1611, 2024

DeepSec 2024 Talk: Executive Breach Simulation Toolkits – Pavle Bozalo, Aron Feuer & Matias Ulloa

Sanna/ November 16, 2024/ Conference/ 0 comments

As cyberattacks multiply and become more sophisticated, executive breach simulation toolkits have become essential. Enabling organizations to simulate, predict, and assess the impact of potential security breaches from an executive perspective is necessary to know how to keep organizations safe. Unfortunately, simulations are broken. Simply put, they don’t properly prepare leaders and security practitioners for security breaches. This talk will look at the evolving landscape of breach simulation toolkits designed for security practitioners, focusing on their role in enhancing cybersecurity strategies, incident preparedness, and organizational resilience. We will see how simulations can be engaging, while remaining instructive and preparing people for actual cyber events. We’ll discuss how these toolkits work, why they’re essential for making smarter business decisions around cybersecurity, and how they help align leadership with technical teams. Real-world examples will show how

Read More

1511, 2024

DeepSec 2024 Talk: The Malicious Bloodline Inheritance: Dissecting Deed RAT and Blood Alchemy – You Nakatsuru, Kiyotaka Tamada & Suguru Ishimaru

Sanna/ November 15, 2024/ Conference/ 0 comments

ShadowPad is a particularly notorious malware family used in Advanced Persistent Threat (APT) campaigns since 2017. ShadowPad use spread to various groups beginning in 2019, and a ShadowPad builder was disclosed in June 2024. One reason ShadowPad has garnered so much attention from security researchers is that it is an advanced modular type fileless RAT with a complex structure that is difficult to analyze. In July 2023, Deed RAT was published by Positive Security as a variant of ShadowPad. Furthermore, Blood Alchemy malware was also discovered as another variant of Deed RAT in April by ICI, with evidence such as unique data structures, malware configurations, loading schemes, and code similarities. However, important features of both Deed RAT and Blood Alchemy, such as the C2 communication scheme, loading additional modules, and details of backdoor commands,

Read More

0311, 2024

DeepSec 2024 Talk: Modern vs. 0ld Sk00l – Seth Law

Sanna/ November 3, 2024/ Conference/ 0 comments

The development landscape includes an ever-changing set of security practices. It has finally become standard practice to perform penetration testing, run threat modeling, teach developers about security, push left, and have zero trust. This shows the industry is better off today than in previous years. Or does it? Get a taste for the actual history of security and why everything old is new again. See security failures as they existed in years past and how they still exist in modern examples from the last year. Finally, explore the strategies that effectively catch these problems early in the development lifecycle without spending a fortune on security snake oil. We asked Seth a few more questions about his talk. Please tell us the top 5 facts about your talk. Modern vs. 0ld 5k00l is a comparison

Read More

3010, 2024

DeepSec 2024 Talk: The Tyrant’s Toolbox – Julian & Pavle B.

Sanna/ October 30, 2024/ Conference/ 0 comments

Social media, and our communications systems, have devoured any semblance of privacy, putting the eyes and ears of authoritarian and wannabe fascist types into the pockets of each of us; radically erasing whatever distance once existed between those who exercise authority and the human objects of their control, both at home and abroad. As Professor Ronald J. Deibert, founder of Citizen Lab, eloquently highlights in his book “Reset: Reclaiming the Internet for Civil Society”: “…recent years have brought about a disturbing descent into authoritarianism, fueled by and in turn driving income inequality in grotesque proportions the rise of a kind of transnational gangster economy.” As we continue our descent into a global madness fueled by AI, spyware, algorithms, and misinformation, tyrants around the world continue to expand their toolbox. Through our talk, we examine

Read More

2110, 2024

DeepSec 2024 Talk: AI’s New Era: Impacts on Health Data Security and Beyond – Sina Yazdanmehr & Lucian Ciobotaru

Sanna/ October 21, 2024/ Conference/ 0 comments

It has become easier to create AI systems because of the availability of many options and datasets. These AIs can quickly gain expert knowledge in different domains, enabling attackers to exploit scientific knowledge and target system and data security, which was not workable before. Although recent studies have highlighted these impacts, a tangible example has been missing. For instance, attackers can use AI’s expert knowledge in the healthcare sector to perform complex attacks with no need of domain expertise. Earlier this year, Google launched Health Connect, an Android app designed to share data seamlessly between medical and fitness apps, intended to replace Google Fit. While Health Connect is robust against conventional cyberattacks, it is susceptible to these emerging threats. In this talk, we will show an example of these threats by explaining a malicious

