About René Pfeiffer

System administrator, lecturer, hacker, security consultant, technical writer and DeepSec organisation team member. Has done some particle physics, too. Prefers encrypted messages for the sake of admiring the mathematical algorithms at work.

0810, 2020

Administrivia: DeepSec and DeepINTEL Preparations, Anti-Virus Issues, Schedule, and digital Conference

René Pfeiffer/ October 8, 2020/ Conference

We have been stuck in administrative tasks for the past weeks. So to break the radio silence: Yes, DeepSec and DeepINTEL will happen. We currently prepare the hybrid configuration for the streams and the virtual platforms to bring speakers to the audience and vice versa. The conference hotel has confirmed that we can conduct the event at the usual location. Claiming that things look good is a bit of an exaggeration. Nevertheless we would like to go forward. Exchanging ideas and discussing current threats has never been more important than now. We hope to give you this opportunity, and we hope that you are able to participate. We have also created a couple of mailing lists for informal news, official press releases/articles, and future Calls for Papers to keep you informed. All lists are

Read More

2209, 2020

Administrivia: DeepSec 2020 will turn into a hybrid conference

René Pfeiffer/ September 22, 2020/ Administrivia, Conference

The current travel warnings and COVID-19 statistics have an impact on the DeepSec 2020 conference. As we expected, travel is the major obstacle. This means that DeepSec 2020, ROOTS, and DeepINTEL will turn into a hybrid event. We will still be on-site at the conference hotel. Presentations will be on-site and available by our conference streaming platform in parallel. Speakers that cannot be in Vienna will stream their presentations. Everything will be live, and everyone attending physically and virtually can participate. Furthermore, we constantly update our COVID-19 health protection in order to keep you and everyone here in Vienna at the conference safe. Two trainings are already virtually (right from the start). We are exploring which trainings can switch to a virtual mode and will update the schedule accordingly. In case you are interested

Read More

1609, 2020

Administrivia: DeepSec 2020, Virtual Content, Travel Warnings, Trainings

René Pfeiffer/ September 16, 2020/ Conference

Reading the news can be very frustrating these days. Not that it was ever fun. We are monitoring the current COVID-19 situation in Europe and abroad. Given the questionable start of the Corona Traffic Light system in Austria, we want to offer you some facts. The training Black Belt Pentesting / Bug Hunting Millionaire: Mastering Web Attacks with Full-Stack Exploitation and Mobile Security Testing Guide Hands-On will be virtual. This has been our and the trainer’s decision from the start due to travel regulations. Depending on the travel situation other trainings may switch to a virtual training as well. It depends on the content, and the trainers need to agree. Some of the DeepSec 2020 presentations will be virtual. Again this is due to travel regulations. Most of the presentation will still be on-site

Read More

1509, 2020

Reminder for your Training @ DeepSec 2020: Exploiting Race Conditions – Dawid Czagan

René Pfeiffer/ September 15, 2020/ Conference

A race condition attack is one of the most dangerous and underestimated attacks on modern web applications. It’s related to concurrency and multithreading.  As a result of this attack an attacker, who has $1000 in his bank account, can transfer way more than $1000 from his bank account. This is just one example, but it clearly shows how dangerous this attack is. If you develop or use software connected to a network, then this is for you. In a free video Dawid Czagan (DeepSec Instructor) will show you step-by-step how this attack works and tell you how to prevent this attack from happening. Watch this free video and feel the taste of Dawid Czagan’s Live Online Training ”Black Belt Pentesting / Bug Hunting Millionaire: Mastering Web Attacks with Full-Stack Exploitation” (DeepSec 2020; mind the date

Read More

1509, 2020

Administrivia: COVID-19 and Schedule Update

René Pfeiffer/ September 15, 2020/ Conference

We have been busy working on the schedule, the preparations for DeepSec/DeepINTEL, and our COVID-19 protection plan. As you may know, Austria has introduced a Corona „traffic light“ system to mark the spread of COVID-19 cases. We have added a section to our COVID-19 countermeasures describing what the traffic light colours mean. Since we rely on our own protection measures based on guidelines by health experts, DeepSec and DeepINTEL can happen unless a total lock-down is in place. The schedule has some updates. We have added two new presentations. Denis Kolegov will dissect IPSec UDP, a custom undocumented VPN protocol. It lacks the cryptographic strength and perfect forward secrecy. The protocol has severe flaws which allows attackers to reconstruct the keys and decrypt the whole network traffic. In addition Paula de la Hoz will

