Chris John Riley - Mobile Fail: Cracking open “secure” android containers
We’ve known for some time that physical access to a device means game over. In response we’ve begun to rely more and more on “secure” container applications to keep our private and company secrets… well… secret! In this presentation I will discuss specific design flaws in the security of “secure” Applications that promise to keep your data / password and even company email safe and sound.
BIO: Chris John Riley is a senior penetration tester and part-time security researcher working in the Austrian financial sector. With over 15 years experience in various aspects of Information Technology, Chris now focuses full time on Information Security. Chris is one of the founders of the PTES (Penetration Testing Execution Standard), regular conference attendee and avid blogger (blog.c22.cc), as well as being a regular contributor to the Metasploit project and generally getting in trouble in some way or another. When not working to break one technology or another, Chris enjoys long walks in the woods, candle light dinners and talking far too much on the Eurotrash Security podcast.
Andrea Matwyshyn – Catawampus
Abstract redacted until day of talk at Speaker’s request.
BIO: Dr. Andrea M. Matwyshyn is a leading academic studying corporate information security regulation and privacy law. She is an assistant professor in the Legal Studies and Business Ethics Department in the Wharton School and an affiliate of the Center for Technology, Innovation and Competition at the University of Pennsylvania Law School. In addition to her appointment at the University of Pennsylvania, she is a member of the board of advisors of the EU-funded Network of Excellence in Internet Science project at the Oxford Internet Institute and a faculty affiliate of the Center for Internet and Society at Stanford Law School. She has been studying information security as an academic since 2003. Prior to entering academia, she was a corporate attorney in private practice counseling clients on privacy and information security planning. She hearts gadgets.
Ryan Linn – Swiping Cards At The Source: POS & Cash Machine Security
You put your credit card in, I take your cash out. Point of Sale systems and Cash Machines are frequently targeted but rarely discussed. This talk will be a frank discussion about the types of attacks we have both seen and executed against these types of machines, where these systems are vulnerable from physical attacks to network and trojan attacks, and how to proactively deal with the problems. We will focus on current, practical, and frequently seen attacks of both POS systems and systems which dispense cash, because THAT’S what it’s all about.
BIO: Ryan Linn is a Senior Consultant with Trustwave’s SpiderLab. Ryan is an author, a developer, and an educator, and a penetration tester. He has contributed to Metasploit , BeEF, and Ettercap.
Soldier of Fortran - Legacy 0-Day: How Hackers Breached the Logica Mainframe
In early 2012 a group of 3 hackers were caught when a mainframe at Logica was no longer running as expected. This was the first warning that hackers had penetrated the once unpenetrable IBM mainframe z/OS. Through some simple and some ungodly technical hacks the attackers were able to gain shell access to the mainframe, harvest accounts and got access to some very private data. The mainframe that was breached was responsible for Swedish police, banks, SPAR (SSN equivalent), Infortorg etc. SoF was able to obtain the detailed investigation to the attack and some extras that weren’t in the report. This talk will go over how the attack when down, what was successful and what wasn’t, how they were caught and investigated and tools that exist today (which didn’t exist at the time of the attack) to perform the same type of pentest on your mainframes. If you learn anything from this talk it will be just how unsecure these mainframes really are when in the wrong hands.
BIO: Ever since the late 90s SoF has been obsessed with the idea of mainframes but it wasn’t until last year that a few things fell in to place. One, until recently you couldn’t emulate a mainframe computer, this is no longer the case. As a result SoF was able to get his hands on a mainframe and start exploring the OS, but he lacked the fire to persue it, that is, until, two, he was paired with an older mainframe engineer. It was at this time that SoF realized the massive gulf between IT security experts and mainframe security experts. Using his dwindling free time and what he knew of IT security he set out to try and claw back mainframes in to the security fold instead of being the out of scope, ‘legacy’ systems. With that fire and his emulator he’s contributed to projects such as NMAP, Ettercap and John the Ripper, released his own custom tools, and presented the topic of mainframes and mainframe security at Thotcon, BSides and Shmoocon. Being the only person who is exploring mainframe penetration testing puts him in the unique position of being able to talk in depth about the Logica breach.
TProphet – OMFG China!
The “China threat” is an incredibly hot topic in government and in the popular media. Information security companies have used the publicity to sell their services, and for the first time, hacking has taken center stage in American diplomatic policy. However, is China really a threat? If so, is the People’s Liberation Army really the worst adversary? As a hacker interested in China or a security researcher interested in profiling threats, where do you even begin? TProphet will share his perspectives based on three years of real-world experience living and working full-time in Beijing.
