uk: Комп'ютерні науки

description: Software-Defined Networking (SDN) is now widely deployed in production environments with an ever-growing community. Though SDN's software-based architecture enables network programmability, it also introduces dangerous code vulnerabilities into SDN controllers. However, the decoupled SDN control plane and data plane only communicate with each other with pre-defined protocol interactions, which largely increases the difficulty of exploiting such security weaknesses from the data plane. In this talk, we extend the attack surface and introduce Custom Attack, a novel attack against SDN controllers that leverages legitimate SDN protocol messages (i.e., the custom protocol field) to facilitate Java code vulnerability exploitation. Our research shows that it was possible for a weak adversary to execute arbitrary command or manipulate data in the SDN controller without accessing the SDN controller or any applications, but only controlling a host or a switch. To the best of our knowledge, Custom Attack is the first attack that can remotely compromise SDN software stack to simultaneously cause multiple kinds of attack effects in SDN controllers. Till now we have tested 5 most popular SDN controllers and their applications and found all of them are vulnerable to Custom Attack in some degree. 14 serious vulnerabilities are discovered, all of which can be exploited remotely to launch advanced attacks against controllers (e.g., executing arbitrary commands, exfiltrating confidential files, crashing SDN service, etc.). This presentation will include: an overview of SDN security research and practices. a new attack methodology for SDN that is capable of compromising the entire network. our research process that leads to these discoveries, including technical specifics of exploits. showcases of interesting Custom Attack chains in real-world SDN projects.

uk: вхід без авторизації

name: Hacking the Brain: Customize Evil Protocol to Pwn an SDN Controller


Christopher Sheats

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: We started our own transit Internet Service Provider (ISP) to safely route anonymized packets across the globe, and you can too. Emerald Onion is a Seattle-based 501(c)3 not-for-profit and we want to help other hacker collectives start their own. Getting your own Autonomous System Number (ASN), managing Internet Protocol (IP) scopes, using Border Gateway Protocol (BGP) in Internet Exchange Points (IXPs), dealing with abuse complaints or government requests for user data -- this is all stuff that you can do. Not every technologist is comfortable with launching and managing a nonprofit organization let alone has all of the technical knowhow to run an ISP. We didn't either when we started. We had a goal, and that was to route unfiltered Tor exit traffic in the Seattle Internet Exchange despite National Security Agency (NSA) wiretaps in the Westin Exchange Building. This talk will cover high level challenges and opportunities surrounding privacy infrastructure in the United States.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: Privacy Infrastructure: Challenges and Opportunities

DEF CON

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Комп'ютерні науки

description: Just like the Windows platform, graphic drivers of macOS kernel are complicated and provide a large promising attack surface for EoPs and sandbox escapes from low-privileged processes. After auditing part of the binaries, I discovered a number of vulnerabilities last year. Including, NULL pointer dereference, stack-based buffer overflow, arbitrary kernel memory read and write, use-after-free, etc. Some of these vulnerabilities were reported to Apple Inc., such as the CVE-2017-7155, CVE-2017-7163, CVE-2017-13883. In this presentation, I will share with you the detailed information about these vulnerabilities. Furthermore, from the attacker's perspective, I will also reveal some new exploit techniques and zero-days.

uk: вхід без авторизації

name: Attacking the macOS Kernel: Graphics Driver


Infecting The Embedded Supply Chain

uk: Комп'ютерні науки

description: With a surge in the production of internet of things (IoT) devices, embedded development tools are becoming commonplace and the software they run on is often trusted to run in escalated modes. However, some of the embedded development tools on the market contain serious vulnerabilities that put users at risk. In this talk we discuss the various attack vectors that these embedded development tools expose users to, and why users should not blindly trust their tools. This talk will detail a variety reverse engineering, fuzzing, exploit development and protocol analysis techniques that we used to analyze and exploit the security of a common embedded debugger.

uk: вхід без авторизації


LoRa Water Meter Security Analysis

uk: Комп'ютерні науки

description: To avoid the tedious task of collecting water usage data by go user's home _ water meters that are equipped with wireless communication modules are now being put into use, in this talk we will take a water meter _which is using Lora wireless protocol_ as an example to analyze the security and privacy risks of this kind of meters_we will explain how to reverse engineer and analyze both the firmware and the hardware of a water meter system, we will be talking about its security risks from multiple perspectives , physical, data link, and sensors. Do notice that LORA is not only used in water meter ,it is being used in a lot of IoT scenarios_so the methods we employed to analyze LORA in this talk are also useful when you do tests of other LORA based systems .

uk: вхід без авторизації


uk: Комп'ютерні науки

description: The Teddy Ruxpin is an iconic toy from the 1980's featuring an animatronic teddy bear that reads stories from cassette tapes to children. In late 2017, a new model of the toy was released with improvements including Bluetooth connectivity, LCD eyes, and a companion mobile application. While the new bear features a number of improvements, the Teddy Ruxpin's original ability to add new stories by replacing the included cassettes is no longer applicable, and it requires users to supply files to the bear in a proprietary format. This presentation aims to show how the new Teddy Ruxpin was reverse engineered down to a very low level in order to create new content. I will reveal the inner workings of the hardware and software within the bear and document the process used to reverse engineer it. I will then examine the communication between the mobile application and Teddy Ruxpin as well as the custom structure of the digital books read by the bear. I will end the presentation by releasing a toolset that allows users to create their own stories followed by a demo showcasing the Teddy Ruxpin greeting the DEF CON audience.

uk: вхід без авторизації

name: Dissecting the Teddy Ruxpin: Reverse Engineering the Smart Bear


uk: Комп'ютерні науки

description: MS17-010 is the most important patch in the history of operating systems, fixing remote code execution vulnerabilities in the world of modern Windows. The ETERNAL exploits, written by the Equation Group and dumped by the Shadow Brokers, have been used in the most damaging cyber attacks in computing history: WannaCry, NotPetya, Olympic Destroyer, and many others. Yet, how these complicated exploits work has not been made clear to most. This is due to the ETERNAL exploits taking advantage of undocumented features of the Windows kernel and the esoteric SMBv1 protocol. This talk will condense years of research into Windows internals and the SMBv1 protocol driver. Descriptions of full reverse engineering of internal structures and all historical background info needed to understand how the exploit chains for ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY work will be provided. This talk will also describe how the MS17-010 patch fixed the vulnerabilities, and identify additional vulnerabilities that were patched around the same time.

uk: вхід без авторизації

name: Eternal Exploits: Reverse Engineering of FuzzBuncg and MS17-010


uk: Комп'ютерні науки

description: Apple's sandbox was introduced as "SeatBelt" in macOS 10.5 which provided the first full-fledged implementation of the MACF policy. After a successful trial on macOS, Apple applied sandbox mechanism to iOS 6. In its implementation, the policy hooked dozens of operations. The number of hooks has been growing steadily when new system calls or newly discovered threats appeared. In the beginning, Apple's sandbox used a black list approach which means Apple originally concentrated on the known dangerous APIs and blocked them, allowing all others by default. However, with the evolution of Apple's sandbox, it applies a white list approach that denies all APIs and only allows secure ones that Apple trusts. In this talk, we will first introduce Apple's sandbox mechanism and profiles in the latest iOS. Then, we discuss iOS IPC mechanism and review several old classic sandbox escape bugs. Most importantly, we show two new zero-day sandbox escape vulnerabilities we recently discovered in the latest iOS 11.4. Besides, we share our experience of exploiting vulnerabilities in system services through OOL msg heap spray and ROP (Return-oriented programming). In addition, we discuss a task port exploit technique which can be used to control the whole remote process through Mach messages. By using these techniques, security researchers could find and exploit sandbox escape bugs to control iOS user mode system services and further attack the kernel.

uk: вхід без авторизації

name: Fasten your seatbelts: We are escaping iOS 11 Sandbox!


uk: Комп'ютерні науки

description: There are billions of ARM Cortex M based SOC being deployed in embedded systems. Most of these devices are Internet ready and definitely security is always the main concern. Vendors would always apply security measurements into the ARM Cortex M product for few major reasons: 1) People will not be able to copy and replicate the product; 2) License control for the hardware and software; 3) Prevent malicious code injection in to the firmware. Vendors normally rely on the security measurements built within the chip (unique ID number/signature) or security measurements built around the chip (secure boot). In this talk, we will share the ARM Cortex M SOC vulnerability that we discovered and it will be two parts: The first is security measurement build within the SOC and how we break it. We could gain control of changing the SOC unique ID and write the firmware or even turn the device into a trojan or bot. The second is security measure built around the SOC and how we break the Secure Boot elements and write into the firmware.

uk: вхід без авторизації

name: Your Peripheral Has Planted Malware - An Exploit of NXP SOCs


uk: Комп'ютерні науки

description: In this paper, a new replay attack based on Ethereum smart contracts is presented. In the token transfer, the risk of replay attack cannot be completely avoided when the sender's signatures are abused, which can bring the loss to users. And the reason is that the applying scope of the signatures is not properly designed in the smart contracts. To test and verify this loophole, we selected two similar smart contracts for our experiment, at the same time, we used our own accounts in these two contracts to carry out the experiment. Because the same signatures of the two contracts were used in the experiment, we got a double income from sender successfully. The experiment verified that the replay attack is really exist. Besides, the replay attack may exist in multiple smart contracts. We calculated the number of smart contracts with this loophole, as well as the corresponding transaction activities, which find some Ethereum smart contracts are risked for this loophole. According to the vulnerability of the contract signature, the risk level is calibrated and depicted. Furthermore, the replay attack pattern is extended to within contract, cross contract and cross chain, which provide the pertinence and well reference for protection. Finally, the countermeasures are proposed to fix this vulnerability.

