WiK and Mubix - gitDigger: Creating useful wordlists from public GitHub repositories
This presentation intends to cover the thought process and logistics behind building a better wordlist using github public repositories as its source. With an estimated 2,000,000 github projects to date, how would one store that amount of data? Would you even want or need to? After downloading approximately 750,000 repositories, storing 10TB on multiple usb drives; this will be a story of one computer, bandwidth, basic python and how a small idea quickly got out of hand.
BIOS: Vell, WiK’s just zis guy. He enjoys long walks on the beach while his computer equipment is busy fuzzing software, cracking passwords, or spidering the internet.
Mubix is a Senior Red Teamer. His professional experiences start from his time on active duty as United States Marine. He has worked with devices and software that run gambit in the security realm. He has a few certifications that haven’t expired yet, but the titles that he holds above the rest is father, husband, and United States Marine.
Steven F. Fox - Social Aftermath – Responding to Social Pwnage
Many social engineering talks focus on the exploitation of trust relationship and the resulting compromise of corporate and personal assets. However, what happens after the pwnage is done?
This session opens with the aftermath of a successful social engineering incident on a major automotive financing company. Attendees will learn of the methodical analysis of the interactions which led to the compromise of customer information, as well as employee and executive network credentials. The case study also illustrates how this organization was able to use the forensic analysis of social interactions to enhance its customer service business processes. This information was used to engage employees in protecting information with the associated business processes. Most importantly, the customer care process was transformed such that it was able to frustrate social engineers and enhance the experience of their customers.
Attendees will learn:
- How the incident response team used log information and incident investigation to determine the social nature of this incident.
- How the incident response team employed Open Source Intelligence techniques to profile the social attack surface, narrowing the focus of their investigation.
- How the incident response team worked with management to modify business processes to be resilient in the face of social exploits.
BIO: Steven F. Fox offers security guidance to ensure compliance with Federal standards and requirements as a Sr. Security Architecture and Engineering Advisor for the U.S. Treasury. He also contributes to multiple working groups including the IPv6 transition team, Developer Security Testing workgroup, and the Security and Privacy workgroup. Mr. Fox brings a cross-disciplinary perspective to the practice of information security; combining his experience as a security consultant, a Sr. IT Auditor and a systems engineer with principles from behavioral/organizational psychology to address security challenges. He has performed security services including risk/vulnerability/penetration testing assessments, incident response planning, PCI DSS services, and social engineering. Steven is a syndicated blogger covering IT Governance, Risk Management, and IT-Business fusion topics. His speaking engagements include ISSA and ISACA events, SecureWorld Dallas/Detroit, Hacker Halted, Security B-Sides Chicago/Detroit/Las Vegas, and GrrCon. He also volunteers his time to the Ponemon Institute, Security BSides Detroit and the MichSec security organization.
Tom Steele Dan Kottmann - Collaborative Penetration Testing With Lair
Lair is an open-source project developed for and by pentesters. Built on Meteor and Node.js with a dash of Python, Lair is a web application that normalizes, centralizes, and manages diverse test data from a number of common tools including Nmap, Nessus, Nexpose, and Burp. Unlike existing alternatives, Lair encourages team-based collaboration by automatically pushing updates to team members in real time. Paired with it’s workflow and documentation management, Lair offers a single solution for performing a detailed, thorough penetration test individually or as a team in a manner that has not been done before.
BIOS: Tom Steele hails from Seattle Washington where he works as a Security Consultant at FishNet Security. The dynamic nature of his current role allows him to touch many areas of the offensive security spectrum. When not working he can be found gaming and creating tools to solve complex problems.
As a consultant in FishNet Security’s security assessment practice, Dan performs social engineering and network and wireless penetration tests. Dan has roughly nine years of consulting experience and five years of professional experience in the security industry.
Sean Malone – HiveMind: Distributed File Storage Using JavaScript Botnets
Some data is too sensitive or volatile to store on systems you own. What if we could store it somewhere else without compromising the security or availability of the data, while leveraging intended functionality to do so? This presentation will cover the methodology and tools required to create a distributed file store built on top of a JavaScript botnet. This type of data storage offers redundancy, encryption, and plausible deniability, but still allows you to store a virtually unlimited amount of data in any type of file. They can seize your server — but the data’s not there!
BIO: Sean Malone has been building and breaking networks and applications for the last 12 years, and he has a diverse practical and academic background in information technology and security. As a Principal Consultant and the primary engagement manager for FusionX, Sean provides clients across all verticals with sophisticated adversary simulation assessments and strategic security guidance. Sean is a key member of the FusionX internal research and development team and his custom security assessment utilities are used in a majority of FusionX engagements.
