Wim Remes - “Damn kids. They're all alike.” … we have a date with history.
Tiago Pereira - What botnet is this?
Tiago Henriques / Tiago Martins - Security Metrics: Why, where and how?
Steve Lord - Your career is a system. It's time to root it.
Ricardo Dias - The art of malware cluster visualization
Pedro Vilaça - BadXNU, a rotten apple!
Marco Vaz - How to hack into your home router
Kyriakos Economou - Shellter - A dynamic shellcode injector
Joxean Koret - Diaphora: a new FOSS program diffing tool
Herman Duarte / Cláudio André - Is my app secure ?
Francisco Guerreiro - NAC/NAP/802.1x systemic bypass for 15EUR
Duarte Monteiro - Inside the CAN
Doron Shiloach - Taking Threat Intelligence and Sharing to the Next Level
David Marques - Data Theft - Who the hell stole my data?
Wim Remes
“Damn kids. They're all alike.” … we have a date with history.
“Yes, I am a criminal. My crime is that of curiosity. My crime isthat of judging people by what they say and think, not what they look like.
My crime is that of outsmarting you, something that you will never forgive me
for.
I am a hacker, and this is my manifesto. You may stop this individual,
but you can't stop us all... after all, we're all alike.”
- The Mentor, January 8th 1986
Today we’re almost 30 years after The Mentor wrote “The Conscience of a hacker” and 45 years after Willis H. Ware wrote “Security Controls Report” for the American government. As an industry we are on the verge of no longer being able to claim immaturity. As a community we are way past that stage.
This talk will cut deep into our community, the problems we are responsible for resolving, the industry we have a relationship with, and our way ahead. Join me in a fast-paced analysis of where we are, how we got to this placed, and how we’re going to get out of here through an interesting yet treacherous journey. After all, we’re all alike and we’re in this together.
About the Speaker:
As the Manager of Strategic Security Services for Rapid7 in EMEA Wim Remes leverages his 15+ years of security leadership experience to advise clients on reducing their risk posture by solving complex security problems and by building resiliency into their organization. Wim delivers expert guidance on reducing the high cost of IT security failures, both financially and in terms of brand reputation combining his deep expertise in network security, identity management, policy design, risk assessment and penetration testing to develop innovative approaches to enterprise security. Before joining the Rapid7 team Wim was a Managing Consultant at IOActive and previously he has worked as a Manager of Information Security for Ernst and Young and a Security Consultant for Bull, where he gained valuable experience building security programs for enterprise class clients.
Wim has been engaged in various infosec community initiatives such as the co-development of the Penetration Testing Execution Standard (PTES), InfosecMentors, The Eurotrash Security Podcast and organizing the BruCON security conference. Wim has been a featured speaker at international conferences such as Excaliburcon (China), Blackhat Europe, Source Boston, Source Barcelona and SecZone (Colombia). He is also a Member of the Board of Directors at (ISC)2.
Tiago Pereira
What botnet is this?
The story of an investigation of a botnet from its detection trough network traffic analysis to its identification and classification. On this presentation we will show some of the work done at anubis labs on botnet detection and analysis, detailing the process of reversing the malware DGA and network protocol.About the Speaker:
Tiago Pereira is an information security enthusiast with 9 years of experience in the field. Passionate about forensics and malware reverse engineering, he is currently a Threat Intelligence Analyst at AnubisNetworks where he focuses on malware reversing and threat research.
Tiago Henriques / Tiago Martins
Security Metrics: Why, where and how?
Security Metrics, when used correctly can help you paint a picture on the status of ur Security, they can also help you make security decisions so that you can prioritize and reduce the risk when making these decisions.This talk will focus on answering the following questions:
-What security metrics can I get ?
-How can they help me?
-How can I get started with obtaining and using security metrics?
-How can I combine data science with security and automation?
-How can I be in an agile environment and still have Security measures and processes apply ?
We will also provide some demos where we obtain and analyse security metrics from different sources.
