uk: Комп'ютерні науки

description: Why research wireless water meters? Because they are a potential security hole in a critical infrastructure, which can lead to a potential leakage of private information, and create the potential to steal water by lowering water bills? It's a technology that's all around us but seems to too mundane to think about. Because a hacker can't resist exploring technology to see how it works and how to break it, because they are there? In this talk the speaker, who managed a small water system for 13 years, will first present an overview of drinking water security, review reported water system security incidents and the state of drinking water security over the past year, and will then take a deep dive into the hardware, software, topology, and vulnerabilities of wireless water meter networks and how to sniff wireless water meter signals. John McNabb, an IT pro for more than 6 years, also served as an elected Water Commissioner for a small New England town for 13 years. John has been actively researching security issues for drinking water systems for many years, and presented talks at DEF CON 18 and Shmoocon 18 on the subject. He has also presented talks on the environmental impacts of IT at The Next Hope and Phreaknic 14. John is a long-time science fiction fan and has been working on a few SF short stories he hopes to submit some day for publication.

uk: вхід без авторизації

name: Vulnerabilities of Wireless Water Meter Networks


Sneaky PDF

Mahmud Ab Rahman

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: Mahmud Ab Rahman - Sneaky PDF Being a most prevalent document exchange format on the Internet, Portable Document Format (PDF) is in danger of becoming the main target for client-side attack. With estimation of more than 1.5 million line of code and loaded with huge functionalities, this powerful document format is suffered with several high impact vulnerabilities, allowing attackers to exploit and use it as malware spreading vector. Until now, there are thousands of malicious PDF file spreads with little chances of getting detected. The challenges are obfuscation techniques used by the attackers to hide their malicious activities, hence minimizing detection rate. In order to sustain the survival of malicious PDF file on the Internet, attackers circumvent the analysis process through diverse obfuscation techniques. Obfuscation methods used usually ranges from PDF syntax obfuscation, PDF filtering mechanism, JavaScript obfuscation, and variant from both methods. Because of rapid changes in methods of obfuscation, most antivirus software as well as security tools failed to detect malicious content inside PDF file, thus increasing the number of victims of malicious PDF mischief. In this paper, we study in the obfuscation techniques used inside in-the-wild malicious PDF, how to make it more stealthy and how we can improve analysis on malicious PDF. Mahmud Ab Rahman currently works as Information Security Specialist for Malaysia Computer Emergency and Response Team (MyCERT) under umbrella of CyberSecurity Malaysia. Prior to that, he worked as an Intrusion Analyst at MyCERT department. His education background comprises of Master Degree in Computer Science from National University of Malaysia in 2006. Prior to that, he obtained a Degree in Computer Science from the same university. Mahmud has been involved in the computer security field for over 5 years. His area of focus and interest is network security, honeynet, botnet monitoring, and malware analysis. He also engages in several large scale penetration-testing exercises and to provide solutions for any vulnerability detected. Moreover, he is recognized for conducting numbers of training for organizations to talk on topics ranging from introduction to advanced security courses. He is a occasional speaker at conferences such as FIRST Technical Colloquium, FIRST Annual Conference, Honeynet Annual Security Conference, Honeynet Project HackInTheBox SIGINT and Infosec.MY He currently holds a GIAC's GPEN, GREM and CISCO's (CCNA,CCNP). On 2010, he wrote a paper on "Getting Owned By Malicious PDF" for GIAC GPEN Gold certification.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

DEF CON

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Комп'ютерні науки

description: In last year, we have given a talk over China-made malware in both Blackhat and DEFCON, which is appreciated by various parties and we would like to continue this effort and discuss over APT attacks in Asia this year. However, case studies are not just our main dish this time, we will carry out technical analysis over the samples. I have worked with 2 Taiwanese researchers and would like to talk about how to automate the APT attack analysis with our analysis engine, Xecure, and give comparison between samples from various Asian countries, giving similarity and difference analysis among them, which could be insightful to the audience. Finally, we will talk about our contribution to the rule and signature to detect APT attack. Anthony Lai (aka Darkfloyd) has worked on code audit, penetration test, crime investigation and threat analysis and acted as security consultant in various MNCs. Anthony has worked with researchers to convey talks about Chinese malware and Internet Censorship in Blackhat 2010 and DEFCON 18. His interest falls on studying exploit, reverse engineering, analyse threat and join CTFs, it would be nice to keep going and boost this China-made security wind in malware analysis and advanced persistent threat areas. He has found VXRL (Valkyrie-X Security Research Group) in Hong Kong and keep themselves to connect to and work with various prominent and respectable hackers and researchers. Benson Wu focuses research on detect and counter advanced persistent threat, code review, secure coding and SDLC process implementation. He graduated from National Taiwan University with PhD in Electrical Engineering and National Chiao-Tung University with MS in Computer Science; and held ECSP, CEI, CSSLP certifications. Currently, he is with Xecure Lab as Lead Security Researcher, and Research Center for Information Technology Innovation, Academia Sinica as Postdoctoral. He had spoken at NIST SATE 2009, DEFCON 18 (with Birdman), OWASP China 2010, BoT (Botnets in Taiwan) 2011, HIT (Hacks in Taiwan) 2011, and wrote the "Web Application Security Guideline" for the Taiwan government since year 2007. Jeremy Chiu (aka Birdman) has more than ten years of experience with host-based security, focusing on kernel technologies for both the Win32 and Linux platforms. In early 2001 he was created Taiwan's first widespread trojan BirdSPY. The court dropped charges after Jeremy committed to allocate part of his future time to assist Taiwan law enforcement in digital forensics and incidence response. Jeremy specializes in rootkit/backdoor design. Jeremy also specializes in reverse engineering and malware analysis, and has been contracted by law enforcements to assist in forensics operations. Jeremy is a sought-after speaker for topics related to security, kernel programming, and object-oriented design; in addition to frequently speaking at security conferences, Jeremy is also a contract trainer for law enforcements, intelligence organizations, and conferences such as DEFCON 18, SySCAN (09 08), Hacks in Taiwan (07 06 05), HTICA(06 08) and OWASP Asia (08 07). In 2005, Jeremy founded X-Solve Inc. and successfully developed forensics and anti-malware products. In July 2007, X-Solve was acquired by Armorize Technologies. In Oct 2010, he left Armorize and created a new research team, Xecure-Lab. Peikan (aka PK) has intensive computer forensic, malware and exploit analysis and reverse engineering experience. He has been the speaker in Syscan and HIT (Hack In Taiwan) and convey various training and workshop for practitioners.

uk: вхід без авторизації

name: Balancing The Pwn Trade Deficit: APT Secrets in Asia


uk: Комп'ютерні науки

description: This presentation discusses the current legal status of evasion of geolocation and the potential liability of the user-evader or provider of an evasion tool. The presentation also projects how the law might develop to treat acts of evasion and what challenges the technical community might face in this area. The legal community has shown an interest in geolocation for several years; however, until recently it did not seriously consider mandating the use of geolocation to comply with national laws and regulations. Recently, there have been indications that governments will turn to geolocation as a viable means of partitioning cyberspace; geolocation tools should help mimic physical borders in cyberspace. The emerging reliance of legal systems on geolocation creates a need to address evasion of geolocation and reevaluate the legality of acts of evasion. So far, no legal disputes concerning evasion have been published; however, the ongoing disputes regarding place-shifting technologies, such as the lawsuits against ivi and Justin.tv in the U.S., TV Catch UP in the U.K., and ManekiTV in Japan, indicate that evasion of geolocation is the next in line for legal attention. The presentation will provide no legal advice but will offer a number of suggestions that should be considered by those who use evasion, are interested in evasion, or are in the process of developing evasion tools. Additionally, it will suggest the types of legal policy issues that are likely to emerge in the near future. Dr. Marketa Trimble is an intellectual property law professor at the William S. Boyd School of Law, University of Nevada, Las Vegas. Her research and teaching on cross-border intellectual property issues have led her to the investigation of various cyberlaw issues, including legal problems in the context of the internet as the primary place for business and daily activities. She holds two doctoral law degrees, one from Stanford University Law School and one from Charles University Law School in Prague, has expertise from working in the European Union and in European governments, and conducts legal research in English, German and Czech, which gives her a unique perspective on legal problems that transcend international borders and involve the legal regimes and policy choices of multiple countries.

uk: вхід без авторизації

name: The Future of Cybertravel: Legal Implications of the Evasion of Geolocation


The Art of Trolling

uk: Комп'ютерні науки

description: Trolling is something that today has a very negative connotation on the Internet and in the common usage of the word outside of it. However, for better or worse trolling has long enjoyed a close relationship with hacking be it in the area of information security, or simply in technology development. I intend to delve into the definition of a troll, the history of trolling in human culture ( as well as its contributions ), and the techniques that are generally exploited by trolls to realize their intended goals. There will be several past projects that I classify as successful trolls that I will use as object lessons in the practical application of the discussed techniques. Trolls span the gaps between hardware and software projects and at times can carry a variety of "payloads". Matt 'openfly' Joyce is pretty well known in some circles for having amassed a rather staggeringly large number of klines, olines, ilines, and glines in his many years on irc. In addition to IRC bans, he has been firewalled from Fark, physically barred from attending the HOPE conference, and once introduced in a videocasted Unreal 2004 competitive gaming tournament as "the guy that has been banned from just about every server and forum known to the internet". In addition to this staggering list of anti-accomplishments, Matt has been an invited member of NYC Resistor, a Maker, and an all around great person whom many ladies would love to share their special lady parts with. He also works on open source federal cloud platforms, fonera2.0n images for the ChaosVPN project and occasionally spends time in the company of puppies. In his free time, Matt loves drinking single malt scotch while discussing the markets of the orient, from the confines of exclusive gentlemen's clubs. This talk is dedicated to the memory of Macho Man Randy Savage and Ronald Reagan. @openfly

uk: вхід без авторизації


uk: Комп'ютерні науки

description: The best techniques for exploitation, maintaining access, and owning in general move down the stack, using low-level code to bypass security controls. Take the preboot execution environment and get bios-level access to the hardware from across the network, outside any control of the on-disk operating system. In this presentation I will detail the pxesploit attack I wrote, releasing a new metasploit-based comprehensive PXE attack toolkit to deliver any payload reliably to many different operating systems. Also new will be the ability to host a PXE attack through a meterpreter session in memory, using it to escalating privileges and own remote networks. Matt Weeks has performed research in mathematics in chaos and cryptology, and focuses on information security. He enjoys finding ways to break application security, writing shellcode, and creating post-exploitation techniques. Also known as scriptjunkie, he is a developer for the Metasploit framework, wrote the sessionthief MITM tool, and broke a cryptosystem based on chaos theory.

