1311, 2013

DeepSec 2013 Talk: Building The First Android IDS On Network Level

René Pfeiffer/ November 13, 2013/ Conference, Development, Security

Being popular is not always a good thing and here’s why: As mobile devices grow in popularity, so do the incentives for attackers. Mobile malware and threats are clearly on the rise, as attackers experiment with new business models by targeting mobile phones. The threat to mobile devices, however, is not limited to rogue versions of popular apps and adware. Threat actors are also pouncing on mobile users’ banking transactions. Android continues to be a primary target for malware attacks due to its market share and open source architecture. Nowadays, several behaviour-based malware analysis and detection techniques for mobile threats have been proposed for mobile devices but only about 30 percent of all Android smart phones and tablets have security apps installed. At DeepSec 2013 Jaime Sanchez (@segofensiva) will present AndroIDS, a signature-based intrusion

1311, 2013

DeepSec 2013 Talk: Malware Datamining And Attribution

René Pfeiffer/ November 13, 2013/ Conference, Security

The production of code leaves traces in the final binary. There can be debugging symbols present, which give you a lot of information. Maybe the binary has some commonly used libraries or functions. A lot of fingerprinting can be done with software. Why is this of interest? Well, there is the attribution problem of attacks and malicious software. Identifying where malware comes from can be crucial for the assessment of risks and the impact of compromised systems. Michael Boman has researched this topic and will present his findings in his talk titled Malware Datamining And Attribution at DeepSec 2013. Stuxnet and related malware is a prime example where the source of the code is of fundamental interest. Even for more „mundane“ code malware authors use leaves traces in their work which can be used

1211, 2013

DeepSec 2013 Talk: My Name Is Hunter, Ponmocup Hunter

René Pfeiffer/ November 12, 2013/ Conference, Security

Defending one’s own resources against malicious software is daily business for information security professionals. Usually you deploy a range of measures and try to minimise the risk. It may or may not work, depending if you have to fear the mysterious Advanced Persistent Threat (APT). APTs are highly targeted, very stealthy and can greatly impact your security in terms of damage and level of compromise. Their stealth aspect makes them hard to detect and hard to counter. Tom Ueltschi from the Swiss Post has gained experience with these kind of attacks. This is why he will share his insights at DeepSec 2013. His talk is titled My Name Is Hunter, Ponmocup Hunter. Ponmocup is a strain of malicious software which forms its own botnet. It is known by a couple of names, depending on

1111, 2013

DeepSec 2013 Talk: Cultural Learning Of China To Make Benefit Glorious Profession Of Infosec

René Pfeiffer/ November 11, 2013/ Communication, Conference, Security Intelligence

If something happens in your network, it’s an established custom to blame it on China. This approach is tried and true among the Chief Information Officers (CIOs) who have some explaining to do. Throw in the inevitable Advanced Persistent Threat (APT) and you are set. No more explanations necessary. Why is that? Well, most people don’t know, therefore Wim Remes of IOactive will give you a thorough overview in his talk titled Cultural Learning Of China To Make Benefit Glorious Profession Of InfoSec. Geopolitics is a good start. The current debate about the role of China as a nation, in international hacking incidents and corporate espionage is framed in an almost exclusively US-centric narrative. Using your adversaries as scapegoat works well, provided you talk to like-minded people and nations. China, however, is a nation

1011, 2013

DeepSec 2013 Talk (U21): The Dark Side of the Internet

René Pfeiffer/ November 10, 2013/ Conference, Internet

You may have heard of background radiation. It’s the kind of ionizing radiation you are exposed when wandering around on this planet. The sources are radioactive isotopes in the air, the soil, our food, and the water. In addition there is cosmic radiation from outer space. So even without artificial radiation sources you will have a natural background radiation. The Internet has a similar phenomenon. The pendant of the fundamental particle in Nature is the packet. Internet traffic consists of data packets going from their source to a target address. Imagine a part of the Internet which isn’t used at all. Its address space isn’t advertised anywhere. It holds no services and no active hosts. This place is called Darknet. In theory there will be no packets. In practice there are. A student from

0911, 2013

DeepSec 2013 Talk: CSRFT – A Cross Site Request Forgeries Toolkit

René Pfeiffer/ November 9, 2013/ Conference, Security

Cross Site Request Forgery (CSRF) is a real threat to web users and their sessions. To quote from the OWASP web site: „CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated.“ Combined with social engineering this is a very effective attack tool. Believe it or not, web sites prone to CSRF are very common. If your web developers do not know what „unique web form“ means, you will have to deal with CSRFs eventually. Paul Amar is a student of computer science, and at DeepSec 2013 he will present a framework to study and prototype CSRF interaction with web servers. The tool presented is the Cross Site Request Forgeries Toolkit (CSRFT). It has been developed in Python and Node.JS. The

