terms of both the goal and how to get there. Until now, the main goal of patch-diff was focused on the root cause of the vulnerability and building a 1-day to exploit it Usually patch-diff was done manually on a single patch. We reached higher for the holy grail. We understood that in order to find 0-days we needed to build an automated process that would gather all the insights from all the patches in a single, searchable db. It worked! We discovered the root causes of multiple classes of vulnerabilities. We used these discoveries on a fully patched Windows 10 host in order to highlight opportunities for exploitation. As a consequence, we found and reported (1) 6 information disclosure vulnerabilities to Microsoft, (2) 2 post exploitation techniques allowing covert exfiltration of private user data, and (3) an additional surprise. In this presentation, we'll describe our research process, demonstrate a live exploitation of the vulnerabilities we found, share the tools we developed, and explain how other researchers can use it to discover 0-days.

uk: вхід без авторизації

name: Back to the Future: Our journey back to the future of Windows vulnerabilities and the O-days we brought back with us


uk: Комп'ютерні науки

description: It's a tale as old as time: a graduating senior needs two more courses to graduate, but the lectures happen to be scheduled at the same time and the school's new high-tech wireless attendance tracking system makes it impossible to attend both courses... in theory. By reverse-engineering the attendance devices and emulating them using a hidden Arduino, the system can be tricked into giving attendance credit for both courses without being physically present. It's a real-life "time turner," allowing him to be in two places at once. REFERENCES: https://github.com/wizard97/iSkipper/releases/download/v1.0.0/iskipper.pdf https://courses.ece.ubc.ca/cpen442/termproject/reports/2010/iclicker.pdf https://people.ece.cornell.edu/land/courses/ece4760/FinalProjects/f2015/cs886_kdv8/cs886_kdv8/cs886_kdv8/index.html https://github.com/wizard97/iSkipper https://github.com/charlescao460/iSkipper-Software

uk: вхід без авторизації

name: Time Turner: Hacking RF Attendance Systems (To Be in Two Places at Once)


uk: Комп'ютерні науки

description: Due current global issues of 2020, organizations have been forced to make changes in how their business model operates and as such, have opened the doors to remote working. Microsoft SharePoint is one of the most popular and trusted Content Management System's (CMS) deployed today. The product is used to share and manage content, internal knowledge with embeded applications to empower teamwork and seamlessly collaborate across an organization for a truly remote experience. After the efforts of countless talented engineers in Microsoft, SharePoint has been deployed in the Microsoft cloud as part of their office 365 offering. This presentation will analyze the security architecture of SharePoint server and how it differs from other popular CMS products. From an offensive point of view, we will also reveal several attack surfaces and mitigations implemented and how those mitigations can be bypassed. Finally we will disclose several high impact vulnerabilities detailing the discovery and exploitation. REFERENCES: 1. http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/ 2. https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.control 3. https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms524602(v=vs.90) 4. https://www.youtube.com/watch?v=Xfbu-pQ1tIc 5. https://www.blackhat.com/us-20/briefings/schedule/#room-for-escape-scribbling-outside-the-lines-of-template-security-20292 6. https://www.spguides.com/sharepoint-csom-tutorial/

uk: вхід без авторизації

name: Don't Dare to Exploit: An Attack Surface Tour of SharePoint Server


uk: Комп'ютерні науки

description: Over recent years, there has been a huge boom in open-source C2 frameworks hitting the information security space. So much so they made a website and a logo - that’s how you know things are serious! Such a trend naturally drives more people towards taking on the gauntlet but all too often it becomes an insurmountable challenge and another dashed dream of the aspiring red teamer, or veteran alike. Believe me when I say - I’ve been there. I’ve felt the pain, the frustration, the imposter syndrome. Heck, I still do. However, I’ve (mostly) come out the other side with some hard learned lessons. Those lessons are the subject of this talk. The goal is not to write or provide code. We shall discuss how to approach initial design ideas; decide what is important and what is not; anticipate and deal with potential problem areas; consider different use cases and perspectives; and more. If you are interested in building your own C2 framework, contributing to existing frameworks, or even software development in general, there’s something in this talk for you.

uk: вхід без авторизації

name: Adversary Village - Designing a C2 Framework


Adversary Village - Prelude Operator

uk: Комп'ютерні науки

description: Prelude Operator is the new kid to the adversary emulation block party. Built by the same people who designed and built the MITRE Caldera framework, Operator is a free and largely open-source desktop platform that aims to make adversary emulation accessible to smaller organizations. The app includes a library of RATs (agents) which can deploy into the field and supports a modular architecture of plugins and network protocols, including hundreds of TTPs mapped to ATT&CK. In this tool demonstration, we will highlight the key features of Operator and empower people to walk away with a developer-first adversary emulation desktop platform that is end-to-end free & open-source.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Threat actors build their tradecraft for each campaign, they need to select the right tactics, techniques. Most of the time they use open source or commercial, but publicly available tools. They even re-purpose or pack existing malware acquired from other threat actors. The reason behind of this decision is tool development takes time, and if the known/current tools already work well, they don’t need upgrades either. However, the adversary simulation specialists need to operate in safer environments, therefore, they’re not allowed to use malicious tradecraft or unknown tools in general. Tradecraft development is an essential skills for an adversary simulation specialist as it needs custom C2 protocols, implants, safer but realistic Mitre Att&ck TTPs, and finally cutting-edge evasions for the modern security controls including EDRs and Cyber Analytics. In this workshop, we’ll walk through reasons and ways of Tradecraft development, talk about where to start, and to go, finding example source codes, walking through the source code of existing C2s, implants, and draft tools. We’ll also discuss about weaponization techniques such as offensive pipelines, modern evasions techniques and tool integrations. Duringthe exercises, we’ll prefer C# for programming, but you can replicate what you learn in various languages after this workshop (e.g. Python, Go, Rust). During the workshop, the participants will be able to develop their own implants, C2s, evasions and more using examples and active tools such as Petaq Purple Team C2 and Malware, TA505+ Adversary Simulation Pack and Tehsat Malware Traffic Generator

