uk: Архітектура, дизайн інтер'єру

description: Am 29.8.2012, dem offiziellen Eröffnungstag der diesjährigen Architekturbiennale in Venedig, fand die 14. Veranstaltung der Diskursreihe "ARCH+ features" als Doppelführung durch die Pavillons der Schweiz und Deutschlands statt. Allerdings hatten das deutsche Team mit Muck Petzet, Konstantin Grcic und Erica Overmeer sowie Miroslav Šik, offizieller Teilnehmer der Schweiz an der Biennale, die Aufgabe, nicht durch den eigenen, sondern durch den jeweils anderen Pavillon zu führen. Ziel war es, durch die Interpretationsebene die Gemeinsamkeiten und Unterschiede der beiden Länderbeiträge im Hinblick auf das Motto der Gesamtbiennale "Common Ground" herauszuarbeiten. Im Schweizer Pavillon stand die Bildstrategie von Šik und der hinzugezogenen Architekturbüros Miller & Maranta und Knapkiewicz & Fickert im Mittelpunkt der Diskussion. Die Wände des Pavillons wurden in einem aufwändigen Verfahren mit Fotoemulsion behandelt und direkt belichtet, um eine fiktive Stadtlandschaft als Wandfresko zu erschaffen. Miroslav Šik andererseits konfrontierte vor dem deutschen Pavillon die ca. 200 Zuhörer mit der schwierigen politischen Geschichte des deutschen Pavillons und sieht im Verhältnis zur eigenen Geschichte den größten Unterschied in der Haltung der beiden Beiträge. Im Inneren überzeugte Sik mit einer präzisen Analyse der räumlichen Strategie der deutschen Ausstellung, die eine unaufgeregte Alltagsarchitektur und den Umgang mit dem städtischen und architektonischen Bestand zum Thema machte.

uk: вхід без авторизації

name: ARCH+ features 14: Architekturbiennale Venedig 2012 – Swiss Pavilion


Helgard Haug

type: Person

de: Architektur, Innenarchitektur

uk: Архітектура, дизайн інтер'єру

en: Architecture, Interior Architecture

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: Was können die Künste für die urbane Gesellschaft tun? Wie kann Kunst helfen, Gesellschaft zu verändern? Was sind Modi der Kunstproduktion im urbanen Raum? Diese und andere Fragen stellte die Konferenz reART:theURBAN vom 25. bis 27.10.2012 in der Gessnerallee Zürich. Die Konferenz brachte durch ihren interdisziplinären Ansatz international renommierte Wissenschaftler, Denker, Künstler und Kunstschaffende zusammen. Keynote Redner waren unter anderem der Philosoph Slavoj Zizek (Slowenien), der Geographer Erik Swyngedouw (Belgien), der Urbanist Charles Landry (Grossbritannien), die Performance Wissenschaftlerin Shannon Jackson (USA) und der Soziologe Dirk Baecker (Deutschland). Künstlerische Interventionen und Workshops wurden von Künstlern und Künstlerkollektiven wie Omer Krieger (Israel), Blast Theory (Grossbritannien), stadttheater.tv (Schweiz) und Rimini Protokoll (Deutschland) gestaltet. In Zusammenarbeit mit reART:theURBAN hatte die Gessnerallee Zürich unter neuer Leitung die ortsspezifische Arbeit 100 Prozent Zürich des Regie-Kollektivs Rimini Protokoll für den Zeitraum der Konferenz nach Zürich geladen. Die Performances waren an jedem Abend im Anschluss an die Konferenz zu sehen. ARCH+ features 16 Im Rahmen der Konferenz reART:theURBAN fand am Freitag, den 26.10.2012, die 16. Ausgabe der ARCH+ features mit dem Regie-Kollektiv Rimini Protokoll und dem Dramaturg, ZHdK-Dozent und Forscher Imanuel Schipper statt. Im Anschluss an die Aufführung 100 Prozent Zürich führten Helgard Haug, Stefan Kaegi und Daniel Wetzel von Rimini Protokoll ein Gespräch mit Imanuel Schipper. Thema: Soziale Wirklichkeit und Big Data In dem von ARCH+ und der Stiftung Bauhaus Dessau ausgelobten Wettbewerb Out of Balance heißt es: Menschen werden in sozialräumliche Verhältnisse hineingeboren. Ihre Lebenschancen sind, durch diese „Zufälligkeit“ der Geburt bedingt, extrem unterschiedlich. Gemäß dem Gleichheitspostulat der Demokratie verkörpern moderne Gesellschaften das Versprechen einer sozialen Inklusion. Sie ist ein Garant für die politische Stabilität eines Gemeinwesens. Es ist also geboten, immer wieder nach der Einlösung dieses politischen Anspruchs zu fragen. Das heißt, zu fragen, wie die soziale Wirklichkeit tatsächlich aussieht. Der Rekurs auf „Realien“ ist dafür die Voraussetzung. Wie lassen sich angesichts der fortschreitenden Digitalisierung und Vernetzung gesellschaftliche Zusammenhänge jenseits quantitativer Beschreibungen darstellen? Welche Rolle können die Künste dabei spielen, soziale Relationen und Prozesse bewusst zu machen und zu visualisieren? Können sie dabei helfen, diese Daten zu übersetzen und Aussagen zu treffen, die Einsichten in gesellschaftliche Verhältnisse geben? 100 Prozent Zürich Einen performativen Zugang zu diesen Fragen verfolgt das Regie-Kollektiv Rimini Protokoll, das mit seinen stadtspezifischen Aufführungen „100 Prozent …“ flüchtige Porträts moderner Stadtgesellschaften zeichnet. Rimini Protokoll erhebt dabei die Stadtbewohner zum eigentlichen Akteur. Während Statistiken Menschen in abstrakte Tortenstücke, Säulen und Kurven verwandeln, fragen Rimini Protokoll: „Was ist, wenn diese Statistiken Gesichter bekommen? Wie sieht es aus, wenn Zürich sich auf einer Bühne durch 100 Menschen vertreten ließe, eine Menge, so ausgesucht, dass sie statistisch relevante Aussagen machen kann?“ Die Zusammensetzung repräsentiert ein Bevölkerungsmodell, das Rimini Protokoll mit dem Amt für Statistik der Stadt Zürich erarbeitete. Die ortspezifische Performance „100 Prozent Zürich“ zeigt aber auch, dass Information nicht neutral ist. Denn die Darstellung von Information ist beeinflusst vom Erkenntnisinteresse. Eine aufklärerische, emanzipative Übersetzung legt Tatsachen offen, die verdrängt, verschwiegen oder vergessen, aber gleichwohl wesentlich für das Verständnis der Gegenwart sind. Und sie beeinflusst damit perspektivisch das gesellschaftliche Handeln. Schließlich ist das Bild, das wir uns von der Welt machen, maßgeblich dafür, wie wir handeln. (Siehe Ausgabe 206/207: Politische Empirie und Wettbewerb Out of Balance)

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: de

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: ARCH+ features 16: Rimini Protokoll und Imanuel Schipper

ARCH+

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Архітектура, дизайн інтер'єру

description: In der ersten Veranstaltung im neuen Jahr diskutieren wir mit Urban Catalyst über die Ergebnisse ihres langjährigen Forschungsprojekts zum Phänomen der temporären Nutzung. Den Initiatoren ist es gelungen, die Praxis der Zwischennutzung auf ein theoretisches Fundament zu stellen und einen internationalen Diskurs anzuregen. Mit zeitlichem Abstand können wir heute Bilanz ziehen und fragen, inwieweit das kulturelle Phänomen der Zwischennutzung der 90er und 00er Jahre eine Veränderung und Erneuerung der Planungspraxis bewirkt hat und welche Erkenntnisse wir für einen zukunftsfähigen Stadtdiskurs gewinnen können? Philipp Oswalt, Klaus Overmeyer, Philipp Misselwitz im Gespäch mit Daniela Brahm (Ex-Rotaprint) und Wolfgang Kil

uk: вхід без авторизації

name: ARCH+ features 18, Urban Catalyst: Klaus Overmeyer - Statement


uk: Архітектура, дизайн інтер'єру

uk: вхід без авторизації

name: ARCH+ features 18, Urban Catalyst: Philipp Oswalt - Statement


ARCH+ features 18: Urban Catalyst

uk: Архітектура, дизайн інтер'єру

description: Donnerstag, 21.2.2013, 19 Uhr, Altes Haus Ungarn, Kinosaal, Karl-Liebknecht-Straße 9, Berlin-Mitte ARCH+ features 18 stellt das Kollektiv Urban Catalyst und dessen langjähriges Forschungsprojekt zum Phänomen der temporären Nutzung vor. Urban Catalyst widmen sich, so Kees Christiaanse im Vorwort der gerade bei DOM publishers erschienenen Veröffentlichung, "den offenen Räumen der Stadt, all jenen Gebieten, deren Zukunft für bestimmte oder unbestimmte Zeit unklar ist, die sich also in einem Zustand des Nicht-Mehr und Noch-Nicht befinden." Den Initiatoren gelang es, die Praxis der Zwischennutzung auf ein theoretisches Fundament zu stellen und einen internationalen Diskurs darüber anzuregen. Temporäre Nutzung von unbestimmten urbanen Schwellenräumen wird seitdem von der Verwaltung sowie von Planern und Investoren nicht mehr als Problem gesehen, sondern als Entwicklungsstrategie bewusst eingesetzt. Denn es hat sich gezeigt, dass gerade in von Staat, Planung und Kapital vernachlässigten Bereichen besondere Formen von Urbanität entstehen, die von temporären, informellen und innovativen Praktiken geprägt sind. Zwischennutzer sind Pioniere alternativer Raumnutzungen, deren Lebensweisen als Freiberufler, Kleinunternehmer und Teilzeitbeschäftigte die Veränderungen der postfordistischen Gesellschaft widerspiegeln. Mit ihren informellen Netzwerken schaffen sie öffentliche Orte, die über Nacht zu urbanen Hot Spots werden können. Anlässlich der Veröffentlichung der Studien können wir heute mit zeitlichem Abstand Bilanz ziehen und fragen, inwieweit das kulturelle Phänomen der Zwischennutzung der 90er und 00er Jahre eine Veränderung und Erneuerung der Planungspraxis bewirkt hat und welche Erkenntnisse wir für einen zukunftsfähigen Stadtdiskurs gewinnen können? Urban Catalyst werden auf die Veränderung des Zwischennutzungsdiskurses seit Beginn ihrer Forschung sprechen und im Anschluss mit der Künstlerin Daniela Brahm, Mitbegründerin von Ex-Rotaprint, und dem Architekturkritiker Wolfgang Kil eine kritische Diskussion führen. Urban Catalyst sind: Philipp Oswalt, Direktor der Stiftung Bauhaus Dessau, Klaus Overmeyer, Professor für Landschaftsarchitektur an der Bergischen Universität Wuppertal, und Philipp Misselwitz, Professor für Internationalen Urbanismus an der Universität Stuttgart.

uk: вхід без авторизації


ARCH+ features 19: Kim Förster, Teaser

uk: Архітектура, дизайн інтер'єру

uk: вхід без авторизації


uk: Архітектура, дизайн інтер'єру

description: ARCH+ presents representatives of a young generation of European architects who emphasize, after the sociological and technological dominance in the architectural discourse of the last decades, the intellectual power of the form, more precisely the potential of the architectural setting and its effect in its context. They consciously build on historical traditions and emphasize the autonomy of architecture. This talk is set within the context of a deliberate turning back on key issues of architecture. Kuehn Malvezzi works on models of space: 1:1, Appropriation, Autonomy, Choreo-graphy, City in the City, Concrete, Confrontation, Context, Curatorial Design, Display, Esperanto, Event, Exhibition, Form, Genealogy, Heterotopy, Hybrid, Ideology, Image, Interculture, Interstice, Mannerism, Model, Montage, Monument, Morphology, Mosaic, Museum, Object, Parcours, Passage, Presentation, Readymade, Realism, Reenactment, Repetition, Situation, Station, Temporary, Threshold, Translation, Typology, Use.