uk: вхід без авторизації

name: Replay Attacks on Ethereum Smart Contracts


uk: Комп'ютерні науки

description: Thus far, the security community has treated machine learning as a research problem. The painful oversight here is in thinking that laboratory results would translate easily to the real world, and as such, not devoting sufficient focus to bridging that gap. Researchers enjoy the luxuries of neat bite-sized datasets to experiment upon, but the harsh reality of millions of potentially malicious files streaming in daily soon hits would-be ML-practitioners in the face like a tsunami-sized splash of ice water. And while in research there’s no such thing as ““too much”” data, dataset sizes challenge real-world cyber security professionals with tough questions: ““How will we store these files efficiently without hampering our ability to use them for day-to-day operations?”” or ““How do we satisfy competing use-cases such as the need to analyze specific files and the need to run analyses across the entire dataset?”” Or maybe most importantly: ““Will my boss have a heart-attack when he sees my AWS bill?”” In this talk, we will provide a live demonstration of the system we’ve built using a variety of AWS services including DynamoDB, Kinesis, Lambda, as well as some more cutting edge AWS services such as Redshift and ECS Fargate. We will go into depth about how the system works and how it answers the difficult questions of real world ML such as the ones listed above. This talk will provide a rare look into the guts of a large-scale machine learning production system. As a result, it will give audience members the tools and understanding to confidently tackle such problems themselves and ultimately give them a bedrock of immediately practical knowledge for deploying large-scale on-demand deep learning in the cloud.

uk: вхід без авторизації

name: AI VILLAGE - AI DevOps: Behind the Scenes of a Global Anti-Virus's Machine Learning Infrastructure


uk: Комп'ютерні науки

description: DEF CON,DEFCON,DEF CON 26,DC26,computer security,security conference,hacker conference,information security,cyber security,def con 2018,hackers,hacker videos,security research,artificial intelligence,machine learning, AI research, AI security,adversarial machine learning,

uk: вхід без авторизації

name: AI VILLAGE - Identifying and correlating anomalies in internet-wide scan traffic to newsworthy security events


uk: Комп'ютерні науки

description: Offensive assessments – i.e., penetration testing, adversary emulation, red teaming – have become a key component of maintaining a secure network. Unfortunately, offensive assessments require significant resources, and can vary in quality and structure based on who specifically is conducting the assessment. In the past few years, we’ve seen people try to remedy this problem by creating automated offensive assessment tools, but the capabilities and goals of these tools are highly variable, and many either require personnel to manage them or lack the ability to conduct dynamic or end-to-end tests. We believe that automated offensive assessments can be done better using automated planning. One of the older branches of AI, automated planning seeks to solve problems where an autonomous agent must determine how to compose a sequence of actions together to achieve an objective. Problems in this space can range from constructing offline deterministic plans, to planning under probabilistic conditions, or to planning in scenarios where the world and underlying model are un- or partially-known. Planning techniques have been applied to solve problems in a variety of domains, including controlling unmanned vehicles and designing intelligent agents in computer games. In this talk, we’ll describe how we’ve leveraged concepts from the automated planning community to help us design CALDERA, a free, open source automated adversary emulation system. Using these concepts, CALDERA dynamically strings techniques – taken from MITRE ATT&CK™ – together to achieve objectives and conduct end-to-end tests. In addition to describing CALDERA itself, we’ll also discuss more generally some of the challenges and advantages of deploying automated planning to automated offensive assessments, discussing alternate approaches that we as well as others have considered in tackling this problem. Attendees should walk away with both an understanding of how they can use CALDERA as well as how planning can be used for automated offensive assessments.

uk: вхід без авторизації

name: AI VILLAGE - Automated Planning for the Automated Red Team


uk: Комп'ютерні науки

description: In 2017, I discovered that a popular IP-based door access control system (badge reader and door lock controller) used poorly-implemented cryptography. Through binary analysis and live testing against a functional device, I was able to construct an exploit that would unlock the door without talking to the central authority database or logging the door open event. I'll walk the audience through the steps that made me realize there was a problem, through the binary analysis, and then finally into building a working exploit.

uk: вхід без авторизації

name: IoT VILLAGE - I'm the One Who Doesn't Knock: Unlocking Doors from the Network


uk: Комп'ютерні науки

description: Following the progress in computing and machine learning algorithms as well as the emergence of big data, artificial intelligence (AI) has become a reality impacting every fabric of our algorithmic society. Despite the explosive growth of machine learning, the common misconception that machines operate on zeros and ones, therefore they should be objective, still holds. But then, why does Google Translate convert these Turkish sentences with gender-neutral pronouns, “O bir doktor. O bir hemşire”, to these English sentences, “He is a doctor. She is a nurse”? As data-driven machine learning brings forth a plethora of challenges, I analyze what could go wrong when algorithms make decisions on behalf of individuals and society if they acquire statistical knowledge of language from historical human data. In this talk, I show how we can repurpose machine learning as a scientific tool to discover facts about artificial and natural intelligence, and assess social constructs. I prove that machines trained on societal linguistic data inevitably inherit the biases of society. To do so, I derive a method that investigates the construct of language models trained on billions of sentences collected from the World Wide Web. I conclude the talk with future directions and open research questions in the field of ethics of machine learning.

uk: вхід без авторизації

name: AI VILLAGE - The Great Power of AI Algorithmic Mirrors of Society


uk: Комп'ютерні науки

uk: вхід без авторизації

name: AI VILLAGE - Responsible Offensive Machine Learning


uk: Комп'ютерні науки

uk: вхід без авторизації

name: ICA VILLAGE - Hacking firmware where you least expect it: in your tools


uk: Комп'ютерні науки

description: During the Cyber Grand Challenge, an automated vulnerability exploitation competition, all the teams used the same approach: use a fuzzer to find bugs, and symbolic execution to generate an exploit for any bugs found. Fuzzers are great at triggering bugs, but their effectiveness is often limited by the quality of the initial testcase corpus that is fed to them. Testcases are easy for humans to create, but hard to generate automatically. Teams used a wide variety of techniques to generate initial seeds: from using very slow symbolic execution techniques to find inputs that triggered execution paths, to just using the word “fuzz” as the seed and hoping for the best. However, many of the programs in the CGC are console programs designed to be used by humans: meaning they give a prompt in English and expect a response. For this research we trained a chatbot Recurrent Neural Network on a set of testcases generated by humans, and ran the RNN against the test set with the goal of finding testcases that had higher code coverage than random guessing and could be used with a fuzzer to find bugs.

uk: вхід без авторизації

name: AI VILLAGE - Chatting with Your Programs to Find Vulnerabilities


AI VILLAGE - Closing Notes and Prizes

uk: Комп'ютерні науки

uk: вхід без авторизації


AI VILLAGE - Opening Remarks

uk: Комп'ютерні науки

uk: вхід без авторизації


AI VILLAGE - Malware Panel

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Classic Web Application Firewalls (WAFs) mostly use rule-based approach for attack detection. This approach is known to have its pros and cons. Despite offering decent protection from automated attacks and predictable detection results rule-based approach has and always will have certain disadvantages. We all know that it’s useless against 0-day attacks or that even the most sophisticated rules are easily evaded by skilled professionals. That is why a more effective approach should involve some kind of heuristics. Let’s give a chance to artificial intelligence to find something non-obvious for human perception in raw data and try to explain its results. To this day AI has been more often used for cat classification rather than for detecting application-level attacks on HTTP applications. Our team decided to test the hypothesis that Deep Learning is able to detect web-based attacks effectively. We started with very simple neural network architectures and tried to use them for classification. After some experiments it became clear that we needed more complex networks so we abandoned our attempts to use classification shifting to anomaly detection. Eventually, we ended up using seq2seq model with attention mechanisms which is able to detect zero-day web attacks with minimal number of false positives.

uk: вхід без авторизації

name: AI VILLAGE - Detecting Web Attacks with Recurrent Neural Networks


uk: Комп'ютерні науки

description: Machine learning is quickly becoming a ubiquitous technology in the computer security space, but how secure is it exactly? This talk covers the research occurring in adversarial machine learning and includes a discussion of machine learning blind spots, adversarial examples and how they are generated, and current blackbox testing techniques. Heather Lawrence is a cyber data scientist working with NARI. She earned her undergraduate and MS degrees in Computer Engineering from the University of Central Florida focusing on computer security. She is pursuing a PhD in Computer Engineering from the University of Nebraska Lincoln. Her previous experience in cyber threat intelligence modeling, darknet marketplace research, IT/OT testbed development, data mining, and machine learning has led to several awards from capture-the-flag competitions including the National Collegiate Cyber Defense Competition, CSI CyberSEED, and SANS Netwars Tournament. Her current research interests focus on the application of machine learning to cybersecurity problem sets.

uk: вхід без авторизації

name: AI VILLAGE - The current state of adversarial machine learning


uk: Комп'ютерні науки

description: Machine Learning and Artificial Intelligence have become essential to any effective cyber security and defense strategy against unknown attacks. In the battle against cybercriminals, AI-enhanced detection systems are markedly more accurate than traditional manual classification. Through intelligent algorithms, detection systems have been able to identify patterns and detect phishing URLs with 98.7% accuracy, giving the advantage to defensive teams. However, if AI is being used to prevent attacks, what is stopping cyber criminals from using the same technology to defeat both traditional and AI-based cyber-defense systems? This hypothesis is of urgent importance - there is a startling lack of research on the potential consequences of the weaponization of Machine Learning as a threat actor tool. In this talk, we are going to review how threat actors could exponentially improve their phishing attacks using AI to bypass machine-learning-based phishing detection systems. To test this hypothesis, we designed an experiment in which, by identifying how threat actors deploy their attacks, we took on the role of an attacker in order to test how they may use AI in their own way. In the end, we developed an AI algorithm, called DeepPhish, that learns effective patterns used by threat actors and uses them to generate new, unseen, and effective attacks based on attacker data. Our results show that, by using DeepPhish, two uncovered attackers were able to increase their phishing attacks effectiveness from 0.69% to 20.9%, and 4.91% to 36.28%, respectively.

