0.56 hack-lu-2023 2023-10-16 2023-10-19 4 00:05 https://pretalx.com Europe/Luxembourg Salle Europe Talk 2023-10-16T11:00:00+02:00 11:00 00:30 Visualisations in Infosec tend to be moonshots: shiny but mostly one-shots. What about something simpler, but useful on a daily basis ? hack-lu-2023-31201-sbud-infovis-in-infosec cti-summit /media/hack-lu-2023/submissions/H9HAEZ/Sbud_v4_preview_ZapIMue.png Ange Albertini en Have you ever taken the screenshot of a hex viewer or a text editor, then you wanted to add annotations, highlights, descriptions? Ever tried to update someone else's visualisation? Sbud is a set of visualisation renderers driven by text. Offline, no framework, no dependency. Themes and fonts are supported. MIT licence. Save as SVG, PDF, PNG... Text is kept, still selectable, still updatable. false https://pretalx.com/hack-lu-2023/talk/H9HAEZ/ https://pretalx.com/hack-lu-2023/talk/H9HAEZ/feedback/ Salle Europe Talk 2023-10-16T11:30:00+02:00 11:30 00:20 At Crowdsec we receive a lot of signals of users detecting attacks using our open source intrusion prevention system. We used these signals to detect whether attackers are behind anonymization services such as proxies or VPNs. We show that by monitoring changes in attack behavior over time we can reliably detect proxies and VPNs and use this data to improve our threat intelligence. hack-lu-2023-36588-detecting-vpns-proxies-by-analyzing-their-attack-patterns-over-time cti-summit Emanuel Seemann en Crowdsec is an open source intrusion detection system which uses a crowdsourcing approach to collect threat intelligence from the community and to return a distilled version of the resulting data as an ip blocklist that is relevant and up to date to the community. Recently, we have started improving our threat intelligence by enriching it with various additional information on malicious ips. One of these projects involved setting up a machine learning system that detects whether a given attacker is using an anonymization service such as a proxy or a vpn. In this talk we show: * How we define attack patterns for each ip * How we monitor the evolution of attack patterns over time and how we can use this to detect anonymization. We also present other findings that we discovered on the way and hope that our results could help threat researchers even if they don't have access to data as exhaustive as the crowdsec CTI. false https://pretalx.com/hack-lu-2023/talk/XZPCVE/ https://pretalx.com/hack-lu-2023/talk/XZPCVE/feedback/ Salle Europe Talk 2023-10-16T11:50:00+02:00 11:50 00:30 If you have not noticed the hype about ABOUT (Software Bill of Material) you must been living in a cave. They have been touted as the next best thing after sliced bread and the cure-it-all to all our security problems of the past many years. Join me to break through the hype and review the good, the bad and the ugly and determine if, how and when they may useful and when not. hack-lu-2023-36252-sboms-are-they-a-threat-or-a-menace cti-summit Philippe Ombredanne en SBOMs are discussed everywhere. What are they? How do you create one (using open source tools of course)? What do you do with one if you have it? How to break through the hype and ensure that they contain useful data? How can you use these for red team and blue team ops support? I am a co-founder of SPDX, an active contributor to CycloneDX and the creator of Package URL (PURL) which is a standard to identify packages in these SBOMS as well VEX (Vulnerability Exploitability Exchange) specs such as CSAF and OpenVex. PURL are also used by many SCA tools and vulnerability databases as the key id to search for package vulnerabilities. I am unwillingly part of the hype around SBOM, yet I am also uniquely positioned to deliver a constructive critique and help you cut through this hype so you get the essential inside information to decide what to do with SBOMs (or do nothing!) false Slide presentation https://pretalx.com/hack-lu-2023/talk/PUXBQ8/ https://pretalx.com/hack-lu-2023/talk/PUXBQ8/feedback/ Salle Europe Lightning talk 2023-10-16T14:00:00+02:00 14:00 00:05 A Tool to Detect Fraudulent Token Contracts on Ethereum Blockchain hack-lu-2023-37928-token-smart-contract-analyzer cti-summit lightning talk TGrandjean en Hi! We have received your proposal "Token Smart Contract Analyzer" to hack.lu. We will notify you once we have had time to consider all proposals, but until then you can see and edit your proposal at https://pretalx.com/hack-lu-2023/me/submissions/NN9AHG/. Please do not hesitate to contact us if you have any questions! The hack.lu organisers ________________________________________ Full proposal content: Proposal title: Token Smart Contract Analyzer Abstract: A Tool to Detect Fraudulent Token Contracts on Ethereum Blockchain Description: Smart contracts have demonstrated new ways to manage and trade digital assets, conduct financial transactions, and transform business processes. Several concepts have emerged to enable investors to own or trade digital assets. Trading platforms relying entirely on decentralized, known as decentralized exchanges, allow unrestricted financial transactions to exchange digital assets. Beyond the opportunities offered, using the decentralized environment remains complex to understand by most of its users, consequently giving adversaries opportunities to benefit from investors based on scamming schemes. The cryptocurrency market is damaged by malicious actors that aim to drain investor funds via scamming token smart contracts. This research paper initially highlights related problems with fraudulent token contracts. Further, it proposes a solution for identifying several fraudulent schemas in the crypto ecosystem via a dynamic algorithmic solution supported by the SC Analyzer tool based on real-time data. false https://pretalx.com/hack-lu-2023/talk/RMTECU/ https://pretalx.com/hack-lu-2023/talk/RMTECU/feedback/ Salle Europe Lightning talk 2023-10-16T14:05:00+02:00 14:05 00:05 Website cloaking is a technique that enables websites to deliver different content to different clients, with the goal of hiding particular content from certain clients. Website cloaking is based on client detection, which is achieved via browser fingerprinting. In an attempt to hide their malicious web pages from detection, cyber criminals (can) use cloaking. They