uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

description: Input-output performance problems are on every day agenda for DBAs since the databases exist. Volume of data grows rapidly and you need to get your data fast from the disk and moreover - fast to the disk. For most databases there is a more or less easy to find checklist of recommended Linux settings to maximize IO throughput. In most cases that checklist is good enough. But it is always better to understand how it works, especially if you run into some corner-cases. This talk is about how IO in Linux works, how database pages travel from disk level to database own shared memory and back and what kind of mechanisms exist to control this. We will discuss memory structures, swap and page-out daemons, filesystems, schedulers and IO methods. Some fundamental differences in IO approaches between PostgreSQL, Oracle and MySQL will be covered

uk: вхід без авторизації

name: Linux IO internals for database administrators: (tutorial, 2018 version)


Stephen Frost

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

uk: Бібліотекознавство, документознавство

en: Information and Library Sciences

de: Geisteswissenschaften

uk: Гуманітарні науки

en: Humanities

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: We'll cover how to write your first patch to PG, submit it for review, and profit! Ever wished PostgreSQL had a particular capability or feature? Know a bit of C? This talk will walk you through writing a patch for PG, what needs to be modified to add an option to an existing command (grammar, execution, etc) and the major components of PG (parser, commands, memory management, etc). We'll also cover the PG style guidelines, a crash-course on using git, how to submit your patch, and the review process.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: Hacking on PostgreSQL: Add your feature to Postgres!

name: PGCon - PostgreSQL Conference for Users and Developers

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

@language: de

uk: вхід без авторизації

name: Open-Access-Tage 2020 - Begrüßung und Eröffnung

Universität Bielefeld

addressCountry: DE

addressLocality: Bielefeld

addressRegion: North Rhine-Westphalia


de: Sozialwissenschaften/Soziologie

uk: Суспільні науки та соціологія

en: Social Sciences/Sociology

uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

de: Rechts-, Wirtschafts- und Sozialwissenschaften

uk: Право, економіка та суспільні науки

en: Law, Economics and Social Sciences

uk: Гуманітарні науки

description: Open Access gained a lot of importance in the last decades and is now strongly supported by many scientific organisations and funders in several countries. But as the movement is becoming more and more mainstream, a new question arises that is rarely addressed : how open exactly is open access? or more precisely: how open is it to the diversity of scientific cultures, publishing languages and scholarly communication practices that exist in the academic landscape? Some scholars have been using the concept of 'bibliodiversity' to capture this concern and promote a different way to foster open access to academic publications. In my presentation, I will explore how the concept of bibliodiversity is particularly fruitful to guide open access initiatives and policies, particularly in the European context.

uk: вхід без авторизації

name: Supporting bibliodiversity in open science: a European challenge


uk: Комп'ютерні науки

uk: Бібліотекознавство, документознавство

uk: Гуманітарні науки

uk: вхід без авторизації

name: Update Schweiz: Nationale Open Access Strategie und Verhandlungen mit Grossverlagen


uk: Комп'ютерні науки

description: Current status quo of credential management in cloud related DEVOPS environments enables attackers to easily obtain leaked credentials. This presentation showcases how leaked credentials in public repositories can potentially lead to further compromise in enterprise environments.The focus will be on the DEVOPS attack surface and the toolchains involved within this process in cloud platform environments. Presenters will use a recently released tool (Git Wild Hunt) to show how public leaks can lead to further compromise of individuals and enterprises with actual examples of derived information from compromised secrets. An analysis of credentials leaked globally and its source (company affected and user) will be provided as examples.

uk: вхід без авторизації

name: Red Team Village - Have My Keys Been Pwned?: API Edition


uk: Комп'ютерні науки

description: Identifying and enumerating assets has become incredibly easy thanks to all the tools that have been released in the past few years, but being the first to a new target can be the difference between a P1 and a Duplicate! This talk will cover how we were able to monitor, fingerprint, and catalog cloud assets at a rate of over 200 thousand hosts a second in an attempt to find bounty targets and the bugs within them before anyone else.

uk: вхід без авторизації

name: Red Team Village - Knock Knock, who's there?: Identifying Assets in the Cloud


uk: Комп'ютерні науки

description: "Red team operations involve many skills, the operation requires a lot of monitoring, consolidating and caution. In order to perform red team operations faster, and stealthier without thinking about the infrastructure every team has its’ own habits and standards. However, there is a problem with those habits and standards; - There are tons of tools but no operation management, - No aggregation between these tools, - When OPSEC fails due to problems above or any other reason, it’s essential to possess the capability of maintaining robust infrastructure which can be recreated if discovered, and more importantly, without any issues upon deployment. In this talk, infrastructure challenges we face as a red teamer will be discussed. Along with challenges, a solution will be proposed based on DevOps practices such as; - Design your infrastructure based on the standards and habits which your team has - Create playbooks which suits your needs based on your design - Create CI pipeline to test and maintain your playbooks

uk: вхід без авторизації

name: Red Team Village - Managing Red Team Infrastructure as a Red Teamer


uk: Комп'ютерні науки

description: Kubernetes Goat - Vulnerable by Design Kubernetes Cluster Environment Kubernetes Goat is “vulnerable by design” Kubernetes Cluster environment to practice and learn about Kubernetes Security. In this session Madhu Akula will present how to get started with Kubernetes Goat by exploring different vulnerabilities in Kubernetes Cluster and Containerised environments. Also he demonstrates the real-world vulnerabilities and maps the Kubernetes Goat scenarios with them. Also, we will see the complete documentation and instruction to practice Kubernetes Security for performing security assessments. As a defender you will see how we can learn these attacks, misconfigurations to understand and improve your cloud native infrastructure security posture.

uk: вхід без авторизації

name: Red Team Village - Kubernetes Goat: Vulnerable by Design Kubernetes Cluster Environment


uk: Комп'ютерні науки

description: The world is moving towards smart culture everything nowadays is smart, and mostly all are those smart devices are basically embedded devices with internet connectivity or some provision to connect with the internet. Since these devices are booming in market this also tempting lots of people/groups for hacking. In this 1 hour talk we will discuss how to test the embedded/IoT devices, it would give you a methodology for assessment, how to perform firmware analysis, identifying vulnerable components, basic approach for reverse engineering the binaries to discover potential remote code execution, memory corruption vulnerabilities by looking for native vulnerable functions in C or bad implementation of functions like System, popen, pclose etc. After conducting static analysis, firmware analysis we will move towards dynamic testing approach which include web application testing, Underlying OS security testing, identifying vulnerabilities and misconfiguration in device. At last we will move towards fuzzing the device via web application parameters and installing appropriate debugger on device to identify memory corruption vulnerabilities. DELIVERABLES Methodology for testing embedded devices Deep dive into device security testing from beginner level to developing exploit And At last, a good intro into how to break known security boundary of embedded/IoT devices by knowing its weakness and thereby securing it.

uk: вхід без авторизації

name: Red Team Village - Offensive Embedded Exploitation: Getting hands dirty with IOT/Embedded Device Security Testing


uk: Комп'ютерні науки

description: ATTPwn is a computer security open source tool designed to emulate adversaries. The tool aims to bring emulation of a real threat into closer contact with implementations based on the techniques and tactics from the MITRE ATT&CK framework. The goal is to simulate how a threat works in an intrusion scenario, where the threat has been successfully deployed. It is focused on Microsoft Windows systems through the use of the Powershell command line. This enables the different techniques based on MITRE ATT&CK to be applied. ATTPwn is designed to allow the emulation of adversaries as for a Red Team exercise and to verify the effectiveness and efficiency of the organization's controls in the face of a real threat. Furthermore, ATTPwn provides the possibility of knowledge transfer between users. This knowledge is exchanged through implementation of ATT&CK techniques. This new user-generated knowledge can be shared with the community through a special feature within ATTPwn. The collaborative part of ATTPwn enhances the know-how that every users can bring to the community in the shape of offensive techniques, which are always being mapped with ATT&CK.

uk: вхід без авторизації

name: Red Team Village - ATTPwn: Adversarial Emulation and Offensive Techniques Collaborative Project


uk: Комп'ютерні науки

description: I’ve done a few years at NECCDC (Collegiate Cyber Defense Competition) Red team and teams make the same mistakes over and over again with the approach of trying to harden a system that is so far compromised that it's better if they could just reinstall everything. This talk I will detail things that have worked and not worked over the last three years that everyone seems to miss and grounds the fact that the simpler the attack. the overall better you will have in endpoints responding home. Managing rapid response to teams who are actively dealing with your malware and other tidbits.

uk: вхід без авторизації

name: Red Team Village - What College Kids Always Get Wrong: the art of attacking newbies to blue team


Red Team Village - Pwn the World

uk: Комп'ютерні науки

description: Want to learn the basics of how to hack cool industrial IOT, industrial control systems and technology that moves the world? How to find them, leverage weaknesses in protocols & systems. Turn engineer technical tools into dual use reconnaissance and attack tools. Components of energy grids, digital security systems, production systems and more.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This presentation will go through various steps on how students can bridge the gap between academia and becoming a penetration tester. This will include a breakdown of certifications to get, career fields to take on before getting in the industry, what to expect, and speed bumps and road blocks that students can expect to see in their journey.

