uk: Комп'ютерні науки

description: MikroTik routers keep getting owned. They’ve been exploited by advanced threats like VPNFilter, Slingshot APT, and Trickbot. They’ve been compromised by coin miners, botnets, and who knows what else. With each new campaign the security industry publishes new indicators of compromise and everyone moves on. However, MikroTik administrators operate in a sandbox. They have very limited access to the router’s underlying file system and almost no ability to directly interact with the Linux operating system. Due to these limitations, file hashes cannot answer the fundamental question that is asked again and again on the MikroTik forums, “Have I been compromised?” It’s time the users had their question answered. In this talk, I’ll present three vulnerabilities that can help MikroTik administrators break out of the sandbox. I’ll show how to use these vulnerabilities to help determine if the router has been compromised. Jacob Baines Jacob is the founding member of Tenable's Zero Day Research group. He focuses much of his research efforts on routers and other IoT devices. Sometimes he even finds vulnerabilities.

uk: вхід без авторизації

name: Help Me Vulnerabilities You're My Only Hope


Jatin Kataria

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: First commercially introduced in 2013, Cisco Trust Anchor module(TAm) is a proprietary hardware security module that is used in a wide range of Cisco products, including enterprise routers, switches and firewalls. TAm is the foundational root of trust that underpins all other Cisco security and trustworthy computing mechanisms in such devices. We disclose two 0-day vulnerabilities and show a remotely exploitable attack chain that reliably bypasses Cisco Trust Anchor. We present an in-depth analysis of the TAm, from both theoretical and applied perspectives. We present a series of architectural and practical flaws of TAm, describe theoretical methods of attack against such flaws. Next, we enumerate limitations in current state-of-the-art offensive capabilities that made the design of TAm seem secure. Using Cisco 1001-X series of Trust Anchor enabled routers as a demonstrative platform, we present a detailed analysis of a current implementation of TAm, including results obtained through hardware reverse engineering, Trust Anchor FPGA bitstream analysis, and the reverse engineering of numerous Cisco trustworthy computing mechanisms that depend on TAm. Finally, we present two 0-day vulnerabilities within Cisco IOS and TAm and demonstrate a remotely exploitable attack chain that results in persistent compromise of an up-to-date Cisco router. We discuss the implementation of our TAm bypass, which involves novel methods of reliably manipulating FPGA functionality through bitstream analysis and modification while circumventing the need to perform RTL reconstruction. The use of our methods of manipulation creates numerous possibilities in the exploitation of embedded systems that use FPGAs. While this presentation focuses on the use of our FPGA manipulation techniques in the context of Cisco Trust Anchor, we briefly discuss other uses of our bitstream modification techniques. Jatin Kataria Jatin Kataria is the Principal Research Scientist at Red Balloon Security where he architects defensive technologies for embedded systems. Playing both the role of cat and of mouse at Red Balloon has many suggesting that he may be the first real source of perpetual energy. He tires of n-days easily and is always looking for new and exciting ELF shenanigans, caching complications, and the Fedex guy who lost his engagement ring. Prior to his time at Red Balloon Security, Jatin worked at a number of firms as a systems software developer and earned his Master of Engineering at Columbia University. Rick Housley Rick Housley is a Research Scientist at Red Balloon Security and leads their advanced hardware reverse engineering efforts. He often finds himself at the end of a soldering iron hoping he has not bricked another expensive COTs product. His focus at Red Balloon includes the discovery of previously unknown vulnerabilities, novel firmware extraction techniques, and advanced physical reverse engineering using custom tooling. When not designing secure-boot defeating EMPs and interposers, he is building axe handles and baby rattles in his woodshop. Ang Cui Dr. Ang Cui is the Founder and Chief Scientist of Red Balloon Security. Dr. Cui received his PhD from Columbia University in 2015. His doctoral dissertation, titled ”Embedded System Security: A Software-based Approach”, focused exclusively on scientific inquiries concerning the exploitation and defense embedded systems. Ang has focused on developing new technologies to defend embedded systems against exploitation. During the course of his research, he has uncovered a number of serious vulnerabilities within ubiquitous embedded devices like Cisco routers, HP printers and Cisco IP phones. Dr. Cui is also the author of FRAK and the inventor of Software Symbiote technology. Ang has received various awards on his work on reverse engineering commercial devices and is also the recipient of the Symantec Graduate Fellowship and was selected as a DARPA Riser in 2015.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: 100 seconds of Solitude Defeating Cisco Trust Anchor

DEF CON

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Комп'ютерні науки

description: Configuration Management (CM) tools are used to provision systems in a uniform manner. CM servers are prime targets for exploitation because they are connected with key machines. The tools themselves are powerful from a security standpoint: they allow an attacker to run commands on any and every connected system. Unfortunately, many security professionals do not have CM experience, which prevents them from using these tools effectively. MOSE empowers the user to weaponize an organization’s CM tools without having to worry about implementation-specific details. MOSE first creates a binary based on user input. Once transferred to the CM server and run, this binary dynamically generates code that carries out the desired malicious behavior on specified systems. This behavior can include running arbitrary system commands, creating or deleting files, and introducing backdoors. MOSE puts the generated code in the proper place so that all targeted systems will run it on their next check-in with the server, removing the need for the user to integrate it manually. CM tools are a powerful resource, but they have a barrier to entry. MOSE aims to remove this barrier and make post exploitation more approachable by providing a tool to translate the attacker's desired task into commands executable by the CM infrastructure. Jayson Grace Jayson Grace is a Penetration Tester on the Product Security Team at Splunk. Previously he founded and led the Corporate Red Team at Sandia National Laboratories. He holds a BS in Computer Science from the University of New Mexico, which gave him some great knowledge and also made him fatter and added a bunch of grey hairs. He has also previously worked as a tool developer, system administrator, and DevOps engineer. Jayson is passionate about empowering engineers to create secure applications, as well as coming up with novel automation methods to break things

uk: вхід без авторизації

name: MOSE Using Configuration Management for Evil


uk: Комп'ютерні науки

description: eBPF (or "extended" Berkeley Packet Filter) is a bytecode instruction set and virtual machine used as a safe computing environment within the Linux kernel to perform arbitrary programmatic actions. It is a redesign of Linux's original in-kernel BPF bytecode VM used to power features like tcpdump filters. eBPF has an entirely different set of capabilities and instructions, with its primary goal being to serve as a JIT-able virtual machine instruction set that can be targeted by compilers of a memory-safe "restricted C" language. In the Linux kernel, it is actively being applied to anything and everything to provide performant programmatic capabilities to userland that extend traditionally kernel-based functionality. In this exploit development focused talk, we will first introduce eBPF and discuss several nefarious techniques enabled by the technology. As we do so, we will cover the respective sets of APIs, file descriptor types, and other eBPF machinery that enable such techniques, building up from various forms of hidden IPC channels to full-fledged rootkits. Within this talk, we will walk through the implementations of the techniques we discuss so that attendees will walk away with the knowledge of how to implement their own variants. Along the way we will discuss novel container breakout techniques and interesting "dual-purpose" eBPF features that enable the development of mutative syscall hooks that work for processes that work for processes already attached by a debugger. Finally, we will provide insight on how defenders should begin to attempt to detect and recover from such abuses, when possible at all. This presentation significantly extends on work we first presented at 35C3, which focused more heavily on the underlying aspects of general eBPF-based kernel tracing. In contrast, this talk will demo new techniques and include substantially improved versions of techniques presented previously as proofs-of-concept. Jeff Dileo Jeff Dileo (chaosdata) is a security consultant by day, and sometimes by night. He hacks on embedded systems, mobile apps and devices, web apps, and complicated things that don't have names. He likes candy and arguing about text editors and window managers he doesn't actually use.

uk: вхід без авторизації

name: Evil eBPF: Practical Abuses of In-Kernel Bytecode Runtime


uk: Комп'ютерні науки

description: We show practical attacks against OpenPGP and S/MIME encryption and digital signatures in the context of email. Instead of targeting the underlying cryptographic primitives, our attacks abuse legitimate features of the MIME standard and HTML, as supported by email clients, to deceive the user regarding the actual message content. We demonstrate how the attacker can unknowingly abuse the user as a decryption oracle by replying to an unsuspicious looking email. Using this technique, the plaintext of hundreds of encrypted emails can be leaked at once. Furthermore, we show how users could be tricked into signing arbitrary text by replying to emails containing CSS conditional rules. An evaluation shows that 17 out of 19 OpenPGP-capable email clients, as well as 21 out of 22 clients supporting S/MIME, are vulnerable to at least one attack. We provide different countermeasures and discuss their advantages and disadvantages Jens Müller Jens Müller is a PhD student at the Chair for Network and Data Security, Ruhr University Bochum, Germany. His research interests are legacy protocols and data formats, for which he loves to investigate what could possibly go wrong in a modern world. He has experience as a speaker on international security conferences (BlackHat, IEEE S&P, OWASP) and as a freelancer in network penetration testing and security auditing. Besides breaking thinks, he develops free open source software, for example, tools related to network printer exploit^H^H^H^H^H^H^H, um, "debugging".