uk: вхід без авторизації

name: AI VILLAGE - DeepPhish: Simulating the Malicious Use of AI


uk: Комп'ютерні науки

description: A year after we discovered and reported a bunch of CVEs related to deep learning frameworks, many security and AI researchers have started to pay more attention to the software security of AI systems. Unfortunately, many deep learning developers are still unaware of the risks buried in AI software implementations. For example, by inspecting a set of newly developed AI applications, such as image classification and voice recognition, we found that they make strong assumptions about the input format used by training and classifications. Attackers can easily manipulate the classification and recognition without putting any effort in adversarial learning. In fact the potential danger introduced by software bugs and lack of input validation is much more severe than a weakness in a deep learning model. This talks will show threat examples that produce various attack effects from evading classifications, to data leakage, and even to whole system compromises. We hope by demonstrate such threats and risks, we can draw developers’ attention to software implementations and call for community collaborative effort to improve software security of deep learning frameworks and AI applications.

uk: вхід без авторизації

name: AI VILLAGE - Beyond Adversarial Learning – Security Risks in AI Implementations


uk: Комп'ютерні науки

description: The proliferation of ransomware has become a widespread problem culminating in numerous incidents that have affected users worldwide. Current ransomware detection approaches are limited in that they either take too long to determine if a process is truly malicious or tend to miss certain processes due to focusing solely on static analysis of executables. To address these shortcomings, we developed a machine learning model to classify forensic artifacts common to ransomware infections: ransom notes. Leveraging this model, we built a ransomware detection capability that is more efficient and effective than the status quo. I will highlight the limitations to current ransomware detection technologies and how that instigated our new approach, including our research design, data collection, high value features, and how we performed testing to ensure acceptable detection rates while being resilient to false positives. I will also be conducting a live demonstration with ransomware samples to demonstrate our technology’s effectiveness. Additionally, we will be releasing all related source code and our model to the public, which will enable users to generate and test their own models, as we hope to further push innovative research on effective ransomware detection capabilities.

uk: вхід без авторизації

name: AI VILLAGE - Stop and Step Away from the Data: Rapid Anomaly Detection via Ransom Note File Classification


uk: Комп'ютерні науки

description: Malware similarity analysis compares and identifies samples with shared static or behavioral characteristics. Identification of similar malware samples provides analysts with more context during triage and malware analysis. Most domain approaches to malware similarity have focused on fuzzy hashing, locality sensitivity hashing, and other approximate matching methods that index a malware corpus on structural features and raw bytes. Ssdeep or sdhash are often utilized for similarity comparison despite known weaknesses and limitations. Signatures and IOCs are generated from static and dynamic analysis to capture features and matched against unknown samples. Incident management systems (RTIR, FIR) store contextual features, e.g. environment, device, and user metadata, which are used to catalog specific sample groups observed. In the data mining and machine learning communities, the nearest neighbor search (NN) task takes an input query represented as a feature vector and returns the k nearest neighbors in an index according to some distance metric. Feature engineering is used to extract, represent, and select the most distinguishing features of malware samples as a feature vector. Similarity between samples is defined as the inverse of a distance metric and used to find the neighborhood of a query vector. Historically, tree-based approaches have worked for splitting dense vectors into partitions but are limited to problems with low dimensionality. Locality sensitivity hashing attempts to map similar vectors into the same hash bucket. More recent advances make the use of k-nearest neighbor graphs that iteratively navigate between neighboring vertexes representing the samples. The NN methods reviewed in this talk are evaluated using standard performance metrics and several malware datasets. Optimized ssdeep and selected NN methods are implemented in Rogers, an open source malware similarity tool, that allows analysts to process local samples and run queries for comparison of NN methods.

uk: вхід без авторизації

name: AI VILLAGE - It's a Beautiful Day in the Malware Neighborhood


uk: Комп'ютерні науки

description: Like all software systems, the execution of machine learning models is dictated by logic represented as data in memory. Unlike traditional software, machine learning systems’ behavior is defined by the model’s weight and bias parameters, rather than precise machine opcodes. Thus patching network parameters can achieve the same ends as traditional attacks, which have proven brittle and prone to errors. Moreover, this attack provides powerful obfuscation as neural network weights are hard to interpret, making it difficult for security professionals to determine what a malicious patch does. We demonstrate that one can easily compute a trojan patch, which when applied causes a network to behave incorrectly only on inputs with a given trigger. An attacker looking to compromise an ML system can patch these values in live memory with minimal risk of system malfunctions or other detectable side-effects. In this presentation, we demonstrate proof of concept attacks on TensorFlow and a framework we wrote in C++ on both Linux and Windows systems. An attack of this type relies on limiting the amount of network communication to reduce to the likelyhood of detection. Accordingly, we attempt to minimize the size of the patch, in terms of number of changed parameters needed to introduce trojan behavior. On an MNIST handwritten digit classification network and on a malicious PDF detection network, we prove that the desired trojan behavior can be introduced with patches on the order of 1% of the total network size, using roughly 1% of the total training data, proving that the attack is realistic. I am a recent graduate from Columbia Univserity with a BA in Computer Science and MS in Machine Learning, and an incoming engineer on the Acropolis Hypervisor team at Nutanix. I have experience with Linux Kernel development, data science and malware analysis. I have interned at Google, Drawbridge and Nimbledroid, and have published research with Columbia’s Wireless and Mobile Networking lab. For fun, I like to be outdoors and train Brazilian Ju-Jitsu.

uk: вхід без авторизації

name: AI VILLAGE - StuxNNet: Practical Live Memory Attacks on Machine Learning Systems


uk: Комп'ютерні науки

description: One of the most exciting potential applications for artificial intelligence and machine learning is cognitive augmentation of humans. At its best, AI allows humans to handle more information, react faster to complex events, and potentially even sense features of the world that we are currently incapable of perceiving. This has many applications in the security field, such as aiding humans in the task of binary reverse engineering. Reverse engineering binary code is one of the most challenging skill sets in the security field to learn. The ability to look at a block of raw machine code and understand what it does, as well as recognize similarities to code previously seen, often requires years spent doing tedious analysis of large amounts of code. In this talk I show how we can use machine learning to handle the tedious parts of this process for us. If we show a generative neural network a wide variety of machine code, the network will learn the most relevant features needed to reproduce and describe that code. Once the network is trained, we can show it a new segment of code and capture the state of the neurons at the end of the segment. This neural state is effectively a summary of the entire sequence summarized into a vector. Comparing these vectors allows easy measurement of the similarity of several code sequences by simply measuring the Euclidean distance between them. These vectors can also be used as inputs to other machine learning models that can perform a variety of tasks, such as identifying compiler settings used to generate the code. As part of the presentation, I will also be releasing a tool, the JMPgate framework, which can be used to accomplish tasks like identifying library code within an executable binary.

uk: вхід без авторизації

name: AI VILLAGE - JMPgate: Accelerating reverse engineering into hyperspace using AI


uk: Комп'ютерні науки

description: While the papers are piling in arxiv on adversarial machine learning, and companies are committed to AI safety, what would a system that assess the safety of ML system look like in practice? Compare a ML system to a bridge under construction. Engineers along with regulatory authorities routinely and comprehensively assess the safety of the structure to attest the bridge’s reliability and ability to function under duress before opening it to the public. Can we as security data scientists provide similar guarantees for ML systems? This talk lays the challenges, open questions in creating a framework to quantitatively assess safety of ML systems. The opportunities, when such a framework is put to effect, are plentiful – for a start, we can gain trust with the population at large that ML systems aren’t brittle; that they just come in varying, quantifiable degrees of safety. Ram Shankar is a Data Cowboy on the Azure Security Data Science team at Microsoft, where his primary focus is modeling massive amounts of security logs to surface malicious activity. His work has appeared in industry conferences like BlueHat, DerbyCon, MIRCon, Strata+Hadoop World Practice of Machine Learning as well as academic conferences like NIPS, IEEE Usenix, ACM - CCS. Ram graduated from Carnegie Mellon University with a Masters in Electrical and Computer Engineering. If you work in the intersection of Machine Learning and Security, he wants to learn about your work!

uk: вхід без авторизації

name: AI VILLAGE - Towards a framework to quantitatively assess AI safety – challenges, open questions and opportunities.


AI VILLAGE - Adversarial Stickers

uk: Комп'ютерні науки

description: Adversarial examples fooling machine learning field are a burgeoning field. We propose applications to fool self driving cars or facial recognition systems but most of the techniques are purely academic. They require minute manipulations to the bit values of the pixels entering a system. Adversarial patches are an attack that could actually work. This talk will cover how to make them and further applications I got my Ph.D. in algebraic topology in 2016 and immediately moved into machine learning to work on something useful to people. I then completed a post-doc in mathematical machine learning where I worked on medical data. I now work at endgame.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Blockchain and Cryptocurrencies are gaining unprecedented popularity and understanding. Meanwhile, Ethereum is gaining a significant popularity in the blockchain community, mainly due to the fact that it is designed in a way that enables developers to write decentralized applications (Dapps) and smart contract. This new paradigm of applications opens the door to many possibilities and opportunities. However, the security of Ethereum smart contracts has not received much attention; several Ethereum smart contracts malfunctioning have recently been reported. Unlike many previous works that have applied static and dynamic analyses to find bugs in smart contracts, we do not attempt to define and extract any features; instead we focus on reducing the expert’s labor costs. We first present a new in-depth analysis of potential attacks methodology and then translate the bytecode of solidity into RGB color code. After that, we transform them to a fixed-sized encoded image. Finally, the encoded image is fed to convolutional neural network (CNN) for automatic feature extraction and learning, detecting security flaw of Ethereum smart contract.

uk: вхід без авторизації

name: AI VILLAGE - Hunting the Ethereum Smart Contract: Color Inspired Inspection of Potential Attacks


BCOS Monero Village - Welcome Speech

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - An Introduction to Kovri


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - The Monero Projects Vulnerability Response Process


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - Monero Gameshow: The lamest show you'll see all year.


