Alex Pinto – Using Machine Learning to support Information Security [Mentored by Joel Wilbanks]
Big Data, Data Science, Machine Learning and Analytics are a few of the new buzzwords that have invaded out industry of late. Again we are being sold a unicorn-laden, silver-bullet panacea by heavy handed marketing folks, evoking an expected pushback from the most enlightened members of our community. However, as was the case before, there might just be enough technical meat in there to help out with our security challenges and the overwhelming odds we face everyday. And if so, what do we as a community have to know about these technologies in order to be better professionals? Can we really use the data we have been collecting to help automate our security decision making? Is a robot going to steal my job? If you are interested in what is behind this marketing buzz and are not scared of a little math (not crypto, though ;)), this talk would like to address some insights into applying Machine Learning techniques to data any of us have easy access to, and try to bring home the point that if all of this technology can be used to show us “better” ads in social media and track our behavior online (and a bit more than that) it can also be used to defend our networks as well.
BIO: Alexandre Pinto (or just Alex) has over 13 years dedicated to information security solutions architecture, strategy advisory and monitoring. He has experience with a great range of security products, and has even been know to do pen-testing from time to time. Alex holds the CISSP-ISSAP, CISA, CISM, CREST CCT APP and PMP certifications. And somehow he is still a nice guy. He was also a PCI QSA for 5+ years, but is almost fully recovered. Alex was responsible over the last 3 years for kickstarting his previous company’s offices in 2 different countries mainly because he is able to perform competently on a very deep technical level on all the company services, from risk auditing (*sigh*) to network and web application penetration testing. For the past year, as a part of his sabbatical, he has been researching and exploring the applications of Machine Learning and Predictive Analytics into Information Security Data, specially in supporting the mess that we currently face in trying to make sense of day to day usage of SIEM solutions as a whole.
D0n Quix0te - The Little Dutch Boy [Mentored by Bill E. Ghote]
Does this sound painfully familiar: After hardening your systems and implementing a firewall, application and vulnerability scanners, network intrusion detection, and comprehensive patch management – Your internal web server was still compromised.
To make matters worse it was then used as a pivot point to compromise your whole network. And you didn’t even know it had happened until you got a call from an external security organization.
Like the Little Dutch Boy in that famous story, you discover the tiny hole in your network defenses that the bad guys were able to sneak through undetected. And you realize that the clues were there all along.
If you had seen those simple clues, you could have plugged the vulnerability before it was exploited and prevented the whole mess.
This was the genesis of a new continuous monitoring tool called OMENS. OMENS is a free Windows web server monitoring tool designed to monitor, detect, and block the attackers that traditional Network Monitoring tools can sometimes miss.
In this presentation the creator of OMENS will discuss the blind spots that Network Monitoring systems suffer from, and how these holes can be plugged by a distributed, host based monitoring system. He will also discuss how OMENS is being used to monitor for hostile actors, understand their activity, and to remediate the possible flaws they are probing for – Before they can be exploited.
BIO: D0n Quix0te is the author and creator of OMENS. He has more than 25 years of experience in architecting, installing, maintaining, and defending high value targets. And has been involved in the response and analysis of a number of significant security incidents.
Dan Ward - Flameout – Burnout Supernova [Mentored by Ally Miller]
The information security industry is notorious for flameouts of brilliant people. In looking back at the circumstances that lead to a dramatic situation, we can usually find early indicators that bad things lie ahead and fail to take timely action to avoid tripping into the abyss. In some instances, we feel that we are trapped in the darkness and we are alone. How do we identify when we or others near us are on a bad path? How do we recover? Once we’re back in a good mental state, what can we do to protect ourselves from the dark places?
BIO: Dan has spent the past fifteen years in the information security industry in many different roles including sales engineering, security infrastructure management, architecture, security account delivery, and security leadership. His current mission is to help organizations build secure data products through tight integration of the complete tech stack and tying all activity within the stack back to causation.
Doug Moore - Sixteen Colors: Archiving the Evolution of ANSI and ASCII Art [Mentored by Brendan O'Connor]
ANSI (and ASCII) art dominated online communication for a short time. However, in that small window the medium evolved from a necessary function of early online systems into an art form on its own. Sixteen Colors was created to keep a history of the art form as seen from the production of the underground art scene that began in the 1990′s and continues today. Learn what it takes to compile hundreds of thousands of pieces of artwork and how that artwork has changed over two decades.
