uk: Комп'ютерні науки

description: Initially, heap was just one of access methods as well as btree and hash indexes were. So, extendability of access methods implies pluggable storage engines support in modern terms. For now, only index access methods are defined in pg_am table of system catalog. Those index access methods also have well-defined interface. Therefore in order to meet initial design PostgreSQL need to support two features: - Pluggable index access methods, i.e. ability to implement new index types by adding new tuples to pg_am; - Pluggable storage engines, i.e. ability to implement completely different storages for tables without traditional heap.

uk: вхід без авторизації

name: PostgreSQL extendability: Origins and new horizons: Towards pluggable storage engines


Sean Chittenden

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: Virtual IPs or floating IPs have long been the workhorse mechanism for providing high-availability for database systems, however floating IP addresses have several limitations that make it problematic in modern data centers and cloud environments, notably that it requires all members be in the same Layer-2 domain. consul is a strongly consistent way of providing high-availability services in Layer-3 environments and provides fail-over across different geographic regions. In this talk we will discuss the benefits, setup, and use of consul for fail-over of PostgreSQL, both in a local data center scenario and a geographic redundancy scenario where databases are split across multiple data centers.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: PostgreSQL High Availability and Geographic Locality using consul

name: PGCon - PostgreSQL Conference for Users and Developers

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Комп'ютерні науки

description: The buffer manager (primarily configured by shared_buffers) is the part of Postgres that caches on-disk data in memory. That is required both for correct crash recovery and performance. Unfortunately some parts are showing its age. We'll discuss how it currently works, what problems there are, and what attempts are in progress to rectify these weaknesses: * Checkpoints can sometimes trigger huge amounts of IO, leading to long delays of concurrent requests * Lookups in the buffer cache are expensive * The Buffer Mapping table is a hash table, making efficient implementations of prefetching, write coalescing, dropping of cache contents hard * Relation extension scales badly * Cache replacement is inefficient and often replaces the wrong buffers * Double Buffering between the OS and postgres The exact content of the talk will take the state of postgresql's master branch from around the conference into account. It'll less focus on how to tune postgres, and more on how postgres itself can be improved.

uk: вхід без авторизації

name: PostgreSQL's buffer manager - Problems & Improvements


PoWA 3: Towards a computer assisted DBA

uk: Комп'ютерні науки

description: In detail, we will present the various tools making the PoWA stack, and how they truly shine when used together. This will include: - presentation of pgqualstats, pgstat_kcache, hypopg - presentation of powa-archivist, the stats aggregator - use cases where PoWA can provide exactly the kind of information that is hard to reach for the DBA - how does the global workload index suggestion works - future developments, and where this will take us.

uk: вхід без авторизації


Queues in PostgreSQL

uk: Комп'ютерні науки

description: Many projects involve something resembling job or message queuing. In this talk I will look at: - the pros and cons of using a plain old relational database for this type of workload rather than specialized technology - approaches and designs - special considerations for PostgreSQL - performance and tuning - potential improvements

uk: вхід без авторизації


Run Simple Query Faster

uk: Комп'ютерні науки

description: When we consider the any executor engine, its very generic and designed for supporting wide range of queries and so does the postgres SQL engine. Consider very simple query i.e TPC benchmark or PGBench, where the queries and only simple update, select, insert etc., Here simple queries means queries which don't have complex quals, join, sub-queries, some function calls in quals.

uk: вхід без авторизації


The PCI Compliant Database

uk: Комп'ютерні науки

description: Everyone talks about database security, but what are we really doing about it? The Payment Card Industry standards specify what you need to do in order to store credit and debt card information in your database. If you store that information, you have to comply. Even if you don't store that information, it's a good reference point for what it takes to actually secure a database. We'll discuss all aspects of what the PCI standard requires of your database, including: - Firewalls and network infrastructure. - Security policies. - Data security at the database level. - Data security in flight. - Client-level security. - Development and operational requirements for security. While structured in the context of the PCI standard, the information is useful for anyone who maintains sensitive information in a database, and that's nearly everyone.

uk: вхід без авторизації


Introducing: pg global kv

uk: Комп'ютерні науки

description: pgglobalkv was born out of a need to replace our existing site personalization infrastructure that was built on top of a certain NoSQL solution so we turned to Postgres, our datacenter workhorse, to solve this problem. We needed a multimaster replication that was far faster and less resource intensive than trigger based replication and we weren't comfortable running experimental versions of BDR in production yet. We wanted something built on top of a mature version of Postgres using only well tested core functionality. Using only PL/pgSQL, the Postgres Foreign Data Wrapper, and a light weight daemon that runs next to Postgres, we were able to build a replication based on timestamps which could keep up with whatever the underlying Postgres server could handle. In our case we were able to push 15,000 writes per second (and far more reads) per machine. We've never needed more than one machine per datacenter per instance but pgglobalkv is topology agnostic in terms of it's performance characteristics and this allows it's performance to scale linearly with the number of machines. Since we put our first pgglobalkv instance into production 7 months ago, it has taken 19.3 billion document writes while maintaining 660 million documents without a single production incident and we have plans of building more production critical infrastructure on top of it. When open sourcing pgglobalkv, we are open sourcing all of the pieces on the Postgres side: all the replication code, the PL/pgSQL UPSERT plus conflict resolution, row expiry daemon, the server setup and configuration, and monitoring infrastructure. All that is missing is the application side code that hashes keys to pick an appropriate shard. Obviously, we needed to make a number of tradeoffs to get the performance that we did. This talk will cover the strengths and weaknesses of pgglobablkv as a solution, as well as what features are currently missing to make it fully featured for every use case.

uk: вхід без авторизації


WAL Reduction

uk: Комп'ютерні науки

description: Under heavy write load on the server, writing large amount of WAL to disk can pose to be a bottleneck and slow down rate of transaction commit. Not only that, streaming large amount of WAL and writing it on standby can introduce replication delays resulting in unrecoverable data loss in case of primary server crash. To alleviate this and improve performance, features to reduce WAL size have been introduced in PostgreSQL core. This talk describes such features and scenarios in which they should be used.

uk: вхід без авторизації


Yandex.Mail success story

uk: Комп'ютерні науки

description: Yandex is one of the largest internet companies in Europe, operating Russia’s most popular search engine and its most visited website. Yandex.Mail is one of the biggest mail services in Russia with audience of 50+ million users weekly and 200+ million users total. All mail metadata (without message bodies) were stored in Oracle databases with a total size of approximately 300 terabytes (without accounting raids and standbys, only data) and total load of 250.000 transactions per second. It took us several years to migrate all these data and load from Oracle to PostgreSQL. In this talk we will speak about our motivation, architecture decisions, migration process and of course about difficulties faced.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: ARINC is a 90-year-old company originally created to coordinate and support radio communications for airlines. Since then, ARINC has developed several standards to promote interoperability between manufacturers of line-replaceable units (LRUs.) This talk will cover major ARINC standards, such as ACARS (an air-to-ground messaging system), 429 (the CAN bus of aviation), and AFDX, and explain why it’s completely impossible to control a 737 through a compromised in-flight entertainment system.

uk: вхід без авторизації

name: Aviation Village - An Introduction to the ARINC standards


uk: Комп'ютерні науки

description: Modern aircraft heavily rely on several wireless technologies for communications control, and navigation. Researchers demonstrated vulnerabilities in many aviation systems e.g., injecting ghost aircraft into airspace, spoof locations and manipulate key communication messages. However, the resilience of the aircraft landing systems to adversarial wireless attacks have not been studied in the open literature, despite their criticality and the increasing availability of low-cost SDR platforms. In this work, we investigate and demonstrate the vulnerability of aircraft instrument landing systems (ILS) to wireless attacks. In majority of airports today, commercial traffic is typically assigned some type of instrument approach into the landing phase to maintain smooth flow of traffic in and out of the airport environment. The demonstrated attacks can cause last-minute go around decisions, missing the landing zone in low visibility, and even cause crash landings depending on the level of automation in the future. We analyze the ILS waveforms and show the feasibility of spoofing such radio signals using commercially-available SDR. We show that it is possible to fully and in fine-grain control the course deviation indicator, as displayed by the ILS receiver, in real-time, and demonstrate it on aviation-grade ILS receivers. Additionally, we introduce a novel attack called the single-tone attack that significantly reduces the power requirements of the attack. We develop a tightly-controlled closed-loop ILS spoofer that autonomously adjusts the adversary’s transmitted signals based on the aircraft’s GPS location to cause an undetected off-runway landing. We demonstrate the integrated attack on an FAA certified flight-simulator’s (X-Plane) AI-based auto-land feature and show success rate with offset touchdowns of 18 meters to over 50 meters. We discuss potential countermeasures and show that unlike other aviation security issues that can be fixed with conventional crypto, they are ineffective against the demonstrated attack and securing ILS poses unique challenges.

uk: вхід без авторизації

name: Aviation Village - Wireless Attacks on Aircraft Instrument Landing Systems (ILS)


uk: Комп'ютерні науки

description: Both general aviation and commercial aircraft rely on a wide variety of radio systems for navigation as well as communications and data telemetry. Learn about all the RF system dependencies to worry about the next time you’re flying the friendly skies.

uk: вхід без авторизації

name: Aviation Village - In The Air And On The Air Aviation Radio Systems


uk: Комп'ютерні науки

description: Two years ago, the U.S Air Force opened its doors to hackers with the launch of the Hack the Air Force challenge. Since then, the Air Force has run numerous other bug bounty challenges, ranging from logistics sites to custom hardware and engaging thousands of hackers along the way. Hear from Assistant Secretary of the Air Force Dr. Will Roper and Defense Digital Service hacker Jack Cable on the Air Force’s engagement of hackers via bug bounties and future initiatives in aviation security. In this open discussion, we encourage attendees to share their thoughts on how the Air Force can continue to work with the security community to improve the state of aviation security.

uk: вхід без авторизації

name: Aviation Village - Hacking the airforce and beyond


uk: Комп'ютерні науки

description: From origins in general purpose computing, Coordinated Vulnerability Disclosure (CVD), Software Bill Of Materials (SBOM), and Secure Over-The-Air (SOTA) updates have been implemented or considered in safety sectors including industrial control systems, medical devices, and ground transportation. These common software security practices are becoming widespread global norms, turning up in public policy, international standards, and national law (often in sector-specific safety regulation).

uk: вхід без авторизації

name: Aviation Village - Ideas whose time has come: CVD, SBOM, and SOTA


uk: Комп'ютерні науки

description: Speed is vital in startups, and fast moving CI/CD pipelines are the norm in startups. Dynamic application security testing (DAST) can take advantage of the speed, automate along the CI/CD pipelines, and enable developers to fix issues while vulnerabilities are in development phase. In order to be integrate seamlessly with CI/CD pipelines, DAST tools should be ready to be deployed as code, integrate with a modern build system, and be able to provide instant feedback. Existing commercial DAST tools generally do not have such capabilities. In this presentation, we discuss how we dockerized Headless Burp, deployed the Headless Burp as code, so that it can be integrated with Selenium tests on demand.

uk: вхід без авторизації

name: Appsec Village - Automate Dynamic Application Security Testing: An approach in dockerized CI/CD pipelines


uk: Комп'ютерні науки

description: Purple Team testing, or the active collaboration of offensive and defensive staff during penetration tests, can help organizations address their most immediate security threats, increase the accuracy of testing, and create a feedback loop where both teams contribute to the success of the other. Typical Dynamic Application Security Testing (DAST) does not lend itself well to Purple Team practices. This talk covers the basics of conventional Purple Team exercises, the ways that application testing environments and tools often differ from penetration testing, and how application defenders and breakers can adapt to those differences to enable each other in an integrated fashion. For defenders, learn how your insights into the overall environment and risks, knowledge of security controls, and the state of and output from applications being tested can lead to better, faster, and more actionable application security tests. For breakers, learn how to help defenders better recognize threats in logs and alerting systems and increase their ability to spot, stop, and mitigate real-world attacks. Both sides can benefit from fewer missed opportunities to work together to increase the security of their organization while reducing the friction that the often adversarial nature of security testing creates.

uk: вхід без авторизації

name: Appsec Village - Purple Team Strategies for Application Security


uk: Комп'ютерні науки

description: Unfortunately, in large organizations, it becomes very challenging for the security team to review and track all the commits and deploys that occur in all the company's products. To circumvent this problem, I developed a tool in Go to automate security testing within the Continuous Integration pipelines called huskyCI.

uk: вхід без авторизації

name: Appsec Village - huskyCI: Finding Security Flaws in CI Before Deploying Them


uk: Комп'ютерні науки

description: Application Security began in the early 60's where plain text password storage, no password policy, poor access control and other massive security problems were the norm. This talk with review the history of application security to help illustrate not just how much application security has gotten better, but also how the rate of positive change has been getting better as well. This fun ride through the history of application security is meant to inspire those who work in the industry. We are often looking closely at failure and insecurity, but when we step back and look at our industry historically, we can all see just how much things truly are getting better.

uk: вхід без авторизації

name: Appsec Village - Keynote: The Unabridged History of Application Security


uk: Комп'ютерні науки

description: Over the past few years, AppSec professionals have become increasingly reliant on automation. While it's fine to use tools to do the work that you just don't have the time for, there are many vulnerabilities that automated tools can't detect. In this talk, we'll discuss methodologies for finding those hidden vulnerabilities so you can sleep a little better at night.

uk: вхід без авторизації

name: Appsec Village - Vulnerabilities that Hide from Your Tools


uk: Комп'ютерні науки

description: Crypto used to mean cryptography - and in the realm of mathematics. Nowadays, everyone wants some crypto for their security schemes. But sometimes people forget is that crypto is hard - and trusting your own crypto is very risky if you don't actually have cryptographers in your team! In this talk, we will review some common crypto failures and how they led to some of the biggest issues we've seen in recent years and conclude with some concrete advice on how to avoid such mistakes, and more importantly where to get advice.

uk: вхід без авторизації

name: Appsec Village - Crypto Failures and how to avoid them


uk: Комп'ютерні науки

description: There are over 17,000 police agencies and 38,000 local governments in the US. They all use software to track your taxes, handle 911 calls, and and store reports documenting the worst days of citizens' lives. AppSec is damn important, but most agencies are lucky to have an IT department, let alone anyone looking after security. The apps in LE and Local.gov are generally hidden from scrutiny. When the end-users don't have the resources to dig into what happens under the hood, what sort of flaws sneak into those products? This talk will take you behind the curtain and show you the gnarly stuff your tax dollars paid for, vulns found and fixed, and how you can help make things better.

uk: вхід без авторизації

name: Appsec Village - How bad could it be? Inside Law Enforcement and local.gov appsec


uk: Комп'ютерні науки

description: Welcome and Introductions

uk: вхід без авторизації

name: Appsec Village - Welcome and Introductions


uk: Комп'ютерні науки

description: Attackers love it when defenses fail. Implementing defenses without properly understanding the risks and threats is usually a waste of money and resources. This is a frank discussion of what control failures an attacker looks for when attempting to breach an enterprise, as well as how an effective control can help prevent an attacker from being successful. Jayson will walk through real-world scenarios that have led to successful compromise of different companies through control failures. He will also give detailed analysis of controls that led to his attacks being effectively thwarted. Learn how to understand and assess real-world risks, as well as simple defenses which can be implemented to better protect your organization. Jayson E. Street is an author of the “Dissecting the hack: Series”. Also the DEF CON Groups Global Ambassador. Plus the VP of InfoSec for SphereNY. He has also spoken at DEF CON, DerbyCon, GRRCon and at several other ‘CONs and colleges on a variety of Information Security subjects. *He was a highly carbonated speaker who has partaken of Pizza from Beijing to Brazil. He does not expect anybody to still be reading this far but if they are please note he was chosen as one of Time’s persons of the year for 2006.

uk: вхід без авторизації

name: Social Engineering Village - I PWN thee, I PWN thee not!


uk: Комп'ютерні науки

description: You learned how to build rapport from Robin. Then you learned about the code of trust… but blending all of it together to now master – SIZING PEOPLE UP. Robin is a best-selling author, professional speaker, trainer, facilitator, and retired FBI Special Agent and Chief of the Counterintelligence Behavioral Analysis Program. Robin has taken his life’s work of recruiting spies and broken the art of leadership and relationship building into Five Steps to TRUST. Since 2010, Robin has been working with large corporations as well as small companies in every aspect of their business. Whether it is newly promoted leaders, executives, sales teams, or customer relations, Robin has crafted his Code of Trust for quick results and maximum success.

uk: вхід без авторизації

name: Social Engineering Village - Sizing People Up: Analyzing Behavior Like an FBI Behaviorist


uk: Комп'ютерні науки

description: Use of patterning and adversarial input techniques are on the rise as computer vision analysis of everything from our faces to our license plates becomes ubiquitous for everything from marketing to state surveillance. This talk will be a highly tactical guide to give an overview of the work in the area of confounding or intentionally triggering computer vision systems with fashion. This presentation will show you the same open source guides, libraries, and resources to build your own adversarial clothing, via the process used to develop ALPR-triggering fabrics. This talk will review not only the technical and aesthetic considerations, but also getting over the manufacturing hurdle from design to prototype so you can quickly deploy your fashion hacks to the people BIO Kate Rose is director of an organization that provides privacy, security, and technology resources and training to nonprofits and activists. She’s organized civic hackathons across the US, and currently leads a volunteer team building open source state advocacy tools. When she’s not recreationally filing FOIA requests, she illustrates and designs fabrics.

uk: вхід без авторизації

name: Crypto and Privacy Village - Sartorial Hacking to Combat Surveillance


uk: Комп'ютерні науки

description: The Sony hack proved that content producers are unprepared for attacks and unaware of the damage that can be caused to their IPs. Hacking Hollywood is a glimpse into the filmmaking process from a security minded and social engineering perspective. Learn the details that go into making a film and how the (dis)structure of the industry leaves them vulnerable to attack and what they can do about it. Andrew Nicholson As a film location scout, Andrew has made a living out of getting into peoples homes and places of business to take pictures. He has worked on Hollywood film and television productions for over 6 years. His most recent credits include the Black Lightning Pilot and the 2018 Dynasty Reboot.

uk: вхід без авторизації

name: Social Engineering Village - Hacking Hollywood: Confessions of a film scout


uk: Комп'ютерні науки

description: Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

uk: вхід без авторизації

name: Voting Village - Election Security (Beyond the Machine): Are we forgetting anything?


Voting Village - 2020 - Ready? or Not?

uk: Комп'ютерні науки

description: Presentations from the DEF CON 27 Voting Village

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Keynote Remarks from Senator Ron Wyden


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Incident Lifecycle and Incident Response Management Planning


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - If the Voting Systems are Insecure Let's just Vote on our phones!


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - What Role Can Journalists Play in Securing Elections?


