Attacking Modern SaaS Companies

Modern software-as-a-service (SaaS) companies have a large footprint and a lot of automation which enables them to build their service quickly. Since several devops and cloud tools and processes are new, many companies don’t understand the risks and don’t plan with security in mind. Even some practiced network pentesters don’t always know the best way to find vulnerabilities […]

Read more

When Two-Factor Authentication is a Foe: Breaking the iCloud Keychain

Everybody knows about Apple iCloud backups: how to disable this feature, or (if you are on the other side) how to download the data. However, iCloud is not just about backups. There is quite a lot of data that is also being *synced* across all the devices, and as such stored in the iCloud. This […]

Read more

Incident Response and Forensics in AWS

Moving from on-premises deployments to the cloud can offer incredible benefits to many organizations, including a plethora of capabilities to build, scale, modify, monitor, and tear down infrastructure with never before seen speed and agility. But, how do you monitor for, and respond to, attackers that leverage those same capabilities against you? In this session, […]

Read more

MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need to Adapt)

Windows Defender Advanced Threat Protection will soon be available for all Blue Teams to utilize within Windows 10 Enterprise, which includes detection of post breach tools, tactics and techniques commonly used by Red Teams, as well as behavior analytics. Combined with Microsoft Advanced Threat Analytics for user behavior analytics across the Domain, red teamers will […]

Read more

Pwning a Smart Home in Under 10 Minutes

This is an informative and action-packed session revealing the scary secrets of the current state of IoT device security. It focuses on the various techniques which Gupta and his team used to break into several smart homes (and enterprises) taking advantage of the insecurity in smart devices. Some of the devices he will cover during the talk […]

Read more

Securing Network Communications: An Investigation into Certificate Authorities on Mobile

This talk will take an in-depth look at the certificate authorities (CAs) found on mobile devices today. The CAs included in our mobile devices make up the roots of trust that our secure network transactions rely on to validate that the servers we are talking to are who they say they are. Focusing specifically on […]

Read more

Control system security, are we living on luck?

Control systems are all around us, working in the background of our lives providing us light, water, heat, transportation, and many good things. These systems are becoming more digital and more connected than ever before, so we must consider control system security just like we do with IT systems. We certainly have seen a jump […]

Read more

Lessons Learned Hunting IoT Malware

Permeating the entire spectrum of computing devices, malware can be found anywhere code is executed. Embedded devices, of which many are a part of the Internet of Things (IoT), are no exception. With their proliferation, a new strain of malware and tactics have emerged. This presentation will discuss our lessons learned from reverse-engineering and hunting […]

Read more

Crash Course in Kubernetes & Security

Kubernetes is Google’s answer to container orchestration and some of the tools it provides developers are indistinguishable from black magic. However, with the power that it provides it also can let you fall into some security holes that are hard to climb out of. In this presentation we’ll go through those pitfalls, along with some […]

Read more

AirBnBeware: short-term rentals, long-term pwnage

What’s scarier, letting HD Moore rent your house and use your home network for day or being the very next renter that uses that network? With the colossal growth of the vacation rental market over the last five years (AirBnb, HomeAway), travellers are now more vulnerable than ever to network based attacks targeted at stealing […]

Read more

Hiding in Plain Sight – Taking Control of Windows Patches

On the second Tuesday of every month, Windows administrators stand ready to deploy the swarm of patches issues by Microsoft addressing new vulnerabilities found on mission-critical systems.  Although this patch management routing may have system admins feeling overwhelmed, Patch Tuesdays are expected, allowing them to plan accordingly for the maintenance windows. But IT organizations are […]

Read more

Hack Microsoft by using Microsoft signed binaries

PowerMemory is a PowerShell post-exploitation tool. It uses Microsoft binaries and as such is able to execute on a machine, even after the Device Guard Policies have been set. In the same way, it will bypass antivirus detection. PowerMemory can retrieve credentials information and manipulate memory. It can execute shellcode and modify process in memory (in userland […]

Read more

Open Source Malware Lab

The landscape of open source malware analysis tools improves everyday. A malware analysis lab can be thought of as a set of entry points into a tool chain. The main entry points are a file, a URL, a network traffic capture, and a memory image. This talk is an examination of the major open source […]