uk: вхід без авторизації

name: Adversary Village - Tradecraft Development in Adversary Simulations


uk: Комп'ютерні науки

description: Evolving endpoint protection software with enhanced detection capabilities and greater visibility coverage have been taking red team and purple team operation’s complexity to a higher level. The current situation forces adversaries to take precautions and invest much more time in the weaponization phase to overcome prevention and detection mechanisms. The community has adapted CI/CD pipelines to automate tasks related to offensive tools weaponization. Offensive CI/CD pipelines have been around for a couple of years, with the goal of helping red teams to automate offensive tools creation and evasion techniques implementation. As part of this evolution, we designed and built our own offensive CI/CD pipeline framework that is simple to use, modular, self-managed, automated, collaborative, and fast. Our framework leverages Infrastructure as Code (IaC) to fully automate the deployment of our offensive CI/CD pipeline framework with built in recipes for evading host and network detections. Each recipe is modular and can be customized to fit red team or purple team requirements, such as proprietary techniques or imitation of specific threat actor TTPs.The framework leverages Gitlab CI/CD in conjunction with Kubernetes cluster to automate and manage the process of building and deploying offensive tools at scale. In this talk, we will discuss the essentials of offensive pipeline and present our innovative approach, while referring to the challenges we solved, and demonstrate how you can leverage our offensive CI/CD framework to empower red team and purple team operations.

uk: вхід без авторизації

name: Adversary Village - Scaling Up Offensive Pipelines: Infrastructure Automation


uk: Комп'ютерні науки

description: It is not viable for system administrators and defenders in a large Active Directory (AD) environment to ensure all AD objects have only the exact permissions they need. Microsoft also realised that, why they recommended organizations to implement the AD tier model: Split the AD into three tiers and focus on preventing attack paths leading from one tier to a more business critical tier. The concept is great, as it in theory prevents adversaries from gaining access to the server tiers (Tier 1 and 0) when they have obtained a shell on a workstation (Tier 2) i.e. through phishing, and it prevents adversaries from gaining access to the Domain Admins, Domain Controllers, etc. in Tier 0 when they have got a shell on a web server i.e. through an RCE vulnerability. But it turns out to be rather difficult to implement the tiering concept in AD, why most organizations fail it and end up leaving security gaps. It doesn’t help on the organization’s motivation to make sure their tiering is sound, when Microsoft now call it the AD tier model “legacy” and have replaced it with the more cloud-focused enterprise access model: https://docs.microsoft.com/en-us/security/compass/privileged-access-access-model#evolution-from-the-legacy-ad-tier-model As a person hired to help identify the vulnerabilities in an organization, you want to find and report the attack paths of their AD. BloodHound is well-known and great tool for revealing some of the hidden and often unintended relationships within an AD environment and can be used to identify highly complex chained attack paths that would otherwise be almost impossible to identify. It is great for finding the shortest attack path from a compromised user or computer to a desired target, but it is not built to find and report attack paths between tiers.. I will in my presentation explain and demonstrate a tool I have created called ImproHound, which take advantage of BloodHound’s graph database to identify and report the misconfigurations and security flaws that breaks the tiering of an AD environment. ImproHound is a FOSS tool and available on GitHub: https://github.com/improsec/ImproHound

uk: вхід без авторизації

name: Adversary Village -Tool Demo: ImproHound Identify AD Tiering Violations


uk: Комп'ютерні науки

description: Adversaries have been continuously improving their malware to be stealthier and more resilient on both the victim’s host as well as on the network.Examples of these innovations on the latter include Fast Flux networks, Domain Generation Algorithms and Domain Fronting among other techniques. Unfortunately, open source tools for threat emulation currently have limited support for such advanced features, leaving redteams with easy to detect C2 communications. We present C2Centipede, a proxy tool that provides these features to HTTP reverse shell tools (like Metasploit or Empire) to be stealthier on the network by dynamically and transparently modifying the trojan’s C2 communication routing and beaconing strategies, with the aim of evading some of the blueteam’s detection strategies.