use vulnerability detection to only target clients that seem vulnerable. On top of that, they (can) also provide benign content in case they suspect someone or something is trying to detect them. In this talk I quickly go over what cloaking is, how it works, and why I think it deserves some more attention from the cyber community. hack-lu-2023-38140-cloaking-malicious-web-content-delivery cti-summit lightning talk Jeroen Pinoy en Very short introduction into browser fingerprinting, cloaking and CTI related to it. false https://pretalx.com/hack-lu-2023/talk/7WUYKM/ https://pretalx.com/hack-lu-2023/talk/7WUYKM/feedback/ Salle Europe Lightning talk 2023-10-16T14:10:00+02:00 14:10 00:05 The composition binary analysis of apps and libraries can be a complex thing mixing multiple techniques. Let's review the techniques and FOSS tools to automate this analysis for binary formats such as bytecode, native Go and C/C++ ELFs and minified JavaScript. hack-lu-2023-38158-the-composition-analysis-of-binary-java-elf-go-and-javascript-apps cti-summit lightning talk Philippe Ombredanne en I routinely analyze large app and system binaries to find out what they are made of and if they contain unknown software or vulnerable code. I will highlight some useful FOSS tools such Lief, BANG, ScanCode.io, Elf inspector tools to support this short talk. Join me to discover how you can determine what software goes into a binary to get back to its corresponding source (in a white box context). false Slides https://pretalx.com/hack-lu-2023/talk/MNCC3H/ https://pretalx.com/hack-lu-2023/talk/MNCC3H/feedback/ Salle Europe Lightning talk 2023-10-16T14:15:00+02:00 14:15 00:05 A Flexible case management hack-lu-2023-38173-case-management cti-summit lightning talk Cruciani David en A flexible case management that can be used for forensic, threat intel... Work with different organization, follow tasks of your team, make report... false https://pretalx.com/hack-lu-2023/talk/XREWCZ/ https://pretalx.com/hack-lu-2023/talk/XREWCZ/feedback/ Salle Europe Lightning talk 2023-10-16T14:20:00+02:00 14:20 00:05 GeoOpen and mmdb-server: A Comprehensive Open Source Solution for IP Address Geolocation hack-lu-2023-38177-geoopen-and-mmdb-server-a-comprehensive-open-source-solution-for-ip-address-geolocation cti-summit lightning talk Alexandre Dulaunoy en https://hdoc.csirt-tooling.org/OgdCNqHYQpukzRKN0T2hmg?both false https://pretalx.com/hack-lu-2023/talk/JBPW3R/ https://pretalx.com/hack-lu-2023/talk/JBPW3R/feedback/ Salle Europe Talk 2023-10-16T14:30:00+02:00 14:30 00:30 Recently a CSIRT colleague said: "CTI is dead" which made us wonder and ponder. hack-lu-2023-34025-cti-is-dead-long-live-cti cti-summit David en The Cyber Threat Intelligence (CTI) remains a bit of a buzzword. What a CTI team does, for who it does it and how, are still covered in mystery or a maintained artistic blur. Often CTI is regarded as retrieving threat reports, digesting them or researching a malware or infrastructure to make a report. Other teams then retrieve, digest, extract IOCs and or TTPs and then implement mitigations or write another internal presentation. While this may help protect from certain attacks, many reports do not directly concern our constituencies. And more to the point, the reports may not be timely when an incident is being handled by a CSIRT. A complementary approach, could be to identify, collect and analyze the data that we already "have" but sometimes tend to forget. We will present a more constituency centric approach and some of the challenges we face as an MSSP. By combining these complementary approaches, an outward looking and inward knowing, we could revive CTI in a more long term, less buzzword way, and more importantly better protect our constituency. false https://pretalx.com/hack-lu-2023/talk/YL9AAY/ https://pretalx.com/hack-lu-2023/talk/YL9AAY/feedback/ Salle Europe Talk 2023-10-16T15:00:00+02:00 15:00 00:30 Defending against the latest threats requires timely, actionable intelligence. In an active sharing community that has members of varying maturity, resources, and team staffing, you need a way to collect, normalize, enrich, and vet the shared intelligence at scale. Most will have different intelligence requirements, so flexibility is demanded to tailor to the disparate use-cases and existing workflows they may have. This presentation shows how the Retail & Hospitality ISAC leverages MISP as a community instance for their members and incorporates other free and open-source software to address these topics and more! hack-lu-2023-33832-fosstering-an-isac-enabling-a-community-with-open-source-tools cti-summit JJ Josing en • Brief overview of MISP architecture • RH-ISAC custom taxonomy o Categorizing intelligence: ▪ Source where intelligence was shared ▪ Sector of member who shared intelligence ▪ Threat type (e.g., ATO, info stealer, credential harvester, etc.) • RH-ISAC custom galaxy o Threat actor profiles/clusters ▪ Prioritizing threat actors ▪ Data sources ▪ Custom cluster elements • Intel Sharing and Normalization o mail2misp o Sharing templates o MISP objects o PDF/video documentation resources • Enriching and vetting attributes o Automating enrichment with PyOTI o Enrichment services o Enrichment tags o Vetted attributes “feed” • Intel Interoperability o RH-ISAC developed integrations o Existing 3rd party integrations o MISP Sync • What’s next! false https://pretalx.com/hack-lu-2023/talk/WVZVZH/ https://pretalx.com/hack-lu-2023/talk/WVZVZH/feedback/ Salle Europe Talk 2023-10-16T15:30:00+02:00 15:30 00:30 Linux is an open-source OS; however, performing Threat Hunting on Linux using open-source software (OSS) is not easy, as only a few tools are available and maintained. A port of the well-known Sysmon tool, originally developed for MS Windows, has been made for Linux, but it suffers from several issues. In this presentation, I will introduce a brand-new open-source tool I have been working on for several months. This tool aims to be a Sysmon alternative for Linux and provides several features that Sysmon does not offer. hack-lu-2023-33919-0-kunai-your-new-threat-hunting-tool-for-linux cti-summit Quentin JEROME en This presentation aims to introduce the community to Kunai, a new Threat Hunting tool designed specifically for Linux Systems. I'll start by discussing the project's