DeepSec Season Greetings – Slides and Videos

René Pfeiffer/ December 23, 2021/ Conference/ 0 comments

We have been radio-silent for the past weeks, because we had to post-process the conference. The videos of DeepSec 2020 have been completed and uploaded to Vimeo. You can view them in our showcase collection for the event. We hope you can find some quiet moments in the next few days. The slides of the presentations are stored on our web server. We haven’t hidden any Log4Shell emoticons in the documents, so they are safe to view. 😉 Enjoy the holidays! See you next year!

DeepSec and DeepINTEL 2021 concluded, Dates for Events in 2022

René Pfeiffer/ November 26, 2021/ Conference/ 0 comments

The last week was very exciting, Organising DeepSec and DeepINTEL 2021 right in the middle of changing regulation and travel restrictions was not easy. Both events were in in hybrid form with health protection measures. The pandemic has raised  a lot of questions on how scientific research impacts government, politics, and society. One of our main concerns is to put scientific methods back into information security. While nobody dies or contracts a disease when information security fails, there are parallels between warnings of experts and the lack of adequate means to protect the population. We have some dates for your calendar. Please make a note and set your alarm for our events next year: DeepSec IT & Law Convention – 26 April 2022 DeepSec 2022 Trainings – 15/16 November 2022 DeepSec 2022 Conference –

Read More

Talk “Analyzing Radicalization on the Internet – Method and Results of the COMRAD-Project” moved to 19 November 2021 16:50

René Pfeiffer/ November 18, 2021/ Administrivia, Conference/ 0 comments

The presentation „Analyzing Radicalization on the Internet – Method and Results of the COMRAD-Project“ has been from today moved to 19 November 2021 at 16:50. The presentation has not been cancelled. We had to move the talk because of a collision and technical problems.

DeepSec 2021 Talk: Analyzing Radicalization on the Internet – Method and Results of the COMRAD-Project – Dr. Andreas Enzminger & Dr. Jürgen Grimm

Sanna/ November 17, 2021/ Conference, Internet/ 0 comments

Incitement, radicalization, and terror are the buzzwords that currently concern us the most. Right-wing and left-wing extremist groups or religious fundamentalists act as fire accelerators for extremist tendencies, even leading to the use of political violence. In this way, they can also endanger the value-based foundations of democracy in the medium and long term. Although much discussed, the role of the media, especially social media, in radicalization within society remains conceptually and empirically unclear. While there are several case analyses based on violent events, systematic studies have yet to be conducted. To fill this gap, the COMRAD project is dedicated to researching radicalization tendencies in cyberspace, focusing on psychosocial, ideological, and communicative conditioning factors. The focus is on the “open space” of politically left-wing, right-wing, or Islamic Facebook groups, in which recruitment strategies and

Read More

DeepSec2021 Talk: QKD-based Security for 5G and Next Generation Networks – Sergiy Gnatyuk, PhD. DSc.

Sanna/ November 16, 2021/ Conference, Security/ 0 comments

Modern information and communication technologies (ICT) implementation in all spheres of human activity, as well as the increasing number and power of cyber-attacks on them make the cyber security of the developed digital state vulnerable and weak. Cyber-attacks become targeted (so-called APT-attacks) and attackers carefully prepare them, analyzing the identified vulnerabilities and all possible ways of attack. The security and defense capabilities of the state are considered in an additional fifth domain titled cyberspace (after land, air, water and space). World`s leading states develop strategies to protect cyberspace, create cyber troops, develop and test cyber weapons. A significant number of cyber-attacks today are aimed at critical infrastructures and government organizations. Traditional security methods (in particular, cryptographic algorithms) do not fully protect against all currently known attacks, they are potentially vulnerable to attacks based on

Read More

Updated Health Protection Guidelines – Information about hybrid Configuration of DeepSec & DeepINTEL 2021

René Pfeiffer/ November 13, 2021/ Administrivia, Conference/ 0 comments

The City of Vienna has announced changes to the health protection regulations. The regulations are still not in effect, but we expect them to be in place in the course of the next week. The city council is more strict than the rest of Austria, so make sure to update on local regulations. We have updated the health protection document on our web site. Basically the access to the conference is limited to persons having recovered from CVOID-19 and vaccinated persons. Additional information can be found by using one of the following links: Latest COVID-19 information Information about COVID-19 (City of Vienna) DeepSec will be at the conference hotel and feature live streams for every track. Some speakers will present remotely. All presentation will be available on site and via the streams. Links for

Read More

New health protection regulations for DeepSec and DeepINTEL 2021

René Pfeiffer/ November 5, 2021/ Conference/ 0 comments

The City of Vienna has announced stricter regulations regarding conferences and restaurant businesses. This directly affects our conferences. Beginning with 15 November 2021, attending events requires a proof of either having recovered from a COVID-19 infection („genesen“) or be fully vaccinated („geimpft“). This is called the „2G rule“ because of the German words used for the terms. We will update our procedures for the conference accordingly. Our conference hotel has to follow the regulations as well. This means that you cannot attend either DeepSec or DeepINTEL with only a test (of any kind). There will be no exceptions. Further information can be found at the following links: What is „3G“ rule? Questions and answers regarding coronavirus and the COVID-19 disease Up-to-date Information on the Coronavirus Situation Some of the information web sites will get

Read More

DeepSec 2021 Talk: Running an AppSec Program in an Agile Environment – Mert Coskuner

