2309, 2013

DeepSec 2013 Workshop: Secure your Business by Business Continuity Plans

René Pfeiffer/ September 23, 2013/ Conference, Training

Quite a lot of companies stay in business, because they operate continuously and reliably. Few have the luxury to close shop for an extended period of time. If you do, then you are either fabulously successful or in deep trouble. Regardless of what you have in mind for your enterprise you should think of implementing a business continuity plan (BCP) sooner or later. Since designing and implementing a BCP is no piece of cake, we offer you a one day training at DeepSec 2013 where you can get started. The workshop will be conducted by Michel Wolodimiroff, who has over 25 years of experience in dealing with information technology. He will walk you through all bad dreams  of failing infrastructure, data loss, compromised systems, and worse catastrophes you might not even have thought of.

Read More

2209, 2013

DeepSec 2013 Schedule is Final!

René Pfeiffer/ September 22, 2013/ Administrivia, Conference, Schedule

The schedule for DeepSec 2013 is final. We had to rearrange some talks, because not all of the speakers we selected confirmed their appearance (that’s real life interference; we hope to see them at some future DeepSec events). The topics look great! We hope you get as much restless nights worrying about your data and infrastructure as we do! ☺ The workshop line-up is especially impressive. It now features 9 trainings in total. Two of the trainings are one day courses, so it might be easier to convince your workload to squeeze some lectures by experts into your busy schedule. This year’s workshops allow you to learn about attacking GSM networks (and thus their clients!), web applications (and their clients too), people (don’t pick up the phone!), IDS/IPS systems (we bet you never saw

Read More

2109, 2013

DeepSec 2013 Talk: Europe In The Carna Botnet – Telnet’s Threat To The Largest Economy

René Pfeiffer/ September 21, 2013/ Conference, Security

Botnets have been around since 1999. These herds of networked and compromised systems (called zombies) are the tool of the trade for many groups. It’s the  zombie outbreak of the information age. The analysis of existing botnets is an important task of security researchers around the globe. The study of the malware involved, the infection process and the inter-node communication of the infected systems is crucial for the dismantling of the botnet. Therefore we are happy to present Parth Shukla’s talk on the Carna botnet. It was created by an anonymous hacker to create a census of the (IPv4) Internet. Parth has been analysing the devices that formed part of the Carna Botnet. The data concerning the devices was provided by the anonymous researcher. He has distributed the relevant data to many CERTs and

Read More

2009, 2013

DeepSec 2013 Talk: Static Data Leak Prevention In SAP – The Next Generation Of Data Loss Prevention

René Pfeiffer/ September 20, 2013/ Conference, Security

Once you use information technology you will have to worry about leaks. Applications can leak data when attached to the network (any network!). That’s no breaking news, but it might be bad news for you and your data. Fortunately there are good news, too. There is a talk by Andreas Wiegenstein about ways of data leak/loss prevention (DLP) and a new methodology which might help your organisation: In the age of digital industrial espionage, protecting intellectual property has become a key topic in every company. In the past, companies addressed data leaks by implementing so called content-aware Data Loss/Data Leak Prevention (DLP) software. Such software analyzes data moving through an IT landscape and reports unauthorized transfer of critical data, i.e. transfers beyond the company’s network borders. The key purpose of this methodology is to

Read More

1609, 2013

DeepSec 2013 Talk: Top 10 Security Mistakes In Software

René Pfeiffer/ September 16, 2013/ Conference, Security

Software Development and information security are tightly tied together. A bug attracts vulnerabilities and bugs and vulnerabilities combined can be turned into exploits to compromise systems. In an ideal world security starts at the design or development stage. While you probably will never be able to completely eliminate bugs in (your) code due to the complexity of modern applications and their dependencies, you still can improve the security record by paying attention. So where do you get started? What are the most common mistakes made during the software development process that leads to security problems in the finished product? Peter af Geijerstam will address the top 10 security mistakes in his talk at DeepSec 2013. Mistakes during software development do not always have to be caught at the quality assurance stage. You can catch