origin and my motivations for initiating it, followed by an exploration of the tool's inner workings and implementation details. This section will conclude with an overview of the challenges encountered during the tool's development. Next, I will highlight its key features, emphasizing how it differs from existing tools. The latter part of this section will explore practical Threat Hunting scenarios that can be realized with the tool. In conclusion, I will summarize the key takeaways from this tool and share our future plans for its development. false https://pretalx.com/hack-lu-2023/talk/MGMYZA/ https://pretalx.com/hack-lu-2023/talk/MGMYZA/feedback/ Salle Europe Talk 2023-10-16T16:00:00+02:00 16:00 00:20 Even reputable vendors sometimes have a hard time consistently communicating uncertainties in a single report. This talk will highlight the challenge at the individual analyst level of working with uncertainties and communicating them. Words of Estimative Probability (WEP) and confidence levels, which address intelligence gaps, assumptions, and conclusions, may appear abstract and difficult to grasp for individuals with technical backgrounds who have transitioned to CTI from working with concrete facts. The presentation will explore various approaches to communicating uncertainties, showcasing their respective advantages and disadvantages for different types of threat report consumers. hack-lu-2023-33556-why-does-the-cti-industry-struggle-with-communicating-uncertainties cti-summit Ondra Rojcik en This talk will present a comparative study of how security vendors utilize Words of Estimative Probability (WEP) and confidence levels, which are tools used in intelligence analysis to convey uncertainties. It aims to shed light on the varying approaches used in the industry. While the talk will not exhaustively explain why some vendors struggle in this area at an industry level, it will emphasize that working with uncertainties and effectively communicating them can also be challenging for individual analysts. WEP and confidence levels might appear difficult to grasp. To bridge this gap, the talk will translate these abstract concepts into language that resonates with the technical audience. It will provide practical guidelines for utilizing WEP and offer specific steps to differentiate terms such as "likely" and "highly likely." Additionally, the presentation will explore various approaches to communicating uncertainties, highlighting their respective advantages and disadvantages for different types of threat report consumers. Some logical approaches that effectively combine WEP and confidence levels may be complex for untrained readers to comprehend. However, alternative methods that deviate from standard intelligence analysis tradecraft could be viable in certain cases. Regardless of the chosen approach, transparency and consistency are essential considerations for any CTI team, including security vendors. false https://pretalx.com/hack-lu-2023/talk/L7UC9M/ https://pretalx.com/hack-lu-2023/talk/L7UC9M/feedback/ Salle Europe Talk 2023-10-16T16:30:00+02:00 16:30 00:30 Keeping IoCs usable and the base where they are stored clean over time is an important challenge. ANSSI/CERT-FR will present the tooling developed internally and used by CTI analysts in order to verify their quality and normalization before they are pushed into MISP. hack-lu-2023-33942-ensuring-ioc-quality-at-cert-fr cti-summit Barrault Victor en Thanks to its central position in the French cybersecurity ecosystem, CERT-FR has access to a lot of information and thus, a lot of IoCs. For internal usage and further sharing, these IoCs must reach a certain level of quality and remain usable over time. In order to manage this, CERT-FR provides its analysts with a library and a set of Python scripts. Analysts have to use these scripts in order to push data into the production MISP instance. The tools are based on an internal library, itself based on pymisp. It provides a set of functions, superseding pymisp’s ones, to create, update and delete attributes and tags in MISP. It does so both to apply more verification in order to guarantee their quality and to ensure that the input of the different types of IoCs will be consistent over time. This consistency is also essential for further automated exploitation by other internal tools. Thus, the scripts used by the analysts ensure that the data in IoC is normalized, following CERT-FR standards and that the tools consuming it will have access to the necessary data. It also ensures that the IoC lifecycle is correctly followed limiting analyst errors. The presentation will first cover what we call a quality IoC at CERT-FR. Then we will detail the normalization we apply to the data and the rules that need to be applied on IoCs before they can be pushed into MISP and why we need to apply these rules. Finally the internal library will be presented, to show some of the provided functions. Analysts can rely on these functions in their own tools or they can use the set of tools provided with the library to push their IoC into MISP. This set of tools will be also presented, in order to show how the normalization and rules are applied at CERT-FR. We will also give a brief feedback on how we want to improve the tools, following (constructive) criticism we have from analysts and other works we are currently carrying out regarding normalization and storing of technical IoCs. In a nutshell, this presentation will provide a feedback on the challenges encountered by CERT-FR on its IoCs usage and the solutions developed to keep the base as clean as possible over time. false https://pretalx.com/hack-lu-2023/talk/YV8H3B/ https://pretalx.com/hack-lu-2023/talk/YV8H3B/feedback/ Salle Europe Talk 2023-10-16T17:00:00+02:00 17:00 00:30 Another year has passed since the last CTI Summit, with MISP having gone through a long list of changes and extensions - this talk aims to summarise what has happened since October 2022 as well as giving a glimpse into what the core team has in store for the community in the near future. hack-lu-2023-38169-misp-updates cti-summit Andras Iklody en Another year has passed since the last CTI Summit, with MISP having gone through a long list of changes and extensions - this talk aims to summarise what has happened since October 2022 as well as