Read more

WiFi Exploitation: How passive interception leads to active exploitation

When was the last time you thought to yourself, hmm, I wonder if an attacker is exploiting my smart phone and laptop as a result of merely leaving my WiFi enabled? Or, when did you think: I wonder if a person can create a profile about me and possibly determine where I live, work, and […]

Read more

How To Secure Serverless Applications

Serverless applications offer a number of fantastic benefits that let you focus almost exclusively on solving your user’s problems. Relieved of the daily operations burden of traditional deployments, teams often think that security is taken care of inherently in the design. Nothing could be further from the truth. In this talk, we’ll explore how to […]

Read more

CANtact: Open Source Automotive Tools

Car hacking really came to light in 2015. We saw Jeeps getting attacked over the air, BMWs being remotely unlocked, and attacks on Tesla’s Model S. Yes, today’s cars are computers, and they going to have vulnerabilities. While cars have had in-vehicle networking for the last 25 years, only recently have we seen public attacks […]

Read more

Purple Teaming the Cyber Kill Chain: Practical Exercises for Management

Purple Teaming is conducting focused Red Teams with clear training objectives for the Blue Team for the ultimate goal of improving the organization’s overall security posture. The popular opinion is that Purple Teaming requires a big undertaking. This is not true and we will show practical exercises for Purple Teaming for varying levels of organizational […]

Read more

Utilizing Memory and Network Forensics for Scalable Threat Detection and Response

Modern threats necessitate active hunting for malware and attackers throughout an organization’s environment.  Unfortunately, traditional approaches to detection of this malicious activity are now inadequate as advanced malware and skilled attackers easily mislead them.  During this presentation attendees will learn how malware and attackers evade these traditional methods as well as how memory and network […]

Read more

How to build a malware classifier [that doesn’t suck on real-world data]

Machine learning is the latest trend in malware classification. It’s easy enough that everyone can now spin up a malware crawler, extract some features from the files, build some machine learning models, and publish their research in a reputable journal. However, many of these models have issues with overfitting – they have significant accuracy reductions […]

Read more

Jihadism and Cryptography, from internet to softwares

Cryptography and social networks are some of the online tools used today to protect the communications of terrorists and to affirm their membership in terrorist organisations. The Internet has become the method of choice for communication. The number of sites calling for a jihad rose from 28 in 1997 to over 5,000 in 2005. The […]

Read more

Practical Static Analysis for Continuous Application Security

Static code analysis tools that attempt determine what code does without actually running the code provide an excellent opportunity to perform lightweight security checks as part of the software development lifecycle. Unfortunately, building generic static analysis tools, especially for security, is a costly, time-consuming effort. As a result, very few tools exist and commercial tools […]

Read more

The State of SCADA on the Internet

The insecure state of SCADA devices is well known and concerning. These connected devices are largely Internet connected. While this is not a new phenomenon, connected devices have continually garnered attention- from attackers and researchers alike. In this talk, Kyle Wilhoit presents the state of SCADA on the Internet, answering the who, what, when, where, […]

Read more

EventID Field Hunter (EFH) – Looking for malicious activities in your Windows events

There are thousands of possible Windows event IDs, split into 9 categories and 50+ subcategories. The Windows Event Logs provide a historical record of a wide range of actions such as login/logoff, process creation, files/keys modifications, and packet filtering. These logs provide investigators with a wealth of information that can be analyzed in many different […]

Read more

[Ab]using TLS for defensive wins

TLS, and it’s older forerunner SSL, are used to maintain the confidentiality and integrity of network communications. This is a double edged sword for Information Security departments as this allows private information to remain private, but can also be used to hide malicious activity. Current defensive measures for dealing with network traffic encrypted using TLS […]

Read more

Making sense of a million samples per day: Behavior-based Methods for Automated, Scalable Malware Analysis

With the astonishing rate of new and modified malware samples being released daily, automation of analysis is needed to classify and cluster together similar samples, exclude basic and uninteresting variations, and focus costly manual analysis work on novel and interesting features (e.g., added or remove pieces of code with a given semantic). We will discuss […]