uk: вхід без авторизації

name: Network Nightmare: Ruling the nightlife between shutdown and boot with pxesploit


DCFluX in: License to Transmit

uk: Комп'ютерні науки

description: When cell phones, land lines and the internet break down in a disaster, Amateur radio is there. Considered to be one of the earliest forms of Hacking, this talk will take a look at some of the things that can be done if you are a licensed amateur radio operator. Matt Krick "DCFluX" is Chief Engineer of New West Broadcasting Systems, Inc., Operators of broadcast stations KGMN-FM, KZKE-FM, KYET-AM and KKAX-LP. He has worked in the field of broadcasting since 1998, specializing in all aspects of broadcast engineering, video editing and electronics.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: There is no explicit right to privacy in the Constitution, but some aspects of privacy are protected by the First, Third, Fourth and Fifth Amendments. This presentation will discuss the historical development of the right to privacy, and in particular, the development of the Fourth Amendment; and then compares this historical development to the current digital age. The development of the right to privacy (especially given the historical context of the Fourth Amendment) to our current age requires us to deal with technologically invasive personal searches as airports, searches and seizures of laptops and other computing devices, and how to handle stored communications. It becomes evident very quickly that searches and seizures are not so clear when it comes to bits and bytes...so where do we go from here? Michael Schearer ("theprez98") is the author of the "Assault on Privacy" blog, which focuses on governmental intrusions into privacy rights. He also hosts monthly "Flex Your Rights' nights at Unallocated Space, a central Maryland hackerspace. Michael is a government contractor who spent nearly nine years in the United States Navy as an EA-6B Prowler Electronic Countermeasures Officer. His military experience includes aerial combat missions over both Afghanistan and Iraq and nine months on the ground doing counter-IED work with the U.S. Army. He is a graduate of Georgetown University's National Security Studies Program and a speaker at ShmooCon, DEFCON, HOPE, and other conferences. Michael is a licensed amateur radio operator and an active member of the Church of WiFi. He lives in Maryland with his wife and four children

uk: вхід без авторизації

name: WTF Happened to the Constitution?!: The Right to Privacy in the Digital Age


Whose time is it anyway?

uk: Комп'ютерні науки

description: Michael Robinson - What Time Are You Anyway? https://www.defcon.org/images/defcon-19/dc-19-presentations/Robinson/DEFCON-19-Robinson-Time.pdf Computer forensic examiners rely heavily on timestamps during investigations. Timeline analysis is a critical technique in determining what happened and when. In 2005, timestomp.exe was released and this gave non-observant investigators a run for their money. Unfortunately, there are some gaps in what timestomp.exe will do. Observant investigators can identify timestomping and recover from that activity. Good timestomping requires knowing what time values need to get trashed, where these times are stored, AND what supporting artifacts need to be altered. This presentation examines several file systems and operating systems and identifies what needs to be tweaked in order to effectively hide one's tracks. Michael Robinson has over 15 years of computer security experience and is currently a computer forensic examiner in the Washington, DC area, where he deals with e-discovery and intrusion analysis. For over four years he ran IT and IA operations for a Department of Defense agency. He teaches computer forensics at the graduate level at Stevenson University in Maryland. He earned two masters degrees - one in computer forensics and one in information security.

uk: вхід без авторизації


Wie bilden sich Wasserwirbel?

de: Physik, Astronomie

fi: fysiikka, tähtitiede

uk: Фізика, Астрономія

en: Physics, Astronomy

fr: Physique, Astronomie

da: Fysik, Astronomi

es: Física, Astronomía

nl: Natuurkunde, Astronomie

de: Mathematik, Naturwissenschaften

uk: Математика, природничі науки

en: Mathematics, Natural Sciences

@language: de

uk: вхід без авторизації

name: Moderation Skorupka, Sascha (Leitung, Regie, Redaktion)

Leibniz Universität Hannover (LUH)

addressCountry: DE

addressLocality: Hanover

addressRegion: Lower Saxony


Build Your Own Radar System

uk: Комп'ютерні науки

description: Radar is used extensively by the military, police, weather, air travel, and maritime industries - why not you? Come learn how to build a radar imaging system on the cheap! This talk will explain the basics of how radar works as well as how to measure range and velocity of your chosen targets. You will learn how to use synthetic aperture techniques to generate a two- or even three-dimensional image. The hardware and software design will be totally opened up so you can go home and build your own system. The talk will try to run through the basics pretty fast, so some knowledge of electronics or basic physics might help, but is not required! Regardless of your background, you will see the capabilities of a modern home-built radar system and hopefully get some ideas for your own uses. Michael Scarito is a multidisciplinary hacker masquerading as an electrical engineer. Interests include physical and cyber security, surveillance systems, innovative uses for radio frequency electronics, and projects which incorporate all of the above.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: A university with no prior CTF experience and no students with significant prior information security experience may find competition a daunting task. Most competitions require a large amount of technical knowledge to set up, along with a fair amount of organization. But how are students with no information security knowledge going to compete in CTF competitions and keep from getting completely owned? Well, the answer is, they're not. The most important step to successful competition is educating oneself. In this presentation, we describe our efforts as a team of undergraduate students interested in creating our school's cyber defense organization and beginning to participate in CTF competitions. We introduce the methodologies that we used (and continue to use) in order to start educating and motivating bright students about information security and keep them interested. We will use our personal experience and proven successful tactics to outline the necessary steps to take and to expose the commonly overlooked necessities of starting a cyber defense organization, regardless of if you are a student interested in information security, an advisor looking to motivate students, an alumnus looking to share your passion for information security, etc. Information security education must continue outside the classroom. Although the demand for information security knowledge is high, the requirements are rigid. While the industry is growing very rapidly, students who do not show passion and dedication to the field, and deep practical knowledge will be quickly left behind. We aim to leave you armed and ready to compete with and learn from some of the best and brightest information security students in the world. Mike Arpaia is a Junior in the CyberSecurity program at Stevens Institute of Technology and is a co-founder of the Stevens Cyber Defense Team. Mike works as a Security Consultant/Penetration Tester Intern at Gotham Digital Science LLC. His primary interests are in web application security and exploitation. Ted Reed was a student interested in cyber-security. Now he likes model planes and simulation.

uk: вхід без авторизації

name: Beat to 1337: How to create a successful university cyber defense organization


uk: Комп'ютерні науки

description: It's 2011, so this year it's going to be 25 years since Brain.A, the first PC virus, Join Mikko Hypponen as he talks about the history and evolution of computer viruses. From Brain to Stuxnet, he's spent his career tracking malware and will give a pretty good rundown on what has happened, when and why it mattered. Mikko Hypponen is based in Helsinki, Finland. He has been analysing computer viruses for more than 20 years. He has written on his research for magazines such as Scientific American. According to information leaked by Wikileaks, the US Government has classified Mr. Hypponen as an infosec ROCK STAR (true story). He doesn't often speak publicly, but when he does, it's in venues like TED or Rubicon Detroit - or DEF CON. He's also the oldest child genius on the planet. And every time he swims, dolfins appear. Apart from computer security issues, Mr. Hypponen enjoys collecting and restoring classic arcade video games and pinball machines from past decades.

uk: вхід без авторизації

name: The History and Evolution of Computer Viruses


Abusing HTML5

uk: Комп'ютерні науки

description: The spike of i(Phone, Pod Touch, Pad), Android, and other mobile devices that do not support Flash has spurred the growth and interest in HTML5, even though the standard is still evolving. The power of HTML5 allows developers to create almost full-fledged web applications, not just structured content. HTML5's new features has increased the attack surface. It has been demonstrated that the HTML5 offline application cache can be abused. In addition, the support for client-side storage will open up the opportunity for SQL injection attack on client machines. There has been chatter regarding the new attack opportunities that the audio, video, and canvas tags will present, considering they require JavaScript and image-related functions such as SVG. This presentation will demonstrate the issues of HTML5 and how they can be abused and mitigated with good-old techniques. This presentation will also delve into the writing malicious web pages with web workers, abusing cross-origin JavaScript requests, how not to do cross-document messaging, and abusing geolocation. Ming Chow is a Lecturer at the Tufts University Department of Computer Science. His areas of interests are computer security, game development, web application security, and Computer Science in Education. He was also a web application developer for ten years at Harvard University for University Operations Services. Ming co-edited a special issue of IEEE Security & Privacy on securing online games with Gary McGraw of Cigital, Inc. published in May 2009. Ming is a frequent guest speaker and have spoke at numerous organizations, including the New England Chapter of the High Technology Crime Investigation Association (HTCIA-NE), the Greater Boston Chapter of the Association of Certified Fraud Examiners (ACFE), the Massachusetts Office of the Attorney General (AGO), and OWASP. Ming mentored a team of students from Tufts to the Microsoft Imagine Cup Game Design Competition US Finals in 2010. Finally, Ming is a SANS GIAC Certified Incident Handler (GCIH).