giving a glimpse into what the core team has in store for the community in the near future. false https://pretalx.com/hack-lu-2023/talk/KTDHFU/ https://pretalx.com/hack-lu-2023/talk/KTDHFU/feedback/ Salle Europe Talk 2023-10-16T17:30:00+02:00 17:30 00:20 Research in the field of bypassing AV solutions and the role of cryptography in malware development. Application of classical cryptographic algorithms for payload and C2 communicate encryption. Practical research has been carried out: the results of using Skipjack, TEA, Madryga, RC5, A5/1, Z85, DES, mmb, Kuznechik, etc. encryption algorithms have been analysed. The application of cryptography based on elliptic curves is also being researched. How does all this affect the VirusTotal detection score and how applicable is it for bypassing AV solutions (AV bypass). In some researched practical cases, we get FUD malware. Bypass AV Kaspersky, Windows Defender. ESET NOD32 in some practical cases. Reverse engineering and code reconstruction with malware development tricks from ransomware and malware like Conti, Snowyamber, Paradise Ransomware, CopyKittens, etc. Discover new tricks from Russian APT29 related malware. hack-lu-2023-35433-malware-av-evasion-tricks-cryptography-in-malware cti-summit /media/hack-lu-2023/submissions/RGZCBL/2023-06-09_23-58_AcZH20e.png cocomelonc en Practical implementation and simulation of APT attack with using non popular cryptography algorithms. Using Hemming and Reed-Solomon codes to check integrity of the payload and C2 connections false https://pretalx.com/hack-lu-2023/talk/RGZCBL/ https://pretalx.com/hack-lu-2023/talk/RGZCBL/feedback/ Salle Europe Talk 2023-10-17T09:00:00+02:00 09:00 00:25 MISP is an amazing platform for collecting and maintaining your CTI data and context, but is can also be useful in daily hunting engagements, incident repone cases, standard SecOps and other scenarios; without giving your infrastructure, outsourcing partners access access to context from MISP. hack-lu-2023-34476-cratos-use-your-bloody-indicators cti-summit Dennis Rand en In this talk we will walk through some use cases and releasing and open-source project Cratos an FastAPI application that allows integrating your MISP data into your security infrastructure, minimizing the risk of leaking your contextual data while still automating the tasks, and also allowing to cache data. false https://pretalx.com/hack-lu-2023/talk/CHCVTP/ https://pretalx.com/hack-lu-2023/talk/CHCVTP/feedback/ Salle Europe Talk 2023-10-17T09:30:00+02:00 09:30 00:30 In this talk, we will dive into exclusive data collection and analysis techniques specific to this decentralized network. We'll also take a quick tour of IPFS's wide range of applications and provide practical tips and tricks to help you secure your organization. hack-lu-2023-35277-ipfs-unveiled-exploring-data-collection-analysis-and-security cti-summit Patrick VentuzeloTanguy Laucournet en Join us for an in-depth exploration of IPFS, where we'll uncover its inner workings and dive into exclusive data collection and analysis techniques specific to this decentralized network. We'll also take a quick tour of IPFS's wide range of applications, including both everyday uses and those that may involve questionable or risky activities, giving you a comprehensive understanding of its capabilities. In addition, we will try to help you fortify your organization against any potential misuse or harm facilitated through IPFS. We will provide practical tips and tricks during our talk, empowering you to strengthen your security measures. false https://pretalx.com/hack-lu-2023/talk/UDEXYV/ https://pretalx.com/hack-lu-2023/talk/UDEXYV/feedback/ Salle Europe Talk 2023-10-17T10:15:00+02:00 10:15 00:30 The threat groups from North Korea, known as Lazarus, are highly active and pose a significant danger to various industries worldwide. With over 20 years of experience in cybersecurity, I have focused on investigating incidents and providing detailed reports to my clients. Through my extensive research, I have accumulated a vast knowledge base concerning their TTPs and aliases. Since the early 2000s, they have been primarily targeting South Korea and gained global recognition in 2014 during Operation Blockbuster. From 2015 onwards, they expanded their scope to focus on the financial and cryptocurrency sectors, carrying out large-scale ransomware attacks and extortion campaigns. Additionally, they have pursued sensitive information by targeting industries such as nuclear, defense, and aerospace. They exhibit exceptional skills in compromising supply chains, executing drive-by download attacks, exploiting remote services, and conducting phishing campaigns. They possess a remarkable ability to quickly adapt and optimize their attacks for specific targets. The cybersecurity community, including myself, maintains a vigilant watch over their activities. As a supplementary initiative, I maintain a website(https://lazarus.day) that catalogs their various aliases and posts related to them. Since 2009, there have been over 1500 posts authored by almost 300. He is everywhere. hack-lu-2023-33969-he-is-everywhere-a-tale-of-lazarus-and-his-family cti-summit JeongGak Lyu, @lazarusholic en Discuss the threat groups behind North Korea and summarize their relationships, which cluster as Lazarus, Kimsuky, ScarCruft, BlueNoroff, Andariel, and Konni. We'll also look at the incidents they've been responsible for since 2009 and identify their favorite Techniques. false https://pretalx.com/hack-lu-2023/talk/QWNF3T/ https://pretalx.com/hack-lu-2023/talk/QWNF3T/feedback/ Salle Europe Talk 2023-10-17T10:45:00+02:00 10:45 00:15 Cerebrate is just about to turn 2, since it’s 1.0 release in 2021 October. As most two year olds, it is finally free to roam around the living room and have a lasting impact on its surroundings. Having undertaken a journey of transformation and becoming operational in most aspects it was originally intended, this talk aims to walk participants through the changes as well as giving some insights into how Cerebrate is changing how we manage our communities. hack-lu-2023-38182-cerebrate-learning-to-run cti-summit Andras Iklody en Having undertaken a journey of transformation and becoming operational in most aspects it was originally intended, this talk aims to walk participants through