0811, 2013

DeepSec 2013 Talk: Mobile Fail: Cracking Open “Secure” Android Containers

René Pfeiffer/ November 8, 2013/ Conference, Security

Over the last few years the desire to have information at our fingertips whenever and wherever we want has driven us more and more towards mobile devices. The convenience of having our email, files and access codes available to us on our smartphones or tablets has given rise to a new problem… that of securing our sensitive data on an inherently insecure device. The same form factor that makes smart phones the easy choice for remote access to email and services also makes them easy to lose. In response, we’ve begun to move security closer to the data, relying on “secure” container applications to keep our private and company data secure. Mobile apps such as LastPass, Dropbox, Evernote, GOOD for Enterprise, and may others all offer differing degrees of security. In this presentation Chris

0711, 2013

DeepSec 2013 Talk: Future Banking And Financial Attacks

René Pfeiffer/ November 7, 2013/ Conference, Security

Hey, you! Want to know a secret? Your adversaries are after money. Taken the „cyber shoot-outs“ of governments aside, no sophisticated attack happens without economical benefits. Attackers don’t care where the money comes from. However they care for efficiency. They do not compromise web server after web server to hope for some loot which can be turned into profit. Instead they go after the places where people store and move their money. Financial institutions have been battling attacks against their customers and their infrastructure since their services entered the Internet. It’s an arms race, and if you are involved you need to keep up. We are proud to have Konstantinos Karagiannis at DeepSec 2013 talking about the future of banking and financial attacks. Advanced User Enumeration and DDoS Every attack needs a proper target.

0611, 2013

DeepSec 2013 Talk: Risk Assessment For External Vendors

René Pfeiffer/ November 6, 2013/ Conference, Security, Stories

No man is an island. If this is true for every single one of us, then it is also true for companies. Modern enterprises have business to business (B2B) relations. They are at the centre of a network of suppliers and other vendors. Information flows between the players since they need to exchange data. What do you do if you deal with confidential or regulated data which mustn’t flow freely? How do you assess the risks? How do you determine what security measures work best? How do you deal with the situation of not enforcing security because every player runs its own policies? Luciano Ferrari has prepared a presentation for you and talks about his experience. The first issue is physical proximity. Once you are linked with business entities several thousands of miles away

0511, 2013

No more Early Birds! No Regular! Get your DeepSec 2013 tickets now!

René Pfeiffer/ November 5, 2013/ Administrivia, Conference

If you like to attend DeepSec 2013, here’s your last chance. Space is getting crowded and the ticket sale enters the last minute tariff! For everyone interested in booking tickets for the workshops, now is the time! Don’t wait for others to fill your seat. You have been warned. In case you are still deciding, as always DeepSec will feature 0talks with tricks, code, vulnerabilities not seen before in public. Give yourself a premature Christmas treat, enjoy the conference, and leave for home with a dozen of 1337 presents information-wise. Totally beats the stuff Santa and the elves will bring you weeks later. We are looking forward to see you all at DeepSec 2013!

0411, 2013

DeepSec 2013 Talk: Auditing Virtual Appliances – An Untapped Source Of 0-days

René Pfeiffer/ November 4, 2013/ Conference, Security

System administrators and information security researcher often have to deal with appliances. Almost every organisation and company has a couple of magical black boxes sitting around. Usually they are connected to the network, and they do important stuff (such as filtering things, checking content, and the like). In the old days testing these appliances for their security record was hard. You had to open it, do a lot of tedious reverse engineering in order to understand how it works, and then conduct your tests to do your analysis. Fortunately the future is here, and so is a new form factor: virtual appliances! At DeepSec 2013 Stefan Viehböck of SEC Consult will talk about the advantages of having a virtual appliance to deconstruct. Virtual appliances aren’t very different from their embedded cousins, judged from the

0211, 2013

DeepSec 2013 Talk: Hack The Gibson – Exploiting Supercomputers

René Pfeiffer/ November 2, 2013/ Conference

Compromising and controlling a large number of computers is a big advantage for attackers. The best example are the botnets consisting of hundreds, thousands or millions of systems infected by malicious software. These herds of compromised nodes receive commands from Command & Control (C&C) servers. In a sense this is massive parallel computing, but unfortunately it isn’t used for scientific purposes. Instead these nodes send unsolicited e-mails (a.k.a. spam), perform Distributed Denial of Service (DDoS) attacks, or do other tasks for their masters. The infection process is highly automated. Scripts looks for promising targets, attack them, install the botnet software, and add them to the herd’s network. Great. But what about infecting whole networks of nodes instead of nodes one by one? Modern supercomputers are based on a multi-node architecture. Individual nodes are part

0111, 2013

DeepSec 2013 Talk: Prism Break – The Value Of Online Identities

René Pfeiffer/ November 1, 2013/ Conference, Internet

We all have identities. We use them on a daily basis in our off-line world. Colleagues greet us at work, because they know who we are. Of course our family members know who we are. When it comes to the digital life-style our identity becomes a lot more complex and diverse. Web shops know what we like and suggest products we do not yet have. Social media sites suggest contacts that might match our interest (as do dating web sites). Frequently used search terms are processed to refine the results our favourite search engine presents us. Customisation and targeting is the key. Everything you do and communicate is processed like ore and the Big Data server farms refine your daily trails through the Internet and produce your online identity – which is a good

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this: