Opisi predavanj
- Hacking the Human Operating System - The role of social engineering within cybercrime, Raj Samani, McAfee EMEA
Understanding the psychology behind spear phishing based attacks. This presentation considers how cybercriminals are using subconscious levers into performing actions that lead to a breach. We will fully explore the concept of social engineering, what it is, how it works and the best methods to defend against it. - Lets go with Hidden Data Economy, Raj Samani, McAfee EMEA
What happens after data is stolen? This presentation considers the hidden marketplace for stolen information, this goes well beyond simply the theft of financial information. - Hack a country, Tadej Nared, David Petek, S|CEH - Slovenian certified ethical hackers
Prezentacija podaja odgovor na vprašanje, ali je možno, že z javno dosegljivimi podatki prepoznanih naprav v slovenskem omrežju, enostavno in hitro doseči zadostno kompromitirano infrastrukturno maso, ki jo lahko zlonamerni napadalci izrabijo za disruptivne ali subverzivne napade širših obsežnosti na kritične informacijske sisteme in omrežja, ter predvsem kakšna je slika, kadar se parametri raziskave iz javno dostopnih podatkov razširijo na običajne raziskovalne pristope.
V ta namen med drugim izvedemo neintruzivno iskanje, kjer s pomočjo prepoznavanja naprav na podlagi odzivov in vodenja baze pogostih routerjev hitro ugotovimo, kolikšen odstotek naprav uporablja privzete prijavne podatke in posledično prepušča prost dostop praktično katerikoli zlonamerni zasebni, korporativni ali tuji vladni entiteti. Ker preliminarne raziskave kažejo, da gre v praksi za visoko število naprav, slednje razkriva nacionalno ahilovo peto, predvsem v smislu, kaj bi tovrstni botneti pomenili za korporativno in nacionalno varnost.
Raziskava želi dokazati, da ščitenje informacijske infrastrukture deluje le, kadar slednjo ustrezno ščitijo tudi vsi "organski deli" organizacije, vključujoč in predvsem lastno / zasebno informacijsko varnost, zato je edini odgovor v celovitem smislu kontinuirano izobraževanje vseh zaposlenih. -
Obravnava varnostnih vidikov pri razvoju panevropske infrastrukture za izmenjavo podatkov med službami javne varnosti, Blaž Ivanc, Institut Jožef Stefan
Končni uporabniki infrastrukture za izmenjavo meritev, podatkov in informacij bodo organizacije s področja javne varnosti, ki se prve odzovejo ob varnostnih incidentih: policija, nujna medicinska pomoč, protiteroristične enote ipd. Med uporabniki še posebej prevladujejo potrebe po dostopu do podatkovnih baz, senzornih sistemov in kamer. Službe javne varnosti se pri svojem delu srečujejo s številnimi izzivi, ki zahtevajo ustrezne informacijske rešitve, ki neposredno vplivajo na rezultate odziva ob varnostnih incidentih. Predavanje bo osredotočeno na obravnavo varnostnih vidikov v okviru nastajajočih zmogljivosti, ki bodo v prihodnje na voljo službam javne varnosti v Evropski uniji. -
Fast and Transparent Online Banking Fraud Detection and Investigation, Federicco Maggi, Politecnico di Milano
The significant growth of online banking frauds, fueled by the underground economy of malware, raised the need for effective fraud analysis systems. In this talk I will present an innovative system for online banking fraud analysis, detection and investigation. Our system is able to "learn" easy-to-understand models from each customer's spending habits, based on past transactions. First, it quantifies the anomaly of each transaction with respect to the customer historical profile. Second, it finds global clusters of customers with similar spending habits. Third, it uses a temporal threshold system that measures the anomaly of the current spending pattern of each customer, with respect to his or her past spending behavior. With this threefold profiling approach, it mitigates the under-training due to the lack of historical data for building well-trained profiles, and the evolution of users' spending habits over time. At runtime, our system supports analysts by ranking new transactions that deviate from the learned profiles, with an output that has an easily understandable, immediate statistical meaning. Our evaluation on real data, based on fraud scenarios built in collaboration with domain experts that replicate typical, real-world attacks (e.g., credential stealing, banking trojan activity, and frauds repeated over time), shows that our approach correctly ranks complex frauds. Our system ranks frauds and anomalies with up to 98% detection rate and with a maximum daily computation time of 4 min. Given the good results, a leading Italian bank deployed our system in their environment to analyze frauds. -
Zaupanje - temelj socialnega inžiniringa, Franci Čeč, Aleš Germovšek, S|CEH - Slovenian certified ethical hackers