uk: вхід без авторизації

name: Adversary Village - C2Centipede APT level C2 communications for common reverse HTTP shell toos


uk: Комп'ютерні науки

description: Game Theory is the study of choices and strategies made by rational actors, called "players," in competitive situations, and it offers us a way to study and map human conflict. Statisticians use game theory to model war, biology, and even football. We will model the choices and behavior demonstrated by real-world adversarial conflict. Usingthese models, we will discuss how players form strategies and how other actors can influence those strategies. The talk will begin with an overview of game-theoretic modeling and its application to adversary behavior. Using the Prisoner's Dilemma as an example, we will look at how to model and analyze a single game. We can then model repeated interactions and demonstrate how "players" can influence each other's choices. These models will lay the foundations we need to look at more realistic adversary conflict. Next, we are going to look at how players can exploit information asymmetry. Emerging techniques such as dynamic honeynets and virtual attack surfaces both investigate attackers while manipulating their beliefs. We will build a Signaling Game model to show how defenders can credibly deceive adversaries. Using this model, we will look at a scenario where a defender observes multiple attacker movements within a network. While sustained engagement can help the defender learn more about the attacker and provide them false information, it comes at the risk of added exposure. In this scenario, there is a trade-off between information gained and short-term security. This talk will not look at network topology or protocols but will instead look at information exchange and strategy. We will then apply the same models to an adversarial perspective. Sustained engagement with a defender can provide an attacker with information and the opportunity to deceive defenders. However, that comes with a risk. How does an attacker's strategy change when a defender can eject them from the network at any time? By analyzing conflict where strategy and choices determine the outcome, we learn more about how to understand others' tactics and influence them with our own decisions.

uk: вхід без авторизації

name: Adversary Village - Game Theory: Understanding and Strategy and Deception


uk: Комп'ютерні науки

description: Blue teams and CERTs are increasingly better equipped and better trained. At the same time offensive infrastructures are increasingly diverse in components and growing in size. This makes it a lot harder for red teams to keep oversight but also a lot easier for blue teams to react on the traces that red teams leave behind. However, do blue teams really know what traces _they_ leave behind when doing their investigation and analyses? RedELK was created and open sourced to help red teams with these two goals: 1) make it easy to have operational oversight, 2) abuse blue team OPSEC failures. Come to this talk to learn about blue team detection and how RedELK can help you.

uk: вхід без авторизації

name: Adversary Village - Exploiting Blue Team OPSEC Failures with RedELK


uk: Комп'ютерні науки

description: Advanced Persistent Threat. Where did this term come from? What does it really mean? Exactly how can you determine that it is a "nation state" as opposed to a run-of-the-mill attack? All of this will be explained in detail. As an example, I will use an actual attempt against my home system, with a review of collected data to illustrate the whole APT thing. There are differences in how APT actors approach things, and this will be discussed from the perspective of someone who attacked plenty of systems in their youth - me. We'll talk about how APT differs from Red Teaming and Penetration Testing, and if you are trying to simulate it you need to throw the rulebook out of the window to do it right.

uk: вхід без авторизації

name: Adversary Village - A Short History and An Example Attack


uk: Комп'ютерні науки

description: Endpoint Detection and Response (EDR) have become the punching bags of the security world. Attackers employ sophisticated techniques to circumvent these controls and as a result, there has been a driving need for defenders to detect and prevent these attacks... but are they sufficient? This talk will go over all the operational considerations and tradecraft theory I've developed over the past few years when evading EDRs and other endpoint controls. This will primarily focus on techniques to ensure command and controls servers are not easily detected and contain virtually no Indicators of Compromise. This talk will then deep dive into the inner workings of the EDR bypassing framework ScareCrow,highlighting some of the lesser-known techniques and new features that are available to red teamers and pentesters. By the end of this talk, the audience should walk away with a detailed understanding of how to use ScareCrow and other opsec considerations to avoid being detected by endpoint controls and blue teams.

uk: вхід без авторизації

name: Adversary Village - Operation Bypass Catch My Payload If You Can


uk: Комп'ютерні науки

description: Defending enterprise networks against attackers continues to present a difficult challenge for blue teams. Prevention has fallen short; improving detection & response capabilities has proven to be a step in the right direction. However, without the telemetry produced by adversary behavior, building new and testing existing detection capabilities will be constrained. PurpleSharp is an open source adversary simulation tool written in C# that executes adversary techniques within Windows Active Directory environments. The resulting telemetry can be leveraged to measure and improve the efficacy of a detection engineering program. PurpleSharp leverages the MITRE ATT&CK Framework and executes different techniques across the attack life cycle: execution, persistence, privilege escalation, credential access, lateral movement, etc

uk: вхід без авторизації

name: Adversary Village - PurpleSharp Automated Adversary Simulation


uk: Комп'ютерні науки

description: It is truly amazing how many and diverse methods an attacker has to "call home", exfiltrate information, or coordinate the next steps in his chain of attack. In this talk we will demonstrate (and automate) the most wacky, unexpected, and interesting methods for setting up a C2 server: Messaging apps? social media profiles? video games or gaming platforms? Yes, and there's more. The more sacred and innocent an app appears to be, the higher the score for us when weaponizing it. We will explain from scratch the function, the construction and even the automation with Ruby and Python of C2 servers based on a wide range of applications of common and daily use. For this we will use a fake toy ransomware, which will try to call home, exfiltrate information and coordinate an attack in the most crazy,bizarre and above all ... unexpected ways. Lots of short demos make this talk suitable to both newcomers and experienced people.

uk: вхід без авторизації

name: Adversary Village - Everything is a C2 if you're brave


uk: Комп'ютерні науки

description: The adversary philosophy and mindset are important when trying to emulate a threat actor during a red team operation or offensive cybersecurity assessment or trying to understand them as a defender. In this talk we will take a look at the philosophy and mindset of an adversary as well as what motivates them.

uk: вхід без авторизації

name: Adversary Village - The Way of The Adversary: Threat Actor Philosophies & Mindsets


uk: Комп'ютерні науки

description: Adversary Emulation is quickly becoming a hot topic in information security, and there is a good reason for it. Security analysts, threat hunters, and incident responders are constantly facing an onslaught of old and new threats. How can defenders properly prepare for the ever-changing threat landscape, improve their skill set, and improve the security posture of their organization? In this presentation I'll answer those questions by covering: The various forms of Adversary Emulation, where/how it fits into Security Operations, Threat Intelligence, the benefits of using it as a Blue Team training tool, and how to get started!