uk: вхід без авторизації

name: Re: What's up, Johnny?: Covert Attacks on Email End-to-End Encryption


Get Off the Kernel if You Can't Drive

uk: Комп'ютерні науки

description: For software to communicate with hardware, it needs to talk to a kernel-mode driver that serves as a middle-man between the two, helping to make sure everything operates as it should. In Windows that is done using the Kernel-Mode Driver Framework (KMDF). These drivers are used to control everything in your computer, from small things like CPU fan speed, color of your motherboard LED lights, up to flashing a new BIOS. However, as the code in these drivers runs with the same privileges as the rest of the kernel, malicious drivers can be used to compromise the security of the platform. To that end, Microsoft relies on WHQL, code signing, and EV Signing to prevent drivers which have not been approved by Microsoft from being loaded into the kernel. Unfortunately, security vulnerabilities in signed drivers can be used to as a proxy to read and write hardware resources such as kernel memory, internal CPU configuration registers, PCI devices, and more. These helpful driver capabilities can even be misused to bypass and disable Windows protection mechanisms. Let us teach you how these drivers work, show you the unbelievable risk they pose, and enjoy our walk of shame as we parade all the silly and irresponsible things we discovered in our research. Jesse Michael Jesse Michael is an experienced security researcher focused on vulnerability detection and mitigation who has worked at all layers of modern computing environments from exploiting worldwide corporate network infrastructure down to hunting vulnerabilities inside processors at the hardware design level. His primary areas of expertise include reverse engineering embedded firmware and exploit development. He has also presented research at DEF CON, Black Hat, PacSec, Hackito Ergo Sum, Ekoparty, and BSides Portland. Mickey Shkatov Mickey Shkatov, a principal researcher at Eclypsium, has been performing security research and product security validation since 2010, He has also presented multiple times at DEF CON, Black Hat, PacSec, CanSecWest, BruCon, Hackito Ergo Sum, and BSides Portland.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Data collected by vacuum cleaning robot sensors is highly privacy-sensitive, as it includes details and metadata about consumers’ habits, how they live, when they work or invite friends, and more. Connected vacuum robots are not as low-budget as other IoT devices and vendors indeed invest into their security. This makes vacuum cleaning robot ecosystems interesting for further analysis to understand their security mechanisms and derive takeaways. In this talk we discuss the security of the well-protected Neato and Vorwerk ecosystems. Their robots run the proprietary QNX operating system, are locally protected with secure boot, and use various mechanisms that ensure authentication and encryption in the cloud communication. Nonetheless, we were able to bypass substantial security components and even gain unauthenticated privileged remote execution on arbitrary robots. We present how we dissected ecosystem components including a selection of vacuum robot firmwares and their cloud interactions. jiska Jiska has a M.Sc. in IT-Security. She is a PhD student at the Secure Mobile Networking Lab (TU Darmstadt) since May 2014. Her main research interest are wireless physical layer security and reverse engineering. You might also know her embroidery projects or game shows from past CCC events. clou (Fabian Ullrich) Fabian has a M.Sc. in IT-Security. He is working as a researcher and analyst at ERNW. His main research interests are full stack IoT and web application security. In his free time, Fabian likes to capture some flags.

uk: вхід без авторизації

name: Vacuum Cleaning Security: Pinky and The Brain Edition


Your Car is My Car

uk: Комп'ютерні науки

description: For many of us, our cars are one of the largest purchases we will ever make. In an always connected world it is natural that we would want to have the convenience of being able to remotely monitor our vehicles: to do everything from remind ourselves exactly where exactly we parked, verify we locked our vehicle, or even remote start it so it will be warmed up (or cooled down) when we get in. There are a variety of vendors offering aftermarket alarm systems that provide these conveniences and offer a peace of mind. But how much can we trust the vendors of these systems are protecting access to our cars in the digital domain? In this talk, Jmaxxz will tell the story of what he found when he looked into one such system.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Incorporating natural elements, complex fabrication techniques, and components rarely seen by the outside world, the DEF CON 27 Badge brings our community together through Technology's Promise. Join DEF CON's original electronic badge designer Joe Grand on a behind-the-scenes journey of this year's development process and the challenges, risks, and adventures he faced along the way. Joe Grand (Kingpin) Joe Grand, also known as Kingpin, is a computer engineer, hardware hacker, DEF CON badge designer (14, 15, 16, 17, 18, China 1, 27), teacher, advisor, runner, daddy, honorary doctor, TV host, member of legendary hacker group L0pht Heavy Industries, and the proprietor of Grand Idea Studio.

uk: вхід без авторизації

name: Behind the Scenes of the DEF CON 27 Badge


uk: Комп'ютерні науки

description: Major US telecommunications companies AT&T, T-Mobile, and Sprint have been quietly selling access to their customers’ real-time location data, including cell tower information as well as highly precise GPS data. Through a complex network of dodgy data aggregators and middlemen companies, this data access eventually trickled down to a slew of different industries, used car salesman, landlords, and hundreds of bounty hunters, likely without your knowledge or informed consent. In this talk, based on leaked documents, sources, and first hand experience, Joseph will explain how this data industry works, the players involved, and also how the data access is available on the black market, where it can be used in any way an attacker fancies: Joseph paid a source $300 to successfully locate a phone in New York. Joseph Cox Joseph is an investigative reporter for Motherboard, the science and technology section of VICE. He covers cybersecurity, the digital underground, and social media platforms.

uk: вхід без авторизації

name: How You Can Buy ATT TMobile and Sprint Real Time Location Data


uk: Комп'ютерні науки

description: The 2016 WWDC saw the dawn of Apple Pay Web, an API that lets websites embed an Apple Pay button within their web-facing stores. Supporting it required a complex request flow, complete with client certificates and a custom session server. This proved detrimental, since Apple failed to caution against important side effects of taking in untrusted URLs. As a result, many new SSRF vulnerabilities entered the world. Worse yet, while they were exploitable and discoverable in similar ways, they were spread across distinct codebases in several programming languages, so could not be patched in any generic way. Apple is not alone - in the process of gluing the web together, Twilio, Salesforce, and others have all created similarly broad attack surfaces. When companies fail to take an honest, empathetic look at how clients will use a product, they shove along hidden security burdens. Those who integrate with an API have less context than those who create it, so are in a worse position to recognize these risks. Engineers have been talking about defensive programming for decades, but top companies still have trouble practicing it. In this talk we explore these mistakes with demos of affected software, and introduce a powerful model for finding broad classes of bugs. Joshua Maddux Joshua Maddux started out as a software engineer. After a few years, having introduced his share of problems to the world, he turned his life around and started hunting for vulnerabilities. Now at PKC Security he does a mix of software development and white-box penetration testing, with a focus on helping startups move fast without breaking too many things. Aside from pentesting for clients, Joshua is also active in the bug bounty world. His past research has led to security updates in Java, Gitlab, United Airlines, Zapier, and others.

uk: вхід без авторизації

name: API Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web


uk: Комп'ютерні науки

description: People are always talking about binary vulnerabilities when attacking desktop applications. Memory corruptions are always costly to find. Meanwhile, mitigations introduced by operating systems make them harder to be exploited. More and more applications are using hybrid technologies, so we can try web security tricks to pwn them reliably with less effort. Our presentation will summarize attack surfaces and methods to find security issues in desktop applications. In particular, we will explicate some real-world cases, such as chaining multiple vulnerabilities (information leaking, CSP bypass, opened debugging port) to achieve RCE in a specialized IDE, sensitive file leaking in famous editors, privileged APIs abusing in many IM applications and so on. During our research, we find some issues actually reside in popular libraries. These flaws may affect more applications than we will demonstrate in this talk. Web security knowledge is usually unfamiliar to desktop application developers. Attacking desktop apps using web security tricks is a non-competitive "blue ocean". Our presentation will focus on many design misconceptions and implementation mistakes in desktop applications. By sharing these representative lessons, we hope to help desktop application developers improve the security of their products. Junyu Zhou Junyu Zhou, Security Researcher in Tencent Security Xuanwu Lab, CTF player from 0ops/A*0*E, is focusing on vulnerability research and web application security. Speaker of HITB2018Dubai and ZeroNights2018. Ce Qin Ce Qin, Security Researcher in Tencent Security Xuanwu Lab for 3 years, focus on software security, mainly on browser and Desktop software. Jianing Wang Jianing Wang, Security Researcher in Tencent Security Xuanwu Lab, member of Syclover, is focusing on vulnerability research and web application security.

uk: вхід без авторизації

name: Web2Own: Attacking Desktop Apps fromWeb Security's Perspective


uk: Комп'ютерні науки

description: Companies are coming for your brains. The electricity in your brains, to be more precise. Valve, Facebook, Elon Musk and more are funding research into technologies that will translate neural signals into controls for devices like computers, smartphones, and VR/AR environments. While this would be super exciting, it represents some serious data privacy issues. First: what kind of private information can be elicited from your neural signals? It’s possible to use a specific kind of neural response to visual and audio stimuli to deduce information about the user… like where you bank, who you know, your real identity, etc (Edward Nygma in Batman Forever, anyone?) More broadly, there is also the issue of what happens when you provide your neural signals to a company. If you’re worried about what Facebook is doing with your information now, imagine what they can do when they have hours of information straight from your brain. If neural data is treated the same as your DNA, commercial companies become the owners of your thoughts (as electrical signals). Will they readily share it with the FBI without probable cause? These kinds of questions, and many more, are starting to surface with neurally-controlled devices and other emerging technologies. This talk will cover all of this and more. Katherine Pratt/GattaKat Dr Katherine Pratt received her B.S. in aerospace engineering from MIT in 2008, and her PhD in Electrical and Computer Engineering (ECE) from the University of Washington (UW) in 2019. During undergrad she completed several internships with the private space venture Blue Origin, working in systems and propulsion engineering. She has served four years in the United States Air Force, working primarily as an operational flight test engineer on the F-35 Joint Strike Fighter. Her doctoral dissertation focused on the privacy, ethics, and policy of information derived from elicited neural signals. She was the recipient of a National Science Foundation Graduate Research Fellowship and the 2018-19 UW ECE Irene Peden Endowed Fellowship. During graduate school she interned with the ACLU of Washington through the Speech, Privacy, and Technology Project. She also completed a six month fellowship as the first Congressional Innovation Scholar through Tech Congress where she crafted technology policy and legislation in the office of a member of the House of Representatives.