Jay “Rad” Radcliffe – Mom! I Broke My Insulin Pump….Again!
Exactly two years ago I gave a presentation on weaknesses in diabetic medical devices, and how similar they were to industrial SCADA systems. Well, I got a new insulin pump, and I have managed to find more problems. This will be a very unique talk where the audience will get to see over a dozen different diabetic devices, touch and poke at them, ask how they work and see them attached to me. Also part of the discussion will be these devices in context: How are they used? What are the implications of their failure? There will also be a live demo of a critical software flaw that has never been discussed publicly! There will be needles. There will be blood. There’s a chance the speaker might not even survive.
BIO: Jay “Rad” Radcliffe has been working in the computer security field for over twelve years and is currently a Senior Security Analyst for InGuardians. Jay was diagnosed with Diabetes on his 22nd birthday, and after a difficult diagnosis discovered he was an insulin dependent Type I diabetic. His geek resume includes being a licensed ham radio operator since he was 12 ex-n8rhv, now n8os), building all kinds of VHF and HF antennas, using a TRS80 as a toddler and writing TURBO BASIC programs in the 2nd grade.
Evan Davidson and Noah Schiffman - Dungeons & Dragons, Siege Warfare, and Fantasy Defense in Depth
Overzealous Admin: “I bet you can’t break in to my network! I got my stuff together…”
Pentester: “I’m just here to help out and find the weaknesses the bad guys might or have used.”
Overzealous Admin: “Well I have a corporate network with a level 8 Paladin firewall taking +2 hit points, a level 3 Rouge IDS to disarm your Smurf Attack, a level 5 Wizard SEIM solution with +3 powers of divination, and a level 2 Devoted Cleric antivirus to heal your malware infections!”
Pentester: “Um…your CEO shared all his docs on Dropbox. Didn’t your Wizard tell you?”
Lets play a game of fantasy tower defense with your infrastructure? Instead of measuring the price of your implementation, lets concentrate on if it can really protect you! If your defense isn’t mobile, agile, or technically relevant to where your users and data are then you’re still waging medieval siege warfare! Who cares about networks, servers, mobile computing, and BYOD! How about we review some modern security practices to protect what’s really important…YOUR DATA…without attending a single vendor song and dance routine. In the end, we’ll collaboratively outline a new approach to securing your assets that doesn’t focus on patching or hardening a single device or buying something. Are we doing this all wrong? You may even be convinced to throw away your firewall altogether!
BIOS: With hardly any experience in anything worth discussing, Evan is a frustrated and jaded security professional tired of responding to incidents and data owners in a broken mantra…”I told you so! Oh, you agree? Then WTF!” After a certification binge (he’s embarrassed to say how many) and stint at corporate ladder climbing, he abandoned all hope of making businesses and government any more secure from the inside. Now he breaks stuff…
An IT industry veteran, with 20+ years of experience, Dr. Noah Schiffman is a former black-hat hacker turned security consultant. He spent almost a decade as a career computer hacker, performing penetration testing, social engineering, corporate espionage, digital surveillance, and other ethically questionable projects. Subsequently, he worked as a security consultant, teaching network defense, giving talks, and writing about information security. His past clients have consisted of Fortune 500 companies and various government agencies. For the past several years, his R&D efforts in the commercial and defense sectors have covered areas of data analysis and pattern recognition for security applications.
Christie Dudley - Strange interactions in personal data: Brokers and the CFAA.
There is one very important fact, most people overlook when considering privacy and user data: Data cannot be owned.
Personal data cannot be owned. This small fact has astounding implications when considering privacy.
Consider the intersection of two distinct, troublesome areas: data broker operations and the computer fraud and abuse act.
When considering threats to the integrity of your network, advertisers are not the first thing that comes to mind. Yet the market for user data is so rich right now that it is ripe for exploitation. The brokers can buy and sell any data they wish, with no concern for the origin or means of acquiring data. They are not required to and unwilling to reveal their sources. Some provisions in the Computer Fraud and Abuse Act open up the opportunity to acquire data surreptitiously by discouraging the public from discovering what may be happening to their data. Quiet, quasi-criminal operations could exist that syphon data that is illegitimately collected and sell to legitimate brokers.
The result of this alignment of circumstances is that there is an entirely unexplored class of attackers that may operate beneath the radar, yet out in the open. The data market is not something that has the potential for regulation, so it is incumbent on organizations to be aware of the threat and take appropriate measures to contain it.