Read More

1109, 2020

Reminder for your Training @ DeepSec 2020: Bypassing CSP via ajax.googleapis.com – Dawid Czagan

René Pfeiffer/ September 11, 2020/ Conference

Content Security Policy (CSP) is the number one defensive technology in modern web applications. A good CSP offers a lot of possibilities, but it is hard to develop. Mistakes are common, too. Many developers add ajax.googleapis.com to CSP definitions, because they use libraries from this very popular content distributions network (CDN) in their web applications. The problem is that it completely bypasses the CSP and obviously you don’t want that to happen. Since CSP should be part of any modern application, you better get to work and brush up your knowledge. In a free video Dawid Czagan (DeepSec Instructor) will show you step-by-step how your CSP can be bypassed by hackers. Watch this free video and feel the taste of Dawid Czagan’s Live Online Training ”Black Belt Pentesting / Bug Hunting Millionaire: Mastering Web

Read More

0909, 2020

Administrivia: Updated COVID-19 counter measures document

René Pfeiffer/ September 9, 2020/ Conference

In software development and system administration some data sets are periodically updated. This is true for our COVID-19 counter measures document. We updated some sections and whacked our reverse proxy a bit (i.e. reduced the caching limits). We can’t do much about the travel regulations and your company policy, but we gone through great efforts to make your stay at DeepSec and DeepINTEL as safe as possible. 1918 is the new 1984. Stay healthy! Keep yourself air-gapped!

0909, 2020

Reminder for your Training @ DeepSec 2020: Token Hijacking via PDF – Dawid Czagan

René Pfeiffer/ September 9, 2020/ Conference

PDF files are everywhere. No day goes by without someone having used a PDF document. This is why PDF files are the perfect hacking tool. They can even be used to hack your web application. Imagine that the attacker prepares a malicious PDF file which steals sensitive data from a user. The PDF file is uploaded to the web application, the user reads this PDF file, and finally sensitive data is exfiltrated from the user’s browser. It’s scary, isn’t it? In a free video Dawid Czagan (DeepSec Instructor) will show you-step-by step how this attack works and how you can check if your web application is vulnerable to this attack. Watch this free video and feel the taste of Dawid Czagan’s Live Online Training ”Black Belt Pentesting / Bug Hunting Millionaire: Mastering Web Attacks with

Read More

0109, 2020

Administrivia – DeepSec 2020 Schedule, in-depth Articles, and Tickets

René Pfeiffer/ September 1, 2020/ Administrivia, Conference

We have some news. The schedule for DeepSec is getting stable. 🎉 Juggling the presentations slots and keeping in touch with all speakers and trainers is always the most dynamic part of DeepSec events. The current situation puts an extra strain on the preparations. We intend to conduct as much on-site presentations as possible. So far only two trainings and selected talks will be virtual. The main part of the schedule will be physically on-site. Please note our updated counter COVID-19 measures document. We have some more features planned for anyone attending, because we want to keep you busy during the conference. The ticket shop is online and waiting for your orders. We know that most people book late. Usually this is not a problem. Nevertheless we like to ask you to book early

Read More

2208, 2020

DeepSec 2020 preliminary Schedule published

René Pfeiffer/ August 22, 2020/ Conference

In Summer time slows down considerably. This has nothing to do with the theory of relativity. It’s just hot, people take some time off, and messaging latency significantly increases. In turn we have to speed up the reviews and come up with a selection. As always, this has been very hard. You sent us very high quality submissions. Thanks for making the selection process hard for us. 😍 The preliminary schedule is where it has always been in the past years. Please note that two trainings will be virtual trainings. All other trainings will be on-site unless we are forced to conduct them virtually as well. With COVID-19 being the Corona elephant in the room for all events all over the world, we created a document to address the health situation. DeepSec and DeepINTEL