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Organizational Cybernetics: A Key to Resilience for the Digital Village


Voting Village - Panel

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Ideas Whose Time Has Come: CVD, SBOM, and SOTA


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Unclear Ballot: Automated Ballot Image Manipulation


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Addressing the election security threats posed by very small Jurisdiction


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Assessing Election Infrastructure


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Voting Village Speaker Track


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Bootstrapping Vulnerability Disclosure For Election Systems


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Thirty Years Behind the Ballot Box: A firsthand look at the multiple factors preventing fair, effective and secure elections in America


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - While the Bots Distracted You Overt Russian Information Operations


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - The Role of State and Local Election Administrators in Securing Elections


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Trustworthy Elections Evidence and Dispute Resolution


keywords: System Security Integrated Through Hardware (SSITH)

uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - The DARPA SSITH Program at DEFCON


Voting Village - Chris Krebs

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Beyond the Voting Machine.: Other High Value Targets in Today's Election System


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Putting Voters First: Expanding Options to Vote


uk: Комп'ютерні науки

description: DEF CON 27 Social Engineering Village

uk: вхід без авторизації

name: Social Engineering Village - R Paul Wilson


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Voting Village - Machine Voting: The Bulgarian Experience


uk: Комп'ютерні науки

description: Presentation from DEF CON 27 Social Engineering Village

uk: вхід без авторизації

name: Social Engineering Village - Ex3cutiv3s In Th3 R3d


uk: Комп'ютерні науки

description: Fighting child abuse is dirty work. Does getting dirty justify the ends? Join our new COO as he discusses the very important topic. McCombs comes to ILF uniquely primed with more than 20 years of experience in the tech industry, combined with more than a decade of experience in C-level roles. In those critical capacities, McCombs led enterprise-wide initiatives within project management, customer relationship management and acquisition, policies and procedures, process improvement, and infrastructure. McCombs is also an accomplished public speaker and trainer, focused on change management, professionalism, social engineering, and corporate security. In the past, McCombs volunteered for the Autism Hope Alliance and currently donates his time to local business as a trusted advisor.

uk: вхід без авторизації

name: Social Engineering Village - Why vigilantism doesn't work: What am i going to do about it?


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Social Engineering Village - The SEPodcast Ep 120 Live Guest Robin Dreeke


uk: Комп'ютерні науки

description: Practical OSINT techniques are not just applicable in a day-to-day infosec job but can also benefit every aspect of your life. Expressed through personal stories and walk-throughs of real investigations I will show you how OSINT makes you more effective at any job and safer in the real world. Ryan MacDougall is a Senior Social Engineer Pentester for Social-Engineer LLC, who has over 20 years’ experience in the information technology world and 6 years in the security space specifically. Currently a trainer for SECOM’s OSINT classes which have been seen at Blackhat, DerbyCon, and numerous public and private sessions.

uk: вхід без авторизації

name: Social Engineering Village - OSINT in the Real World


uk: Комп'ютерні науки

description: Social engineering is a special form of hacking that bridges our technical skills with a deep understanding of human behavior. Many of us use this special blend of techniques to assist in our various colors of hacking but even those of us not in a professional social engineering, hacking, or penetration testing role can use these skills to aid in our career success. Social engineering has a wonderful set of techniques that can be used to help you enter into a new job, a new career, get a promotion, self promote, overcome imposter syndrome, plus many other situations. This talk will walk through the ways we can apply our knowledge of social engineering to any job and any career to help us be successful. Rebecca Long is a software engineer with 15 years experience focusing on quality assurance and DevOps. She is currently working at RiskLens, a cyber-risk quantification software company in Spokane as their Lead DevOps Engineer, Washington. She holds undergraduate and master’s degrees in computer science with her thesis on social engineering and phishing within a financial institution. As a leader in the Spokane tech community for most of the last decade, in 2018 she finally launched her dream of a non-profit called Future Ada which supports and advocates for women and non-binaries in STEAM (science, technology, engineering, art, and mathematics).

uk: вхід без авторизації

name: Social Engineering Village - Hacking Your Career Thru Social Engineering


uk: Комп'ютерні науки

description: Perry Carpenter is the author of, “Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors” from Wiley Publishing, and he currently serves as Chief Evangelist and Strategy Officer for KnowBe4, the world’s most popular security awareness and simulated phishing platform. Previously, Perry led security awareness, security culture management, and anti-phishing behavior management research at Gartner Research, in addition to covering areas of IAM strategy, CISO Program Management mentoring, and Technology Service Provider success strategies. With a long career as a security professional and researcher, Mr. Carpenter has broad experience in North America and Europe, providing security consulting and advisory services for many of the best-known global brands. Perry holds a Master of Science in Information Assurance (MSIA) from Norwich University in Vermont and is a Certified Chief Information Security Officer (C|CISO).

uk: вхід без авторизації

name: Social Engineering Village - The Aspies Guide to Social Engineering...: your way through life


uk: Комп'ютерні науки

description: Red Teaming isn’t just pen testing. Red team approaches and techniques are widely used in the military, intelligence community, and throughout the private sector. Every institution, from the Marines Corps to pharmaceutical giants, experiences the same organizational pathologies that make the unable to identify blind spots, challenge assumptions, or consider adversarial perspective. This talk will describe why red team approaches are needed, and offer concrete examples of where and how they have been used effectively. These practical tips and best practices of what makes red teams succeed will be intuitively useful to members of the information security community. Micah Zenko is the Director of Research and Learning at McChrystal Group, and columnist at Foreign Policy magazine. Previously, he worked at the Council on Foreign Relations, Harvard’s Kennedy School of Government, and the State Department’s Office of Policy Planning. Zenko consults with military commands, law enforcement agencies, the private sector, and nonprofit research organizations. He is the author of three books, including Red Team: How to Succeed by Thinking Like the Enemy. He has a PhD in political science from Brandeis University, and a Wisconsin bartender license.

uk: вхід без авторизації

name: Social Engineering Village - Red Teaming: Insights and Examples from Beyond the INFOSEC Community


uk: Комп'ютерні науки

description: Countless tactics exist in exploiting corporate infrastructure; stealing equipment, data, or committing rampant sabotage. In the aftermath these can decimate an enterprise in numerous ways.You cannot allow such disaster on your watch.“Leveraging the Insider Threat” goes into the psychology behind attacks, reasoning and psychological manipulation techniques; while also being an overview of common Social Engineering tactics, both remote and physical. These are meant to trick, coerce, and ensnare users without alerting anyone to suspicion.Learn how some terrifying tactics work, and in turn flip the table on attackers.Also Transform yourself, learn to be Awesome! Marcus Liotta has led a 13-year Systems Administration, and Technology Sales career. Between learning how to sell products to anyone, performing Advanced Malware Removal, and processing Automation techniques for better control and defense of company infrastructure – Marcus has ensured he is plenty capable of not only identifying threats, but also evaluating the psychology behind them. In his spare time Marcus works on countless projects such as DIY Tech inventions, or writing and designing artistic representations of his work in a creative manner. He also studies and practices practical (legal and fun) psychological manipulation in daily life.

uk: вхід без авторизації

name: Social Engineering Village - Leveraging the Insider Threat oh,: and how to be awesome


uk: Комп'ютерні науки

description: Have you considered the social engineering implications of ride share(Uber/Lyft) interactions? Want to get better at social skills and get comfortable with people? In this talk I will explain the potential to use ride sharing services as not only a highly accessible platform for practicing social engineering and honing soft skills, but also as a potential attack vector that is rarely considered by the casual rider. I will share my real life experiences experimenting with ride share driving and how the small talk you probably already engage in can be leveraged against you. From teenage script kiddie to hacker con speaker and INFOSEC podcaster, I’ve worked in all areas of tech from dial-up tech support to level 1 network operations center. My specialties include social engineering, physical security and open source intelligence. I am also the host of the Sudo Social Club podcast & YouTube channel, a project centered around hacking capture the flag, wargames, crypto-challenges and vulnerable VM’s.

uk: вхід без авторизації

name: Social Engineering Village - Rideshare OSINT: Car Based SE For Fun and Profit


uk: Комп'ютерні науки

description: Corporate colors and logos characteristic of a brand are easily and freely accessed on the network. As consumers we have been advised to distrust an email with these identities. Instead, the voice gives us confidence. When we need help, the voice is there. It is the first thing we hear when we call, it tells us how wonderful and beneficial it is to be associated with that brand. A voice that will never harm us, until now. Identity spoofing is one of the most used social engineering formats to initiate major attacks. But what if cyber-criminals could go further? What would happen if someone could not only impersonate, but actually use the identity of an institution to make an attack on a national level? Is it possible to do this with a minimal investment or without capital? The answer is yes. Daniel Isler is Security Consultant, Bachelor in Arts of Representation, Actor and Scenic Communicator and Voice Over Artist. With more than 10 years of experience as an academic in Acting classes at the University of Valparaíso, UNIACC University and Professional Institute Aiep. He also develops projects in the area of visual arts. With those who have participated in contemporary art festivals in Chile, Argentina, Portugal and Spain. Since 2015 he leads the Social Engineering team at Dreamlab Technologies. Certifications / Competencies: • Advanced Practical Social Engineering, Orlando, FL, United States. • Usable Security, University of Maryland, United States. • Improvisation Summer School, Keith Johnstone Workshop Inc. Calgary, Canada. • French for foreign language, Université de Pau et des Pays de L’adour, Pau, France. • Diploma in commercial speech, dubbing and neutral accentuation, Voces de Marca, Caracas, Venezuela. • Diploma in Digital Photography, Arcos Professional Institute. • Diploma in Audiovisual Language, UNIACC University.