@language: en

uk: вхід без авторизації

name: ARCH+ features 21: Kuehn Malvezzi - Raummodelle (Part 1)


uk: Архітектура, дизайн інтер'єру

description: After presenting their work Simona Malvezzi and Wilfried Kühn, principals of Kuehn Malvezzi Architects, engaged in a discussion with Ellen Blumenstein, Chief curator of KW Institute for Contemporary Art, Nikolaus Kuhnert and Anh-Linh Ngo, editors of ARCH+, on exhibition design, spatial layouts, the potential of form and the role of the architect.

uk: вхід без авторизації

name: ARCH+ features 21: Kuehn Malvezzi - Discussion (Part 2)


uk: Архітектура, дизайн інтер'єру

description: „Idee, Idee und noch mal Idee!“ Mit diesem emphatischen Aufruf zur konzeptuellen Ambition beendete Oda Pälmke die 22. Ausgabe der ARCH+ features, die dieses Mal im bis auf den letzten Platz gefüllten Studiolo der KW stattfand. Ihren Vortrag hat Oda Pälmke entsprechend nach Begriffen geordnet, die den konzeptuellen Hintergrund ihrer Arbeit klarmachen: Autogenes Training, halluzinogenes Training, poetische Verdichtung, Fiktionalisierung, Überhöhung u.v.m. Die Begriffe dienen allesamt dazu, das Vorgefundene einerseits zu rationalisieren, andererseits poetisch zu verdichten, um daraus architektonische Strategien zu entwickeln. Mit großer Feinfühligkeit erkennt sie, welche historische Spuren und Referenz sich dafür eignen, nicht nur bewahrt, sondern neu bewertet und weitergedacht zu werden. „Manchmal muss man drei mal hinschauen“, um die subtilen und oft humorvollen Verweise in ihrer Arbeit zu erkennen, sagt Oda Pälmke. Der Abend beginnt mit der Darstellung ihrer drei Bücher: „Typen – Good, Bad and Ugly Houses“, „Ganz gut – Quite Good“ und „Facades“. Mit einem Blick fürs Wesentliche und auch Skurrile trotzt sie in den kleinen Büchern der generischen Alltagsarchitektur Momente der Schönheit ab. Damit gibt sie bereits einen tiefen Einblick in ihre Arbeitsweise: Mittels einer poetischen Verdichtung transformiert sie die urbane Realität, die „hässlich“ oder allenfalls „ganz gut“ ist, zu „ziemlich gut“. Damit stehen ihre Arbeiten im Kontext einer gegenwärtigen Generation von Architekten, die die Wertigkeit aller Zeitschichten der Stadt zu schätzen wissen, da sie ihnen die Möglichkeit eröffnen, überlieferte architektonische Prinzipien zeitgemäß weiterzudenken. Die Ambition besteht darin, das Vorgefundene selbstbewusst zu interpretieren und in der Transformation des Vorhandenen das eigene Zeitgefühl zum Ausdruck zu bringen. Damit sind ihre Arbeiten immer zeitgenössisch und von einer ziemlich seltenen Selbstverständlichkeit. SL/ALN

uk: вхід без авторизації

name: ARCH+ features 22: Good, bad, ugly or quit good


uk: Архітектура, дизайн інтер'єру

description: The architect Eyal Weizman presents his contribution to the Gwangju Biennale. "Roundabout Revolution", a collaboration with Samaneh Moafi, seeks to test the constitution and potential of public space today in contemporary Gwangju as well as in the global political arena.

uk: вхід без авторизації

name: ARCH+ features 23: The Roundabout Revolution


uk: Архітектура, дизайн інтер'єру

description: Nikolaus Hirsch, künstlerischer Leiter der Gwangju Biennale Folly II und Direktor der Städelschule in Frankfurt a.M., spricht über das Konzept von Folly II und die Bedeutung von Schwellen für den öffentlichen Raum.

uk: вхід без авторизації

name: ARCH+ features 23: Schwelle als Provokation


uk: Архітектура, дизайн інтер'єру

description: Nach dem erfolgreichen Auftakt, einem ganztätigen Symposium, fand am 14.3.14 die feierliche Eröffnung der Ausstellung "Think Global, Build Social!" im Architekturzentrum Wien statt. Den ganzen Tag über verfolgten von 10:00-17:00 Uhr über 100 Gäste konzentriert die Berichte der 9 geladenen Teilnehmer und Teilnehmerinnen der Ausstellung. Ob es um komplexe interkulturelle Kompetenzen an der thailändisch-burmesischen Grenze ging (wie bei Line Ramstad von Gyaw Gyaw) oder um soziale Strategien für eine Stadt der Teilhabe durch eine Begegnungstätte für Studierende und Obdachlose in Wien (wie bei Alexander Hagner von gaupenraub+/-), im Vordergrund standen bei allen Vortragenden immer die Frage, welchen Beitrag die Architektur für das konkrete Leben der Gemeinschaft leisten kann. Dass dabei nicht nur das langfristige soziale Engagement, sondern auch die architektonische Qualität und intelligente, ressourcenschonende Lösungen im Fokus stehen, zeichnet die Auswahl der Projekte und Initiativen aus. Nach der ersten Station am DAM in Frankfurt konnten wir in Wien zum zweiten Mal anhand der uneitlen und authentischen Berichte der Architektinnen und Architekten erleben, von welcher Welle der Kollegialität und des gegenseitigen Respekts diese Bewegung getragen wird. Anlässlich der Ausstellungseröffnung von „Think Global, Build Social! Bauen für eine bessere Welt“ im Architekturzentrum Wien präsentiert die Reihe ARCH+ features den ergänzenden Österreich-Schwerpunkt, mit dem das Az W unter anderem einen Überblick über die vielfältige Beteiligung österreichischer Hochschulen an Design-Build-Projekten bietet. ARCH+ features würdigt damit vor allem das besondere Engagement der lebendigen Design-Build-Bewegung in Österreich. In diesem Kurzinterview hat Elias Rubin vom Verein s2arch, der zunächst als Student und danach als Projektleiter an vielen Design-Build-Projekten beteiligt war, die Motivation hinter seiner Arbeit dargestellt.

uk: вхід без авторизації

name: ARCH+ features 24: Think Global, Build Socical! - Elias Rubin - s2ach, Wien, Österreich


uk: Архітектура, дизайн інтер'єру

description: Thomas Raynaud of BuildingBuilding belonsg to a new generation of architects that has returned to core questions of the discipline by reemphasizing the intellectual potency of form. He takes up a traditional historical lineage that championed architecture's inherent autonomy — a break from decades of architectural discourse dominated by sociology and technology.

uk: вхід без авторизації

name: ARCH+ features 25: Some works of BuildingBuilding


ARCH+ features 26: Die Klotz-Tapes

uk: Архітектура, дизайн інтер'єру

description: Anlässlich des 30-jährigen Gründungsjubiläums des Deutschen Architekturmuseums in Frankfurt haben ARCH+ in Kooperation mit dem DAM die sogenannten Klotz-Tapes herausgegeben. In diesen bisher unveröffentlichten Tonbanddiktaten schildert DAM-Gründungsdirektor Heinrich Klotz (1935–1999) den Aufbau der Sammlung, die Errichtung des Museumsgebäudes und seine Begegnungen mit Architekten. Klotz hat die Postmoderne nach Deutschland gebracht, steht ihr aber auch kritisch gegenüber. Oliver Elser, Myriam Pflugmann und Franziska Stein haben im Deutschen Architekturmuseum (DAM) die Klotz-Tapes bearbeitet und stellen diese in dem ihnen gewidmeten ARCH+ feature ausführlich vor.

uk: вхід без авторизації


cs: Matematika

de: Mathematik

fi: matematiikka

uk: Математика

en: Mathematics

fr: Mathématiques

da: Matematik

es: Matemáticas

nl: Wiskunde

de: Mathematik, Naturwissenschaften

uk: Математика, природничі науки

en: Mathematics, Natural Sciences

description: We consider the customers' equilibrium strategy and socially optimal strategy in a single server Markovian queueing system with changeable service rates controlled by a threshold. When a customer arrives at an empty system, he is served by the server at a lower service rate. When the queue length reaches the threshold, customers are served at a high service rate. The optimal joining strategies of customers are studied under two information scenarios. The first scenario, where the server' state and the queue length are observable, is called a fully observable case. The second scenario, where the system state is not observable, is called an unobservable case. We analyze the steady-state distribution and performance measures of the system, and derive the equilibrium strategy. Finally, we compare the equilibrium strategy with socially optimal strategy via numerical examples.

uk: вхід без авторизації

name: Equilibrium and Social Optimality in Queues with Service Rate and Customers' Joining Decisions

name: Banff International Research Station (BIRS) for Mathematical Innovation and Discovery


uk: Математика, природничі науки

description: In this talk, we provide a method, called L, based on distributional law of Little (DLL) to determine the equilibrium distribution of the number of elements in a discrete-time GI/G/1 queueing system. We also clarify a number of issues, and provide a number of new results. We assume that the inter-arrival times range from 1 to g+1 and the service times from 1 to h+1. The majority of authors have formulated the system in question as a quasi birth and death process, which can be solved by the matrix iterative methods pioneered by Neuts, methods that are cubic in the number of phases, and in fact, if g=h, all matrix analytic methods we found in literature are cubic in g, or worse. In contrast, our method L, which finds the distribution of the number of elements in the system in quadratic time. This implies that for large enough g and h, our algorithm will outperform all cubic algorithms, a claim verified by numerical tests. In particular, for realistic values g and h, algorithm L is more than 50 times faster than the different algorithms based on matrix analytic methods we found in literature.

uk: вхід без авторизації

name: The Distribution of the Line Length in a GI/G/1 Queue Using Distribution Little Laws and Roots Methods


uk: Математика, природничі науки

description: Monte Carlo simulation is one of the most successful techniques, not only in operations research and performance evaluation, but in science in general. One reason for this extraordinary success is its flexibility. In contrast, most queueing models are rather specialized. In this talk, we suggest methods to make queueing theory more flexible. In particular, we suggest an event-based approach, which provides great flexibility for the modeller. We also show how to convert such event- based models into Markov chains, which can then be solved by classical numerical methods. The suggested method is particularly suited for small models, where its execution times are much lower than Monte-Carlo simulation. For larger problems, the curse of dimensionality takes over, and the execution times based on classical numerical methods increase exponentially. This means that for complex models, simulation finds numerical solutions with less computer time than classical numerical methods.