BIO: Doug is a developer from Washington, DC that has found himself as the leading archiver of ANSI and ASCII art. He created and maintains Sixteen Colors (http://sixteencolors.net) ANSI and ASCII Art Archive. What began in 2001 as a small endeavor to make recently produced ANSI art more accessible has become an extensive archive of the large majority of art created by the underground ANSI art scene. This hobby led him to a career as a developer and an expanding role in archiving ANSI and ASCII art.
Ebony - The Goodness is Baked In: Baking Assurance into Software [Mentored by Davi Ottenheimer]
In an ever-changing world where the technological dependence is ever increasing — the government wants to provide transparency, everyone has 500+ friends on Facebook, your kids can use the computer better than you can, your bank allows transfers on the fly, you can meet your next first date (or your future ex) based on an algortihm, you can apply for a loan, or even look up medical records… In a world of Big Data, data mining, network breaches and the cloud, what is the first line of defense for your important, personal, private info?!
Software Assurance.
This talk will discuss the various definitions of software assurance, who it relates to, as well as the ownership. We will talk about the recent law that was passed National Defense Authorization Act of 2013 (NDAA) and what it means to software assurance and career developers everywhere. We’ll wrap up the discussion by highlighting some common vulnerabilities of software, suggestions for incorporating it into development and testing and finally several options for practice.
BIO: Ebony is a Senior Software Engineer that started working on a website that initiated a C&A process and that experience resulted in an interest in Information Security. She is a self-proclaimed mediocre developer who uses common sense rather than expert technical skill to attack problems; a proud Mafiosa of the Tech Lady Mafia and she is known around the office as “The Pit Bull”. She holds a B.S. in Computer Science, an M.S.M. in Information Systems Security, several certifications including Certified Ethical Hacker, Security+, and Certified Information Systems Auditor and has attended several conferences including Schmoocon, Hacker Halted, BsidesDE, and Lady Hack
FailOpen - Human Blue Teaming (Learning to patch the vulnerabilities in ourselves) [Mentored by Jimmy Shah]
The Hacker Mentality is applied to technology with fervor. Take a thing, learn how it works, make it do cool things, bend it to your will. Yet in other areas, we take things at face value and not question them. We need to learn to apply the line of thinking we have for technology to solve our other issues. The talk is an attempt to give a overview of the journey I have been on for the past few years to identify my issues (depression, anxiety, overweight, self esteem), learn about the topics, dig through the garbage, learn to question everything that has been documented, and then apply it to where it mattered, myself.
The point of the talk isn’t to give any mind blowing revelations on how to solve anything, rather to try to say that the only person who can solve the problems are those with the problems. I plan to share random facts that I have picked up during my investigations into mental health, physical health and other topics, talk about my obsessive metrics gathering/biomining and hopefully inspire others to take an educational journey of their own.
BIO: Fail Open is an Infosec consultant and long-time nerd who gave up feeling sorry for himself and started to learn how to fix the things he didn’t like. Definitely not finished.
Franklin Tallah - The 7 habits of highly effective CISOs [Mentored by Wendy Nather]
Despite being l33t technologists, many infosec leaders feel overwhelmed, marginalized and resigned to the notion that CISO stands for “Career is So Over”. This talk is about positive deviants; those who steer clear of the scape goat mentality and establish themselves as business leaders and facilitators. Come hear about one CISO’s “cage rattling questions” and how he harnesses for influence; or another CISO’s “Do not do” list that will make you cringe. If you are responsible for your company’s security program (or would like to be) come participate in this conversation on what it takes to deliver WIN.
BIO: Franklin Tallah is a senior security consultant at Verizon with 11 years of experience working at various intersections between IT infrastructure and Compliance. He maintains an alphabet soup of industry certifications and is an active member of ISSA.
James Siegel Jr. - The Truth, You Thought We Wouldn’t Know? [Mentored by Terry Gold]
OSINT is often mentioned, but not really covered.
Occasionally mention is made of a particular tool, but the aspiring professional is left to their own means to discover how to use the tool, or determine what information is of value.
Given a sample case, a real world person, the talk will include some dox freely available in the wild and discuss and demonstrate how some of the information found can easily be used in a penetration test or by an attacker.
