BSides Tallinn 2024

A paired Bluetooth device is authorized to use any function specified in the agreed-upon Bluetooth profiles. A mouse utilizes the human interface device profile, similar to a keyboard. If you lose a paired wireless mouse, the finder can convert it into a keyboard that remains paired with your computer. In this hands-on workshop, you will extract the encryption key from a physical Bluetooth mouse and use it to emulate a keyboard.

Sigma detections have been a way for blue teams to share malicious behavior for over 7 years. Since then, the core team have been working extremely hard on bringing brand new features – like correlations, filtering, & meta rules, sweeping documentation uplifts, as well as bringing a new suite of tools and ecosystem changes that's designed to be as modern as the SIEMs we use today.

Come explore these advancements as we unlock some of new exciting possibilities of what Security Teams can now do with Sigma and the v2 Specification.

This talk is about a vulnerability in Google Drive. But it's also a talk about web security concepts, how services can be made to interact in unintended ways, and how a few seemingly harmless flaws can be chained to defeat security boundaries.

TBD

DNS over HTTPS (DoH) is a protocol that emerged in 2018 and has since seen some adoption. This educational talk will provide a brief overview of DoH from the perspectives of network admins and cybersecurity experts. It will give overview the current state of its implementation, and how it is supported by browsers, operating systems, and DNS server software. Additionally, the talk will address how DoH can be controlled, detected, and how its being used. in diverse network setup It will also include a short overview of the split-horizon problem with offering practical insights.

Security-related tools tend to be dual use, habit of editing URI bar to navigate a website may have surprising results and reporting a vulnerability while hinting a bounty sounds like ransom note.

Sounds like introspection of a security researchers? Could be also cybercriminal building their alibi. Or cybercrime police trying to tell the two apart. I'll talk about intel gathering, investigation and prosecution as process, explaining where we try to draw the line between good and evil - and how to make everybody's life easier by really appearing on the side of line you have chosen, illustrated by real life cases that can be discussed at the time of presentation.

A huge amount of data is generated by electronic health records, various biosensors and other means. To receive benefits like more effective detection of diseases from these enormous amounts of data, Artificial Intelligence (AI) and Machine Learning (ML) systems are becoming more widely used. With this technological progress comes the potential for new or previously overlooked security threats. Because of the nature of the system, the security issues within healthcare systems could bear devastating consequences. This study identifies the threats opposed to AI/ML-based healthcare systems by conducting comprehensive threat modelling and threat analysis. The model captures all the characteristics of a modern healthcare system that utilizes the usage of an AI/ML component with an in-house development approach. The model has different ways to gather data and interact with patients and doctors. The threat modelling is conducted based on the STRIDE methodology. In addition, STRIDE-based attack trees are used to further identify all the relevant threats that could endanger a modern healthcare system. As a result, a comprehensive list of identified threats is provided for all the components that are used in a modern healthcare AI/ML-based system. The threat list consists of conventional and AI/ML-specific threats. For AI/ML-specific threats to be successful, they need some form of a conventional attack to be carried out beforehand. The model itself and the threats identified are validated by various experts from the cybersecurity and AI/ML field. This study aims to contribute to the safe and effective implementation of AI/ML technologies in healthcare settings.

In the DevOps era of frequent releases, CI tools such as Github actions are powerful platforms to enable secure and rapid software releases, but what additional attack surface do these often privileged components come with? This talk covers a recent research project from Snyk Security Labs to understand Github actions in depth and how they can be attacked to leak cloud environment access tokens, arbitrary secrets and result in a full compromise of the repository. Security engineers, pentesters and bug hunters alike will come away knowing the threat landscape for Githubs CI platform, and through case studies of high impact vulnerabilities we have uncovered, be equipped to exploit and secure Github actions.

In this talk, we delve into the world of Digital Forensics and Incident Response (DFIR). We will cover the basics, such as the process and terminology, and examine four distinct incidents. For each incident, I will explain the ‘what’ and ‘how’ of the attack, the lessons learned, and the often overlooked human aspect of incident response.

Business Email Compromise (BEC) Incident: We’ll explore a case where an adversary exploited a user and maintained persistence for a month to extract money.

Ransomware Incident: We’ll examine a company’s third ransomware incident, all of which happened within a span of 2 years, where the victim attempted to pay the ransom. We’ll discuss what went wrong during the recovery process

Wiper Incident: We’ll delve into a rare hacktivism attack where 95% of the victim’s infrastructure and data, including backups and logs, were deleted.

Failed Attempt: Sometimes, attackers have bad days too. We’ll look at an incident where the attackers gained access to the company’s infrastructure but failed to deploy or exfiltrate anything.

By sharing my experiences, I hope to help attendees with the knowledge to stay proactive against cyber attacks and, in the event of an incident, respond more effectively.

Last year, at BSides Tallinn, we demonstrated how to make ChatGPT your b*tch.

