1903, 2025

DeepSec and DeepINTEL 2025 – Call for Papers!

René Pfeiffer/ March 19, 2025/ Administrivia, Call for Papers, Conference, DeepIntel/ 0 comments

We have silent running since December. The reasons were behind-the-scenes updates, post-processing the past DeepSec conference, recharging our batteries, and adapting to the new situation in IT security influenced by geopolitics. Following the news since 20 January took a lot of head-shaking and wondering what the rest of 2025 will look like. This is where you come in. We want to see and hear you on stage at DeepSec and possibly DeepINTEL 2025. The Call for Papers is now open. The motto for DeepSec this year is “forbidden lore”. It is a reference to forbidden knowledge, the debate about full disclosure, and hard facts that are now declared illegal by authoritarian governments. DeepSec has always followed a scientific approach for discussing and questioning IT security. One of our past conferences even had the motto

Read More

0112, 2024

DeepSec 2024 Keynote – The Mind Bomb

René Pfeiffer/ December 1, 2024/ Conference/ 0 comments

DeepSec 2024 ended on 22 November 2024. We took a week off to post-process the event in terms of video material and dialogues. Usually only participants get first access to the video recordings, but because of the threat of disinformation from nation states, we published the keynote early and freely. Randahl Fink explained his take on manipulation of elections and entire societies. Russia, among others, is very proficient in creating election results that keep on surprising politicians and analysts alike. The Mind Bomb is real, and it is about to explode in Western democracies. You can watch the video online on Randahl’s YouTube channel, his Patreon site, or on our Vimeo account. Presenters at conferences are storytellers. They make topics come alive, create links between seemingly unrelated aspects, teach new knowledge, and hopefully make

Read More

2111, 2024

DeepSec 2024 Opening – Conference Days are now live

René Pfeiffer/ November 21, 2024/ Conference/ 0 comments

DeepSec 2024 has opened. Enjoy the two days of presentations, discussions, and insights into how to improve the security of your information technology infrastructure. Our keynote will deep dive into the dangerous world of mind manipulation. Social engineering is a threat from the past. Political engineering is the new kid on the block, and it has the power to reshape and destroy nation states and societies. Fake news, propaganda, and outright lies have become the standard tool of radical parties, be it left, right, or centre. Randahl Fink explores the power of the mind bomb in his keynote presentation. For everyone attending: Our only social media presence is in the Fediverse. Please use our @DeepSec handle and the #DeepSec hash tag for referencing content and discussions. Do not use Twitter/X or similar platforms. Thank

Read More

2011, 2024

DeepINTEL 2024 – a full Day all about Security Intelligence

René Pfeiffer/ November 20, 2024/ Conference, DeepIntel/ 0 comments

The DeepINTEL 2024 security intelligence has begun. The day holds a full day of presentation about current and future threats. It is difficult to describe a TLP:AMBER event, because we do not publish the schedule for DeepINTEL. The term security intelligence has a wide spectrum. Basically, it includes all informations that will help you improve your defence, understand your adversaries, and how attacking groups operate. The sources are probes, monitoring systems, reports from attacks and their analysis. We are looking forward to provide the next iteration of DeepINTEL as a unique forum where security experts can get crucial updates. Grab your coffee, listen, and contribute!

1611, 2024

DeepSec 2024 Talk: Executive Breach Simulation Toolkits – Pavle Bozalo, Aron Feuer & Matias Ulloa

Sanna/ November 16, 2024/ Conference/ 0 comments

As cyberattacks multiply and become more sophisticated, executive breach simulation toolkits have become essential. Enabling organizations to simulate, predict, and assess the impact of potential security breaches from an executive perspective is necessary to know how to keep organizations safe. Unfortunately, simulations are broken. Simply put, they don’t properly prepare leaders and security practitioners for security breaches. This talk will look at the evolving landscape of breach simulation toolkits designed for security practitioners, focusing on their role in enhancing cybersecurity strategies, incident preparedness, and organizational resilience. We will see how simulations can be engaging, while remaining instructive and preparing people for actual cyber events. We’ll discuss how these toolkits work, why they’re essential for making smarter business decisions around cybersecurity, and how they help align leadership with technical teams. Real-world examples will show how

