About René Pfeiffer

System administrator, lecturer, hacker, security consultant, technical writer and DeepSec organisation team member. Has done some particle physics, too. Prefers encrypted messages for the sake of admiring the mathematical algorithms at work.

0903, 2023

DeepSec 2023 Call for Papers is open

René Pfeiffer/ March 9, 2023/ Call for Papers, Conference, DeepIntel/ 0 comments

The call for papers of DeepSec 2023 and DeepINTEL 2023 is open! You can submit your ideas for presentations and trainings via our CfP manager form. Content for DeepINTEL should be sent to use directly (but you can use the same web form, just mention what you have in mind). This year’s focus will be on the wonderful world of artificial intelligence, machine learning, and related algorithms. The GPT language models have gained notoriety in the media. All the shiny algorithms still lack cognitive skills, but they are decent simulations of communication. Big companies rush to add dumb conversation simulators to their products. What does this mean from the information security perspective? If you have found weaknesses in chat simulators or AI/ML filters, please let us know. It’s your turn to tell HAL 9000

0902, 2023

Call for Papers Preparations, Social Media, and other Updates

René Pfeiffer/ February 9, 2023/ Administrivia, Communication, DeepIntel/ 0 comments

Our traditional Winter break has been a bit longer than anticipated. We are working on the call for papers for DeepSec and DeepINTEL 2023 (14 to 17 November 2023). The location has not changed, so we can focus on the content of the conferences. This is a good time to check if you are on our call for papers mailing list. If you like our regular reminders and updates, please subscribe or tell us what email address we should add. Speaking of communication, the sabotage of Twitter continues. Today the APIs for posting content are limited to paid subscribers. This deliberately stops cross-posting content to Twitter from other sources. It affects updates from our blogs and updates via mobile phones, because we never used the official Twitter app (and will not in the future).

2001, 2023

DeepSec News Channels and Twitter Third Party Apps

René Pfeiffer/ January 20, 2023/ Conference/ 0 comments

A couple of days ago the Talon app we use for reading and writing on Twitter stopped working. Code that stops working or APIs that turn into bouncers at the nightclub is normal operation in some fields of IT. As for Twitter, it has turned into a personal playground of one person. The platform has nothing to do with the microblogging service it once was. Decisions are made random or with a questionable agenda. It’s time to leave. And no, we are not going to Mars like Ryba Zhfx promised the public over ten years ago. You can find links to our articles on our Mastodon account. We have this blog, and we have our mailing lists. We will try to turn our Twitter postings into an archive and publish it on our servers

1712, 2022

Late thank you for attending and speaking at DeepSec / DeepINTEL 2022

René Pfeiffer/ December 17, 2022/ Administrivia, Conference/ 0 comments

Usually we are under high load after the conference because of the administrative tasks. 2022 was no exception, but the change of location still requires some attention. So this is a much delayed thank you for attending our events and speaking at DeepSec and DeepINTEL 2022! It was great to meet all of you in person. We also enjoyed talking about experiences with IT security, exchanging insights, sharing stories, and gathering inspiration for the next year. While virtual meetings can save time and help a lot, some things are best discussed face to face. The videos are nearly fully post-processed. We will inform our attendees and speakers first. In January 2023, you can enjoy the videos on our Vimeo account. The slides of the presentations can be downloaded from our DeepSec 2022 slide collection.

3011, 2022

DeepINTEL Report: The view from Vienna: OPSEC, Iran’s cyberpower, and tech decoupling

René Pfeiffer/ November 30, 2022/ DeepIntel, Security Intelligence/ 0 comments

We are a bit late with the summaries from our event. Let’s start with some public information from DeepINTEL 2022. The conference is a closed event where security experts can openly discuss updates on threats, capabilities of potential adversaries, and all kinds of intelligence information related to information security. Steph Shample, an expert from the Middle East Institute (MEI), gave an update on Iran’s capabilities in past and present APT, cybercrime, ransomware, and cryptocurrency. The connections of Iran with China and Russia were discussed, too. Given the invasion of Ukraine, Russia is trying to get support for its digital operations. Mohammed Soliman, also from the Middle East Institute, presented his research on the technology containment strategy by the US administration. The stance regarding 5G serves as a blueprint. It is important to emphasise that

1711, 2022

DeepSec 2022 has started – two Days of Presentation about Information Security

René Pfeiffer/ November 17, 2022/ Conference, Security/ 0 comments

The DeepSec Conference 2022 has started. We will be busy handling the presentation tracks, the TraceLabs OSINT CTF event, and the ROOTS track. We covered most of the presentations in brief interviews on this blog. There is more to come after the conference has ended. The live streams from the conference are available to registered attendees. The recordings will be published on our video platform after post-precessing. Updates from the event will be posted to our Twitter and Mastodon accounts. In case you want to be part of the conversation, please use the #DeepSec hashtag.

1611, 2022

DeepINTEL 2022 has started – Conference on Security Intelligence

René Pfeiffer/ November 16, 2022/ Conference, DeepIntel/ 0 comments

We often abuse the term big picture as an analogy for a better perspective on things. With security intelligence, this is true. The DeepINTEL conference covers the strategic aspects of IT security, analyses the capabilities of potential (and actual) adversaries, and helps to bridge the gap between individual experiences of security researchers and targets. DeepINTEL 2022 has started. Topic-wise advanced persistent threats, the current geopolitical situation, psychological warfare with digital means, and techniques of malicious software in attacks are the primary focus. Selected aspects will be published in articles on this blog after the conference, because the DeepINTEL is a TLP:AMBER event.