uk: вхід без авторизації

name: Adversary Village - Look at me I'm the adversary now: introduction to adversary emulation and its place in security operations


uk: Комп'ютерні науки

description: Have you ever wondered what phishing strategy real world APTs use? And how these compare with the scenarios that you use during your Red Team / social engineering activities? If you did, you probably found out that there's a lot of research about APT techniques, tactics and procedures, like the use of specific malware or attack vectors, but there are not many public resources on which techniques those attackers actually use to convince a non-suspecting person to aid them in their operation. In this talk an analysis is presented of hundreds of phishing emails that were used in real campaigns. All characteristics of an email, like the method of influence, tone of speech and used technologies are classified and measures how well a phishing campaign is designed, scoring from “obvious spam” to “near-realistic original mail”. By comparing and measuring the state of these phishing emails,we can learn more about how certain groups operate and how much “effort” they put into their scenarios. This is important knowledge for both attackers and defenders. If you want to know how to phish like you’re an APT, then this talk is for you. Spoiler alert: you might already be a better phisher than these groups.

uk: вхід без авторизації

name: Adversary Village - Phish Like An APT: Phenomenal pretexting for persuasive phishing


uk: Комп'ютерні науки

description: Most businesses today use hybrid cloud and many of us will retire before companies fully migrate to the cloud. Cloud identity service Azure AD provides protection from advanced cybersecurity attacks, but what additional challenges appear when integrating with on-prem AD? Let's check that out in advanced scenario-based session, Live demos only.

uk: вхід без авторизації

name: Adversary Village - From OnPrem to the Cloud: Hybrid AD Attack Path


uk: Комп'ютерні науки

description: This talk covers the basics of credentials reconnaissance performed for a red team. Mostly covers the reconnaissance performed on GitHub to search for leaked passwords by developers. The current toolset and the Shiny new GitHub Credentials Stroller which dives into each repository and performs a deep scan.

uk: вхід без авторизації

name: Adversary Village - Red Team Credentials Recon: OLD with a TWIST


uk: Комп'ютерні науки

description: See autonomous lateral movement in a live environment. In this Linux-based attack, multiple benign behaviors - each designed not to be detected - are chained together to complete a lateral movement action. Using a creative approach to parsing indicators of compromise out of RAT responses and injecting them automatically into commands later down the kill chain, this lateral movement demonstration will be fully hands-off. The techniques and TTPs in this demonstration will be made open-source following the talk.

uk: вхід без авторизації

name: Adversary Village - Autonomous Lateral Movement


uk: Комп'ютерні науки

uk: вхід без авторизації

name: The Black Box and the Brain Box: When Electronics and Deception Collide


Adversary Village - Village Kick Off

uk: Комп'ютерні науки

description: Adversary Village at DEF CON 29 kick-off session!

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Local privilege escalation techniques are far beyond checking the Windows/Kernel version, looking for unquoted service paths or checking SUID binaries. Moreover, a local privilege escalation could make a huge difference when trying to comprise a domain. Several tools have been created to find possible privilege escalation paths, but most of the tools for Red Team and Pentesting just check for a few possible ways, so pentesters need to use several tools and do some manual recon to check for everything. PEASS is a compilation of a bash script for Linux/MacOS/*nix and a .Net project and a batch script for Windows that I have created some time ago which aims to check and highlight every possible privescpath so professionals don’t need to execute several different tools for this purpose and can very easily find vulnerabilities. During this talk I would like to present PEASS-ng. The architecture of these scripts has evolved and improved so much that I would like to present how they work at the moment and how the difficulty to collaborate with the project has been reduced significantly. Moreover, I would also like to present the 2 new PEAS that haven't been present anywhere yet: BotPEAS and WebPEAS (the latest one will be released the day of the talk). During the talk I will also present my local privilege escalation resources (https://book.hacktricks.xyz/linux-unix/privilege-escalation , https://book.hacktricks.xyz/windows/windows-local-privilege-escalation) so the attended will be able to continue learning about the topic after the talk.

uk: вхід без авторизації

name: Adversary Village - New Generation of PEAS


uk: Комп'ютерні науки

description: State-sponsored threat actors have engaged in software supply chain attacks for longer than most people realize, as governments seek out access to information and potential control. Of Russia, North Korea and Iran, China has been behind the most attacks, targeting the technology sector for economic espionage and intellectual property theft. In their current drive for innovation and cloud migration, organizations increasingly rely on software development and all its dependencies: third-party code, open - libraries andshared repositories. Recent attacks have shown how easy it is to create confusion and send malicious code undetected through automated channels to waiting recipients. This talk will walk attendees through the stages of past attacks by Chinese APTs - notably APT10, APT17 and APT41- to show how capabilities have evolved and what lessons could be applied to recent attacks, comparing tactics, techniques and procedures.

