Grab your calendars, you have to be in Vienna on 12 November 2016! BSidesVienna is accepting your submissions for an awesome community conference. The range of topics is wide, so don’t ask yourself “Is this interesting or not?” – just submit and come to Vienna in November!
While you are preparing your submission, you might want to make some extra space in your calendar for DeepSec 2016. The submission we got so far look great. Crypto, the Internet of Stuff (IoT), exploit labs, pentesting training, and more waits for you. Make sure you get the Early Bird prices for your tickets!
Google has been a supporter of DeepSec in the past. While we may not need to introduce Google to you, we would like to point out that they have a very capable security team and that members of their researchers have held presentations at DeepSec conferences. Google staff is often around, so take the advantage and talk to them.
DeepSec would not be possible without the support from sponsors. So we welcome SEC4YOU as sponsor for the next DeepSec 2016!
SEC4YOU offers services regarding advanced auditing, penetration testing, and vendor-agnostic IT security consulting. SEC4YOU experts support your team when it comes to test and to implement security measures. Especially when it comes to compliance requirements, you will need assistance to make sure that nothing goes wrong. SEC4YOU’s portfolio covers IT security analysis (dealing with risks and threats to your organisation), auditing, ISO 27001 certification (with or without BSI standards), creation of security policies, risk management, information security management system (ISMS), internal government and revision processes. Their experts are well-versed with clients from internal auditing, accounting/controlling, information technology, data protection, risk/compliance management, and information security. Plus they like hackers! Make sure you have a chat with them when attending DeepSec.
The presentation titled Bridging the Air-Gap – Data Exfiltration from Air-Gap Networks was held at DeepSec 2015. Since the presentation format was not meant to be printed or viewed with generic documents viewers, the slide deck had to be converted. The slides in PDF format can be downloaded from this link:
For an animated version of the slides, use one of these links:
or in short http://goo.gl/mpCNWC
Mind the gap and enjoy!
Analysing threat intelligence hasn’t been more important. We all know that bad things will happen. That’s not the issue to worry about. You should spend some thoughts on why something happens, what methods are involved, and what your adversaries look like on the inside. Defending your assets is much more than using a fence, some doors, and badges for your employees. We would like to welcome you to DeepINTEL to discuss security intelligence in-depth.
Sitting through the Rookie Track at BSidesLondon is something we really enjoy. This year the quality of the presentations was amazing. Of course, the rookie’s mentors take a part of the blame for that. Good training gives you always a head start. Nevertheless someone has to stand in front of the crowd and fill the 15 minutes slot with content. All rookies did a good job. It was hard to pick a clear winner. The jury took more than three iterations to find a conclusion. Locard made it, and we welcome him to DeepSec 2016 in November. Honourable mentions go to @Shlibness, @Oxana_Sereda and @callygarr.
For you we have some thoughts on the presentations we saw and on the methods being used.
Think of your presentation as code. Make it lean and mean. It’s easy to implement your favourite function in 200K lines of code. Make it smaller. The same is true for your presentation. Writing a book about your favourite topic is easy. Squeezing everything the audience needs to know and you have to say into a presentation slot of 15 minutes (or 30, 45, 60, 90, …) is hard. It requires a thorough understanding of the facts and the theory. In addition you need ideas how to present your thoughts with minimal distraction. Good illustrations will help you. Using text will also do, but you need to reduce it as well. No fillers, no noise, just use the minimal code necessary.
Stage fright will be your enemy (even if you are not an Android phone). If you have a problem with crowds, think about not drinking loads of your favourite caffeinated drug. Try to relax before your presentation begins (starting with breakfast gives you a good start, relaxing seconds before your talk doesn’t make much sense). Have a chat with the audience. You need to introduce yourself any way, so why not ask people from the audience some questions? Once you are past the first seconds or minutes of your talk, you most probably have forgotten your nervousness. Besides, being nervous is a sign that you care, so there’s nothing to worry about.
For everyone thinking of entering the Rookie Track at BSidesLondon 2017: Please do! We will be pleased to see you presenting your ideas!
In case you haven’t noticed, the London BSides schedule is up. The Rookie track starts right with the most important part of information security – opsec. Behaviour is on a par with expensive security hardware and your favourite protection software. Wearables, video games, hidden data, malware mythbusting, and more follow next.
The main schedule features presentations about the impact of TOR/I2P traffic to your servers (think or best forget about CloudFlare), methods used by options advanced attackers, attacking Low Powered Wide Area Network (LPWAN) devices used for smart / IoT stuff, malicious software, static code analysis, threat analysis, the temptation of containers, and honey pots. There’s ample of content for everyone looking for new ideas. Don’t miss the opportunity!
The Security BSides London 2016 is coming up. Next month you will have the chance to see presentations all around topics in information security. The schedule will be published soon. Gathering from the talks of past events you will not be disappointed. We will be present to watch over the Rookie Track. Young talents in terms of presentation experience will tell you about selected subjects covering security issues on software, administration, policies, hardware, or social interaction.