uk: вхід без авторизації

name: Organization Tavakoli, Javad (Moderation)

name: Queueing Theory in a World where most Queueing Problems are Solved by Simulation (Keynote)


uk: Математика, природничі науки

description: There are many applications where users of different types arrive to a finite set of resources and request temporary use of subsets of these resources. The manager of the resources is entitled to charge for their use and might incur some costs in making them available. In this context, the manager has an admission control problem. Given the current state of allocation, can they admit a user of a particular type? If they can, should they, or wait for a more lucrative user to arrive in the future? In the situation where a user is indifferent between different sets of resources, which ones should they choose? In this talk I shall discuss my long history of engaging with different versions of this problem, culminating with some current work with Jing Fu and Bill Moran in which we are looking at a restless multi-armed bandit formulation.

uk: вхід без авторизації

name: Admission policies for complex resource allocation problems (Keynote)


uk: Математика, природничі науки

description: When job sizes are known, Shortest Remaining Processing Time (SRPT) is known to be an optimal (in a very strong sense) scheduling policy for a single server queue under general assumptions on underlying random variables. However, the performance of SRPT is known not to be robust to errors in processing time estimates. For a popular error model, we characterize the optimal policy using a Gittins Index approach and discuss its properties. The implementability of the policy is studied, with the structure of the optimal policy guiding heuristic policies that appear to perform well. Time permitting, issues for multiple server queues will be highlighted.

uk: вхід без авторизації

name: Size-based Scheduling with Estimation Errors


Completing a Task with Interruptions

uk: Математика, природничі науки

description: Assume that the time to complete a task without interruption is T. Assume interruptions occur according to a Poisson process with rate lambda. If a process is interrupted, it must begin again. Let W be the total time to completion. We find the Laplace transform of W. One application is a solution of the classic problem of the time to cross a one way street assuming Poisson traffic.

uk: вхід без авторизації


cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

uk: вхід без авторизації

name: Plone Conf 2016 - Day 2: Lightning Talks


uk: Комп'ютерні науки

description: Tom will outline the development process, the tools used, and show some of the Plone code that made the relaunch of this site a success. Tom will describe the WebRelaunch project at FHNW - the University of Applied Sciences Northwestern Switzeland. He will cover - The lessons they learned about taming Plone 5 and plone.app.mosaic, - Working with diverse external partners who had never heard of Plone, - Completely separating the front end from the editing area ...and several other hurdles and goodies they encountered on the way to their new website, which will be released soon.

uk: вхід без авторизації

name: Transforming for the Future: A Swiss University Success Story


uk: Математика, природничі науки

description: We are concerned with an M /M /- join the shortest queue type with N parallel queues for an arbitrary large N, in which each queue has a dedicated input stream. Each server has an exponential service rate μ. Assuming the steady-state case, a bayesian paradigm is used in estimating the traffic intensity based on queue length data only and based on the mean field interaction model for the limiting behavior of the JSQ model studied by Daw- son et al. (2019) . Several prior distributions are taken into account and numerical results show the accuracy of our estimate of the traffic intensity.

uk: вхід без авторизації

name: On Bayesian Estimation for Join the Shortest Queue Model


uk: Математика, природничі науки

description: We study the asymptotic periodic distribution of queues with time- varying periodic transition rates and catastrophes that occur randomly according to an exponential distribution with time-varying periodic rate. When a disaster occurs, the system resets, all customers are lost and an exponentially distributed period of time elapses before the repair is complete. Service is governed by a phase distribution. The asymptotic periodic distribution of the queue process is analogous to the steady state distribution for a system with constant transition rates.

uk: вхід без авторизації

name: Catastrophes and Queueing Systems with Time-Varying Periodic Transition Rates


uk: Математика, природничі науки

description: We consider a class of phase-type distributions, to be called the MMPP class of PH-distributions, and find bounds of their mean and squared coefficient of variation (SCV). As an application, we have shown that the SCV of the event- stationary inter-event time of Markov modulated Poisson processes (MMPPs) is greater than or equal to unity, which answers an open problem about MMPPs.

uk: вхід без авторизації

name: Bounds on the Mean and Squared Coefficient of Variation of Phase-Type Distributions


uk: Математика, природничі науки

description: In this paper, we study a double-sided queueing model with marked Markovian arrival processes and finite discrete abandonment times. We apply the theory of multi-layer Markov modulated fluid flow (MMFF) processes to analyze the queueing model. First, we define three age processes for the queueing system and convert them into a multi-layer MMFF process. Then we analyze the multi- layer MMFF process to find queueing performance measures related to the age processes, matching rates/probabilities, waiting times, and queue lengths for both sides of the queueing system. We obtain a number of aggregate quantities as well as quantities for individual types of inputs, which can be useful for the analysis and design of, for examples, passenger-taxi service systems and organ transplantation systems.

uk: вхід без авторизації

name: Double-Sided Queues with Marked Markovian Arrival Processes and Abandonment


Baobáxia - the Galaxy of Baobab Trees

uk: Комп'ютерні науки

description: Baobáxia is a community-built project to connect about 200 Brazilian quilombos to assist the interchange and preservation of traditional, community-built culture, under especially challenging conditions including remote locations without access to the Internet. Baobáxia is built in Django with sqlite or postgres (middle-end) and Backbone,js (front-end) with a back-end in git-annex, which handle the synchronization between different nodes in the network. We're currently considering the possibility of rewriting the system, e.g. with an API in Flask directly on top of git-annex, skipping the Django middleware, and a new front end in Angular.js. The talk will present the system and the movement behind and will discuss the pros and the cons of the possible paths for future development.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: I will talk about our work at Briefy, a startup company from Berlin that provides visual content on a large scale. When I started working at Briefy last year we had a big challenge: build a new product from scratch to automate the entire business. We built an entire technical solution consisting of thousands of lines of code running in the cloud with only three developers. We managed to create and deliver a set of new components: * Microservices with Pyramid and SQLAlchemy * Frontend with Angular4 * Event dispatcher service handling: notifications, logs, bigquery integration and async tasks * Paas environment with Deis to run our (micro) services in AWS * Workflow library to model our business process I will talk about this case of study from the initial challenge, technical decisions, non-technical issues and with an overview of each component of this architecture, lessons learned and future challenges.

uk: вхід без авторизації

name: From legacy to a microservices architecture


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Plone Conf 2017 - Day 1: Lightning Talks


Really unconventional migrations

uk: Комп'ютерні науки

description: In this talk I am going to share original ideas and novel techniques we developed to cut down upgrade and migration times. It all was triggered by the challenging task of upgrading a heavily customized Plone 4 intranet to Plone 5 and contextually installing Plone Intranet while minimizing the downtime. Solr was involved in the process. Given we had to deal with 300 GB of data, the out of the box Plone upgrade procedure and the migration from Archetypes to Dexterity was simply too slow to fit the given time constraints. We were forced to explore new migrations paths and strategies. The outcome was a set of original ideas and techniques that can be shared and applied as well to other Plone/Zope projects.

uk: вхід без авторизації


uk: Комп'ютерні науки

de: Erziehungswissenschaften

uk: Педагогічні науки

en: Educational Sciences

de: Rechts-, Wirtschafts- und Sozialwissenschaften

uk: Право, економіка та суспільні науки

en: Law, Economics and Social Sciences

uk: вхід без авторизації

name: TOWARDS INNOVATIVE ENGINEERING EDUCATION

University of Toronto

addressCountry: CA

addressLocality: Toronto

addressRegion: Ontario

name: Educational Technology Office, Faculty of Applied Science and Engineering (ETO FASE)


Single sign on sites in Japan

uk: Комп'ютерні науки

description: We made some SSO sites in Japan. I will show the structure of the sites in this talk, and I will cover some technical points: ° Plone + Shibboleth ° Plone + CAS ° Pyramid + Shibboleth ° Plone + Shibboleth / NOT using SSO ° Plone + SiteMinder + LDAP

uk: вхід без авторизації


uk: Комп'ютерні науки

description: For several of our clients we have used Plone to develop a public facing website in multiple languages and multiple domains. Plone’s support for developing multilingual sites provides an excellent framework to build international-targeting site. In this talk I will show how you can create a site with many languages, served in several domains (some of them with multiple languages), and easily copy content from one language to another.

uk: вхід без авторизації

name: Plone in a multi country, multi language and multi domain Apps


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Die neue Plone 5 Ära der Universität Bonn


uk: Комп'ютерні науки

@language: es

uk: вхід без авторизації

name: Plone CMS, novedades y flexibilidad para soluciones empresariales hoy en día


uk: Математика, природничі науки

description: A holomorphic quadratic differential on a complex curve defines a flat metric with conical singularities. In the case of simple zeroes, T. Bridgeland and I. Smith identified geodesic intervals connecting zeroes, as well as maximal geodesic cylinders, with stable objects in certain 3-dimensional Calabi-Yau category. As a corollary, the counting of such geodesics gives a wall-crossing structure in the Lie algebra of Hamiltonian vector fields on a symplectic algebraic torus. I will explain that essentially the same numbers give wall-crossing structure in a different graded Lie algebra, of matrix-valued functions on an algebraic torus (joint work with Y. Soibelman). This WCS makes sense for curves endowed with abelian differentials with zeroes of arbitrary order and can be generalized to closed holomorphic 1-forms on complex varieties of arbitrary dimension.

uk: вхід без авторизації

name: BPS Counting and Pseudoperiodic Topology

name: Institut des Hautes Études Scientifiques (IHÉS)

addressCountry: FR

addressLocality: Bures-sur-Yvette

addressRegion: Île-de-France


uk: Математика, природничі науки

description: The count of stable pairs (Pandharipande-Thomas theory) on K3 x E is well-understood whenever the curve class is primitive over the K3 factor. I will explain how ideas of Pandharipande and Thomas can be used to remove the primitivity assumption.

uk: вхід без авторизації

name: Multiple Cover Formula for the Stable Pairs Theory of K3xE


uk: Математика, природничі науки

description: Khovanov and Rozansky defined a link homology theory which categorifies the HOMFLY-PT polynomial. This homology is relatively easy to define, but notoriously hard to compute. I will discuss recent breakthroughs in understanding and computing Khovanov-Rozansky homology, focusing on connections to the algebraic geometry of Hilbert schemes of points, affine Springer fibers and braid varieties.

uk: вхід без авторизації

name: 4/5 Algebra and geometry of link homology


uk: Математика, природничі науки

description: We call generalized Airy functions particular solutions of the differential equations f(n)(x)=xaf(x). We show that asymptotic expansions of generalized Airy functions contain coefficients of Givental's R-matrices both for Gromov-Witten invariants of projective spaces and for Witten's r-spin classes. Joint work with Sybille Rosset.

uk: вхід без авторизації

name: Generalized Airy Functions and Givental's R-matrices for Projective Spaces and Witten's Class


uk: Комп'ютерні науки

description: Les pouvoirs publics font face à plusieurs défis en termes de gestion des données misent à disposition du citoyen. Au-delà des aspects techniques, comment gérer les données, les rendre accessibles et placer le citoyen au centre de la démarche.

uk: вхід без авторизації

name: Retour d’expérience sur la gestion de solutions orientées citoyen


uk: Комп'ютерні науки

description: Plus de 300 Pouvoirs locaux de Wallonie utilisent Plone comme framework pour créer des applications répondant à leurs besoins parfois très spécifiques. Récompensé par un award de la commission européenne en 2017, le projet est reconnu comme une “success story” de partage de patrimoine logiciel entre pouvoirs publics. Un business plan efficace, une maîtrise des outils et l’adoption de la méthodologie inspirée des communautés open source comme Plone.org assurent la pérennité de ce projet depuis 15 ans.

uk: вхід без авторизації

name: L'efficacité de l'open source pour développer un patrimoine logiciel commun à un groupement de villes


uk: Математика, природничі науки

description: The purpose of these lectures will be to present the theory of classifying toposes of geometric theories. This theory was developped in the 1970's by Lawvere, Makkai, Reyes, Joyal and other catagory theorists, systematising some constructions of Grothendieck and his student Monique Hakim, but it still deserves to be much better known that it actually is. The last part of the lectures will present new developpments due to Olivia Caramello which, based on her principle of "toposes as bridges", make the theory of classifying toposes more applicable to concrete mathematical situations : in particular, the equivalence between geometric provability and computing on Grothendieck topologies, and general criteria for a theory to be of presheaf type.

uk: вхід без авторизації

name: 4/4 Classifying toposes of geometric theories


Docker and Plone

uk: Комп'ютерні науки

description: Easily develop and deploy Plone based application stacks with Docker and Rancher.

uk: вхід без авторизації


uk: Математика, природничі науки

description: Quantum mechanics implies a fundamentally non-classical picture of the physical world. This non-classicality is expressed in it sharpest form in the phenomena of non-locality and contextuality, articulated in the Bell and Kochen-Specker theorems. Apart from the foundational significance of these ideas, they play a central role in the emerging field of quantum computing and information processing, where these non-classical features of quantum mechanics are used to obtain quantum advantage over classical computational models. The mathematical structure of contextuality, with non-locality as a special case, is fundamentally sheaf-theoretic. The non-existence of classical explanations for quantum phenomena corresponds precisely to the non-existence of certain global sections. This leads to both logical and topological descriptions of these phenomena, very much in the spirit of topos theory. This allows the standard constructions which witness these results, such as Kochen-Specker paradoxes, the GHZ construction, Hardy paradoxes, etc., to be visualised as discrete bundles. The non-classicality appears as a logical twisting of these bundles, related to classical logical paradoxes, and witnessed by the non-vanishing of cohomological sheaf invariants. In this setting, a general account can be given of Bell inequalities in terms of logical consistency conditions. A notion of simulation between different experimental situations yields a category of empirical models, which can be used to classify the expressive power of contextuality as a resource. Both quantitative and qualitative, and discrete and continuous features arise naturally.

uk: вхід без авторизації

name: The sheaf-theoretic structure of contextuality and non-locality


uk: Комп'ютерні науки

description: Les plateformes collaboratives permettent d’assurer une gestion efficace des conseils municipaux de l’instruction des dossiers par l’agent communal à la publication des décisions vers le citoyen (https://www.deliberations.be). La gestion de projets et la gestion documentaire sont également des outils transversaux permettant aux administrations d’éviter le fonctionnement en silo.

uk: вхід без авторизації

name: Améliorer la gouvernance et la gestion interne de la ville avec Plone


Making Everyone Happy

uk: Комп'ютерні науки

description: The Mountaineers is a 110-year old nonprofit focused on exploring and protecting the outdoors. They have very broad and diverse groups of users - the general public, guests, members (adults and youth), volunteers, donors, and staff - all with competing technological needs and challenges. Jeff will show how a combination of the Plone CMS and Salesforce CRM help The Mountaineers meet these challenges.

uk: вхід без авторизації


Tao of CSS

uk: Комп'ютерні науки

description: Rob will tell us about transitions, transforms, animations, cool backgrounds, and more.

uk: вхід без авторизації


A JavaScript Plone Client

uk: Комп'ютерні науки

description: A key part of the work started at the Barcelona sprint this summer was an extensible Angular 2 based app, which does all its interaction with the Plone backend through the new REST API. It supports both server side and browser side rendering for fast response time, SEO and accessibility.

uk: вхід без авторизації


Digital Marketing Platforms

uk: Комп'ютерні науки

description: The Plone CMS is near and dear to our hearts, but there's more to life than custom content types, templates/themes, and workflows that support a website with robust content management features. It's important to understand what marketing/business problems Plone solves for and which ones it does not, so that Plone can remain at the heart of an integrated Digital Marketing Platform that empowers marketers to have content-related capabilities such as Personalization and Targeting, Data Analytics, Test-and-Learn, Omni-channel campaigns across email, mobile, etc. We will also take a look at how Plone is able to fit into a CMS + eCommerce and/or CMS + Membership Management integrated experience.

uk: вхід без авторизації


Accessibility: Access 4 all

uk: Комп'ютерні науки

description: What accessibility means and why it is vital to your whole process, from design to devops to content creation and curation. Paul will show how Plone can support you as you work towards the goal of optimal SEO, multi-platform deliverability and full legal compliance.

uk: вхід без авторизації


Reporting Databases

uk: Комп'ютерні науки

description: It's hard to make reports from NoSQL databases, and this is true for some SQL databases as well. And what if your reports need data from several databases? Then you need a separate reporting database. This talk will give you an introduction to reporting databases - what they are, when to use them, how to design them, and a quick look at some of the tools available. Lastly we'll look at how we implemented reporting databases at Shoobx and some of our experiences there.

uk: вхід без авторизації


Empowering Others by Removing Barriers

uk: Комп'ютерні науки

description: Your first time contribution to a large project is always a bit daunting: lots of things to learn and read upfront. Even for seasoned contributors there are always some rocks in the way.

uk: вхід без авторизації


uk: Математика, природничі науки

description: We present a Queueing and Markov chain decomposition method based on the total expectation theorem. Our decomposition method requires partial flow to be conserved, which we call a termination scheme. This scheme is useful when deriving analytical formulas for complex queueing systems. As an example, we apply our method to derive an exact set of stationary equations for the probability generating functions of decomposed chains of Markov-modulated continuous-time Markov chains.

uk: вхід без авторизації

name: Analysis of Markov Modulated Markov Chains - A Divide and Conquer Approach to Queueing Problems

name: Banff International Research Station (BIRS) for Mathematical Innovation and Discovery


keywords:
Models
agnostic
biostatistic
machine learning
epidemiology

uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

en: Information and Library Sciences

de: Geisteswissenschaften

uk: Гуманітарні науки

en: Humanities

description: Marvin, Computer Engineer and Biostatistician, is the head of the Emmy Noether research group on interpretable machine learning, funded by the German Research Foundation, at the Leibniz Institute for Prevention Research and Epidemiology – BIPS in Bremen, Germany. Since February 2021, he is also Professor of Machine Learning in Statistics at the University of Bremen. He has a research focus on statistical learning and interpretable machine learning and is interested in epidemiological applications to high-dimensional genetic data and longitudinal register data. Marvin is also author of several R packages, including the random forest package ranger. Marvin presented the results of his latest paper, just accepted in Machine Learning journal, explaining the conditional predictive impact (CPI), a model-agnostic interpretable machine learning method which can handle correlated predictor variables and adjust for confounders. The method builds on the knockoff framework of Candès et al. (2018) and works in conjunction with any valid knockoff sampler, supervised learning algorithm, and loss function. Marvin briefly described the method, show selected simulation results and give an example (with R code) of the application. The CPI has been implemented in an R package, cpi, which can be downloaded from this https URL.

uk: вхід без авторизації

name: Model-agnostic Interpretable Machine Learning


keywords:
West Nile Virus
Covariates
MOOD
Ecology

de: Umweltschutz

uk: Охорона навколишнього середовища

en: Environmental Protection

de: Biologie

uk: Біологія

en: Biology

uk: Математика, природничі науки

de: Raumplanung

uk: Містобудування та територіальне планування

en: Spatial Planning

description: William Wint is Senior Analyst for the Environmental Research Group of Oxford - ERGO, and an SRA at the Department of Zoology, University of Oxford. For MOOD, William focuses on providing covariate and disease driver datasets for risk assessment, and on modelling the distributions of the vectors and hosts of a range of MOOD’s target diseases. During the Science Webinar, William illustrated the latest developments about his reserch about vector and host modelling.

uk: вхід без авторизації

name: Overview of MOOD Vector and Host Modelling: Where we are now


uk: Комп'ютерні науки

description: RISC-V is an open standard instruction set architecture (ISA) provided under open-source licenses that do not require fees to use. ISA is based on established reduced instruction set computer (RISC) principles. RISC-V has features to increase computer speed, while reducing cost and power use. Many industry players like Google, IBM, NVIDIA, Qualcomm, and Samsung are members of the RISC-V Foundation and have long supported RISC-V development. In 2016, NVIDIA unveiled plans to replace the internal microcontrollers of their graphic cards with next-gen RISC-V-based controllers built for upcoming NVIDIA GPUs. NVIDIA's Product Security undertook a detailed architectural analysis and research of the RISC-V IP, discovering a potential risk with the ambiguous specification of the Machine Trap Base Address (MTVEC) register. This ambiguity leads to potential fault injection vulnerabilities under physical attack models.