uk: вхід без авторизації

name: Social Engineering Village - The Voice Told Me To Do It


uk: Комп'ютерні науки

description: Ever wanted to get into Social Engineering (SE), but thought you needed to know body language, facial expressions, be charming, and outgoing to succeed? This is a common misconception and you don’t need to know or be those things to make a start in SE. I think most SE talks focus on the more technical “human” aspects and I’m purposefully ignoring that side. I’m going to focus on the basics; how to perform reconnaissance, how to match dress styles, how to make up a pretext that fits your knowledge, how to get real staff to help you, what to do if you do get in, why you should interact with staff, and why you should practice being observant. These are important tools to learn and use, which can help you make a start in social engineering. Chris has worked in a range of industries, most notable of which are Critical National Infrastructure (CNI), and leading edge design and manufacturing (Dyson). Doing so has given Chris a very varied array of knowledge, from penetration testing robot vacuum cleaners, to designing and testing secure SCADA networks. During Chris’ time at Dyson, he was involved in developing the global security team and performing internal penetration testing. Chris was also heavily involved with securing the design of Dyson’s current and future internet connected appliances, and corresponding smartphone applications. More recently, Chris has been conducting ever more security tests and audits of ICS in the rail, air, maritime, and utilities sectors, as well as CNI work at nuclear sites. Chris’ skill set also includes Social Engineering, and has successfully gained access into CNI, Airports and Casinos, which are regarded are some of the most secure facilities in the industry.

uk: вхід без авторизації

name: Social Engineering Village - The Basics of Social Engineering: aka How I break into Casinos, Airports and CNI


uk: Комп'ютерні науки

description: Cold reading is a technique to make others believe that you have psychic powers. After reading everything I could find on cold reading, I ran a two-day experiment during the Veracode Hackathon, where I gave psychic readings to colleagues whom I didn’t know personally. Each participant filled in a survey at the end of the reading, and gave me a short video statement about the experience. In this talk, introduce the concept of cold reading, my experiments, and recommendations for using cold reading techniques in social engineering. I’ll walk through the set up of the experiment, which included setting the scene through props, gauging the “sitter’s” level of experience and openness to psychic readings, and then various techniques I applied. These included using statements rather than questions, rainbow ruses based on reading social cues, and playing with probabilities. The talk includes video testimonials and survey results to show the effectiveness of the techniques in the experiment. We’ll then switch to applying cold reading to social engineering. We’ll cover how props help build your authority if you introduce them in the right way. Using statements rather than questions demonstrates that you are an insider and know the company or situation well, which builds rapport fast. Gauging whether a target is tech savvy helps you tailor your attack. Researching frequently used hardware and software (probability game) and using these in statements can further build your authority. We’ll learn how fortune tellers are never wrong, and how to build justifications so you are always right. Doing OSINT research on your target will help your hit rate, which is what psychics call a warm reading. Before going into questions we’ll cover the following week’s winning numbers for MegaMillions. Chris Kirsch has always had a passion for security, but bad life choices led him to a career in marketing – for many DEF CON attendees just one step above a rose seller. He has enjoyed worked product marketing jobs at PGP Corporation, nCipher, Rapid7 and now Veracode. Born in Germany, he has lived in Switzerland, the United Kingdom, and now the United States. In 2017, Chris received a DEF CON black badge for the Social Engineering CTF by shamelessly taking advantage of nice, trusting people at a Fortune 500 gaming company. Chris is currently looking for an internship with a fortune teller to advance his career.

uk: вхід без авторизації

name: Social Engineering Village - Getting Psychic: Cold Reading Techniques for Fortune Tellers and Social Engineers


uk: Комп'ютерні науки

description: It was 10 years ago it all started in a tiny little squalid room. Hundreds of people packed in to see a new type of event – one that made headlines and scared the world. 10 years later – what has changed, where are we? what can we learn from the last decade? Chris is a professional social engineer with over 17 years of experience. His passion is understanding the why not just the what. Chris has had the opportunity to work with some of the world’s greatest minds in learning how to use skills that might not be too common to be infused in this industry.

uk: вхід без авторизації

name: Social Engineering Village - 10 Years: What has Changed?


uk: Комп'ютерні науки

description: “It is estimated that nearly 70% of people will experience signs or symptoms of Impostor Syndrome.” Too many people get stuck in a self-doubt loop. This is when feelings of being an impostor creep in. Billy Boatright is part of the nearly 30% that have not. Billy will share with you how an early failure and a “pep talk” from an all-time great has allowed him to avoid persistent feelings of self-doubt. Whether it’s your next social engineering engagement or giving a talk at a conference, Billy will also share ways that can help us all avoid the self-sabotage of Impostor Syndrome. Billy will also dive into the “Hero Worship” culture that social media created. Billy began his social engineering career without even knowing it. He was a bartender on the Las Vegas Strip for the better part of a decade. He won numerous awards from all over the world as a Top-ranked Flair Bartender. He has taken the skills he learned behind the bar to the Information Security world. Billy has been a Judge for the Social Engineering Capture the Flag event at Defcon. He is also the namesake for the BSides Las Vegas Social Engineering Capture the Flag Championship Belt. Billy also volunteers time and expertise to the Las Vegas ISSA Chapter as a Board Member. He is also a member of the BSides Las Vegas Senior Staff. Billy has multiple degrees and numerous certifications. However, when asked about them he will gladly quote George Moriarty, “The shining trophies on our shelves can never win tomorrow’s game.”

uk: вхід без авторизації

name: Social Engineering Village - Swing Away: How to conquer Impostor Syndrome


uk: Комп'ютерні науки

description: The data center embodies the heart of many businesses on the Internet. It contains much of the information in a centralized location which provides a huge incentive for those who would wish harm. The data centers in the realm of Cloud may no longer contain just a single entity, but many individual tenants that attach to a common fabric. The Cisco Application Centric Infrastructure (ACI) aims to meet these needs with a multi-tenant, scalable fabric that interconnects physical hosts, VMs and containers. ACI is Cisco's answer to the centrally-managed Software Defined Network (SDN). The Application Policy Infrastructure Controller (APIC) and Nexus 9000 series switches form the brains and backbone of ACI. A member of Cisco's Advanced Security Initiatives Group (ASIG) will demonstrate their findings during an evaluation of ACI and the APIC, more than three years before the BH2019 talk "APIC's Adventures in Wonderland." Step into the mind of an attacker and scan, probe, and interact with the network fabric to progress from an unauthenticated user to administrator and root of the data center switch fabric. Once inside the system, see how the APIC can be modified in a nearly undetectable manner to provide the attacker unfettered internal access to all the interconnected hosts and VMs in the data center. The target audience for this talk includes those with a technical interest in offensive discovery and secure product development. Participants will receive an overview of how a data center product is viewed in an offensive light. About Chris McCoy: Chris is a technical leader in Cisco's Advanced Security Initiatives Group (ASIG) and published author of Security Penetration Testing, The Art of Hacking Series LiveLessons with Cisco Press. He has over 20 years of experience in the networking and security industry. He has a passion for computer security, finding flaws in mission-critical systems, and designing mitigations to thwart motivated and resourceful adversaries. He was formerly with Spirent Communications and the U.S. Air Force. Chris is CCIE certified (Emeritus) in the Routing & Switching and Service Provider tracks, which he has held for over 10 years.

uk: вхід без авторизації

name: Red Team Offensive Village - Through the Looking Glass: Own the Data Center


uk: Комп'ютерні науки

description: Phishing seems easy enough, but getting successful results can be difficult. In this talk we'll walk through practical tips for getting better responses. We'll talk about target selection, ruse development, technology deployment, and suggestions for working with clients to maximize the value of the assessment. About Nathan Sweaney: Nathan works for Secure Ideas testing pens and consulting clients. He's been in the infosec industry for a decade or so working with a wide range of clients and technologies. He's regularly told that he takes all of the fun out of things and is eager to argue about politics and religion. Hailing from the great state of Oklahoma, he hopes you'll all keep flying over it & leave us alone.

uk: вхід без авторизації

name: Red Team Offensive Village - Casting with the Pros s: Tips and Trick


uk: Комп'ютерні науки

description: Network Behavior Anomaly Detection (NBAD) and User and Entity Behavior Analytics (UEBA) are heralded as machine learning fueled messiahs for finding advanced attacks. The data collection and processing methodologies of these approaches create a series of new exploitable vectors that can allow attackers to navigate network and systems undetected. In this session, methods for poisoning data, transforming calculations and preventing alerts will be examined. Proof of concept Python code will be demonstrated and made available. Approaches to harden against these attacks will also be discussed as well as outlining needed changes in detection standards. About Charles: WitFoo Chief Technology Officer - Charles’ dedication to maturing the craft of InfoSec is built on a diverse career path across the industry. He started his career in InfoSec in the US Navy in 2002 serving as the Network Security Officer at the US Naval Postgraduate School. After leaving active duty, he was a contributing product reviewer for InfoWorld magazine focusing on network security products. Charles spent 7 years running Herring Consulting, a company dedicated to process orchestration, data sharing, and marketing. In 2012, Charles joined the Lancope team as a pre-sales engineer, promoted to Consulting Security Architect and later as Strategic Account Manager following the acquisition of Lancope by Cisco. In 2014, Charles partnered with veterans of the military, law enforcement and cybersecurity to research new approaches to improve the craft of cybersecurity operations. In 2016, that research resulted in the forming of WitFoo. When not working with cybersecurity heroes, Charles enjoys SCUBA divining with his wife, Mai.