About the Speaker:
Tiago ‘Balgan’ Henriques currently is the CEO at BinaryEdge. A startup located in Zürich,Switzerland.
At the university he did some part time lecturing on a different range of topics, from Computer Security, to Networking and Cryptography. His main interests are: Cryptography, Pentesting, Information Security, Computer Security and Forensics, Vulnerability research, and data Science.
Hello, I’m Tiago Martins currently CTO at BinaryEdge.
My work is security related so I can’t share much, but what I can share is that it involves real time analysis of events that allows the identification of infected machines.
Steve Lord
Your career is a system. It's time to root it.
Many people enjoy breaking systems, from computers to software to communications protocols. What most people don't understand is that your job, your career and your life are all systems.All of these things can be hacked, with startling results once you know what to do with the ability. In this talk, I discuss your career's threat surface, how to map out objects and methods, and how to exploit weaknesses in common career processes in order to redirect your employment, inject arbitrary content, and in some cases execute arbitrary pay rises.
Your career is a system like any other. It's time to exploit it to it's full potential.
About the Speaker:
Steve has been a career penetration tester for over 15 years, the last 10 of which has been spent at UK pentest consultancy Mandalorian. He also co-organises the UKs 44CON Cybersecurity and 44CON London and is the author of “Breaking In: The Pentester’s Hidden Handbook”.
Steve writes about penetration testing and career hacking at rawhex.com and occasionally for SC Magzine, IT Security Guru, the Gentleman Hacker’s Club and other online outlets.
Ricardo Dias
The art of malware cluster visualization
The last few years have been challenging for incident responders. Information technology threat landscape changed dramatically, malware is becoming stealthier, diverse and modular. Its not without surprise that concepts like automated behaviour analysis, malware clustering, data visualization and threat intelligence sharing became so popular. While some open source solutions already feature these cutting edge concepts, there is still a gap on how to integrate them successfully into your incident response process.This talk will focus on how to improve incident response by aggregating and visualizing portable executable malware samples that share similar structure or behaviour. It will be explained and compared two popular cluster hashing functions: peHash and impHash. Threat intelligence from various sources including Virustotal, YARA and PEiD will be used to aggregate clusters into charts. Finally a live proof-of-concept, featuring popular malware, will demonstrate the capabilities of data visualization applied to malware clusters.
About the Speaker:
Ricardo Dias is an intrusion detection analyst and a passionate malware hunter. For the last 10 years Ricardo has been assisting government and financial institutions in incident response and developing tools for malware analysis, threat intelligence and data visualisation.
Pedro Vilaça
BadXNU, a rotten apple!
Your latest OS X 0day exploit got you root and now what? Apple (finally) introduced mandatory code signing for kernel extensions in Yosemite so there's a new obstacle to your beautiful kernel rootkit. Are you an OPSEC ninja or too cheap to buy $99 a code signing certificate? You can't or don't want to steal (because it's morally wrong!) someone's else certificate?This presentation is about solving these problems with techniques that allow you to bypass code signing requirements and regular kernel extensions loading interfaces. The goal is to convince you that kernel extensions code signing is a joke because its design is flawed. But this isn't enough, challenging, or even fun. I'll show you how to abuse a public known vulnerability that is still present in all available OS X versions and also a feature available in Mavericks and Yosemite, working around some "protections" in XNU kernel.
The full source code for both rootkit loaders will be available so you can poke around and hopefully learn a thing or two. Hopefully this will be more than enough to convince you that there are serious issues in the OS X platform and something must change at Apple.
The only requirement for this talk is uid=0(root). Well, the world isn't perfect but there is hope. Google Project Zero has already shown how easy it is.
About the Speaker:
A leading expert in the field of not being an expert, plays with computers for more than 30 years, holds a degree in Economics and a MBA, writes a somewhat famous OS X related blog, breaks copy protections for fun and profit, annoys HackingTeam, trolls Apple’s product security policy, loves to solve weird problems, tries to spread some knowledge and write a different bio for each conference.