uk: вхід без авторизації

name: Glitching RISC-V chips: MTVEC corruption for hardening ISA


uk: Комп'ютерні науки

description: Apple's iOS, macOS and other OS have existed for a long time. There are numerous interesting logic bugs hidden for many years. We demonstrated the world's first public 0day exploit running natively on Apple M1 on a MacBook Air (M1, 2020). Without any modification, we exploited an iPhone 12 Pro with the same bug. In this talk, we will show you the advantage and beauty of the IPC logic bugs, how we rule all Apple platforms, Intel and Apple Silicon alike, even with all the latest hardware mitigations enabled, without changing one line of code. We would talk about the security features introduced by Apple M1, like Pointer Authentication Code (PAC), System Integrity, and Data Protection. How did they make exploiting much harder to provide better security and protect user's privacy. We will talk about different IPC mechanisms like Mach Message, XPC, and NSXPC. They are widely used on Apple platforms which could be abused to break the well designed security boundaries. We will walk you through some incredibly fun logic bugs we have discovered, share the stories behind them and methods of finding them, and also talk about how to exploit these logic bugs to achieve privilege escalation. REFERENCES: https://www.youtube.com/watch?v=Kh6sEcdGruU https://support.apple.com/en-us/HT211931 https://support.apple.com/en-us/HT211850 https://support.apple.com/en-us/HT212011 https://support.apple.com/en-us/HT212317 https://helpx.adobe.com/security/products/acrobat/apsb20-24.html https://helpx.adobe.com/security/products/acrobat/apsb20-48.html https://helpx.adobe.com/security/products/acrobat/apsb20-67.html

uk: вхід без авторизації

name: Cought you - Reveal and Exploit IPC Logic Bugs in Apple


uk: Комп'ютерні науки

description: Vacuum robots are becoming increasingly popular and affordable as their technology grows ever more advanced, including sensors like lasers and cameras. It is easy to imagine interesting new projects to exploit these capabilities. However, all of them rely on sending data to the cloud. Do you trust the companies promise that no video streams are uploaded to the cloud and that your personal data is safe? Why not collect the dust with open-source software? I previously showed ways to root robots such as Roborock and Xiaomi, which enabled owners to use their devices safely with open-source home automation. In response, vendors began locking down their devices with technologies like Secure Boot, SELinux, LUKS encrypted partitions and custom crypto that prevents gaining control over our own devices. This talk will update my newest methods for rooting these devices. The market of vacuum robots expanded in the past 2 years. In particular, the Dreame company has recently released many models with interesting hardware, like ToF cameras and line lasers. This can be a nice alternative for rooting. I will show easy ways to get root access on these devices and bypass all security. I will also discuss backdoors and security issues I discovered from analysis. You will be surprised what the developers left in the firmware. REFERENCES: Unleash your smart-home devices: Vacuum Cleaning Robot Hacking (34C3) https://dontvacuum.me/talks/34c3-2017/34c3.html Having fun with IoT: Reverse Engineering and Hacking of Xiaomi IoT Devices https://dontvacuum.me/talks/DEFCON26/DEFCON26-Having_fun_with_IoT-Xiaomi.html https://linux-sunxi.org/Main_Page

uk: вхід без авторизації

name: Robots with lasers and cameras (but no security) Liberating your vacuum from the cloud


uk: Комп'ютерні науки

description: Apple introduced an Ultra Wideband (UWB) chip in the iPhone 11. Its cryptographically secured spatial measurement capabilities are accessible via the Nearby Interaction framework since iOS 14. As of now, it only supports interaction with other Apple devices including the latest Apple Watch and HomePod mini. These are the first steps to support UWB in a larger ecosystem, as measuring precise distance and direction can be an enabler for various future applications. The automotive industry already announced UWB support for mobile car keys on the iPhone. But what’s really inside Apple’s U1 chip, internally called Rose? In this talk, we will travel through time, space, firmware and kernel components—and fight daemons to modify firmware interaction from user space. This will not only cover one or two, but three firmwares that process or forward each Rose time measurement: The Rose Digital Signal Processor (DSP), Rose Application Processor (AP), and the Always-On Processor (AOP). REFERENCES: There's almost nothing known about UWB on the iPhones... So the only reference is this: https://support.apple.com/guide/security/ultra-wideband-security-sec1e6108efd/web

uk: вхід без авторизації

name: Wibbly Wobbly, Timey Wimey -Whats Inside Apple's U1 chip


uk: Комп'ютерні науки

description: By responding to probing requests made by Palo Alto and SonicWALL firewalls, it's possible to apply security policies to arbitrary IPs on the network, allowing access to segmented resources. Segmentation using firewalls is a critical security component for an organization. To scale, many firewall vendors have features that make rule implementation simpler, such as basing effective access on a user identity or workstation posture. Security products that probe client computers often have their credentials abused by either cracking a password hash, or by relaying an authentication attempt elsewhere. Prior work by Esteban Rodriguez and by Xavier Mertens cover this. In this talk I will show a new practical attack on identity-based firewalls to coerce them into applying chosen security policies to arbitrary IPs on a network by spoofing logged in users instead of cracking passwords. Logged on user information is often gathered using the WKST (Workstation Service Remote Protocol) named pipe. By extending Impacket with the ability to respond to these requests, logged on users on a device can be spoofed, and arbitrary firewall rules applied. We will dive into the details of how client probing has historically been a feature that should be avoided while introducing a new practical attack to emphasize that fact. REFERENCES https://www.coalfire.com/the-coalfire-blog/august-2018/the-dangers-client-probing-on-palo-alto-firewalls https://isc.sans.edu/forums/diary/The+Risk+of+Authenticated+Vulnerability+Scans/24942/ https://github.com/SecureAuthCorp/impacket https://www.rapid7.com/blog/post/2014/10/14/palo-alto-networks-userid-credential-exposure/ https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXHCA0

uk: вхід без авторизації

name: Hi Im DOMAIN Steve, Please Let Me Access VLAN2: Tricking firewall user identity capabilities into applying security policies to arbitrary IPs on the network.


uk: Комп'ютерні науки

description: This talk will cover the unique threats and challenges of working in information security for a news organization. Some best practices for journalists, hard technical problems facing media security, and how hackers can get involved. This talk is for both hackers and journalists.

uk: вхід без авторизації

name: A look inside security at the New York Times


uk: Комп'ютерні науки

description: Over the past decade, there have been a number of research efforts (and DEFCON talks!) investigating the phenomenon of RSA keys on the Internet that share prime factors with other keys. This can occur when devices have poorly initialized sources of “randomness” when generating keys; making it trivial to factor the RSA modulus and recover the private key because, unlike large integer factorization, calculating the greatest common divisor (GCD) of two moduli can be fast and efficient. When describing their research, past hackers and researchers have attested that they “built a custom distributed implementation of Batch-GCD;” which seems like one hell of a detail to gloss over, right? This talk will detail a hacker's journey from understanding and implementing distributed batch GCD to analyzing findings from compromising RSA keys from network devices en masse. REFERENCES: Amiet, Nils and Romailler, Yolan. “Reaping and breaking keys at scale: when crypto meets big data.” DEF CON 26, 2018. Heninger, Nadia, et al. "Mining your Ps and Qs: Detection of widespread weak keys in network devices." 21st {USENIX} Security Symposium ({USENIX} Security 12). 2012. Hastings, Marcella, Joshua Fried, and Nadia Heninger. "Weak keys remain widespread in network devices." Proceedings of the 2016 Internet Measurement Conference. 2016. Kilgallin, JD. “Securing RSA Keys & Certificates for IoT Devices.” https://info.keyfactor.com/factoring-rsa-keys-in-the-iot-era. 2019 Daniel J. Bernstein. Fast multiplication and its applications, 2008.

uk: вхід без авторизації

name: The mechanics of compromising low entropy RSA keys


The PACS man Comes For Us All

uk: Комп'ютерні науки

description: It's 2021. You’re still here! You’re vaccinated! You should be happy and carefree! And yet…the PACS-man still haunts us all. Why should this be? Don’t we have newer, better tech with more bits of encryption and fewer wires? Haven’t the professional sentinels we’ve entrusted with our physical security software-defined ALL THE THINGS and made them better? Nay, these are but fruits of the poisonous physical security tree! Come, fellow hackers and weary travelers, visit with the ghosts of access control and learn of the lies they’ve laid before us! Come see how false guardians have used BLE slight-of-hand to increase complexity and cost while reducing security and ask that they be paid a tithing for the privilege! Witness young software-defined gladiators do battle in an arena they did not prepare for and falter! Behold as our friendly ghosts of access control forge never-before seen tools to help slay false security prophets!

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Browser extensions are installed anywhere, they serve as an integral part of our day-to-day web routine, from AdBlockers to Auto-Translators. But - do we know what is running inside of them? Do we know what goes deep-down inside their communication routines? How do they use their internal API’s? And how do their different JS execution contexts work? In this session, I will explore these unique internal extension API’s, hidden attack-surfaces and show how these concepts can be broken & exploited using new ways! I start showing how an attacker can "jump" from one low-permissions chrome-app/extension to another, hence elevating its permissions. Then, I will show how to gain full "browser-persistency" inside extensions' background-scripts context. Chaining it all together, I show how attacker, starting from low permissions chrome-app, gains a fully-armed "extension-rootkit", a persistent JS-malware running inside of a “good” extension, along with C&C features, JS injection techniques to any tab/origin, obfuscation-techniques and more. Eventually, I will present a generic technique, targeting all chrome-users, for taking over any previously installed chrome extension and implant an "extension-rootkit" in it. REFERENCES: [1] Chrome Developers: Chrome extensions API Reference, https://developer.chrome.com/docs/extensions/reference/ [2] Chrome Developers: Chrome extensions Manfiest v2/v3 Security References, https://developer.chrome.com/docs/extensions/mv2/getstarted/ & https://developer.chrome.com/docs/extensions/mv3/security/ [3] "Websites Can Exploit Browser Extensions to Steal User Data", 2019 - https://www.securityweek.com/websites-can-exploit-browser-extensions-steal-user-data / https://www-sop.inria.fr/members/Doliere.Some/papers/empoweb.pdf [4] "Web Browser Extension User-Script XSS Vulnerabilities", 2020 - https://ieeexplore.ieee.org/document/9251185 [5] "Detecting DOM-Sourced Cross-Site Scripting in Browser Extensions", 2017 - https://ieeexplore.ieee.org/document/8094406 [6] "Attacking browser extensions", Nicolas Golubovic, 2016 - https://golubovic.net/thesis/master.pdf [7] "A Combined Static and Dynamic Analysis Approach to Detect Malicious Browser Extensions", 2018 - https://www.hindawi.com/journals/scn/2018/7087239/ [8] "Chrome Extensions: Threat Analysis and Countermeasures", 2012 - https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.374.8978&rep=rep1&type=pdf [9] "Extension Breakdown: Security Analysis of Browsers Extension Resources Control Policies", Usenix Security 2017 - https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-sanchez-rola.pdf [10] "Protecting Browsers from Extension Vulnerabilities", 2010 - https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/38394.pdf

uk: вхід без авторизації

name: Extension Land: Exploits and Rootkits in Your Browser Extensions


uk: Комп'ютерні науки

description: The past two years have seen the rise of Golang-based malware from its beginnings as a way to win at CCDC and red team engagements to its current use by actual threat actors. This talk will break down why Golang is so useful for malware with a detailed tour through the available components used for exploitation, EDR and NIDS evasion, and post-exploitation, by one of the main authors of the core components. Although focused on the offensive perspective, there will be valuable insights into the challenges in detecting Golang malware. Interested in learning Golang? Interested in writing or detecting malware? This is your invitation into the weird and wonderful world of Golang malware. REFERENCES: List of Golang Security Tools: https://github.com/Binject/awesome-go-security C-Sto: https://github.com/c-sto/goWMIExec https://github.com/C-Sto/BananaPhone https://github.com/C-Sto/gosecretsdump capnspacehook: https://github.com/capnspacehook/pandorasbox https://github.com/capnspacehook/taskmaster Vyrus / gscript crew: https://github.com/gen0cide/gscript https://github.com/vyrus001/go-mimikatz https://github.com/vyrus001/msflib secretsquirrel / Josh Pitts: https://github.com/secretsquirrel/the-backdoor-factory https://github.com/Genetic-Malware/Ebowla https://github.com/secretsquirrel/SigThief https://github.com/golang/go/issues/16292 malwareunicorn on OSX loading: https://malwareunicorn.org/workshops/macos_dylib_injection.html Misc: https://github.com/sassoftware/relic https://github.com/EgeBalci/sgn https://github.com/moonD4rk/HackBrowserData https://github.com/emperorcow/go-netscan https://github.com/CUCyber/ja3transport https://github.com/swarley7/padoracle Command and Control: https://github.com/BishopFox/sliver https://github.com/DeimosC2/DeimosC2 https://github.com/t94j0/satellite Obfuscation/RE: https://github.com/unixpickle/gobfuscate https://github.com/mvdan/garble https://github.com/goretk/redress Of interest for defense, but breaks Docker & Terraform: https://github.com/unsecureio/gokiller

uk: вхід без авторизації

name: Offensive Golang Bonanza: Writing Golang Malware


uk: Комп'ютерні науки

description: Alarm systems are ubiquitous - no longer the realm of banks and vaults only, many people now have them in their homes or workplaces. But how do they work? And the logical follow-up question - how can they be hacked? This talk focuses on the communication lines in physical intrusion detection systems: how they are secured, and what vulnerabilities exist. We’ll discuss the logic implemented in the controllers and protections on the communication lines including end of line resistors - and all the ways that this aspect of the system can be exploited. In particular, we’ll release schematics for a tool we’ve developed that will enable measuring end-of-line resistor systems covertly, determining the necessary re-wiring to defeat the sensors, and deploy it without setting off the alarm. After the talk, you can head over to the Lock Bypass Village to try these techniques out for yourself!