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - Monero's Emerging Applications: Don't worry, I don't know what the title means


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - Scaling and Economic Implications of the Adaptive Blocksize in Monero


BCOS Monero Village - Inside Monero

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - Ring Signatures MONERO


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - A Rundown of Security Issues in Crypto Wallets


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - We Don't Need No Stinkin Badges


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - We Program Our Stinkin Badges


Was kann man an Beton besser machen?

@language: de

uk: вхід без авторизації

name: Moderation Skorupka, Sascha (Leitung, Regie, Redaktion)

Leibniz Universität Hannover (LUH)

addressCountry: DE

addressLocality: Hanover

addressRegion: Lower Saxony


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - Hacking a Crypto Payment Gateway


BCOS Monero Village - BCOS Keynote

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BCOS Monero Village - Greatest Questions


uk: Комп'ютерні науки

description: Thanks to the use of DNA in criminal investigations, hundreds of innocent people have been exonerated from crimes they did not commit. DNA has also been used to used to arrest suspects in cold cases! In my presentation I will give a primer on the techniques used for DNA profiling and the statistics for false positives. The bulk of my presentation will be looking into the vulnerabilities of current DNA profiling methods and how a malicious actor could actually reconstruct enough genotypic information of any innocent person from just a picture of their face. This is based on recently published Nature Genetics research and extends the methods to suggest that it would only take ~50 million face:genotype samples to have a sufficient genotypic mapping that would allow someone to recreate your 23andMe profile (602,000 SNPs) from a selfie.

uk: вхід без авторизації

name: BIO HACKING VILLAGE - Selfie or Mugshot? The power of facial recognition technology and the implications for genetic discrimination


uk: Комп'ютерні науки

description: The WaterBot is designed to dispense liquid (water, plant food, MS Media) and report how much and when it was administered. Designed, engineered and programed by 11 yr. old BiaSciLab, the WaterBot is open source and scaleable. Come see how you can hack it to help hack your plants!

uk: вхід без авторизації

name: BIO HACKING VILLAGE - WaterBot The Hackable Plant Control System


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BIO HACKING VILLAGE - Our Evolutionary Path... in 45 Minutes: OR: Full speed off the edge of the cliff


BIO HACKING VILLAGE - DAY ONE

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

description: As prenatal testing and ultrasound technology have greatly improved, so has our ability to diagnose birth defects and genetic diseases earlier and earlier in pregnancy. Until recently, our only available options were to offer pregnancy termination or wait to see if the baby survived long enough to be treated after birth. But what if we had the capability to intervene before those genetic mutations had a chance to cause their harmful effects, sparing parents from the agony of uncertain pregnancy outcomes and saving children from debilitating diseases? In last year’s “Designer Babies: Hacking Human Embryos” we discussed pre-implantation genetic testing and embryo modification as a means to identify and treat heritable diseases, by correcting harmful gene mutations before a pregnancy even begins. Since then, exciting new research has shown that even after a pregnancy is under way, opportunities still exist for hacking the biological machinery of the fetus to alter its developmental course.This talk will review new and rapidly evolving strategies to treat genetic disease in utero – while the baby is still in the womb - by hijacking the embryologic mechanisms responsible for fetal growth and development. Examples include: - injection of a critical protein into the amniotic fluid surrounding babies with X-linked hypohydrotic ectodermal dysplasia, a genetic condition causing a lack of sweat glands and the life-threatening inability to regulate temperature - transfusion of mesenchymal stem cells into the fetal umbilical cord to treat osteogenesis imperfecta or “brittle bone disease” - in utero blood and bone marrow transplant to treat the fatal hemoglobin disorder alpha-thalessemia major - correcting deformities such as cleft lip and palate by triggering cell signaling pathways ""knocked out"" by genetic mutation

uk: вхід без авторизації

name: BIO HACKING VILLAGE - Hacking Human Fetuses


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BIO HACKING VILLAGE - Workplace Accommodation for Autistics: Autistic Autobiography and Technology Enabled Prosthetic Environments


uk: Комп'ютерні науки

description: Biological viruses have existed and evolved for millions of years, maliciously exploiting host cells for survival. How have they done this, and what can we learn from it? Extremely advanced mechanisms for privilege escalation, persistence, and defence evasion have been used by biological viruses long before malware was first written. This talk will provide an understanding of what mechanisms are used by biological viruses to exploit immune defences, persist, and survive in the arms race with the immune system. Surprising differences between malware and virus actions will be shown, and some mechanisms which are used by viruses, but have not been adopted, or even attempted by malware, will be revealed. No biological background is needed, only an open mind.

uk: вхід без авторизації

name: BIO HACKING VILLAGE - Exploiting Immune Defenses - Can Malware Learn from Biological Viruses?


uk: Комп'ютерні науки

description: Joel will talk about how the DEF CON Biohacking Village came together in all its wonderful glory

uk: вхід без авторизації

name: BIO HACKING VILLAGE - Biohacking Village Microfluidics Badge


uk: Комп'ютерні науки

uk: вхід без авторизації

name: BIO HACKING VILLAGE - Four Thieves Vinegar Collective: Take back the knowledge, Take back the power


uk: Комп'ютерні науки

description: The increase of pace in the technology field has left the race for manufacturers to increase the security in medical devices. There is the theoretically possibility that your heart can be pwned. Pacemakers have become part of the internet of things. We are putting our hearts on display. This is my journey from regular hacker to gen-one cyborg to pwning my own heart that I can own the vulnerabilities to fix it. We forget that these are devices connected to flesh and blood, a person who depends on this device to have just one more heart beat. This is a journey into the inner sanctum of living with a vulnerable device in a time where technology progression has left behind security. We can no longer have security by obscurity when it comes to devices which cyborg’s like me depend on.We should not be in the business of sacrificing security for convenience or power. As a patient, I would rather sleep knowing my device has been hardened and have the inconvenience of replacing it more regularly than the converse. I feel that we, as the security community, should be addressing and assisting medical manufacturers with the security vulnerabilities in the devices that literally keep people alive. There should be more effort placed on addressing the security vulnerabilities. The simple fact is we are not dealing with just ones and zeroes. This is, for some, a life or death situation.

uk: вхід без авторизації

name: BIO HACKING VILLAGE - PWN to Own My Heart


uk: Комп'ютерні науки

description: This talk will focus on consumer grade glucose monitors - primarily continuous glucose monitors that are implantable or attach to the skin for extended length of time and provide readings via bluetooth low energy or have RF/BLE bridges. Research was focused on security/privacy implications.

uk: вхід без авторизації

name: BIO HACKING VILLAGE - Jumping the Epidermal Barrier


uk: Комп'ютерні науки

description: Traditionally SOCs look outward from their network perimeters, missing the adversaries already operating in their networks. As SOCs improve their capabilities by turning inwards, where should they start? What techniques should they be worried about? What tools will help them? Without knowing what your adversaries can do and what your current capabilities are, it’s hard to make improvements. This talk will describe how to use the MITRE ATT&CK framework as a “scorecard” within the SOC to understand and tune defensive capabilities, making it easier to answer these hard questions. We’ll describe key use cases for how SOCs can use ATT&CK, covering hunting, threat intelligence, red teaming, and security engineering. To enable these use cases, we’ll present a non-invasive technique to construct a detective coverage map that highlights the SOC’s strengths and weaknesses, focusing on minimizing resource requirements while still providing usable results. To accompany this, we describe a process to create a remediation plan that provides the highest return on investment by orienting on the most relevant threats and prioritizing defensive improvements based on current coverage. Throughout the talk, we will provide real examples, making it easy for those in attendance to understand and replicate at home.

uk: вхід без авторизації

name: BLUE TEAM VILLAGE - Stop, Drop and Assess Your SOC: Sonducting and Using Att&ck Assessments


BLUE TEAM VILLAGE - SOC of 2020

uk: Комп'ютерні науки

description: The security operations aspect of your Information Security risk management program is where the “rubber meets the road” — the tools and people you have to implement the process and procedures you put together to find the badness and put out the fires. How has the concept of security operations evolved, and where are we headed? There is plenty of buzzword bingo: UBA, UEBA, machine learning and artificial intelligence, network abnormality detection, the marketing conversations of evolving to that SOC of 2020 — what do all these really mean to you and your operations and which can be useful in your efforts to find the badness?