Read More

1511, 2024

DeepSec 2024 Talk: The Malicious Bloodline Inheritance: Dissecting Deed RAT and Blood Alchemy – You Nakatsuru, Kiyotaka Tamada & Suguru Ishimaru

Sanna/ November 15, 2024/ Conference/ 0 comments

ShadowPad is a particularly notorious malware family used in Advanced Persistent Threat (APT) campaigns since 2017. ShadowPad use spread to various groups beginning in 2019, and a ShadowPad builder was disclosed in June 2024. One reason ShadowPad has garnered so much attention from security researchers is that it is an advanced modular type fileless RAT with a complex structure that is difficult to analyze. In July 2023, Deed RAT was published by Positive Security as a variant of ShadowPad. Furthermore, Blood Alchemy malware was also discovered as another variant of Deed RAT in April by ICI, with evidence such as unique data structures, malware configurations, loading schemes, and code similarities. However, important features of both Deed RAT and Blood Alchemy, such as the C2 communication scheme, loading additional modules, and details of backdoor commands,

Read More

1211, 2024

DeepSec 2024 Talk: Why NIS2 Implementation often fails in Industrial Areas – Michael Walser

Sanna/ November 12, 2024/ Conference/ 0 comments

Why do most projects preparing for NIS2 fail in practice? Many affected companies complain about the requirements of EU Directive 2022/2555, which are too unspecific and technically difficult to implement. Excessive demands are spreading. Companies affected are uncertain because of the evaluation of the actual implementation, unlike ISO security certification (e.g. ISO27001/ISO62443). The results are often unsatisfactory despite the sometimes massive investment in costs and personnel resources. An Excel spreadsheet or a Visio drawing itself does nothing to change the resilience of KRITIS or industrial facilities against cyber-attacks in practice. We focus on industrial customers and their OT infrastructure, using anonymized, real-world examples to show the challenges in practice and offer examples of solutions to prevent repeating past mistakes. The first steps do not have to cost a lot of money or tie up

Read More

1211, 2024

DeepSec 2024 Talk: Industrial plants: IP Protection in an increasingly (de)globalized economic System – Josef Rametsteiner

Sanna/ November 12, 2024/ Conference/ 0 comments

Customs duties and trade restrictions are increasingly presenting companies with logistical challenges. The trend is to move production capacities to the relevant countries to be close to the customer. But how can a company safely move to an industrial plant abroad without risking the loss of its own IP (intellectual property)? By using a practical example, we show how to enable a commercially available Simatic S7 1500 PLC to keep control over the PLC program stored in the controller and its parameters. To achieve this, we implement strong cryptography within the device. The challenge here is that the device does not have the necessary functionality “out of the box”. How can we make sure that production does not take on a life of its own (secure manufacturing)? Regardless of the PLC used, industry has

Read More

1111, 2024

DeepSec 2024 Talk: “EU Cyber Resilience Act” – Maintain control and not just liability for your products – Michael Walser

Sanna/ November 11, 2024/ Conference/ 0 comments

The new EU Directive EU 2019/1020, also known as the “Cyber Resilience Act” or “CRA” for short, defines new rules for manufacturers of hardware and software with “digital elements”. For device manufacturers in the medical, industrial and entertainment sectors, the time to act is now. Security updates, vulnerabilities and an extended duty of care for the life cycle are now enforced by law. However, hardware production, such as IoT devices, poses new challenges. What many do not know: Many vulnerabilities are because of physics and are not “bugs” in the conventional sense. As part of the “DeepSec Secure Coding” series, we put the spotlight on the challenges of developing secure hardware and show the vulnerabilities using the example implementation of a bootloader for embedded systems. How to keep control over updates? What is “Secure

Read More

0811, 2024

DeepSec 2024 press release: Sluggish NIS2 implementation as a security risk. DeepSec conference presents remedies against the shock paralysis in companies

Sanna/ November 8, 2024/ Conference, Press/ 0 comments

Directive (EU) 2022/2555, abbreviated as the NIS-2 Directive, should strengthen resistance to digital attacks by potential targets in the European Union. Certain companies of a certain size in defined sectors are required to implement the directive. The directive targets critical and important companies. This year’s DeepSec conference, together with sematicon AG, will present a practical approach to implementation. Checklists and metrics are not enough Implementing security measures always requires a certain amount of preparation. A good deal of already fail at this first hurdle, because the exact knowledge of your own network and all the devices in it can vary depending on the counting method. Is a control or measuring device just a device or a full computer with operating systems? The classification determines many of the consequences when securing such devices. Correctly categorizing