The purpose of this discussion is multi-parted. By and large it will show some aspiring individuals how to go about gathering some of the information.
It will also serve as a warning to those in the audience who might be simply curious about infosec and security in general, how easy it can be to find some information about particular individuals.
BIO: James is a full time systems administrator. A former CCDC Alum, he is currently actively engaged with preparing the team for next year. He works as an assistant to Georgia Weidman at Bulb Security, and is an ambitious, aspiring, infosec professional.
Jared Sperli and Joe Kovacic - Vulnerabilities in Application Whitelisting: Malware Case Studies [Mentored by Brav0hax]
In recent years, Application Whitelisting has been one of the new breeds of antimalware technology. However, malware has already developed techniques for dealing with and impeding this new technology’s adoption rate, from causing unwanted behavior in the solution to directly altering the execution of the security solution to avoid detection while making it appear as though it is operating correctly. This talk will demonstrate how malware can accomplish these negative outcomes by manipulating application certificates and using file system filter drivers. This talk will also discuss how to factor these vulnerabilities into your security decisions.
BIO: Co-presenters Joe Kovacic (CEO and principal engineer) and Jared Sperli (COO and principal chauffeur) are co-founders of itSoftware which specializes in Windows security solutions. Joe started his career as an IT Helpdesk Software Engineer and later applied his Windows expertise to software development at VMware. Jared is an Army military intelligence veteran with training in computer network operations and a lot of time spent in Strykers.
Kat Sweet - The Sensual Side of 3D Printing [Mentored by Javvad Malik]
Come one, come all! In this stimulating oral presentation, learn how to harness 3D printing technology for a purpose that we can all get behind: sex toys. You’ll be taken through the ins and outs of erecting your perfect toy right in the privacy of your own bedroom: from design, to material choice, to post-processing, it’s only as hard as you want it to be. You’ll learn how to program your first sex toy’s own unique curves, and you’ll also learn why privacy, anonymity, and choice all dictate that your next 3D model should be for personal use only.
BIO: Kat Sweet is a longtime nerd, first-time BSidesLV attendee. When not at her day job, you can find her knitting, playing with 3D printing, studying web design, playing guitar and singing (with delusions of rock-stardom thanks to a Carnegie Hall performance). She has a degree in gender and women’s studies, an academic path that gave her the opportunity to write multiple (copiously researched) papers about sex toys. She has also already heard every terrible pun in existence on her last name.
Keli Hay - Never Mind Your Diet, Cut the Crap From Your Vocabulary [Mentored by Brian Martin]
It is never too inchoate to commence elucidating your obfuscated intelligence. Have you ever really listened to yourself or read what you have written? How many words can be reworded or dropped from a sentence to make your message clearer? As a listener and reader, it is hard enough trying to remember the various InfoSec-specific acronyms without surrounding them with various $5 words and extra, fluffy crap.
In this talk, I will truly show how cheap talk is by not wasting money on wordage.
BIO: Keli Hay is a course developer, technical writer, and certified technical trainer with over 13 years experience in information technology. She has worked with F500 companies such as CA Technologies, BP, and Red Hat and with teams in North America, Europe, Asia, and Australia. Keli has developed over 200 courses for various audiences including customers, partners, and resellers across various industry verticals including software, financial, energy, defense, healthcare, and government. In addition to course development, Keli co-authored the Nokia Firewall, VPN, and IPSO Configuration Guide and provided technical editing expertise to the authors of the OSSEC Host-based Intrusion Detection Guide.
Prajwal Panchmahalkar - Matriux Leandros – An Open Source Penetration Testing and Forensic Distribution [Mentored by Savant42]
Matriux is the first full-fledged Debian-based security distribution designed for penetration testing and forensic investigations. Although it is primarily designed for security enthusiasts and professionals, it can also be used by any Linux user as a desktop system for day-to-day computing. Besides standard Debian software the Matriux Arsenal contains a huge collection of more than 350 most powerful and versatile security and penetration testing tools with around 20-50 more tools being added every release cycle of 6 months. Matriux comes with a custom-built Linux kernel to provide better performance and higher support for hardware to work even with a Pentium IV and 512 MB RAM comfortably.