uk: вхід без авторизації


uk: Комп'ютерні науки

description: "Good programmers write code, great programmers reuse" is one of the most well known truisms of software development. But what does that mean for security? For over 30 years software engineering has focused on writing the perfect code and reusing it as often as they can, believing if they can just get the bugs out, the system will be secure. In our talk we will demonstrate how the most prominent doctrine of programming is deadly for security. Analysis of software vulnerability data, including a full decade of data for several versions of the most popular operating systems, server applications and user applications (both open and closed source), shows that properties extrinsic to the software play a much greater role in the rate of vulnerability discovery than do intrinsic properties such as the actual software quality. We show that (at least in the first phase of a product's existence), software vulnerabilities have different properties from software defects. Our analysis of attacker tools and popular exploits shows that the attacker's learning curve determines when and which particular products are likely to be attacked. Improvements in those tools affect the frequency of attack, and the ultimate result is point-and-click usability. We will present several examples from both the defender and the attacker perspective illustrating how dangerous familiarity is for security. We will demonstrate that the more familiar an attacker is with your product, the more likely you are to be attacked and the more likely an attacker will succeed. Sandy Clark (Mouse) has been taking things apart since the age of two, and still hasn't learned to put them back together. An active member of the Hacker community, her professional work includes an Air Force Flight Control Computer, a simulator for NASA and singing at Carnegie Hall. She is currently fulfilling achildhood dream, pursuing a Ph.D. in Computer Systems and Security at the University of Pennsylvania. Her research explores the vulnerability lifecycle, human scale security and the unexpected ways that systems interact. A founding member of Toool-USA, she also enjoys puzzles, toys, Mao (the card game), and anything that involves night vision goggles. Brad Haines (RenderMan) is a Whitehat by trade, Blackhat by fashion. A very visible and well known member of the wardriving and hacker community, he does whatever he can to learn how things work, how to make them better and to teach people the same. A firm believer in the hacker ethic of openess , sharing, and collaboration. Never afraid to try something new, he can usually be found taking unnessecary risks for the sake of the experience. Author of several computer security books and a frequent presenter at hacker, security and privacy conferences, he can usually be found investigating something interesting, scanning the air for any WiFi data, and trying to find new and interesting beers.

uk: вхід без авторизації

name: Familiarity Breeds Contempt: The Honeymoon Effect and the Role of Legacy Code in Zero-Day Vulnerabilities


uk: Комп'ютерні науки

description: In the early 90's, at the dawn of the World Wide Web, some engineers at Netscape developed a protocol for making secure HTTP requests, and what they came up with was called SSL. Given the relatively scarce body of knowledge concerning secure protocols at the time, as well the intense pressure that everyone at Netscape was working under, their efforts can only be seen as incredibly heroic. But while it's amazing that SSL has endured for as long as it has, some parts of it -- particularly those concerning Certificate Authorities -- have always caused some friction, and have recently started to cause real problems. This talk will examine authenticity within SSL, shed new light on the current problems, and cover some new strategies for how to move forward.

uk: вхід без авторизації

name: SSL And The Future Of Authenticity: Moving beyond Certificate Authorities


uk: Комп'ютерні науки

description: KVM, the Linux Kernel Virtual Machine, seems destined to become the dominant open-source virtualization solution on Linux. Virtually every major Linux distribution has adopted it as their standard virtualization technology for the future. And yet, to date, remarkably little work has been done on exploiting vulnerabilities to break out of KVM. We're here to fix that. We'll take a high-level look at KVM's architecture, comparing and contrasting with other virtualization systems and describing attack surfaces and possible weaknesses. Using the development of a fully-functioning exploit for a recent KVM vulnerability, we'll describe some of the difficulties involved with breaking out of a VM, as well as some features of KVM that are helpful to an exploit author. Once we've explored the exploit in detail, we'll finish off with a demonstration against a live KVM instance. Nelson Elhage is a kernel hacker for Ksplice, Inc., where he works on providing rebootless security updates for the Linux kernel. In his spare time, he mines for bugs in the Linux kernel and other pieces of open-source systems software.

uk: вхід без авторизації

name: Virtunoid: Breaking out of KVM (Kernel Virtual Machine)


uk: Комп'ютерні науки

description: Well There's malware on the interwebs. They're pwning all your systems, snatching your data up. So hide your cards, hide your docs, and hide your phone, 'cause they're pwning er'body out there! This may be the 3rd and final installment of the Malware Freak Show series, so we're pulling out all the stops. This year we'll highlight 4 new pieces of malware but the victims are you and the people you know. We will analyze and demo malware found in your place of employment, your watering hole, your friendly neighborhood grocer, and finally your mobile phone. The malware we are going to demo are very advanced pieces of software written by very skilled developers that are target your world's data. The complexity in their propagation, control channels, anti-forensic techniques and data exporting properties will be very interesting to anyone interested in this topic. Nicholas J. Percoco Senior Vice President and Head of SpiderLabs at Trustwave With more than 14 years of information security experience, Percoco is the lead security advisor to many of Trustwave?s premier clients and assists them in making strategic decisions around security compliance regimes. He leads the SpiderLabs team that has performed more than 1000 computer incident response and forensic investigations globally, run thousands of penetration and application security tests for clients, and conducted security research to improve Trustwave's products. Percoco and his research has been featured by many news organizations including: The Washington Post, eWeek, PC World, CNET, Wired, Hakin9, Network World, Dark Reading, Fox News, USA Today, Forbes, Computerworld, CSO Magazine, CNN, The Times of London, NPR and The Wall Street Journal. Jibran Ilyas is a Senior Forensic Investigator at Trustwave's SpiderLabs. He is a member of Trustwave's SpiderLabs - the advanced security team focused on penetration testing, incident response, and application security. He has investigated some of nation?s largest data breaches and is a regular contributor for published security alerts through his research. Jibran and his research has been featured by many news organizations including Dark Reading, Infoworld, Threatpost, IT World and SearchSecurity. He has 87 years of experience and has done security research in the area of computer memory artifacts. Jibran has presented talks at security conferences (DEF CON, Black Hat, SecTor, SOURCE Barcelona) in the area of Computer Forensics and Cyber Crime. Jibran is also a regular guest lecturer at DePaul and Northwestern University. Prior to joining SpiderLabs, Jibran was part of Trustwave's SOC where he helped Fortune 500 clients with their Security Architectures. and deployments. Jibran holds a Bachelors of Science degree from DepPaul University and Masters degree in Information Technology Management from Northwestern University.

uk: вхід без авторизації

name: Malware Freak Show 3: They're pwning er'bodey out there!


Getting SSLizzard

uk: Комп'ютерні науки

description: The world has seen a seismic shift from browser-based web applications to GUI-rich semi-thick client applications running on handheld mobile devices. In the browser world, the industry had placed a great deal of time and energy towards providing users visual cues to indicate the level security and trust that their data being transmitted to the remote server is protected and not falling into the hands of unintended recipients. In the mobile device world, these visual cues are mostly nonexistent, resulting in the inherent trust that the underlying APIs are ensuring a level of security before transmitting a users sensitive data. In our research, we tested the most popular apps on both the iOS and Android platforms. We ran each app through a data transmission assault course that contained various historic, contemporary, and obscure SSL attacks and documented the results. In this presentation, we will discuss and demonstrate flaws at both the application an OS layer that need to be addressed by both the mobile app developers and well the mobile device manufactures. A utility called "SSLizzard" will also be released for use by mobile application developers to test their mobile apps and their behavior against SSL-based attacks discussed in this talk. Nicholas J. Percoco: With more than 14 years of information security experience, Percoco is the lead security advisor to many of Trustwaveps premier clients and assists them in making strategic decisions around security compliance regimes. He leads the SpiderLabs team that has performed more than 1000 computer incident response and forensic investigations globally, run thousands of penetration and application security tests for clients, and conducted security research to improve Trustwave's products. Percoco and his research has been featured by many news organizations including: The Washington Post, eWeek, PC World, CNET, Wired, Hakin9, Network World, Dark Reading, Fox News, USA Today, Forbes, Computerworld, CSO Magazine, CNN, The Times of London, NPR and The Wall Street Journal. Paul Kehrer is a web developer and programmer at Trustwave with extensive experience with X.509 and PKI, including writing and maintaining a registration authority. Since 2007, Paul has lead the team responsible for the design and infrastructure of Trustwave's Certification Authority. Paul enjoys baking cakes in his spare time.

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Steal Everything, Kill Everyone, Cause Total Financial Ruin!


uk: Комп'ютерні науки

description: The presentation will first take a step back and offer a basic reminder of what passive fingerprinting is and, more precisely, DHCP fingerprinting. Then we will offer defensive and offensive use cases for DHCP fingerprinting. Next, we will cover the goals and resources offered by the new project and some future plans. As part of the announcement, two large fingerprint databases will be made available (both of which were bundled in separate projects: PacketFence and Satori). We hope this new resource will increase the quality and breadth of current DHCP fingerprint databases and increase adoption for this reliable fingerprinting technique. Olivier Bilodeau is a System Architect at Inverse developing PacketFence an open source Network Access Control (NAC) software. He also lectures on system security at ...cole de technologie superieure University (ETS) in Montreal, Canada. His past experiences made him travel into dusty Unix server rooms, obfuscated perl code and expensive enterprise networks. On his free time he enjoys several CTFs a year (with the CISSP Groupies and Amish Security teams), hacking perl, doing open source development and brewing beer.

uk: вхід без авторизації

name: FingerBank - Open DHCP fingerprints database: no it's not about a bank of fingers...


uk: Комп'ютерні науки

description: Ever heard of PacketFence? It's a free and open source Network Access Control (NAC) software that's been out there since 2005. In the last two years we had several major releases with important new features that makes it an even more compelling solution. Trying to appeal to both attackers and defenders, this presentation will cover all of our NAC's secret sauce : Wired / Wireless RADIUS MAC authentication / 802.1X, port-security through SNMP, captive portal redirection techniques, hardware support procedure, voice over IP, FreeRADIUS, Snort and Nessus integration, and quarantine / remediation features. We will continue with the advantages of Open Source when dealing with a NAC. Then we will focus on the last two years of the project, the problems, the missteps and the good, new and shiny stuff. This will include learning about some 802.1X problems, complaining about other vendor's code, looking at our own problems and salivating on some of the technical prowess we recently achieved. Finally we will expose our World Domination Roadmap covering both short-term improvements and potential research projects (and we will beg for help to achieve it). Hopefully this talk will demystify NACs by explaining in details how our implementation works, give yet another example of why open source rocks and convince those who haven't jumped on the NAC band-wagon to give the free one a try. Olivier Bilodeau is a System Architect at Inverse developing PacketFence an open source Network Access Control (NAC) software. He also lectures on system security at ...cole de technologie superieure University (ETS) in Montreal, Canada. His past experiences made him travel into dusty Unix server rooms, obfuscated perl code and expensive enterprise networks. On his free time he enjoys several CTFs a year (with the CISSP Groupies and Amish Security teams), hacking perl, doing open source development and brewing beer.

