Information Warfare

René Pfeiffer/ March 17, 2022/ Conference

[This is the March update from our DeepSec scuttlebutt mailing list. Subscribers received this article already.] Filling a blog with articles is both hard and very easy these days. In theory, information security is more present in the news than ever. In practice, you will find few articles with in-depth content. A few days ago I had a discussion with a friend about the many web pages with the title scheme “n reasons why something is great” or “k ways to do web application filtering”. We both agreed that the title is a definite warning not to read the article. Also, most articles just give you a brief introduction into a topic and suddenly end after a few paragraphs. The term clickbait comes to mind. A lot of publishing systems use fancy techniques to

Read More

To Join or not to Join a Cyberwar – Hacking Back and Hack Attacks

René Pfeiffer/ March 1, 2022/ Conference

The Russian invasion of Ukraine has put the digital sidelines into the spotlight. The world of cyber is part of conflicts, politics, and military operations. This has become very clear if you look for preparations of the current military actions in Ukraine. Information warfare most likely predates the tanks and missiles by year or even decades. This is not the focus of this article. There have been calls to attack networked targets in order to help. Is this a good idea? Let’s see. Information warfare is one aspect of the digital domain. Then there are sabotage, disrupting networks, exploiting vulnerabilities, getting access to data, and many more aspects. Joining either side of a conflict is usually a bad idea. Everything starts with the targets. Who runs a system you have decided to attack? It’s

Read More

Sven Guckes has died

René Pfeiffer/ February 23, 2022/ Conference

Sven Guckes has died. Sven was a constant companion of Free Software events throughout the years. He contributed to Free Software projects in many way. He ceaselessly connected people by organising meetings in restaurants prior to, during, and after conferences. The command line was his home. He helped improve Vim configurations for countless persons and enabled them to use this editor more efficiently. Sven was session chair at past DeepSec conferences. We mourn his loss, and we fondly remember his contribution to transferring knowledge and experience between everyone he connected. Thanks, Sven! Others have published their thoughts about Sven. You can find the texts by using the following links: Remember: Be More Like Sven Sven Juckes passed away Vim-Versteher und Kommandozeilenerklärer: Sven Guckes ist tot (German) Vim 9 will be dedicated to Sven Guckes

Read More

DeepSec Season Greetings – Slides and Videos

René Pfeiffer/ December 23, 2021/ Conference

We have been radio-silent for the past weeks, because we had to post-process the conference. The videos of DeepSec 2020 have been completed and uploaded to Vimeo. You can view them in our showcase collection for the event. We hope you can find some quiet moments in the next few days. The slides of the presentations are stored on our web server. We haven’t hidden any Log4Shell emoticons in the documents, so they are safe to view. 😉 Enjoy the holidays! See you next year!

New health protection regulations for DeepSec and DeepINTEL 2021

René Pfeiffer/ November 5, 2021/ Conference

The City of Vienna has announced stricter regulations regarding conferences and restaurant businesses. This directly affects our conferences. Beginning with 15 November 2021, attending events requires a proof of either having recovered from a COVID-19 infection („genesen“) or be fully vaccinated („geimpft“). This is called the „2G rule“ because of the German words used for the terms. We will update our procedures for the conference accordingly. Our conference hotel has to follow the regulations as well. This means that you cannot attend either DeepSec or DeepINTEL with only a test (of any kind). There will be no exceptions. Further information can be found at the following links: What is „3G“ rule? Questions and answers regarding coronavirus and the COVID-19 disease Up-to-date Information on the Coronavirus Situation Some of the information web sites will get

Read More

Hardwear.io Interview: BlueMirror – Defeating Authentication in Bluetooth protocols

René Pfeiffer/ October 22, 2021/ Conference

Bluetooth communication has become a standard for many handheld devices, personal computers, and local area networks. Since the protocol was first published, it has gone through many improvements. Security researchers and hackers have subjected Bluetooth devices and the protocol to security tests and analysis. The most recent discovery has to do with the key agreement protocols of Bluetooth. This topic will be presented at Hardwear.io by Tristan Claverie and Jose Lopes Esteves. We have asked both of them a few questions: Bluetooth has come a long way from the first attacks almost twenty years ago. Are there fundamental design weaknesses that impact Bluetooth security up to newer protocols? If we look at recent protocols (the most recent ones being the ones standardized for Bluetooth Mesh), there is still the ability for two devices to

Read More

Hardware Security – Hacking on the Layer 1 – Training and Conference

René Pfeiffer/ September 20, 2021/ Conference

In system administration there is an easy way to distinguish between software and hardware: hardware are the parts that can be kicked. This happens usually when things break. Since breaking things is a major part of security research, we have teamed up with the Hardwear.io Security Conference. The Spectre and Meltdown bugs have shown that hardware is a crucial part of everyone’s security architecture. Few software developers realise that this foundation can cause a lot of havoc. So we recommend checking out the schedule. Reverse engineering hardware can be very rewarding, because you learn a lot on how it reacts to perturbations. There will be a training at Hardwear.io on how to do this with celullar baseband firmware. This piece of code sits on the gateway to the mobile network. During the training you

Read More