uk: вхід без авторизації

name: Red Team Offensive Village - Breaking NBAD and UEBA Detection


uk: Комп'ютерні науки

description: SaltStack is robust configuration management utility used by many to achieve DevOps related initiatives in their organizations. Thanks to its open source model, SaltStack can be used by both hobbyist, hackers, and corporations alike. Like any open source tool suite out there, that also means individuals with adversarial intent, be it professional, or malicious, can also take advantage of this tool. In its most simple case, SaltStack can be used by an adversary as a simple Command and Control server (C2 server). However, if SaltStack is used as intended, an educated adversary can easily turn salt ‚Äúbad‚Äù in more ways than simple command and control. By re-configuring and automating basic settings within the Salt Master and Salt Minion configurations, it is easy to deploy SaltStack across many systems for any scenario. Coupling this ease of deployment with a basic understanding of configuration management, and scripted stagers, the result is a powerful post-exploitation framework with a built in C2 server, that is simply just SaltStack, but in use by an adversary. There are many benefits for using such a tool suite from an adversarial perspective such as, easily bypassing AV with trusted Salt Minions, and taking advantage of the desired state configurations to build out robust, scalable, post exploitation persistence modules. Part of the research conducted was not just on how an adversary might use SaltStack, but also on how they might target a SaltStack environment. Man in the middle attacks are a concerning attack vector against Salt Minions at the time of this research. SaltStack has strong protections against this, but they are not enabled by default due to the need of manually distributing a unique public key. It is up to the individual(s) deploying SaltStack to be sure they enabled the proper security features to be safe from these attacks. Fortunately, SaltStack does have a few compensating controls that make this less likely after a successful deployment, but it is important that all SaltStack users are made aware of the importance and impact that just one particular setting can have on their infrastructure. Fortunately methods of detecting this activity are clear and well documented, but unfortunately a successful attack usually means root access on the target which could result in an adversary clearing their tracks. This could make it difficult to perform root cause analysis unless network traffic was analyzed at the time of the event. The overall goal of this research is to show how advances in tools for perfectly legitimate Information Technology initiatives, like DevOps, can be turned into sophisticated tool suites for attackers. In true hacker spirit, this technology can be used for completely unintended purposes. This presentation will provide the insight to how SaltStack could be attacked or used in an adversarial context, and also how those attacks or uses could be detected and prevented. About Casey Erdmann: Casey Erdmann, also known as 3ndG4me by his CTF team mates and online social communities, is an avid offensive security nerd. Casey is 23 years old, and has a love for CTFs and application security. He is the co-founder of DC706, and is active in his local computer security community. Casey has been responsible for implementing infrastructure for local high-school CTF competitions, and coaching his local university‚Äôs SECCDC team. Casey is also responsible for developing the OpenVPN Connect module for the WiFi Pineapple, as well as Propane King of the Hill, a NetKotH rewrite inspired by members of DC 404. When he isn‚Äôt writing neat tools, or reaching out to his local community, Casey spends about 90% of his free time researching the latest offensive security news/techniques and playing CTFs trying to ‚Äúget good with the other 10% being writing music, playing video games, or optional sleep.

uk: вхід без авторизації

name: Red Team Offensive Village - Bad Salt (Adversarial DevOps)


uk: Комп'ютерні науки

description: Red Team Framework RTF

uk: вхід без авторизації

name: Red Team Offensive Village - Red Team Framework (RTF)


uk: Комп'ютерні науки

description: Red Team operations require substantial efforts to both create implants and a resilient C2 infrastructure. SiestaTime aims to merge these ideas into a tool with an easy-to-use GUI, which facilitates implant and infrastructure automation. SiestaTime allows operators to provide registrar, SaaS and VPS credentials in order to deploy a resilient and ready to use Red Team infrastructure in less than five minutes. The generated implants will blend-in as legitimate traffic by communicating to the infrastructure using SaaS channels (e.g. GMail, Twitter). Use your VPS/Domains battery to deploy staging servers and inject your favorite shellcode for interactive sessions, clone sites and hide your implants ready to be downloaded, deploy more redirectors if they get busted‚ SiestaTime is built entirely in Golang, with the ability to generate Implants for multiple platforms, interact with different OS resources, and perform efficient C2 communications. Terraform will help to deploy/destroy different Infrastructure. About Alvaro Folgado: Rebujacker works as a Product Security Engineer at Salesforce. He has multiple years of experience performing penetration tests, security assessment against different technologies, building automation tools for this purpose and performing application level researches. In the recent years his field of study has been focused into red teaming and automation. The combination of his application level and offensive security knowledge leads him to build better and stealthier implants that blends-in with nowadays cloud infrastructure and application stack of targeted organizations.

uk: вхід без авторизації

name: Red Team Offensive Village - SiestaTime Automation fr Long term implants


uk: Комп'ютерні науки

description: Presentation from DEF CON 27 Ham Radio Village

uk: вхід без авторизації

name: Ham Radio Village - The RF Dark Arts: How I went from total ignorance to receiving 1000+ mile contacts in 6 month


uk: Комп'ютерні науки

description: Presentation From DEF CON 27 Ham Radio Village

uk: вхід без авторизації

name: Ham Radio Village - Hunting tape measure yagis and offset attenuators


uk: Комп'ютерні науки

description: Presentations from the DEF CON 27 Hack the Sea Village

uk: вхід без авторизації

name: Hack the Sea Village - PENTESTING: How to Get into the Field Explained: How to get into ship systems and ICS Space


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Hack the Sea Village - Remote Yacht Hacking: Hacking the swim IOT


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Hack the Sea Village - C2 over Maritime Automatic Identification System (AIS) and commercial aggregation websites


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Hack the Sea Village - NSC and Special Assistant for Cyber


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Hack the Sea Village - Finding Flaws in a Satcom Terminal


uk: Комп'ютерні науки

description: As cyber security standards and frameworks proliferate, many of the challenges in securing maritime and offshore assets are not addressed. Frequent crew changes, remoteness of the connected asset and other unique challenges are difficult to address through regulatory means. I’ll discuss the state of the maritime industry relevant to cyber security and educate the audience on recent changes in maritime regulation, if not law. The audience will learn how “safety” drives everything in this sector and how cyber introduces a new law of physics (software vs steel vessels) to what historically was a slow changing field. I’ll include real examples, practical discussion of the gold nuggets and time permitting share a practical, copyable model for analyzing cyber risk.

uk: вхід без авторизації

name: Hack the Sea Village - Maritime Cyber Policy Panel


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Hack the Sea Village - Hack the Sea 1.0: The Voyage Begins


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Hack the Sea Village - Hacking an oil rig


uk: Комп'ютерні науки

description: Privacy is important for all kinds of people no matter what business or social status they are in. One of the cornerstones of privacy in our days is the secure messaging applications like Telegram, which deploy end-to-end encryption to protect the communications. At the same time these kind of applications have become so important that bug buying companies are now paying up to $500,000 for exploits on these platforms or just $15,000 for information disclosure exploits. It is no news that Telegram has been targeted by several intelligence agencies to allow the interception of messages. Several clone applications have been created and distributed with the intent of spying on their users. Telegram however, can be abused allowing the message interception on non-rooted Android device and without replacing the official application. BIO Vitor Ventura is a Cisco Talos security researcher. Has a researcher, he investigated and published various articles on emerging threats. Most of the days Vitor is hunting for threats, investigating, them reversing code but also looking for the geopolitical and/or economic context that better suits them. Vitor has been a speaker in conferences, like Recon and BSides Lisbon among others. Prior to that he was IBM X-Force IRIS European manager where he was lead responder on several high profile organizations affected by the WannaCry and NotPetya infections, helping to determine the extent of the damage and to define the recovery path. Before that he did penetration testing at IBM X-Force Red, where Vitor lead flagship projects like Connected Car assessments and Oil and Gas ICS security assessments, custom mobile devices among other IoT security projects. Vitor holds multiple security related certifications like GREM (GIAC Reverse Engineer Malware), CISM (Certified Information Security Manager).

uk: вхід без авторизації

name: Crypto and Privacy Village - Telegram - Snoop the messages


uk: Комп'ютерні науки

description: Anonymous communication is important for dissidents, activists, whistleblowers, journalists, and any individuals that might be under surveillance by other parties. Dining Cryptographer Networks (DC-Nets) provide the strongest anonymity protections and the lowest possible latency of any current cryptographic solution. Unfortunately DC-Nets are faced with three fatal flaws that prevent their deployment in the real world: prohibitive bandwidth consumption, denial of service attacks (DoS) by participants, and low fault tolerance. In this talk, I will present Howl, our new open source project and decentralized anonymity network that solves these issues to make DC-Nets usable in the real world. We leverage a new aggregation protocol for bandwidth and fault tolerance issues, and use trusted execution environments (TEEs) to prevent DoS. All privacy is handled by the DC-net protocol and at no point does broadcast privacy rely on the trusted execution environment or aggregation network. BIO Tyler Kell is a Research Engineer at Cornell Tech in New York City. In a prior life, before becoming a researcher, he worked as a penetration tester and security consultant.

uk: вхід без авторизації

name: Crypto and Privacy Village - Towards Usable Dining Cryptographer Networks with Howl


uk: Комп'ютерні науки

description: You might have heard the saying, "Biometrics are usernames, not passwords." But outside the security world, most people have no idea of the scale of threats we’re all facing with biometric privacy. Governments worldwide are using facial recognition for surveillance, often leading to disastrous consequences in countries without strong human rights protections. Companies, too, are developing more uses for facial recognition, often with a “Move fast and break things” mindset. Voice data, movement data, and more types of biometric data are also now commonly collected by public and private entities. People willingly put photos, videos, and audio of themselves online. They also use apps and consumer tech that collect biometric data. At the same time, deepfake technology is advancing rapidly, and surveillance culture is becoming increasingly pervasive everywhere. Not only are consumers willingly giving up their face data for app discounts, but they’re also giving up their DNA data for questionably accurate genomic analysis. The popularity of DNA testing kits like 23and Me has led to a rise in public and private DNA databases, which come with their own risks, from potential government misuse of data to basic security risks that come with any large-scale collection of sensitive data. The worst possible scenario, of course, is that we create a future where all of these privacy-invasive technologies will succeed and proliferate without laws or technological solutions to stop any of the harms. That’s a world in which we have zero privacy, because your unique and permanent biometric markers are being tracked literally everywhere you go, including, potentially, in your own thoughts. (See. e.g., Facebook’s Reality Labs.) Biometric privacy is one of the less-understood fields of privacy research and discussion. In this talk, I explore the unique biometric privacy risks and harms of these new technologies, and offer some solutions for what we can do to protect biometric privacy now and in the future. BIO Tiffany C. Li is a tech lawyer and legal scholar. She is a Resident Fellow at Yale Law School’s Information Society Project. Li is an expert on privacy, intellectual property, and tech platform governance. Li’s writing has appeared in the Washington Post, NBC News, Slate, and academic publications. Li has been honored as a Transatlantic Digital Debates Fellow (Global Public Policy Institute/ New America Foundation), a Fellow of Information Privacy (International Association of Privacy Professionals), and an Internet Law and Policy Foundry Fellow (Internet Education Foundation). Li is a licensed attorney and holds CIPP/US, CIPP/E, CIPT, and CIPM certifications. She has a J.D. from Georgetown University Law Center, where she was a Global Law Scholar, and a B.A. in English from University of California Los Angeles.