uk: вхід без авторизації

name: Adversary Village - Signed, Sealed, Delivered Comparing Chinese APTs


ODC Conference 2021 - Welcome Day One

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Alexander Jacob coordinates the research group Advanced Computing for Earth Observation, within the Institute for Earth Observation at EURAC Research. He did his undergraduate studies in Geodesy at TU Darmstadt in Germany and continued with specialization with a MSc and PhD studies in geoinformatics from the Royal Institute of Technology in Stockholm, Sweden. He is an expert in earth observation and data science and is currently working on standardizing and improving access to cloud processing facilities and organization of earth observation data into data cubes. He is an active project manager for EURAC Research’s contribution to the ESA openEO Platform project and the PI of the ESA SAR2CUBE project. He has been actively involved in the original openEO H2020 project as well, coordinating and developing the back-end implementation of Eurac Research. Matthias Mohr is a software architect at the Institute for Geoinformatics in Münster and Technical Fellow for the Radiant Earth Foundation. He is primarily working for the openEO Platform project and is also a main contributor to the STAC specification and ecosystem. He is the openEO Project Steering Committee chair and a STAC Project Steering Committee member.

uk: вхід без авторизації

name: An API for Standardised Access and Processing of EO Data


uk: Комп'ютерні науки

description: Dr. Brian Killough has 34 years of NASA experience and leads the Committee on Earth Observing Satellites (CEOS) Systems Engineering Office. The SEO supports the international CEOS organization coordinating satellite earth observation data for global benefit. Dr. Killough has played a significant role in the evolution of the Open Data Cube initiative and the development of several country-level and regional data cube initiatives. Dr. Killough received his BS degree from the University of Virginia, his MS degree from George Washington University and his PhD from the College of William and Mary.

uk: вхід без авторизації

name: Keynote Session: EO at the Edge Introduction


uk: Комп'ютерні науки

description: This workshop is designed to provide an introduction and demonstration of how to load data and manipulate it in the Digital Earth Africa Sandbox environment. We'll use this environment as there is no installation required and data is already available. The workshop is designed for people who are new to programming or new to ODC. Please see the accompanying documentation for this workshop to follow through here: https://gist.github.com/caitlinadams/93eccb5bddef8423459ea74498db6d62

uk: вхід без авторизації

name: Exploring Earth observation data in the ODC workshop


uk: Комп'ютерні науки

description: Claire Krause is the Assistant Director of Product Development in Digital Earth Australia; Geoscience Australia’s satellite imagery program. She is responsible for working with stakeholders to develop ideas and workflows for using our wealth of satellite information to better inform decision makers on Australia’s natural resources, with a particular focus on water.

uk: вхід без авторизації

name: Tour of the ODC: Digital Earth Australia


Ladies of Landsat

uk: Комп'ютерні науки

description: Dr. Kate Fickas is a remote sensing ecologist who uses earth observation to help natural resource and conservation managers make decisions about aquatic ecosystems. She is currently research faculty at the University of Massachusetts, Amherst studying how drones and satellite imagery can be used to capture changes in vulnerable salt marsh wetlands on the US East Coast and funded by the U.S. Environmental Protection Agency. She is also research faculty at Utah State University helping public health managers track harmful algal blooms with earth observation data. Dr. Fickas created the Ladies of Landsat Twitter page in 2018 as she was finishing her PhD and sought a community of women to share her experiences with in the field of earth observation. Since then, Ladies of Landsat has become a collaborative effort with other EO scientists who have helped grow the Ladies of Landsat Twitter following to 6,500 followers by creating a diverse and inclusive community to support and amplify voices of women and other under-represented groups in EO and working to change the status quo of a male-dominated field.

uk: вхід без авторизації


Panel Session Day Two: Q&A

uk: Комп'ютерні науки

description: Hear from Steven Ramage, Brian Killough, Sara Safavi, Andiswa Mlisa, Matthias Mohr, Alexander Jacob, Michele Claus and Kate Fickas discuss EO at the Edge, Diversity and Inclusion and so much more.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Dr Robert Woodcock is a Research Scientist and Consultant in Earth Data and Analytics infrastructures with CSIRO Minerals and CSIRO Space and Astronomy. Data and its conversion to useful, decision supporting information is a universal need for business, community, and Government across a broad range of areas from improving business operations through application in decision support at a national and international levels in earth resource, urban and environmental management. As our ability to gather data has grown exponentially, so has our need to manage the flow of information within and between organisations and to make it useful. Dr Woodcock and his teams have address the issues of information flow across organisational boundaries and have developed innovative information systems adopted into national infrastructure and achieved lasting large scale economic impact on multiple organisations. Dr Woodcock's portfolio of activities involves national spatial data infrastructure and CSIRO Earth Analytics Science Innovation Cloud platform. His team’s portfolio has seen national application in Australian Industry and Government including the AuScope national geoscience information infrastructure. Internationally, he is a member of the Committee on Earth Observation Satellites (CEOS) and Chair for the CEOS Working Group on Information Systems and Services. Robert has worked for almost two decades in the field of visualisation, spatial information systems and analytics and its application to Earth Science with a focus on ensuring research innovation leads to business innovation.

uk: вхід без авторизації

name: Earth Analytics Science and Innovation Hub


uk: Комп'ютерні науки

description: Steven Ramage leads external relations at the Group on Earth Observations (GEO) Secretariat in Geneva, Switzerland. His role involves focusing on the interfaces between science, technology, policy and decisions in support of more than 100 UN Member States. He is on the Governing Boards of Digital Earth Africa and Digital Earth Pacific, a member of the UK Space Agency Earth Observations Advisory Committee and the Advisory Board of EO4GEO. Steven was an owner/director of 1Spatial before taking on a role as Executive Director of the Open Geospatial Consortium (OGC), and then Managing Director of Ordnance Survey International. Steven is a Visiting Professor at the Institute for Future Cities, University of Strathclyde, Glasgow and a Fellow of the Royal Geographical Society (RGS). He tweets as @steven_ramage

uk: вхід без авторизації

name: ODC Global Reach: From insights to evidence, then action


uk: Комп'ютерні науки

description: Sara Safavi is a geospatial enthusiast and lifelong space geek living in Austin, TX. Today she leads the Developer Relations team at Planet Labs, where she helps developers, data scientists, and geo-people do amazing things with daily satellite imagery. With a background in geoscience and over a decade of industry experience, Sara specializes in education and enablement at the intersection of software and all things geospatial.

uk: вхід без авторизації

name: What exactly is "Cloud Native Geospital", anyway?