the changes as well as giving some insights into how Cerebrate is changing how we manage our communities. false https://pretalx.com/hack-lu-2023/talk/8R8JUA/ https://pretalx.com/hack-lu-2023/talk/8R8JUA/feedback/ Salle Europe Talk 2023-10-17T11:00:00+02:00 11:00 00:30 In this presentation, we will delve into the interesting Ukraine-Russia conflict over the past year and uncover the emerging challenges in cyber threat intelligence and its critical importance to detection engineering, validation, and organizational resilience. Explore the impact of cyber warfare on global security dynamics and gain valuable insights into the intersection of geopolitics and cybersecurity. Join us for a brief but enlightening journey through this evolving landscape. hack-lu-2023-33981-digital-tug-of-war-unraveling-the-cyber-battle-between-ukraine-and-russia cti-summit Ondrej NekovarJan en Embark on a fascinating journey to uncover the multifaceted narrative of the protracted conflict between Ukraine and Russia that has captivated the world for over a year. This presentation aims to provide a comprehensive summary of the significant events, key moments and complex dynamics that have shaped this ongoing geopolitical saga. Amidst this turbulent backdrop, the realm of cyber threat intelligence has become a critical battleground, adding an unprecedented layer of complexity to an already volatile situation. We will delve into the myriad challenges that have emerged in the context of cyber threat intelligence and explore how they have shaped the course of the conflict and influenced the dynamics of global security. One of the main objectives of our discussion will be the intrinsic value and indispensability of threat intelligence in current conflict scenarios. Threat Intelligence serves as a beacon of foresight, equipping organizations and nations with the knowledge and tools necessary to proactively defend against cyber threats. By analyzing evolving tactics, techniques, and procedures used by adversaries, threat intelligence enables the identification of potential vulnerabilities, allowing stakeholders to strengthen their defenses and increase overall resilience. In addition, we will explore the complex interplay between threat intelligence and critical organizational processes. Detection engineering, the art of developing robust systems and mechanisms to identify and neutralize cyber threats, increasingly relies on timely and accurate threat intelligence. The synergy between detection engineering and threat intelligence supports the creation of sophisticated and proactive defense strategies that provide a more secure digital environment for organizations of all sizes. Validation, another key aspect in cyber threat intelligence, is becoming increasingly important in the context of the Ukraine-Russia conflict. Validating the authenticity and reliability of threat data is essential to distinguish real threats from false alarms. By implementing robust verification procedures, organizations can distinguish between genuine cyber threats and misleading or deceptive information, thereby optimizing resource allocation and response efforts. Finally, our presentation will underscore the importance of organizational resilience in the face of persistent cyber threats. Threat intelligence acts as a critical foundation upon which resilience strategies are built. By leveraging threat intelligence, organizations can develop comprehensive response plans, identify potential attack vectors, and implement proactive measures to mitigate risks and minimize the impact of cyber incidents. Join us as we embark on this thought-provoking exploration of the Ukraine-Russia conflict, where the convergence of geopolitical tensions and cyber threat intelligence makes for a compelling narrative. Prepare to gain invaluable insights into the complex interplay between these domains and emerge equipped with a deeper understanding of the evolving landscape of contemporary warfare. false https://pretalx.com/hack-lu-2023/talk/SMDFBC/ https://pretalx.com/hack-lu-2023/talk/SMDFBC/feedback/ Salle Europe Talk 2023-10-17T11:30:00+02:00 11:30 00:30 In this talk we invite you to follow our journey from a small virtual team of CTI enthusiasts with other responsibilities to an established CTI function in a cyber defense organization of a large company. hack-lu-2023-33993-how-to-operationalize-cti-a-real-world-example cti-summit Melanie Niethammer en While the journey is still ongoing, we want to highlight what worked so far and what not so much. From building and maintaining collections to the daily business of a CTI analyst of providing relevant information to our stakeholders without becoming a news clipping service. true https://pretalx.com/hack-lu-2023/talk/UXXCXQ/ https://pretalx.com/hack-lu-2023/talk/UXXCXQ/feedback/ Salle Europe Lightning talk 2023-10-17T13:30:00+02:00 13:30 00:05 Where are the CSAM hashsets? hack-lu-2023-38181-liberate-the-csam-hashsets cti-summit lightning talk Andras Iklody en Where are the CSAM hashsets? false https://pretalx.com/hack-lu-2023/talk/KML7KQ/ https://pretalx.com/hack-lu-2023/talk/KML7KQ/feedback/ Salle Europe Lightning talk 2023-10-17T13:35:00+02:00 13:35 00:05 Cobalt Strike v 4.9 was released mid September, but leaked less than a month later. Let s dive into this presumed blow to the vendor. hack-lu-2023-38150-cobalt-striked cti-summit lightning talk Vincent Hinderer en I ll detail the timeline of this event, what is and is not in the leak, and what message the leaker left to us, analysts. false https://pretalx.com/hack-lu-2023/talk/MESUKB/ https://pretalx.com/hack-lu-2023/talk/MESUKB/feedback/ Salle Europe Lightning talk 2023-10-17T13:40:00+02:00 13:40 00:05 With all the leaked credentials found in the wild, most of them are outdated or just a compilation of smaller dumps. Are they really used against you? hack-lu-2023-38188-are-leaked-credentials-dumps-used-by-attackers cti-summit lightning talk Xavier Mertens en I searched for some old credentials with my domain « root shell.be » and checked if they were used in brute-force attacks…. true https://pretalx.com/hack-lu-2023/talk/NGU8KF/ https://pretalx.com/hack-lu-2023/talk/NGU8KF/feedback/ Salle Europe Lightning talk 2023-10-17T13:45:00+02:00 13:45 00:05 Some lessons learned and anecdotes from spending several years sharing