uk: вхід без авторизації

name: PacketFence, the Open Source Nac: What we've done in the last two years: Salivating on NAC secret sauce


uk: Комп'ютерні науки

description: Get the latest information about how the law is racing to catch up with technological change from staffers at the Electronic Frontier Foundation, the nation's premiere digital civil liberties group fighting for freedom and privacy in the computer age. This session will include updates on current EFF issues such as surveillance online and fighting efforts to use intellectual property claims to shut down free speech and halt innovation, discussion of our technology project to protect privacy and speech online, updates on cases and legislation affecting security research, and much more. Half the session will be given over to question-and-answer, so it's your chance to ask EFF questions about the law and technology issues that are important to you.

uk: вхід без авторизації

name: Ask EFF: The Year in Digital Civil Liberties


uk: Комп'ютерні науки

description: Panel - DEF CON Comedy Jam IV, A New Hope For The Fail Whale We're baaaaaack! The most talked about panel at DEF CON! Nearly two hours of non-stop FAIL. Come hear some of the loudest mouths in the industry talk about the epic security failures of the last year. We'll be covering mobile phones, cloud, money laundering and food cooked on stage to name just a few topics. Nothing is sacred not even each other. Come for the FAIL stay for the crepes! David Mortman runs Operations and Security for C3, LLC and is a Contributing Analyst at Securosis. Formerly the Chief Information Security Officer for Siebel Systems, Inc., Previously, Mr. Mortman was Manager of IT Security at Network Associates. Mr. Mortman has also been a regular panelist and speaker at RSA, Blackhat, DEF CON and Source Boston as well. Mr. Mortman sits on a variety of advisory boards including Qualys. He holds a BS in Chemistry from the University of Chicago. David writes for Securosis, Emergent Chaos and the New School blogs. David was an editor for the 2nd Ed of the Cloud Security Alliance Guidance. Twitter: @mortman Rich Mogull Swim. Bike. Run. Kick. Punch. Code. Write. Mr. Graham learned hacking as a toddler from his grandfather, a WW-II codebreaker. His first IDS was written more than 10 years ago designed to catch Morris-worm copycats. He is the author of several pending patents in the IDS field. He is the author of well-regarded security-related documents and is a frequent speaker at conferences. Prior to founding Errata Security he co-founded, was the CTO, and chief-architect at Network ICE (now owned by ISS-IBM)

uk: вхід без авторизації


Former Keynotes - The Future

uk: Комп'ютерні науки

description: Dark Tangent, Rod Beckstrom, Jerry Dixon, Tony Sager, Linton Wells II - Former Keynotes - The Future Former keynotes keep coming back to DEFCON. Join The Dark Tangent, Rod Beckstrom, Jerry Dixon, Tony Sager, and Linton Wells to discuss the future of cyber security.

uk: вхід без авторизації


Is it 0-day or 0-care?

uk: Комп'ютерні науки

description: Vulnerability Databases (VDBs) have provided information about security vulnerabilities for over 10 years. This has put VDBs in a unique position to understand and analyze vulnerability trends and changes in the security industry. This panel presentation will examine vulnerability information over the past several years with an emphasis on understanding security researchers, quality of research, vendors, disclosure trends and the value of security vulnerabilities. The emotional debate surrounding Full Disclosure has raged on for decades. This panel will use grounded data to discuss salient points of the debate to hopefully determine trends that may influence the debate. Maybe even in a positive fashion!

uk: вхід без авторизації


Network Security Podcast

uk: Комп'ютерні науки

description: Extra A special meeting of network security podcasters, lead by Rich Mogull.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: https://www.defcon.org/images/defcon-19/dc-19-presentations/PCI-PANEL/DEFCON-19-JackDaniel-PCI-2-PANEL.pdf Building on last year's panel discussion of PCI and its impact on the world of infosec, we are back for more- including "actionable" information. Having framed the debates in the initial panel, this year we will focus on what works, what doesn't, and what we can do about it. Compliance issues in general, and PCI-DSS in particular, are driving security in many organizations. In tight financial times, limited security resources are often exhausted on the "mandatory" (compliance) at the expense of the "optional" (actual security). We will focus on the information needed to reconcile these issues, and encourage the audience to continue the discussion with us. Jack Daniel is old, and has a Unix Beard, so people mistakenly assume he knows stuff. He still makes no attempt to correct this gross misunderstanding. Jack has proven himself to be an inciteful moderator on compliance topics. He has many years of network and systems administration experience, and a bunch of letters after his name. Jack lives and breathes network security as Product Manager for Tenable. James Arlen , CISA, sometimes known as Myrcurial is a cyber-security cyber-consultant usually found in tall buildings wearing a cyber-suit, founder of the Think|Haus hackerspace, columnist at Liquidmatrix Security Digest, Infosec Geek, Hacker, Social Activist, Author, Speaker and Parent. He's been at this security game for more than 15 years and loves blinky lights and shiny things. Cyber. Joshua Corman is the Research Director for Enterprise Security at The 451 Group and founder of RuggedSoftware.org. A passionate advocate for the security practitioner, he is known for his candor, intellectual honesty, and willingness to challenge the status quo - tackling topics like his 7 Dirty Secrets of the Security Industry and Is PCI the No Child Left Behind Act for Security? Alex Hutton likes risk, critical thinking, and data. He writes for newschoolsecurity.com dub cloud.com, and Verizon's security blog. Martin McKeay is the host and author of the Network Security Blog and Podcast. He is a well known expert in the field of PCI and has worked as a QSA for over four years; he's seen the security compliance can encourage, as well as the lengths people will go to in order to avoid implementing real security. He is an advocate for PCI and compliance while recognizing it's limitation, a dichotomy that sometimes threatens his sanity. Dave Shackleford is a SANS Analyst, instructor and GIAC technical director. He has consulted with hundreds of organizations in the areas of regulatory compliance, security, and network architecture and engineering. He's worked as CSO for Configuresoft, CTO for the Center for Internet Security, and has also worked as a security architect, analyst, and manager for several Fortune 500 companies.

uk: вхід без авторизації

name: PCI 2.0: Still Compromising Controls and Compromising Security


uk: Комп'ютерні науки

description: Fabricating, circumventing, forging, partying, milling, crafting, building breaking - Defcon Groups have risen, fallen, and endured the last 8 years as decentralized and smoldering embers of the local hacker think-tank. This year Defcon sets out to stoke that fire and unite our groups, at and outside of the conference. The talk will consist of a panel of Defcon Groups leaders, uncovering the secrets and follies of several groups: what makes them work, when do they fail, and ultimately .. WTF have these people been doing all this time? Come hear how hackerspaces have influenced these local groups and the cool ways that these groups are propping the hackerspace. What can you break? Anch (DC503) - currently rebooting DC503 after it's near death experience, is a part of the unique hacking scene that is Portland. blakdayz (DC225) - can pwn sh1t from space, master of a harem, original gangster @ Defcon Voicebridge Anarchy Angel & ngharo (DC414) - Brew city nerds coming together under the dc414 flag to hack the planet Itzik Kotler (DC9723) - is killing time till the feds arrive. Meanwhile, he is the CTO of Security Art and co-founder of DC9723. In his former life, he was a Software Engineer. People change. Now, I'm a lamp. Jake "GenericSuperhero" - Representing Black Lodge Research. Hardware, Software, Wetware, Anywhere, Everywhere. converge DCG Coordinator, hermit champion of email harassment and slayer of dead hacker groups; you'll probably see his beard wandering the Defcon landscape in search of booze and fun

uk: вхід без авторизації

name: Represent! Defcon Groups, Hackerspaces, and You.


uk: Комп'ютерні науки

description: On Christmas Eve, a call was made from a prison warden: all of the cells on death row popped open. Many prisons and jails use SCADA systems with PLCs to open and close doors. Not sure why or if it would happen, the warden called physical security design engineer, John Strauchs, to investigate. As a result of their Stuxnet research, Rad and Newman have discovered significant vulnerabilities in PLCs used in correctional facilities by being able to remotely flip the switches to "open" or "locked closed" on cell doors and gates. Using original and publicly available exploits along with evaluating vulnerabilities in electronic and physical security designs, this talk will evaluate and demo SCADA systems and PLC vulnerabilities in correctional and government secured facilities while recommending solutions. John J. Strauchs, M.A., C.P.P., conducted the security engineering or consulting for more than 114 justice design (police, courts, and corrections) projects in his career, which included 14 federal prisons, 23 state prisons, and 27 city or county jails. He owned and operated a professional engineering firm, Systech Group, Inc., for 23 years and is President of Strauchs, LLC. He was an equity principal in charge of security engineering for Gage-Babcock & Associates and an operations officer with the U.S. Central Intelligence Agency (CIA). His company and work was an inspiration for the 1993 movie, "Sneakers" for which he was the Technical Advisor. He was a presenter at Hackers On Planet Earth (HOPE) in 2008 and DojoCon in 2010 and is a consultant for Recursion Ventures. Tiffany Strauchs Rad, BS, MBA, JD, is the President of ELCnetworks, LLC., a technology development, law and business consulting firm with offices in Portland, Maine and Washington, D.C. Her consulting projects have included business and technology development for start-ups and security consulting for U.S. government agencies. She is also a part-time Adjunct Professor in the computer science department at the University of Southern Maine teaching computer law, ethics and information security. Her academic background includes studies at Carnegie Mellon University, Oxford University, and Tsinghua University (Beijing, China). She has presented at Black Hat USA, Black Hat Abu Dhabi, Defcon 17 & 18, SecTor, Hackers on Planet Earth, Chaos Communication Congress and regional information security conferences. Tiffany also researches car computers and is fond of virus research (both biological and digital). Teague Newman is an independent information security consultant based in the Washington, D.C. area with extensive penetration testing experience. In 2009, he competed in the Netwars segment of the US Cyber Challenge and ranked within the Top 10 in the US in all rounds in which he participated. He is also an instructor for Core Security Technologies and has instructed professionals on the topics of information security and penetration testing at places like NASA, DHS, US Army, US Marine Corps (Red Team), DOE, various nuclear facilities as well as for large corporate enterprises. His projects include GPU-based password auditing and liquid nitrogen overclocking. Dora The SCADA Explorer: Exploit writer.