uk: вхід без авторизації

name: Crypto and Privacy Village - Stop Facebook From Buying Your Brain: Facial Recognition, DNA, and Biometric Privacy


uk: Комп'ютерні науки

description: You've got a whole pack of privacy lawyers, cybersecurity team members, a CISO, a CTO, a CPO, a General Counsel, privacy engineers, security engineers, and more. Where do you put them? Who reports to who? There is a robust and lively debate going on among CISOs, CPOs, GCs, and others about structuring privacy and security teams efficiently and effectively within an organization. Sit in and listen to that debate here - and maybe take away some recommendations for your own teams. BIO Suchi is a data privacy and cybersecurity lawyer (@SuchiPahi). She was supposed to be a doctor, but went rogue and wound up in law school arguing about the CFAA. After 4 years of working on some of the most incredible incidents as a cybersecurity lawyer and of helping companies of all sizes set up privacy and security practices, she decided to leave the law firm life so that she could do more tech law things. Robin Andruss - Director, Privacy Operations at Twilio has over 15 years experience in privacy, audit, and compliance. Currently, as a Director, Privacy Operations for Twilio, Robin leads a variety of internal strategic privacy initiatives to help Twilio meet it’s internal and external privacy commitments. Prior to Twilio, Robin's privacy career includes privacy roles from Google, Yahoo and TrustArc and developed a strong background in project and process management, financial audit and compliance (Sarbanes Oxley internal/process audits), and consulting from Deloitte. Marina is a well-established change agent in technology and cyber security with over 15 years of experience developing and delivering cyber security and IT strategy and programs. She has extensive experience aligning cyber strategy with business strategy while executing enterprise wide initiatives. Marina has expertise in risk management, data strategy and governance, security controls, information technology implementation and transformation, training, and project management. As Planned Parenthood Federation of America’s (PPFA) and Planned Parenthood Action Fund’s CISO, she works with senior leadership team to provide technical and cyber security expertise to mature the security posture of the Federation. Mike has over twenty years of experience in the security industry. He’s currently enjoying some well earned time off after a year and a half as Lyft’s first CISO where he had overall responsibility for their cybersecurity efforts. Prior to Lyft, he spent nine years at Salesforce in various roles, ultimately building and growing their world class Detection and Response organization. He started his career prototyping intrusion detection systems for battlefield networks. Fred is yet another privacy and cybersecurity lawyer, with a background in cybercrime defense. As GitHub’s Associate Corporate Counsel, he works closely with their security teams on bug bounty policy, incident response, and breach notifications. When not lawyering, Fred enjoys shell script kludges and improbable vehicles.

uk: вхід без авторизації

name: Crypto and Privacy Village - How to Integrate Privacy Legal Security


uk: Комп'ютерні науки

description: Everything you need to know about PAKEs and then some: what, why, which, blind salt, quantum resistance, APIs, HSMs, password KDFs, secret salts, and recovering a lost secret salt. PAKEs need to be easy to use and hard to misuse, otherwise adoption rates will be low. Take SRP, almost every implementation has functions like "calculateA", "calculateU", etc. To use these libraries you need to know exactly how SRP works. Some programmers might choose to send the server verifier first because it saves a trip. If the library doesn't prevent it, then this breaks SRP and let's anyone make password guesses offline. With a good API a programmer only needs to know they want to use a PAKE and the rest is relaying messages to and from the library until it's done.

uk: вхід без авторизації

name: Crypto and Privacy Village - Easy PAKE Oven


uk: Комп'ютерні науки

description: According to recent estimates, a quantum computer may be built as soon as 2030. As this will render existing cryptography insecure, we require quantum-safe alternatives now. Another aspect is the development of the Internet of Things, whereby increasing numbers of devices are being connected to the internet. This poses further challenges as not only is the new crypto more computationally intensive, but these devices are becoming smaller in terms of area and power capacity. This talk will present a form of quantum-based cryptography which is suitable for constrained devices, and will demonstrate in real-time an efficient implementation of such a scheme for a relevant use-case. BIO Sarah McCarthy is a researcher at the Centre for Secure Information Technologies, Queen’s University Belfast (QUB), where she has been based for 5 years. She specialises in post-quantum lattice-based cryptography, has made contributions to the EU-funded H2020 SAFEcrypto project and is involved in the ETSI Standards Quantum Safe Cryptography (QSC) Working Group. She has recently given invited talks at the 2018 ETSI QSC Workshop and 2019 International Cryptographic Module Conference. Sarah graduated from QUB with a Masters of Science in Mathematics and is currently completing her PhD in Computer Science there.

uk: вхід без авторизації

name: Crypto and Privacy Village - Stop right now!: Quantum Safe Instantaneous Vehicle to Vehicle Communication


uk: Комп'ютерні науки

description: You can unlock your smartphone with a passcode, your finger, even your face. When the cops demand you decrypt your phone or other device for them, can you successfully invoke your Fifth Amendment right against self-incrimination? Well, it depends. This talk quickly walks through the when, where, why, and how of compelled decryption and the Fifth Amendment under current case law. It ends with some practical takeaways, including "don't talk to the cops" and "stay out of Florida." BIO Riana Pfefferkorn is the Associate Director of Surveillance and Cybersecurity at the Stanford Center for Internet and Society. Her work focuses on investigating and analyzing the U.S. government's policy and practices for forcing decryption and/or influencing crypto-related design of online platforms and services, devices, and products, both via technical means and through the courts and legislatures.

uk: вхід без авторизації

name: Crypto and Privacy Village - Giving Cops the Finger: Compelled Device Decryption and the Fifth Amendment


uk: Комп'ютерні науки

description: There is a new ecosystem underway that will impact everyone, especially the irritated people in the U.S. who have received more than 48 billion robocalls last year. This new ecosystem will hopefully put an end to these annoying and fraudulent robocalls calls, which the Federal Communications Commission (FCC) estimates will constitute more than half of all phone calls placed in the U.S. this year. The FCC and major telecommunications companies including Comcast, AT&T, and T-Mobile are behind a new, global technology standard called SHAKEN/STIR (Signature-based Handling of Asserted Information using ToKENs and Secure Telephony Identity Revisited) to combat robocalls and caller ID spoofing. This new standard addresses the issue of commercial robocallers who are impersonating other callers and committing fraud via Caller ID. Public key infrastructure (PKI) is the backbone of the SHAKEN/STIR global technology standard. In order for the entire ecosystem to work, it needs to be created with a trusted PKI system as the base, using digital signatures in every single call, which are verified and authenticated. SHAKEN/STIR uses digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure. The way it works is each telephone service provider obtains its digital certificate from a certificate authority that is trusted by other telephone service providers. The certificate technology enables the called party to verify that the calling number is accurate and has not been spoofed. In order to build this new ecosystem to facilitate stronger identities for each and every call generated, an effective PKI ecosystem must be implemented. Strong identities and controls will be needed to ensure call identities are trusted globally. PKI is the technology that will be used to identify and verify each phone call. SHAKEN/STIR will shift the identity details from the call originator to the trusted telephone company routing the call. The industry – technology infrastructure, telecommunications, and government entities – needs to work together on a solution that will reduce fraud and put an end to robocalls. As this technology standard evolves and deployed, it is important to identify the security risks telecommunications companies will face and how enterprises can benefit from this work. Security will be required at every level of SHAKEN/STIR implementation. BIO Mark B. Cooper is president and founder of PKI Solutions. He has deep knowledge in all things Public Key Infrastructure (PKI) and has been known as “The PKI Guy” since his early days at Microsoft. PKI Solutions Inc. provides consulting, training and software solutions for Microsoft PKI and related technologies for enterprises around the world. Prior to founding PKI Solutions, Cooper was a senior engineer at Microsoft, where he was a PKI and identity management subject matter expert who designed, implemented and supported Active Directory Certificate Services (ADCS) environments for Microsoft’s largest customers.