Read More

1509, 2013

Crypto Wars by Black Boxes and Standards

René Pfeiffer/ September 15, 2013/ High Entropy, Security

Intelligence services go after cryptography. That’s the news you have probably read in the past weeks. That’s no surprise. They have been doing this for centuries. If your job is to intercept and analyse communication, then cryptography gets in your way (provided the target uses it properly). Intelligence services have been dealing with creating and breaking ciphers since their existence. How do you break cryptography? What can you do to attack encrypted communication? There are multiple ways to obtain messages in clear text. Attack the encrypted data! This is widely known as cryptanalysis. Basically you intercept the encrypted message and try to deduce the plain text. Given sufficient failures in the history of cipher designs, this is pretty hard with most modern ciphers. Algorithms used today are developed and tested to withstand attacks like

Read More

1209, 2013

DeepINTEL 2013 – Thank you!

René Pfeiffer/ September 12, 2013/ Conference, Security Intelligence

The second DeepINTEL conference ended two days ago. We had great talks and met wonderful people sharing insights and exchanging thoughts about how to cope with information security. Our thanks go to everyone attending DeepINTEL 2013! In case you missed this year’s opportunity, there will be a DeepINTEL 2014 conference. Its date will be announced at DeepSec 2013. If you have content for DeepINTEL 2014, please get in touch with us as soon as possible!

3108, 2013

DeepSec 2013 Schedule published

René Pfeiffer/ August 31, 2013/ Administrivia, Conference

The pretty final schedule of DeepSec 2013 has been published. It took us some time, because we received a lot of submissions! Every speaker has confirmed. Let’s hope we don’t run into late cancellations. We hope you will get your share of entertainment and scare out of the selected content. As in the years before we will publish a blog article about every workshop and every talk in order to give you a better insight what every speaker intends to address (we started with the first one already). Abstracts are fine, context is better. We will also point out links to related fields provided that possible leaked content doesn’t destroy our publication schedule 😉 In case you haven’t booked yet, the early bird tariffs are still valid. Get your DeepSec tickets while they are

Read More

3008, 2013

DeepSec 2013 Talk: Automation in Android & iOS Application Security Review

René Pfeiffer/ August 30, 2013/ Conference, Security

Even if you do not want to follow the Bring Your Own Device (BYOD) hype you might have to deal with mobile operating systems and applications running on them. Once you have a need to deploy a system, you need to know how to review the security. Hemil Shah will explain in his talk how you can deal with this problem. Mobile application hacking and its security is becoming a major concern in today’s world – especially with BYOD and user’s jailbreaking/rooting their devices. In the last few years we have seen a range of new attack vectors and methods of exploitation for these devices. Mobile applications are vulnerable to various sets of different attacks like local storage, user data harvesting, activity spying, unauthorized event injection, UI jacking, tab jacking, traffic redirection, logical attacks,

Read More

3008, 2013

DeepINTEL Schedule Update: New Talk – “Advanced Security through Network Intelligence”

René Pfeiffer/ August 30, 2013/ Administrivia, Conference, Security Intelligence

Due to personal reasons one of our DeepINTEL speakers had to unfortunately cancel his appearance. Therefore we present a new talk held by Caroline Krohn. The title is “Advanced Security through Network Intelligence”. „Network Intelligence“ is the sum of findings extracted from people’s activities in the internet. Information related to people can be either, restricted and protected by any kind of encryption, or public and available to everybody. Nowadays, it is almost sufficient to collect data from open sources to put together a precise profile on a person of interest. Transparency does not only occur through own postings on so-called social networks, such as Facebook, Xing, LinkedIn, Twitter. Third party mentions and pictures other people post and tag, etc. also help following people’s activities outside the internet. Even the decision not to appear on

Read More

1108, 2013

DeepINTEL 2013 – New Talk: “Hackers NG” – Dealing with the Security Skills Shortage