Read More

0411, 2024

DeepSec 2024 Training: SAP Cyber Security 101 – Andreas Wiegenstein

Sanna/ November 4, 2024/ Conference, Training/ 0 comments

In many companies, we find that CISOs and security officers do not have any (in-depth) knowledge of SAP. Therefore the topic of SAP security often gets underestimated. Anyone interested in gaining insight into the important basics of SAP technologies can benefit from this highly compact crash course on SAP security. The session will give you an overview of security threats and ways to counter them. It is a sneak preview for a complete SAP security training. We asked Andreas a few more questions about his training. Please tell us the top 5 facts about your training. Delivers a general introduction to SAP technologies; no prior knowledge needed Provides a broad overview of SAP security features, mechanisms and architecture Discusses inherent SAP risks and weaknesses (no 0-Days !) Provides insights into typical SAP security challenges

Read More

0311, 2024

DeepSec 2024 Talk: Modern vs. 0ld Sk00l – Seth Law

Sanna/ November 3, 2024/ Conference/ 0 comments

The development landscape includes an ever-changing set of security practices. It has finally become standard practice to perform penetration testing, run threat modeling, teach developers about security, push left, and have zero trust. This shows the industry is better off today than in previous years. Or does it? Get a taste for the actual history of security and why everything old is new again. See security failures as they existed in years past and how they still exist in modern examples from the last year. Finally, explore the strategies that effectively catch these problems early in the development lifecycle without spending a fortune on security snake oil. We asked Seth a few more questions about his talk. Please tell us the top 5 facts about your talk. Modern vs. 0ld 5k00l is a comparison

Read More

3010, 2024

DeepSec 2024 Talk: The Tyrant’s Toolbox – Julian & Pavle B.

Sanna/ October 30, 2024/ Conference/ 0 comments

Social media, and our communications systems, have devoured any semblance of privacy, putting the eyes and ears of authoritarian and wannabe fascist types into the pockets of each of us; radically erasing whatever distance once existed between those who exercise authority and the human objects of their control, both at home and abroad. As Professor Ronald J. Deibert, founder of Citizen Lab, eloquently highlights in his book “Reset: Reclaiming the Internet for Civil Society”: “…recent years have brought about a disturbing descent into authoritarianism, fueled by and in turn driving income inequality in grotesque proportions the rise of a kind of transnational gangster economy.” As we continue our descent into a global madness fueled by AI, spyware, algorithms, and misinformation, tyrants around the world continue to expand their toolbox. Through our talk, we examine

Read More

2110, 2024

DeepSec 2024 Talk: AI’s New Era: Impacts on Health Data Security and Beyond – Sina Yazdanmehr & Lucian Ciobotaru

Sanna/ October 21, 2024/ Conference

It has become easier to create AI systems because of the availability of many options and datasets. These AIs can quickly gain expert knowledge in different domains, enabling attackers to exploit scientific knowledge and target system and data security, which was not workable before. Although recent studies have highlighted these impacts, a tangible example has been missing. For instance, attackers can use AI’s expert knowledge in the healthcare sector to perform complex attacks with no need of domain expertise. Earlier this year, Google launched Health Connect, an Android app designed to share data seamlessly between medical and fitness apps, intended to replace Google Fit. While Health Connect is robust against conventional cyberattacks, it is susceptible to these emerging threats. In this talk, we will show an example of these threats by explaining a malicious

Read More

1710, 2024

DeepSec 2024 Talk: Windows Defender Internals – Baptiste David

Sanna/ October 17, 2024/ Conference

Microsoft Defender Antivirus (aka Windows Defender) is an antivirus deployed worldwide and used by default on every Windows out-of-the-box. We all use it but who knows exactly how it really works? What is inside this software trusted by many people and companies across the world? This talk is the first one providing such a view about Windows Defender internals, from kernel mode to user-mode, based on extensive reverse engineering research work. With the recent world-wide BSOD of CrowdStrike antivirus, it matters to understand how an antivirus work, what it really monitors, and how some designs are prone to error or security issues. During this talk, we see that such a highly privileged software is just another Deus Ex Machina, not only for regular malware analysis but also for many security features on Windows. This

Read More