uk: вхід без авторизації

name: SCADA & PLCs in Correctional Facilities: The Nightmare Before Christmas


uk: Комп'ютерні науки

description: Last year, we presented a talk on the implication of malware and rootkits on mobile devices. We focused on the kernel layer of the Android OS stack. With the proliferation of Apps of every size, shape and color being published this year, we focused solely upon the User Interface (UI) of the Android OS. The results of our research yielded a very dangerous flaw that is likely going to require a UI overhaul of the Android OS. Our talk will demonstrate a technique using legitimate and documented APIs to steal credentials and other user information from the most popular Apps in the Android Market. We will demo this technique live and provide a technical walkthrough of the specific methods being used. At the conclusion of our talk, we'll release a Proof of Concept (PoC) built to demo this technique. Nicholas J. Percoco Senior Vice President and Head of SpiderLabs at Trustwave With more than 14 years of information security experience, Percoco is the lead security advisor to many of Trustwaveps premier clients and assists them in making strategic decisions around security compliance regimes. He leads the SpiderLabs team that has performed more than 1000 computer incident response and forensic investigations globally, run thousands of penetration and application security tests for clients, and conducted security research to improve Trustwave's products. Percoco and his research has been featured by many news organizations including: The Washington Post, eWeek, PC World, CNET, Wired, Hakin9, Network World, Dark Reading, Fox News, USA Today, Forbes, Computerworld, CSO Magazine, CNN, The Times of London, NPR and The Wall Street Journal. Twitter: c7five Sean Schulte Software Engineer, Trustwave Sean is an engineer at Trustwave who works primarily with Java and Ruby. He is responsible for building external APIs such as the SSL reseller API, and internal APIs including a Google Safe Browsing blacklist along with the infrastructure to support various SSL services. In his spare time he maintains an unpopular, but feisty, baseball blog. Twitter: sirsean

uk: вхід без авторизації

name: This is REALLY not the Droid you're looking for...


uk: Комп'ютерні науки

description: It can be scary to think about how little of the modern attack surface many tools cover. There is no one best tool for the job and on top of that some tools don't do a great job at anything. Often in the hands of general users the capabilities and limitations are not even thought of during testing. Point, click, done. The attack surface of modern web environments as well as their protection mechanisms have become more complicated and yet many tools have not adapted. Hey, Y2K called and it wants some applications tested. There is certainly no shortage of vulnerabilities in modern web environments but we should be looking beyond low hanging fruit at this point. In between fully automated scanners and manual testing lies a sweet spot for the identification of vulnerabilities. Some of the juiciest pieces of information are not found by vulnerability scanners but are found by humans creating custom tests. This is why semi-automated testing space is so important. All of this complicated blending of protection mechanisms, services, and RIA technologies means that moving in to the area of semi-automated testing can be fraught with failure. We detail how these failures can be avoided as well as provide a tool that solves some of these problems as well as provides analysis for your own tools and scripts. Your web applications have moved on, don't you think it's time your tools to do the same? Nathan Hamiel is a Principal Consultant for FishNet Security's Application Security Practice. He is also an Associate Professor of Software Engineering at the University of Advancing Technology. He spends most of his time focusing in the areas of application, Web 2.0, and enterprise security. Nathan has been a speaker at security events around the world including: Black Hat, DefCon, ShmooCon, ToorCon, SecTor, OWASP and many others. He is also a developer of several open source security projects including the pywebfuzz and RAFT. Gregory Fleischer is a Senior Security Consultant in the Application Security practice at FishNet Security. In his spare time, he likes to find and exploit vulnerabilities in web browsers and client-side technologies such as Java and Flash. He has an interest in privacy and anonymity and has worked with The Tor Project to identify potential issues. Justin Engler is a Security Consultant for FishNet Security's Application Security practice. His focus is on the security of web applications, web-backed thick clients (desktop and mobile), databases, and industrial control systems. Justin is currently working on the open source RAFT project. Seth Law Seth Law is a Principal Consultant for FishNet Security in Application Security. He spends the majority of his time breaking web and mobile applications, but has been known to code when the need arises. Seth is currently involved in multiple open source projects, including RAFT. Twitter: @sethlaw

uk: вхід без авторизації

name: Smartfuzzing The Web: Carpe Vestra Foramina


Net Neutrality Panel

uk: Комп'ютерні науки

description: Over the last five years, network neutrality has moved from an abstract buzzword to FCC-enacted policy. Supporters and detractors both contend that their opponents position means "the end of the Internet as we know it!" This panel discussion will present a reasoned discussion of the issue from multiple viewpoints. Among the issues to answer: What is network neutrality and can we even agree on a definition? Does the FCC have the authority to enact net neutrality rules? What is the role of Congress in net neutrality? Lastly, what are the future implications for the Internet? This panel discussion will cover the basics of net neutrality, the role of Congress and the FCC in regulating the Internet, and the future legal and policy implications of the FCC's neutrality rules. Is the future of the Internet really at risk?

uk: вхід без авторизації


Whoever Fights Monsters?

uk: Комп'ютерні науки

description: Paul Roberts, Aaron Barr, Joshua Corman and Jericho - "Whoever Fights Monsters..." Aaron Barr, Anonymous, and Ourselves "Whoever fights monsters should see to it that in the process he does not become a monster." - Friedrich Nietzsche. Aaron Barr returns for the first time in what's sure to be a gritty and frank (and heated) panel. How can we conduct ourselves without losing ourselves? How far is too far - or not far enough? IT security has finally gotten the attention of the mainstream media, Pentagon generals and public policy authors in the Beltway, and is now in mortal danger of losing (the rest of) its soul. We've convinced the world that the threat is real - omnipresent and omnipotent. But recent events suggest that in their efforts to combat a faceless enemy, IT security firms and their employees risk becoming indistinguishable from the folks with the Black Hats. The Anonymous attacks and data spilled from both private- and public sector firms raise important questions that this panel will try to answer. among them: how to respond to chaotic actors like Anonymous and LulzSec, what the U.S. gains (and loses) by making "APTs" the new "Commies" and cyber the forefront of the next Cold War and APTs the new commies. Aaron, Josh and Jericho will debate whether we in the security community can fight our "monsters" without sacrificing the civil liberties and the freedoms we enjoy here at home. Full bios and descriptions available here: https://www.defcon.org/html/defcon-19/dc-19-speakers.html#Roberts

uk: вхід без авторизації


Kiosk Hacking Redux

uk: Комп'ютерні науки

description: Paul Craig - Internet Kiosk Terminals : The Redux https://www.defcon.org/images/defcon-19/dc-19-presentations/Craig/DEFCON-19-Craig-Internet-Kiosk-Terminals.pdf Paul Craig is the self-proclaimed "King of Kiosk Hacking" You have likely heard of him or his pornographic tool iKAT (Interactive Kiosk Attack Tool). For the last 3 years he has dedicated his life to striking fear into the hearts of Kiosk vendors. This talk will compromise all of his latest advancements in the field of hacking Kiosk terminals. Multiple platforms, vendors, technologies and more shells than you can shake a stick at. If you have ever wanted to hack that lonely web-browsing computer in the corner of a room, this is the talk for you. This talk will also showcase a live freestyle Kiosk hacking session, with a truck load of slick ninja techniques and zero-day. Watch out - the King of Kiosk hacking is back in town. Paul Craig works at Security-Assessment.com with a bunch of some of the best hackers in the world. Paul lives for hacking, it's in his blood! From the age of 13 he has have been addicted to popping shells, stealing access and escalating privileges. He loves his job and is fully committed to the trade.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Phil Cryer - Taking Your Ball And Going Home; Building Your Own Secure Storage Space That Mirrors Dropbox's Functionality https://www.defcon.org/images/defcon-19/dc-19-presentations/Cryer/DEFCON-19-Cryer-Taking-Your-Ball-and-Going-Home.pdf When for-profit companies offer a free app, there is always going to be strings attached. As we have increasingly seen, these strings are often tied to your privacy to enable said third party company to monetize you in some way, but in worse cases your security can be compromised leaving you open to identity theft at best or legal repercussions at worst. One of today's most ubiquitous apps is Dropbox, which operates as a file hosting service that uses "cloud computing" (aka the internet) to enable users to store and share files and folders with others using file synchronization. Sounds harmless enough until you start thinking about how they can do so much for free. Learn about the flaws discovered by security researchers that have caused Dropbox to significantly change their terms of service, and about a group building a free, open sourced option for anyone to use to share and protect their data with. Learn, get involved, help and CYA, because for-profit third party companies are not going to do it for you. Phil Cryer (fak3r) is a systems engineer and privacy advocate who has worked on Linux and open source solutions for over 10 years. While balancing security with openness he has lectured globally on ways to open data silos to facilitate scientific discovery, but is equally comfortable talking about sharing any kind of data. His favorite memory from previous DEFCONs was yelling at the screen during a late night screening of Wargames, but locking himself out of his own room at last year's con is a close second. He learns by doing, believes that imagination is more important than knowledge, and like all good IT professionals, has a bachelor degree in fine arts. Twitter: @fak3r

uk: вхід без авторизації

name: Taking Your Ball And Going Home; building your own secure storage space that mirrors Dropbox's functionality


uk: Комп'ютерні науки

description: Cloud security has come into focus in the last few years; while many ways to break the cloud have been proposed, few solutions have been put forward. This talk is primarily a conceptual discussion on how cloud providers can and should be (but probably are not) protecting both their own and their clients' assets in their cloud implementations. It will discuss the known issues with cloud, and a readily available proposed solution to some of these issues. The presentation will conclude with a demonstration of an actual implementation of this theory at a cloud hosting provider. An understanding of basic network security technology is required. Ramon Gomez is a Security Professional working for a cloud hosting provider. He has been working in correlation theory for the last 8 years, including time spent working at a prominent North American vendor of SEIM software, providing theory and logic to improve the correlation capabilities of the product. His primary areas of professional expertise are in correlation theory, and Intrusion Detection/Analysis.