Read more

RTF Abuse: Exploitation, Evasion and Counter Measures

If you knew how many ways you could obfuscate and deliver payloads with RTF documents, you would have thought it was a file format Microsoft secretively purchased from Adobe. Kidding aside, 2016 has peeked my interest in the RTF specification and you should learn why.  This talk walks through research experiences and examples that take […]

Read more

Drug Pump and Medical Device Security

Wifi connected drug infusion pumps known as ‘Smart Pumps” have been used in hospitals for over a decade. What could go wrong? Answer: Death. They have recently been the target of much interest in the hardware hacking community. In this talk we will tear down one of these pumps and identify a number of security […]

Read more

Malware Activity in Mobile Networks – An Insider View

Mobile devices are becoming the target of choice for cybercriminals. This presentation will provide an in-depth view of the mobile malware that is currently active on the Internet. It will describe the infection rates, what the malware does, how it is monetized and the impact it has on network resources and the user experience. The […]

Read more

DevOps For The Home

This is the story one man’s personal trip to the cloud (and back) as he rebuilds his home network in a devops model, supported by virtual private cloud service. This presentation takes a micro look at cloud services, and the benefits and risks that come along with it for the average home user, as well […]

Read more

UNMASKING MALWARE

Malware comes in different shapes and sizes. They are even produced in a massive scale. But attackers know that this is not enough. Malware has to be protected. In this talk, I will present the different techniques attackers use to protect and mask malware to bypass security products and analysis. I will show how attackers […]

Read more

Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing

Tired of threat intelligence anecdotes? How vendors just keep selling the idea that “more data is better data”? Join Alex in a scientific animated-GIF-powered data-driven analysis of what makes for a good threat intelligence feed and sharing community that is relevant to your environment and defense needs!

Read more

Confessions of a Professional Cyber Stalker

For several years I developed and utilized various technologies and methods to track criminals leading to at least two dozen convictions. In the process of recovering stolen devices, larger crimes would be uncovered including drugs, theft rings, stolen cars, even a violent car jacking. Much of the evidence in these cases would be collected by […]

Read more

Cymon – An Open Threat Intelligence System

Threat Intelligence is a term frequently discussed within information security circles, with many firms offering commercial threat data feeds, using different frameworks and transport mechanisms detailed (including STIX and TAXII). Beyond the threat data generally offered, there are questions about exactly how useful and actionable such data can be. In this talk we will debut […]

Read more

Software Defined Networking / Attacker Defined Networking

In this session, the topic of Software Defined Networking (SDN) will be explored from a security perspective.  What SDN means today will be covered, using a lab setup using an OpenDaylight controller with networking gear from multiple vendors.  Openflow, Netconf and Yang protocols will all be discussed, explored and exploited! Security and reliability issues that […]

Read more

Making & Breaking Machine Learning Anomaly Detectors in Real Life

Machine learning-based (ML) techniques for network intrusion detection have gained notable traction in the web security industry over the past decade. Some Intrusion Detection Systems (IDS) successfully used these techniques to detect and deflect network intrusions before they could cause significant harm to network services. Simply put, IDS systems construct a signature model of how […]

Read more

Breaking and Fixing Python Applications

As the popularity of the Python programming language increases and consolidates its position as one of the most popular languages of its genre, only a few attempts have been made to assess how resistant it may be to attacks. We will review and test with practical examples some of the most common attack and defense mechanisms, by […]

Read more

Stealthier Attacks and Smarter Defending with TLS Fingerprinting

Ever been busted because your man in the middle software (which does TLS properly) alerted someone to your bad certificate?  No more! Want to detect certain types of connections leaving your network, but can’t keep the IP blacklist up to date?  This could be the answer. This talk includes an introduction to both TLS and […]

Read more

Automation is your Friend: Embracing SkyNet to Scale Cloud Security

Most network and security operations people hate automation. They like to press buttons themselves and maintain “control” of the processes. Cloud computing is going to be very disruptive as they realize their time tested processes go the way of the dodo bird. What they don’t realize is that the cloud actually increases the control they […]