René Pfeiffer/ August 11, 2013/ Conference, Security Intelligence

Cooling temperatures in Vienna bring new talks to DeepINTEL. We are proud to announce a talk by Colin McLean, lecturer in Computing at the University of Abertay Dundee in Scotland. He discussed the problem of finding hackers with security skills (and who probably do not possess the attributes Mr Hayden sees in his own IT staff). The abstract reads as follows: There is a cyber security skills shortage and it’s becoming a world-wide concern with many stakeholders warning of impending doom. Browsing the Internet shows that this concern is not only expressed from the USA, and the UK, but all over the world. Mark Weatherford of the US Department of Homeland Security has stated “The lack of people with cyber security skills requires urgent attention. The DoHS can’t find enough people to hire.”. The

Read More

0508, 2013

DeepINTEL 2013 – New Talk „Mutually Assured Pwnage“

René Pfeiffer/ August 5, 2013/ Conference, Security Intelligence

We have added a new talk to the DeepINTEL 2013 schedule. Karin Kosina will talk about „Mutually Assured Pwnage“ and critically explore what Cold War analogies can and cannot teach us about war in the 5th domain. “Cyberwar” has become a thing (never mind that no-one seems to really know what that thing really is). Along with the militarisation of cyberspace – or “the fifth domain of warfare” – there has been a flurry of attempts to draw analogies to other models of conflict. While this is understandable to a certain extent – What worked in the past may work again in the future, right? And let’s not be so cynical here to speak about hammers and things that look like nails… –, it has in many cases only added to the confusion around an already confused

Read More

1907, 2013

Reminder: DeepSec – the Book: Call for Papers

Sanna/ July 19, 2013/ Administrivia, Call for Papers

Dear DeepSec speakers, this reminder goes out to you! We will publish a book about past and present DeepSec topics – To make this book a bummer we need your help! The book will be a summary, a factual overview on what’s been going on at our annual event, from 2008 – 2012, a collection of the most compelling talks and captivating topics we’ve featured at our conference so far. We want you to send us the abstracts of the talk you held at DeepSec – and we ask you to open up your topic once again. What’s been going on in the very special field you held your talk about? Have there been some new developments? Is your talk still up to date or does it seem kind of antiquated to you? If

Read More

1707, 2013

Musings about PRISM and the Like, or an Appeal to Reasoning

Mika/ July 17, 2013/ Discussion, Mission Statement, Security Intelligence

Spying and Distrust are not new, Full Stop. We are old enough to have witnessed many large spying programs in “real time”, starting in the 90ies and continuing until now. Everybody spies on everybody else, everybody tries to use every resource available to gain any kind of intelligence useful for the very own benefit. Alliances, treaties and promises (or vows if you take it more seriously) only have secondary value when it’s about the own advantage. This is true for most aspects of our life, be it private, business or international political affairs. Spouses (sometimes) distrust each other. Business partners (sometimes) negotiate with most detailed contracts to leave as little room as possible to deviate from the expectations, trusting in legal frameworks, lawyers and neutral judges to enforce the expectations. In international affairs (sometimes)

Read More

1607, 2013

DeepINTEL 2013 – Preliminary Schedule

René Pfeiffer/ July 16, 2013/ Conference, Schedule, Security Intelligence

The preliminary schedule of the DeepINTEL conference is ready! We have selected the presentations carefully and tried to address in-depth threats to (y)our infrastructure and (y)our data. Here are the abstracts of the talks (in alphabetical order, according to the speakers name), that we are allowed to publish publicly: Compliance and Transparency of Cloud Features against Security Standards (Yury Chemerkin) Nowadays cloud vendors provide a solid integration, virtualization and optimization in many fields (for example medical, business, and education) for online services. Such services operate with sensitive data which attracts attackers. There are quite different security controls and metrics for every Cloud service provider. It is generally known that several industrial organizations are focused on keeping an appropriate security level by offering solutions to improve the transparency of Cloud security controls among different vendors.

Read More