Chcon

Learn the foundational and basics of Operational Technology (OT) / Industrial Control System (ICS) Cyber Security. Understand the differences between an Infosec / Information Technology and OT / ICS, why some of the traditional security controls and countermeasures can increase organisational risk rather than decrease it. This training will also explain some alternative approaches to mitigate risks associated with critical infrastructure, if you work in an environment that has OT or ICS, or are curious to know more about securing these environments this is a great first step.

With Cybersecurity incidents becoming more prevalent across the globe, it is now a matter of when not if something will occur. Our training will help you understand the phases that are normally part of an incident and what role you would likely need to play according to your organisation's response plan (you know where yours is and test it regularly right?). Equip yourself with the knowledge you need to help reduce the impact of a cyberattack.

Embark on a journey into the heart of WiFi technology with our dynamic training program. Delve into the core principles while keeping pace with the latest advancements in the field. This immersive experience isn't just about theory; it's about hands-on learning. Navigate through virtual wireless arenas, applying newfound skills in real-world exercises.

From tackling personal networks to infiltrating enterprise setups, this training equips you to handle diverse challenges. Explore both fortified and vulnerable configurations, honing your expertise in thwarting attacks. And with a focus on the cutting-edge WPA3 standard, you'll be prepared for the newest frontiers of WiFi security.

As an introduction to web application security through Python, this training session aims to give attendees the tools to understand the most common security vulnerabilities faced by web applications as well as how to fix them.

Reverse Engineering for Education/Entertainment provides an introduction to analysing code, bytecode, and application binaries.

Welcoming to Christchurch Hacker Conference as performed by Kevin and Dan

The crew will roll the DnD dice. The first number will be the talk number on the schedule, the second will be the slide. We will show the slide and you will talk about that one until we pick the next.

This is a place holder for your real talk and we would not actually do this.

The goal of this talk is to give people interested in getting into cyber security, or who have just started but aren’t sure where you’re going to land, an idea of: where you can start, where you can go, and what you can do to get there.

The Cybersecurity industry is full of weird and wonderful people, however much like any other industry, there are often some colourful characters who can make a questionable comment or two which can really crush a young, hopeful Cybersecurity consultant's spirit.

This talk will go over some of the most humiliating and thought provoking experiences that we have experienced while working in the Cybersecurity industry. Including how to deal with these situations and most importantly how not to be a dick in the industry.

Allow Justina and Lou to recount their work horror stories of people being dicks, and how to not be a dick.

Asked an experienced staff member to explain their investigative process to a new starter and been met with a blank stare, a hand wave and a vague "I just do what makes sense"? Even worse, "I re-image the machine and move on"! As an industry, we can do better than this, and this talk will show you how you can apply a decision making model around your thinking - from level one SOC to in-depth system investigation - to enhance your investigations today.

Curious on what the Windows built-in Data Protection API (DPAPI) is? Want to understand how it can be abused from an offensive perspective? This talk will explain how the DPAPI works under the hood, various abuse scenarios, and what to consider when developing Windows applications that use the DPAPI

Microsoft is planning to kill off NTLM (New Technology Lan Manager) authentication in Windows 11 and above. Let's speedrun coercing hashes out of a few more things before it fades into obscurity over the next twenty five years or so.

There will be a deep dive on several new bugs we disclosed to Microsoft (including bypassing a fix to an existing CVE), some interesting and useful techniques, combining techniques from multiple bug classes resulting in some unexpected discoveries and some absolutely cooked bugs. We’ll also uncover some defaults that simply shouldn't exist in sensible libraries or applications as well as some glaring gaps in some of the Microsoft NTLM related security controls.

It’s been five years, two kids, six jobs, four Taylor Swift albums, one global pandemic and eleventy billion security incidents since I last spoke at CHCon, so what’s changed in the global security landscape and how we talk about security incidents and breaches?

When it comes to cybersecurity, sometimes the thing that people forget is that a solution or an account is only as secure as the individuals who are authorised to access it. By targeting the human element, an individual does not have to try break through firewalls or defense mechanisms or access accounts. All they need to play to is the person that takes the time to respond - to elicit a reaction strong enough to make that person think that what they are doing is for their benefit or required.

The best way to do that, is by targeting one's emotions. Let's talk about some of the ways this can be successful using technology, focusing on Advance-Fee Fraud, Romance Scams, and Phishing Attacks.