uk: вхід без авторизації

name: Red Team Village - Student Roadmap: Becoming a Pentetration Tester


uk: Комп'ютерні науки

description: With the explosion of GPU enabled processing power password cracking has long grown beyond the standard wordlist. New tools and techniques are being used in order to effectively and efficiently crack passwords that just a few years ago would have be unfathomable. People often ask me, what is the best way to crack this hash, and the truth is it really depends. Let us introduce some of the more modern and best ways to attack passwords by analyzing the language structures and character patterns of passwords, as well as developing custom rules and rule chains to maximize effort. Password cracking is one of those things that has been around for a long time, however people often do not associate a methodology behind it and consider it just a tool. My presentation has a large amount of content to cover within a 50-minute window, therefore our demos are light and quick showing the different tools built for cracking locally, in the cloud, or in a distributed environment. I feel that by passing along the knowledge of the ins and outs of the tools will be more valuable than having people watch us crack passwords on the screen. The slide decks can be made available to participants and contains sample commands for them to try out each technique I present

uk: вхід без авторизації

name: Red Team Village - Hashes; Smothered, Covered and Scattered: Modern Password Cracking as a Methodology


uk: Комп'ютерні науки

description: Quite often, you may have heard people mention, “Why should you bother learning PowerShell, isn’t it dead?” or “Why not just use C#?” Many individuals in the offensive security field have a common misconception that PowerShell is obsolete for red team operations. Meanwhile, it remains one of the primary attack vectors employed by Advanced Persistent Threats (APTs). APTs are known for implementing sophisticated hacking tactics, techniques, and procedures (TTPs) to gain access to a system for an extended period of time. Their actions typically focus on high-value targets, which leave potentially crippling consequences to both nation-states and corporations. It is crucial that Red Teams accurately emulate real-world threats and do not ignore viable attack options. For this talk, we will walk through how many threat actors adapt and employ PowerShell tools. Our discussion begins with examining how script block logging and AMSI are powerful anti-offensive PowerShell measures. However, the implementation of script block logging places a technical burden on organizations to conduct auditing on a substantial amount of data. While AMSI is trivial to bypass for any capable adversary. Finally, we will demonstrate APT-like PowerShell techniques that remain incredibly effective against the latest generation of network defenses.

uk: вхід без авторизації

name: Red Team Village - APTs ❤PowerShell and Why You Should Too


Red Team Village - Catch Me if You Can

uk: Комп'ютерні науки

description: The presentation will show, from a technical point of view, how to deploy backdoors to guarantee access to an organization. Initially, a brief review about types of persistance, locations where it can be deploy and common aspects to be taken into account will be carried out, to then go on to describe all the details that allow a Red Team to guarantee access to the entity without the organization being able to detect it or being able to expel the attacker before the attacker re-enters using another alternative persistence. The presentation will feature the following highlights: - General introduction to the concepts necessary to understand the details regarding the scenarios where it is necessary to deploy persistence in an organization (in real intrusion). - Reverse connection typology such as situations where there is direct access to the Internet, connection via proxy, proxy with authentication, DNS, … - Infrastructure and techniques for persistence deployment, indicating the type of servers and advanced techniques such as Domain fronting, IP laundry, ... - Traditional deployment of persistence on an organization both in existing systems in DMZ, internal servers, workstations, Cloud servers, Active Directory, … - Alternative persistence to guarantee unknown access through users with predictable credentials based on password history, Wireless backdoor on workstations (in both directions), extracting internal WiFi passwords, pivoting through resource reconstruction, periodic tasks to modify AD setting, monthly Outlook rules configured and upload interna GAL table of users, visual information extraction using screen and others. - Anti-forensic techniques for the deployment of persistence, to avoid the identification of these by the Security team. - Types of behavior to act and techniques when the security team detects a persistence, allowing access to the entity to be recovered before having lost access to company. The combined use of the exposed techniques and actions, as will be shown in the presentation, means that the security team does not have the ability to expel the Red Team in any case, allowing the intrusion to be carried out with greater freedom. The presentation is the result of experience in developing deep Red Team exercises on the main organizations in Spain (IBEX35), as well as large banking and industrial entities in Europe and America for more than 6 years. After the presentation, an Open Source tool will be published to help in the development of the persistence deployment.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Guerrilla Red Team is a methodology by which a company can grow security IQ, technical expertise, and security brainpower, resulting in an internal mesh network of trusted decentralized ethical hackers. The program requires minimal capital investment from the hosting red team. It achieves its primary goals through weekly group mentorship hosted during a four-hour block, once per week, during the workday. It forms a peer network in which guerrilla operators share ideas and techniques, and ultimately grow technically and professionally as a unit. Members of the program come from various technical disciplines, but not necessarily security-focused verticals. The cohort of five to six members follows a nine-week syllabus that takes them from someone with minimal red team experience to autonomous operations. Guerrilla Operators will have a regular cadence of operations, which will require deconfliction from the parent red team to only ensure there are no safety concerns with the proposed target. Expected outcomes for the nine-week cohort are as follows: Guerrilla operators are armed with the skills to continue their red team learning, as well as a support network for challenging tasks The parent red team has an expanded network of internal, trusted, ethical hackers. This strengthens idea generation for campaigns, and enables communication through the use of a shared and common technical language. Over time, the Guerrilla Red Team provides a steady flow of trained homegrown red team operators or security analysts The company itself benefits by having security-focused mindsets placed throughout technical disciplines, resulting in staff that are poised to ward off attacks by thinking like an attacker, functioning similarly to security-focused Site Reliability Engineers (SRE) Provides the company with verification that their security program and infrastructure are as robust as they say it is through the use of decentralized, independent low-tier actors attacking the network: an Offsec ChaosMonkey Provides the guerrilla operators real world, hands on experience in a career field that is hard to break into outside of the Federal pipeline.

uk: вхід без авторизації

name: Red Team Village - Guerrilla Red Team: Decentralizing the Adversary


uk: Комп'ютерні науки

description: Privilege escalation often includes abusing pre-existing features on a system. This talk gives a quick overview of sudo, sudoers, and ways of leveraging misconfigurations to increase access. Included in this talk, are vectors that range from common low-hanging fruit to downright crafty.

uk: вхід без авторизації

name: Red Team Village - 50 Shades of Sudo Abuse


uk: Комп'ютерні науки

description: Which creature implemented code injection 1.5 billion years before any computer malware did? What is the decoding algorithm being used in each of our cells to run the program written in our genes? As computer scientists, we are pushing the edge to develop disruptive technologies for the future. In fact, we can learn from an industry that has been evolving since long before humankind existed: The evolution of biological systems. With our proposal we hope to show the incredible parallels between bacteria and computer malware, the complex algorithms implemented in each of our cells, and how each plays a pivotal role in furthering the research of the other. This lecture will take the audience on an educational journey through both disciplines. This will foster interdisciplinary collaboration and inspire innovative solutions to future challenges for instance in the context of synthetic biology (i.e. creating artificial life), or personalized medicine (i.e. machine learning to treat patients). We are made up of trillions of computational devices. The cells within our body are information-processing units, with memory, storage, cooling and communication devices. Hardware for executable programs was very successfully shaped during the evolution of uncountable biological entities. We are presenting a wormhole between the two parallel universes of computer science and systems biology. A leap through space and time will allow us to connect the evolution of life with recent advances in computer science. An intimate exchange between the computational and the biological spheres is a prerequisite for future generations to work together on aspects of gene editing, robotics and artificial intelligence. As an incentive, we will perform a small quiz during our lecture with attractive prizes. It is our firm belief that we are the right team to foster discussions on life-inspired computer (r)evolution.

uk: вхід без авторизації

name: Red Team Village - Back to the Future CompSci and System Biology


uk: Комп'ютерні науки

description: Android applications are treasure chests of potential bugs waiting to be discovered. Having a structured, streamlined approach greatly improves your efficiency and assessment accuracy. This talk will go over methods used to identify the type of mobile framework to better assess possible attack vectors. Examples will be provided to demonstrate how to exploit those vectors.

uk: вхід без авторизації

name: Red Team Village - Android Application Exploitation


uk: Комп'ютерні науки

description: Despite the rising tide of security maturity, targeted attack chains are often successful due to systemic weaknesses in how modern IT administrators and blue teams operate. This talk gives the attacker's perspective on how common attack chains can be stopped before they spiral out of control. This talk is fueled by two red team operators field experience in attacking modern enterprise environments. It will cover various tactics and techniques that are used with high success during red team engagements, as well as specific countermeasures that would hamper the success of the described attack chains. The speakers will cover a hypothetical red team style engagement, starting from a limited-knowledge basis on the Internet, moving to an internal foothold, leading to data compromise. This talk will focus on technical details at an executive level, and will be performed in a "debrief" style with no technical specifics or demos.

uk: вхід без авторизації

name: Red Team Village - Breaking the Attack Chain: Unexpected WIns and Fails from Two "Simulated Adversaries"


uk: Комп'ютерні науки

description: Penetration Testing (Pentesting) involves skilled cybersecurity professionals generating a plan of attack for finding and exploiting vulnerabilities in the networks, and applications. The current procedure used in pen-testing is semi-automated at best and requires significant human effort. Moreover, the plan of attack followed by pen-testers may not yield best outcomes in terms of exploiting vulnerabilities in the provided time. Our framework, ASAP utilizes software vulnerabilities and network topology information to provide an artificial intelligence-based automated attack plan. Our framework Autonomous Security Analysis and Penetration Testing (ASAP) utilizes the reachability information between different network hosts and software vulnerabilities to generate a state transition graph known as attack graph. Each state in the attack graph represents the current privilege of the attacker. The attack graph also encodes information about the possible next state transitions in the network. In effect attack graph maps all possible exploits and privilege escalations possible in a network. This information is provided to Artificial Intelligence (AI) module. The AI module utilizes a popular framework known as Partially Observable Markov Decision Process (POMDP) to encode uncertainty over different state transitions, and reward obtained by attackers on achieving different privilege levels. The output generated by the AI module - Attack Policy provides the best course of action for a penetration tester/ red team member in the current network setup. The attack policy generated by the ASAP framework can be deployed on target enterprise networks using automated exploitation tools such as Metasploit. Based on our experimental evaluation in a cloud network setup, the attack policy generated by our framework does significantly better than human penetration testers in terms of finding and exploiting vulnerabilities in a network