uk: вхід без авторизації

name: Defeating Physical Intrusion Detection Alarm Wires


uk: Комп'ютерні науки

description: In the recent years, we have seen some of the major players in the industry switch from x86-based processors to ARM processors. However, you might be surprised to know that Intel has long supported ARM to x86 transition with their binary translator, Houdini, which runs ARM binaries on x86. In this talk, we will discuss Intel's proprietary Houdini translator, which is primarily used by Android on x86 platforms, such as higher-end Chromebooks and desktop Android emulators. We will start with a high-level discussion of how Houdini works and is loaded into processes. We will then dive into the low-level internals of the Houdini engine and memory model, including several security weaknesses it introduces into processes using it. Lastly, we will discuss methods to escape the Houdini environment, execute arbitrary ARM and x86, and write Houdini-targeted malware that bypasses existing platform analysis. REFERENCES: * Ye, Roger. Android System Programming: Porting, Customizing, and Debugging Android HAL. Packt Publishing, 2017. * JNI Functions, Oracle, 12 Nov. 2002, https://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/functions.html * Chromium OS Docs. Linux System Call Table, https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md * The Development Environment : Android Developers. Android Developers, https://developer.android.com/topic/arc/development-environment * Nachoparker. Own Your Bits, 14 June 2018, https://ownyourbits.com/2018/06/13/transparently-running-binaries-from-any-architecture-in-linux-with-qemu-and-binfmt_misc/ * Git at Google. Android container in Chrome OS, archived at https://web.archive.org/web/20200128052853/https://chromium.googlesource.com/chromiumos/platform2/+/master/arc/container-bundle/ * Oberheide, J. & Miller, C. 2012, June. Dissecting the Android Bouncer [Presentation] @ SummerCON, Brooklyn, New York

uk: вхід без авторизації

name: Sleight of ARM: Demystifying Intel Houdini


uk: Комп'ютерні науки

description: UPnP sucks, everybody knows it, especially blackhat proxy operators. UPnProxyPot was developed to MITM these operators to see what they're doing with their IoT proxy networks and campaigns. We'll cover SSDP, UPnP, UPnProxy research/campaigns as well as cover a new Golang based honeypot, so we can all snoop on them together! REFERENCES: http://www.upnp-hacks.org (OG disclosure) https://www.youtube.com/watch?v=FU6qX0-GHRU (DEF CON 19 talk I attended) https://www.akamai.com/us/en/multimedia/documents/white-paper/upnproxy-blackhat-proxies-via-nat-injections-white-paper.pdf (my initial UPnProxy research) https://blogs.akamai.com/sitr/2018/11/upnproxy-eternalsilence.html (additional UPnProxy campaign researcher, also mine)

uk: вхід без авторизації

name: UPnProxyPot: Fake the Funk, Become a Blackhat Proxy, MITM their TLS...


Do No Harm - LIVE

uk: Комп'ютерні науки

description: Mired in the hell of a global pandemic, hospital capacity stressed to its limit, doctors and nurses overworked and exhausted... surely the baddies would cut us a little slack and leave little 'ol healthcare alone for a bit, right? Well, raise your hand if you saw this one coming. Another year of rampaging ransomware, of pwned patient care- only this time backdropped by the raging dumpster fire that is COVID. Can we once and for all dispel with the Pollyannas telling us that nobody would knowingly seek to harm patients? And if we can't convince the powers that be- whether in the hospital C-suite or in DC- that we need to take this $%& seriously now, then what hope do we have for pushing patient safety to the forefront when things return to some semblance of normal? With a heavily curated panel including policy badasses, elite hackers, and seasoned clinicians - D0 N0 H4RM remains the preeminent forum where insight from experts collide with the ingenuity and imagination of the DEF CON grassroots to inspire activism and collaboration stretching far beyond closing ceremonies. Moderated by physician hackers quaddi and r3plicant, this perennially packed event always fills up fast - so make sure you join us. As always- the most important voice is yours.

uk: вхід без авторизації


Do No Harm - PANEL

uk: Комп'ютерні науки

uk: вхід без авторизації


Breaking Secure Bootloaders

uk: Комп'ютерні науки

description: Bootloaders often use signature verification mechanisms in order to protect a device from executing malicious software. This talk aims to outline actionable weaknesses in modern bootloaders which allow attackers to deploy unsigned code, despite these protection mechanisms. In the first phase of this talk, we will discuss exploitation of the bootloaders in modern Android smartphones, demonstrating weaknesses which allow for bypassing bootloader unlocking restrictions, decryption of protected user data, and deployment of malicious software to devices using full disk encryption. In the second phase, we will discuss bootloader weaknesses in the secondary hardware used by smartphones. Using an embedded RF chip as a target, we will demonstrate reverse engineering techniques which identified weaknesses in the signature verification mechanisms of the firmware update protocols used by the bootloader, allowing for deployment of custom firmware to the chip. REFERENCES: Travis Goodspeed - Great Ideas in Reversing the Tytera MD380: https://nullcon.net/website/archives/ppt/goa-16/Great-Ideas-in-Reversing-the-Tytera-MD380-by-Travis-Goodspeed.pdf Roee Hay - fastboot oem vuln: Android Bootloader Vulnerabilities in Vendor Customizations: https://www.usenix.org/system/files/conference/woot17/woot17-paper-hay.pdf

uk: вхід без авторизації


Sneak into buildings with KNXnet/IP

uk: Комп'ютерні науки

description: Building Management Systems control a myriad of devices such as lighting, shutters and HVAC. KNX (and by extension KNXnet/IP) is a common protocol used to interact with these BMS. However, the public's understanding and awareness is lacking, and effective tooling is scarce all while the BMS device market keeps on growing. The ability to craft arbitrary KNXnet/IP frames to interact with these often-insecure BMS provides an excellent opportunity in uncovering vulnerabilities in both the implementation of KNX as well as the protocol itself. From unpacking KNX at a lower level, to using a Python-based protocol crafting framework we developed to interact with KNXnet/IP implementations, in this talk we’ll go on a journey of discovering how BMS that implement KNXnet/IP work as well as how to interact with and fuzz them. After this talk you could also claim that “the pool on the roof has a leak”!

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Governments around the world (US, UK, EU) are planning to force interoperability on the biggest tech platforms. Companies like Facebook say that this is a privacy disaster because it would hurt their ability to keep us safe from privacy invasions. Yeah, I know. But even if you DO think Facebook has our best interests at heart, monopoly is a deeply stupid way protect privacy. I will present "Privacy Without Monopoly," a major EFF white paper I co-authored with Bennett Cyphers, which sets out a framework for understanding how privacy and interop aren't just compatible - they rely on one another!

uk: вхід без авторизації

name: Privacy Without Monopoly: Paternalism Works Well, But Fails Badly


You're Doing IoT RNG

uk: Комп'ютерні науки

description: Think of a random number between '0' and infinity. Was your number '0'? Seriously? Crap. Well unfortunately, the hardware random number generators (RNG) used by your favorite IoT devices to create encryption keys may not work much better than you when it comes to randomness. In this talk, we'll delve into murky design specs, opaque software libraries, and lots of empirical results. We wrote code for many popular IoT SoC platforms to extract gigabytes of data from their hardware RNGs and analyze them. What we found was a systemic minefield of vulnerabilities in almost every platform that could undermine IoT security. Something needs to change in how the Internet of Things does RNG. The vulnerabilities are widespread and the attacks are practical. RNG is bad out there - "IoT Crypto-pocalypse" bad.

uk: вхід без авторизації


Worming through IDEs

uk: Комп'ютерні науки

description: You might think that as long as you never hit run, opening up that interesting new POC in your IDE and checking out the code is safe. But it isn't. IDEs and developer tools are complex pieces of software that have vulnerabilities, just like everything else. We'll start by discussing what a reasonable threat model is for IDEs. How do companies threat model their IDEs? What do users expect of their IDEs? Is viewing a file equivalent to executing it? Then we'll dive into the reality of it. Nearly every IDE examined was trivially vulnerable. But there were also a variety of subtle bugs lying underneath. We'll look at bugs in both local IDEs (like VSCode and IntelliJ) and cloud-based IDEs (like AWS Cloud9 and Github Codespaces). Finally, we'll show how an attacker could make a worm that would spread through attacking IDEs. View a malicious project? Let's automatically backdoor every project on a computer and keep spreading. REFERENCES: https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md https://nvd.nist.gov/vuln/detail/CVE-2012-3479 http://blog.saynotolinux.com/blog/2016/08/15/jetbrains-ide-remote-code-execution-and-local-file-disclosure-vulnerability-analysis/ https://www.cvedetails.com/vulnerability-list/vendor_id-15146/product_id-49160/year-2019/Jetbrains-Intellij-Idea.html

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Offensive testing in organizations has shown a tremendous value for simulating controlled attacks. While cyber extortion may be one of the main high ROI end goals for the attacker, surprisingly few tools exist to simulate ransomware operations. Racketeer is one such tool. It is an offensive agent coupled with a C2 base, built to help teams to prototype and exercise a tightly controlled ransomware campaign. We walk through the design considerations and implementation of a ransomware implant which emulates logical steps taken to manage connectivity and asset encryption and decryption capabilities. We showcase flexible and actionable ways to prototype components of fully remote ransomware operation including key and data management, as well as data communication that is used in ransomware campaigns. Racketeer is equipped with practical safeguards for lights out operations, and can address the goals of keeping strict control of data and key management in its deployment, including target containment policy, safe credential management, and implementing operational security in simulated operations. Racketeer can help gain better optics into IoCs, and is helpful in providing detailed logs that can be used to study the behavior and execution artifacts of a ransomware agent.