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Have you wondered whether developers can play any significant role in the security world? Come hear from a diehard programmer and hacker who loves to break and loves to build, and learn how a regular programmer can make major contributions to security from the trenches. This presentation will dive into the intersection between development and security. You will learn about the SDL -- Secure Development Lifecycle, and why in the world a hacker would care about processes and procedures. You will learn how "processes" and "lifecycles" can be useful -- and how they can be a complete waste of time. Included are real world success stories of organizational hacking -- getting other engineers to change their practices -- and real world fail stories. Attendees will come away with knowledge of how development and security intersect, and how they can use their programming day job to save the world. If you are a developer who cares deeply about security, enjoys exploits, and wants to make the world a better place, this is for you.

uk: вхід без авторизації

name: BLUE TEAM VILLAGE - Hacking Your Dev Job to Save the World: Where Programming and Hacking Meet


uk: Комп'ютерні науки

description: Industrial espionage is the practice of secretly gathering information about competing corporation or business interest, with the objective of placing one’s own organization at a strategic or financial advantage. A common practice to achieve this advantage is to elicit information from unwitting individuals through what today is called social engineering (SE). We all hear the term SE so often that we become desensitized to it, thereby INCREASING the effectiveness of it against ourselves and organizations. Thus, will call it what it is - Human Intelligence, also known as HUMINT. Presenting personal experiences as an Army counterintelligence agent with examples of military and industrial espionage, will examine tradecraft employed against individuals every day. We will apply lessons learned from the US military and the intelligence community by using two acronyms taught to Army counterintelligence agents: SAEDA (Subversion and Espionage Directed against the Army) and MICE (Money, Ideology, Coercion, Ego). By presenting different aspects of HUMINT collection efforts will enable individuals to possibly detect, deflect, and protect oneself from such actions.

uk: вхід без авторизації

name: BLUE TEAM VILLAGE - Subversion and Espionage Directed Against You (SAEDY)


uk: Комп'ютерні науки

description: In the current cyber landscape several vulnerabilities are discovered every day. The volume of information and multiple sources to consume this information create interesting challenges for any security team. In the recent months several organizations have been prey of bad actors, exposing private data of millions of users, many times from month old vulnerabilities. Vulnerability management is often disregarded, improperly staffed and rarely discuss in the infosec community, yet is one of the single point of failures allowing for breaches to take place. Under this circumstance, are you prepared to deal with vulnerabilities accordingly? In this talk, we’ll share our experiences dealing vulnerabilities at scale. What works, what does not and why. More importantly, what actions you should consider improving or build your Vulnerability program. In the process, we’ll introduce some of the custom tools created internally to automate and enhance the program. Unlike most Vulnerability Management talks, this talk is about the hands-on portion and day-to- day activities that must take place. Whether you are a seasoned infosec professional or new to the field, there is something for you to take away, especially at scale.

uk: вхід без авторизації

name: BLUE TEAM VILLAGE - How Not to Suck at Vulnerability Management at Scale


uk: Комп'ютерні науки

description: Automation has been the forefront of almost every tool or talk in the recent years. The DFIR industry has been moving rapidly towards automating everything! With some great work being done in the area of integrating workflows and various toolsets to make things easier for analysts, automation has really taken off. While that sounds like a worthwhile solution to help SOC analysts weed out the run of the mill adware/PUPs or phishing expeditions, can we really automate a response to the more sophisticated or targeted attack on our company’s crown jewels? The current argument being made, is that -- rather than building in house Incident Response teams, we should utilize automation to substitute analysts and use third party retainers for skilled analysis. Large investments in automation technologies, rather than resource development reflect this strategy. What does this mean for career progression for budding DFIR analysts? With security engineering taking the forefront, is analysis as a career in DFIR a dying star? Is automation moving us towards click forensics rather than intelligent analysis? I’d like to challenge groupthink, and debate where automation will lead the industry trends. Additionally, I will share some of my experiences in the changing face of DFIR.

uk: вхід без авторизації

name: BLUE TEAM VILLAGE - Automating DFIR: The Counter Future


uk: Комп'ютерні науки

description: There is a rising trend within Threat actors to find newer, more effective and stealthy ways to attack and gain persistence in a network. One way to achieve this is by abusing legitimate software such as Windows Management Instrumentation and PowerShell. This is the case for Living Off the Land and Fileless threats. By using these techniques, attackers can distribute their malicious code bypassing software whitelisting and avoid antivirus detection. A method to detect these threats is by monitoring endpoints activity. However, this option comes with many challenges that range from getting enough system’s activity information to handle hundreds of events per second. In our research, we analyze this monitoring method and the design challenges involved in it. Furthermore, we propose a solution that aims to detect and alert when advance threats are identified in a system. In order to provide an endpoint monitoring system free of any vendor lock-in, this solution combines the capabilities of different open source projects as well as free tools. These include, Sysmon for monitoring system activity, Elastic Stack (ELK) to store and search the collected data, ElastAlert to trigger alarms and the Sigma Project to define the rules for the alarms. This highly customizable solution would enable organizations to hunt for threats inside their network or create rules that would automatically detect specific threats upfront.

uk: вхід без авторизації

name: BLUE TEAM VILLAGE - Endpoint Monitoring: With Free, and Open Source tools!


uk: Комп'ютерні науки

description: Logs, right? Do you run an expensive SIEM? If not, this talk is for you. An effective process for managing logs and security events with built-in and open-source tools will be detailed. I'll share reports and tickets from our organization and describe how we analyze them to improve IT operations, situational awareness, security posture, and pass audits.

uk: вхід без авторизації

name: BLUE TEAM VILLAGE - Effective Log and Events Management


uk: Комп'ютерні науки

description: Cloud Security is a magical world of as-a-service miracles. Just spin up your intrusion-detection- as-a-service, SOC-as-a-service, incident-response-as-a-service, and start feeding it security- intelligence-as-a-service. Come hear from this CISO-as-a-service unwrap the onion of cloud access security brokers (CASB), cloud workload protection platforms (CWPP), microsegmentation, cloud security posture management (CSPM), software-defined perimeters (SDP), and bunch of other cloud related topics. What do they do? Do they really work? What do you with all those security appliances you’ve accumulated?

uk: вхід без авторизації

name: BLUE TEAM VILLAGE - Cloud Security Myths: Cutting through he BS-as-a-service


uk: Комп'ютерні науки

description: Moustafa Alzantot is a Ph.D. Candidate in Computer Science at UCLA. His research interests include machine learning, privacy, and mobile computing. He is an inventor of two US patents and the recipient of several awards including the COMESA 2014 innovation award. He worked as an intern at Google, Facebook, and Qualcom. Yash Sharma is a visiting scientist at Cornell who recently graduated with a Bachelors and Masters in Electrical Engineering. His research has focused on adversarial examples, namely pushing the state-of-the-art in attacks in both limited access settings and challenging domains. He is interested in finding more principled solutions for resolving the robustness problem, as well as studying other practical issues which are inhibiting us from achieving AGI.

uk: вхід без авторизації

name: CAAD VILLAGE - GeekPwn - The Uprising Geekpwn AI/Robotics Cybersecurity Contest U.S. 2018 - Practical adversarial attacks against challenging models environments


uk: Комп'ютерні науки

description: In this talk, the speaker will introduce the state-of-art techniques in both defense and attack. More specifically, he will summary the most effective attack approach and the defense mechanisms. He will also share the approaches their team adopted for the competition. Wenbo Guo is a Ph.D. student in the College of Information Science and Technology at Pennsylvania State University. Currently, he is a research intern at JD security research center in Silicon Valley. Before joining the Penn State, he got his Master degree from Shanghai Jiao Tong University in 2017. His research mainly focuses on deep learning as well as its applications in program analysis and security. He has published several research papers in the high-quality journals and conferences, such as KDD. Alejandro Cuevas, originally from Paraguay, graduated in May 2018 from The Pennsylvania State University with a B.S. Security and Risk Analysis. As an undergraduate, Alejandro co-authored 2 papers in different areas within computer security. At Penn State, Alejandro has worked on analyzing the challenges in the reproduction of crowd-reported vulnerabilities and is currently involved in a project presenting a novel RNN for memory alias analysis. Furthermore, Alejandro has also extensively collaborated with EPFL, exploring the security challenges faced by the ICRC and helping in the deployment of an anonymous communication protocol with provable traffic-analysis resistance. Alejandro is currently applying to Ph.D. programs and hopes to start in the fall of 2019.

uk: вхід без авторизації

name: CAAD VILLAGE - GeekPwn - The Uprising Geekpwn AI/Robotics Cybersecurity Contest U.S. 2018 - Explanation: Alternative Path to Secure Deep Learning System


uk: Комп'ютерні науки

description: State-of-the-art deep neural network classifiers are highly vulnerable to adversarial examples which are designed to mislead classifiers with a very small perturbation. However, the performance of black-box attacks (without knowledge of the model parameters) against deployed models always degrades significantly. In this paper, We propose a novel way of perturbations for adversarial examples to enable black-box transfer. We first show that maximizing distance between natural images and their adversarial examples in the intermediate feature maps can improve both white-box attacks (with knowledge of the model parameters) and black-box attacks. We also show that smooth regularization on adversarial perturbations enables transferring across models. Extensive experimental results show that our approach outperforms state-of-the-art methods both in white-box and black-box attacks. Bruce Hou, senior security researcher with more than four years of experience in Tencent Security Platform Department, mainly focuses on the classification of images and videos, human-machine confrontation and the attacks and defenses of cyber security. Wen Zhou, senior security researcher with multiple years of experience in Tencent Security Platform Department, mainly focuses on the research of computer vision, adversarial-examples and so on. Tencent Blade Team was founded by Tencent Security Platform Department, focusing in security researches of AI, mobile Internet, IoT, wireless devices and other cutting-edge technologies. So far, Tencent Blade Team has reported many security vulnerabilities to a large number of international manufacturers, including Google and Apple. In the future, Tencent Blade Team will continue to make the Internet a safer place for everyone.