ODC Sprint Progress

uk: Комп'ютерні науки

uk: вхід без авторизації


Digital Earth Africa: A continental ODC

uk: Комп'ютерні науки

description: Adam Lewis’ vision and leadership has transformed the way spatial data is organised, prepared and analysed, leading to changes in the way satellite images are processed in Australia to produce resource information. From 2004 to 2017 he transformed Geoscience Australia’s earth and marine observation function into a globally recognised capability. He has been key to the design and development of Digital Earth Australia — technology which provides the Australian government with the data to monitor the environment and increase productivity in the agricultural and mining industries, and to the Open Data Cube, a global initiative which increases the value and use of satellite data, providing users with free access to technology and analysis platforms. Adam now leads the Digital Earth Africa (DE Africa) program, working with African stakeholders and organisations and with international partners to establish an operational Earth observation data cube specific to Africa’s lands and seas. DE Africa is an open platform, led and governed by Africans, that is making petabytes of free and open satellite data accessible to support decision-making by governments, the private sector, and civil society.

uk: вхід без авторизації


Digital Earth South Africa

uk: Комп'ютерні науки

description: Ms Andiswa Mlisa is the Managing Director of Earth Observation directorate at the South African National Space Agency (SANSA). Prior to joining SANSA, she was at the Group on Earth Observation (GEO) Secretariat, based in Geneva, Switzerland, responsible for the coordination of the AfriGEOSS initiatives and capacity building. A graduate of the Universities of Fort Hare and Stellenbosch in GIS and Remote Sensing, she spent her early career years developing geospatial solutions for water resource management and disaster risk reduction. She aims to use her over 17 years of experience and passion for developing partnerships in earth observations & space applications initiatives to mainstream use of Earth observations for service delivery.

uk: вхід без авторизації


Updates from the ODC Steering Council

uk: Комп'ютерні науки

description: Caitlin Adams is a deeply creative thinker with a passion for solving the complex problems humanity faces. Working as a Data Scientist at FrontierSI, she looks for interesting ways to extract insights from Earth observation data and supports the community to do the same.

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: ODC Conference 2021 - Panel Conversation Day One


uk: Комп'ютерні науки

description: Sachindra Singh is the Team Leader of the Geoinformatics Section, at the Geoscience, Maritime and Energy Division, Pacific Community (SPC). He has 15 years experience in geospatial-oriented systems and software engineering. A strong advocate of open source technologies for capacity building and sustainable development in developing countries, he has implemented robust decision-making tools and services based on geospatial and remotely-sensed data in the Pacific, both on regional and national levels. He has undertaken numerous capacity building exercises for on open source GIS/RS tools and systems in the Pacific Region, and currently is providing technical support for the Digital Earth Pacific (DEP) initiative within Pacific Community (SPC).

uk: вхід без авторизації

name: Digital Earth Pacific: Earth Observation Infrastructure for Sustainable Development


ODC Conference 2021 - Sprint pitches

uk: Комп'ютерні науки

uk: вхід без авторизації


Bedienung eines Bunsenbrenners

keywords:
Bunsenbrenner
Kartuschenbrenner
Gasbrenner
Teclubrenner
Brenner
Chemie
fachfremd Unterrichten
Campingkocher

de: Chemie

fi: kemia

uk: Хімія

en: Chemistry

fr: Chimie

da: Kemi

es: Química

nl: Scheikunde

de: Mathematik, Naturwissenschaften

uk: Математика, природничі науки

en: Mathematics, Natural Sciences

@language: de

uk: вхід без авторизації

Europa-Universität Flensburg (EUF)

addressCountry: DE

addressLocality: Flensburg

addressRegion: Schleswig-Holstein

name: Institut für mathematische, naturwissenschaftliche und technische Bildung


Bedienung einer Druckgasflasche

keywords:
Druckgasflasche
Druckminderer
Sauerstoff
Wasserstoff
Stickstoff
Kohlenstoffdioxid
Gas
Chemie
fachfremd Unterrichten
Gasflasche
Gasflasche
Inhaltsmanometer
Flaschenmanometer

uk: Математика, природничі науки

uk: вхід без авторизації


Molekulares Sieben

keywords:
Teilchenmodell
Wasser
Tinte
Chemie
fachfremd Unterrichten
Modelle
Modellvorstellung
Anfangsunterricht
Naturwissenschaften
Diffusion
Osmose
Teilchenbewegung
Brownsche Molekularbewegung
Experiment

uk: Математика, природничі науки

uk: вхід без авторизації


Luftballon im Glas

keywords:
Luftballon
Wasser
Teilchenmodell
Aggregatzustände
Chemie
fachfremd Unterrichten
verdampfen
kondensieren
Anfangsunterricht
Experiment