Matriux was first released in 2009 under code name “lithium” and then followed by versions like “xenon” based on Ubuntu. Matriux “Krypton” then followed in 2011 where we moved our system to Debian. Other versions followed for Matriux “Krypton” with v1.2 and then Ec-Centric in 2012. This year we are working releasing Matriux “Leandros” which is currently in beta testing and a major revamp over the existing system.
Matriux arsenal is divided into sections with a broader classification of tools for Reconnaissance, Scanning, Attack Tools, Frameworks, Radio (Wireless), Digital Forensics, Debuggers, Tracers, Fuzzers and other miscellaneous tool providing a wider approach over the steps followed for a complete penetration testing and forensic scenario. Although there are were many questions raised regarding why there is a need for another security distribution while there is already one. We believed and followed the free spirit of Linux in making one. We always tried to stay updated with the tool and hardware support and so include the latest tools and compile a custom kernel to stay abreast with the latest technologies in the field of information security.
Matriux is also designed to run from a Live environment like a CD/ DVD or USB stick which can be helpful in computer forensics and data recovery for forensic analysis, investigations and retrievals not only from Physical Hard drives but also from Solid state drives and NAND flashes used in smart phones like Android and iPhone. With Matriux we also support and work with the projects and tools that have been discontinued over time and also keep track with the latest tools and applications that have been developed and presented in the recent conferences.
I would like to present on the various broader security and forensic aspects and how beneficial it is to have a complete package as a Linux Distribution for the scanning, security testing and forensic purposes, and Matriux in particular over the other existing Linux Distributions.
BIO: An Independent Security Researcher for the past 3 years, Prajwal has been the Development Lead for Matriux since 2009. Currently he is a Research Assistant at Texas Tech University on Cyber Security of Smart Grid Energy Systems. He will be graduating with his Masters in Computer Science in May 2013. A Finalist for America’s Information Security Leadership Award 2012 (AISLA) by (ISC)2. Prajwal was a chapter lead for n|u, Hyderabad an open security community, until he left India for Higher studies in 2011. As a guest author, Prajwal publishes articles for ClubHack Magazine regularly.
Renegade6 - Stop Shooting Blanks – No magic bullets in your arsenal [Mentored by Nicolle Neulist]
There is no one single device that will provide a total security solution. All those “magic” and 4th quadrant solutions will not protect you. Security is not a framework, not a destination, and not a weekend of overtime implementing a new tool. It is not news that organizations need defense in depth or layered defenses. Too many organizations are stuck in a reactive security mode. Businesses react to network alerts, researching events in the morning from the day before. They react to virus detections when the av solution emails them a report. Each security solution only provides a part of the answer to the question “Am I owned?” Network alerts only provide a partial picture, same with host monitoring. By combining logs, network alerts, and system alerts a much clearer picture emerges. This talk will show that you can detect system compromises days, weeks and even months before antivirus will catch it. It will cover key system events and locations to monitor. Network events that you may not currently be watching for that you absolutely should be watching. Plus how simple visualization of log data can make potential compromises really stand out. Examples from compromises will be used to reinforce the concepts presented.
BIO: Renegade6 has been addicted to computers since he won a TI-99/4A in a school raffle. In 1997 he was blown away by NMRC, L0pht, and others. Past positions include satellite network administrator, network administrator, system administrator, information security team lead, Information Assurance Security Officer for the Green Zone in Iraq, Information Assurance Manager, instructor, network defense, and currently Network Defense SME and Senior Incident Handler.
Yair Silbermintz - Fun with WebSockets using Socket Puppet [Mentored by Weasel]
WebSockets are HTML5s solution for low latency communications. Support is now stable in major browsers, and developers are starting to use them for chat, games, videoconferencing, and other applications. Despite its growing adoption, WebSockets are difficult for pen testers to mess with. Tools are starting to catch up – wireshark, fiddler & chrome will let you view WebSocket traffic, but there is no simple system currently available to tamper with these messages. This summer I plan to release Socket Puppet, a chrome extension designed to fill this need, and I want to release it at BSides.
BIO: A New Jersey based web developer with a strong interest in security. By day, he builds websites in PHP, Python, HTML5, CSS3, JS, and anything else that will get the job done. In his spare time he plays video games, goes to cons, keeps up with security research, and pokes around with the latest tech he can get his hands on. He studied computer science at Yeshiva University & is also a GWAPT if you actually care about certs.