uk: вхід без авторизації

name: Racketeer Toolkit: Prototyping Controlled Ransomware Operations


uk: Комп'ютерні науки

description: As developers start to rely more on hardware-based memory encryption controls that isolate specific application code and data in memory - secure enclaves, adversaries can use enclaves to successfully coexist on the host and enjoy similar protections. In this talk we venture into a practical implementation of such an offensive enclave, with the help of Intel SGX enclave technology, supported on a wide variety of processors present in enterprise data-centers and in the cloud. We discuss how malware can avoid detection in defensively instrumented environments and protect their operational components from processes running at high privilege levels, including the Operating System. We dive deeper into using enclaves in implants and stagers, and discuss the design and implementation of an enclave that is capable of facilitating secure communication and storage of sensitive data in offensive operations. We cover how the enclaves can be built to help secure external communication while resisting system and network inspection efforts and to achieve deployment with minimal dependencies where possible. Finally, we release the enclave code and a library of offensive enclave primitives as a useful reference for teams that leverage Intel SGX technology or have the hardware platform capable to support such adversarial efforts.

uk: вхід без авторизації

name: Your House is My House - Use of Offensive Enclaves In Adversarial Operations


Hacking Humans with AI as a Service

uk: Комп'ютерні науки

description: As the proliferation of Artificial Intelligence as a Service (AIaaS) products such as OpenAI's GPT-3 API places advanced synthetic media generation capabilities in the hands of a global audience at a fraction of the cost, what does the future hold for AI-assisted social engineering attacks? In our talk, we will present the nuts and bolts of an AIaaS phishing pipeline that was successfully deployed in multiple authorized phishing campaigns. Using both paid and free services, we emulated the techniques that even low-skilled, limited resource actors could adopt to execute effective AI-assisted phishing campaigns at scale. By repurposing easily-accessible personality analysis AIaaS products, we generated persuasive phishing emails that were automatically personalized based on a target's public social media information and created by state-of-the-art natural language generators. We will also discuss how an AI-assisted phishing workflow would impact traditional social engineering teams and operations. Finally, we look at how AIaaS suppliers can mitigate the misuse of their products. REFERENCES 1. T. Karras, S. Laine, and T. Aila, “A Style-Based Generator Architecture for Generative Adversarial Networks,” arXiv:1812.04948 [cs.NE], 2019. 2. S. Gehrmann, H. Strobelt, and A. M. Rush, “GLTR: Statistical Detection and Visualization of Generated Text,” arXiv:1906.04043 [cs.CL], 2019. 3. G. Jawahar, M. Abdul-Mageed, and L. V. S. Lakshmanan, “Automatic Detection of Machine Generated Text: A Critical Survey,” arXiv:2011.01314 [cs.CL], 2020. 4. J. Seymour and P. Tully, “Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing on Twitter,” 2016. 5. P. Tully and F. Lee, “Repurposing Neural Networks to Generate Synthetic Media for Information Operations,” 2020. 6. OpenAI, “OpenAI Charter,” OpenAI, 09-Apr-2018. [Online]. Available: https://openai.com/charter/. 7. G. Brockman, M. Murati, and P. Welinder, “OpenAI API,” OpenAI, 11-Jun-2020. [Online]. Available: https://openai.com/blog/openai-api/. 8. A. Pilipiszyn, “GPT-3 Powers the Next Generation of Apps,” OpenAI, 25-Mar-2021. [Online]. Available: https://openai.com/blog/gpt-3-apps/. Would like to thank contributing author Timothy Lee Timothy is a security researcher who likes to break things and tries to understand how the system works during the process. In the past year, he is researching with iOS security and is starting his journey on iOS vulnerability research. Additionally, he has contributed to red team social engineering operations and security tooling, with practical experience in vishing and in-person social engineering. https://www.linkedin.com/in/timothylee0/

uk: вхід без авторизації


eBPF, I thought we were friends!

uk: Комп'ютерні науки

description: Since its first appearance in Kernel 3.18, eBPF (Extended Berkley Packet Filter) has progressively become a key technology for observability in the Linux kernel. Initially dedicated to network monitoring, eBPF can now be used to monitor and trace any kind of kernel space activity. Over the past few years, many vendors have started using eBPF to speed up their services or introduce innovative features. Cilium, Calico, Cloudflare, Netflix and Facebook are leading the charge, showing off new complex networking use cases on a monthly basis. On the security side of things, Google recently contributed the Kernel Runtime Security Instrumentation which opens the door to writing Linux Security Modules with eBPF. In other words, eBPF is the new kid in town and a growing number of companies are running services with eBPF access in production. This leads us to a simple question: how bad can things get if one of those services were to be compromised ? This talk will cover how we leveraged eBPF to implement a full blown rootkit with all the features you would expect: various obfuscation techniques, command and control with remote and persistent access, data theft and exfiltration techniques, Runtime Application Self-Protection evasion techniques, and finally two original container breakout techniques. Simply put, our goal is to demonstrate that rogue kernel modules might have finally found a worthy opponent. We will also detail how to detect such attacks and protect your infrastructure from them, while safely enjoying the exciting capabilities that eBPF has to offer. REFERENCES: Bibliography and documentation links cited in the submission: 1. Russian GRU 85th GTsSS deploys previously undisclosed drovorub malware, NSA / FBI, August 2020 https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF 2. Kprobe-based Event Tracing, https://www.kernel.org/doc/html/latest/trace/kprobetrace.html 3. Linux Kernel tracepoints, https://www.kernel.org/doc/html/latest/trace/tracepoints.html 4. “bpf_probe_write_user” bpf helper, https://elixir.bootlin.com/linux/v5.11.11/source/include/uapi/linux/bpf.h#L1472 5. Uprobe-based Event Tracing, https://www.kernel.org/doc/html/latest/trace/uprobetracer.html 6. Cilium’s XDP documentation, https://docs.cilium.io/en/latest/bpf/#xdp Previous eBPF related talks & projects that helped us build the rootkit: 7. Evil eBPF In-Depth: Practical Abuses of an In-Kernel Bytecode Runtime, Jeff Dileo, DEF CON 27, https://www.defcon.org/html/defcon-27/dc-27-speakers.html#Dileo 8. Process level network security monitoring and enforcement with eBPF, Guillaume Fournier, https://www.sstic.org/2020/presentation/process_level_network_security_monitoring_and_enforcement_with_ebpf/ 9. Runtime Security with eBPF, Sylvain Afchain, Sylvain Baubeau, Guillaume Fournier, https://www.sstic.org/2021/presentation/runtime_security_with_ebpf/ 10. Monitoring and protecting SSH sessions with eBPF, Guillaume Fournier, https://www.sstic.org/2021/presentation/monitoring_and_protecting_ssh_sessions_with_ebpf/

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Fastjson is a widely used open source JSON parser with 23'100 stars on GitHub. As a basic module of countless java web services, it serves hundreds of millions of users. We managed to find a way to bypass many security checks and mitigations by using the inheritance process of some basic classes, and achieve remote code execution successfully. We will disclose these high-risk and universal gadgets for the first time in this talk. Now, we can control many important websites and affect millions of users. Let's make things more interesting. We found that this fastjson vulnerability affect a multi-billion-dollar blockchain. We designed multiple complex gadgets based on the features of the blockchain, and exquisitely achieved information leakage and pointer hijacking. Putting all these gadgets together, we achieved remote code execution on the blockchain nodes. However, generally after remote code execution, we seem to have no better exploit method other than the 51% attack, which will lead to serious accounting confusion. After a detailed analysis of the architecture design of the public blockchain, we found a way from RCE to steal the public blockchain users' assets almost without any notification. To the best of our knowledge, this is the first published attack case on the realization of covertly stealing user assets after RCE on the public blockchain nodes. We will propose a more covert post penetration exploit method for public blockchain nodes in this talk. Blockchain is not bulletproof to security vulnerability. We will show you how to use classical web vulnerabilities attack the blockchain and how to steal real money from the decentralized cyber world. REFERENCES: 1. https://github.com/threedr3am/gadgetinspector 2. https://github.com/JackOfMostTrades/gadgetinspector 3. http://i.blackhat.com/us-18/Thu-August-9/us-18-Haken-Automated-Discovery-of-Deserialization-Gadget-Chains.pdf 4. http://i.blackhat.com/eu-19/Thursday/eu-19-Zhang-New-Exploit-Technique-In-Java-Deserialization-Attack.pdf 5. https://asm.ow2.io/asm4-guide.pdf

uk: вхід без авторизації

name: How I use a JSON Deserialization 0day to Steal Your Money on the Blockchain


uk: Комп'ютерні науки

description: We've been getting asked a lot for "that tool that was like Shodan but for web app vulns.” In particular WTF happened to it? Punkspider (formerly known as PunkSPIDER but renamed because none of us could remember where tf the capital letters go) was taken down a couple of years ago due to multiple ToS issues and threats. It was originally funded by DARPA. We weren’t sure in which direction to keep expanding, and it ended up being a nightmare to sustain. We got banned more than a 15 year old with a fake ID trying to get into a bar. It became a pain and hardly sustainable without a lot of investment in time and money. Each time we got banned it meant thousands of dollars and countless hours moving sh** around. Now we’ve solved our problems and completely re-engineered/expanded the system. It is not only far more efficient with real-time distributed computing and checks for way more vulns, we had to take some creative ways through the woods – this presentation covers both the tool itself and the story of the path we had to take to get where it is, spoiler alert: it involves creating our own ISP and data center in Canada and integrating freely available data that anyone can get but most don’t know is available. Come play with us and see what the wild west of the web looks like and listen to our story, it’s fun and full of angry web developers. We’ll also be releasing at least 10s of thousands of vulnerabilities and will be taking suggestions from the audience on what to search. Fun vulns found get a t-shirt, super fun ones get a hoodie thrown at them. REFERENCES: https://www.youtube.com/watch?v=AbS_EGzkNgI (Shmoo 2013 talk) https://hadoop.apache.org/ https://aws.amazon.com/kubernetes/ https://www.docker.com/ https://www.python.org/ https://www.apache.org/licenses/LICENSE-2.0 https://kafka.apache.org/ https://owasp.org/www-project-top-ten/

uk: вхід без авторизації

name: Punkspider and IOStation: Making a mess all over the internet


uk: Комп'ютерні науки

description: You've seen talks about container hacking. You've seen talks about mainframe hacking. But how often do you see them together? IBM decided to put containers on a mainframe, so a container hacker and a mainframe hacker decided to join forces and hack it. We became the first people on the planet to escape a container on a mainframe, and we’re going to show you how. Containers on a mainframe? For real. IBM zCX is a Docker environment running on a custom Linux hypervisor built atop z/OS - IBM’s mainframe operating system. Building this platform introduces mainframe environments to a new generation of cloud-native developers-and introduces new attack surfaces that weren’t there before. In this crossover episode, we’re going to talk about how two people with two very particular sets of skills went about breaking zCX in both directions, escaping containers into the mainframe host and spilling the secrets of the container implementation from the mainframe side. When two very different technologies get combined for the first time, the result is new shells nobody’s ever popped before. REFERENCES: Getting started with z/OS Container Extensions and Docker: https://www.redbooks.ibm.com/abstracts/sg248457.html The Path Less Traveled: Abusing Kubernetes Defaults: https://www.youtube.com/watch?v=HmoVSmTIOxM Attacking and Defending Kubernetes Clusters: A Guided Tour: https://securekubernetes.com Evil Mainframe penetration testing course :https://www.evilmainframe.com/ z/OS Unix System Services (USS): https://www.ibm.com/docs/en/zos/2.1.0?topic=system-basics-zos-unix-file z/OS Concepts: https://www.ibm.com/docs/en/zos-basic-skills?topic=zc-zos-operating-system-providing-virtual-environments-since-1960s Docker overview: https://docs.docker.com/get-started/overview/