Lately very interested in improving OS X security and malware research. Wrote a long OS X rootkits article for Phrack and finally making that OS X rootkits book a reality.
Marco Vaz
How to hack into your home router
I will talk about the a mips32 router hacking process covering the discovery of bugs, developing the exploits and exploiting of the router.The presentation will focus on firmware analysis, firmware virtualization and debugging. The research on the vulnerabilities CVE-2014-1635 and CVE-2013-7173 will be the connecting thread on this talk.
About the Speaker:
Marco Vaz is Director of PenTesting at KeepITSecure24 and Partner at INTEGRITY. He has been working in Information Security for more than 16 years.
He had several roles and responsibilities in Security Architecture Design and Implementation, Security Operations, Incident Management, Malware analysis and Penetration Testing.
Kyriakos Economou
Shellter - A dynamic shellcode injector
AV evasion, a challenge for both good and bad guys. A few tools are around promissing to assist professionals with AV bypassing during pentesting jobs.However, they all share the same weaknesses which are originating by their technical approach based on very strict and quite 'static' rules. This facilitates the creation of AV detection signatures that can shorten the lifetime of effectiveness of those tools quite fast. This results into tools that either work half of the time or tools that require frequent updates by their authors.
Shellter, breaks those rules and creates a very strong and reliable shelter for your shellcode. In fact, almost all of the updates that have been applied to Shellter since v1.0 were done in order to make it more user-friendly. Those that were done to optimize its effectiveness were done because its author is quite paranoid.
About the Speaker:
I started reverse engineering software protections for fun. That led me to malware…analysis, and then I moved on with vulnerability research and exploit development which have also become the main areas of interest for me.
In my free time I enjoy researching and developping my own tools, PoCs, and skills.
I love what I do, I do what I love and this pretty much would be all about me. ;o)
Joxean Koret
Diaphora: a new FOSS program diffing tool
During this talk I will discuss how I started creating this bindiffing suite, why, the current state and the ideas for the future and will also discuss about all the algorithms and heuristics implemented in Diaphora.About the Speaker:
Joxean Koret has been working for the past +15 years in many different computing areas. He started working as database software developer and DBA for a number of different RDBMS. Afterwards he got interested in reverse engineering and applied this knowledge to the DBs he was working with, for which he has discovered dozens of vulnerabilities in products from the major database vendors, specially in Oracle software. He also worked in other security areas like malware analysis and anti-malware software development for an Antivirus company or developing IDA Pro at Hex-Rays. He is currently a security researcher in Coseinc.
Herman Duarte / Cláudio André
Is my app secure ?
Based on our experience on testing mobile applications, both on Android and iOS, we challenged ourselves on doing an assessment of both app stores' applications, using OWASP mobile top 10 as a reference in terms of vulnerabilities to search for.As a criteria for choosing the apps to test, we focused on the most common mobile applications available in the Portuguese Android and iOS app stores, from several categories such as finance, social media, medical and security.
For this talk we expect to highlight the most interesting design choices both good and bad and what should be done to avoid such mistakes.
About the Speaker:
Herman Duarte is an infosec professional by day and an infosec ninja by night, he loves everything that is security related, from hardware devices, web apps and mobile applications. Working in the infosec field with Integrity S.A., HD is a lead consultant that helps his clients in security engagements from penetration testing to consultancy related projects, in different countries around the globe. HD is a 2 times speaker at codebits, confraria segurança&it and 2 times winner (alongside with his cool teammates) of the codebits CTF.
Cláudio is a Security Consultant at Integrity S.A. His experience includes penetration testing on web applications, infrastructure and mobile applications. Prior to joining Integrity, he has been involved in many different projects involving System Administration and Software Development. Starting from early age, he is passionate with everything related with technology.