The Rookie Track is unique among InfoSec events. It is a stage where the presenters can tell their ideas to an audience. They are supported by mentors who guide the content and the presenter from idea to the 15 minutes on stage. The Rookie Track was born out of the fact that a lot of people in information technology have great ideas, but few dare to step on stage and to tell the world about it. It is an example how to gain hacking skills for presenting your ideas to like-minded brains is a crucial part of hacking. To give you an idea how good the content is, have a look at past Rookie Tracks published by the BSides London staff.
We will be present at the Rookie Track and pick a winner. The Best Rookie presenter gets a ticket to DeepSec 2016. Hope to see you in London!
Explaining complicated topics with a lot of dependencies is hard. Even the operation of devices such as computers, telephones, or cloud(ed) applications can’t be described in a few sentences. Well, you can, if you use the tried and true lie-to-children method coined by Jack Cohen and Ian Stewart. If you really want to dive into a subject, you need a good start and a tour guide who knows where the terrain gets rough and helps you through it.
Information technology and its security is hard to learn. The basics are surprisingly simple. Once you get to the implementation and the actual parts that need to be touched, it gets a lot more complicated. Modern IT combines various technologies, most taken from computer science, others taken from other fields of research. The starting point defines how far you get when trying to understand what’s going on. Getting behind the scenes of hardcore exploits by juggling processor op-codes requires knowledge of operating system basics, processor architecture, data structures, memory management, and even more details. The same is true for every other topic in information security.
For DeepSec 2016 we like to explore the didactic side of information security. We had presentations in the past covering how to train hacking skills. Everybody praises the skills of hackers, but no one talks about where these skills come from. Education is a tricky business. Every one of us has a different approach to learn and to practice skills. We would like to hear about your approach. Take advantage of the open Call for Papers of DeepSec 2016 and tell us!
DeepSec 2016 is coming! We have set up the Call for Paper manager to accept your submissions for talks and workshops. Keep the „cyber“ distractions low, maximise content. DeepSec is all about hard facts and solid research.
The Internet of Stuff/Things has gained momentum. Given the current IoT security designs, this technology will keep security researchers busy for decades to come. Tell us how to break the smart home of the future.
The Crypto Wars are on again. Forget quantum computers! Think about how crypto will work in the age of golden keys and backdoor privileges. Of course you can also talk about the state of cryptography and post-quantum algorithms. DeepSec has always had a decent crypto content.
We will give you some more ideas on what to submit in the course of the next weeks right here on this blog.
Hope to see you at DeepSec 2016 – the tenth DeepSec conference! Yay!
During the premiere of „A Good American“ we had a chat with journalists. Markus Sulzbacher of Der Standard wanted to know what the implication of the so-called Bundestrojaner (litterally federal trojan, the colloquial German term for the concept of inserting government malware in order to extract information from a suspect’s computer and telephone devices). The idea is to infect a computer system with malicious software that sits in the background and to siphon off the hard-to-get data connected to communication (i.e. messengers, Skype, emails, etc.). We have translated the interview from German to English for you. You can find the original on Der Standard web site.
Der Standard 12.04.2016
Police praise the software as a “wonder weapon against terror”. But for IT expert René Pfeiffer the planned introduction of governmental spying software is no suitable measure for the fight against crime.
Interview: Markus Sulzbacher
Standard: What speaks against the use of governmental spying software?
Pfeiffer: The use requires a manipulation of the device you’re going to spy on. In combination with an ongoing police investigation any form of manipulation is extremely questionable, regarding the evidential value of information and data extracted this way. A federal Trojan relies on an infrastructure, which intentionally keeps computer systems in a state of weakness in term of information security. It’s like a flat with predetermined breaking points on doors and windows. This goes against all principles of IT Security.
Standard: Is there such a thing like a “controlled” use of state espionage software?
Pfeiffer: You can compare malware to it’s biological pendants, bacteria and viruses. Everyone who believes in a controlled use of governmental spying software also believes in the controlled use of biological weapons. As soon as such code is set free, it can be examined and used to program new malware.
Standard: How can one protect oneself against a federal Trojan technically?
Pfeiffer: In the end a federal Trojan is governmental malware and behaves exactly like a digital Trojan horse, from which you protect yourself against by using anti-virus programs and other software. The target of spy attempts, your very own digital infrastructure, can’t distinguish a federal from a criminal Trojan. The outcome is the same, and since we haven’t been able to get rid of past and existing malware yet, we won’t be capable to protect ourselves from this one by using technology alone.
Standard: How does one gets to know about security gaps, information, which is key to programming such spying software?
Pfeiffer: There are companies, specialised in the targeted search and selling of vulnerabilities and exploits of all kinds of software. Efficiency determines the price: You pay a certain price and get information about a particular vulnerability, sometimes including the code to attack it on certain operating systems or applications. Depending on the price, vulnerabilities even come with a warranty: If a security gap has been detected and gets closed, you get a new one for free. Today the trade in vulnerabilities and exploits is socially accepted. It used to be a criminal domain.