Read More

1710, 2024

DeepSec 2024 Talk: Windows Defender Internals – Baptiste David

Sanna/ October 17, 2024/ Conference/ 0 comments

Microsoft Defender Antivirus (aka Windows Defender) is an antivirus deployed worldwide and used by default on every Windows out-of-the-box. We all use it but who knows exactly how it really works? What is inside this software trusted by many people and companies across the world? This talk is the first one providing such a view about Windows Defender internals, from kernel mode to user-mode, based on extensive reverse engineering research work. With the recent world-wide BSOD of CrowdStrike antivirus, it matters to understand how an antivirus work, what it really monitors, and how some designs are prone to error or security issues. During this talk, we see that such a highly privileged software is just another Deus Ex Machina, not only for regular malware analysis but also for many security features on Windows. This

Read More

1610, 2024

DeepSec 2024 Talk: Insights on Client-Side Scanning and Alternatives in the Fight Against Child Sexual Abuse and Exploitation – Carolyn Guthoff

Sanna/ October 16, 2024/ Conference/ 0 comments

Content Warning: This talk may include mention of child sexual abuse and exploitation. In this talk, we want to summarize our research into Client-Side Scanning (CSS) and follow-up work on safety in end-to-end encrypted messaging concerning sexual risks. Client-Side Scanning (CSS) is discussed as a potential solution to contain the dissemination of child sexual abuse material (CSAM). A significant challenge associated with this debate is that stakeholders have different interpretations of the capabilities and frontiers of the concept and its varying implementations. In the current work, we explore stakeholders’ understandings of the technology and the expectations and potential implications in the context of CSAM by conducting and analyzing 28 semi-structured interviews with a diverse sample of experts. We identified mental models of CSS and the expected challenges. Our results show the CSS is often

Read More

1010, 2024

DeepSec 2024 Talk: Detecting Phishing using Visual Similarity – Josh Pyorre

Sanna/ October 10, 2024/ Conference/ 0 comments

Current phishing detection methods include analyzing URL reputation and patterns, hosting infrastructure, and file signatures. However, these approaches may not always detect phishing pages that mimic the look and feel of previously observed attacks. This talk explores an approach to detecting similar phishing pages by creating a corpus of visual fingerprints from known malicious sites. By taking screenshots, calculating hash values, and storing metadata, a reference library can compare against newly crawled suspicious URLs. By combining fuzzy searches and OCR techniques with other methods, we can identify similar matches. We asked Josh a few more questions about his talk. Please tell us the top 5 facts about your talk. In security, URL block lists are widely used, but I rarely see people utilizing a database of visual information to hunt for phishing attacks that

Read More

0910, 2024

DeepSec 2024 Talk: Cheating Detection in Chess using Neural Network – Zura Kevanishvili

Sanna/ October 9, 2024/ Conference/ 0 comments

During the talk, I will address the escalating issue of cheating in online chess, underscored by recent incidents like Hans Niemann’s case, highlighting the urgent need for effective solutions to maintain fair play and uphold competitive integrity. I will present our innovative approach to detecting AI assistance in chess, using advanced neural networks. Our research involves a comprehensive analysis of extensive chess game data, encompassing moves from established engines like Stockfish to innovative neural networks such as Maia, Maia individual and its components. Key aspects of our methodology include: Centipawn Deviations: Evaluating deviations from typical computer strategies to identify moves influenced by AI. Human-like Play Recognition: Utilizing Maia’s and Maia Individual’s capability to discern human-specific playing styles, enhancing our ability to distinguish genuine human play from computer-assisted moves. Move Time Distribution: Analyzing patterns in

Read More

0710, 2024

DeepSec 2024 Talk: Differences in Focus on Cybersecurity in Smart Home Devices between Research and Practice – Dr. Edith Huber & Dipl. Ing. Albert Treytl

Sanna/ October 7, 2024/ Conference/ 0 comments

This meta-study of scientific security journals and a user survey examines the most common cybersecurity threats and solutions for smart home devices. But do the researched topics correspond to the security threats encountered in practice? This talk will explore the tension between research interests and practical applications, and present opportunities for improving the cybersecurity of smart home devices. We asked Edith and Albert a few more questions about their talk. Please tell us the top facts about your talk. The role of cybercrime in smart home devices. How vulnerable are we? Cyber security options in this context. The difference between research and practice in smart home devices. How did you come up with it? Was there something like an initial spark that set your mind on creating this talk? These aspects were investigated as

Read More

0410, 2024

DeepSec 2024 Talk: AI Based Attack on Post Quantum Standard “CRYSTALS Kyber” – Maksim Iavich