uk: вхід без авторизації

name: Hacking Your Thoughts Batman Forever meets Black Mirror


uk: Комп'ютерні науки

description: The capability to emulate x86 and other architectures has been around for some time. Malware analysts have several tools readily available in the public domain. However, most of the tools stop short of full emulation, halting or doing strange things when emulating library functions or system calls not implemented in the emulator. In this talk we introduce a new tool into the public domain, Binee, a Windows Process emulator. Binee creates a nearly identical Windows process memory model inside the emulator, including all dynamically loaded libraries and other Windows process structures. Binee mimics much of the OS kernel and outputs a detailed description of all function calls with human readable parameters through the duration of the process. We've designed Binee with two primary use cases in mind; data extraction at scale with a cost and speed similar to common static analysis tools, and second, for malware analysts that need a custom operating system and framework without the overhead of spinning up various configurations of virtual machines. Currently Binee can run on Windows, OS X, and Linux. Kyle Gwinnup Kyle is a Senior Threat Researcher in Carbon Black's TAU team. He has over 10 years of experience in many areas of computer science and IT. Prior to Carbon Black, Kyle worked in finance and with the DoD in various roles ranging from network/systems administrator, software engineer, reverse engineer, penetration tester and offensive tool developer. At Carbon Black, Kyle's focus is on large scale program analysis, primarily static but moving asymptotically toward dynamic analysis. John Holowczak John is a Threat Researcher on Carbon Black's Threat Analysis Unit, focusing on automation of threat detection and building out infrastructure for large scale malware analysis. Within the field of threat detection and analysis, John specializes his research in binary classification, dynamic analysis and reverse engineering.

uk: вхід без авторизації

name: Next Generation Process Emulation with Binee


uk: Комп'ютерні науки

description: Mobile app hacking peaked in 2015 with tools like keychain-dumper & ssl-kill-switch released but requiring jailbroken/rooted devices. Back then, wresting the power to understand & modify apps on our devices from dystopian looking mega corps was our cause. As jailbreaks became infrequent, the hackers’ arsenal was left behind. While this is progress against dark uses of hacking, done to protect our freedom fighters, how can hackers still hold power to account? Can we still find flaws in apps/devices & live up to the protections the technology promises? Enter runtime binary instrumentation with Frida. It’s possible to analyze apps in their final state when executed on real hardware running the latest iOS/Android with no jailbreaks. This fills a gap between source analysis & debuggers. But, simply enumerating app classes requires studying multiple blogs & a deep read of the docs. We created Objection to simplify this & hide the boilerplate so hackers could focus on unravelling apps. But, many people still rely on simple hacks & automation & rarely use new advanced techniques such as reflectively inspecting live heap objects, canary execution tracing, runtime memory edits and filesystem exploration. We’ll show hackers, malware researchers & security engineers how to use these advanced mobile hacking techniques. Leon Jacobs Leon has been hacking for over a decade. He’s plied his trade at SensePost for the last three having previously worked for a bank and ISP in South Africa. Leon spends most of his daytime hours hacking large networks or web and mobile applications. Leon spends most of his nighttime hours building hacking tools and techniques to contribute back to the community.

uk: вхід без авторизації

name: Meticulously Modern Mobile Manipulations


uk: Комп'ютерні науки

description: Fuzzing remains to be the most effective technique for bugs hunting in memory-unsafe programs. Last year, hundreds of security papers and talks on fuzzing have been published and dozens of them were focused on adapting or improving American Fuzzy Lop in some way. Attracting with its simplicity and efficiency, AFL is the number one choice for the vast majority of security researchers. This high popularity means that hunting for bugs with AFL or a similar tool is becoming less and less fruitful since many projects are already covered by other researchers. It is especially hard when we talk about a project participating in Google OSS-Fuzz program which utilizes AFL to generate a half-trillion test cases per day. In practice, this means that we can not blindly rely on AFL anymore and should search for better fuzzing techniques. In order to overcome this challenge, we need to understand how AFL and similar fuzzers work and be able to use their weaknesses to find new 0days. This talk is aimed to discuss these weaknesses on real examples, explain how we can do fuzzing better and release a new open-source fuzzer called Manul. Manul is a high-scalable coverage-guided parallel fuzzer with the ability to search for bugs in open source and black box binaries on Windows and Linux. Manul was able to find 10 0-days in 4 widely-used projects that have been extensively tested by AFL. These vulnerabilities were not found by chance, but by analyzing and addressing issues exist in AFL. Authors will show several of the most critical vulnerabilities and explain why AFL overlooked them. This talk will be interested for experienced hackers, who are willing to improve their bug hunting capabilities, as well as for new researchers, who are making their first steps on the thorny trail of bug hunting. Maksim Shudrak Maksim is a security researcher and vulnerability hunter in open-source and blackbox applications. In the past, he had experience working on dynamic binary instrumentation framework DynamoRIO, developing extremely abstract Windows OS emulator for malware analysis at IBM Research as well as writing sophisticated fuzzer to search for vulnerabilities in machine code. The latter was so exciting that he defended PhD on this topic. Today, he works on Red Team side at large cloud-based software company. Maksim has spoken at various security conferences around the world such as DEF CON, Positive Hack Days, Virus Bulletin and BSides SF.

uk: вхід без авторизації

name: How To Improve Coverage Guided Fuzzing Find New 0days


uk: Комп'ютерні науки

description: Active Directory has always been a popular target for attackers, with a constant rise in attack tools attempting to compromise and abuse the main secrets storage of the organization. One of the weakest spots in Active Directory environments lies in the design of one of the oldest authentication protocols – NTLM, which is a constant source of newly discovered vulnerabilities. From CVE-2015-0005, to the recent LDAPS Relay vulnerability, it is clear why this protocol is one of the attackers’ favorites. Although there are offered mitigations such as server signing, protecting the entire domain from NTLM relay is virtually impossible. If it weren’t bad enough already, we will present several new ways to abuse this infamous authentication protocol, including a new critical zero-day vulnerability we have discovered which enables to perform NTLM Relay and take over any machine in the domain, even with the strictest security configuration, while bypassing all of today's offered mitigations. Furthermore, we will present why the risks of this protocol are not limited to the boundaries of the on-premises environment and show another vulnerability which allows to bypass various AD-FS restrictions in order to take over cloud resources as well. Marina Simakov Marina Simakov is a security researcher at Preempt, with a special interest in network security and authentication protocols. Prior to Preempt, Marina served as a Security Researcher at Microsoft for several years. She holds an M.Sc. in computer science, with several published articles, with a main area of expertise in graph theory. Marina previously spoke at various security conferences such as Black Hat, BlueHat IL and DEF CON. Yaron Zinar Yaron Zinar is a Lead Security Researcher at Preempt, delivering the industry’s first Identity and Access Threat Prevention. Previously, Yaron spent over 12 years at leading companies such as Google and Microsoft where he held various positions researching and leading big data, machine learning and cyber security projects. Yaron is an expert on Windows Authentication protocols, among his team latest finding are CVE-2017-8563 and CVE-2018-0886, which he presented in Black Hat last year. Yaron holds an M.Sc. in Computer Science with focus on statistical analysis.

uk: вхід без авторизації

name: Relaying Credentials has Never Been Easier: How to easily bypass the latest NTLM Relay Mitigations


uk: Комп'ютерні науки

description: While recent research has explored the capability of attacks to cause harm by targeting devices – e.g., SCADA systems, vehicles, medical implant devices - little consideration has been given to the concept of attacks affecting psychological and physiological health by targeting humans themselves. In a first-of-its-kind study, we assessed the capability of several consumer devices to produce sound at high and low frequencies which may be imperceptible to many people, as a result of remote and local attacks, and compared the resulting sound levels to maximum recommended levels. In doing so, we tested their viability as localised acoustic weapons which could cause temporary/permanent hearing damage and/or adverse psychological effects. We examined a number of countermeasures, including a tool to detect specified frequencies above specified thresholds. In this talk, I will cover the background of malware which has, intentionally or not, caused physical or psychological harm. I will explore previous research on the harmful effects of sound, focusing particularly on high and low frequencies, and some of the guidance which has been proposed to limit exposure to such sound. I will examine the use of imperceptible sound as applied to security research (covert channels, ultrasonic tracking beacons, etc), and will present our experiments and findings, including threat models, methodology, the attacks we developed, and the implications of our results. Finally, I will suggest a number of countermeasures and outline some possible areas for future research. Matt Wixey Matt is a PhD candidate at the Dawes Centre for Future Crimes, University College London, and leads technical research for the PwC Cyber Security practice in the UK. Prior to joining PwC, Matt led a technical R&D team for a law enforcement agency in the UK. His research interests include antivirus and sandboxing technologies, unconventional attack vectors, side-channels, and radio security.