uk: Математика, природничі науки

uk: вхід без авторизації


Eiswasserkocher

keywords:
Eis
Wasser
Teilchenmodell
Chemie
Experiment
fachfremd Unterrichten
Anfangsunterricht
Aggregatzustände
Siedepunkt
Siedetemperatur
Stoffeigenschaften
Druck
druckabhängig

uk: Математика, природничі науки

uk: вхід без авторизації


keywords:
Dalton
Massenerhaltung
Massenerhaltungsgesetz
Chemie
fachfremd Unterrichten
chemische Reaktion
Kohlenstoff
Kohlenstoffdioxid
Sauerstoff
Experiment
Modelle
Masse
Modellvorstellung

uk: Математика, природничі науки

uk: вхід без авторизації

name: Boyle-Versuch: Ein Versuch zum Massenerhaltungsgesetz


uk: Комп'ютерні науки

description: The great thing on atomic updates as used e.g. with transactional-update is, that your system is always in a defined state. But what happens with changes in /etc? With normal updates, changes are done immediately to /etc during the updates. With atomic updates, they are only visible with the next reboot. Which means, changes between update and reboot to /etc can create a conflict. There are several strategies by other distributions, like three-way-diff and patching, symlinks, ignoring the problem, etc. In this talk I will mention the biggest challenges we see, which solutions do exist, what are the advantages and what the disadvantages and which impact this will have on normal distributions like openSUSE Tumbleweed. This talk is to create awareness for the problem and as base for discussions, it will not provide a solution for every problem. It's targeting application developers and distribution developers, as this are the areas were changes would be necessary.

uk: вхід без авторизації

name: Atomic Updates - and /etc?: How to handle updates of config files in /etc


uk: Комп'ютерні науки

description: In this talk I explain how containers based on openSUSE Leap and Tumbleweed should be built and how the process for building and submitting official images works.

uk: вхід без авторизації

name: Building containers and images in and for openSUSE: How it works, what to do and what to avoid.


uk: Комп'ютерні науки

description: 10 years of Freedom and Equity in Healthcare GNU Health is the Free/Libre Health and Hospital Information System that is included in openSUSE. GNU Health combines the socioeconomic determinants of health with state-of-the-art technology in bioinformatics and clinical genetics. It provides holistic picture of the person, from the biological and molecular basis of disease to the environmental determinants of health. In addition, it manages the internal processes of a health institution, such as financial management, billing, stock management, pharmacies or labs (LIMS) The GNU Health Federation introduced in 3.4 series allows to build nationwide federated networks with thousands of heterogeneous nodes. The GNU Health federation is revolutionary, and will allow the community, the health practitioners, the research institutions and the ministries of health to have much better perspective and precise information on the individuals and their context. Having the GNU Health Federation in openSUSE (available both for Tumbleweed and Leap) not only provides the development environment, but the server stability to deploy it in hospitals and large heterogeneous health networks across a country.

uk: вхід без авторизації

name: GNU Health + openSUSE: Building large public health networks


uk: Комп'ютерні науки

description: Everyone knows that Free Software such as Linux, Apache or PostgreSQL are the backbone of many data centers (DC) and cloud offerings. The Internet as we know it today would not exist without Free & OpenSource Software (FOSS) But the more Free Software leaves the DC and gets closer to the 'Enduser', the more myth are build around FOSS. Linux on a Desktop? GIMP Instead of Photoshop? Running your business on a Free ERP-System? Fear, Uncertainty and Doubts (FUD) are spread to protect market share for proprietary solutions. In this talk I will take a look at some FUD, and share some thoughts about answers to the myths.

uk: вхід без авторизації

name: Business Applications as Free Software - Demystifying FUD: You should not believe everything that Big Money tells you.....


uk: Комп'ютерні науки

description: Linux is the dominant platform to run microservices using cloud-native architectures. These modern architectures impose new challenges on the platform serving the applications. We'll take a peek at BPF and Cilium and how it revolutionizes both networking and security to enable platforms built on top of it to fully utilize the benefits of cloud-native architectures. Thomas Graf is Co-Founder & CTO at Isovalent and creator of the Cilium project. Before this, Thomas has been a Linux kernel developer at RedHat for many years.

uk: вхід без авторизації

name: Cilium & BPF - The Future of Linux Networking and Security


uk: Комп'ютерні науки

description: In this talk we could see how easy it is to deploy and configure Ceph ready k8s cluster on top of Kubic. And setup Ceph on top of it with Rook (rook.io). We would see couple of examples for Openstack and Vagrant to run such clusters for your CI and development environments.

uk: вхід без авторизації

name: Ceph on Kubic: Deploying Ceph with Rook on Kubic k8s cluster


uk: Комп'ютерні науки

description: In one corner, we have Zypper: the successor to the motley of package management options from Ximian and SuSE. Created after the merger of the Ximian and YaST package manager teams, it was a pioneer in using the SAT solver for package management and proved that it worked well at scale in a large and popular Linux distribution platform (SUSE Linux). It spawned the development of libsatsolver, which became libsolv. Considered by many to be the most advanced and fastest package manager, it is created a class of package managers all on its own. It is used in openSUSE, but is also available in Fedora and other RPM-based Linux distributions. In the other corner, we have DNF: the anointed successor to YUM (Yellowdog Updater, Modified). DNF (Dandified YUM) was forked from YUM to rework the internals to leverage libsolv and offer a saner, more maintainable API. Forged from the blood, sweat, and tears of many package manager developers from Red Hat and others, DNF is built with the lessons in mind from the last decade of software and systems management experiences. A new up and comer, it is used in Fedora, Mageia, OpenMandriva, Yocto, and others. It is also available in openSUSE. How do these two package managers compare? Are they more similar than different? Has DNF made YUM no longer a trash heap? Does ZYpp still rule the roost? This talk explores both package managers and compares them from a technical, usability, and ecosystem perspective. Who knows? Perhaps there are lessons to still be learned for evolving both package managers.