This year, we'll dive deeper into real-world LLM vulnerabilities.

Nowadays everybody is talking about AI and large language models.

Let's talk about to break them.

In this workshop we'll target some LLMs and exploit the h$ll out of them.

Get your laptop ready for this hands-on workshop delivered by OWASP Lead Stefano Amorelli.

In this talk we'll explore how Red Teams can and do evade Endpoint Detection and Response (EDR) systems.

First, we'll look at how EDRs are set up and used in various environments. We'll break down their components and how they work & communicate. Next, we'll dive into common malware functionalities and the different ways EDRs internally try to detect them.

The main focus will be on the actual techniques used for avoiding detection and how they can be implemented. We'll cover how different detection scenarios are handled and also some more generic bypasses that still work against advanced EDR systems. We'll also have live demos to show these techniques in action if demo gods allow.

Kubernetes (k8s) is an orchestration system for automating software deployment, scaling and management, and if you don’t know… this is really hot right now.

When implemented in a cloud environment, it allows a service to grow almost limitless, because the k8s Cluster can create and destroy servers at will, based on the load of the containers running. Imagine what can go wrong when attackers get to own this power for themselves… you are right, lightspeed growth equals a lot of destruction power.

In this talk, we are going to analyze a real example of an AWS Kubernetes cluster infection through a software development supply chain compromise. The attackers were able to get AWS credentials from a DevOps workstation and use them to introduce a poisoned docker image into a kubernetes cluster. It allowed them to move laterally within the cluster and to the cloud provider, retrieving secrets, passwords, tokens, and a bunch of other data.

Luckily, we were able to detect them just in time, as they had retrieved secrets that would have allowed them to move laterally to other companies or execute a new docker image with nastier results.

We are going to present the examples using a real-time lab, offering examples for incident responders and malware analysts to understand how to investigate these techniques, getting through the cyber kill chain and explaining what went wrong and what could have been done better.

Email is a ubiquitous part of everyday life, yet its inner workings and future developments often remain distant. Things being overlooked has left plenty of opportunities for abuse. It's up to us to pay a little bit of attention to more than just deliverability.

And even though email is being described on Wikipedia as something that "was conceived in the late–20th century", it's still constantly evolving to better adapt to the 21st century. There are both old and new approaches available that help make things more (in)secure.

This talk covers recent larger vulnerabilities involving DKIM, DMARC and BIMI, currently available methods for improving email security and teases of what's being planned for the future.

Some parts of this talk are also partially covered here: https://www.zone.ee/blogi/2024/05/17/bimi-and-dmarc-cant-save-you/

The current threat landscape has seen an exponential increase in synthetic media use (deepfake technology). These tools can be leveraged against systems that automatically verify one's identity, or even be used in social engineering attacks against business processes and people in order to appear as a different person. Threat actors are using this more and more in their business-as-usual, so how can assessors test these attacks in an ethical, legal and non-impactful way? This presentation will hopefully shed a light on how we developed our approach.

This talk delves into Threat Actors' tactics for infiltrating Windows systems at a Kernel level. We analyze Kernel security features and weak spots used in real-world exploitation to understand the mechanisms that Threat Actors use to bypass protections and what capabilities they gain in the process.
We conclude with some security recommendations to help organizations strengthen their defenses against these evolving threats.

Estonian web blue team has evolved Locked Shield defence and threat hunting toolkit over past 4 years and a lot of it could - and should - be used also in real life.

We'll run through the scenario of dockerising whatever webapps, secure configurations, WAF tricks and easy ways to make your logs usable. All templates - sidecar containers, configurations, etc - will be public, docker-savvy participants can follow our scenario on their own computers and the rest gets chance to interact with sample application and navigate through the resulting logs in real time.

In April 2023, Sarah Bils was revealed to be one of the main people behind the DonbassDevushka social media "personality,” posting pro-Russian propaganda to a variety of social media accounts since 2014. One of the main accounts, the PeImeniPusha Twitter account has been active since 2015, with a huge uptick in activity concurrent with the Russian invasion of Ukraine. Ms. Bils has claimed that there was a team of at least a dozen people responsible for the Donbass Devushka personality.

With a group of people all writing under the same “personality” can we detect patterns that might reveal shifts in authorship of tweets? I used a number of open and closed source tools, along with original methodology and tools, to analyze text and metadata collected from the PeImeniPusha Twitter account and several other sources. Primary areas of research and analysis include identification of potential authorship clusters, analysis of trends in content posted, and network analysis of people affiliated with the Donbass Devushka personality. This session will build significantly upon research first presented to a standing room only crowd at the DEF CON 31 Misinformation Village, and will present additional research and analysis for the first time.

Join Jarrad Pemberton and Tormi Tuuling, SOC Engineers at Wise, as they walk through how threat actors can leverage verified advertising services to phish your customers. They'll be discussing the tactics of these threat actors, and the Ads transparency movement in today's advertising focused internet landscape.