threat intelligence related to potential fraud / compromise. hack-lu-2023-38202-lessons-learned-from-sharing-intel-about-potential-fraud-compromise cti-summit lightning talk Jeroen Pinoy en Some lessons learned and anecdotes from spending several years sharing threat intelligence related to potential fraud / compromise. Based on experiences with both 'real' and 'simulated' scenarios. false https://pretalx.com/hack-lu-2023/talk/MNNLZP/ https://pretalx.com/hack-lu-2023/talk/MNNLZP/feedback/ Salle Europe Lightning talk 2023-10-17T13:50:00+02:00 13:50 00:05 Recently Sigma got a bunch of updates, time to keep you updated! hack-lu-2023-38199-sigma-project-news cti-summit lightning talk Thomas Patzke en Sigma got recently some updates: * the new [SigmaHQ website](https://sigmahq.io). * Sigma blog * Rule packages * Query post-processing * ... This talk gives a short overview about these news. false https://pretalx.com/hack-lu-2023/talk/9X7V8Y/ https://pretalx.com/hack-lu-2023/talk/9X7V8Y/feedback/ Salle Europe Lightning talk 2023-10-17T13:55:00+02:00 13:55 00:05 Risks of some new precious connected devices hack-lu-2023-38210-do-we-consider-this-as-a-risks-already cti-summit lightning talk Vladimir Kropotov en What else people should consider in the threat models true https://pretalx.com/hack-lu-2023/talk/AHNLUP/ https://pretalx.com/hack-lu-2023/talk/AHNLUP/feedback/ Salle Europe Talk 2023-10-17T14:00:00+02:00 14:00 00:30 CIRCL, CERT.PL and other JTAN poject partners will present a data sharing network built in the JTAN project. The talk will showcase open source tools used as a backbone of the network and the operational value of the data exchanged. hack-lu-2023-35091-jtan-data-sharing-network cti-summit Alexandre DulaunoyPaweł Pawliński en Details TBC. false https://pretalx.com/hack-lu-2023/talk/LHDBVE/ https://pretalx.com/hack-lu-2023/talk/LHDBVE/feedback/ Salle Europe Talk 2023-10-17T14:30:00+02:00 14:30 00:30 Cyber threat intelligence (CTI) analysts are inundated daily with new Indicators of Compromise (IOC)s to analyze. Due to the ephemeral nature of IOCs, analysts must analyze IOCs promptly to understand if an IOC is usable. IOC validation is one of the most time-consuming and frustrating aspects of analyzing an IOC. By optimizing IOC validation, an analyst can produce much more timely intelligence. In this session, you will learn first-hand how to turbocharge the validation of IOCs, thus saving you precious time and helping you prioritize your time to focus on high-value IOCs and creating both timely and actionable intelligence. hack-lu-2023-34622-turbocharging-ioc-validation-become-a-more-efficient-cti-analyst cti-summit Arwa Alomari en The session is based on real-world experience and will cover: - Intro to Low-Regret Model. - Scenarios which will take you down a rabbit hole and how to avoid them - When you, as a CTI analyst, should stop enriching an IOC - How to conduct IOC associations and linkage - A live demonstration of a highly efficient and automated method to gain optimal results and improve the IOC validation process using Low-Regret Model. The session will also provide participants with valuable sources to aid them in effectively validating IOCs in their role as a CTI analyst. false https://pretalx.com/hack-lu-2023/talk/NMLPHG/ https://pretalx.com/hack-lu-2023/talk/NMLPHG/feedback/ Salle Europe Talk 2023-10-17T15:00:00+02:00 15:00 00:30 This talk will present how Suricata, an open source IDS and NSM engine can provide high performance matching of IOCs on live traffic using a feature named dataset. It will also cover how the produced NSM events can be used to do IOC matching on past traffic data and will present the IOCMite tool that link Suricata and MISP. hack-lu-2023-36025-modern-iocs-matching-with-suricata cti-summit Eric LeblondPeter Manev en Suricata is an high performance open source IDS and NSM engine that exist since 2009. The IDS function has evolved over the years and ,among other features, the dataset one has been developed to be able to match on a list of elements. We will present how the feature is designed and how it is really convenient to do matching of IOCs on the live network traffic as well as building network wide patient zero database for metadata. We will also cover how the NSM produced data can be used to do matching on past traffic when new IOCs are added. And finally we will present IOCMite an open source tool linking MISP and Suricata in both direction using the dynamic nature of dataset. false Slides https://pretalx.com/hack-lu-2023/talk/GVL7FM/ https://pretalx.com/hack-lu-2023/talk/GVL7FM/feedback/ Salle Europe Talk 2023-10-17T15:30:00+02:00 15:30 00:30 Post Exploitation Frameworks are not only the swiss army knife for Red Teamers, but also in heavy use by cybercriminals and even state actors. Many artifacts, like Beacons/Badgers or Stage Loaders end up on platforms like VirusTotal. Tired of the many manual process steps needed to get decent insights about these hunted artifacts the PXF-X framework was born. hack-lu-2023-32667-pxf-x-a-modular-python-framework-to-hunt-extract-and-enrich-post-exploitation-framework-artifacts cti-summit Joel Doenne en PXF-X should fully automate all the required analysis steps. In essence, this means: 1) artifacts are hunted with VirusTotal Livehunting YARA rules, 2) the samples are then obtained and analyzed in several ways, 3) the extracted information is then enriched by different intelligence sources and reconnaissance methods. PXF-X is designed in a modular way. The intention is that various modules can be integrated sucessively. Currently three different Frameworks are supported: Meterpreter, Cobalt Strike and Brute Ratel C4. A bunch of others are in the makings. true https://pretalx.com/hack-lu-2023/talk/HNAUGB/ https://pretalx.com/hack-lu-2023/talk/HNAUGB/feedback/ Salle Europe Talk 2023-10-17T16:15:00+02:00 16:15 00:30 Nowadays structured firmwares can be a complete OS with thousands of files. It usually requires several hours to find the links between some components, and it is easy to get lost in this mass of information. This talk will introduce how we have combined and extended already existing open-source solutions to solve this issue and help reversers in their daily tasks. The resulting tool, Pyrrha, allows users to visualize the different binaries and