uk: вхід без авторизації

name: Red Team Village - Autonomous Security Analysis & Penetration testing (ASAP)


uk: Комп'ютерні науки

description: ATT&CK is a game changer and where it works, it can enable both blue and red teams to co-exist and work effectively together. However, what happens when it falls short and the threat intelligence and hypotheses don't exist? How do you build threat intelligence and threat hunt hypotheses from first principles. What do attackers on UNIX do when bitcoin miners aren't their motivation? I’ll go into: * The target I chose and why – we have ~40 years’ experience looking at UNIX from an offensive standpoint, why wouldn't attackers * Building a collection worksheet and the information you'll need to track * Figuring out what TTPs the bad guys are using to attack UNIX when no-one has documented them previously – faced with a lack of DFIR reports, how do you validate your hypotheses * Working out whether your customer is exposed and why this matters * Translating concepts we see in the wild into things our customer can consume * What this means for users of ATT&CK

uk: вхід без авторизації

name: Red Team Village - All of the Threats: Intelligence, modelling, simulation and hunting through an ATT&CKers lens


uk: Комп'ютерні науки

description: What's the hype with the dark web? Why are security researchers focusing more on the dark web? How to perform threat hunting on the dark web? If you are curious about the answers to these questions, then this talk is for you. Dark web hosts several sites where criminals buy, sell, and trade goods and services like drugs, weapons, exploits, etc. Hunting on the dark web can help identify, profile, and mitigate any organization risks if done timely and appropriately. This is why threat intelligence obtained from the dark web can be crucial for any organization. In this presentation, you will learn why threat hunting on the dark web is necessary, different methodologies to perform hunting, the process after hunting, and how hunted data is analyzed. The main focus of this talk will be automating the threat hunting on the dark web. You will also get to know what operational security (OpSec) is and why it is essential while performing hunting on the dark web and how you can employ it in your daily life.

uk: вхід без авторизації

name: Red Team Village - Automating Threat Hunting on the Dark Web and other nitty-gritty things


uk: Комп'ютерні науки

description: Python 3.8, released October 2019, boasts a new security feature called “audit hooks”. According to PEP 578 and PEP 551, the purpose of audit hooking is to allow transparency into Python’s runtime so that events can be monitored and logged just like any other process. While additional insight is great for defenders, it's likely to become another hurdle for attackers to overcome in the same vein as PowerShell. Y'all tryna bypass these audit hooks or nah? Come through.

uk: вхід без авторизації

name: Red Team Village - Y'all Tryna Bypass Python 3.8 Audit Hooks or Nah?


uk: Комп'ютерні науки

description: Chris Wysopal is currently Veracode's CTO and Co-Founder. He is responsible for the company's software security analysis capabilities. One of the original vulnerability researchers and a member of L0pht Heavy Industries, Chris has testified on Capitol Hill in the US on the subjects of government computer security and how vulnerabilities are discovered in software. He published his first advisory in 1996 on parameter tampering in Lotus Domino and has been trying to help people not repeat this type of mistake for 15 years. Back in 1997 he first got paid for hacking someone else's network and later a company's web application. Chris was hooked and has been performing security testing one way or another since.

uk: вхід без авторизації

name: Red Team Village - Red Teaming: Born from the Hacker Community


uk: Комп'ютерні науки

description: Android malware is evolving every day and they are everywhere, even in Google Play Store. Malware developers have found ways to bypass Google's Bouncer as well as antivirus solutions and many alternative techniques to operate like Windows malware do. Using benign looking application working as a dropper is just one of them. This talk is about android malware on Google Play Store and targeting Turkey. The talk will cover; Techniques to Analyze Samples: Unencrypted samples are often used to retrieve personal informations to sell and do not have obfuscation. Encrypted samples however are used for much sophisticated tasks like stealing banking information. They decrypt themselves by getting the key from a twitter account who owned by the malware developer and operate by communicating with the C&C. Also, most banking samples are using techniques like screen injection and dependency injection which is mostly used by android application developers. Bypassing Anti-* Techniques: To be able to dynamically analyze the sample, defeating anti-* techniques are often needed. We will introduce some (known) Frida scripts to be able to defeat common anti-* checks malware uses. Extracting IoCs: Extracting twitter account as well as C&C from encrypted samples are often critical to perform threat intelligence over samples. Extracting IoCs while assets are still active was crucial for our research since we are also aiming to takeover C&Cs. We will introduce (known) automatization technique to extract twitter account, decryption key and C&C address. 4. Extract Stolen Information from C&Cs: In order to extract information from C&C, one should act swiftly. The speed of extraction process is critical since the actors change C&Cs often. We will give a detailed walkthrough about how we approach C&Cs as a target and extract the informations. The samples and informations in the talk is the product of our researches over many bankbot samples as well as other Turkish malware developer actors' samples.

uk: вхід без авторизації

name: Red Team Village - Android Malware Adventures


uk: Комп'ютерні науки

description: In this talk, we'll introduce DropEngine -- a modular framework for creating malleable initial access payloads (also known as "droppers" or "shellcode runners"). Initial access payloads serve a deceptively simple purpose: loading implants from disk into memory. However, a number of obstacles stand in the way of this seemingly mundane task. To start with, the payload must safely be delivered to its intended target (usually via spearphishing). During delivery, the payload is exposed to signature-based detections and analyzed from within an automated sandbox. The payload must then be saved to disk without triggering antivirus, and must load the implant into memory without alerting Endpoint Detection and Response (EDR). Due to the widespread use of application whitelisting, payload authors are restricted to languages that are compatible with "Live Off the Land Binaries and Scripts" (LOLBAS), most of which are executed through the Windows Common Language Runtime (CLR). This means that most payloads must also contend with Microsoft's Anti-Malware Scan Interface (AMSI). Finally, the payload must be able to withstand analysis by threat hunters and reverse engineers. These obstacles are not insurmountable. However, defense evasion techniques tend to have a short shelf-life, and become particularly stale after repeated use. Because of this, payloads are often prepared on a per-engagement basis, which is hardly an easy feat when done by hand. DropEngine addresses this problem by providing a malleable framework for creating shellcode runners. Operators can choose from a selection of components and combine them to create highly sophisticated payloads within seconds. Available payload components include crypters, execution mechanisms, and environmental and remote keying functions. Also included are pre-execution modules such as sandbox checks and AMSI bypasses, as well cleanup modules that execute after the implant is loaded into memory. DropEngine comes pre-packaged with example modules that are more than sufficient to bypass signature and heuristic-based detections at the time of writing. However, DropEngine's true strength is that it improves operational efficiency by providing a high degree standardization, while allowing operators to control just about every aspect of the payload's signature and behavior.

uk: вхід без авторизації

name: Red Team Village - DropEngine: A Malleable Payload Creation Framework


uk: Комп'ютерні науки

description: The technological landscape is rapidly transforming into a data driven, automated, and measured ecosystem. Cloud is an enabler for businesses to become more agile, scalable, and global to maintain a competitive advantage. There are numerous opportunities for red teamers to adopt these same modern strategies to level up their skills, platforms, and yes, even reporting. Attendees will learn how to begin integrating cloud capabilities, scientific notebooks, and aggregated datasets into a highly efficient operating model. We will walkthrough cloud technologies including AWS SageMaker, Athena, Lambda, and API Gateway to build an end-to-end ecosystem of automation. This session will provide demos, accelerators, and code releases to make both routine processes and innovative techniques faster, repeatable, and scalable.

uk: вхід без авторизації

name: Red Team Village - Combining Notebooks, Datasets, and cloud for the ultimate Automation Factory


uk: Комп'ютерні науки

description: Adversary emulation has become an increasingly common type of engagement where red teams look to known threat groups to inspire the actions and behaviors used. While scoping activity might make operating easier, emulation introduces a new set of challenges to planning. How do you know how an adversary behaves? What do you do if you only know part of the picture? How do you turn all of that into a plan? In this talk I’ll examine how we can start building an adversary profile from the open source intel in MITRE ATT&CK. Open source intel often doesn’t give a complete picture of an adversary, and I’ll talk about some of where these gaps come from, how to spot them, and some ways of filling them in. I’ll work through a process for turning the profile we’ve created into an adversary emulation plan expressed in ATT&CK and how we can stay aligned with that plan as we operate.

uk: вхід без авторизації

name: Red Team Village - Emulating Adversary with Imperfect Intelligence


uk: Комп'ютерні науки

description: Organizational data is rapidly moving to the cloud, but it's not always intentional. The shift from on-premise data storage to the cloud constitutes a significant challenge and risk to the modern enterprise. The use of cloud file storage applications is on the rise for both consumer and business systems, which results in interesting data and metadata siting on endpoints. In this talk, we'll examine the large footprints of popular cloud file storage applications such as OneDrive and Box - learning what information can be enumerated from each cloud file storage solution. In some scenarios, data can be carved out from cache, restoring sensitive documents no longer on an endpoint.

uk: вхід без авторизації

name: Red Team Village - Enumerating Cloud File Storage Gems


uk: Комп'ютерні науки

description: The Secure Shell (SSH) was designed to replace telnet/rsh with a secure channel over unsecured networks. SSH is a swiss army knife for red team engagements letting malicious actors accomplish a multitude of interesting tasks. Aside from providing access to run commands on remote systems SSH can be used to complete a myriad of other activities including hop network boundaries, maintain persistent access, download files, steal credentials, hide access and even configure what commands users run on login. This talk goes through details of how to configure and abuse ssh for a number of red team oriented goals from beginner to advanced.