uk: вхід без авторизації

name: Sound Effects: Exploring Acoustic Cyberweapons


EDR is Coming; Hide Yo Sh!t

uk: Комп'ютерні науки

description: There’s a new, largely unaddressed threat in the security industry today, Endpoint Detection and Response (EDR), which aims to stop threat actors in their tracks. The scenario plays out like this... At first your campaign is going well and your attacker objectives are being met. Then, your lovingly crafted payloads become analyst samples, you’re evicted from the environment and you lose your persistence. You and the analyst are now having a bad time. You may feel this is just fear mongering, but we assure you, the risk is real.Fortunately, we have a few new tricks up our sleeves to keep this nightmare scenario at bay. While many would have you believe that we live in a measured and signed boot Utopia on modern systems, we will show you the seedy underbelly of this Brave New World. By abusing early boot mechanisms and UEFI platform firmware, we are able to evade common detection. By showing up early to the fight, we sucker punch EDR, leaving it in a daze unable to see our malicious activities. We put a new twist on old code injection techniques and maintain persistence in UEFI firmware, making an effective invisibility cloak. By leveraging these two techniques, you and the analyst can have a happy and relaxing evening. From that point on - the good ol’ days are back again! Plunder away! Michael Leibowitz Michael has done hard-time in real-time. An old-school computer engineer by education, he spends his days hacking the mothership for a fortune 100 company. Previously, he developed and tested embedded hardware and software, fooled around with strap-on boot roms, mobile apps, office suites, and written some secure software. On nights and weekends he hacks on electronics, writes CFPs, and contributes to the NSA Playset. Topher Timzen Topher Timzen is currently a Principal Vulnerability Enthusiast and enjoys causing constructive mischief. Topher has spoken at conferences such as DEF CON, SecTor and BSidesPDX on offensive security research. Enjoying teaching, particularly about exploitation, he has been running the CTF at BSidesPDX for the past few years. Topher is located in the woods hiking or mountain biking when not computing. Collectively they have pretended to be bears, slayed a dragon or two, and have managed to not bring down a production server (for long). In reality, they just want to write malware.

uk: вхід без авторизації


Apache Solr Injection

uk: Комп'ютерні науки

description: Apache Solr is a search platform used by many enterprise companies to add a full text search functionality to their websites. Often hidden behind firewalls, it provides a rich API to search across large datasets. If this API is used by web applications in a wrong way, it may open a possibility for injection attacks to completely modify the query logic. In this talk we’ll shed some light on the new type of vulnerabilities for web applications - Solr parameter injection, and provide some useful ways how to achieve remote code execution through it. We also provide exploits for almost all known vulnerabilities for Apache Solr, including the two new RCEs we reported this year. Michael Stepankin Michael Stepankin is a Security Researcher at Veracode. He works on bringing new detection features to Veracode’s dynamic and static scanner engines. As a passionate hacker, he loves to hack enterprise java applications by day and write beautiful JavaScript code by night. Listed in Halls of Fame of various bug bounty programs, Michael has also worked as a penetration tester for many years.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: For the past 3 years d4rkm4tter has been obsessed with monitoring the wireless networks at DEF CON. This talk will take you on a journey through the successes and failures that lead to the creation of the WiFiCactus and the over 1 TB of data captured. A history of each capture project including a summary of the most interesting pieces of data will be shown. Many people spread a lot of fear, uncertainty and doubt about the wireless environments during DEF CON. This presentation aims to bring some clarity to what is really happening in the airwaves during one of the largest hacker conferences in the world. This will include presenting data on the attacks and sensitive information that exists in the airwaves. This presentation will demonstrate the risks of using wireless networks and information leaks that can be captured by anyone who is passively listening. Countermeasures and protection strategies will be provided to help you avoid having your data captured by those who might be listening. With the number of connected devices around us, there has never been a better time to start wardriving or warwalking. Everyone is capable of profiling wireless data around them thanks to cheap hardware and open source tools. As hackers it is important for us to discover issues and vulnerabilities while validating claims of security by software and hardware vendors. Monitoring wireless communication is a great way to start validating those claims. All of the hardware and methods used will be provided so that anyone can do this type of monitoring on their own. Hack the Planet! d4rkm4tter (Mike Spicer) d4rkm4tter is a mad scientist hacker who likes to meddle with hardware and software. He is particularly obsessed with wireless. He has a degree in computer science from Southern Utah University which he has put to use building and breaking a wide array of systems. These include web application pentesting, wireless monitoring and tracking as well as good old fashioned reverse engineering. He is the creator of the #WiFiCactus and has been seen presenting Demolabs at DEF CON and DEF CON China Beta. He is a Kismet cultist and active in the wireless and wardriving communities.

uk: вхід без авторизації

name: I Know What U Did Last Summer 3 Yrs Wireless Monitoring DEFCON


Poking the S in SD Cards

uk: Комп'ютерні науки

description: Ever wonder why the S in SD cards stands for Secure? Well, it turns out that it is possible to read and/or write protect these cards by software using specific commands. As you might expect, this process isn’t as "secure" as the name implies leading to multiple issues. This talk will present some of these features and the vulnerabilities discovered while poking at cards from various manufacturers. The equipment used in this talk is quite easily attainable allowing for easy replication and learning about these attacks. Nicolas Oberli Nicolas works as a security researcher for Kudelski Security in Switzerland. His research focuses on embedded devices and communication protocols. In his spare time, he now spends more time designing CTF challenges than solving them. He is also one of the main developers of the Hydrabus hardware hacking tool and part of the BlackAlps security conference committee.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This talk covers interesting domain privilege escalation, persistence and backdoor techniques with the help of ACLs, minimal user rights and combinations of both. We will discuss how these techniques can be applied using open source tools and scripts. The talk also covers how to detect and mitigate such attacks. The talk will be full of live demonstrations. Nikhil Mittal Nikhil Mittal is a hacker, infosec researcher, speaker and enthusiast. His area of interest includes red teaming, active directory security, attack research, defense strategies and post exploitation research. He has 10+ years of experience in red teaming. He specializes in assessing security risks at secure environments that require novel attack vectors and "out of the box" approach. He has worked extensively on Active Directory attacks, defense and bypassing detection mechanisms and Offensive PowerShell for red teaming. He is creator of multiple tools like Nishang, a post exploitation framework in PowerShell and Deploy-Deception a framework for deploying Active Directory deception. In his spare time, Nikhil researches on new attack methodologies and updates his tools and frameworks. Nikhil has held trainings and boot camps for various corporate clients (in US, Europe and SE Asia), and at the world's top information security conferences. He has spoken/trained at conferences like DEF CON, BlackHat, CanSecWest, BruCON, 44CON and more.

uk: вхід без авторизації

name: RACE - Minimal Rights and ACE for Active Directory Dominance


Confessions of an Nespresso Money Mule

uk: Комп'ютерні науки

description: In 2018 I somewhat innocently bought very expensive coffee (Nespresso capsules) online from Ebay. What followed was a series of unexpected additional packages from the manufacturer Nespresso and a lurking suspicion that something had gone terribly--if not criminally--wrong as a result of my purchase. This talk chronicles the obnoxious amounts of obsessive research and tracking that became my new hobby--stalking Nespresso fraudsters and my decidedly non-technical attempts at developing a generic search profile and reporting the fraudsters to anyone who would listen, to include : the persons whose identities had been stolen, Nespresso, Ebay, and the FBI. Ultimately I just ended up with a LOT of coffee; a lingering sense that I had committed several crimes; and no faith left in humanity. Nina Kollars Nina Kollars is writing a book about the ways in which hackers contribute to national security. She is a political scientist whose main research is in technological adaptation by users. Kollars is Associate Professor for the Naval War College in the Strategic and Operational Research Department. She conducts research on military weapons and the humans who use them. Largely unsatisfied with sitting still, Kollars has also worked for the Library of Congress' Federal Research Division, the Department of Afro-American Studies at Harvard University, the World Bank, an anti-glare coating factory on the third shift, and volunteers for BSides. She is the former viceroy of the DC strategy group Cigars, Scotch, and Strategy. She is also a certified bourbon steward.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This talk is the grand finale of a four-year long investigation that started with analyzing an IoT botnet, to discovering the structured industry that exists behind social media manipulation (SMM). SMM is the deliberate act of paying for popularity with followers or activity on social media. Adopting a bottom-up approach, the thorough methodology undertook to study the botnet will be presented: from building honeypots, infecting them with malware and conducting a man-in-the-middle-attack on the honeypots’ traffic to access the decrypted HTTPS content between the C&Cs and social networks. Then, the various investigative paths taken to analyze this large data set, leading to the discovery of industry actors involved in the supply chain of social media manipulation, will be presented. These investigative paths include traffic analysis, various OSINT approaches to reveal and understand actors, reverse-engineering the software that automates the use and creation of fake accounts, forum investigations, and qualitative profiling. All actors involved in the industry will be mapped, from malware authors, to reseller panels, and customers of fake popularity. The potential profitability of the industry will then be discussed, as well as the revenue division in the chain, demonstrating that the ones making the highest revenue per fake follower sold are not the malware authors, but rather those at the end of the chain. Olivier Bilodeau Olivier Bilodeau is leading the Cybersecurity Research team at GoSecure. With more than 10 years of infosec experience, he enjoys attracting malware in honeypots, writing tools for malware research, reverse-engineering all-the-things and vulnerability research. Passionate communicator, Olivier has spoken at several conferences like BlackHat Europe, DefCcon, Botconf, SecTor, Derbycon, HackFest and many more. Invested in his community, he co-organizes MontréHack, a monthly workshop focused on applied information security, and NorthSec, Montreal's community conference and Capture-The-Flag. Masarah Paquet-Clouston Masarah Paquet-Clouston is a security researcher at GoSecure, a PhD student at Simon Fraser University in criminology and one of Canada’s decorated 150 scientific innovators. With her background in economics and criminology, she specializes in the study of markets behind illicit online activities. She published in several peer-reviewed journals, such as Social Networks, Global Crime and the International Journal for the Study of Drug Policy, and presented at various international conferences including Virus Bulletin, Black Hat Europe, Botconf and the American Society of Criminology.