"Namen socialnega inženiringa je običajno pridobivanje določenih zaupnih informacij. Cilj drugega koraka življenjskega kroga se nanaša na razvijanje odnosa in pridobivanje zaupanja. Ljudje bolj zaupamo (tudi delimo informacije) tistemu, za katerega menimo, da je bolj zaupanja vreden. V prispevku bo poleg zaupanja na medosebni ravni, le-to postavljeno tudi v okvir organizacijskega delovanja in sledenju organizacijskim interesom, kar je v širši strokovni javnosti redkeje omenjeno. To pa pomeni upoštevanje zaupanja pri izgradnji sistema varovanja informacij, oblikovanju programa varnostnega izobraževanja in ne nazadnje, tudi pri pripravi smernic in priporočil za delo v vsakdanji praksi." - Obravnavani incidenti v 2015/16, Gorazd Božič, SI-CERT
SI-CERT že 20 let obravnava računalniške incidente v slovenskem prostoru. Kratek pregled bo pokazal nekaj zanimivih primerov, ki jih nismo prikazali v filmu #hekerji.si, pa so morda vseeno vredni omembe. Nato pa se bomo osredotočili na trenutno dogajanje. Namig: izsiljevanje, goljufi in poplava spama iz davčne blagajne. - USB armory - razvoj in uporaba, Andrej Rosano, Inverse Path
Predstavljen bo razvoj USB armoryja, od zamisli do uporabnih aplikacij. Opisano bo, kaj je bilo pri razvoju naučenega.Pri Inverse Pathu so v lanskem letu predstavili projekt USB armory. Gre za mini računalnik velikosti USB ključa, prednostno namenjen varnostnim aplikacijam.USB armory je Open Source hardware kompaktnih dimenzij in USB napajanjem. Nudi platformo za razvoj in zagon različnih aplikacij.Varnostne lastnosti sistema na čipu (SoC) in odprta koda hardwarja daje razvijalcem in uporabnikom na razpolago popolnoma prilagodljivo USB zaupno napravo namenjeno odprtim in inovativnim osebnim varnostnim aplikacijam. - It's not all about hacking, Jurica Čular, Croatian Government's CERT
Although we often think on cyber security as purely hacking activities, either offensive or defensive, there is much more in it. This lecture will give you retrospective on why it is important to have strategic thinking on a state level in terms of cyber security.What should be the most important parts of national cyber security strategy, how to implement it and what are the major challenges in starting a process on country-wide scale. - ABcD - "Automated Bug (cruised) Discovery", Miroslav Štampar, Croatian Goverment's CERT
Presenting prototype of heuristic, fast, open source and modular web browser plugin for "bug bounty" hunters and/or penetration testers which utilizes cross-browser userscripting (e.g. Greasemonkey). It automatically performs in-browser fast and non-intrusive web vulnerability checks against site(s) as you surf. In case of a positive match, data necessary for successful reproduction is stored for the later (mis)usage or passed to other penetration testing tools. In short: hack as you surf (or the other way around). - Digitalna forenzika pri preiskavah hekerskih napadov - izkušnje policije, Toni Kastelic, MNZ - Policija, Uprava kriminalistične policije
Digitalni dokazi in z njimi povezana digitalna forenzika postajata vse pomembnejša elementa v kazenskih postopkih ter preiskovanju in dokazovanju kaznivih dejanj. Slovenska policija že vrsto let intenzivno deluje na tem področju, tako v smislu rednega nabavljanja in posodabljanja opreme, nenehnega usposabljanja svojih kadrov, kot tudi uvajanja novih metod in praks v postopke digitalne forenzike. Pri izvajanju postopkov digitalne forenzike mora forenzik upoštevati več dejavnikov. Na prvem mestu je veljavna zakonodaja, zato mora digitalno forenziko izvajati v skladu z zakonodajnimi normami, kar je osnovni pogoj, da je digitalni dokaz v kazenskih postopkih pravno veljaven. Sledi poznavanje in upoštevanje mednarodno oblikovanih standardov in metod digitalne forenzike ter nenazadnje odlično poznavanje opreme (tako strojne in programske), ki jo uporablja in s katero se srečuje pri svojem delu. Le s sodobno opremljenostjo, usposobljenostjo in visokim strokovnim nivojem je delo na nenehno se razvijajočem področju digitalne forenzike lahko uspešno. - Mobile Application Security, Zsolt Nemeth, Camphora Consulting
Every mobile app has the potential to steal or leak sensitive and private company information. Risky app behaviors, hidden actions, and malicious malware code can all conspire to exfiltrate valuable information from employee mobile devices.Mr Nemeth will provide a glimpse into the most advanced app risk analysis technologies available for assessing and reporting the risks. - Kako smo TeslaCrypt videli na SI-CERT, Matej Breznik, SI-CERT
Doberšen del decembra smo preučevali izsiljevalsko kampanjo TeslaCrypt. Tokrat je šlo za razširjanje druge različice okužbe, kl uporabniku prek šifriranja onemogoči dostop do njegovih datotek. Predstavljeni bodo različni pristopi k reševanju podatkov ob okužbi, tudi nekateri, ki so specifični za tokratno različico okužbe. - An unexpected journey: From XSLT injection to a shell, Saša Jušić, Infigo IS d.o.o.