Attack surface management is an age old challenge that organisations face. With cyber attacks being reported frequently in the media it can be easy to lose hope as a consumer, let alone a technology professional. This presentation aims to remove some of the "magic" behind threat emulation and simulation that internal Red Teamers and Offensive Security Specialists have picked up from studying the "bad guys" by looking at real world examples and going through "what's next" after you've been handed your Red Teaming report.

Gone are the days when developers had to craft their own session management systems and rely on CGI calling Perl scripts (hopefully!). Today, programming languages and frameworks offer a wealth of built-in security features—often for free. But what exactly do these features provide, and how can we leverage them to elevate our security code reviews, penetration testing practices, and even compliance efforts?

In this talk, we'll explore the security mechanisms that modern frameworks and languages offer out of the box. We'll dive into how understanding these built-in tools can transform your approach to code review and penetration testing, allowing you to focus on the nuances and deeper issues that could compromise your application’s security. Whether you're a security professional, developer, or compliance officer, this session will equip you with the knowledge to make the most of the features at your disposal and ensure your applications are as secure as possible.

The most common definition of OT (Operational Technology) includes ICS (Industrial Control Systems). This talk will present an alternative view which better aligns to current practice, both in NZ and globally. The talk will address some of the conflict in terminology and discourse around what good OT cyber security looks like - generally from a defender perspective. The talk will include key insights and takeaways technical and non-technical, regardless of your OT security maturity.

In an era where budget constraints are ever-present and the threat landscape is constantly evolving, organisation must optimize their cybersecurity spending with precision. This technical presentation delves into the integration of Cyber Threat Intelligence (CTI) within detection engineering frameworks to maximize the effectiveness of limited cybersecurity resources. The presentation will explore the strategic application of actionable intelligence to tailor defensive measures, enabling organisations to prioritize their security efforts based on tangible and relevant threat insights into adversary tactics, techniques, and procedures (TTPs). Attendees will gain a deeper understanding of how to interpret threat actor telemetry to engineer more robust targeted defenses and identify the most pertinent threats to their operations. This session offers a comprehensive guide to deploying a targeted cybersecurity strategy that not only mitigates cyber risks but also enhances the protection of critical assets within resource-constrained environments.

The advancement of A.I within the last few decades has sparked some concern in the general public such as fears of political impersonation or a robot uprising. However, there has been an ongoing and persistent threat with the use of A.I that is only just making it's way into the mainstream media.

The production of deepfake pornography has been increasing within the last ten years. This technology is used to make non-consensual adult media often targeting women including famous people and non-celebrities. This talk will unpack the history of deepfake porn, explain how the technology developed, evaluate the prevention and mitigation efforts, and discuss what services and legislation are in place in New Zealand to protect people affected by this.

Stop me if these phrases sound familiar: "Management just doesn't understand the issue", "The executives don't care about security", or "If the board would just give us the budget......". You've probably heard or even uttered many of these common phrases yourself. There seems to be this perennial divide between our technical security practitioners and engineers, and the leadership at the top levels of an organization. Have you ever considered what it would be like to be an executive, what you’d do differently, or even wondered if it’s possible to move from a technical security role into the C-Suite of a multi-billion dollar organization?
In this presentation we’ll follow the journey of someone who did just that. Alyssa Miller, a childhood hacker who grew up in the hacker culture of the 80’s and 90’s is now the CISO of such an organization. She’ll share the lessons learned as a hacker that helped her understand and influence executives at the highest levels of leadership. She’ll give you tips, tricks, and even warnings about potential pitfalls to avoid if your goals include the C-Suite at some point in your future. You’ll learn that you don’t need to abandon your hacker roots to join the management ranks, and in fact you’ll see how those tools uniquely equip you to be exceptional in such a role. Come join us for fun stories, learning from examples, and inspiration to chase those dreams in your most authentic way.

MFA, everyone says you should be using it. We say that too, but not all MFA is created equal, and some MFA implementations have issues. Having tested many systems over the years we have seen some “interesting” implementations with weird behaviour which allows for bypassing MFA. Knowing these gotchas will help you find these issues and hopefully avoid the same mistakes.