BIO: Christie started her career with a BSEE with an emphasis in digital communications from the University of Kansas. A 15 year enterprise network engineer career, largely in finance and manufacturing followed. Starting with a study in anthropology she decided to change fields, eventually pursuing an old interest in communications security and privacy and a brief internship in hardware security. Seeking to combine her interests in technology and society she began pursuing the field from a new perspective, enrolling as JD candidate at Santa Clara Law. She now consults on privacy issues related to communications technology while completing her law degree. She has also cofounded Fork the Law, an effort to bridge the gap between technologists and legislation.
Ian Robbertson and Michael Gough – “Malware Management Framework” – We detected WinNTI with it!
With all the security products you use, you still don’t have confidence that your networks are malware-free. And you’re right. They aren’t. You want to know a dirty little secret? There IS a way to discover the most advanced malware!
This discussion comes straight from the guys in the trenches who have been dealing with real world advanced malware for years. We are not in pristine labs, but the kind of environments that most of us really have, but won’t admit in public. Through our own wins and losses at defending our environments, we have identified what works and what doesn’t, and have created the Malware Management Framework: A simple methodology for defending your systems against the most advanced malware. We will cover the Malware Management Framework and provide specific, actionable items on how to use it in your environment with tools you may already have, and free tools you have not yet seen.
If you are responsible for defending a network, and you want to have higher confidence that systems in your environment are malware-free, you need to attend this discussion.
BIOS: Ian and Michael (The Thoughtful Hackers coined by Paul Asidoorian on a PaulDotCom interview) are security professionals and researchers. They first discovered a critical flaw in a major card key system. In their real jobs, Ian and Michael are defending against cutting edge advanced malware and researching how to better detect and respond to this ever increasing threat. Michael’s background includes 20 years of security consulting for Fortune 500 organizations, running BSides Texas, and general awesomeness. Ian’s background includes security, networking and software development, and was a former CISO for the State of Texas. Now Ian and Michael defend against malefactors, nefarious ne’er-do-weller’s trying to do nefarious things and trying to p0wn their employer’s assets. They can be found on twitter as @MI2Security (Ian) and @HackerHurricane (Michael).
Jimmy Shah, David Shaw and Matt McDevitt – Discovering Dark Matter: Towards better Android Malware Heuristics
There are nearly 1,000,000 free and paid Android apps available. A very small percentage of these mean to do you harm. Figuring out which apps are the bad ones is difficult enough for the average user, but it’s not much easier for malware analysts. Analysis tools and automation can help to filter this flood of apps.
Towards the end of discovering new unknown malware in a timely manner, we are developing new heuristics.
We will cover:
* Existing analysis tools: manual and automated
* Data leakage and permissions abuse
* Development of new tools and heuristics for malicious Android apps
* Comparing the results of running the heuristics vs. manual analysis
BIOS: Jimmy Shah is a Mobile Security Researcher specializing in analysis of mobile/embedded threats on existing platforms (Windows Phone 8, iOS, Android) and potential mobile malware and spyware. If it’s lighter than a car, has a microprocessor, and is likely to be a target it’s probably his problem. He has presented on mobile threat research at a number of computer security conferences.
David Shaw is the Senior Director of Engineering at Redspin, specializing in External and Application security assessments, with particular interest in exploit development and unconventional attack vectors. David was a speaker at ToorCon 12 and LayerOne 2013, and was the technical editor of the Nmap 6: Network Exploration and Security Auditing Cookbook.
Matthew McDevitt is a security and malware researcher. After 8 years’ experience in systems administration, Matt began professionally pursuing information security, his hobby since young adulthood. Matt is currently a Mobile Malware Researcher and specializes in x86 and embedded system malware analysis.
Olli-Pekka Niemi and Antti Levomäki – A Fire In The Eye
Signatureless attack detection is becoming the hot topic in threat prevention. Client side security vulnerabilities are often found in zero day exploits in the wild, meaning that signature based intrusion detection and prevention systems are not likely to catch these attacks. Signatureless detection systems are designed to detect these kinds of attacks and they do provide some additional layer of security. One of the techniques deployed by signatureless is called sandboxing. In sandboxing , the signatureless attack detection systems executes files that are being transferred in networks in sandbox. They carefully instrument the execution and based on that determine if the file was malicious. We have analyzed signatureless detection and particularly the sandboxing technique, and we have and found several issues in the concept. We have also found ways to completely evade sandboxing. We have taken some peeks into one of the market leading sandboxing product and will discuss about our findings. In this presentation we will highlight the problems we have identified in signatureless attack detection and sandboxing, and present our findings regarding one of the market leading product. The attendees will better understands limits of these systems. Even though they do provide additional layer of security, there are issues one should know.
BIOS: Olli-Pekka Niemi has been working in Internet security since 1996. He has experience in offensive security as a Penetration Tester and in defensive security as a System Administrator. Since December 2000, he has been working for Stonesoft R&D, developing Intrusion Prevention Systems and Next Generation Firewalls. His main R&D interests are analyzing network-based threats and evasion research. Mr. Niemi is the founder and head of the Stonesoft Vulnerability Analysis Group (VAG). He is also the Chief Research Officer of Stonesoft. Mr. Niemi has given presentations at various security conferences such as T2, DeepSec, Positive Hack Days, and SIGCOMM.
Antti Levomäki has been working since 2004 at R&D of Finnish Cyber Security Company Stonesoft. For the last five years he has focused on researching evasion techniques against network security products and writing testing tools. Previous duties include writing attack and application signatures for Stonesoft network security products. Mr. Levomäki holds a Master Of Computer Science degree from the University of Helsinki and is currently pursuing a PhD at the Aalto University.
Steve Werby - Crunching the Top 10,000 Web
A detailed analysis of password policies and authentication controls for widely-used websites hadn’t been conducted and seemed to be a daunting effort. To address this I supplemented automated and semi-automated data collection with the utilization of low-cost marketplaces like Amazon Mechanical Turk and the implementation of a system which allows volunteers to add, update, and modify data. I will cover my methodology, analysis of the collected data, challenges, lessons learned, and future plans.sites’ Password Policies and Controls.
BIO: Steve Werby is an independent information security consultant and security architect for a Fortune 200 company. He previously led enterprise information security programs for 3 large organizations and has presented at conferences such as DerbyCon, SOURCE Seattle, Hack3rCon, SecTor, ShmooCon, and OWASP LASCON. He is proud of the fact that he hasn’t signed his name the same way twice since 2009.
Richard Thieme - Governments and UFOs: A Historical Analysis of Disinformation and Deception
This talk is about the ways the many components of governments interact and respond to challenging and anomalous events–highly relevant to hacking by all definitions and at all levels. If you don’t know the lay of the land, you can not engage in appropriate research and reconnaissance, counter-measures, and operations.
The proliferation of reliable reports of unidentified flying objects from the 1940s forward represented just such a challenge. The phenomenon was anomalous, well-documented, and certainly challenging—because, as Major General John Samford said, “credible people have seen incredible things.”
The UFO History Group includes some of the best researchers in the field. Richard Thieme was privileged to be invited to join the group and their project which resulted, after nearly 5 years of work, in “UFOs and Government: A Historical Inquiry,” an outstanding work of historical scholarship that nevertheless reads like a fascinating detective story. In almost 600 pages and with nearly 1000 citations, the work illuminates the response of the government since the early 1940s. how and why policies were set, and how they were executed. The book has been recommended by CHOICE, the primary resource for academic libraries, for inclusion by libraries at all levels because the book stands out as “an exception” in a field filled with speculation (there is virtually none in this book). Other reviews say, “this is the best book about the UFO phenomena that was ever written” and “UFOs and Government is a triumph of sober, conscientious scholarship unlikely to be equaled for year
s to come.”
You have never heard a talk like this – about a subject that has been ridiculed and marginalized intentionally for sixty years as a matter of policy and politics. As Don Quixote said, “insanity is seeing things as they really are.” This speech uses UFO phenomena as dye in the arteries of “how things really are.”
BIO: Richard Thieme has established a reputation for edgy thinking, the mindset of a hacker, and radical clarity (“insanity is seeing things as they really are,” said Don Quixote). Jeff Moss said of him, “His ability to be open minded. conspiratorial, ethical and subversive at the same time is inspiring.” Clint Brooks, Asst. Deputy Director of NSA (ret) said, “Thieme takes us to the edge of cliffs we know are there but rarely visit.”
He is an author and professional speaker focused on the deeper implications of technology, religion, and science for twenty-first century life. He has published hundreds of articles, dozens of short stories, three books with more coming, and has delivered hundreds of speeches. A novel, FOAM, is in progress and “A Richard Thieme Reader,” collecting fiction and non-fiction, interviews and book reviews, will be published in 2013.
Thieme speaks professionally about the challenges posed by new technologies and the future, how to redesign ourselves to meet these challenges, and creativity in response to radical change. He has spoken for numerous hacker, security and intel conferences around the world. He recently spent a day at NSA doing a speech, a panel, and a discussion. His column, “Islands in the Clickstream,” was distributed to thousands of subscribers in sixty countries before collection as a book in 2004. When a friend at the NSA told him, “The only way you can tell the truth [that we discuss during a decade-long project on intelligence and ethics] is through fiction,” he returned to writing short stories, one result of which is “Mind Games,” a collection of nineteen stories. Other edgy realities are referenced in the recently published and critically extolled “UFOs and Government: A Historical Inquiry” to which he contributed, a 5-year research project using material from inside the military and intelligence communities to document government responses to the phenomena from WW2 to the present.