uk: вхід без авторизації

name: Bulletproofing The Cloud: Are We Any Closer To Security?


uk: Комп'ютерні науки

description: Halloween makers or how haunters void warranties, social engineer and find the joy of creativity. A short path down to what a community of makers that mod hardware, special effect and mood you in order to scare the shit out of you just one night a year. These people comprise electrical engineers to housewives and personally I've learned to solder better, faster because of it. Reeves Smith has been working with hardware for security's sake for 12 years, making open source WIDS and the like. He found a community of makers that live for nothing but Halloween and thought their spirit of creativity was a lot like the creativity seen in parts of the security community. He currently works for Tenacity Solutions Inc. as a SNSE and is a Mac Fan Boy.

uk: вхід без авторизації

name: Halloween Makers Or How a Haunter: Voids Warranties, Social Engineers and Finds the Joy of Curiosity


Why Airport Security Can't Be Done FAST

uk: Комп'ютерні науки

description: Eight years after 9/11 TSA finally decided to fix their security system. But what has really changed? Homeland Security's science division has been busy lately, and is currently polishing up a project called FAST - Future Attribute Screening Technology. FAST, part of project MALINTENT, is a project of the Department of Homeland Security Behavioral Science Unit, which supposedly can detect whether you want to blow up the plane purely based off of biological indicators. While it was originally slated for completion this year, the project has been delayed due to many technical difficulties. Starting to smell snake oil? Basic statistics and common sense agree! Methodological flaws, numerous exploits and better uses of tax dollars will be discussed. Semon Rezchikov is an independent security researcher, programmer, and wetware hacker. He is spending the summer at MIT making cells do his bidding. In his free time, he can be found messing around with mathematics, playing clarinet, and furiously scribbling thoughts into his handy black notebook. Morgan Wang is an independent security researcher and analyst, history buff, classically liberal Libertarian, avid knitter and overall crafty person. Her hobbies include impersonating long-dead historical figures and obtaining suspicious amounts of fabric. Joshua Engelman is an independent security researcher and amateur mathematician. In his spare time, he volunteers for the ACLU and teaches fencing to small children. His current project is an autonomous beverage retrieval bot for his robotics team. He can be found lurking on the DEF CON forums, in school labs at odd hours, and directly behind law enforcement personnel wearing a monocle and trenchcoat.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Nothing is harder to see than things we believe so deeply we don't even see them. This is certainly true in the "security space," in which our narratives are self-referential, bounded by mutual self-interest, and characterized by a heavy dose of group-think. That narrative serves as insulation to filter out the most critical truths we know about our work. An analysis of deeper political and economic structures reveals the usual statements made in the "security space" in a new context, one which illuminates our mixed motivations and the interpenetration of overworlds and underworlds in our global society. Crime and legitimacy, that is, are the yin/yang of society, security, and our lives. You can't have one without the other. And nobody should know this better than hackers. This presentation will make you think twice before uncritically using the buzzwords and jargon of the profession - words like "security," "defense," and "cyberwar." By the end of this presentation, simplistic distinctions between foreign and domestic, natural and artificial, and us and them will go liquid and the complexities of information security will remain ... and permeate future discussions of this difficult domain. As a result, we will hopefully think more clearly and realistically about our work and lives in the context of the political and economic realities of the security profession, professional intelligence, and global corporate structures. Richard Thieme has published hundreds of articles, dozens of short stories, two books (including Mind Games, a collection of short stories with more coming (FOAM, a novel, a serio-comic narrative of sex, secrets and intrigue, will be completed soon, followed by "The Room," a novelette about torture and the tortured), and he has given several thousand speeches. He speaks professionally about the challenges posed by new technologies and the future, how to redesign ourselves to meet these challenges, and creativity in response to radical change. Many recent speeches have addressed security and intelligence issues for professionals around the world. He has keynoted conferences in Sydney and Brisbane, Wellington and Auckland, Dublin Heidelberg and Berlin, Amsterdam, the Hague, and Rotterdam, Eilat Israel and Johannesburg South Africa, and the USA. Clients range from GE and Microsoft to the FBI, US Dept of the Treasury. and the US Secret Service. His pre-blog column, "Islands in the Clickstream," was distributed to thousands of subscribers in sixty countries before collection as a book by Syngress, a division of Elsevier. His work has been taught at universities in Europe, Australia, Canada, and the United States, and he has guest lectured at numerous universities. He lives with his wife, Shirley, in Fox Point, Wisconsin and can be reached at www.thiemeworks.com.

uk: вхід без авторизації

name: Staring into the Abyss: The Dark Side of Crime-fighting, Security, and Professional Intelligence


uk: Комп'ютерні науки

description: Verisign iDefense General Manager, Rick Howard, will provide an inside look into current cyber security trends with regard to Cyber War, Cyber Hacktivism, and Cyber Espionage. In this presentation Rick will discuss the current capabilities, tactics, techniques and procedures used by various cyber security cartels in key regions around the world. Finally, Rick will describe the idea of a Cyber Security Disruptor; new ideas, technologies and policies that will fundamentally make us change how we protect the enterprise. Rick Howard spent the last five years working as the iDefense Intelligence director and is now the general manager of the business. Prior to joining iDefense, Rick led the intelligence-gathering activities at Counterpane Internet Security and ran Counterpane's global network of Security Operations Centers. He served in the US Army for 23 years in various command and staff positions involving information technology and computer security and spent the last 2 years of his career as the US Army's Computer Emergency Response Team Chief (ACERT). He coordinated network defense, network intelligence and network attack operations for the Army's global network and retired as a lieutenant colonel in 2004. Rick holds a Master of Computer Science degree from the Naval Postgraduate School and an engineering degree from the US Military Academy. He also taught computer science at the Academy from 1990 to 1995 . He has published many academic papers on technology and security and has contributed as an executive editor to two books that Verisign iDefense personnel have written: "Cyber Fraud: Tactics, Techniques and Procedures" and "Cyber Security Essentials." Twitter: @raceBannon99

uk: вхід без авторизації

name: An Insider's Look at International Cyber Security Threats and Trends


uk: Комп'ютерні науки

description: Earth vs. The Giant Spider: Amazingly True Stories of Real Penetration Tests brings the DEF CON 19 audience the most massive collection of weird, downright bizarre, freaky, and altogether unlikely hacks ever seen in the wild. This talk will focus on those complex hacks found in real environments - some in very high end and important systems, that are unlikely but true. Through stories and demonstrations we will take the audience into a bizarre world where odd business logic flaws get you almost free food [including home shipping], sourcing traffic from port 0 allows ownership of the finances a nation, and security systems are used to hack organizations. The SpiderLabs team delivered more than 2300 penetration tests last year, giving us access to a huge variety of systems and services, we've collected a compendium of coolest and oddest compromises from the previous year to present at DEF CON. Our goal is to show effective attacks and at the same time not the trivial ones that can be found by automated methods. By the end of this presentation we hope to have the audience thinking differently about systems and applications that organizations use every day, and how they may be used against them. Rob Havelt is the director of penetration testing at Trustwave's SpiderLabs, the advanced security team within Trustwave focused on forensics, ethical hacking, and application security testing for premier clients. Rob has worked with offensive security seemingly forever, and from running a start-up ISP, to working as a TSCM specialist, he's held just about every job possible in the realm of system administration and information security. Formerly a bourbon-fueled absurdist, raconteur, and man about town, currently a sardonic workaholic occasionally seeking meaning in the finer things in life - Rob is, and will always be, a career hacker. Wendel Guglielmetti Henrique is a Security Consultant at Trustwave's SpiderLabs, the advanced security team within Trustwave focused on forensics, ethical hacking, and application security testing for premier clients. He has over 11 years experience in Information Technology, where the last 6 years were dedicated to penetration testing. He has performed security focused code reviews, secure development training, forensics analysis and security assessments. Wendel has performed countless network, application and web application penetration tests for various organizations across the globe, including government, banking, commercial sectors, as well as the payment card industry. Recent presentations include Black Hat Arsenal 2010 (USA), OWASP AppSec Research 2010 (Sweden) and Black Hat Europe 2010 (Spain). Previously, Wendel spoke in Troopers 09 (Germany), OWASP AppSecEU09 (Poland), YSTS 3.0 (Brazil), and has spoken in well known security conferences such as DEF CON 16 (USA) and H2HC (Brazil). Wendel developed a tool to detect and remove the famous BugBear virus, before most of the antivirus companies around the world in 2002. During his career, he has discovered vulnerabilities across a diverse set of technologies including webmail systems, wireless access points, remote access systems, web application firewalls, IP cameras, and IP telephony applications. Some tools he wrote already were used as examples in national magazines like PCWorld Brazil and international ones like Hakin9 Magazine.

uk: вхід без авторизації

name: Earth vs. The Giant Spider: Amazingly True Stories of Real Penetration tests


uk: Комп'ютерні науки

description: As this shift to "General Computing" and working in the cloud has accelerated in the last 4 years, so has the ability to take advantage of these technologies from an Information Security vantage point. This could not be more apparent than with the sudden uptick in GPU based password cracking technologies. In this presentation we will explore where the current GPU cracking technologies are, what their cost are to implement, and how to deploy and execute them (with demo). Most importantly, we will demonstrate the "brute force calculator" which can assist with getting your monies worth. Finally, we will explore where the future lays for this medium and what that means for safe passwords moving into the next decade. Robert has been working in Information Security for over 12 years. In his travels he was one of the first to publicly demonstrate the downfalls of credit card security in merchant environments. Next, after 2 ? years of research, he demonstrated "whitelist" based IDPS technology embedded in within web based code to protect against and detect XSS and Injection Attacks in real-time. Later, he developed and implemented highly customized DNS logging integrated with real-time IDPS technology for protection against 0-day malware threats. He currently is working on a SV Hacker Space and various WiFi security shenanigans.