XSLT (Extensible Stylesheet Language Transformations) is a language that allows transformation of XML documents into various other document formats. Business applications often rely on XSLT to format reports which are subsequently rendered as PDF documents. Such applications also often need to allow a user certain amount of editing of XSL files, which get processed in order to render PDF documents. Malicious users can take advantage of powerful XSLT processing capabilities and perform various malicious activities.This presentation will demonstrate how complete control over a target server can be taken through simple modification of XSL files that are processed by the target (vulnerable) application. The presentation will conclude with demonstration of how OS commands can be executed through static Java classes called through an XSLT processor and how such vulnerabilities can be prevented. - Security in Smart Metering - Smart grid, Nenad Andrejević, Comtrade d.o.o.
Understanding security in Smart Metering and Smart Grid. Smart meters have got complex, and they are no longer a measurement instrument attached to a display.Instead they are made up of many components that include electronics and computers with all the same vulnerabilities that any other electronics or computers would have.This presentation explain how to consider security as one of the enablers for IoT. -
Napad na wps zaščito (praktična demonstracija), Peter Kavčič, FOV
Namen je predstaviti, kaj wps je, njegov namen uporabe, delovanje, ... Nato pa v teoriji in praksi predstaviti bruteforce in pixie dust napada (v živo). -
Fighting malicious code, Zubair Khan, Tranchulas
One of the biggest threats to day-to-day operations of any organization is malware. In this talk, we will discuss malware detection and analysis techniques in interesting ways. We describe how you can conduct investigations and demonstrate techniques for analyzing malicious activity. We will demonstrate how you can recover stolen data from your corporation by reverse engineering malware that encrypts data. -
The art of OSINT, Zubair Khan, Tranchulas
Open-source intelligence (OSINT) is intelligence collection technique that involves gathering information from publicly available sources and analyzing it to produce actionable intelligence. In today’s data driven age, information does not have to be secret to be valuable. We cover various aspects of OSINT in this talk including methodologies, tools and techniques to monitor social media for intelligence collection. -
ICT Forensics Investigation on IPv6 Attacks, Mane Piperevski, Piperevski&Associates
Vendors security features don’t cover IPv6 attacks detection and prevention in big way. We must know how to manually identify and investigate this type of attacks. In short we will cover basic methods that are very helpful in forensic investigation on IPv6 attacks. -
Metasploit – eno najbolj razvpitih orodij s področja računalniške varnosti, Brane Vasiljevič, Hic Salta d.o.o.
Metasploit je verjetno eno izmed najbolj uporabnih orodij v rokah varnostnih strokovnjakov. Vendar pa Metasploit ni samo zbirka ranljivosti, ki jih lahko uporabimo pri napadu na sisteme in aplikacije. Orodje vključuje celotno infrastrukturo, ki omogoča pridobivanje osnovnih informacij o omrežju, sistemih in aplikacijah, razvoj novih ranljivost, pripravo okolja za izvajanje naprednih oblik napadov, pridobivanje varnostno kritičnih informacij in podobno. Na predavanju bomo spoznali gradnike in osnovno delovanje, različne izvedbe orodja, povezovanje z drugimi aplikacijami ter spoznali velik nabor možnosti, ki jih orodje in njegovo okolje ponuja. -
Socialni inženiring – praktični primeri iz finančne industrije, Denis Novak, Detektivska agencija Vestigium d.o.o.