uk: вхід без авторизації

name: Crypto and Privacy Village - How PKI and SHAKEN/STIR Will Fix the Global Robocall Problem


uk: Комп'ютерні науки

description: The Third Servile War was over. The slave army has been defeated, and the survivors are offered a pardon by their Roman captors. The only requirement was that they identify Spartacus, their leader (Kirk Douglas). Rather than give away his identity, however, they all begin to yell out “I’m Spartacus!”—thus preserving his anonymity by overwhelming the Romans with possibilities. (Spoiler alert: they all die as a result.) What lesson can we learn from them about preserving privacy through obscurity? The right to be forgotten has been held as fundamental human right by various governments. The recent Facebook scandal and a series of large scale breaches has centered the discussion on the privacy implications of this right. Most people agree that the right to be forgotten should allow users to remove accounts and material that they have created in the past — but how easy is it to disappear from online social media and networks in an effort to preserve one’s privacy? To find out, I created a fake identity and gave it accounts across 24+ sites, including the “usual suspects” (gmail, twitter, facebook) and some not so “usual” (Ashley Madison and MySpace). The privacy agreements and the experience with these sites demonstrated how difficult deletion is for end users. Governments have not mandated these privacy protections for users systematically—and even if they had, enforcement would be problematic; there is little incentive for businesses to prune existing user data. Since users cannot rely on governments to ensure privacy, a different method of privacy assurance is proposed: privacy through obfuscation. Existing accounts and personal data may be protected through obfuscation techniques, common in other research such as location cloaking. An open-source proof-of-concept (“Spartacus as a Service”) is presented that allows for these techniques to be employed on several well-known online applications. This prototype seeks to ensure that privacy is maintained without relying on organizations removing all data from their systems—effectively yelling “I’m Spartacus!” on behalf of the user. BIO Mike Kiser is insecure. He has been this way since birth, despite playing a number of roles over the past 20 years—from the Office of the CTO to Security Strategist to Security Analyst to Security Architect—that might imply otherwise. In spite of this, he has designed, directed, and advised on large-scale security deployments for a global clientele. He is currently in a long-term relationship with fine haberdashery, is a chronic chronoptimist (look it up), and delights in needlessly convoluted verbiage. He has been a speaker on topics ranging from identity governance to security analytics, network security, and various related privacy issues, and is the co-host of a podcast illuminating all things identity. In a past life, he developed mathematical models to simulate collisions between galaxies.

uk: вхід без авторизації

name: Crypto and Privacy Village - I Am Spartacus (And You Can Be too!): Spartacus as a Service (SaaS)


uk: Комп'ютерні науки

description: The BADASS army is an organization that started with one woman in Ohio, and within two years has helped thousands of people get their private images removed from unauthorized websites, helped pass laws criminalizing “revenge porn”, and teach victims the necessary tech skills to protect their private pictures and videos. Katelyn Bowden has brought this fight to a global level, and is here to talk about battling revenge porn the BADASS way. We will be discussing privacy laws, sensitive media storage, and safe sexting, along with the methodology of image abuse perpetrators. BIO Katelyn is the founder and CEO of BADASS- a nonprofit dedicated to fighting image based abuse online. Since starting the organization in 2017, BADASS has helped thousands victims of Non Consensual Pornography remove their photos and protect themselves, worked with platforms to prevent private images from being uploaded, and assisted in getting several statewide revenge porn laws put into place.

uk: вхід без авторизації

name: Crypto and Privacy Village - Fighting non consensual pornography: ...the BADASS way


uk: Комп'ютерні науки

description: Let's Encrypt has enabled rapid adoption of TLS across the long-tail of public-facing services. Unfortunately, there are still challenges in deploying TLS on home network devices, such as routers, TV tuners, and IoT hubs. These devices are commonly accessed by their non-routable, dynamically-assigned IP address, preventing traditional domain-validated certificates from being used. This talk introduces a new DNS-based service that allows home network devices to automatically request certificates that can be used with non-routable IP addresses. BIO Karl Koscher is a research scientist working at the University of Washington where he specializes in wireless and embedded systems security. Previously, he was a postdoctoral scholar working with Stefan Savage at UC San Diego. He received his Ph.D. from the University of Washington in 2014, where he was advised by Tadayoshi Kohno.

uk: вхід без авторизації

name: Crypto and Privacy Village - Enabling HTTPS for home network devices using Let's Encrypt


uk: Комп'ютерні науки

description: Nowadays, the majority of US-based newsrooms rely on primarily consumer-facing applications to facilitate secure communications with sources. Usage of tools like Signal, WhatsApp, Threema, and others, have spiked in usage as the most state-of-the-art way to ensure confidential conversations with at-risk leakers and whistleblowers. Documents flood newsrooms, sometimes in gigabytes at a time, and journalists need tools to interrogate that data in relative safety from device compromise, legal interception, all while getting the job at the accelerated speed of the news cycle. Let's explore how these tools, from both a technical and behavioral usage standpoint, *make the news*. Sometimes in a good way, when a story comes out after months of clandestine collaboration with sources, and toiling over data that needs to be interrogated; sometimes in a bad way, when sources get burned, or organizations endanger themselves. BIO Harlo Holmes is the Director of Digital Security at Freedom of the Press Foundation. She strives to help individual journalists in various media organizations become confident and effective in securing their communications within their newsrooms, with their sources, and with the public at large. She is a media scholar, software programmer, and activist.

uk: вхід без авторизації

name: Crypto and Privacy Village - Tiplines Today: Freedom of the Press Foundation


uk: Комп'ютерні науки

description: We've all heard the unfortunate events that lead the imprisonment of whistleblower Reality Winner. The protection of sources has been a challenge for journalists since the birth of the trade, but it's become even more difficult in the age of document leaks. With fingerprints, watermarks, exif data, etc, there seems to be an infinite number of ways that a document could be linked back to the source and seemingly equal is the number of ways to "scrub" them. To help others navigate these waters, the Truth & Transparency Foundation (TTF), the non profit newsroom behind MormonLeaks and FaithLeaks, has developed Scrubber, a script written over the years of the TTF's existence that automates the "scrubbing" of sensitive documents to be released to the public. Building on top of dozens of other open source projects, Scrubber can be run on any platform and will help any journalist or activist implement consistency in the cleaning of their files. While there is no silver bullet, Scrubber lays a great foundation. BIO Ethan Gregory Dodge started his career as a cyber-security engineer in Silicon Valley. His understanding of security naturally flowered into a deep passion for privacy and he slowly found himself following journalists uncovering the state of surveillance in the United States. In early 2016, he experienced a drastic change of world view when he abandoned the orthodox Mormon belief system he was raised with. Despite having left the religion, Ethan has found the culture of Mormonism to be important to his identity. He continues studying the religious movement's history and progression as a secular Mormon. In late 2016, he was a founding member of the MormonLeaks.io team where his loves of transparency and Mormonism intersected. A year later, he co-founded the Truth & Transparency Foundation, a non-profit newsroom dedicated to empowering the disenfranchised by promoting transparency within religious institutions. He holds a bachelor's degree in Information Technology from Utah Valley University and enjoys learning and writing about where his interests of technology, security, privacy, and religion intersect.

uk: вхід без авторизації

name: Crypto and Privacy Village - Scrubber: An open spurce compilation to protect journalistic sources


uk: Комп'ютерні науки

description: A non-trivial quantum computer would break the public key cryptography in use today. They might be at least a decade away, but nothing prevents adversaries to record and store selected internet traffic today for later quantum-assisted decryption. It is therefore prudent to start the migration to quantum-safe cryptography. NIST is well underway in its post-quantum standardization process. Adoption of these quantum-safe alternatives will however depend on the progress in integrating them into internet standards and systems. We describe how TLS and SSH can be adapted to use post-quantum cryptography. We examine various design considerations and report on our experiences in adding post-quantum and hybrid key exchange and authentication to these protocols. We describe the Open Quantum Safe project, which enables developers and researchers to experiment with post-quantum cryptography in various languages, applications, and protocols, including via our forks of OpenSSL and OpenSSH. Finally, we report on the performance of this new cryptography, and demonstrate conventional and post-quantum hybrid TLS 1.3 and SSH connections. BIO Christian Paquin - I am a crypto specialist in Microsoft Research's Security and Cryptography team. I’m currently involved in projects related to post-quantum cryptography, such as the Open Quantum Safe project. I’m also leading the development of U-Prove, a privacy-enhanced authentication technology. In my time at MSR, I’ve worked on projects involving various privacy-enhancing technologies, smart cloud encryption (e.g., searchable and homomorphic encryption), and the intersection of AI and security. Prior to joining Microsoft in 2008, I was the Chief Security Engineer at Credentica, a crypto developer at Silanis Technology working on digital signature systems, and a security engineer at Zero-Knowledge Systems working on TOR-like systems.

uk: вхід без авторизації

name: Crypto and Privacy Village - Migrating to quantum-safe crypto to protect against the quantum hacker


uk: Комп'ютерні науки

description: In this presentation, we show the audience how to use well documented protocol weaknesses to generate fraudulent domain security certificates, decrypt "secure https" web traffic, and decrypt TLS encrypted emails. Then we show the audience how to use these weaknesses as backdoors to break into Cisco Meraki firewalls, Google Nest security cameras, physical building locks, Dropbox accounts, Onedrive accounts, Outlook.com accounts, Skype message histories, Amazon AWS Virtual Machines, Oracle Cloud virtual machines, LogMeIN remote access accounts, Online Medical Records, online backups, windows bit-locker encrypted hard drives, apple file-vault encrypted hard drives drives, and many other systems. At the end of the presentation: we cite related research showing multiple government agencies successfully using these TLS interception attacks against citizens, businesses, other governments, ... then provide simple solutions to prevent this type of attack. BIO Chris Hanlon is the founder of Agile Data Security a company dedicated to helping businesses secure their software development life-cycle, protect their technology assets (computers, routers, servers, databases and cloud systems) and reduce their vulnerability to social engineering attacks.

uk: вхід без авторизації

name: Crypto and Privacy Village - TLS decryption attacks and back-doors to secure systems


uk: Комп'ютерні науки

description: Zero knowledge proofs are powerful tools; come learn about how they work and what they enable! We'll get down and dirty in the details of Bulletproofs, a zero knowledge proof protocol that doesn't require trusted setup. I'll walk you through the math/crypto of Bulletproofs, alongside my open-source implementation in Rust. You'll walk away with an appreciation for zero knowledge proofs, a deeper understanding of Bulletproofs, and hopefully some interest in tinkering on or building systems with zero knowledge proof protocols yourself! BIO Cathie was an applied cryptographer at Chain and Interstellar. She enjoys working on open-source zero knowledge proof implementations and protocols for confidentiality in blockchain systems. She has a background in distributed systems and cryptography from MIT. When she isn't designing better blockchain protocols, she can be found climbing tall rocks and performing aerial silks.