libraries of the firmware and their interactions in the form of several dependency graphs. hack-lu-2023-35391-pyrrha-navigate-easily-into-your-system-binaries cti-summit Eloïse Brocas en Pyrrha is an extension of Sourcetrail [1] an open-source code source explorer (for c/cpp, Python, and Java). This extension uses LIEF [2] to analyze imports and exports of each library and binary of the firmware and create links between them. The result is exported as a sourcetrail database. Thanks to Sourcetrail UI, the user will be able to navigate and search in the resulting firmware mapping. Pyrrha has been open-sourced and is available on GitHub: https://github.com/quarkslab/pyrrha [1] https://github.com/CoatiSoftware/Sourcetrail [2] https://lief-project.github.io/ false https://pretalx.com/hack-lu-2023/talk/WVFPNK/ https://pretalx.com/hack-lu-2023/talk/WVFPNK/feedback/ Salle Europe Talk 2023-10-17T16:45:00+02:00 16:45 00:30 Telecom operators are at the heart of our societies, and all the citizens have a mobile phone today, which makes the operators an ideal target. This presentation will get more in depth into specific threat actors which are supporting the work of global surveillance companies. hack-lu-2023-33889-threat-actors-surveillance-companies-targeting-telecom-operators cti-summit Alexandre de Oliveira en Telecom operators are at the heart of our societies, and all the citizens have a mobile phone today, which makes the operators an ideal target. This presentation will get more in depth into specific threat actors which are supporting the work of global surveillance companies and attacking all operators around the world. We will go over the investigations we have conducted on attacks targeting the operators of many countries across the globe and the impact for the populations and national security of these countries. true https://pretalx.com/hack-lu-2023/talk/P8KXTK/ https://pretalx.com/hack-lu-2023/talk/P8KXTK/feedback/ Salle Europe Talk 2023-10-17T17:15:00+02:00 17:15 00:20 Crowdsec is building the largest CTI, crowdsourced by an open source security engine solution. With the help of machine learning algorithms, we analyze this data to detect and classify cyber threats in near real time. hack-lu-2023-36575-how-crowdsec-is-building-a-collaborative-trustable-and-crowdsourced-cti-to-change-the-cybersecurity-landscape cti-summit /media/hack-lu-2023/submissions/XHLVWG/CrowdSecx280_fRMMTFn.png Matthieu Mazzolini en Over the past years CTI has evolved from a simple blocklist to a more end-to-end approach. Learn about the crowdsourced approach to achieving this CTI thanks to using an open-source security engine that detects & blocks more than 150 behaviors across a network of 60k nodes spread all over the globe, ensuring that the CTI system is continually updated with the latest information & can respond quickly to new threats. You will also get insights on the data that builds this next-generation CTI & see examples of DDOS events, CVEs blocked, & a description of malicious actors reported on the Internet. To conclude you will get insights of machine learning applications to classify IP addresses based on their behavior. false https://pretalx.com/hack-lu-2023/talk/XHLVWG/ https://pretalx.com/hack-lu-2023/talk/XHLVWG/feedback/ Salle Europe Talk 2023-10-17T17:35:00+02:00 17:35 00:20 In cybersecurity, CTI and SOC teams often seat next to each other. The CTI team accumulates impressive amount of threat intelligence including technical IOCs. On SOC side even more impressive amount of data is collected in data lakes even now data oceans (logs, telemetry, network flow or traffic, etc.). MISP has been available for years as a Threat Intelligence platform and had highly facilitated sharing across the security community, mainly between CTI teams. In particular, MISP allows an organisation to have IOC data set ready to be used. Still SOC teams rather often struggle to consume those IOCs into their monitoring and detection platforms and event more to feed back into MISP for new findings or sightings from the alerts or retro searches run on the SOC platforms. MISP42 is an open-source app developed to help SOC teams using Splunk platform to make the use of IOCs in MISP an easy workflow that can be automated. hack-lu-2023-35046-misp42-connecting-cti-and-soc-teams cti-summit Remi Seguy en The presentation will present the challenges CTI and SOC team may have in using in an actionable way IOCs on the monitoring and detection platforms to introduce why MISP42 was developed for Splunk (it was the main platform of the SOC at the time). Then the 2 main use cases will be detailed with practical examples - use MISP IOC into Splunk for hunting, retrosearch, threat activity or detection enrichment. - use findings/matches on Splunk to create new events or increment sightings factors and finally illustrate the swiss-knife concept of MISP42 (one command designed to be a wrapper of MISP REST API) false https://pretalx.com/hack-lu-2023/talk/99YBB9/ https://pretalx.com/hack-lu-2023/talk/99YBB9/feedback/ Salle Europe Talk 2023-10-17T17:55:00+02:00 17:55 00:30 [Yeti](https://github.com/yeti-platform/yeti) is an opensource platform dedicated to the curation and management of operational threat intelligence, geared towards incident responders and forensic practitioners. It's written in Python and maintained since ~2017. It consists of several modules: - a graph database & search engine - a threat feed ingestion engine - a data enrichment module (e.g. sandbox information, domain resolution, IOC extraction...) - Signature management (YARA, Sigma, etc.) - High-level entity management (Threat actors, TTPs, Campaigns) to tie everything together in a neat graph database. Yeti has existed since 2017, and is used both in industry and academia, and has recently been undergoing several big changes, which we would like to present at CTI-Summit 2023: hack-lu-2023-33639-yeti-old-dog-new-tricks cti-summit Thomas ChopiteaSébastien Larinier en We are going to tell the story of Yeti, why it was created, where it's now, and about all the friends we made along the way. Besides the new DFIR twist we want to give Yeti, we'll highlight some of the major changes in the codebase: - Total revamp of the Web UI using VueJS. - Backend migration to ArangoDB (graph database) - Code health: Python typing, e2e tests, making