uk: вхід без авторизації

name: CAAD VILLAGE - GeekPwn - The Uprising Geekpwn AI/Robotics Cybersecurity Contest U.S. 2018 - Transferable Adversarial Perturbations


uk: Комп'ютерні науки

description: Driven by their accessibility and ubiquity, deep learning has seen rapid growth into a variety of fields, in recent years, including many safety-critical areas. With the rising demands for computational power and speed in machine learning, there is a growing need for hardware architectures optimized for deep learning and other machine learning models, specifically in tightly constrained edge based systems. Unfortunately, the modern fabless business model of manufacturing hardware, while economic, leads to deficiencies in security through the supply chain. In addition, the embedded, distributed, unsupervised, and physically exposed nature of edge devices would make various hardware or physical attacks on edge devices as critical threats. In this talk, I will first introduce the landscape of adversarial machine learning on the edge. I will discuss several new attacks on neural networks from the hardware or physical perspective. I will then present our method for inserting a backdoor into neural networks. Our method is distinct from prior attacks in that it was generated to neither alter the weights nor inputs of a neural network. But rather, it inserts a backdoor by altering the functionality of operations implemented by the network on those parameters during the production of the neural network. Joseph Clements works with Dr. Yingjie Lao’s Secure and Innovative Computing Research Group conducting research on Adversarial AI in edge based Deep Learning technologies. In the fall semester of 2017, Joseph joined Clemson University’s Holcombe Department of Electrical and Computer Engineering in pursuit of his PhD. He graduated with a bachelor’s degree in computer engineering from the University of South Alabama in May of 2016. There, he engaged in research with Dr. Mark Yampolskiy on the security of additive manufacturing and cyber-physical systems. His research interests include machine learning and artificial intelligence, security and VLSI design.

uk: вхід без авторизації

name: CAAD VILLAGE - GeekPwn - The Uprising Geekpwn AI/Robotics Cybersecurity Contest U.S. 2018 - Hardware Trojan Attacks on Neural Networks


uk: Комп'ютерні науки

description: Adversarial attack/defense against machine learning models in digital world. NorthWestSec, a team of independent security researchers concentrating on AI and security topic. They have demonstrated the Hacking Google reCaptcha using Deep learning technology at GeekPwn 2017 in Silicon Valley.

uk: вхід без авторизації

name: CAAD VILLAGE - GeekPwn - The Uprising Geekpwn AI/Robotics Cybersecurity Contest U.S. 2018 - How to leverage the open-source information to make an effective adversarial attack/defense against deep learning model


uk: Комп'ютерні науки

description: Rohan Taori and Amog Kamsetty, undergrades at UC Berkeley studying EECS The application of deep recurrent networks to audio transcription has led to impressive gains in automatic speech recognition (ASR) systems. Many have demonstrated that small adversarial perturbations can fool deep neural networks into incorrectly predicting a specified target with high confidence. Current work on fooling ASR systems have focused on white-box attacks, in which the model architecture and parameters are known. In this paper, we adopt a black-box approach to adversarial generation, combining the approaches of both genetic algorithms and gradient estimation to solve the task. We achieve a 89.25% targeted attack similarity after 3000 generations while maintaining 94.6% audio file similarity. Rohan Taori(Tweet@rtaori13) is an undergrade at UC Berkeley studying EECS with an interest in machine learning and AI. He heads the educational division at Machine Learning at Berkeley and is also a researcher at BAIR (Berkeley AI Research). Amog Kamsetty is an undergraduate studying EECS at UC Berkeley, with an interest in both machine learning and systems. He is involved with Machine Learning @ Berkeley and is currently pursuing research at UC Berkeley RISE Lab.

uk: вхід без авторизації

name: CAAD VILLAGE - GeekPwn - The Uprising Geekpwn AI/Robotics Cybersecurity Contest U.S. 2018 - Targeted Adversarial Examples for Black Box Audio Systems


uk: Комп'ютерні науки

description: We will introduce a magic trick that vanishes objects in front of self-driving cars adversarial machine learning techniques. Weilin Xu is the intern at Baidu X-Lab, PhD candidate at the University of Virginia. Yunhan Jia is the senior security scientist at Baidu X-Lab. Zhenyu Zhong is the staff security scientist at Baidu X-Lab.

uk: вхід без авторизації

name: CAAD VILLAGE - GeekPwn - The Uprising Geekpwn AI/Robotics Cybersecurity Contest U.S. 2018 - Magic Tricks for Self-driving Cars


uk: Комп'ютерні науки

description: Deep neural networks are vulnerable to adversarial examples, which poses security concerns on these algorithms due to the potentially severe consequences. Adversarial at- tacks serve as an important surrogate to evaluate the robustness of deep learning models before they are deployed. However, most of existing adversarial attacks can only fool a black-box model with a low success rate. To address this issue, we propose a broad class of momentum-based iterative algorithms to boost adversarial attacks. By integrating the momentum term into the iterative process for attacks, our methods can stabilize update directions and escape from poor local maxima during the iterations, resulting in more transferable adversarial examples. To further improve the success rates for black-box attacks, we apply momentum iterative algorithms to an ensemble of models, and show that the adversarially trained models with a strong defense ability are also vulnerable to our black-box attacks. We hope that the proposed methods will serve as a benchmark for evaluating the robustness of various deep models and defense methods. With this method, we won the first places in NIPS 2017 Non-targeted Adversarial Attack and Targeted Adversarial Attack competitions. Tianyu Pang is a first-year Ph.D. student of TSAIL Group in the Department of Computer Science and Technology, Tsinghua University, advised by Prof. Jun Zhu. His research interest includes machine learning, deep learning and their applications in computer vision, especially robustness of deep learning.

uk: вхід без авторизації

name: CAAD VILLAGE - GeekPwn - The Uprising Geekpwn AI/Robotics Cybersecurity Contest U.S. 2018 - Boosting Adversarial Attacks with Momentum


uk: Комп'ютерні науки

description: Targeted attacks of image classifiers are difficult to transfer from one model to another. Only strong adversarial attacks with the knowledge of the classifier can bypass existing defenses. To defend against such attacks, we implement an “adversarial^2 training” method to strengthen the existing defenses. Yao Zhao is an applied scientist at Microsoft AI & Research working on natural language understanding/generation and search ranking. During his Ph.D. at Yale University, he worked in the field of computuer vision and optics. Yuzhe Zhao is a software engineer in Google Research, working on natural language understanding. He recently earned his Ph.D. from Yale University. Previously, he received his undergraduate degree in mathematics and physics from Shanghai Jiao Tong University.

uk: вхід без авторизації

name: CAAD VILLAGE - GeekPwn - The Uprising Geekpwn AI/Robotics Cybersecurity Contest U.S. 2018 - High Frequenzy Targeted Attacks


uk: Комп'ютерні науки

description: Zhuang Zhang, Bo Shi, Hangfeng Dong, from Tencent Yunding Lab(Tweet@YDLab9) Since the malware come out, there is a fight between malware and AV. So more and more methods based on machine learning apply to detect malware. We will share how to detect polymorphic malware based on CNN，then we will introduce a method use generative adversarial network to generate adversarial malware examples to bypass machine learning based detection models. Zhuang Zhang is the senior researcher at Tencent Yunding Laboratory. Bo Shi is the Ecosystem Director of Tencent Yunding Laboratory. Hangfeng Dong is the researcher of Tencent Yunding Laboratory.

uk: вхід без авторизації

name: CAAD VILLAGE - GeekPwn - The Uprising Geekpwn AI/Robotics Cybersecurity Contest U.S. 2018 - Weapons for Dog Fight：Adapting Malware to Anti-Detection based on GAN


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CANNABIS VILLAGE - Introduction to Hydroponic systems in commercial Facilities


uk: Комп'ютерні науки

description: Annie has been at the forefront of the hemp industry for the past 10 years, earning a US Fulbright Scholarship to study hemp in Canada and recently publishing her podcast series, Anslinger: The untold cannabis conspiracy - an interview-narration style podcast highlighting Big Pharma's role in cannabis prohibition analyzed from 10 years of archival research. Annie is co-founder of Anavii Market - an online market for premium verified CBD and other hemp products. She is also the founder of the Kentucky-based non-profit, Friends of Hemp, and is a member of the US Hemp Roundtable, the Hemp Feed Coalition Steering Committee, and the Hemp Industries Association Legislative Review Committee. In addition, she is a published author in Hemp Magazine and Hemp Business Journal. She received her BS in Economics from the University of Kentucky and holds a Masters in International Environmental Policy and an MBA. You can learn more about Annie and her journey on her blog, Think Hempy Thoughts.

uk: вхід без авторизації

name: CANNABIS VILLAGE - The Real History of Marijuana Prohibition


uk: Комп'ютерні науки

description: The Open Cannabis Project is a community-led, research-driven non-profit with a simple mission: to defend the richness and diversity of cannabis from illegitimate and overreaching patents. To fulfill this mission, we are building a transparent and open source repository of data about cannabis genetics, chemistry, and traits. In addition to documenting plants that already exist in the public domain, such a robust data set can also provide a unique lens into cannabis en masse, allowing us to gain an understanding of this variable little plant in a way weve never before been able to see.

uk: вхід без авторизації

name: CANNABIS VILLAGE - Open Cannabis Project: Cannabis + Open Source


uk: Комп'ютерні науки

description: Xmunoz likes to tinker with bits using a magnetized needle and a steady hand. In a former life, she wrangled web traffic and corralled distributed systems. Present interests include breaking cryptography, reverse engineering things, and ethically uncovering vulnerabilities in network infrastructure, system configuration, and web applications. In her free time she plays on the R3d Cr3sc3nt CTF team. In this talk shell be bringing to bear all the aforementioned knowledge to teach you how to grow small-scale Cannabis well indoors with as little effort and expenditure as possible

uk: вхід без авторизації

name: CANNABIS VILLAGE - Weed Hacking: a pragmatic primer for marijuana home grows


uk: Комп'ютерні науки

description: Harry Moreno is a professional Web Software Engineer and a Machine Learning Enthusiast. He has spent most of his career developing web applications for startups in Healthtech, Hospitality and Advertising. He was built machine learning applications for radar sensors, cell segmentation in images and audio identification Using cutting edge approaches in the field of Machine Learning and Computer Visions, we’ll take you through the steps for building an ML model for classifying sick cannabis plants. This is a feature present in many plant or cannabis monitoring systems, but why pay big bucks for big licenses when it could be freely available?