uk: вхід без авторизації

name: DNF vs ZYpp: Fight!: A comparison of the two major RPM package managers


uk: Комп'ютерні науки

description: In the past UX design was a commodity in the paid consumer world, where companies like Facebook, Google, Uber would invest millions on. Today the gap is closing. Enterprise and Open Source applications are in need of better UX too. On the other hand, many companies of all different sizes struggle with today's IT agendas: bleeding edge software, agile development, short time-to-market, etc., and this "new" (and really not so) kid on the block is not making it any easier for developers and designers to keep up: UX design. Companies struggling in this scenario will eventually suffer from a big level of inconsistency in their products portfolio, and sometimes even in one same product. Design Systems can help solve this problem, and a few more. Design Systems serve as a centralized source of information for UX, UI, and other brand-related guidelines that help not only developers find the UI element or component they need, but also designers to build faster prototypes while streamlining the collaboration between the two. But, building a Design System can take a very long time and be very expensive, this is why we're building EOS: an Open Source and customizable Design System. In this presentation, we will talk more about the problem Design Systems solve, how we are building EOS, and how it can be of great benefit to your company or project.

uk: вхід без авторизації

name: Delivering rapid & consistent experiences: Design systems: The modern solution to scale design.


uk: Комп'ютерні науки

description: Japan openSUSE User Group publishes a technical magazine every half year. The title of the magazine is Geeko Magazine. It consists of technical articles on openSUSE and applications running on openSUSE. For example, the latest issue of the magazine contains articles like "Launching Kubernetes Cluster with Kubic in 10 minutes", "Accessing to Google Drive from openSUSE", and "How to enable HTTPS with Let's Encrypt." Since 2014, we have published 9 issues of Geeko Magazine. In this talk, after explaining the culture of self-publishing in Japan, I will talk about the process from calling articles from the user group until distributing Geeko Magazine. Another topic is our challenge: editing the magazine on openSUSE. Thereby, we cannot use popular desktop publishing (DTP) applications like Adobe InDesign. Instead of such applications, we have been using Scribus, an OSS DTP application to edit Geeko Magazine. It supports CMYK color and DTP data such as trim marks and bleed areas, required by print shops. However, in 2014, Scribus was not adequate for writing a Japanese document. This is because typesetting rules are much different from English etc. To publish Geeko Magazine, we went OSS way; we have improved Scribus one by one at every issue of the magazine in cooperation with the upstream community. I will talk about a brief summary of those problems we have resolved.

uk: вхід без авторизації

name: Geeko Magazine: A Technical Magazine on openSUSE, edited on openSUSE


uk: Комп'ютерні науки

description: Keystone is the OpenStack component responsible for identity management and user authentication and authorization, which has unique challenges in cloud-like environments where secure sharing of resources is an essential requirement and yet is fundamental to the core idea of collaborative computing. This introductory talk will give an overview of the keystone project, including: * The many ways users and applications can securely authenticate with keystone, including SAML2.0, OpenID Connect, X.509 and Kerberos, * The implications for authorization in a multitenant environment and how role-based access control is designed in keystone, * How keystone relates to projects outside of the OpenStack ecosystem such as Kubernetes

uk: вхід без авторизації

name: Identity in OpenStack: the Challenge of Multitenancy


uk: Комп'ютерні науки

description: When we want to install openSUSE in out laptop we will use YaST. It will take care of all the details required for a correct partitioning, bootloader installation, time zone selection, network configuration, software selection, etc, etc. But when we want to install 100 nodes in our cloud, each one with a different hardware profile and a different role in our infrastructure, we need something different. AutoYaST can help with this, but there are some limitations, as we need to provide XMLs adjusted for those hardware profiles and roles, and we need a different tool to orchestrate those multiple installations. Can be done, but we can do better. SaltStack is a tool used to manage configuration and provisioning of machines, and we propose use this tool to drive the installation of openSUSE for big deployments. I want to show a WIP installer based on Salt, that can be naturally integrated in any other Salt-based solution, and I would like to talk about the ways that we can improve it in the future.

uk: вхід без авторизації

name: Installing openSUSE only with SaltStack: Using Salt as an alternative to AutoYaST


uk: Комп'ютерні науки

description: Pagure is a new, full-featured Git repository service for the web, written in Python. It is similar to other popular Git-based forges, allowing developers and contributors to share and collaborate on code and content. It also has some unique features not found in any other Git forge providing the basis for decentralized, federated software code hosting and development. It's fully free and open source software, and it's included in openSUSE Leap 15.1 and openSUSE Tumbleweed! The agenda of the presentation: - What is Pagure - History of Pagure - Current state and features of Pagure - Current ecosystem around Pagure - Plans for the future of Pagure - Demo of Pagure on openSUSE

uk: вхід без авторизації

name: openSUSE Conference 2019 - Introducing Pagure: A new lightweight and powerful Git-centered forge, now in openSUSE!