Francisco Artes, Research Vice President, NSS Labs. Hight Priest to the Great Chip in the Sky, and Lord of the Decimal Faeries. - Defense Evasion Modeling
Cybercriminals persistently challenge the security of organizations through the rapid implementation of diverse attack methodologies, state of the art malware, and innovative evasion techniques. In response organizations deploy and rely on multiple layers of diverse security technologies. This talk examines the “kill chain” and the measured effectiveness of typical defense technologies such as Next Generation Firewalls, Intrusion Prevention Systems IPS, Antivirus/Malware Detection, and browsers internal protection. Empirical data on the effectiveness of security products derived from NSS Labs harsh real world testing is presented together with a live demonstration of successful evasion of malware detection. We find a considerable gap of protection levels within/and across different security product groups. The presentation will be backed up with a paper to be made available to attendees.
BIO: Francisco Artes is a recognized information security executive who has helped form many of the best practices for securing intellectual property within the computer gaming, motion picture, and television industries. Mr. Artes is also know for his work on cybercrime, hacking, and forensic security issues with various federal, state and local government and law enforcement agencies such as the US Dept. of Homeland Security, FBI, Texas Rangers, and US Marshals. Prior to his appointment as Research Director with NSS Labs, Mr. Artes most recently served as Vice President, Chief Architect / Content Protection for Trace3, and as Vice President, Security Worldwide for Deluxe Entertainment Services Group. Mr Artes has presented on six of the seven continents, and serves on several boards.
Nicholas Percoco and Josh Corman - The Cavalry Isn’t Coming: Starting the Revolution to Fsck it All!
We have some good news and some bad news. The good news is that security is now top of mind for the people of planet Earth. The bad news is that their security illiteracy has lead to very dangerous precedents and this is likely just the beginning. The reactionary stances taken by the hacker community has induced burnout and fatigue with many of us watching our own demise. We’re here to help us all hit rock bottom in the pursuit of something better. At some point the pain of maintaining inertia will exceed the pain of making changes, so it is time for some uncomfortable experimentation. While it may be overwhelming to think about, this is what we do. We hack systems. Finding flaws in the digital world comes naturally to us. We can and must do the same to the physical world; the media, governments, and lawmakers in order to survive the next decade. Let’s get started.
BIOS: Nicholas J. Percoco has more than 16 years of information security experience and leads SpiderLabs at Trustwave. Prior to joining Trustwave, Percoco ran security consulting practices at VeriSign, and Internet Security Systems. As a speaker, he has provided unique insight around security breaches, malware, mobile security and InfoSec trends to public (Black Hat, DEFCON, SecTor, You Sh0t the Sheriff, OWASP) and private audiences (Including DHS, US-CERT, Interpol, United States Secret Service) throughout North America, South America, Europe, and Asia. Percoco and his research has been featured by many news organizations including: The Washington Post, eWeek, PC World, CNET, Wired, Network World, Dark Reading, Fox News, USA Today, Forbes, Computerworld, CSO Magazine, CNN, The Times of London, NPR, Gizmodo, Fast Company, Financial Times and The Wall Street Journal.
Joshua Corman is the Director of Security Intelligence for Akamai Technologies and has more than a decade of experience with security and networking software. Most recently he served as Research Director for Enterprise Security at The 451 Group following his time as Principal Security Strategist for IBM Internet Security Systems. Mr. Corman’s cross-domain research highlights adversaries, game theory and motivational structures. His analysis cuts across sectors to the core security challenges plaguing the IT industry, and helps to drive evolutionary strategies toward emerging technologies and shifting incentives. Mr. Corman is a candid and highly-coveted speaker with engagements at leading industry events such as RSA, DEFCON, Interop, ISACA, and SANS. As a staunch advocate for CISOs, Corman also serves as a Fellow with the Ponemon Institute, on the Faculty for IANS, and co-founded Rugged Software – a value-based initiative to raise awareness and usher in an era of secure digital infrastructure. His passion for challenging the status quo won him the title of Top Influencer of IT by NetworkWorld magazine in 2009. Corman received his bachelor’s degree in philosophy, graduating Phi Beta Kappa and summa cum laude, from the University of New Hampshire. He resides with his wife and two daughters in New Hampshire.