1511, 2022

Reminder for virtual Training: Exploiting Race Conditions

René Pfeiffer/ November 15, 2022/ Security, Training/ 0 comments

A race condition attack is one of the most dangerous and underestimated attacks on modern web applications. It’s related to concurrency and multi-threading. Because of this attack, an attacker who has $1000 in his bank account can transfer more than $1000 from his bank account. This is just one example, but it clearly shows how dangerous this attack is. In a free video Dawid Czagan (DeepSec instructor) will show you step by step how this attack works and will tell you how to prevent this attack from happening. Watch this free video and feel the taste of Dawid Czagan’s live online training ”Black Belt Pentesting / Bug Hunting Millionaire: Mastering Web Attacks with Full-Stack Exploitation”- Because of our hybrid configuration of DeepSec for trainings and the conference, the Mastering Web Attacks with Full-Stack Exploitation

1511, 2022

DeepSec 2022 Trainings have started

René Pfeiffer/ November 15, 2022/ Security, Training/ 0 comments

The DeepSec trainings have started. Today is the first day. The topics cover attacking modern desktop applications, network threat hunting, incident response, creating malicious office documents for offensive tests, and secure code review. The spectrum covers a lot of content, and it will be very helpful for defending the information security landscape. One of our trainings can still be booked. The workshop titled “Web Hacking Expert: Full-Stack Exploitation Mastery” by Dawid Czagan has been postponed to 28/29 November 2022. It will be an online training. You can take part virtually. Bookings are still possible via our ticket shop.

0811, 2022

DeepSec 2022 Keynote: Complexity killed the Cat

René Pfeiffer/ November 8, 2022/ Conference/ 0 comments

Complex systems is not a term indicating that you have stopped to understand something. The colloquial phrase „it’s complicated“ is often used as a joke. Complex systems have their own science. Information technology has managed to make our daily life easier. Applications manage vast amount of data, communication protocols transport countless numbers of messages, systems just work, and everything is fine. The problem is that code usually grows and never shrinks. This has implication for software development and for information security. The keynote will take you on a tour through complex systems, complexity, the limits of growth, and how the consequences can be managed in a sane way. The presentation will also try to remind you to ask questions, think twice about selecting appropriate metrics, and how to apply this approach to the tools

3110, 2022

We have a Mastodon account – please come and follow us!

René Pfeiffer/ October 31, 2022/ Conference/ 0 comments

The swinging moods of billionaires have hit Twitter. 230 million users have switched ownership and now follow the erratic decisions of a single person. „Mars first!”, or something. DeepSec is using Twitter as a channel to link to blog posts and to share information about ongoing events. This will not change for the moment. However, we have created a new Mastodon account to be on the safe side. The account name is already visible on our Twitter profile page. Please follow us, if you want to receive further news without interruption. DeepSec is fond of decentralised communication channels. While this means more effort to filter and selecting sources, it is true to the original character of the Internet. We also maintain our own mailing lists which cover press releases, random scuttlebutt behind the scenes,

1609, 2022

Scuttlebutt – Musings about the Energy Cost of Information Security

René Pfeiffer/ September 16, 2022/ Conference, Discussion, High Entropy, Scuttlebutt

[Of course, this is the August 2022 article from the DeepSec Scuttlebutt mailing list. We publish the postings one month later on our blog. For timely scuttlebutt, please subscribe to the mailing list.] Dear readers, the Summer is burning Europe and other parts of the world. The climate is changing and poses the biggest challenge to all aspects of our society. And this is without other man-made catastrophes, such as war, lack of raw materials, logistics, health protection, and many more trouble spots. DeepSec is about information security, so I will stick to the digital parts of the story. There are already too much “experts” on social media. No need to add more. Have you ever wondered what amount of energy is used for digital security measures? Have you ever tried an estimate? I

1209, 2022

44CON Reloaded – get you dose of Information Security!

René Pfeiffer/ September 12, 2022/ Conference

44CON is back! Make sure that you get your ticket, because information security is all about getting the edge over your adversaries. This is best done by keeping up-to-date. 44CON has the right schedule for you. It’s full of goodies dealing with Kerberos, forensic code-breaking, attacks on e-ticketing portals, incident response with the Log4J showcase, kernel exploits, and sensibly using security scanners on AWS. The programme also features a hands-on exercise in the form of Trace Labs’ Capture the Flag. 44CON begins on 15 September 2022 at 0915 (BST).

0509, 2022

DeepSec 2022 Focus Topics and an almost final Schedule

René Pfeiffer/ September 5, 2022/ Administrivia, Conference

If you are a regular visitor of our conference or our blog, then you probably know about the different phases of our schedule. We are now in the preliminary stage. Reviews are still being done, and we sort out questions to and answer from our speakers. You may have noticed the free slots. These are still under review. Hopefully, we will have everything sorted out in the course of the next weeks. DeepSec has some internal rules for reviewing presentation submissions. We usually do not accept persons of the same organisation, so that one organisation can have one presentation in the programme. This makes the reviews hard, because you always send us top quality material. We could easily conduct two or three conferences instead of one. For 2022, we have accepted multiple speakers from

1508, 2022

DeepSec and DeepINTEL 2022 Schedule – Reviews almost done

René Pfeiffer/ August 15, 2022/ Conference, Training

The yearly review of submissions is the hardest task of the year. Thanks a lot for your contributions. DeepSec would need to be a full week to accommodate all submitted material. Thanks a lot! We are still stuck in the final reviews, so it will take a week or two to fill all the slots. You may have noticed that the schedule on our website is already alive and kicking. There will be some more rearrangements regarding the presentation slots. The DeepINTEL schedule is available on request since DeepINTEL is a TLP:AMBER event. We have some interesting insights into current campaigns and the capabilities of selected adversaries for you. Effective defence needs well-prepared data and reconnaissance. So we highly recommend attending DeepINTEL 2022. Looking forward to see you in Vienna!