uk: вхід без авторизації

name: Real Life Story of the 1st Mainframe Container Breakout


uk: Комп'ютерні науки

description: What are the threats and vulnerabilities of a retail central bank digital currency (CBDC)? The central bank of Sweden has built a prototype of a retail CBDC system and I will run through the procurement requirements and design and point out where a two-tier CBDC need protection against attacks. The prototype is built on Corda Token SDK and I have during tests found reliable ways to exploit weaknesses in the design. The presentation will focus on the vulnerabilities that can crash the service that handles the tokens and permanently lock tokens rendering tokens and digital wallets useless. The presentation will also go into detail how tokens are validated and how information from all earlier transactions is needed for this. With D3.js and HTML5 I will visualize the token history (backchain) and describe how this can be a problem with GDPR and the Swedish bank secrecy regulation. The presentation will end with a summary of identified threats and weaknesses of a two-tier retail central bank digital currency prototype and how to handle them. The goal of the presentation is to give the attendees insight of the security implications, challenges depending on the design and where an attack can be carried out and everything that cannot be missed when designing a CBDC. REFERENCES: https://www.ingwb.com/media/3024436/solutions-for-the-corda-security-and-privacy-trade-off_-whitepaper.pdf https://d3js.org/

uk: вхід без авторизації

name: Central Bank Digital Currency, Threats and Vulnerabilities


uk: Комп'ютерні науки

description: Have you considered that in certain situations the way hackers exploit vulnerabilities over the network can be predictable? Anyone with access to encrypted traffic can reverse the logic behind the exploit and thus obtain the same data as the exploit. Various automated tools have been analyzed and it has been found that these tools operate in an unsafe way. Various exploit databases were analyzed and we learned that some of these are written in an insecure (predictable) way. This presentation will showcase the results of the research, including examples of exploits that once executed can be harmful. The data we obtain after exploitation can be accessible to other entities without the need of decrypting the traffic. The SSL/TLS specs will not change. There is a clear reason for that and in this presentation I will argue this, but what will change for sure is the way hackers will write some of the exploits.

uk: вхід без авторизації

name: Hack the hackers: Leaking data over SSL/TLS


uk: Комп'ютерні науки

description: What can you do, as an attacker, when you find yourself as a low privileged Windows user with no path to SYSTEM? Install a vulnerable print driver! In this talk, you'll learn how to introduce vulnerable print drivers to a fully patched system. Then, using three examples, you'll learn how to use the vulnerable drivers to escalate to SYSTEM. REFERENCES: - Yarden Shafir and Alex Ionescu, PrintDemon: Print Spooler Privilege Escalation, Persistence & Stealth (CVE-2020-1048 & more) - https://windows-internals.com/printdemon-cve-2020-1048/ - voidsec, CVE-2020-1337 – PrintDemon is dead, long live PrintDemon! - https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/ - Zhipeng Huo and Chuanda Ding, Evil Printer: How to Hack Windows Machines with Printing Protocol - https://media.defcon.org/DEF CON 28/DEF CON Safe Mode presentations/DEF CON Safe Mode - Zhipeng-Huo and Chuanda-Ding - Evil Printer How to Hack Windows Machines with Printing Protocol.pdf - Pentagrid AG, Local Privilege Escalation in many Ricoh Printer Drivers for Windows (CVE-2019-19363) - https://www.pentagrid.ch/en/blog/local-privilege-escalation-in-ricoh-printer-drivers-for-windows-cve-2019-19363/ - space-r7, Add module for CVE-2019-19363 - https://github.com/rapid7/metasploit-framework/pull/12906 - Microsoft, Point and Print with Packages - https://docs.microsoft.com/en-us/windows-hardware/drivers/print/point-and-print-with-packages - Microsoft, Driver Store - https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-store - Microsoft, Printer INF Files - https://docs.microsoft.com/en-us/windows-hardware/drivers/print/printer-inf-files - Microsoft, Use Group Policy settings to control printers in Active Directory - https://docs.microsoft.com/en-us/troubleshoot/windows-server/printing/use-group-policy-to-control-ad-printer

uk: вхід без авторизації

name: Bring Your Own Print Driver Vulnerability


HTTP2: The Sequel is Always Worse

uk: Комп'ютерні науки

description: HTTP/2 is easily mistaken for a transport-layer protocol that can be swapped in with zero security implications for the website behind it. Two years ago, I presented HTTP Desync Attacks and kicked off a wave of request smuggling, but HTTP/2 escaped serious analysis. In this presentation, I'll take you beyond the frontiers of existing HTTP/2 research, to unearth horrifying implementation flaws and subtle RFC oversights. I'll show you how these flaws enable HTTP/2-exclusive desync attacks, with case studies targeting high-profile websites powered by servers ranging from Amazon's Application Load Balancer to WAFs, CDNs, and bespoke stacks by big tech. I'll demonstrate critical impact by hijacking thick clients, poisoning caches, and stealing plaintext passwords to net multiple max-bounties. After that, I'll unveil novel techniques and tooling to crack open a widespread but overlooked request smuggling variant affecting both HTTP/1 and HTTP/2 that is typically mistaken for a false positive. Finally, I'll drop multiple exploit-primitives that resurrect a largely-forgotten class of vulnerability, and use HTTP/2 to expose fresh application-layer attack surface. I'll leave you with an open-source scanner, a custom, open-source HTTP/2 stack, and free interactive labs so you can hone your new skills on live systems. REFERENCES: The HTTP/2 RFC is essential reading: https://tools.ietf.org/html/rfc7540 This research is built on my previous work on this topic: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn This presentation by defparam has good explanations of response queue poisoning and self-desync attacks: https://www.youtube.com/watch?v=3tpnuzFLU8g I had a partial research collision with Emil Lerner. His work provides an alternative perspective on certain techniques: https://github.com/neex/http2smugl

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Modern programming languages are, more and more, being designed not just around performance, ease-of-use, and (sometimes) security, but also performance monitoring and introspectability. But what about the languages that never adopted such concepts from their peers? Or worse, what about the languages that tacked on half-hearted implementations as an afterthought? The answer is simple, you write your own and instrument them into the language dynamically. In this talk, we will discuss the process for developing generalized parasitic tracers targeting specific programming languages and runtimes using Ruby as our case study. We will show how feasible it is to write external tracers targeting a language and its runtime, and discuss best practices for supporting different versions over time. REFERENCES: * https://github.com/ruby/ruby * https://frida.re/docs/javascript-api/

uk: вхід без авторизації

name: Instrument and Find Out: Parasitic Tracers for High Level Languages


uk: Комп'ютерні науки

description: OAuth 2.0 device authentication gives users on limited-input devices like TVs an easier way to authenticate against a cloud website/app by entering a code on a computer/phone. This authentication flow leads to new phishing attacks that: - do not need server infrastructure--the login page is served by the authorization provider using their domain and cert - do not require a client application--application identities can be reused/spoofed - do not require user consent of application permissions Since the phish attacks hijack oauth session tokens, MFA will be ineffective as the attacker does not need to reauthenticate. The ability to defend against these attacks is hindered by limited info and functionality to detect, mitigate, and prevent session token compromise. I'll demonstrate these new phishing attacks, access to sensitive user data, and lateral movement. Defensive measures against these phishing attacks will be discussed, specifically the challenges in detection, mitigation, and prevention, and the overall lack of support for managing temporary credentials. Open-source tools have been developed and will be used to demonstrate how users can: - self-phish their organizations using these techniques - audit security settings that help prevent/mitigate the attacks REFERENCES: 1.0 Evolving Phishing Attacks 1.1 A Big Catch: Cloud Phishing from Google App Engine and Azure App Service: https://www.netskope.com/blog/a-big-catch-cloud-phishing-from-google-app-engine-and-azure-app-service 1.2 Microsoft Seizes Malicious Domains Used in Mass Office 365 Attacks: https://threatpost.com/microsoft-seizes-domains-office-365-phishing-scam/157261/ 1.3 Phishing Attack Hijacks Office 365 Accounts Using OAuth Apps: https://www.bleepingcomputer.com/news/security/phishing-attack-hijacks-office-365-accounts-using-oauth-apps/ 1.4 Office 365 Phishing Attack Leverages Real-Time Active Directory Validation: https://threatpost.com/office-365-phishing-attack-leverages-real-time-active-directory-validation/159188/ 1.5 Demonstration - Illicit Consent Grant Attack in Azure AD: https://www.nixu.com/blog/demonstration-illicit-consent-grant-attack-azure-ad-office-365 https://securecloud.blog/2018/10/02/demonstration-illicit-consent-grant-attack-in-azure-ad-office-365/ 1.6 Detection and Mitigation of Illicit Consent Grant Attacks in Azure AD: https://www.cloud-architekt.net/detection-and-mitigation-consent-grant-attacks-azuread/ 1.7 HelSec Azure AD write-up: Phishing on Steroids with Azure AD Consent Extractor: https://securecloud.blog/2019/12/17/helsec-azure-ad-write-up-phishing-on-steroids-with-azure-ad-consent-extractor/ 1.8 Pawn Storm Abuses OAuth In Social Engineering Attack: https://www.trendmicro.com/en_us/research/17/d/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks.html 2.0 OAuth Device Code Flow 2.1 OAuth 2.0 RFC: https://tools.ietf.org/html/rfc6749#page-24 2.2 OAuth 2.0 for TV and Limited-Input Device Applications: https://developers.google.com/identity/protocols/oauth2/limited-input-device 2.3 OAuth 2.0 Scopes for Google APIs: https://developers.google.com/identity/protocols/oauth2/scopes 2.2 Introducing a new phishing technique for compomising Office 365 accounts: https://o365blog.com/post/phishing/#oauth-consent 2.3. Office Device Code Phishing: https://gist.github.com/Mr-Un1k0d3r/afef5a80cb72dfeaa78d14465fb0d333 3.0 Additional OAuth Research Areas 3.1 Poor OAuth implementation leaves millions at risk of stolen data: https://searchsecurity.techtarget.com/news/450402565/Poor-OAuth-implementation-leaves-millions-at-risk-of-stolen-data 3.2 How did a full access OAuth token get issued to the Pokémon GO app?: https://searchsecurity.techtarget.com/answer/How-did-a-full-access-OAuth-token-get-issued-to-the-Pokemon-GO-app ===

uk: вхід без авторизації

name: New Phishing Attacks Exploiting OAuth Authentication Flows