Francisco Guerreiro
NAC/NAP/802.1x systemic bypass for 15EUR
I'm gonna cover malicious hardware stuffs, basicaly using a NEXX WT3020 with a custom firmware that raep's NAC/NAP and other 802.1x based shits. i'll cover a few other uses for hardware that can be latched on legit corporate workstations.About the Speaker:
Insecurity researcher since circa 2001 with wide IT integration background (tons of industry certifications from such vendors as Cisco, Checkpoint, SCP, CIW, Comptia, LPI, Novell, Microsoft among others).
Finally ended up working 9to5 in INFOSEC industry around 2009 doing the full conversion from blackhat to goldhat.
I also have some data<3 in my dna.
Deep religious fanatic of the Missionerande Kopimistsamfundet (Missionary Church of Kopimism), i take this chance to share the following with you reading this:
All knowledge to all;
The pursuit of knowledge is sacred;
The circulation of knowledge is sacred;
The act of copying is sacred.
Copying of information is ethically right;
Dissemination of information is ethically right;
Copymixing is a sacred kind of copying, more so than the perfect, digital copying, because it expands and enhances the existing wealth of information;
Copying or remixing information communicated by another person is seen as an act of respect and a strong expression of acceptance and Kopimistic faith;
The Internet is holy (Not generally accepted by churches run by the Maesters);
Code is law.
finally, POC || GTFO!
Duarte Monteiro
Inside the CAN
A CAN network is present in the cars board computer that controls multiple variables necessary to a normal functional of the vehicle. We will see how can we gather information about the status of the vehicle, exploit features, and variable manipulation for fun. Due to the raising number of electronic components in cars, some attention is drawn to each security issues can be exploited and possibly endanger the user. Another issue is the interconnectivity of the services that surround the intra network that crash the integrity of the system. After a deep research on the topic i decided to present my findings and raise awareness about CAN inSecurity.Extra: How to steal a BMW in 4 min.
About the Speaker:
I’m a security researcher long before my engineering degree, been passionate about security, since i changed the way i saw the world: everything has a flaw, everything has a weakness. Security is a transversal concept so i try to expand my knowledge in several areas including lock picking, microcontrollers, NFC, Security Certifications, Risk Analysis, etc.. The past year, security changed the position in my life from hobby to a professional and academy level, begun to making freelance pentesting on infrastructures and WhiteHat stuff and making my way in Information Security masters degree (+ two academy CISCO certifications). Currently i’m a Security Analyst for a multinational company where i’m engaged with a team responsible for security automation processes.
Doron Shiloach
Taking Threat Intelligence and Sharing to the Next Level
Researching and mitigating threats is a complex business. Whether integrating threat intelligence feeds or building processes, organizations are faced with tremendous cost and complexity as they build a standing army of defenders. Cybercriminals’ tools, techniques and technology have changed and adapted as well. While some attacks involve sophisticated and adaptive malware, others revolve around intelligence gathering and targeting weak spots in security technology. To combat these collaborative underground criminals, organizations need to work together to drive crowd-sourced threat intelligence to streamline and automate protection strategies. The only question is, who can work together better: the attackers or the enterprises?About the Speaker:
Doron Shiloach is a product manager with the X-Force research and development team with IBM Security, which is responsible for security content and threat and vulnerability research. Doron joined IBM in 2001, and has experience in technology strategy and innovation, as well as strategic alliances and engineering. Doron holds a masters degree in electrical engineering from University of Maryland.
David Marques
Data Theft - Who the hell stole my data?
Data theft is a growing problem on corporate networks, where most commonly internal users steal data due to several reasons. In this talk we will discuss why is it so common, what are the main motivations behind it, what does the portuguese law says about it, how can we find evidence of it using host based forensics and what countermeasures can be used.About the Speaker:
I’m an infosec entusiast for a bunch of years. My professional background also took me into it, as I divide my time into data recovery, digital forensics and infosec projects. Besides that, I hold some common infosec certs and also made a post-graduate in Information Security with Royal Holloway University of London. I like to know how things works from the inner parts of it, so infosec is just the best arena to do it.