uk: вхід без авторизації

name: Red Team Village - Gray Hat SSH: SSHenanigans


uk: Комп'ютерні науки

description: A day hardly goes by without hearing about another ransomware attack. This talk will focus on how to emulate a ransomware attack without introducing risk. We will understand how ransomware works, learn how criminals are evolving to get paid, create an adversary emulation plan that is safe but valuable for enterprises, and discuss how to defend against ransomware attacks. Adversary Emulation is a type of ethical hacking engagement where the Red Team emulates how an adversary operates, leveraging the same tactics, techniques, and procedures (TTPs), against a target organization. The goal of these engagements is to train and improve people, process, and technology. This is in contrast to a penetration test that focuses on testing technology and preventive controls. Adversary emulations are performed using a structured approach following industry methodologies and frameworks (such as MITRE ATT&CK) and leverage Cyber Threat Intelligence to emulate a malicious actor that has the opportunity, intent, and capability to attack the target organization. Adversary Emulations may be performed in a blind manner (Red Team Engagement) or non-blind (Purple Team) with the Blue Team having full knowledge of the engagement.

uk: вхід без авторизації

name: Red Team Village - Deep Dive into Adversary Emulation - Ransomware Edition


uk: Комп'ютерні науки

description: In the not-too-distance past, it was fairly easy for red-teamers to conquer almost any environment with a combination of password sprays, or by leveraging social engineering to lure victims to fake login sites and harvest their credentials. But in the current landscape, there are new road-blocks to contend with. Nearly every company and organization has now deployed some form of Multi-Factor Authentication (MFA) on their perimeter services. Fortunately, for red-teamers, the vast majority of implementations of MFA across the Internet (email-based, SMS, OTP, and push requests) all share a common critical flaw that can still be easily circumvented using a modern revision of the classic “credential harvesting” attacks. This talk will offer a comprehensive methodology for how a red team can effectively bypass nearly any MFA service using Python-Flask and browser emulation libraries (Mechanize or Selenium) to replay MFA credentials in real-time, establish legitimate user sessions, and then harvest the session tokens to assume access to those compromised sessions. This methodology will prove once again, that the advantage is still square in the hands of the red team, and that even now…ALL YOUR BASE ARE BELONG TO US!!!

uk: вхід без авторизації

name: Red Team Village - YIPPEE - KI - YAY MFA'ER: Bypassing Multi-Factor Authentication with Real-time Replay Session Instantiation Attacks


uk: Комп'ютерні науки

description: Red Team activities are undoubtedly one of the fastest developing solutions against the cyber attacks of today. In this talk, we'll take a look at our work on an open-source proactive machine learning powered automation tool that performs red team simulations. This automation tool provides the opportunity to try out all available attack scenarios, thereby helping the community, especially organizations, to develop mechanisms to protect against these attacks before attackers do. Currently, red, blue and purple teams are improving day by day with the contributions made by open source. We will demonstrate the scenario playbook developed to collect the scenarios prepared for the red, blue and purple team on a single scenario place. The aim of this playbook is to protect the systems from such attack vectors, to examine the attack scenarios, to protect their systems by viewing the protection mechanisms and to contribute to these scenarios. With the built-in Scenario Place, people can either run these scenarios or check the scenario configurations on their systems. All scenario titles are prepared in accordance with MITRE and Cyber Kill Chain. All scenarios from various teams such as Atomic Red Team, Mitre and TIBER-EU are fed into the application as input.

uk: вхід без авторизації

name: Red Team Village - Executing Red Team Scenarios with Built-in Scenario Place


uk: Комп'ютерні науки

description: Modern attacks against complex network infrastructure highlight a massive gap between state-affiliated cyber espionage attacks and Red Teams. As Red Teams face challenges that real-world attackers do not, replicating the sophisticated threat groups becomes all the more challenging with tight engagement deadlines and report submissions. The talk aims to bridge this gap by providing insights into modern tradecraft employed by the apex predators as well as the coin-miners and ransomware authors. The talk will also discuss the unique relationship between speed and stealth during Red Team operations. Sometimes ""speed is the new stealth"" but with evolved defensive technologies that baseline behaviour of endpoints on the host and network level, slow and steady may be the way to go instead. Additionally, the talk will walk through publicly-known implant design considerations to defeat mature host and network defences. Bleeding-edge credential harvesting techniques and the evolution of running Invoke-Mimikatz.ps1 to digging deep into C/C++ and Win32 API programming will be featured. Lastly, the evolution of a modern Red Team operator/developer/both will be discussed. The skills and mindset required to successfully complete objectives and evade defences have changed over time. A Red Teamer must evolve to be able to inform defence better.

uk: вхід без авторизації

name: Red Team Village - Modern Red Team Tradecraft


uk: Комп'ютерні науки

description: The crown jewels are ripe for the taking. ERP systems like SAP are being targeted more than ever and red teams need the tools to demonstrate these threats. We'll demonstrate the TTPs needed to emulate real threats with lateral movement techniques in, out, and between SAP systems.

uk: вхід без авторизації

name: Red Team Village - erpwnage Red Team Approach to Targeting SAP


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Red Team Village - Evil Genius: Why You Shouldn't Trust that Keyboard


uk: Комп'ютерні науки

description: Zoom is a popular digital video conferencing company. Zoom has become one of the most valuable companies in the world during the pandemic, with millions of users and hundreds of millions of monthly participants globally. I have done a security research experiment in spare time to test Zoom and to find security risks and vulnerabilities on Zoom. The experiment resulted in interesting findings along with interesting vectors I identified within the journey. In this talk, I will be showcasing my findings and the results of my experiment. I will also discuss some of the challenges in the conducted responsible disclosure

uk: вхід без авторизації

name: Red Team Village - Hacking Zoom: a Hackers Journey into Zoom Sec


uk: Комп'ютерні науки

description: Oftentimes one of the greatest challenges for security professionals today is finding a way to effectively communicate the state of a network’s security posture, and what steps are necessary to achieve the organization’s security goals. Red teamers are already familiar with executing a typical Breach and Attack simulation, but how can they take greater advantage of their findings, and better yet, share those with the C-suite? The Infection Monkey is a mature, widely-used Open Source GPLv3 licensed tool specifically developed for enterprise red teams. Designed to test an organization’s detection and response methods and teams, the Monkey simulates all steps of an attack by mimicking a variety of adversary moves such as scanning, exploitation, lateral movement, password stealing, network mapping, security control bypass and more. Overall, the Infection Monkey’s simulation reveals it contains a lot of stages one might find in a manual penetration test (or in a real attack). The Monkey is easily configurable, and starts from a single machine and propagates according to the test scenario while collecting data, employing attack tactics, performing security tests and looking for more machines to attack. The results are generated in real-time, shown in a network map and also presented in 3 detailed reports. With the Monkey, red teams can autonomously test specific parts of the network with multiple attack scenarios on a regular basis - like executing a lateral movement scenario from an internet-facing server to a sensitive system deployed in a different part of the network. Further, the Monkey maps its findings to both the MITRE ATT&CK knowledgebase and Forrester’s Zero Trust framework to provide in-depth reports with actionable recommendations for achieving a stronger security posture. When mapping to the Zero Trust framework, the report identifies and prioritizes the steps and decisions required to achieve a true Zero Trust network - whether that’s verifying that the current security stack meets Zero trust requirements or outlining specific actions that blue teams can perform to implement better security measures. By mapping the reports to MITRE ATT&CK, the Monkey communicates the results of the attack in plain language, making the advanced tool accessible and effective for any red team. These reports enable security professionals to address and improve their security posture using the metrics, methods, and ideas they already care about aka if your CISO wants to achieve Zero Trust, their team can clearly map out the steps required to get there with the Monkey’s reports. In this talk, Penetration Testers, Network Engineers, Exploit Developers, and other Security professionals will experience a typical Breach & Attack simulation through the lens of the Monkey to learn how open source solutions can improve and add efficiencies to their teams. Shay will take attendees through a demo of Infection Monkey to demonstrate a typical “before and after” scenario with the Monkey. He will run the Monkey in a test environment, aka the “before,” to identify security gaps and then mitigate the issues using advice offered by the Monkey’s reporting. Finally, Shay will run the Monkey in the “after” environment to show how effective this Breach and Attack simulation can be in strengthening security posture.

uk: вхід без авторизації

name: Red Team Village - Making Breach and Attack Simulation Accessible


uk: Комп'ютерні науки

description: Cyber threat intelligence, in the past, has primarily focused on extracting, preparing, and analyzing indicators of compromise for digital forensics and incident response, the security operations center, and other teams. This talk proposes that there is a benefit to including cyber threat intelligence analysts in adversarial threat emulation. By including indicators of emulation (IOE) based upon internal organizational attack data, CTI analysts can enrich and customize red team TTPs to specific threats the organization is currently facing. Don’t have a CTI team? Well, we have solutions for you! From pulling TTPs and IOEs out of thin air to a custom Golang C2 tool you can use to execute payloads that are relevant to your organization. Sit back, relax, and enjoy the show!

uk: вхід без авторизації

name: Red Team Village - Indicators of Emulation: Extra Spicy Adversary Emulation


uk: Комп'ютерні науки

description: This talk focus on reviewing implementation of new security features in mobile networks as well as detecting techniques and bypassing methods from red team perspective . The scope of the illustration include both radio (SDR) and signalling core network attacks. - The outline of the presentation // max 500 words One of the most complicated network is mobile telecom network. There are some segments include signalling, charging, packet data, Radio etc. Still there are many security holes that allow attackers to compromise the network and however telecom companies enable security mechanisms and put some security devices. In this talk, I will cover common high-tech security solutions used by telecom operators and and all ways to detect and after that bypass it as well as security recommendations to prevent theses activities. In this talk I will start the presentation with recent telecom abuse and related hacking news in 2019. In the next section I will cover common mobile network vulnerabilities and architecture. After that illustrate security of radio access network (RAN) and bypassing scenarios and techniques: 1. Mobile Phone Registration (IMEI policies) Bypass 2. Bypassing Unrevealed Ciphering Algorithms 3. 5G, LTE/LTE Advanced Bypass The next part of the talk will be assign to Circuit Switch network (Signaling) and the technical bypass techniques are as below: 1. Home Routing Detection 2. Bypassing Home Routing 3. Signalling Firewall Detection 4. Bypassing Signalling Firewall And at the final section I will explain security solutions to defend against these malicious techniques.