uk: вхід без авторизації

name: CANNABIS VILLAGE - Identifying sick Cannabis with AI


uk: Комп'ютерні науки

description: Frank is a strategic marketing consultant with a strong focus on user experience and a proven adeptness in forecasting market trends. Frank works with established artists and brands to develop unique business opportunities into customer-centric branded experiences. He is focused on building lasting resonance between consumers and businesses worldwide. The opportunity for full legalization in the United States looms over the horizon. The impact however, reaches far beyond the cursory recreational, medicinal, and social benefits. This talk reveals how the mass social engineering effort behind cannabis legalization could be a strategic play to protect against the decoupling of the petrodollar system. We touch upon players & history behind regulation, extrapolate how legalizing today enables the U.S. to reopen and control the renegotiation of major trade treaties such as the WTO, then finally elucidate the knock-on effects with respect to individual security and self sovereignty. By legalizing cannabis, the U.S. is paving the way to control a multi-trillion dollar constellation of industries spanning petrochemical, pharmaceutical, and forestry industries via the industrial hemp market. Through simple examples, this talk reveals how all the pieces glue together and lays out a framework of what their respective impacts might be.

uk: вхід без авторизації

name: CANNABIS VILLAGE - The Invisible Hands Tending the Secret Greens


uk: Комп'ютерні науки

description: Kevin founded a startup focused on opening up the potential of cannabis-derived medicine, by replacing plant growth with engineered microorganisms. His side projects include Bricobio - the DIY bio/biohacker/indie science community in Montreal - and he’s also a director of Helios Makerspace. Kevin will speak about his work hacking the genome of yeast to make it produce THC. Being that this process is more in alignment with current pharmaceutical practices and is able to scale much more effectively, he hopes this approach will enable many to explore the benefits of Cannabis-related medicine and products more consistently.

uk: вхід без авторизації

name: CANNABIS VILLAGE - Where do cannabinoids come from?: ...and how much do they cost?


uk: Комп'ютерні науки

description: Dr. Lewis earned his Ph.D. in Chemistry from Purdue University in 2007 and a B.S. in Chemical Engineering from the Rose Hulman Institute of Technology in 2001. His interest in the science of cannabis spans decades and in 2011, Dr. Lewis founded NaPro Research and assembled a team of chemists and plant scientists to create analytical solutions and products across four key sectors: biotechnology, production, laboratory services and consumer education. Over the past five years, Lewis has additionally focused on cannabis breeding and the optimization of a broad range of secondary metabolic pathways within the plant. Selective breeding has been used for thousands of years to create better agricultural crops. Recent advances in the human understanding of genomics have led to breakthroughs in our ability to hack plant genomes to create better and better plants. The analogic relationship between computer programming paradigms and the central dogma of molecular biology are very uncanny and even justify the use of the word “hacking” when describing the selective breeding and administration of tailormade drugs to humans. Whether deleting genes or add genes, techniques have been developed that can modify the plant source code, this development can turn off or turn on programs in the plant that ultimately change the final chemistry of cannabis plants. The final chemistry of the plant can, therefore, be tailor-made to hack individual human metabolomes by design and to fix ‘buggy’ humans or human behaviors.

uk: вхід без авторизації

name: CANNABIS VILLAGE - Hacking Plants to Hack Humans: Using informatics to Breed Cannabis Plants in Order to Hack the Human Metabolome


uk: Комп'ютерні науки

description: Mr. Wanke is a businessman, Mayor, and County Commissioner. He was born in Anaheim and has lived his entire life in Orange County, CA. He currently lives in Placentia, with his wife and their four young children. Chad graduated from Cal State Fullerton with a BA in Geography and a Minor in Anthropology. As the Principal of Orbis Capital Consultants Chad directs all company activities, personally providing government affairs services to a diverse range of clients including large multi-national corporations, religious organizations, private companies, public agencies, family offices and individual property owners. Chad will present a primer on the critical role local government plays in the Cannabis industry. This will touch upon the areas of local Cannabis permits, business licenses, building permits, law enforcement, code enforcement, health/safety/fire, etc, which are all handled at the municipal or County level and are the pain-points most likely to get someone shut down, arrested, or their permit application stopped in its tracks & their business never opened in the first place.

uk: вхід без авторизації

name: CANNABIS VILLAGE - How to deal with local government (if you must)...


uk: Комп'ютерні науки

description: Michael is the founding and managing principal of Hiller, PC. He has built a career on fighting for his clients against large institutions, multi-national corporations, and state and local governments, with specialties including Commercial Litigation, Land-Use, Insurance, and Cannabis. He’s won numerous awards and designations in recognition of his achievements on behalf of community groups, neighborhoods, and corporate clients. Michael - helping represent some professional athletes, military vets, and parents who wish to treat their children with CBD derived products - is currently involved in a federal lawsuit against the US Attorney General, Jeff Sessions regarding the scheduling, or classification, of Cannabis. This lawsuit challenges the constitutionality of the Controlled Substances Act as it pertains to Cannabis/Marijuana. In a 90-page Complaint, attorneys representing five plaintiffs maintain that the CSA, in classifying Cannabis as a Schedule I drug, is so irrational that it violates the U.S. Constitution.

uk: вхід без авторизації

name: CANNABIS VILLAGE - The Federal Cannabis lawsuit and why the controlled Substances Act is going up in smoke


uk: Комп'ютерні науки

description: Case studies of breaches in Cannabis Software. Recently a major Cannabis POS provider found itself on the business end of a sophisticated digital attack not once, not twice, but thrice. Or maybe four times; Poor disclosure policy and a lack of transparency made it hard to tell. A large portion of all dispensaries in the country were forced to enter sales by paper, spreadsheet, or to close their doors temporarily when this software was crashed by attackers. Government contracts were lost. All eyes are on the industry right now and, given its precarious federal legal status, the next moves made will be crucial. What mightve actually happened? How far beyond the carefully prepared press releases can we see by using OSINT, Social Engineering, source code analysis,and some good ol fashioned scripting & hacking? What makes the Cannabis industry a hotbed for this kind of behavior? Lets umm....answer those questions!

uk: вхід без авторизації

name: CANNABIS VILLAGE - Cruising the Cannabis Hiiighway: A Series of Major Breaches in Cannabis


uk: Комп'ютерні науки

description: WeedAnon is a long time infosec practitioner, cannabis enthusiast, and active volunteer with the HackMiami Conference of South Florida. WeedAnon believes that cannabis use is a great way to pass the time while awaiting internet wide port scans to complete, and sees the emerging cannabis industry as an under-served marketplace when it comes to the implementation of information security best practices. This talk will discuss the emerging attack surface of the cannabis industry. Analysis of physical, digital, and compliance risks that go hand-in-hand with newly drafted medical and recreational legislation will be examined. Examples of discussion points include topics such as the secure management of PII, various compliance requirements, secure data storage, interaction with regulatory authorities, physical security issues, IoT security, legal loopholes and ambiguities, as well as suggestions for best practices and resources for followup research.

uk: вхід без авторизації

name: CANNABIS VILLAGE - Compliance and Infosec Within the Cannabis Industry


CAR HACKING VILLAGE - When CAN CANT

uk: Комп'ютерні науки

description: The Controller Area Network (CAN) bus has been mandated in all cars sold in the United States since 2008. But CAN is terrible in many unique and disturbing ways. CAN has served as a convenient punching bag for automotive security researches for a plethora of reasons, but all of the available analysis tools share a shortcoming. They invariably use a microcontroller with a built-in CAN peripheral that automatically takes care of the low-level (ISO layer 1 and 2) communication details, and ensures that the CAN peripheral plays nicely and behaves at those low levels. However, a good hardware hacker understands that the sole purpose of the electron is to be bent to our will, and breaking assumptions by making “That CANT happen!” happen is a surefire way to find bugs. CANT is a (partial) CAN bus peripheral implemented in software that allows security researchers to exercise the electrical bus-level error handling capability of CAN devices. The ability to selectively attack specific ECUs in a manner that is not detectable by automotive IDS/IPS systems (see ICS-ALERT-17-209-01) is invaluable to automotive security researchers as more automakers integrate advanced security measures into their vehicles.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: There exist several approaches to misbehavior detection in V2X networks in research literature, many of them not necessarily taking automotive restrictions into account. Only few approaches do and there is only one approach that has been tested in actual vehicles as far as I know. And that approach has it challenges - although it is an important first step towards implementation. I will present how this (and one or two other) approach works and how it can be tricked. Although misbehavior detection is an integral part of the V2X security system nobody seems to care that V2X gets deployed, but there is no feasible approach for misbehavior detection. I will present a hypothesis why this is and will discuss it with the audience.

uk: вхід без авторизації

name: CAR HACKING VILLAGE - V2X Misbehavior Detection


uk: Комп'ютерні науки

description: OpenXC builds its firmware -- for both the open and proprietary builds -- using JSON data structures which define the CAN signals. These definitions are akin to the CAN database files (.dbc) files. Reverse engineering of the open openXC builds (as an educational excersise) reveals that it is a straightforward matter to identify and extract the CAN signal definitions from the binary. Attendees will learn: What are dbc files? How strings lead reverse engineers to interesting code via backwards cross-references? What tools do attackers use to reverse engineer raw binary firmwares? How do they use them? What are some simple, useful deterrents? How do descriptive data structures -- JSON in particular -- aid attackers in their reverse engineering efforts? What mitigations are possible for this risk? The exposition of machine code in the talk will be via the free radare2 RE tool.

uk: вхід без авторизації

name: CAR HACKING VILLAGE - CAN Signal Extraction from OpenXC with Radare2


uk: Комп'ютерні науки

description: Nowadays any recent car up to 5 years old comes with something called “Infotainment”, this is that IPad-looking screen that allows you to use the GPS Navigation, select your favorite music from your IPod, make or receive calls while speaking through the Car’s speakers, or even ask the Car to read a SMS message for you, that along with the latest self-driving technologies popping up everywhere cannot longer be handled by a microcontroller, it requires an embedded OS to support all those features and therefore the world started worrying about the possibility to get Ransomware on the Car or an Infostealer reading all your SMS messages while you are driving, or triggering a DoS on the CAN Bus so that the Car cannot work properly, etc. All those scenarios used to be hypothetical until now, we grabbed an infotainment, broke into it and reversed engineer all its main components with one goal in mind: to infect the Infotainment with malware that can be commanded remotely through SMS messages.