Security controls such as endpoint detection and response (EDR) continue to mature, thereby increasing the amount of effort adversaries must invest to successfully execute intrusions, remain undetected and achieve their objectives. This presentation will cover techniques that red teams can use to perform post exploitation against web applications hosted by Microsoft’s Internet Information Services (IIS) while evading modern security controls. The concerns that come with using traditional “cmd.exe” web shells will be discussed before demonstrating more mature web shells which make use of reflective assembly loading and deserialisation.

At 1851’s Great Exhibition, locksmiths offered prizes to anyone who could defeat their so-called “unpickable” locks. This hugely successful marketing stunt heralded the modern security industry, with vendors stoking fears of Sophisticated Hackers™ to create demand for expensive high-tech security solutions, while daring safe-breakers kept finding ways to thwart even the most impenetrable so-called “burglar proof” safe.

In this talk we’ll meet some notorious characters from this now-forgotten golden age of safecracking. We’ll take a look at their criminal exploits, and how safecrackers’ methods and security countermeasures evolved over a century.

Quantum Threats to Crypto: Should We Be Afraid?

This talk about the security challenges presented by quantum computing, covering key Quantum Computing concepts as well as the vulnerabilities of current cryptographic algorithms. We will discuss NIST's efforts in standardizing quantum-resistant cryptography and emphasize the importance of education in preparing for a quantum-enabled future.

With voice cloning now available to the masses, just how secure is your average voice authentication system? Come dive into the world of AI voice generation systems; learn how to clone someone's voice, as well as discussion surrounding the trends we are seeing in voice authentication systems and AI voice generation.

The importance of making more sustainable choices in our daily activities is now deeply embedded within our social practices and is a core part of what we teach our children. Indeed, most modern businesses have ‘green’ policies that underpin regarding how they source products and services, consume energy, and dispose of waste. A good example of this is the growth of the use of highly automated Internet-connected building management systems within the construction of environmentally friendly homes and commercial buildings.

Dropping down to the consumer-level, many individuals are also increasingly embracing green technologies in terms of how they live their lives. We are seeing a massively increased usage of electric and hybrid vehicles, e-bikes, IoT-enabled electrified public transport, smart bulbs, and solar-powered Internet-enabled security cameras.

However, on closer review, many critical security vulnerability and privacy assurance mechanisms are absent within these increasingly autonomous technologies. Many green tech companies are working on cutting-edge technologies that have not yet been thoroughly tested or implemented on a large scale.

This could lead to situations where, if a malicious actor took over an intelligent thermostat or door-locking mechanism, they could create an internal climate which was excessively hot or cold, or remotely disarm a premises door locking mechanisms. Scenarios such as this have physical safety implications for building occupants. They also have serious reputational harm implications for the business owners associated with these green buildings.

Common Criteria is an international standard required by most government and entities to protect their mission-critical resources. It is a pre-requisite for qualified products under the European Union digital signature laws and is required by the US government under the National Information Assurance Partnership (NIAP). This presentation sheds lights on the TLS certificates requirement for this regulation and the common pitfalls to look out for.

I finally work somewhere which cares about security! These are the tools we're using to improve our products.

Human lives are finite, but the internet remembers all. What does, will, or should happen to all the accounts, passwords and other data after a person becomes dead or otherwise unavailable?

The increased dependency on the digital life to participate in society means, digital life is real life. With that, the consequences of failure in confidentiality, integrity and availability of our digital self, can have dire consequences. So, I threat modelled living in 2024; and it’s more fragile than I thought!

How digitally resilient do you think you are?
Let’s talk about that, and some things we can do about it.

There are trillions of PDFs in the world, and their very ubiquity makes them a file type where 'bad people' might store malicious code. The ability to quickly identify malicious files is essential and tools such as Remnux, peepdf and RUPS will be discussed, along with some examples of other things that can be hidden within the PDF file format.

ASB's Kashin has been an icon in many young peoples lives, helping them learn how to save.
This talk recounts the process of researching the Clever Kash device, generally discusses why IoT security matters, and common techniques used to reverse engineer hardware.

Everyone knows that in 1996, David Levinson saved the world by hacking the aliens with his trusty Macintosh PowerBook. Despite the memes you may have seen, this cyberattack is actually plausible, and I can prove it. Let's break down the famous ID4 hacking scene, map it onto Lockheed-Martin's Cyber Kill Chain, and give Mr. Levinson some well-deserved credit!