uk: вхід без авторизації

name: Red Team Village - Bypassing in Mobile Network from Red Team Points Of View


uk: Комп'ютерні науки

description: Most of us understand that it is a good idea to tailor an attack to a password policy. That being said, most password policies are fairly homogeneous. Does a minimum eight characters and at least three of four categories for complexity sound familiar? The hashcat-herders among us have prepared well for this endeavor. Many have hoarded hundreds of gigabytes of dumped passwords from hacked sites using these exact kinds of policies. Which means, when the hashes get dumped, sometimes more than half of a domain can be cracked in a single day. So… what if you have to crack passwords written under a different policy, like a paranoid 15 character minimum? Those gigabytes of dictionaries, full of shorter passwords, aren’t going to rockyou into domain admin anymore. It’s time to dive into the hashes with combinations of combinators, purple rain attacks, and word-level linguistically correct Markov chains. Along with the techniques themselves, this presentation will include the real-world results of various cracking attacks against a ~6000 person domain, at a Fortune 500 with a mature security program. As well as some recommendations for policies that allow memorable passwords while actually making them difficult to crack.

uk: вхід без авторизації

name: Red Team Village - Cracking Beyond 15 Chars, Under $500: "Greener Pastures over the Computational Wall" pr "Why xkcd Advice is Easy to Understand and Hard to Do"


uk: Комп'ютерні науки

description: Initial compromise seems to be tied to client side, but, there are several attack vectors on Web side besides a simple RCE. During this talk I will show 3 cases of getting the initial compromise through vulnerabilities found in application servers and thin clients services going from breaking authentication process, escaping controls and how to solve some challenges during exploitation of what seems an easy peasy. Objectives of this talk are : show how important is to make a good OSINT, make a good dictionary, manage escape sequences in thin client services, how to modify already developed exploits for our current target and the benefit for blue teams to have applications security integrated with infrastructure/operations security.

uk: вхід без авторизації

name: Red Team Village - Initial Compromise Through Web Side


uk: Комп'ютерні науки

description: Red team is a commonly misunderstood offensive security discipline. Red team has been used as a general term for all areas of offensive security just as blue team for defensive security. True red teaming goes Beyond Pentesting and into more adversarial emulation. While there are overlapping skills, there are differences that will be discussed as Phillip shares his experience of going from a pentester to a red teamer. In this talk, you will learn about the different areas that make up red team operations, common tools, and the path to becoming a red teamer. In this presentation, you will learn about resources helpful for a path into red teaming.

uk: вхід без авторизації

name: Red Team Village - Inside the Mind of a Threat Actor: Beyond Pentesting


Red Team Village - OU Having a Laugh?

uk: Комп'ютерні науки

description: Whether you are trying to attack or defend Active Directory, BloodHound has been the default tool for identifying attack paths. With its latest release, BloodHound3 has introduced a number of new edges including the collection of ACLs for Organizational Units. In this talk we will present a method to abuse edit rights on an OU by serving malicious Group Policy Objects in order to compromise any computer or user object that is a member of the vulnerable OU or any of its child OUs.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: In this presentation, we demonstrate several attacks that are possible by spoofing Wi-Fi beacons. These beacons are periodically broadcasted by an access point to announce the presence of a network. Our attacks include, for example, reducing the throughput of nearby devices and lowering their transmission power. In the second part of the presentation, we describe a scheme to protect Wi-Fi beacons, discuss its properties, and demonstrate its implementation in Linux.

uk: вхід без авторизації

name: Red Team Village - Protecting WiFi Beacons from Outside Forgeries


uk: Комп'ютерні науки

description: There are a million techniques out there for finding new attack surface and finding potential vulnerabilities; the problem is finding the time to run your entire methodology against all your targets. This talk will take you through finding new attack surface, performing multiple types of test against those targets, and sending real-time alerts---all on a continuous basis using automation from a cloud-based Linux host.

uk: вхід без авторизації

name: Red Team Village - Mechanizing the Methodology: How to find vulnerabilities while you're doing other things


uk: Комп'ютерні науки

description: The Bug Hunter’s Methodology is an ongoing yearly installment on the newest tools and techniques for bug hunters and red teamers. This version explores both common and lesser-known techniques to find assets for a target. The topics discussed will look at finding a targets main seed domains, subdomains, IP space, and discuss cutting edge tools and automation for each topic. By the end of this session a bug hunter or red team we will be able to discover and multiply their attack surface. We also discuss several vulnerabilities and misconfigurations related to the recon phase of assessment.

uk: вхід без авторизації

name: Red Team Village - The Bug Hunters Methodology: v4.02 Recon


uk: Комп'ютерні науки

description: Mental health is an ongoing issue within infosec before and during COVID-19. There's a fine balance between hacking and personal life. Majority of the time, they cross over. This talk shares an overview of the warning signs, symptoms, and practices to prevent burnout and how to deal with burnout to keep balanced.

uk: вхід без авторизації

name: Red Team Village - The Art of Balancing: a Burnout Talk


uk: Комп'ютерні науки

description: We've all heard of it - Kubernetes - but do you really know what it is and, more importantly, how to set it up securely? The Great Spaghetti Monster isn’t too difficult to secure if you just stop and use common sense (wait, WHAT?) security best practices. These techniques are for everyone - even those who have been playing with Kubernetes for some time. Let’s talk about Docker, baby! You have to start somewhere, and containers are the place. Next, let’s intro Kubernetes and the magic world of orchestration and what it really means to orchestrate containers. A quick recorded demo of my raspberry pi cluster will be shown here. As the brief Kubernetes demo concludes, it’s time to bring in security by demonstrating the security plug-ins and tools used. Techniques are shown for best-in-show k8s security configuration. Remember this concept - “Common Sense”? Let’s see if we can apply it with some best practices and build out the secure cluster. The focus on this is security threats to a Kubernetes cluster, containers and the apps deployed. A review of typical attack vectors in containers and Kubernetes clusters are shown with fun and exciting(?) pentesting tools specifically formulated for k8s. Now the fun begins - we have secured our cluster and our containers but how can we be sure? Let’s put our blue-skills to the test with some red-skills and pentest our cluster. It’s time to present some live security testing tools that are best suited for testing k8s. This is where the rubber meets the road, or in this case, where, wait for it —– common sense prevails!!

uk: вхід без авторизації

name: Red Team Village - Securing (and Pentesting): the Great Spaghetti Monster (k8s)


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Red Team Village - Zero Trust: a Vision for Securing Cloud


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Red Team Village - Weaponized XSS - Moving Beyond Alert (1)


uk: Комп'ютерні науки

description: A company, regardless of its size and market power, may go out of business or lose a lot of value because of a security incident on its information system. The number of vulnerabilities and the interest of cyber-attackers is only increasing. With the advent of the monetization of botnet cyber attacks or the installation of crypto-miners for example, the threats are going more varied and intensified, but less targeted. The vast majority of companies are digital and increasingly exposed on the Internet. The level of cyber exposure is also higher. The "Cyber" risk has become vital. Today, everything has changed and tomorrow everything will change even faster. Where manual analysis was sufficient, paradigms of risk assessment are moving towards more automation. But **we need intelligent automation**. This automation strategy also tends to address the drastic lack of competent cyber security resources and retention of talents. The automation of recurrent, time-consuming and low-value-added tasks will allow teams to focus on more complex and therefore more motivating topics. To efficiently support this strategy, we developed PatrOwl, an Open Source, Free and Scalable Security Operations Orchestration Platform. Technically, PatrOwl is a solution for automating calls to commercial or open source tools that perform checks. To date, more than 140 tools or online services are supported. Beyond centralizing the results (vulnerabilities, meta-data, asset metadata) obtained, the PatrOwl analysis engine compares these results with its knowledge base and other third-party services to determine scenarios of attacks (predictive analysis) or to trigger actions (alerting, program calls, ...). Largely customizable, PatrOwl is suitable for supporting penetration testing, vulnerability audit and compliance, static source audit, threat research (CTI) and security incident response activities (SOC / DFIR).

uk: вхід без авторизації

name: Red Team Village - Anticipate threats with SOC automation


uk: Комп'ютерні науки

description: In this session, we’ll discuss how Russia has influenced worldwide elections using cyberwarfare and how countries have fought back. We’ll understand the natural asymmetry between how countries are able to respond, and how they have changed their approach since 2016.

uk: вхід без авторизації

name: Red Team Village - Trust, but Verify Maintaining Democracy


uk: Комп'ютерні науки

description: Defensive techniques and tools keep getting better and therefore the creation of implants that are not detected is a harder and time consuming task every Red Team operator has to go through. Focusing on the network detection field; recent Intrusion Detection Systems (IDS) that uses new network analysis techniques can detect easily some of our handcrafted implants by analyzing connection fingerprints from both client and server side. In some environments , techniques like Deep Packet Inspection can map our implants to possible threats to be addressed. In this talk, I provide solutions that can be used on implants; a modified TLS Go package that allows circumventing tools like JA3 by providing desired fingerprints that will help to mimic rightful client software, egression to Gmail servers and techniques like steganography/encryption to hide obvious payloads. All these ideas are tailored into a new network modules for the Siesta Time Framework, to help to automate the creation of desired Implants. As a finale, possible new defensive techniques to improve tools like JA3 will be explained.