uk: вхід без авторизації

name: CAR HACKING VILLAGE - Meet Salinas, the first ever SMS-commanded Car Infotainment RAT


CAR HACKING VILLAGE - Go Hack Cars

uk: Комп'ютерні науки

description: Golang is a pretty nifty language, and it's remarkably well suited for car hacking. SocketCAN provides a great framework for interacting with CAN devices, so why not use it from Go? We'll present an open source Go library for making SocketCAN easy, and show how to work with raw CAN and ISOTP data. Attendees will get all the info they need to start hacking CAN buses with Go.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Getting started in car hacking can be a daunting and expensive hobby. In this talk I am going to walk you through what you need to buy (and what you can likely skip). I will also be releasing a quick start guide and a script to help new car hackers build a "Car Hacking" system.

uk: вхід без авторизації

name: CAR HACKING VILLAGE - So, You Want To Hack A Car?


uk: Комп'ютерні науки

description: The security of automobiles accesses control system is a topic often discussed. Today's vehicles rely on key-fob control modules, to ensure the vehicle is accessible to authorized users only. While most traditional automobile key-fob systems have been shown to be insecure in the past, here comes a game changer. Instead of the regular key-fob system, some car owners will be able to access their vehicle by having their smartphone authenticate as a digital car key. In this talk, we will reveal the research and attacks for one of the digital car key system in the current market. By investigating how these features work, and how to exploit it through different possibilities of attack vectors, we will demonstrate the security limitations of such system. By the end of this talk, the attendees will not only understand how to exploit these systems, but also which tools can be used to achieve our goals.

uk: вхід без авторизації

name: CAR HACKING VILLAGE - Grand Theft Auto: Digital Key Hacking


uk: Комп'ютерні науки

description: The Automotive Exploitation Sandbox is a hands-on educational tool designed to provide stakeholders with little to no previous exposure to automotive security a hands-on experience with real hardware following a basic attack chain against a typical automotive development board. The attack chain provides instructions for the user to remotely exploit, escalate privilege, exfiltrate data, and modify memory using synthetic vulnerabilities placed on a remote test platform running an OS and hardware typically found in automotive systems.

uk: вхід без авторизації

name: CAR HACKING VILLAGE - Automotive Exploitation Sandbox: A Hands-on Educational Introduction to Embedded Device Exploitation


uk: Комп'ютерні науки

description: Unified Diagnostic Services (UDS) provides a powerful interface into vehicle diagnostics. OEMs use these services to update firmware, manipulate calibration data, send and receive information from vehicle ECUs, and now more recently for over the air updates. This talk pulls back the curtain on automotive bootloaders and how poor security design or implementation choices can be used by attackers to exfiltrate firmware or even gain persistent code execution.

uk: вхід без авторизації

name: CAR HACKING VILLAGE - Flash Bootloaders Exposing Automotive ECU updates


uk: Комп'ютерні науки

description: The presentation will cover security implications of GPS and positioning attacks. We will discuss real world attacks and incidents. We will touch upon increased reliance on positioning data in accident reconstruction and assistive driving technologies.

uk: вхід без авторизації

name: CAR HACKING VILLAGE - Automotive Evidence Collection – Automotive Driving Aids and Liability


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Revolutionizing Authentication with Oblivious Cryptography


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - JARVIS never saw it coming: Hacking machine learning (ML) in speech, text and face recognition – and frankly, everywhere else


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - “Probably”: an Irreverent Overview of the GDPR


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Catarineu and Modi - Anonymous rate limiting with Direct Anonymous Attestation


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - The Underhanded Crypto(graphy) Contest: 2018 Winners


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Integrating post-quantum crypto into real-life applications


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Two Steps to Owning MFA


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Bullies, Sluts, and Best Selves: Fixing digital privacy education


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Hamilton’s Private Key: American Exceptionalism and the Right to Anonymity


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Opportunistic Onions


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Cloud Encryption: How to not suck at securing your encryption keys


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Prototyping Cryptographic Protocols in Python With Charm


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Geolocation and Homomorphic Encryption


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Cicada: What we can learn from the puzzles


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Jailed by a Google Search: the Surveillance State’s War on Self-induced Abortion


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - “Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - No Way JOSE! Designing Cryptography Features for Mere Mortals


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Building a Cryptographic Backdoor in OpenSSL


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Cryptography, Codes, and Secret Writing: An Introduction to Secret Communications


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Hiding in plain sight: Disguising HTTPS traffic with domain-fronting


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Implementing a Library for Pairing-based Transform Cryptography


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - Green Locks for You and Me


uk: Комп'ютерні науки

uk: вхід без авторизації

name: CRYPTO AND PRIVACY VILLAGE - CATs [CryptoAuthTokens]: A Tale of Scalable Authentication


uk: Комп'ютерні науки

description: For the last five years Backblaze has collected daily operational data from the hard drives in our data centers. This includes daily SMART statistics from over 100,000 hard drives totaling over 500 Petabytes of storage. We’ll start by looking at the lifetime statistics for all the hard drives we have ever used, split out by size and manufacturer. Then we’ll compare the failure rates of consumer versus enterprise drives and we’ll also compare helium-filled versus air-filled drives. We’ll finish up with looking at a handful of SMART attributes to see how temperature relates to hard drive failure and whether or not you can use SMART stats to predict hard drive failure. As a bonus, we’ll show you where to get the data so you can do your own analysis – enjoy.

uk: вхід без авторизації

name: DATA DUPLICATION VILLAGE - Facts, figures, fun from managing 100,000 hard drives


uk: Комп'ютерні науки

description: Whether you have a background in information security, law, or national security, this talk is a beginner’s guide to understanding the law of war in cyberspace. By juxtaposing the law of war with a keyboard, the process of how states evaluate the scale and effects of a cyber operation and determine a basis for resorting to a use of force under the Law of Armed Conflict, can be more readily conceptualized. For if music is indeed, the universal language of mankind, then by encouraging society to learn about this area we can collectively better strategize ways to mitigate cyber conflict

uk: вхід без авторизації

name: DATA DUPLICATION VILLAGE - A Beginner's Guide to Musical Scales of Cyberwar


uk: Комп'ютерні науки

description: Full disk images introduce large amounts of data into a forensic investigation. Still, certain evidence exists only in memory, especially when dealing with malware or fileless attacks designed to stay completely in memory and avoid hitting the disk, exactly for the purposes of avoiding detection and analysis by forensic examiners. Memory forensics is a rapidly growing field, offering many free tools for RAM analysis to uncover important evidence and further the case quickly. As it turns out, these tools can also be applied to a cold drive. Due to OS features such as hibernation, paging and swap space, data from memory ends up being written to disk and survives even when the machine is powered down. In this session, the presenter will introduce the challenges faced when investigations rely solely on disk images, in cases where live memory had not been captured. The audience will then learn how investigators can still benefit from memory forensics in such cases. The presenter will give a full walkthrough of applying techniques, discuss their benefits and limitations, and show examples of results.

uk: вхід без авторизації

name: DATA DUPLICATION VILLAGE - The Memory Remains: Cold Disk forensics 101


uk: Комп'ютерні науки

description: Gluster is a free scalable network filesystem. Using common off-the-shelf hardware, it allows the user to create large, distributed storage solution for media streaming, data analysis, and other data and bandwidth intensive tasks, thus providing a nice alternative to create a data replication pool easily. It was acquired by Red Hat in 2011, and merged into Red Hat Storage server in 2012, while still available in the open source world. Gluster itself doesn't have a large vulnerabilities history, having only 6 vulnerabilities reported in the last 6 years (2 of them after being bought by Red Hat). In this talk, we'll focus on the latter two, releasing GEVAUDAN, an exploit for newcomers to the gluster world to learn about it's architecture and security, and the implicancies of proper access managament on replicated data systems. This is a talk for begginers from both fields: data replication schemas and exploits writing, so both fields will have a proper introductory section. A live demo will take place during the talk, and the public can actively participate.

uk: вхід без авторизації

name: DATA DUPLICATION VILLAGE - Owning GlusterFS with GEVAUDAN


uk: Комп'ютерні науки

description: Protecting volunteers from retribution, and why the fear of unknown unknowns is paralyzing to the academic measurement community.

uk: вхід без авторизації

name: ETHICS VILLAGE - Accountability without accountability: A censorship measurement case study


uk: Комп'ютерні науки

description: How does a researcher become empowered to influence business and marketing leaders to balance coordinated disclosure, opsec protection, and tradecraft protection, with corporate interests? This talk examines use cases gone wrong, and opportunities for all groups to work together to make it right.

uk: вхід без авторизації

name: ETHICS VILLAGE - Ethical Disclosure and the Reduction of Harm


uk: Комп'ютерні науки

description: While at the first glance infosec might seem to be a mainly technical domain you might encounter ethical dilemmas very soon once you start working in the field (namely when you do offensive stuff). In this talk I'll provide an introduction how to tackle such situations in a structured way and on the basis of common approaches and values.

uk: вхід без авторизації

name: ETHICS VILLAGE - Ethics for Security Practitioners


uk: Комп'ютерні науки

description: How do we combat the moral dilemmas technology brings to humanitarian and disaster response? Ethically based decision making can improve the influence of technology during a crisis.

uk: вхід без авторизації

name: ETHICS VILLAGE - Ethics of Technology in Humanitarian and Disaster Response