Standard: Has there been an incident where the use of a federal Trojan has paid off?
Pfeiffer: I don’t know of a single case, where such a software has helped to so solve or prevent a crime. Anyway, sadly this is not the purpose of these measures, which are called for every time after an act of terror has been committed. They just help to secure the budget for the next few years. Right now IT is sexy, everybody relies upon it: The call for spying software seems more in keeping with the times than to call for more competent personnel and better education. Better still, you don’t have to explain yourself: Digital tools sound like magic, they’re justified by trend. Facts are so yesterday.
Essentially the debate about government-supplied malicious software is the same as with encryption backdoors. The discussion won’t go away by itself. Time to think about the case as Thorsten Benner and Mirko Hohmann from the Global Public Policy Institute (GPPi) in Berlin did. If you have any thoughts, save them for the upcoming Call for Papers for DeepSec.
In case you are forensically inclined, we might have a little Call for Papers email for you. There is a lot of strange code around in the Internet and other networks. Decoding what code does without getting your san(d)box blown apart is a fine art. We are interested in getting in touch with researchers in the field of malicious software and digital forensics. Software developers need to know what you have seen. So if you got some ideas, research, or interesting content, drop us your email address.
The world economy is threatened by a new strain of microorganisms. These so-called cyber pathogens spread via networks and the touch of digital devices. They can also lie dormant for days and months, only to spring to life when the victim’s immune system is at its weakest point. It is widely believed that cyber pathogens can infect the population of a whole country and wipe it completely off the grid of the Earth. Current antidotes can only treat the symptoms. The best way to get rid off the pathogens is to resort to physical means and destroy every surface it can cling to. Amputation of infected tissue also works. Unless security researchers will find a suitable vaccination soon, every single one of us is at risk.
The cyber pathogen threat is the reason for an alliance of famous three letter agencies. The Federal Bureau of Investigation (FBI), the National Security Agency (NSA), the US Department of Defense (DoD), and the Centers for Disease Control and Prevention (CDC) have announced to pool their resources in order to contain the spread of the microbes. Furthermore a research team will be created to study the characteristics of the cyber pathogens. Experts still lack the knowledge about the origin, ways of infection, metabolism, and possible mutations. However all experts agree that the pathogens require electric power, semiconductor material, and a way to transmit their DNA. Infection usually happens airborne (i.e. wireless), direct contact (i.e. wired), or by touch of infected tissue (i.e. storage media). Some cyber pathogens can also jump species. New life styles such as the Internet of Things may strongly accelerate infection rate and lead to a pandemic.
The FBI has announced that it will ask companies whose consumer products have been infected with cyber pathogens to cooperate. Chip manufacturers have offered their support by publishing ways to disinfect devices. The workaround requires to keep the temperature of processor and memory chips above 100°C / 212°F for more than one hour. It is also recommended to wear gloves at all times when working with keyboards or touch screens. Some people go to extremes and dump their cell phones and SIM cards after a couple of uses to get fresh ones. This strategy is highly recommended for everyone exposed to classified information. For some reason cyber pathogens are attracted to data that is being protected. Researchers believe that the high nutritional values of confidential data is the cause.
We are looking forward to hear more from the efforts to counter digital bacteria and other threats to mankind.
We already published a Call for Papers for the upcoming DeepINTEL 2016. Here are some thoughts to get your creativity going.
Standard solutions and off-the-shelf products to solve your security needs are remains from the 1990s. Everything else has gone smart, and that’s how you have to address security problems in the future. NSA director Admiral Michael Rogers told the audience of the RSA Conference 2016 that the NSA cannot counter the digital attacks it faces on its own. GCHQ, the NSA’s British counterpart, has publicly stated that the £860m budget to counter digital adversaries is not sufficient to defend Britain’s digital assets.
Modern digital defence needs a sound foundation of data to base decisions on. You can neither combat a forest fire or an infectious disease by blindly throwing money at it. You need to defend where it counts, and security intelligence information will be your guide. This is why we like to recommend the DeepINTEL conference to you. The event is a gathering of experts on this matter, and it is closed to the public. All speakers and participants sign a non-disclosure agreement, so that everyone can talk more openly. DeepINTEL acts as a small and agile think tank where you can openly discuss the state of information and infrastructure security. It’s easy to burn millions of €/$/£ with randomly chosen security measures without getting any improvement.
We are actively looking for smart ideas to do away with Full Take™ and Big Data™. Getting the right intel is key, not collecting as much as you can. If you have some thoughts on this matter, let us know.
For everyone attending DeepSec 2015 we organised a private screening of the film “A Good American”. Everyone else now gets the chance to see this film in theatres beginning on 18 March 2016. Next week there will be the premiere in Vienna, Linz, and Innsbruck here in Austria. Bill Binney will be present himself, and he will answer questions from the audience.
We highly recommend “A Good American” to everyone dealing with information security, regardless of the level. Full take and Big Data is not always the answer to your security challenges. Every gadget around is turning smart, and so should you.
We hope to see you at the premiere here in Vienna next week!