uk: вхід без авторизації

name: Red Team Village - Total E(A)gression: Evading IDS stealthier Implants


uk: Комп'ютерні науки

description: Back in 2018, Financial entities in Mexico were hit by one of the biggest cybersecurity breaches in the history of Mexico, and in 2019 "The Bandidos Hacker Team", who allegedly committed the crime, were captured. But do you really need to be a 1337 H4x0r to compromise those systems? In this talk, I will be sharing (from a Red Team Perspective) How I was compromising the SWIFT, SPID, and SPEI systems in a Financial Institution until I gained root access to all the systems using basic hacking techniques like the pretty good old 1337 days. For the blue teamers, I will be sharing ways to detect these techniques that, although may appear simple, they pose a very challenging scenario to create a detection.

uk: вхід без авторизації

name: Red Team Village - How to hack SWIFT, SPID, and SPEI with basic hacking techniques (from a RED TEAM Perspective)


uk: Комп'ютерні науки

description: The FAA launched the Privacy ICAO Address (PIA) program in January 2020 to address privacy concerns in General Aviation in the United States. This talk will present an analysis on the privacy performance of this program in its current state and our predictions for the future. We will demonstrate that it is possible to identify aircraft despite being enrolled in the program, using ADS-B data from crowdsourced networks. The privacy loss of participating aircraft over time is quantified through a purpose-built privacy simulator, showing that tracking is possible, even with a much greater participation in the program in the future. To address these issues, we will present two solutions that could significantly improve the privacy of the PIA program going forward.

uk: вхід без авторизації

name: Aerospace Village - Break down of the US Attempt to General Aviation Privacy


uk: Комп'ютерні науки

description: Across the Aviation Ecosystem, there is an increased effort to collaborate and coordinate to protect Information Technology (IT) and Operational Technology (OT) systems at airports, airlines, aviation management, and manufacturers and vendors via the supply chain. This diverse panel will share their insights and current activities between government, industry, and the security research community. Learn how you can participate in and ensure the safety and security of the Aviation Ecosystem

uk: вхід без авторизації

name: Aerospace Village - Building Connections Across the Aviation Ecosystem


uk: Комп'ютерні науки

description: Aerospace is changing – Its digital transformation must now be synonymous with being cyber secure. In-cabin systems are looking more like your everyday living room and the numerous potential entry points must be tested for security. During this session we will take you through the offensive testing that we put systems through to show you what is happening to improve the life cycle of aviation systems thanks to cybersecurity-by-design principles influenced by a hack/fix process. From design to operation, blue teams and red teams are working together for a first line of defense to help identify vulnerabilities and ensure more robust and resilient systems – systems which we all rely on, and must be certified by Airworthiness Authorities when safety is at stake. Join Nathalie Feyt, Lawrence Rowell and Yannick Le Ray as they lead a presentation on securing avionics, passenger systems, and air traffic management systems, and show how industry designs, attacks, learns and improves aerospace systems.

uk: вхід без авторизації

name: Aerospace Village - Critical Aerospace Cybersecurity: A changing paradigm and how you can help


uk: Комп'ютерні науки

description: A multitude of wireless technologies are used within air traffic communication. From a conceptual perspective, all of them are insecure as confidentiality was never part of their design and they could not keep up with the change in threat models. This talk analyzes the current state of wireless privacy in aviation, covering air traffic control and datalink communication. We show how combining publicly available data sources enables global tracking of every aircraft for anyone interested. In particular, we present various case studies to demonstrate how anyone can undermine the privacy of military, governmental and corporate operators. Finally, we look at some industry responses and illustrate the futility of the current attempts to maintain privacy for aircraft owners in a world of ubiquitous sensor surveillance.

uk: вхід без авторизації

name: Aerospace Village - Dissecting Wireless Privacy in Aviation


uk: Комп'ютерні науки

description: Researchers have been crafting attacks on aviation systems for almost a decade now, on wireless technologies like ADS-B and ACARS to In Flight Entertainment (IFE) devices. Many attacks seek to affect what the pilots see or how the aircraft is flown. Although we can work out what should happen in theory, does this translate to practice? In this talk, we describe how we investigated this using a flight simulator and 30 type-rated commercial pilots. In particular, we will discuss: - What happens when your aircraft thinks you are on collision course - but nothing is there, - How pilots respond when landing guidance puts you at the wrong end of the runway (i.e. the reverse Die Hard), - Can attackers push flight crew into switching systems off?

uk: вхід без авторизації

name: Aerospace Village - A view from the cockpit: Exploiting Pilot Reactions to Attacks on Avionic Systems


Aerospace Village - GPS Spoofing 101

uk: Комп'ютерні науки

description: With the advent of autonomous cyber-physical systems such as self-driving cars and unmanned aerial vehicles, the use of Global Positioning System (GPS) for positioning and navigation has become ubiquitous. In recent years we have seen a lot of GPS "incidents" which involve either denial of services or spoofing to mislead the receiver. This workshop will include the basics of GPS spoofing with a hands-on exercise and a discussion of state-of-the-art spoofing mitigation techniques

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This will be a tour of an end of life 747 airframe, covering a 101 of the cockpit systems and avionics bays. We will also be explaining the various systems & threat surfaces.

uk: вхід без авторизації

name: Aerospace Village - 747-400 Walkthrough From a Hacker's Perspective


uk: Комп'ютерні науки

description: Modern aircraft heavily rely on several wireless technologies for communications control and navigation. Researchers demonstrated vulnerabilities in many aviation systems e.g., spoofing ILS signals to disrupt the landing, injecting ghost aircraft into airspace, spoof locations, and manipulate key communication messages. This presentation will give the viewers a better understanding of the fundamental problems associated with these critical systems and what makes spoofing attacks possible

uk: вхід без авторизації

name: Aerospace Village - A Deeper Dive into ILS and ADS-B Spoofing


uk: Комп'ютерні науки

description: Modern aircrafts are heavily relied on flight management systems to automate a wide variety of in-flight tasks, including producing flight plans, reducing the workload on the pilot, or allow the airplane to hook up the autopilot. Vulnerabilities in such systems could allow an attacker to manipulate critical data that are important during a flight. In this talk, we will present the result of our research on the security of a famous flight management system and how we managed to detect a weakness in its security mechanism using reverse engineering. Then we will discuss possible risk scenarios regarding manipulation of mentioned critical data. During this research, we have found a method to modify the navigation data on a flight management computer and also identified some risk scenarios that we think could cause some problems. We hope this may lead to future research and make the aviation industry more secure.

uk: вхід без авторизації

name: Aerospace Village - Attacking Flight Management Systems: This is your captain speaking, We have a small Problem!


uk: Комп'ютерні науки

description: Cybersecurity vulnerabilities are ever present in IT and OT systems and the aerospace sector is not exempt from these findings. What should a researcher or vendor do when they find a vulnerability? This is a common question but can have many and variety complex answers. Showing how a few simple steps by each participant in the process of coordinated disclosure can decrease the stress of the efforts and result in trust among researchers and a more resilient aviation sector. Major points will focus on: - What researchers should be doing in preparation of disclosure. - When a researcher should be looking for help with coordination. - Questions vendor should be asking in preparation of a public disclosure. - Each disclosure is a unique event and should be leveraged to build upon.

uk: вхід без авторизації

name: Aerospace Village - Checklist for Aviation Vulnerability Disclosure: Don't go it alone


uk: Комп'ютерні науки

description: This presentation will describe the high-level cyber threat landscape for space systems and focus on three examples: Command Replay Attack, Command Link Intrusion, and Denial of Service using GPS jamming. These three attacks were performed using high fidelity ground-to-space simulators to demonstrate the benefit of performing such research using simulation. These simulations leverage many of the same software components used in operations today for several operational missions. Recommendations are provided on how to protect against the attacks and references are provided so the audience can build their own simulations to begin their own research.

uk: вхід без авторизації

name: Aerospace Village - Exploiting Spacecraft


uk: Комп'ютерні науки

description: The aerospace industry is highly regulated with a great deal of focus on cybersecurity. Other sectors have seen how good faith hackers and researchers can help increase resilience and highlight vulnerability – how best to do that in a highly regulated, safety critical industry like aerospace? Aerospace regulators have a key role in understanding risk and putting in place the legal frameworks and creating rules, regulations and best practice around good faith research, join us on a panel with the research community and aerospace regulators to chat about what where we are and what we need to do.

uk: вхід без авторизації

name: Aerospace Village - Hacking Aerospace Cybersecurity Regulation


uk: Комп'ютерні науки

description: One of the most important parts of avionic systems is the communication. Airplanes use mobile communication to connect to stations on the ground. In many cases the connection is based on LTE-Advanced technology and in some cases when an airplane is on the seas or somewhere else that there is no base station on the ground, It uses the satellite as a hub. In this presentation I will explain vulnerabilities and ways to take advantage of A2G systems and other avionic components.

uk: вхід без авторизації

name: Aerospace Village - Hacking Airplane, A2G Systems


uk: Комп'ютерні науки

description: We'll go through what ACARS is, its roots in Telex, through to how it's implemented and used in modern airline operations today over VHF, HF, and SATCOM. We'll talk about how to setup your own ACARS receiver using an RTL-SDR and do a live demo of capturing real ACARS transmissions and attempt to decode what those messages are about. Then we'll take a thought experiment on how potentially malicious transmissions could be made to affect the aircraft. There will also be a discussion around how ACARS is used in modern CPDLC air traffic to pilot data links, instead of voice communications and how these could be vulnerable, and a brief look at SELCAL which reduces the need for pilots to monitor the radio. Lastly we'll look at the future of ACARS over IP and how this will integrate with modern e-enabled aircraft.