uk: вхід без авторизації

name: Economics of Password Cracking in the GPU Era


uk: Комп'ютерні науки

description: When we connect to a network we leak information. Whether obtaining an IP address, finding our default gateway, or using Dropbox there are packets that can be used to help identify more about our machine and network. This talk and series of demonstrations will help you learn to passively profile a network through a new Metasploit module by gathering broadcast and multicast traffic, processing it, and looking at how the bad guys will use it to own your network. Without sending a packet, many networks divulge significant information about the assets that are attached. These broadcast packets can be used to identify hosts, OS's, and other hardware that is attached. Any skill level can learn how to easily gather and use this information, how to protect your network, and talk about how to extend the framework for new protocols. Ryan Linn is a Senior Security Consultant with Trustwave's SpiderLabs who has a passion for making security knowledge accessible. In addition to being a columnist with the Ethical Hacker Network, Ryan has contributed to open source tools including Metasploit, Dradis and the Browser Exploitation Framework (BeEF).

uk: вхід без авторизації

name: PIG: Finding Truffles Without Leaving A Trace


Three Generations of DoS Attacks

uk: Комп'ютерні науки

description: Denial-of-service (DoS) attacks are very common. They are used for extortion, political protest, revenge, or just LULz. Most of them use old, inefficient methods like UDP Floods, which require thousands of attackers to bring down a Web server. The newer Layer 7 attacks like Slowloris and Rudy are more powerful, and can stop a Web server from a single attacker with incomplete Http requests. The newest and most powerful attack uses IPv6 multicasts, and can bring down all the Windows machines on an entire network from a single attacker. I will explain and demonstrate these tools: Low Orbit Ion Cannon, OWASP Http DoS Tool, and flood_router6 from the thc-ipv6 attack suite. This deadly IPv6 Router Advertisement Flood attack is a zero-day attack--Microsoft has known about it since June 2010 but has not patched it yet (as of May 4, 2011). Audience Participation: Bring a device to test for vulnerability to the Router Advertisement Flood! Some cell phones and game consoles have been reported to be vulnerable--let's find out! If your device crashes, please come to the Q&A room so we can video-record it and arrange disclosure to the vendor. Sam Bowne has been teaching computer networking and security classes at CCSF since 2000. He has given talks at DEFCON, Toorcon and BayThreat, and taught classes and seminars at many other schools and teaching conferences. Sam has a B.S. in Physics from Edinboro University of Pennsylvania and a Ph.D. in Physics from University of Illinois, Urbana-Champaign. His Industry Certifications are: Associate of (ISC)^2, Certified Ethical Hacker, Microsoft: MCP, MCDST, MCTS: Vista; Network+, Security+, Hurricane Electric IPv6 Guru, CCENT.

uk: вхід без авторизації


DIY Non-Destructive Entry

uk: Комп'ютерні науки

description: Ever leave the house without your picks only to find yourself in a situation where you desperately need them? Well, never fear! I'm going to explain how to open everything from cars, to briefcases to safes with objects as common as popsicle sticks and unconventional as palm sanders. Every attack will be fully explained so you understand the underlying mechanisms and how we are taking advantage of mechanical tolerances and design flaws to own these locks. Schuyler Towne toes a strict ethical line when it comes to lockpicking, but lives a rich fantasy life where he is a lockpicking rogue stealing from the mansions of rich Italians and giving their valuables to the poor. By day he is a socialite who often helps the local constable solve crimes, but by night he is the man who robs the robber barons! This is all much more glamorous than reality, where Schuyler spends most of his days getting giddy about 19th century lock patents and annoying his friends by fondling their keys. Twitter:@Shoebox Facebook: www.facebook.com/stowne

uk: вхід без авторизації


Runtime Process Insemination

uk: Комп'ютерні науки

description: Injecting arbitrary code during runtime in linux is a painful process. This presentation discusses current techniques and reveals a new technique not used in other projects. The proposed technique allows for anonymous injection of shared objects, the ability to pwn a process without leaving any physical evidence behind. Libhijack, the tool discussed and released in this presentation, enables injection of shared objects in as little as eight lines of C code. This presentation will demo real-world scenarios of injecting code into end-user processes such as firefox, nautilus, and python. Shawn Webb is a professional security analyst. He works with Linux, FreeBSD, and Windows systems, finding vulnerabilities in in-house applications. He's a proud member and contributor of SoldierX. Twitter: lattera

uk: вхід без авторизації


uk: Комп'ютерні науки

description: When a CISO pays good money for a thorough pentesting, she wants results. Not necessarily the ones that the pentester had in mind, either. Whether the time allotted is too short, the pentester has to achieve multiple objectives, or they disagree on the severity of the findings, both the CISO and the pentester have to agree on both sides of the engagement. We discuss numerous aspects of voluntary pwnage: the differences between a security assessment and a penetration test, what color of box works best, tweaking the objectives for more targeted results, and ensuring a happy ending. @shrdlu has worked as a CISO since 25 years past the epoch, both in the public and private sectors, and has grown to enjoy the exquisite pain of being on the receiving end of a pentest. It should be noted that @shrdlu is not speaking on behalf of any employers, past, present or future, did not test the presentation on any live animals, and will not be dispensing any sort of legal or medical advice.

uk: вхід без авторизації

name: Are You In Yet? The CISO's View of Pentesting


uk: Комп'ютерні науки

description: In the post 9/11 era when it's nearly impossible to buy a pack of gum without alerting the big three credit bureaus, you may think that anonymity is long gone from the economy. That's where bitcoin comes in. Bitcoin is a decentralized peer-to-peer currency based solely on computing power. It is (mostly) untraceable and highly anonymous, not backed by any banks or companies, and in the words of Jason Calacanis "the most dangerous project we've ever seen". In my talk I'll explain what bitcoin is and isn't, and why this 70+ PetaFLOP network has caught the attention of everyone from The Washington Post and MSNBC to Wikileaks and the EFF. Skunkworks is an undergraduate studying electrical engineering. He's an active phone phreak and experiments with high voltage and hardware hacking in his spare time.

uk: вхід без авторизації

name: Hacking the Global Economy with GPUs Or: How I Learned To Stop Worrying And Love Bitcoin


IP4 TRUTH: The IPocalypse is a LIE

uk: Комп'ютерні науки

description: There is a long tradition of researchers presenting at security conferences on topics that are embarrassing to a large company or government agency: ATM hacking, router vulnerabilities, Massachusetts toll road RFIDs, etc. Many of these brave researchers risk lawsuits or career ruin to reveal the truth. THIS is the first talk that puts the presenters' very lives in peril. Much has been made of the so-called "IPv4 address exhaustion" problem, also known as the IPocalypse. Industry analysts, networking vendors, regulatory groups, think-tanks, and so on have insisted that migration to IPv6 is the only solution. However, a small group of dissenters insist that threat is exaggerated and, more importantly, that the "migration plan" is merely a scheme to increase revenue for the network equipment manufactures and overpriced consultants. The full truth is that IPv6 is the result of an international cabal on the verge of controlling the world. For centuries, mystics have prophesied that this "migration" would be the cabal's turning point. Incontrovertible evidence will be presented to convince all in attendance. Numerological analysis, ancient texts, and intercepted communiqués are just a few examples. Due to threats against their families, the presenters have been forced to take on assumed identities and appear only in disguise. Sterling Archer , codename "Duchess", is the world's most deadly secret agent, master of the honeypot operation, and inventor of the tactical turtleneck. He has been an ISIS field agent for 14 years and is in the DANGER ZONE. Twitter: @s__archer Prof. Hubert Freaksworth's bio is somewhere. Everything's like somewhere. Currently this bio is free form. All of this fitting in this machine is seriously freaked up.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Remember the good old days, when you'd stare at Rx and Tx on your shiny new Supra 1200bps modem, and actually know what the heck was going on? Systems tend to talk a lot more nowadays, and somewhere along the line I completely lost track of who mine hangs out with. And I kind of miss my blinkie lights. But we live in a world of Arduino and cheap LEDs - maybe there's a way to play with electronics, talk about security, and show the kids a thing or two - all at the same time. Imagine if one of those USB toys on your desk could actually give you an indication of which countries you were trading packets with, or alert you to unusually long-running sessions. 'cerealbox' will demonstrate how an 8x8 multicolor LED matrix, Arduino, and a network monitoring program can be used to make an LED-based sniffer for around $60. And if that doesn't sound interesting, just wait until you see Port Scan Inferno. Steve Ocepek was one of the original team behind Wholepoint, a computer security consultancy that later merged with Trustwave. As Director of Security Research for Spiderlabs, he is in charge of all signature development for all products, maintaining and updating open source projects, researching new threats, providing intelligence to premier clients, pursuing security advisories, and supporting other SpiderLabs teams during technical engagements. Ocepek's accomplishments include discovering and patenting a new method of detecting wireless clients from the wired network, as well as creating the "thicknet" framework to analyze protocols for Man-in-the-Middle attack surface. He has a featured as a keynote speaker at industry conferences such as Blackhat in both the USA and Europe, and OWASP AppSec. Ocepek is a Certified Information Systems Security Professional (CISSP) and a member of Northeast Ohio Information Security Forum.

uk: вхід без авторизації

name: Blinkie Lights: Network Monitoring with Arduino


We Owe it All to the Hackers

uk: Комп'ютерні науки

description: The same spirit that drives the modern hackers today was the impetus to move digital technology into the mainstream of our lives. Learning about the creativeness and chutzpah of the early hackers--and understanding their implicit advocacy of openness and freedom--puts the tech landscape of today into perspective. Steven Levy is the senior writer for Wired Magazine and the author of seven books, including Hackers: Heroes of the Computer Revolution, the classic computer history book. He was formerly the chief technology correspondent for Newsweek. Other books include Crypto, Artificial Life and Insanely Great (the history of the Macintosh computer). His most recent book, In the Plex, is the result of a three year immersion into Google. In its review of the book, the Washington Post called Levy "American's premier technology journalist."