Read more

Incoming Threats At the Speed of Retail

It’s hard out there for a retailer. For one thing, there are particular challenges to securing a retail business, starting with thin margins and widely distributed environments, and ending with the overriding need to keep customers happy. For another, retailers are the targets of attacks both from criminals around the world and from those same […]

Read more

Complete Application Ownage via Multi-POST XSRF

This talk will discuss the risk posed by Cross Site Request Forgery (CSRF or XSRF) which is also known as session riding, or transaction injection. Many applications are vulnerable to XSRF, mitigation is difficult as it often requires re-engineering the entire application, and the threat they pose is often misunderstood. A live demo of identifying […]

Read more

What Google knows about you and your devices, and how to get it

With cloud forensics picking up, Google has become one of the most important sources of information about anyone who uses one or more Android devices – or doesn’t use Android at all. Google Account aggregates information about the user’s online behavior and offline activities, analyzes their communication, recommending places to visit and things to read. […]

Read more

Xenophobia is Hard on Data: Forced Localization, Data Storage, and Business Realities

“Our data is only safe within our borders!” “(The US|China|New Zealand|Vanuatu) is spying on our citizens!” “Don’t ship our citizens’ data overseas!” These rallying cries are calling for the same solution: forced data localization laws, where a country requires that all its citizens’ and corporations’ data be kept within the territory of that country. What’s […]

Read more

Exploitation Trends: From Potential Risk to Actual Risk

Microsoft researchers have studied some of the exploits discovered over the past several years and the vulnerabilities they targeted. Understanding which vulnerabilities get exploited, who exploits them, the timing of exploitation, and the root causes, all help security professionals more accurately assess risk. Development practices that help minimize vulnerabilities will be discussed.

Read more

Learning To Love Your Attackers

Opposing Forces (OPFOR) training is used by the military to help create realistic scenarios so that when they are deployed in battle they aren’t encountering situations for the first time. Whether it’s battle or incident response, that reaction time is critical to the success of a team. Most organizations have some degree of penetration testing […]

Read more

Stealth Attack From The Produce Aisle

The proliferation of devices like the Raspberry Pi, Pineapple Express, PwnPi and more make it easier (and cheaper) than ever to obtain a complete stealth attack or defense arsenal. In this session, we’ll take a low-cost, credit-card sized ARM computer, add some freely available software and see what we get. We’ll learn: what options are […]

Read more

Breaking Access Controls with BLEKey

RFID access controls are broken. In this talk, we will demonstrate how to break into buildings using open-source hardware we’re releasing. Over the years we have seen research pointing to deficiencies in every aspect of access control systems: the cards, the readers, and the backend. Yet despite these revelations there has been no meaningful change […]

Read more

Hijacking Arbitrary .NET Application Control Flow

This session will demonstrate attacking .NET applications at runtime. I will show how to modify running applications with advanced .NET and assembly level attacks that will give the ability to alter the control flow of any .NET application. New attack techniques and tools will be released to allow penetration testers to carry out advanced post […]

Read more

POS Malware Evolved

Over the past decade, point of sale (PoS) systems have been plagued by both attacks and targeted malware. During this time, we’ve seen a dramatic shift by this targeted malware in both the techniques used and the capabilities it has. This talk will discuss the shifts the security and research community has witnessed by PoS […]

Read more

Play Flappy Bird while you pentest Android in style

Doesn’t it bother you that you have to give up all your mobility when penetration testing Android applications and spend the majority of your time sitting in front of another device that has a running proxy? That will now be history. In this talk we will present a fully interactive proxy that runs as an […]

Read more

The Internet of Fails: Where IoT Has Gone Wrong and How We’re Making It Right

This presentation will dive into research, outcomes, and recommendations regarding information security for the “Internet of Things”. Mark and Zach will discuss IoT security failures both from their own research as well as the work of people they admire. Attendees are invited to laugh/cringe at concerning examples of improper access control, a complete lack of […]

Read more
Subscribe to the Sector Blog
Enter your contact information below to have future blog posts delivered directly to your inbox!