Pri predstavitvi socialnega inžiniringa bo predstavljen napad na računalniški sistem, kjer se napada najšibkejši člen: človek. Navedn bo prvi "zaznani" primer socialnega inžiniringa in še nekaj primerov, potem pa bo predstavljen konkreten primer brez imen in naročnikov. -
Fixing the fixing, Mitja Kolšek, Acros d.o.o.
Software vulnerabilities are likely the biggest problem of information security, fueling a rapidly growing market for “0days”, “1days” and exploits alike. It can be highly intellectually challenging to find a vulnerability and create an exploit for it, and super entertaining to reveal it all to the bug-hungry crowds (preferably along with a logo and a catchy name, courtesy of the marketing department). As a result, there’s been a lot of innovation and progress on the offensive side of information security, and a corresponding defensive industry is thriving providing quasi-solutions that can be bypassed by any motivated attacker.
But almost nothing has changed at the core of the problem: software vendors still produce critical vulnerabilities, aren’t motivated to provide patches, and only a handful of them are capable of responding and delivering a security update when a 0day gets published. And then, when a vendor’s security update is available, it takes weeks or months before it gets applied throughout a corporate network as the risk of interrupting business processes requires testing and gradual deployment. (And do we need to mention that exploit kits tend to add exploits just a few days after official patches come out?)
Now, what if vendors didn’t have a monopoly on patching their code because any vulnerability researcher could write a patch instead of (okay, in addition to) writing an exploit? And what if admins weren’t afraid to apply the patches because patches could be applied instantly without relaunching applications or restarting computer, and could also be instantly un-applied if they turned out to be causing problems? The technology for this exists (hint: 0patch.com), and will allow vulnerability researchers to not only research a vulnerability but also fix it with just a few well-chosen machine code instructions – and monetize their hard work in an unquestionably ethical way. It is time to fix the process of vulnerability fixing. -
Hekerski napadi na bankomate, Mitja Vreča, Printec d.o.o.
Bankomati so zaviti v tančico skrivnosti, saj interakcija s podaljški bančnih podružnic uporabniku ne kaže resnične globine. Pod površjem se namreč skriva zanimivo področje; preplet strojne in programske opreme in različne implementacije uporabniških zahtev ter stalnih sprememb na področju informacijske varnosti, EMV ter PCI standardov - pa tudi zahtev iz strani Visa in MasterCard.Predavanje je prekratko za kompleksno predstavitev prepleta vseh področij, vendar pa bo slušatelje popeljalo preko širokega nabora fizičnih napadov do najnovejših svetovnih trendov – napadov na programsko opremo ter mrežno infrastrukturo. -
Inženirski socialing – v2.01ir6 (LIVE) Grega Prešeren, S&T d.d.
Predstavljene bodo aktualne tehnike, ki se jih hekerji poslužujejo za uspešno izvedbo vdorov v informacijske sisteme. Gre za skupek tehnoloških in socialnih tehnik, ki hekerjem zagotavljajo kar največji uspeh in posledično zaslužek. Nekaj tehnik, ki jih uporabljamo, tako etični kot tudi zlonamerni hekerji, bomo pokazali in pojasnili v živo. Na praktičnih, manj kot eno leto starih primerih bodo predstavljena varnostna tveganja, s katerimi so se soočala anonimna podjetja, ter rešitve za zmanjšanje tovrstnih groženj. -
Security is Broken V2.0 (30min) (latest attacks and effective countermeasures) Jorge Sebastiao, CISSP
“Are you brining a knife to a gun fight? Over the last 5 years information security has been playing catch-up with the hackers. Increasingly sophisticated phishing scams expose users and corporations… Vulnerable code is everywhere: Mobiles, Mobile Apps, Cars, wearable’s, IoT Devices and SCADA and Payment systems… Can we cope?
The traditional systems of security awareness campaigns, code testing, patching or network signature based detection, firewall, IDS/IPS are no longer enough. The modern hackers are agile, creative, share information and develop new undetectable innovative attack methods. A fresh look at the new generation of potential defence mechanisms and their contribution to diminish the risk. How to use new methodologies, tools, and techniques that can be effective against these new attack vectors and enable us to defend effectively and quickly enough not to be too late…
On-Line
Ob prijavi na konferenco HEK.SI 2024, prejmete VIP VSTOPNICO za konferenco INFOSEK 2024!