Read More

2507, 2020

Administrivia: DeepSec Mailing Lists and last Call for our CfPs

René Pfeiffer/ July 25, 2020/ Administrivia, Conference

Summer is always a bad time for getting things done. Usually people are on holiday, sweat, relax, or travel for recreation. Things are different due to the Covid-19 precautions. Unfortunately our Call for Papers ends on 31 July 2020. This means we have to remind you about the deadline. We plan to publish the schedule in mid-August, so we don’t have much choice to ask you again for research results, insights, incidents, weaknesses, helpful hints for defence, and more.. Tell us about your research. Keep our reviewers busy! We have some additional information. We added a mailing list system to our infrastructure. The server is run by our event partners, the Crowes. So you can get news by raven, not only figuratively. The mailing lists we created are a tool to keep you informed.

Read More

0807, 2020

Administrivia: DeepSec/DeepINTEL/ROOTS Speaker Benefits extended to 2021

René Pfeiffer/ July 8, 2020/ Call for Papers, Conference

The Call for Papers of DeepSec, DeepINTEL, and ROOTS have a deadline. DeepSec and DeepINTEL have set he first deadline to 31 July 2020. We will accept submissions after this date, but everyone who submitted before the deadline will be reviewed first. Since all speakers are entitled to benefits which depend on their presence at the conference we decided to extend these offers. If you submit your presentation for the 2020 events and cannot attend, then all benefits such as entry to the conference, travel cost reimbursement, our famous speaker’s dinner, your stay at the hotel, and everything else will stay valid until DeepSec 2021. The only condition is that your content must be presented (either virtually or by proxy). The offer is valid for DeepSec and ROOTS. DeepINTEL is a special case, because

Read More

0107, 2020

Lectures on Information Security

René Pfeiffer/ July 1, 2020/ Discussion, High Entropy

It’s time for an editorial to end our premature Covid-19 induced Summer break. We (as in the staff behind DeepSec/DeepINTEL) were busy with projects, preparations, following the news about the pandemic, and collecting information for our event(s) in November. Personally I have been involved in teaching for decades. The past months have shifted the focus heavily on virtual presences in the form of teleconferences. Keeping hundreds of students busy while explaining how operating systems work and how secure code looks tends to take up some of your time. Good network connections and decent hardware helped a lot, but there are a couple of problems with conveying content, concepts, and ideas. Let me show you what I mean. Getting good tutorials is hard. The new agile way of computer science is to ditch good documentation

Read More

2905, 2020

Administrivia Update: Regulations, Ticket Shop, and DeepSec

René Pfeiffer/ May 29, 2020/ Administrivia, Conference

Clear guidelines for events and conferences slowly emerge here in Austria. We have some news on how DeepSec, DeepINTEL, and ROOTS will look like in November. We will compile the set of regulations in a separate document and publish it on our web site. The constraints set by the authorities contain no show-stoppers for the event and the trainings. We will carefully work out a concept which we will use in November for everything that is going on on site in Vienna. 😷 We have the full support of our conference hotel, and we are confident that we can increase health protection and decrease risks for everyone attending. In addition we found some bug in the ticket shop system. The tickets for DeepINTEL, DeepSec conference / training, and ROOTS can be bought via the

Read More

2705, 2020

Update and Reminder – DeepSec/DeepINTEL Call for Papers is still open

René Pfeiffer/ May 27, 2020/ Call for Papers, Conference

We have added another training to the schedule. Irene Michlin (IBM) will teach you about threat modelling and how to integrate threats into your software development life cycle. Further details will be published in our blog. Speaking of content – the call for papers for both DeepSec and DeepINTEL are still open. We are looking for your contribution. And then there is the inevitable update on DeepSec and the current pandemic situation. A lot of countries discuss how to proceed in terms of regulations, health protection, and logistics such as travel. We would very much link to official information on travel, accommodation, additional procedures during our event, and how DeepSec will look like in November. Sadly we cannot do this yet. The facts are that the Austrian hotels open on 29 May 2020 again.

Read More