uk: вхід без авторизації


Welcome & Making of the badge

uk: Комп'ютерні науки

description: The Dark Tangent introduces DEF CON 19, Welcomes the crowd. LosTboY hints, teases, and explains the badge and the contest to the crowd

uk: вхід без авторизації


DEF CON Awards - 2011

uk: Комп'ютерні науки

description: The Dark Tangent and Russ Rogers announce the winners of the first annual DEF CON Awards.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: https://www.defcon.org/images/defcon-19/dc-19-presentations/Holt-Kilger/DEFCON-19-Holt-Kilger-Assessing-Civilian-Willingness.pdf Changes in the social dynamics and motivations of the hacking community are a potential catalyst that when combined with the expanding reliance of critical infrastructure components upon networked control systems may provide the genesis for the emergence of what is being called the civilian cyberwarrior The emerging visibility and salience of cyber-vulnerabilities within large elements of a nation's critical infrastructure is creating opportunities that are facilitating significant potential shifts in the power relationship between individuals and nation states. This paper examines some of these shifts in the social dynamics and motivations in the hacking community, their effects on the traditional power differential between individuals and nation-state actors and discusses the emergence of the civilian cyberwarrior - individuals that are encouraged and emboldened by this transformed power differential to engage in malicious acts against another country's critical infrastructure or even the critical infrastructure of their own country. In particular, this presentation will explore the findings from an international survey of youth to identify the situational and social factors that predict individual willingness to engage in physical and cyberattacks against various targets. The findings will assist researchers, law enforcement, and the intelligence community to proactively anticipate various threat scenarios and develop effective defenses against attacks on and off-line. Thomas J. Holt is an Assistant Professor in the School of Criminal Justice at Michigan State University. He received his Ph. D. in Criminology and Criminal Justice from the University of Missouri-Saint Louis in 2005. His research focuses on computer hacking, malware, and the role that technology and computer mediated communications play in facilitating all manner of crime and deviance. Dr. Holt has been published in numerous academic journals, including Crime and Delinquency, Deviant Behavior, and the Journal of Criminal Justice, is a co-author of the book Digital Crime and Digital Terror, editor of the text Cybercrime: Causes, Correlates, and Context, and co-editor of the forthcoming book Corporate Hacking and Technology-Driven Crime. He is also a regular presenter at Defcon, the Department of Defense Cybercrime Conference, and various regional hacker conferences. Dr. Holt is also the recipient of two grants from the U.S. National Institute of Justice to examine the market for malicious software and the social dynamics of carders and data thieves in on-line markets. Additionally, Dr. Holt is the project lead for the Spartan Devils Chapter of the Honeynet Project, and directs the MSU Open Source Research Laboratory dedicated to exploring the landscape of cyberthreats around the globe through on-line research. Max Kilger received his doctorate from Stanford University in Social Psychology in 1993. He is a behavioral profiler for the Honeynet Project and contributes additional efforts in the areas of statistical and data analysis. Max has written and co-authored research articles and book chapters in the areas of influence in decision-making, the interaction of people with technology, the motivations of malicious online actors and understanding the changing social structure of the computer hacking community. He was the lead author for the Profiling chapter of the Honeynet Project's book Know Your Enemy (second edition) which serves as a reference guide for information security professionals in government, military and private sector organizations. He also coauthored a chapter examining the vulnerabilities and risks of a cyberattack on the U.S. national electrical grid. His most recent published work is a book chapter on social dynamics and the future of technology-driven crime. He currently is working on two chapters dealing with cyberprofiling for a book on cyber-counterintelligence to be published in early 2012. Max was a member of the National Academy of Engineering's Combating Terrorism Committee, which was charged with recommending counterterrorism methodologies to the Congress and relevant federal agencies. He is a frequent national and international speaker to law enforcement, the intelligence community and military commands as well as information security forums.

uk: вхід без авторизації

name: Assessing Civilian Willingness to Participate in On-line Political and Social Conflict


uk: Комп'ютерні науки

description: According to Google, Android was designed to give mobile developers "an excellent software platform for everyday users" on which to build rich applications for the growing mobile device market. The power and flexibility of the Android platform are undeniable, but where does it leave developers when it comes to security? In this talk we discuss seven of the most interesting code--level security mistakes we've seen developers make in Android applications. We cover common errors ranging from the promiscuous or incorrect use of Android permissions to lax input validation that enables a host of exploits, such as query string injection. We discuss the root cause of each vulnerability, describe how attackers might exploit it, and share the results of our research applying static analysis to identify the issue. Specifically, we will show our successes and failures using static analysis to identify each type of vulnerability in real-world Android applications. Yekaterina Tsipenyuk O'Neil is the founding member of the Security Research Group at Fortify Software, where she is responsible for performing code audits, identifying and analyzing insecure coding patterns, providing security content for Fortify's software security products, and researching ways to improve the quality of the tools. Outside of the office, Yekaterina spends time working with customers and speaking at conferences. Yekaterina has a B.S. and an M.S. in computer science from the University of California, San Diego. Her thesis work focused on mobile agent security. Erika Chin is a Ph.D. student in Computer Science at the University of California, Berkeley. She is in the security research group, and her current research interest is improving mobile phone security. In particular, she is interested in addressing developer confusion and difficulty that lead to vulnerabilities in mobile phone applications. She recently presented at MobiSys on vulnerabilities stemming from inter-application communication in Android.

uk: вхід без авторизації

name: Seven Ways to Hang Yourself with Google Android


uk: Комп'ютерні науки

description: This webinar is the second in a series of 2 webinars which aims to bring together researchers and data specialists from various disciplines to showcase their drone applications and data expertise, knowledge share and information exchange to enhance the research capabilities. Who would benefit from attending: -Data managers and Data Librarians -Data scientists, analysts, developers, and technologists -Researchers (Academia, Industry, and Government) -Environmental & geoscientific research data community Who is speaking: 1- Making drone data open for scientific research: Siddeswara Guru (TERN) 2- Smart Agriculture at UQ Gatton IoT and Drones: Kim Bryceson (UQ) 3- From pixels to point clouds - Using drones, game engines and virtual reality to model and map the National Arboretum in Canberra: Tim Brown (ANU)

uk: вхід без авторизації

name: Drones in research webinar #2: Rise of drones in Australian research space - 27 Jul 2017

Australian Research Data Commons (ARDC)

addressCountry: AU

addressLocality: Melbourne

addressRegion: Victoria


uk: Комп'ютерні науки

description: This one hour webinar is the first in a series of 2 webinars which aims to raise awareness on legal and privacy issues and also to provide an understanding of public safety and community attitude under current Australian law when deploying drones into the research. Speakers: 1- Considerations for marine research drone operation on the Great Barrier Reef: Melanie Olsen (AIMS) 2- The privacy implication of using drones under current Australian law: Prof.Des Butler (QUT) 3- Drones and geospatial data: A look at the legal and ethical issues [IP and copyright]: Assoc.Prof.Leanne Wiseman (Griffith University) Who would benefit from attending: -Data managers and Data Librarians -Data scientists, analysts, developers and technologists -Researchers (Academia, Industry and Government) -Environmental & geoscientific research data community -Research Office, Ethics committee members, Legal counsel for institutions

uk: вхід без авторизації

name: Drones in research webinar #1: An eye on legal, ethics, safety and privacy - 20 Jul 2017


uk: Комп'ютерні науки

description: Der Vortrag wird Einblicke in vergangene und aktuelle Entwicklungen liefern. Auch wird ein Ausblick auf kommende Features nicht fehlen.

uk: вхід без авторизації

name: GraphHopper-Routing-Engine – Einblicke und Ausblick


uk: Комп'ютерні науки

description: Die TEAM Engine ist eine Engine, mit der Entwickler und Anwender Geodienste, wie WFS und WMS, und Geoformate, wie GML oder GeoPackage, testen können. Dieser Vortrag stellt vor, wie der neue OGC-Standard WFS 3.0 mit der TEAM Engine validiert werden kann. Dabei wird der Prozess der Erstellung der neuen Testsuite im Rahmen des OGC-Testbed-14-Programms näher beleuchtet. Des Weiteren werden die aktuellen Entwicklungen im TEAM-Engine-Projekt aufgezeigt und ein Ausblick gegeben.

uk: вхід без авторизації

name: TEAM Engine – Validierung des neuen OGC-Standards WFS 3.0 und aktuelle Entwicklungen im Projekt


uk: Комп'ютерні науки

description: Das OpenStreetMap-Projekt sammelt geographische Informationen. Dabei ergeben sich zahlreiche Berührungspunkte mit personenbezogenen Informationen. Der Vortrag geht den Fragen nach, ob die Datenschutzgrundverordnung einschlägig ist und welche Anforderungen ggf. beim Craftmapping und der Eintragung von Informationen in die Datenbank zu beachten sind.

uk: вхід без авторизації

name: Craftmapping und Datenschutzgrundverordnung - Was ist erlaubt, wo sind die Grenzen?


uk: Комп'ютерні науки

description: Dieser Vortrag erläutert Werkzeuge und Techniken, womit man statische Bilder oder PDFs schnell und einfach in interaktive Karten umwandeln kann.

uk: вхід без авторизації

name: Von statischen Bildern zu interaktiven Karten und zurück


Data Science mit OpenStreetMap

uk: Комп'ютерні науки

description: Data Science ist ein populäres Schlagwort, das schon vielerlei Bereiche befallen hat, nicht zuletzt die Welt der Geoinformatik. Hier geht es darum, wie man gängige Methoden von Data Science auf OpenStreetMap Daten mithilfe von Open-Source-Werkzeugen anwenden kann und daraus neue Einblicke erzeugen kann.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Der Malawi-Atlas ist eine Plattform, um Naturgefahren in Malawi mittels Geodaten zu visualisieren. Im Hintergrund wird auf bewährte Open-Source-Komponenten wie PostGIS, GeoServer, GeoExt und OpenLayers gesetzt.

uk: вхід без авторизації

name: Malawi Atlas - eine SDI mit PostGIS, GeoServer und GeoExt