Sanna/ October 29, 2021/ Conference/ 0 comments

Application security in an enterprise is a challenge. We can see this when we look at the statistics: There have been 16648 security vulnerabilities (CVEs) published so far in 2020 and the average severity is 7.1 out of 10. In this talk, you will find various solutions such as – Development team risk scoring based on maturity and business aspect, – SAST/DAST at CI/CD pipeline without blocking the pipeline itself, – How to leverage bug bounty program, – When to employ penetration testing, – When to employ code review, – Platform developments to remove dependency for developers to implement features, i.e. internal authorization. Most important of all, you will see these solutions lead to minimal friction within the team, which creates a fine-tuned security program. We asked Mert a few more questions about his

Read More

DeepSec2021 Talk: On Breaking Virtual Shareholder Meetings: How Secure is Corporate Germany? – Andreas Mayer

Sanna/ October 29, 2021/ Conference/ 0 comments

The Covid-19 pandemic has had a major impact on annual general meetings (AGMs) of shareholders worldwide. Due to existing gathering restrictions the vast majority of AGMs shifted from physical to online voting events. Therefore, purely virtual AGMs emerged to the new normal where shareholders approve critical company decisions. But how secure are those virtual events really? In this talk, I will present a systematic large-scale study on the security of 623 virtual AGMs held by German companies in 2020 including corporations listed in stock indices such as DAX and MDAX. In 72% of all virtual AGMs analyzed, at least one of the three CIA triad security goals was compromised. Join my talk and I will take you on an enthralling journey through the nitty gritty details and pitfalls that lead to the severe vulnerabilities

Read More

DeepSec 2021 Talk: Building a Cybersecurity Workforce: Challenges for Organizations – Matthieu J. Guitton

Sanna/ October 23, 2021/ Conference/ 0 comments

The shift of human activities from offline to online spaces has major impacts on organizations – either public or corporate – in terms of security, therefore creating a constantly growing need for cybersecurity experts. Although for small companies, expertise can come from external providers, large organizations need to build their own cybersecurity workforce. The limited number of higher education formations result for companies in tension in the employment market, and in the recruitment of people whose expertise is not primarily on cybersecurity. Furthermore, cybersecurity often focuses on technical aspects, and does not always deal enough with the human factor – while the human factor is critical for companies and other large organizations. This presentation will explore the challenges related to building a workforce in cybersecurity from the point of view of organizations. We will

Read More

Hardwear.io Interview: BlueMirror – Defeating Authentication in Bluetooth protocols

René Pfeiffer/ October 22, 2021/ Conference/ 0 comments

Bluetooth communication has become a standard for many handheld devices, personal computers, and local area networks. Since the protocol was first published, it has gone through many improvements. Security researchers and hackers have subjected Bluetooth devices and the protocol to security tests and analysis. The most recent discovery has to do with the key agreement protocols of Bluetooth. This topic will be presented at Hardwear.io by Tristan Claverie and Jose Lopes Esteves. We have asked both of them a few questions: Bluetooth has come a long way from the first attacks almost twenty years ago. Are there fundamental design weaknesses that impact Bluetooth security up to newer protocols? If we look at recent protocols (the most recent ones being the ones standardized for Bluetooth Mesh), there is still the ability for two devices to

Read More

DeepSec 2021 Talk: SSH spoofing attack on FIDO2 Devices in Combination with Agent Forwarding – Manfred Kaiser

Sanna/ October 22, 2021/ Conference/ 0 comments

Since OpenSSH 8.2 there is the possibility to secure a private key with a with a FIDO2 token (Nitrokey, Yubikey, …). A key protected by FIDO2 must be manually confirmed each time the key is used and prevents misuse of the key if an SSH agent is compromised. Although it is known that agent forwarding is a security risk and should not be used, support has been extended with OpenSSH 8.5 (Released: 3.3.2021). Prior to OpenSSH 8.5, it was not possible to forward an SSH agent during file transfers (SCP/SFTP) to another server. This was one of the reasons why AUT-milCERT (BMLV) took a closer look at the SSH protocol. The goal was to find out whether a FIDO2 protected key can provide sufficient protection against misuse in case of a leaked agent. During

Read More

DeepSec 2021 Talk: Releasing The Cracken – A Data Driven Approach for Password Generation – Or Safran & Shmuel Amar

Sanna/ October 21, 2021/ Conference/ 0 comments

By now, it should be well known that passwords are like underwear, they should be changed often, the longer the better and it’s better not to leave them lying around. While the big players advocating for passwordless authentication, passwords are still the most common authentication method. In the wild, we’ve seen thousands of organizations experiencing password spraying and bruteforce attacks on their users. Although MFA should mitigate some of the threats, it’s still not implemented on all protocols and in some cases was bypassed by security flaws in the IDP. In this talk, we’ll present a new concept for password security – smartlists, built on a new data driven approach that utilizes recent advancements in NLP. Together with this talk, we are proud to release a new FOSS tool that makes these new concepts

Read More

DeepSec 2021 Talk: Firmware Surgery: Cutting, Patching and Instrumenting Firmware for Debugging the Undebuggable – Henrik Ferdinand Nölscher

Sanna/ October 20, 2021/ Conference/ 0 comments

Embedded systems can be challenging to analyze. Especially on automotive systems, many things that we take for granted on other software such as debugging and tracing do not always work. This is further complicated by watchdogs and peripheral processors, that go haywire when strict timing and communication requirements are violated. On some systems, debugging is even impossible because debugging resources such as pins are either used for something else or they don’t exist at all! Assuming that code can be dumped, the solution for this can be emulation, however emulating a rich automotive system can be painful and many times, only few aspects of the system can be sufficiently modeled. What if there was an in-between? How can we debug, fuzz and tamper embedded firmware without access to real-time debugging or emulation? In this

Read More