uk: вхід без авторизації

name: Aerospace Village - Introduction to ACARS


uk: Комп'ютерні науки

description: The objective of the talk is to give an overview of the latest development in OpenSky Network – recording Air Traffic Control ATC voice communications. As the receiver-feeder system will be developed within ATCO2 project, an undertaking financed by the European Union, a short overview of the ATCO2 project will be given. The central question covered in this first part of the talk is: “What will happen with the voice recording after it’s uploaded to OpenSky Network?” The main part of the talk will focus on how to set up the receiver which is built around RTLSDR-Airband - an open source multichannel AM/NFM receiver (more about it here: https://github.com/szpajder/RTLSDR-Airband/wiki). Participants are encouraged to take an active role during the workshop and set up the receiver during the talk. In order to do that, listeners should make sure they have the following items available: - Raspberry Pi (any version should work). - SDR-RTL dongle (RTL-SDR Blog R820T2 RTL2832U 1PPM TCXO SMA Software Defined Radio with Dipole Antenna Kit available from https://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/ as includes antenna and antenna cables). - SD card (with memory of 16GB is sufficient)

uk: вхід без авторизації

name: Aerospace Village - Low Cost VHF Receiver: Eavesdropping Pilot/ Controller Communications


uk: Комп'ютерні науки

description: Opening Remarks

uk: вхід без авторизації

name: Aerospace Village - Opening Remarks: Getting the Aerospace - Village to take-off


uk: Комп'ютерні науки

description: The Aviation industry has always focused on safety and with the advent of the e-enabled aircraft must now also contend with cybersecurity threats. Malicious intent via cyber means is a new area of concern that needs to be accounted for during airplane design, development, and verification. This talk will provide an overview of Boeing's Secure Airplane Development Lifecycle and activities that the Commercial Airplane, Product Security organization has undertaken to enhance the cyber resiliency of commercial aircraft.

uk: вхід без авторизації

name: Aerospace Village - Product Cybersecurity: Secure Airplane Development Lifecycle


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Aerospace Village - Software-Defined Radios for Aerospace Cyber: An Introduction for Radion Frequency NOOBS abd Other Smart Folks


uk: Комп'ютерні науки

description: Space Situational Awareness Data (SSA) is the lifeblood of responsible spaceflight. With tens of thousands of debris objects in orbit, knowing where and when collisions may occur is key to preventing lasting environmental harm. However, SSA data collection is inordinately complex, creating natural incentives for centralized information sharing. When actors lack the capability to independently monitor the state of orbit, they find themselves forced to trust third parties. In this talk, we consider how a sufficiently motivated attacker might modify SSA repositories to deliberately conceal or falsify collision projections to influence the behaviors of satellite owners. In addition to a high-level discussion of the relevant threat model, we will present simulated implementations of these attacks. We will also briefly consider various mitigation techniques which can be employed by both SSA operators and data recipients against such attacks. This talk will touch on basic principles of orbital dynamics and spaceflight operations but assumes no prior background in physics. It is intended to serve as starting point for those interested in how the physical dynamics of outer space can manifest as unique security challenges.

uk: вхід без авторизації

name: Aerospace Village - Trust and Truth in Space Situational Awareness (SSA)


uk: Комп'ютерні науки

description: As part of work looking at avionics security, we reverse-engineered two Communication Management Units used on 737s, and they are engineered unlike any other embedded system I’ve seen. CMUs must be certified to a high Design Assurance Level, but airlines typically want to add custom airline operations applications. This talk explores how these seemingly incompatible requirements are met in two very different ways, and takes a deep dive into how the CMUs work.

uk: вхід без авторизації

name: Aerospace Village - Inside the 737 Communications Management Unit: A case study on Building Extensible, High - Assurance Systems


uk: Комп'ютерні науки

description: Check-in software glitches, payment system data breaches, gate signage ransomware attacks... Airports are an interconnected, mini-smart city of retail, dining, infrastructure, and transportation logistics operated by a hodgepodge of business interests + federal, state, and local entities and agencies. Join an interactive adventure as a passenger navigating the airport to catch a flight before hackers cause chaos, highlighting security pitfalls and risks all based on publicly disclosed incidents.

uk: вхід без авторизації

name: Aerospace Village - Ticketing to Takeoff: An Airport Hacking Choose Your Own Adventure


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Blockchain Village - Building a Microcontroller Bitcoin Address Generator


uk: Комп'ютерні науки

description: This exciting, fast-paced course delivers the "big picture" of space missions from cradle to grave. Understanding Space is the ideal course for technical or non-technical professionals new to the space industry or who need a refresher on the fundamentals. Learning outcomes will be: - Gain Core Space Knowledge - Comprehend space mission Capabilities, Trade-offs and Limitations - Apply Space Concepts to real-world problems - Analyze Typical Space Problems - Synthesize concepts to Design a Space Mission - Evaluate basic technical and programmatic space issues This will be a half-day course instead of the normal 2-day course.

uk: вхід без авторизації

name: Aerospace Village - Understanding Space: Through a Cybersecurity Lens


uk: Комп'ютерні науки

description: Reaching out into space may seem like it would require a PhD and thousands of dollars of equipment, but it can actually be done for about $100. In this talk I will detail how to get started talking to satellites using basic equipment. With just a Ham Radio license and some gear, you too can talk to satellites and by extension people thousands of miles away.

uk: вхід без авторизації

name: Aerospace Village - Talking to Satellites


uk: Комп'ютерні науки

description: I intend on delivering an overview of the following: Systems which interact with the AISD highlighting to operators the importance of cybersecurity in this network domain of aircraft. ARINC 821 Electronic Flight Bags Ground systems PKI used Flight Attendant Panels Maintenance terminals Threats to the AISD and where I feel security concerns exist. I will NOT discuss any vulnerabilities i may or may not have discovered but are there any other topics related to the AISD you would like me to include? I am especially interested to hear from operators and their feedback.

uk: вхід без авторизації

name: Aerospace Village - MITM - The Mystery in the Middle: An introduction to the aircraft information systems domain (AISD)


Aerospace Village - Hackers and ISACs

uk: Комп'ютерні науки

description: Across the aerospace sector, good faith research has a key role in highlighting both risks and vulnerabilities but it hasn’t always been welcomed with open arms. ISACs are often seen as a key point of contact for researchers and hackers doing this work but how best do we create relationships across hackers and ISACs to learn the lessons of the past and build the trust that we need?

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Software development for aviation is highly regulated, and process driven. The current processes, as defined in DO-178C and related standards, originate from a history of designing and testing mechanical components. In the past you designed a part and once installed it only had to be monitored for physical condition. It was assumed that maintenance procedures would be able to identify which components are in flight condition and which are not. But now that there are USB ports and iPads in the cockpit, do these previous assumptions remain valid? How can we ensure that flight systems are not compromised after being installed? What can be done to help ensure aviation systems are secure? There are 4 primary areas of concern on a modern aircraft: Maintenance interfaces - What is necessary to ensure that software communicating with the aircraft is correct and operates in a secure manner? Passenger interfaces - What is necessary to ensure that systems passengers interact with cannot interfere with the aircraft operation? Crew accessible interfaces - What is necessary to ensure that the crew cannot accidentally connect a malicious device to flight systems? Pre-flight software validation - Is there a procedure that could be used to ensure that the software running on aircraft systems is 100% correct and unmodified?

uk: вхід без авторизації

name: Aerospace Village - Cybersecurity meets Aviation Regulation


uk: Комп'ютерні науки

description: Space is incredibly important in our daily lives – providing the GPS navigation on our phone and in our financial system, national security communications throughout the world, and remote sensing of weather conditions and other indicators of the health of the Earth. We’ve had a very complacent attitude about our satellites because physical access has been impossible. Now we know our key infrastructure is at threat on the ground, and it is in space as well from both physical and cyber threats. There are many important lessons to be learned about the software approach to human space flight and its high standards for software error rate and redundancy, tiered levels of access, distributed architecture, command protocols, and there are mistakes to learn from as well. The space industry is changing very rapidly. With commercial space stations, lunar exploration, and nation states competing for achievements – and resources – in space, we must understand the implications and prepare for the challenges ahead. Pam Melroy - is a retired US Air Force test pilot and former NASA astronaut and Space Shuttle commander. After NASA she worked at Lockheed Martin on the Orion lunar exploration vehicle program, the Federal Aviation Administration’s Office of Commercial Space Transportation, and at DARPA. She is now an independent consultant and advisor.

uk: вхід без авторизації

name: Aerospace Village - Cybersecurity Lessons Learned from Human Spaceflight


uk: Комп'ютерні науки

description: The Deep Space Networking workshop in the Aerospace Village at DEFCON Safe Mode will challenge your ability to investigate and find important data within complicated technological communications. Trace file provided by Vint Cerf from the original test lab for Delay and Disruption Tolerant Networking. (DTN)!! Presented by Laura Chappell, Chappell University.

uk: вхід без авторизації

name: Aerospace Village - Deep Space Networking: Analysis of tcpcl_we2ereceipt.pcap


uk: Комп'ютерні науки

description: The Aerospace Village will be hosting Eric Escobar’s workshop on building your own CubeSat simulator at DEF CON 28 online. The goal of this workshop would be to construct a “CubeSat Simulator Lite.” We will run through software installation via a screensharing, and will show participants how to setup a Raspberry Pi, set up the device, install the necessary packages, attach a necessary antenna, and view the transmitted data using a software defined radio.