uk: вхід без авторизації

name: Crypto and Privacy Village - Implementing a Zero Knowledge Proof: or, How to Write Bulletproofs in Rust


uk: Комп'ютерні науки

description: So much of the adult population currently utilizes subscription services like Netflix, but there are hidden implications to users’ privacy inherent in the subscription process that cannot be aided by privacy policies. Users must be aware of the threat they present to themselves. This talk will be focused on the interesting vulnerabilities presented by privacy oversights of users between subscription services and the services used to pay for them. BIO Cat Murdock is a Security Analyst with GuidePoint Security's Threat and Attack Simulation team. For the last few years, she has worked on red teams predominantly as a social engineer. Murdock finds the space where privacy policies end and users' choice regarding their own privacy fascinating. Good intentions towards privacy only go so far, and there are many gaps in knowledge, ability, and/or desire that increase risk to individuals' privacy. She likes to explore where this interacts with organizations' established privacy policies. She also really likes dogs.

uk: вхід без авторизації

name: Crypto and Privacy Village - Black Mirror: You are your own privacy nightmare


uk: Комп'ютерні науки

description: Butterfly key expansion (BKE) is a somewhat novel concept to create almost indefinitely new matching public and private keys independently of each other based on a seed (or caterpillar) key pair and a shared expansion function. Although this concept was invented for credential provisioning to Vehicle-to-Everything (V2X) communication devices (DOI:10.1109/VNC.2013.6737583) these characteristics makes it interesting for all low bandwidth, low computational power, low secure storage devices. The BKE protocol allows for efficient generation of massive amounts of certificates with no single PKI component knowing which certificate belongs to which device - as required in V2X communication. The approach has since been utilized and implemented and is about to be standardized in IEEE 1609.2.1. One optimization of the butterfly key expansion protocol is called "unified butterfly key expansion" (UBK) (https://eprint.iacr.org/2018/089.pdf), which is about to be included in IEEE 1609.2.1 as well. While learning about this protocol and being involved in the deployment of PKI systems implementing it, I discovered an issue with a scenario where some CAs would implement the "traditional" BKE mechanism and other CAs the UBK approach - which is happening, e.g., in the US, where BKE is already in production and UBK will be soon: the RA in this case could pretend to implement UBK, where in fact it works with a BKE CA. This way the RA could break one of the central privacy characteristics of the butterfly key expansion protocol: no single PKI component is able to know which public keys/certificates belong to the same device. BIO Ben started his career in the automotive industry in 2010. Since 2013, he has been a Program Manager responsible for the global rollout of connected car technology. He was assigned to work in the U.S. to work on Vehicle-to-Everything (V2X) security in 2015. He is currently the Vice Chair of the 5GAA WG7 "security & privacy" and involved in security topics for V2X communication.

uk: вхід без авторизації

name: Crypto and Privacy Village - MITM privacy attack on mixed mode butterfly key expansion protocol


uk: Комп'ютерні науки

description: Research by us has revealed direct CAN injection remote via APIs, which we intend to present the detail of live. Viper Alarms uses a back-end from CalAmp, the manufacturer of LoJack. We'll show how the LoJack vehicle tracking & recovery device could be compromised and recovery of a stolen vehicle prevented. This research lead us on to compromise of OEM-approved vehicle trackers and immobilisers. The rabbit hole went very deep indeed. This is a story of systemic compromise through weak platform providers and outsourced security.

uk: вхід без авторизації

name: Car Hacking Village - Lojack'd pwning car alarms vehicle trackers


uk: Комп'ютерні науки

description: Many systems depend on accurate location information from Global Navigation System Satellites (GNSS) for normal operation. Public GNSS lacks integrity mechanisms and is vulnerable to spoofing. U.S. Federal law does not allow over-the-air spoofing of GNSS or other signals, which makes assessment of vulnerabilities difficult outside of an enclosed laboratory environment. This research proved the usefulness of a Mobile GNSS Spoofing System that enables legal, real-world evaluation of GNSS vulnerabilities. The mobile spoofing system was used to evaluate vulnerabilities in an Unmanned Ground Vehicle (UGV). The UGV GNSS was exploited using several different attacks including forced lane switching, driving off the road, and stopping the vehicle.

uk: вхід без авторизації

name: Car Hacking Village - Legal GNSS Spoofing and its Effects on Autonomous Vehicles


uk: Комп'ютерні науки

description: In this talk Rotem will share my experience about how he hacked different automotive clouds, techniques he used and goals pursued after connecting. Rotem will talk about the main connectivity areas he looks for, supplier integrations and differences between normal clouds and automotive clouds. Once Rotem got a good foothold, Possible targets and places which can harm the most. Where can to jump next inside and how deep the rabbit hole goes. In this talk Rotem will give real life examples of: From zero to hero – Full backend control with examples Common fails which allow me to jump between networks Dangers of connected cars - Taking over a car from the cloud How to break a production line Cloud credentials leakage

uk: вхід без авторизації

name: Car Hacking Village - Hacking into Automotive Clouds


uk: Комп'ютерні науки

description: Our research revealed several weaknesses in the Tesla Model S passive keyless entry and start system. The talk will be a comprehensive overview of how we reverse engineered the key fob, the issues we found and an efficient proof of concept attack. The proof of concept attack exploits the use of an inadequate cipher and allows us to clone a Tesla Model S key fob in a matter of seconds using commercial off-the-shelf hardware. Information from the FCC database suggests that the same attack could affect vehicles produced by McLaren, Karma and Triumph Motorcycles as they all use a passive keyless entry and start system designed by Pektron. I will share our experience with responsibly disclosing our findings with all the manufacturers.

uk: вхід без авторизації

name: Car Hacking Village - Fast, Furious and Insecure


uk: Комп'ютерні науки

description: Showing the inside of QNX and Android with a high overview of each system and there unique attributes. Finding common misconfigurations in Android systems, while also showing people how to extract and begin the process to reverse engineer (but no in depth reversing of apks). Hardware hacking on systems to gain escalated privileges to obtain initial foothold on device and begin reverse engineering from there!

uk: вхід без авторизації

name: Car Hacking Village - Infotainment Hacking


uk: Комп'ютерні науки

description: Many ECUs do not support reading firmware over CAN, but since automotive manufacturers make mistakes and need to fix firmware bugs, they release firmware updates and support writing firmware over CAN. This will be a deep dive into how you can obtain these firmware updates, decrypt them, (modify if you like) and flash a firmware update file for Honda ECUs. The ECU tools provided by automotive manufacturers are from the stone age, so let’s use a modern web browser to flash an ECU!

uk: вхід без авторизації

name: Car Hacking Village - Flashing ECU Firmware Updates from a Web Browser


uk: Комп'ютерні науки

description: What will it mean if LIDAR becomes ubiquitous in autonomous vehicles? Join us for an exploration of a LIDAR’s operation, network attack surface, and the development of low-tech countermeasures that render solid objects invisible and turn thin air into a virtual wall of steel.

uk: вхід без авторизації

name: Car Hacking Village - Tell Me Lies: Automotive LIDAR and Low Tech Obfuscation


uk: Комп'ютерні науки

description: "What is UDS and how can it help me hack cars?" The goal of this talk is to give a brief introduction to UDS (ISO 14229), what the capabilities of UDS are, why automotive ECUs implement it, and how it is useful in hacking cars. The talk will have examples using standard Linux socketcan interfaces as well as CanCat scripts to help people discover UDS devices and services on their own vehicles.

uk: вхід без авторизації

name: Car Hacking Village - What is UDS?: and how can it help me hack cars?


uk: Комп'ютерні науки

description: Due to internal environment of Windows domains is always too tolerant, and enterprises are more concerned about border defenses than internal security, the penetration behavior based on Windows Active Directory has become more and more popular and aggressive. The emergence of MicrosoftATA allows BlueTeam to perceive and discover most domain penetration activities, however, there are many bypassing techniques for MicrosoftATA recently, and the detection dimension of MicrosoftATA is not comprehensive enough, especially the persistence part. It's a compelling problem whether the Red Team can ensure their behaviors not to be detected after bypassing the detection of MicrosoftATA. In my recent research, the security event log of domain controller details the activity of entities in the domain. Most AD Attacks leave traces in the logs. These logs can be collected and analyzed in real time, helping you quickly detect attacks before an attacker compromises the domain controller. I will detail how to find exceptional behavior from a large number of domain controller security event logs and use a variety of analysis approaches to determine attacks, while taking into account false alarm rate. It's worth mentioning that we don't collect security event log of all computers, only domain controllers. As a result, these ideas are applicable in a large-scale intranet environment, helping Blue Team build its own Advanced Threat Analytics.

uk: вхід без авторизації

name: Blue Team Village - Evaded Microsoft ATA? but you are completely exposed by event logs


uk: Комп'ютерні науки

description: A mostly live demo of base concepts of malware analysis using a multitude of tools on a Dridex sample pulled from a phishing campaign from PDF attachment to executable installation. The main point is to show people some base tools to dive headfirst into analysis of suspicious files.

uk: вхід без авторизації

name: Blue Team Village- An Introduction To Malware Analysis video


uk: Комп'ютерні науки

description: BloodHound was originally built for Pentesters to easily identify highly complex attack paths but it can also be used to improve the overall security posture of your Active Directory. We will start with a short introduction to graph databases and how the different parts of Bloodhound work. We will then discuss some useful tips on using the GUI to visualize various attack paths then we will venturing into the world of custom Cypher Queries. Using this new knowledge, we will set off on a path of destruction, targeting the attack paths in our environment and visualizing the effects of our planned remediations on these attack paths.

uk: вхід без авторизації

name: Blue Team Village - BloodHound From Red to Blue 1 point 5