Sanna/ October 4, 2024/ Conference/ 0 comments

In recent years, the field of quantum computing has seen remarkable advancements, prompting concerns about the security of current public key cryptosystems in the development’s event of sufficiently powerful quantum computers. Kyber, a post-quantum encryption technique relying on lattice problem hardness, has recently been standardized. However, despite rigorous testing by the National Institute of Standards and Technology (NIST), recent investigations have revealed the efficacy of Crystals-Kyber attacks and their potential impact in real-world scenarios. Following the publication of the paper “Breaking a Fifth-Order Masked Implementation of CRYSTALS-Kyber by Artificial Intelligence” discussions have emerged regarding the vulnerability of the post-quantum crypto system Kyber. The authors propose a side-channel attack leveraging artificial intelligence, specifically employing a neural network training method known as recursive learning to compromise the system. Our study explores CRYSTALS-Kyber’s susceptibility to side-channel attacks.

Read More

2709, 2024

DeepSec 2024 Talk: Remotely Snooping on Traffic Patterns using Network Protocols – Kirils Solovjovs

Sanna/ September 27, 2024/ Conference/ 0 comments

The presentation features novel research on using different protocols to remotely measure network load and deduce network traffic patterns of a target using ICMP and other widely adopted protocols. The attack allows to distinguish between file upload, file download, video streaming, VoIP, web browsing, etc. depending on network conditions. This attack works even when done from a different AS. We asked Kirils a few more questions about his talk. Please tell us the top facts about your talk. There is predictable correlation between Bandwidth, Throughput, and Latency. It is possible to remotely measure the load (throughput over bandwidth) of a network endpoint. Measured traffic patterns can be used to deduce the type of traffic at the remote network endpoint. The internet is a series of tubes. How did you come up with it? Was

Read More

2609, 2024

DeepSec 2024 Talk: V2GEvil: Ghost in the Wires – Pavel Khunt & Thomas Sermpinis

Sanna/ September 26, 2024/ Conference/ 0 comments

This research is dedicated to enhancing the cybersecurity of electric vehicles, focusing specifically on identifying vulnerabilities in the Electric Vehicle Communication Controller (EVCC). This controller facilitates communication with the Supply Equipment Communication Controller during the charging process. Accessible through the On-Board Charging (OBC) port, which is as publicly available as the gas tank in combustion engine vehicles. The research journey began by studying the electric vehicle charging ports, how they communicate, and the standards they follow, especially focusing on ISO 15118. Then, we closely looked at how On-Board Charging (OBC) works, especially its communication protocols during charging, focusing specially on the High-Level Communication (HLC). Our research efforts resulted in the development of a dedicated security tool. This tool examines and assesses the implementation of the EVCC (Electric Vehicle Communication Controller). It can simulate the

Read More

2509, 2024

DeepSec Talk 2024: RAT Builders – How to Catch Them All – Stephan Berger

Sanna/ September 25, 2024/ Conference/ 0 comments

Cybercriminals now have unprecedented ease in creating their own remote access trojans (RATs), thanks to a plethora of open-source or leaked builders. One can generate a new binary with just a click of a button. We meticulously examine different builders, such as AgentTesla, DCRat, Nanocore, and others, to extract Indicators of Compromise. These indicators serve as valuable instruments for targeted hunting to detect infections within our networks. Building up on my research from last year, “N-IOC’s to rule them all”, we will analyze the binaries the same way, but this time with a focus on open-source builders for RATs. Initially, we scrutinize the distribution channels of different Trojans, pinpointing where individual builders are accessible for download. These sources range from GitHub, hosted as open-source projects, to other online platforms (such as VX-Underground). Subsequently, we

Read More

2309, 2024

DeepSec 2024 Talk: From Dungeon Crawling to Cyber Defense Drill: Using RPG Principles and LLM for Operational Team Dev – Aurélien Denis & Charles Garang

Sanna/ September 23, 2024/ Conference/ 0 comments

Continuous improvement/training is in the DNA of cybersecurity professionals, specifically for incident responders, which are always searching for new ways to learn and practice their technical and analytical crafts. This is even more the case in mature environments where Incident response teams may find themselves in a situation with few high stakes incidents, preventing them from applying their technical and thinking skills, thus lowering their readiness when a crisis occur. LLMs based conversational agents are becoming mainstream, and applications are countless. In the meantime, Tabletop Role-Playing Games (TTRPG) are found to be a great breeding ground for creativity and fun. To achieve the benefits of this game, preparation is needed and a game master must be present to keep the players engaged. So we leveraged the power of AI, mixed automation and past experiences

Read More