uk: вхід без авторизації

name: Behind the Scenes: Industry of Social Media Manipulation Driven by Malware


SELECT code execution from using SQlite

uk: Комп'ютерні науки

description: Everyone knows that databases are the crown jewels from a hacker's point of view, but what if you could use a database as the hacking tool itself? We discovered that simply querying a malicious SQLite database - can lead to Remote Code Execution. We used undocumented SQLite3 behavior and memory corruption vulnerabilities to take advantage of the assumption that querying a database is safe. How? We created a rogue SQLite database that exploits the software used to open it.Exploring only a few of the possibilities this presents we’ll pwn password stealer backends while they parse credentials files and achieve iOS persistency by replacing its Contacts database… The landscape is endless (Hint: Did someone say Windows 10 0-day?). This is extremely terrifying since SQLite3 is now practically built-in to any modern system. In our talk we also discuss the SQLite internals and our novel approach for abusing them. We had to invent our own ROP chain technique using nothing but SQL CREATE statements. We used JOIN statements for Heap Spray and SELECT subqueries for x64 pointer unpacking and arithmetics. It's a new world of using the familiar Structured Query Language for exploitation primitives,laying the foundations for a generic leverage of memory corruption issues in database engines. Omer Gull Omer Gull is a vulnerability researcher in the Malware and Vulnerability Research group at Check Point Software Technologies. Omer has a diverse background in security research, that includes web application penetration testing, RE and exploitation.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: “A concept is a brick. It can be used to build a courthouse of reason. Or it can be thrown through the window.” ― Gilles Deleuze Ever since Smashing the Stack For Fun And Profit was published by Aleph One almost a quarter century ago the security world has completely changed the way it defends exploitation. Canary stack, DEP, ASLR, CFI and various other mitigation techniques were developed to address various exploit techniques. Yet, ROP remains a prominent practice employed by many exploits even today. ROP is the most common exploitation method for attackers to mutate memory bugs on target process into malicious executable code. “Next Gen” endpoint security products try to address ROP and other exploitation methods. Windows embraces many mitigation techniques as well. However, these mitigation features such as CFG can in fact be leveraged and increase ROP’s attack surface and allow it to even bypass exploit protections! If you are intrigued by ROP, want to learn about methods in Windows that protect against ROP and how to bypass them - this talk is for you! On top of that a novel method of bypassing ROP mitigation of most products will also be revealed. Omer Yair Omer is End-Point team lead at Symantec (formerly Javelin Networks). His team focuses on methods to covertly manipulate OS internals. Before Symantec he was a malware researcher at IBM Trusteer for two years focusing on financial malware families. In the past he has worked at Algotec for six years developing medical imaging software and at IDF's technology unit for three years as dev team lead. Omer lectured on DerbyCon 8, Virus Bulletin and Zero Nights conferences. In his free time he revives historical photographic processes.

uk: вхід без авторизації

name: Exploiting Windows Exploit Mitigation for ROP Exploits


uk: Комп'ютерні науки

description: Computer security is now a public policy issue. Election security, blockchain, "going dark," the vulnerabilities equities debate, IoT safety , data privacy, algorithmic security and fairness, critical infrastructure: these are all important public policy issues with a strong Internet security component. But while an understanding of the technology involved is fundamental to crafting good policy, there is little involvement of technologists in policy discussions. This is not sustainable. We need public-interest technologists: people from our fields helping craft policy, and working to provide security to agencies and groups working in the broader public interest. We need these people in government, at NGOs, teaching at universities, as part of the press, and inside private companies. This is increasingly critical to both public safety and overall social welfare. This talk both describes the current state of public-interest technology, and offers a way forward for us individually and collectively for our field. The defining policy question of the Internet age is this: How much of our lives should be governed by technology, and under what terms? We need to be involved in that debate.SSL VPNs protect corporate assets from Internet exposure, but what if SSL VPNs themselves are vulnerable? They’re exposed to the Internet, trusted to reliably guard the only way to intranet. However, we found pre-auth RCEs on multiple leading SSL VPNs, used by nearly half of the Fortune 500 companies and many government organizations. To make things worse, a “magic” backdoor was found to allow changing any user’s password with no credentials required! To show how bad things can go, we will demonstrate gaining root shell from the only exposed HTTPS port, covertly weaponizing the server against their owner, and abusing a hidden feature to take over all VPN clients! In such complicated closed-source systems, gaining root shell from outside the box certainly ain’t easy. It takes advanced web and binary exploitation techniques to struggle for a way to root shell, which involves abusing defects in web architectures, hard-core Apache jemalloc exploitation and more. We will cover every detail of all the dirty tricks, crazy bug chains, and the built-in backdoor. After gaining root shell into the box, we then elaborate on post exploitation and how we hack back the clients. In addition, we will share the attack vectors against SSL VPNs to kick start researches on similar targets. On the other hand, from our previous experience, we derive general hardening actions that mitigate not only all the above attacks, but any other potential 0days. In summary, we disclose practical attacks capable of compromising millions of targets, including tech giants and many industry leaders. These techniques and methodologies are published in the hope that it can inspire more security researchers to think out-of-the-box; enterprises can apply immediate mitigation, and realize that SSL VPN is not merely Virtual Private Network, but also a “Vulnerable Point of your Network”.

uk: вхід без авторизації

name: Infiltrating Corporate Intranet Like NSA Preauth RCE


uk: Комп'ютерні науки

description: Here’s the use case. You learn of a problem with a government system or some technology, and you want to do the right thing. You want to get the information into the right hands, but you’d be more comfortable sharing if you knew you couldn’t be identified as the messenger of the problem. Sound familiar? This very problem has been the subject of a years-long conversation in the space between government and independent security research. The goal is to create a sturdy, anonymous system for hackers and researchers that shares your tip directly with the part of government that needs to know, and keeps you out of the equation. This is your chance to be part of the conversation. Join The Dark Tangent, the NYT’s Runa Sandvik, Leviathan’s Corbin Souffrant, SOFWERX and The Donovan Groups Pablo Breuer, the ACLU’s Jennifer Granick and the DHS CISA Christopher Krebs and have your voice heard

uk: вхід без авторизації

name: DEF CON to help hackers anonymously submit bugs to the government


uk: Комп'ютерні науки

description: A SIMULATED crisis is unfolding on a national scale, based loosely on the NotPetya attack of 2017. Triggered by a yet-unknown adversary, what started as a an isolated technical issue has quickly escalated into a society-wide event affecting millions of citizens, several industries, and spanning government jurisdictions. Who is in charge, how do they cooperate with others, and how do they make decisions? The Wilson Center, Hewlett Foundation and I Am The Calvary are teaming up to bring public policymakers together with security researchers and others to discover how our nation might respond to a wide-scale “cyber crisis”. Work in tandem with sitting Members of Congress to understand what levers of power Congress yields and how Members can address policy gaps in the future. Former Rep. Jane Harman The Hon. Jane Harman is President of the Wilson Center, a think tank in Washington, DC. She is a former nine-term Member of Congress who served on all the major security committees and represented an aerospace and technology hub in Southern California. Rep. James Langevin The Hon. Jim Langevin represents Rhode Island's 2nd Congressional district. He is Chairman of the Emerging Threats and Capabilities Subcommittee and a senior member of the Cybersecurity and Infrastructure Protection Subcommittee. Rep. Langevin is a member of the House Majority Whip Steny Hoyer's Senior Whip Team, and is responsible for educating other Democratic Members on key issues. Jen Ellis Jen Ellis is the Vice Preident of Community and Public Affairs at Rapid7. She works directly with security researchers, technology providers and operators, and government entities to help them understand and address cybersecurity challenges together. Cris Thomas Cris Thomas works for IBM X-Force Red, and before that worked at Guardent, Trustwave, Tenable and others. Cris created the first security research think tank L0pht Heavy Industries and the video news show The Hacker News Network. Rep. Ted Lieu The Hon. Ted Lieu represents California’s 33rd Congressional district. Now in his third term in Congress, Rep. Lieu currently sits on the House Judiciary Committee and House Foreign Affairs Committee. He also serves as Co-Chair of the Democratic Policy and Communications Committee and has emerged as a leader in cybersecurity in Congress.

uk: вхід без авторизації

name: Hacking Congress The Enemy Of My Enemy Is My Friend


Harnessing Weapons of Mac Destruction

uk: Комп'ютерні науки

description: Whenever a new Mac malware specimen is uncovered, it provides a unique insight into the offensive Mac capabilities of hackers or nation-state adversaries. Better yet, such discoveries provide fully-functional capabilities that may be weaponized for our own surreptitious purposes! I mean, life is short, why write your own? We'll begin this talk by discussing the methodology of subverting existing malware for "personal use", highlighting both the challenges and benefits of such an approach. Next, we'll walk-thru the weaponization of various Mac malware specimens, including an interactive backdoor, a file-exfiltration implant, ransomware, and yes, even adware. Customizations include various runtime binary modifications that will coerce such malware to accept tasking from our own C&C servers, and/or automatically perform actions on our behalf. Of course, in their pristine state, such samples are currently detected by AV products. As such we'll also walk-thru subtle modifications that will ensure our modified tools remains undetected by traditional detection approaches. In conclusion, we'll highlight novel heuristic methods that can generically detect such threats to ensure Mac users remain protected even from such weaponized threats.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Hacking ‘high security’ electronic locks has become a bit of a hobby, but what if you identify an unpatchable design pattern that unlocks buckets of cash and government secrets? How long do wait before telling ‘people’? let’s talk about how these locks are designed, where they fail and we can rip this band-aid off together. phar Mike Davis is a hardware security researcher and consultant with IOActive, and for some reason still responds to ‘phar’.

uk: вхід без авторизації

name: No Mas How Side Channel Flaw Opens ATM Pharmacies and Gov to Attack


uk: Комп'ютерні науки

description: From small business to large enterprise, VOIP phones can be found on nearly every desk. But how secure are they? What if your phone was spying on every conversation you have? This talk is an introduction to hardware hacking and as a case study I’ll use the [REDACTED] Deskphone, a device frequently deployed in corporate environments. I’ll use it to introduce the tools and methodology needed to answer these questions. During this talk, attendees will get a close up look at the operations of a hardware hacker, including ARM disassembly, firmware extraction using binwalk, micro-soldering to patch an EEPROM and get a root shell over UART, and ultimately uncover an already known decade-old bug that somehow remained unnoticed in the device’s firmware. Beyond the case study I will also address alternative tactics; some did not work, others may have but were not the lowest-hanging fruit. When it comes to hardware hacking, the process is as important as the result; knowing that there are multiple ways to reach the end goal helps researchers remain confident when hurdles arise. After the talk, attendees will have an increased distrust towards always-on devices; however, they will have the background knowledge to investigate the products and systems they encounter daily.

uk: вхід без авторизації

name: Introduction to Hardware Hacking: How you too can find a decade old bug in widely deployed devices: AVAYA 9600 Descphone - A case study


uk: Комп'ютерні науки

description: Tor is a free-software anonymizing network that helps people around the world use the Internet in safety. But who cares how good Tor's privacy is, if your government prevents you from reaching the Tor network? In the beginning, some countries filtered torproject.org by DNS (so we made website mirrors and an email autoresponder for downloading Tor), and then some countries blocked Tor relays by IP address (so we developed bridges, which are essentially unlisted relays), and then some countries blocked Tor traffic by Deep Packet Inspection (so we developed pluggable transports to transform Tor flows into benign-looking traffic). Then things got weird, with China's nationwide active probing infrastructure to enumerate bridges, with Amazon rolling over to Russia's threats when Telegram used "domain fronting" to get around blocking, with Turkey blocking Tor traffic by DPI in more subtle ways, with Venezuela and Ethiopia and Iran trying new tricks, and more. In this talk I'll get you up to speed on all the ways governments have tried to block Tor, walk through our upcoming steps to stay ahead of the arms race, and give you some new—easier—ways that let you help censored users reach the internet safely. Roger Dingledine Roger Dingledine is president and co-founder of the Tor Project, a nonprofit that develops free and open source software to protect people from tracking, censorship, and surveillance online. Wearing one hat, Roger works with journalists and activists on many continents to help them understand and defend against the threats they face. Wearing another, he is a lead researcher in the online anonymity field, coordinating and mentoring academic researchers working on Tor-related topics. Since 2002 he has helped organize the yearly international Privacy Enhancing Technologies Symposium (PETS). Among his achievements, Roger was chosen by the MIT Technology Review as one of its top 35 innovators under 35, he co-authored the Tor design paper that won the Usenix Security "Test of Time" award, and he has been recognized by Foreign Policy magazine as one of its top 100 global thinkers.

uk: вхід без авторизації

name: The Tor Censorship Arms Race: The Next Chapter


uk: Комп'ютерні науки

description: Amidst the current public outcry about privacy abuses by corporate america, one sector has received far less scrutiny than it deserves: phone companies. America’s phone companies have a hideous track record on privacy. During the past two decades, these descendants of “Ma Bell” have been caught, repeatedly, selling (or giving away) their customers’ sensitive data to the government, bounty hunters, private investigators, data brokers, and stalkers. The DEFCON community is familiar with the phone companies’ role in the Bush-era “warrantless wiretapping” program and the NSA’s surveillance of telephone metadata, revealed by Edward Snowden. Far fewer people know that the carriers were also willing participants in a massive Drug Enforcement Administration (DEA) spying program, which the government quietly shut down after two decades in 2013. Even less well-understood is how these corporations reap profits by selling our information to the private sector. As just one example, the carriers for years used shady middlemen to provide nearly unlimited access to Americans’ location data to anyone with a credit card. Join Oregon Senator Ron Wyden to learn why the phone companies have gotten one free pass after another, and what he’s doing to hold them accountable.

uk: вхід без авторизації

name: Can You Track Me Now? Why The Phone Companies Are Such A Privacy Disaster


uk: Комп'ютерні науки

description: Is targeting microcontrollers worth the effort? Nowadays, they are responsible for controlling a wide range of interesting systems, e.g., physical security systems, car’s ECUs, semaphores, elevators, sensors, critical components of industrial systems, some home appliances and even robots. In this talk, it will be explained how microcontrollers can be backdoored too. After a quick review of basic knowledge about uC, we will dive into three different approaches to achieve payload injection, from basic to advanced techniques. The first method consists on locating the entry point of the firmware and inject our payload there, this is an easy way to execute it at least once. As a second -and more complex- technique, we will backdoor the EUSART communication injecting a malicious payload at the code routine of that hardware peripheral; we will be able to get the right memory address by inspecting the GIE, PEIE and polling process at the uC interrupt vector. Finally, the third technique allow us to take control of the microcontroller’s program flow by manipulating the stack writing memory addresses at the TOS; with this we can execute a payload made with instructions already written in the original program, performing it just like a ROP-chain technique.

uk: вхід без авторизації

name: Backdooring Hardware Devices By Injecting Malicious Payloads On Microcontrollers


uk: Комп'ютерні науки

description: Analysts believe there are currently on the order of 10 billions Internet of Things (IoT) devices out in the wild. Sometimes, these devices find their way up people's butts: as it turns out, cheap and low-power radio-connected chips aren't just great for home automation - they're also changing the way we interact with sex toys. In this talk, we'll dive into the world of teledildonics and see how connected buttplugs' security holds up against a vaguely motivated attacker, finding and exploiting vulnerabilities at every level of the stack, ultimately allowing us to compromise these toys and the devices they connect to.

uk: вхід без авторизації

name: Adventures In Smart Buttplug Penetration (testing)


uk: Комп'ютерні науки

description: If toasters talking to fridges is no joke to you, then you are aware of the big Internet of Things hype these days. While all kind of devices get connected and hacked, one of the oldest class of IoT devices seems to be forgotten even though it is literally everywhere - VoIP phones. For configuration and management purposes, VoIP phones run a web application locally on the device. We found several critical bugs (reported CVEs) in the web application as well as in the webserver which enabled us to hijack the phones. Starting with simple XSS and CSRF issues, via command injections and memory corruptions right through to remote code executions, all popular vulnerability classes can be found on those devices. We will present our findings together with the tools and strategies we used, and will enable you to do the same with your own phones and other IoT devices. Further, we will provide helpful ARM shell code patterns, scripts and tricks which hackers can use to find bugs. We will conclude our talk by showing that automatic tools fail to discover such vulnerabilities. Therefore, manual IoT pentesting is still required. If you think these management interfaces are not exposed to the internet, you are wrong. In a scan, we found thousands of reachable phones vulnerable to our exploits.

uk: вхід без авторизації

name: I'm on your phone, listening - Attacking VoIP Configuration Interfaces


Closing Ceremonies

uk: Комп'ютерні науки

description: DEF CON 27 draws to a close. Prizes awarded, Black Badge winners announced, thanks given, future plans revealed.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Surveillance detection routes are a daily occurrence for clandestine operatives and agents all over the world. These mentally taxing counter-surveillance measures often mean the difference between life and death. Surveillance Detection Scout hopes to ease that burden. Scout currently supports Tesla Models S, 3 and X, running license plate recognition on 3 camera feeds to alert you in real time if you're being followed. When you park, Scout remains vigilant, implementing familiar face detection as well. By combining timestamped vehicle location data & video, computer vision and an intuitive web interface, it becomes apparent that Scout has just as many offensive as defensive applications. Over time, SDS captures and reports on observed patterns of life, allowing you to quickly gain an overview of your surroundings (or your target) with minimal effort. Whether you're conducting or evading surveillance, Scout has got your 6.

uk: вхід без авторизації

name: Surveillance Detection Scout - Your Lookout on Autopilot


uk: Комп'ютерні науки

description: Over the past years, our team has used several new approaches to identify multiple critical vulnerabilities in SQLite and Curl, two of the most widely used basic software libraries. These two sets of vulnerabilities, which we named "Magellan" and "Dias" respectively, affect many devices and software. We exploited these vulnerabilities to break into some of the most popular Internet of things devices, such as Google Home with Chrome. We also exploited them on one of the most widely used Web server (Apache+PHP) and one of the most commonly used developer tool (Git). In this presentation, we will share how we try to crack the Google Home from both hardware and software aspects, get and analyze the newest firmware, solve the problem, and introduce new methods to discover vulnerabilities in SQLite and Curl through Fuzz and manual auditing. Through these methods, we found "Magellan", a set of three heap buffer overflow and heap data disclosure vulnerabilities in SQLite ( CVE-2018-20346, CVE-2018-20505 CVE-2018-20506 ) We also found "Dias", two remote memory leak and stack buffer overflow vulnerabilities in Curl ( CVE-2018-16890 and CVE-2019-3822 ). Considering the fact that these vulnerabilities affect many systems and software, we have issued a vulnerability alert to notify the vulnerable vendor to fix it. We will disclose the details of "Magellan" and "Dias" for the first time and highlight some of our new vulnerability exploitation techniques. In the first part, we will introduce the results of our analysis on hardware, how to get the newest firmware from simulating an update request, and attack surface of Google Home. We will show how to use Magellan to complete the remote exploit of Google Home, we will also give a brefing talk about how to use Dias to complete the remote attack on Apache+PHP and Git. Finally, we will summarize our research and provide some security development advice to the basic software library developers. Wenxiang Qian Wenxiang Qian is a senior security researcher at the Tencent Blade Team. He is focusing on security research of IoT devices. He also do security audits for web browsers. He was on the top 100 of annual MSRC list (2016 & 2017 ). He published a book called "Whitehat Talk About Web Browser Security ". YuXiang Li YuXiang Li is a senior security researcher at Tencent Blade Team, specialized in the study of Mobile Security and IoT Security. He has reported multiple vulnerabilities of Android and received acknowledgments from vendors(Google/Huawei). He was a speaker of HITB AMS 2018 and XCON 2018. HuiYu Wu HuiYu Wu is a senior security researcher at Tencent Blade Team. Now his job is mainly focus on IoT security research and mobile security research. He was also a bug hunter, winner of GeekPwn 2015, and speaker of DEF CON 26 , HITB 2018 AMS and POC 2017.

uk: вхід без авторизації

name: Breaking Google Home: Exploit It with SQLite(Magellan)


Phreaking Elevators

uk: Комп'ютерні науки

description: This is a comprehensive dive into the current emergency phones with an in-depth look at the phones used in elevators. This talk will provide unique insight into a topic that hasn't been covered before: Elevator Phones. During this talk, I will discuss the commonality between elevator phone brands. I will cover a new, never before released, set of default passwords these system use. I will show a tool kit and how to use it to access elevator phones locally, as well as remotely. In addition, I will show how to reprogram a phone , how to make the elevator state its location, and how to alert the passenger that help is on the way. Finally, I will demonstrate some attacks, including how you can use elevator phones as listening devices to silently listen to conversations of people inside an elevator. I’m WillC, your elevator operator, let's go for a ride!

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Did you know that Elastic Block Storage (Amazon EBS) has a "public" mode that makes your virtual hard disk available to anyone on the internet? Apparently hundreds of thousands of others didn't either, because they're out there exposing secrets for everyone to see. I tore apart the petabytes of data for you and have some dirty laundry to air: encryption keys, passwords, authentication tokens, PII, you name it and it's here. Whole (virtual) hard drives to live sites and apps, just sitting there for anyone to read. So much data in fact that I had to invent a custom system to process it all. There's a massive Wall of Sheep out there on the internet, and you might not have even noticed that you're on it. Actually, you should stop reading and go check that out right now.

uk: вхід без авторизації

name: More Keys than the Janitor: Hacking exposed AWS EBS Volumes


uk: Комп'ютерні науки

description: Nearby sharing apps are very convenient and fast when you want to transfer files and have been pre-installed on billions of devices. However, we found that most of them will also open a door for attackers to steal your files and even more. First, we did a comprehensive research about all top mobile vendors' pre-installed nearby sharing apps by reverse engineering. Many serious vulnerabilities are found on most of them and reported to vendors. Algorithm and design flaws in these apps can lead to file leaking and tampering, privacy leaks, arbitrary file downloads and even remote code execution. We will present all the related vulnerabilities' details and exploit techniques. Next, we conducted the same research on lots of third-party file sharing apps and found that they are even worse about security and are used by surprising more than 1 billion users. Files transferred between them are nearly naked when our MITM attack devices are nearby. Finally, we will summarize all the attack vectors and two common attack models. We will also present the attack demos and related tools. Besides, we will present our practical mitigations. Currently, we are working with most of the top vendors to mitigate these vulnerabilities. Through this talk, we want to notify users and mobile vendors to pay more attention to this serious situation and fix it better and sooner.

uk: вхід без авторизації

name: Your secret files are mine: Bug finding and exploit techniques on file transfer app of all top android vendors


All the 4G Modules Could Be Hacked

uk: Комп'ютерні науки

description: Nowadays more and more 4G modules are built into IoT devices around the world, such as vending machines, car entertainment systems, laptops, advertising screens, and urban cameras etc. But no one has conducted a comprehensive security research on the 4G modules. We carried out this initiative and tested all the major brand 4G modules in the market (more than 15 different types). The results show all of them have similar vulnerabilities, including remote access with weak passwords, command injection of AT Command/listening services, OTA upgrade spoofing, command injection by SMS, and web vulnerability. Through these vulnerabilities we were able to get to the shell of these devices. In addition to using wifi to exploit these vulnerabilities, we created a new way to attack through fake base station system, triggered by accessing the intranet of cellular network, and successfully run remote command execution without any requisites. In this talk, we will first give an overview on the hardware structure of these modules. Then we will present the specific methods we use in vulnerability probe. In the final section we will demonstrate how to use these vulnerabilities to attack car entertainment systems of various brands and get remote control of cars.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Pointer Authentication (in short, PAuth) is the latest security mechanism in iOS. It is proposed to protect the integrity of pointers with hardware-assisted encryption, thus eliminating the threats of code-reuse attacks. In PAuth, a cryptographic signature called PAC is calculated from a pointer value and inserted into the pointer. When the pointer is about to be used, the PAC is extracted and verified whether it is consistent with the original pointer value. In this way, PAuth is able to ensure that the pointers are not tampered. iOS deployed PAuth in user-space system services, protecting pointers that may affect the control flow and preventing code-reuse attacks like ROP and JOP. However, in our study, we found that a fatal flaw in the implementation of iOS PAuth makes user-space system services till vulnerable to code-reuse attacks. The flaw is: iOS uses the same signing key in different user-space processes. This flaw allows a signed pointer from a malicious process can be correctly verified in a system service, thus making it possible to launch JOP. In this talk, we will explain how we found the flaw and why it is inevitable. In advance, we will demonstrate how to leverage this flaw and launch JOP attacks in a PAuth-protected system service. Also, we will propose a new tool, PAC-gadget, to automatically find JOP gadgets in PAuth-protected binaries.

uk: вхід без авторизації

name: HackPac: Hacking Pointer Authentication in iOS User Space


uk: Комп'ютерні науки

description: In this talk, we will share our research in which we successfully exploit Qualcomm WLAN in FIRMWARE layer, break down the isolation between WLAN and Modem and then fully control the Modem over the air. Setup the real-time debugger is the key. Without the debugger, it's difficult to inspect the program flow and runtime status. On Qualcomm platform, subsystems are protected by the Secure Boot and unable to be touched externally. We'll introduce the vulnerability we found in Modem to defeat the Secure Boot and elevate privilege into Modem locally so that we can setup the live debugger for baseband. The Modem and WLAN firmware is quite complex and reverse engineering is a tough work. Thanks to the debugger, we finally figure out the system architecture, the components, the program flow, the data flow, and the attack surfaces of WLAN firmware. We'll share these techniques in detail, along with the zero-days we found on the attack surfaces. There are multiple mitigations on Qualcomm baseband, including DEP, stack protection, heap cookie, system call constraint, etc. All the details of the exploitation and mitigation bypassing techniques will be given during the presentation. Starting from Snapdragon 835, WLAN firmware is integrated into the Modem subsystem as an isolated userspace process. We'll discuss these constraints, and then leverage the weakness we found to fully exploit into Modem.

uk: вхід без авторизації

name: Exploiting Qualcomm WLAN and Modem Over the Air


9.4 The Hard Way

uk: Комп'ютерні науки

description: Upgrades in postgres are a challenging thing - there are several options, all with various things to consider. This presentation explains the procedure of using pg_upgrade with hard links between the old and new data directories to upgrade the master, and rsync to upgrade the slaves with minimal downtime. This method requires no additional hardware and no external replication strategies. After the what went wrong and the what went right, we will walk through a live upgrade step by step.

uk: вхід без авторизації

name: PGCon - PostgreSQL Conference for Users and Developers


uk: Комп'ютерні науки

description: Migration project of a mission-critical database system to PostgreSQL will be presented. The target is the billing system of a large Japanese telecommunication company. The system handles quite a large amount of data and performs both transactional and analytic operations. The most difficult challenges of the project were to stabilize the batch program performances. In this talk, I will describe the issues that occurred in the projects and how we approached them. We prepared a tool affecting PostgreSQL planner, which solved the toughest problems of the project. This talk will cover it as well.

uk: вхід без авторизації

name: A Challenge of Huge Billing System Migration


Audit Logging for PostgreSQL

uk: Комп'ютерні науки

description: Many of us have had auditors ask for information that is difficult to provide with core PostgreSQL. Who made changes to table X in the last six months? When was table Y's DDL last modified and was that during a maintenance window? Who has viewed table Z? An extension available for PostgreSQL 9.5, pgaudit, seeks to answer these and many other questions by providing more detailed logging and finer control of what is logged than is currently available. This talk will examine pgaudit design and usage before presenting practical examples.

uk: вхід без авторизації


Autovacuum, explained for engineers

uk: Комп'ютерні науки

description: In this talk, I will cover PostgreSQL MVCC and Undo-management basics, problems and hazards of misconfigured autovacuum, a couple of strategies on how to make your PostgreSQL installation feel happy about autovacuum. In addition I will show a couple of bloat-removing techniques and give some advices on how to monitor autovacuum activity in your database.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: B-tree index is the most common index type. Most if not all of the modern DBMS use it. The data structure and concerned algorithms are really mature, there are about 40 years of development. And PostgreSQL's B-tree is not exception. It's full of complicated optimisations of performance, concurrency and so on. But there're still many ways to improve it. At the conference we'll discuss new features which are already done and ideas for further improvements. Of course it requires deep drive into B-tree internals and I'm going to guide you there.

uk: вхід без авторизації

name: B-Tree - explore the heart of PostgreSQL


Benchmarking Databases

uk: Комп'ютерні науки

description: Database migration projects are expensive. Be it a change in hardware architecture, operating system, the database system itself or all of it. An important step at the very beginning of such a project is to evaluate if and how well the proposed new system compares to the old one with respect to performance and scalability.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This talk will take you to an optimizer backstage tour: from theoretical background of state-of-the-art query optimization to close look at current implementation of PostgreSQL. We also share our experiences to hack the optimizer in our laboratory. Query optimization is a cornerstone of modern database software including PostgreSQL. However its internal mechanism is not widely known to the community. The goal of this talk is to offer clear and deep knowledge of query optimization technology.

uk: вхід без авторизації

name: Beyond EXPLAIN: Query Optimization From Theory To Code


Building a BaaS using PostgreSQL

uk: Комп'ютерні науки

description: The typical way to design a web or mobile application is to do the data modelling, create an API around it and wrap it as backend using a web framework of choice and serve the API. Now, what if you could get everything done in the data modelling stage itself? There is a new paradigm of web development called "noBackend". It doesn't mean that we completely eliminate the backend from our architecture. Its just that the server side components of our infrastructure become a swappable commodity. Developers no longer need to worry about your backend details. All they need is a REST API, which you can automatically generate from your SQL schema. In this talk, We'll show you how to build a full fledged backend for an application without leaving the confines of your PostgreSQL console (well, almost!). We shall leverage a standalone tool called Postgrest, which will instantly convert your schema into a RESTful API.

uk: вхід без авторизації


PGCon 2016 - Closing sessions

uk: Комп'ютерні науки

description: The Traditional Closing Session

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This article presents the results of the diploma in PostgreSQL databases technologies, tool for the training of specialists in the correct use of databases technologies and solutions related to this manager, and the immediate projections to it perfect accord to the country needed. Cuba is betting on business efficiency as a vital weapon to tackle the current worldwide economic crisis. Today the work on enterprises or entities is not conceived without the informatics applications that help in processes, resources, products management and decisions-making, increasing performance and efficiency; applications that are supported, generally, by a database. Currently the brakes on growth in the use of open source databases management for handling them, is the lack of knowledge by Cuban specialists in handling these types of technologies. The Cuban university, as being essential to the development of society, should develop strategies to support the migration to open source software and with it, the gradual use of technologies that generate no charges for the use of proprietary technologies and to achieve the country technological sovereignty. This article presents, in line with this necessity, the results of the first edition of the diploma in PostgreSQL databases technologies, tool for the training of specialists in the correct use of databases technologies and solutions related to this manager, and the immediate projections to it perfect accord to the country needed.

uk: вхід без авторизації

name: Experience Cuba with PostgreSQL: PostgreSQL Diploma


Faster PostgreSQL: Improved Writes

uk: Комп'ютерні науки

description: This paper will mainly talk about the write performance improvements done in PostgreSQL 9.6 and will share the experiments showing the extra WAL data written due to the current algorithm used to write WAL. This paper will discuss about weakness of current locking strategy for various locks used at Commit-time and new algorithm used to improve the situation along with performance data. I will then talk about the situations where this algorithm can be used at other places in PostgreSQL. It will also describe about the performance improvements being currently worked on like bulk-load and others that are done for 9.6. It will also discuss about the weakness of current WAL writing algorithm due to which it writes much more amount of WAL than required and some ideas to improve the algorithm which will lead to reduced amount of WAL writes. I will also share the data showing the extra writes and some experiments done by me to reduce the same and the pros and cons of each approach used to reduce the WAL-writes.

uk: вхід без авторизації


FTS is dead? Long live FTS!

uk: Комп'ютерні науки

description: Long time ago we introduced full-text search in PostgreSQL, but since then it's development was stopped. It's popular feature of postgres and it has to be enhanced and improved to match users experience and wishes. We will present several new improvements in FTS, which addresses some of them. From time to time we get messages from users about full-text search we developed many years ago. People ask about new features they would like to have in future version of FTS. Most popular were an ability to search for phrases, better support of *spell dictionaries and easier use. There were also complains about performance of FTS, comparison with other external search engines and questions about "fuzzy" search with FTS. Several people asked about ranking functions and underlying algorithms. Postgres becomes better and better with every release, but FTS even if it got benefit from index improvements, was still the same as we developed about 10 years ago. In this talk we will present several new improvements and features, which hopefully make full-text search in PostgreSQL more attractive and efficient.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Have you been told that automated failover for PostgreSQL is "too hard" or even "impossible"? Have you been forced to live with SLAs measured in hours? Is spinning up a new replica something which requires weeks of planning? Well, no more. Using Project Atomic, Kubernetes and Patroni, you can have always-up PostgreSQL-as-a-Service in your own datacenter. And surprisingly easily, too!

uk: вхід без авторизації

name: How I Learned to Stop Worrying and Love Failover


In memory Column Store

uk: Комп'ютерні науки

description: This presentation goes through the discussion of need of in-memory column store and approach to achieve it with different storage types and how it works for different SQL statements. And also, the interaction with parallelism for better performance and it's performance comparison with commercial databases based on the current prototype patch and its further improvements.

uk: вхід без авторизації


Index Internals

uk: Комп'ютерні науки

description: PostgreSQL includes several index types: GiST, SP-GiST, GIN, and of course, the regular B-tree. DBAs are familiar with using each of these for specific use cases, GIN for full-text search, GiST for geometrical data, and so on, but how do they work internally? What makes them suitable for the cases they're typically used for? In this presentation, I will walk through the internal structure of each of these index types, explaining what strengths and weaknesses each one of them have.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Citus is a distributed database that scales out Postgres. By using the extension APIs, Citus distributes your tables across a cluster of machines and parallelizes SQL queries. This talk describes Citus' distributed query planner by focusing on our experience in distributed systems. We first show that the primary challenge for any distributed planner is a theoretical understanding of which computations are easy to scale. We provide three example SQL queries that demonstrate these challenges: (a) simpler aggregate functions with groupings, (b) large table joins, and (c) complex subselects. We then explain why some queries are harder to scale than others. Next, we map these two queries into relational algebra (logical plan). We show that a simple abstraction, one that separates logical and physical planning, can minimize network I/O and parallelize all SQL queries in a small amount of code. We conclude by comparing query planning methods across different distributed databases.

uk: вхід без авторизації

name: Lessons in Building a Distributed Query Planner


uk: Комп'ютерні науки

description: The format remains essentially the same: in a one hour period, audiences are entertained and informed by a rapid fire series of short talks on interesting new or on-going work by individuals or groups. Slides aer permitted, but not obligatory; pictures are highly recommended. Topic areas include new open source software projects, works in progress for future releases of existing projects, student projects, etc. Lightning talks topics this year may make good conference papers next year!

uk: вхід без авторизації

name: PGCon 2016 - Lightning Talks: Short sharp descriptions of short topics


uk: Комп'ютерні науки

description: Compiling PostgreSQL from source is a relatively easy thing to do compared to most open source projects. But for production systems, using the packages the operating systems provide is generally the recommended way to go. The problem is none of them end up managing PostgreSQL quite the same, let alone anything like the original source compile. This talk will cover how some of the major Unix-based operating systems manage their provided PostgreSQL packages.

uk: вхід без авторизації

name: Managing OS Provided PostgreSQL Packages


MLS PostgreSQL

uk: Комп'ютерні науки

description: Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

uk: вхід без авторизації


Non volatile Memory Logging

uk: Комп'ютерні науки

description: Emerging byte-addressable, non-volatile memories (NVMs) is revolutionary as the data written by a store operation of the CPU is nonvolatile. This talk presents the architecture of a prototype and performance evaluation results that demonstrate the potential of NVMs when they are used for the WAL buffer in PostgreSQL; a transaction becomes durable promptly after its WAL records are written in the WAL buffer. There is no need to wait the WAL records are written in the storage device. In a nutshell we can exploit the performance of asynchronous commit without impairing the transaction durability by using NVM for WAL buffer. Although the idea is simple, its implementation, however, is not. This talk also covers the difficulties to implement NVM WAL buffer and how to address them. Finally, I would like to share some knowledge that I obtained through the implementation and examination of the prototype.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: The PostgreSQL buildfarm is the community's implementation of continuous testing. It enables PostgreSQL to consistently issue portable releases despite each contributor testing on no more than a few platforms. Each buildfarm failure report invites human assessment, which often prompts a quick fix. Certain failure modes, especially narrow race conditions, persist for months. After outlining typical difficulties of making tests pass everywhere, this talk will detail a four-month project to purge the race conditions from one regression test.

uk: вхід без авторизації

name: Not Easy Being Green: The Long Tail of Buildfarm Failures


Data Types in PostgreSQL: A guide tour

uk: Комп'ютерні науки

description: Everyone knows how to tell a TIMESTAMP from a TEXT, but how deep into the catalogue of Postgres data types have you gone? In this talk, we'll push past the best-known types into the pantheon of useful but less-appreciated data types Postgres has to offer, including both some that come bundled with Postgres, some you can define for yourself, and some that are available today as extensions.

uk: вхід без авторизації


Parallel Query Has Arrived!

uk: Комп'ютерні науки

description: Capabilities expected to be part of PostgreSQL 9.6 will substantially improve the performance of queries that touch large volumes of data, such as reporting queries on databases used primarily for OLTP. I'll discuss those improvements with examples and benchmark results. In addition, I'll discuss the cases where the current implementation fails to speed things up as much as one might hope, either because the optimal plan is not generated or because the plan fails to run as fast in parallel as might be hoped, and explain how we might improve things in the future. Finally, I'll discuss the pluggable nature of the parallelism infrastructure and explain how, first, it can be used for purposes other than running queries, and, second, if part of it doesn't work well in a particular case, a replacement part can be substituted in for that particular purpose without much impact on the surrounding code.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This talk will discuss and demonstrate the pg_paxos extension, which adds an implementation of the Paxos distributed consensus algorithm to PostgreSQL. pgpaxos provides yet another way of doing table replication in PostgreSQL by automatically replicating a query log through Multi-Paxos. Unlike existing replication solutions, pgpaxos can provide consistent, fault-tolerant, multi-master replication across PostgreSQL servers, at the cost of high read- and write latencies and low throughput. pg_paxos is not a general replication solution, but is especially suitable for applications such as automated fail-over, distributed locking, and managing cluster membership, and can potentially replace components such as Zookeeper.

uk: вхід без авторизації

name: pg_paxos: Table Replication through Distributed Consensus