uk: вхід без авторизації

name: Aerospace Village - Workshop - Simulated Satellite Communications on Raspberry Pi


uk: Комп'ютерні науки

description: This talk will cover a hacker’s perspective of building your own aircraft, what I consider to be the ultimate maker/hacker project. Over 10 years ago, I decided to see if I could build an aircraft from a set of plans. The model I chose was a 4 seat AeroCanard FG, a somewhat controversial derivative of the Cozy Mark IV. The Cozy itself was also a derivative, basically a widened version of the Burt Rutan designed Long EZ. This talk will cover why someone would choose to build their own aircraft. All of these topics will cover the risk as I see it as a professional who has been in the information risk field his entire professional career. - I will break this talk down into the following topics. - FAA and the 51% rule - Plans vs Kits - Composite vs riveted aluminum construction - Making changes to tested designs - Engine selection, aviation engines vs conversions - Avionics selection I will complete the talk with some discussion around becoming a test pilot, what you will become when you finally fly your creation. Patrick Kiley (GXPN, GPEN, GAWN, GCIH, CISSP, MCSE) has over 18 years of information security experience working with both private sector employers and the Department of Energy/National Nuclear Security Administration (NNSA). While he was with the NNSA he built the NNSA's SOC and spent several years working for emergency teams. Patrick has performed research in Avionics security and Internet connected transportation platforms. Patrick has experience in all aspects of penetration testing, security engineering, hardware hacking, IoT, Autonomous Vehicles and CAN bus.

uk: вхід без авторизації

name: Aerospace Village - Experimental Aviation: Risks and Rewards


uk: Комп'ютерні науки

description: The Traffic Alert & Collision Avoidance System or TCAS was first developed in the early 1980s using transponders on aircraft to interrogate other aircraft within a set range about their distance, altitude, and heading. If a collision course is detected and the aircraft is suitably equipped, a TCAS alert will be sounded. In certain autopilot modes (mostly on Airbus), the aircraft will automatically follow the TCAS Resolution Advisory and climb or descend with no input from the pilot.Others have shown that it’s possible to create fake TCAS traffic. We’ve taken this further and investigated how airplanes equipped with autopilots capable of flying a resolution advisory themselves would respond in certain scenarios.

uk: вхід без авторизації

name: Aerospace Village - TCAS and ILS Spoofing Demonstration


uk: Комп'ютерні науки

description: Satellite Orbits 101 will provide an introductory understanding of the orbit of satellites/space vehicles. Leveraging knowledge, experience and visualization tools designed to describe and present orbital behaviors; the presentation will cover introductions to an array of orbital topics including what it even takes to reach and maintain orbit; which launch sites and windows are as important as they are; altitude classifications, such as HEO and LEO; directional classifications; inclination classifications, eccentricity classifications and more. The overlaps and interactions of these topics will also be discussed, as for example a satellite launched from near the equator and destined for a low-inclination orbit could receive help in reaching orbit from the rotation of the earth itself, but how this is not true for satellites bound for high inclination orbits. An attendee will walk away layman’s introductory demystification of just how many layers are beneath the phrase Satellite Orbit. With a degree in Electrical and Computer Engineering at the undergraduate level and Computer Information Systems Engineering with concentrations in Networks and Cyber Security at the Graduate level; Matthew Murray has spent the last twelve of a twenty year career supporting aerospace, cyber and software engineering contracts with Lockheed Martin. His industry knowledge and expertise includes infrastructure hardware, software/hardware interfaces, software development, networking and cyber security. Throughout his career he has gained an in-depth understanding of an array of disciplines and technologies that include satellite orbits and the software development techniques tied to them.

uk: вхід без авторизації

name: Aerospace Village - Satellite Orbits 101: An introduction to the fundamentals


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
introduction
Goidelic languages
Archaic Irish
Middle Irish
Primitive Irish
Irish history

de: Allgemeine und vergleichende Literatur- und Sprachwissenschaft

uk: Загальне та порівняльне літературознавство та мовознавство

en: General and Comparative Literary Studies and Linguistics

uk: Гуманітарні науки

description: Introduction to the history of the Irish language.

uk: вхід без авторизації

name: Old Irish – Introduction, Part 1: History of the Irish Language

Georg-August-Universität Göttingen

addressLocality: Göttingen

addressRegion: Lower Saxony


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
introduction
Goidelic languages
writing
ogham script
Latin alphabet
Irish alphabet
Irish manuscripts

uk: Гуманітарні науки

description: Introduction to written forms of Old Irish. The topics of this lecture are the ogham script of the Primitive Irish inscriptions, as well as the latinate script used in later Old Irish manuscripts.

uk: вхід без авторизації

name: Old Irish – Introduction, Part 2: Writing in Ireland


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
introduction
Goidelic languages
writing
language contact
Irish history

uk: Гуманітарні науки

description: The topics of this lecture are the linguistic contacts of Irish with other languages and the secondary literature on the Old Irish language.

uk: вхід без авторизації

name: Old Irish – Introduction, Part 3: Influence and Handbooks


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
phonology
segmental phonology
vowels
consonants
phonemes
diphthongs

uk: Гуманітарні науки

description: Introduction to the phonological system of Old Irish

uk: вхід без авторизації

name: Old Irish - Phonology, Part 1: Segmental Phonology


Old Irish – Phonology, Part 2: Spelling

keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
phonology
spelling
consonants
vowels
palatalisation

uk: Гуманітарні науки

description: Introduction to the spelling rules of Old Irish.

uk: вхід без авторизації


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
phonology
morphophonemics
consonants
vowels
mutations
palatalisation
syncope
stress
metaphony

uk: Гуманітарні науки

description: Introduction to the morphophonemics of Old Irish. This lecture deals with the topics of stress, palatalisation, metaphony and mutations.

uk: вхід без авторизації

name: Old Irish – Phonology, Part 3: Morphophonemics


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
morphology
nominal morphology
noun inflection
word formation
inflectional morphology

uk: Гуманітарні науки

description: Introduction to the morphological categories of nouns in Old Irish.

uk: вхід без авторизації

name: Old Irish – Morphology, Part 1: Nominal Morphology


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
morphology
verbal morphology
verb avoidance
preverbs
simple verbs
compound verbs

uk: Гуманітарні науки

description: Introduction to the morphology of the verbal complex of Old Irish.

uk: вхід без авторизації

name: Old Irish – Morphology, Part 2: The Verbal Complex


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
morphology
verbal morphology
tense
aspect
mood

uk: Гуманітарні науки

description: Introduction to the verbal categories of Old Irish. This lecture deals e.g. with the categories of tense, aspect, mood, and voice.

uk: вхід без авторизації

name: Old Irish – Morphology, Part 3: Verbal Categories and Dimensions


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
morphology
verbal morphology
stem formation
tense
mood
root modifications
suffixal stem formation

de: Geowissenschaften (ohne Geographie)

uk: Науки про Землю(крім географії)

en: Geosciences (excl. Geography)

de: Mathematik, Naturwissenschaften

uk: Математика, природничі науки

en: Mathematics, Natural Sciences

uk: Гуманітарні науки

description: Introduction to the formation of verbal stems in Old Irish.

uk: вхід без авторизації

name: Old Irish – Morphology, Part 4: Verbal Stem Formation


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
syntax
morphosyntax
typology
pronouns
head marking
Irish literature
text sample
Táin bó Froích

uk: Гуманітарні науки

description: This lecture is a continuation of the "Morphosyntactic Structures, Part 1" video. It features a text sample from the Táin bó Froích.

uk: вхід без авторизації

name: Old Irish – Morphosyntactic Structures, Part 1: Text sample: Táin bó Froích 7–12


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
syntax
morphosyntax
typology
pronouns
head marking

uk: Науки про Землю(крім географії)

uk: Математика, природничі науки

uk: Гуманітарні науки

description: Introduction to the morphosyntactic structures and typological characterisation of Old Irish.

uk: вхід без авторизації

name: Old Irish – Morphosyntactic Structures, Part 1


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
syntax
morphosyntax
word classes
noun clauses
prepositional phrases
Táin bó Froích
Irish literature

uk: Гуманітарні науки

description: This lecture is a continuation of the "Morphosyntactic Structures, Part 2" video. It features text samples from the Táin bó Froích.

uk: вхід без авторизації

name: Old Irish – Morphosyntactic Structures, Part 2: Text Sample: Táin bó Froích 41–43, 61–62, 64–65, 68–70


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
syntax
morphosyntax
word classes
noun clauses
prepositional phrases

uk: Гуманітарні науки

description: Overview of the word classes of Old Irish, with a discussion of the structure of noun clauses and prepositional phrases.

uk: вхід без авторизації

name: Old Irish – Morphosyntactic Structures, Part 2


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
syntax
morphosyntax
verb phrases
finite verbs
infinite verbs
alignment
semantic roles
voice
valency
Irish literature
Táin bó Froích

uk: Гуманітарні науки

description: This lecture is a continuation of the "Morphosyntactic Structures, Part 3" video. It features a text sample from the Táin bó Froích.

uk: вхід без авторизації

name: Old Irish – Morphosyntactic Structures, Part 3: Text Sample: Táin bó Froích 136–145


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
syntax
morphosyntax
verb phrases
finite verbs
infinite verbs
alignment
semantic roles
voice
valency

uk: Гуманітарні науки

description: This lecture covers various morphosyntactic categories of verbs in Old Irish. It includes a treatemnt of the structure of verbal phrases, morphosyntactic alignment, voice, and valency.

uk: вхід без авторизації

name: Old Irish – Morphosyntactic Structures, Part 3


keywords:
Old Irish
Irish
Indo-European studies
Celtic languages
linguistics
Indo-European linguistics
Goidelic languages
syntax
morphosyntax
tense
aspect
mood
negation
clause structure
word order
information structure
Irish literature
Táin bó Froích

uk: Гуманітарні науки

description: This lecture is a continuation of the "Morphosyntactic Structures, Part 4" video. It features a text sample from the Táin bó Froích.

uk: вхід без авторизації

name: Old Irish – Morphosyntactic structures, Part 4: Text Sample: Táin bó Froích 204–205