BIO: TProphet is a long-time phreak, writer and columnist for 2600: The Hacker Quarterly. His popular “Telecom Informer” column is widely considered to be one of the most influential voices in the phreaking community. He is also well-known for his involvement in the lighter side of the Defcon community, helping to organize both the “Queercon” event at Defcon and the famous Ninja parties. Until now, TProphet has kept his professional life separate from the hacker community. After working for three years in Beijing as the local IT manager for an American multinational company, TProphet left Beijing in February to pursue a master’s degree in Europe. His non-compete agreement has now expired, and he expects to graduate in early 2014.
Kurt Opsahl, Eva Galperin, Dan Auerbach, Mark Jaycox - Ask the EFF Panel
Once again, the Electronic Frontier Foundation returns to the Underground to answer your toughest Off-the-Record queries. Question some of the greatest minds in the field of internet law, in what is fast becoming an annual BSidesLV tradition. Patent Trolls, Free Speech, Fair Use, CFAA, CISPA (the cybersecurity bill), and the NSA surveillance programs like PRISM. If it matters (or should) to the on-line community, the EFF is researching it, litigating it and defending your rights. Come join us for what has become one of the liveliest, insightful, audience driven panel discussions in InfoSec. (Note: if you need legal advice about your own situation, please contact EFF separately so you can have a confidential conversation.)
BIOS: Kurt Opsahl is a Senior Staff Attorney with the Electronic Frontier Foundation focusing on civil liberties, free speech and privacy law. Before joining EFF, Opsahl worked atPerkins Coie, where he represented technology clients with respect to intellectual property, privacy, defamation, and other online liability matters, including working on Kelly v. Arribasoft, MGM v. Grokster and CoStar v. LoopNet. For his work responding to government subpoenas, Opsahl is proud to have been called a “rabid dog” by the Department of Justice. Prior to Perkins, Opsahl was a research fellow to Professor Pamela Samuelson at the U.C. Berkeley School of Information Management & Systems. Opsahl received his law degree from Boalt Hall, and undergraduate degree from U.C. Santa Cruz. Opsahl co-authored “Electronic Media and Privacy Law Handbook.” In 2007, Opsahl was named as one of the “Attorneys of the Year” by California Lawyer magazine for his work on theO’Grady v. Superior Court appeal.
A lifelong geek, Eva Galperin misspent her youth working as a Systems Administrator all over Silicon Valley. Since then, she has seen the error of her ways and earned degrees in Political Science and International Relations from SFSU. She comes to EFF from the US-China Policy Institute, where she researched Chinese energy policy, helped to organize conferences, and attempted to make use of her rudimentary Mandarin skills. Her interests include aerials, rock climbing, opera, and not being paged at 3 o’clock in the morning because the mail server is down.
Dan Auerbach is a Staff Technologist who is passionate about defending civil liberties and encouraging government transparency. Coming to EFF with a background in mathematical logic and automated reasoning, as well as years of engineering experience at Google, Dan now works on EFF’s various technical projects and helps lawyers, activists, and the public understand important technologies that might threaten the privacy or security of users.
Mark Jaycox is a Policy Analyst and Legislative Assistant for EFF. His issues include user privacy, civil liberties, EULAs, and “cybersecurity” (online security). When not reading legal or legislative documents, Mark can be found reading non-legal and legislative documents, exploring the Bay Area, and riding his bike. He was educated at Reed College, spent a year abroad at the University of Oxford (Wadham College), and concentrated in History and Politics. The intersection of his concentration with advancing technologies and the law was prevalent throughout his education, and Mark’s excited to apply these passions to EFF. Previous to joining EFF, Mark was a Contributor toArsTechnica, and a Legislative Research Assistant forLexisNexis.
Mike Murray and Allan Zhang - Your Droid Has No Clothes
With all of the recent focus on Android vulnerabilities, the Android landscape seems like an antivirus vendor’s dream. Unfortunately, for those who are using traditional protection software, the Android security software landscape is just as full of holes as Android itself seems to be. In this innovative talk, Allan and Mike will describe the issues within the Android OS’s design and the failure of most security tools to protect it, while at the same time writing active malicious code that will compromise a current Android device with any of the currently available protective software installed while on stage.
BIOS: Allan Zhang has spent over 12 years pioneering research in to the detection of the most sophisticated vulnerabilities and exploits with companies like Lucent Technology, nCircle Network Security and Palo Alto Networks. He is the Founder and CEO of Trustlook, where he leads the development of the next generation of mobile security software. He has contributed to multiple patents and has a BS degree in Economics from Southeast University.
Michael Murray is the co-founder and managing partner of The Hacker Academy. Mike has spent his nearly 15 years in the security industry focused entirely on the different vulnerabilities that allow an organization to be compromised, whether through the organization’s people, processes or technology. His career has included penetration testing, vulnerability researcher and leadership positions at vendors, consulting firms and Fortune 100 corporations. At The Hacker Academy, Mike focuses on building the world’s most innovative security education platform and making security education a constant, year-round endeavor.