development faster and more reliable, and making community contributions much easier. - Production and development Docker images - Integration with third-party OSS tools such as Timesketch and Turbinia. false paper https://pretalx.com/hack-lu-2023/talk/JAKAKS/ https://pretalx.com/hack-lu-2023/talk/JAKAKS/feedback/ Schengen 1 and 2 Training 2023-10-17T14:00:00+02:00 14:00 02:00 It is time consuming and frankly moderately interesting to handle the submission and treatment of spams and phishing things people would like to report to you, either because it is your job or because your that person who knows computer in your family or friends group. In this workshop, we will see show how to integrate opensource tools that will make your life easier, empower the people reporting thing to you, and hopefully reduce your work load. hack-lu-2023-35420-0-managing-spam-phishing-and-other-boring-tasks-with-your-users-and-constituents cti-summit Raphaël Vinot en Please make sure before attending this workshop that you can install python 3 software on your device, and your device should preferably be running Ubuntu 22.04 or more recent. As the workshop is relatively short and depending on how many people will attend, we may not have time to do a lot of sysadmin work during the workshop. The tools we will use are the following: * Lookyloo (to analyze URLs) * Pandora (to analyze files) * Lacus (optionally, to capture the URLs when you have a lot of them) * An URL monitoring interface (to compare a specific URL over time) * Phishtank Lookup (to check if a URL is known or not) We will also see how to integrate Lookyloo and Pandora to handle the cases where the URL points to a file, and where the file is a web document, or it contains URLs. Integration with 3rd party services: * MISP (to share the indicators) * Ticketing system (to manage interactions with other entities, typically take down requests) * Validate if URL is known with VirusTotal, PhishtankLookup, URLScan, URLHaus * Validate if a file is known with Virustotal, ManwareBazaar, HybridAnalysis, MwDB, JoeSandbox * Add contextual information with SaneJS, uWhoisd, Hashlookup false https://pretalx.com/hack-lu-2023/talk/UCRUZT/ https://pretalx.com/hack-lu-2023/talk/UCRUZT/feedback/ Schengen 1 and 2 Training 2023-10-17T16:30:00+02:00 16:30 02:00 This workshop offers an introduction to Blockchain/Web3 OSINT, including extracting and analyzing on-chain and off-chain data. hack-lu-2023-35259-cryptocurrency-web3-osint-workshop cti-summit Patrick VentuzeloTanguy LaucournetMohammed Benhelli en This workshop offers a practical understanding of Blockchain, Smart Contracts, DApps, and NFTs. Participants will learn the basics of Web3 OSINT, including extracting and analyzing on-chain and off-chain data. The workshop also provides a guide to important websites and tools, with a focus on the process of linking and verifying information. It's an opportunity to enhance your skills within the realm of cryptocurrency and Web3. false https://pretalx.com/hack-lu-2023/talk/7KYDJW/ https://pretalx.com/hack-lu-2023/talk/7KYDJW/feedback/ Echternach&Diekirch Workshop 2023-10-17T10:30:00+02:00 10:30 01:30 Stop the countdown timer and dismantle the bomb by cutting the correct cable. hack-lu-2023-32590-0-dismantle-the-bomb hack.lu Stijn Tomme en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timers starts the mission (75 minutes) Goal is to stop the countdown timer connected to a bomb fixed on a 10l white paint bucket false https://pretalx.com/hack-lu-2023/talk/UDFFNS/ https://pretalx.com/hack-lu-2023/talk/UDFFNS/feedback/ Echternach&Diekirch Workshop 2023-10-17T14:00:00+02:00 14:00 01:30 Stop the countdown timer and dismantle the bomb by cutting the correct cable. hack-lu-2023-32590-1-dismantle-the-bomb hack.lu Stijn Tomme en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timers starts the mission (75 minutes) Goal is to stop the countdown timer connected to a bomb fixed on a 10l white paint bucket false https://pretalx.com/hack-lu-2023/talk/UDFFNS/ https://pretalx.com/hack-lu-2023/talk/UDFFNS/feedback/ Echternach&Diekirch Workshop 2023-10-17T16:30:00+02:00 16:30 01:30 Stop the countdown timer and dismantle the bomb by cutting the correct cable. hack-lu-2023-32590-2-dismantle-the-bomb hack.lu Stijn Tomme en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timers starts the mission (75 minutes) Goal is to stop the countdown timer connected to a bomb fixed on a 10l white paint bucket false https://pretalx.com/hack-lu-2023/talk/UDFFNS/ https://pretalx.com/hack-lu-2023/talk/UDFFNS/feedback/ Hollenfels Training 2023-10-17T09:00:00+02:00 09:00 03:00 On basis of a proprietary crypto library that was used for "securely" storing medical history, I like to give an introduction into reverse engineering cryptographic functions by three different approaches: Blackbox, dynamic instrumentation with Frida and static analysis with Ghidra. hack-lu-2023-33988-three-ways-to-reverse-engineering-cryptographic-functions cti-summit Finn Steglich en Outline: 0. Environment: We have an encryption tool, some libraries an already encrypted, secret file. 1. Black box: Just by using the encryption tool, what can we infer about the used primitives, keys, IVs etc.? Misusing the issues and stream cipher properties, we can even get parts of the keystream and start decrypting content. 2. Dynamic analysis with Frida: By hooking the right OLE functions, we understand what library calls are used and what the obfuscated static passphrase is, that the application uses. 3. Static analysis with Ghidra: To confirm our assumptions about the primitives and to understand the key derivation, we dive into the libraries with Ghidra, detect indicators for common crypto and reconstruct what they do. 4. In the end, we can implement a version of the cryptographic function including the key derivation in python, and reverse it to decrypt the secret file. Target audience: People interested in reverse engineering with some prior understanding but no required experience in the field. Some programming experience assumed (C++ or similar for understanding objects in ghidra, python for the script at the end, JavaScript for Frida). Software requirements: Windows (VM) with admin rights, python, Frida and Ghidra installed -- or -- VirtualBox and about 50 GB of free space to use a provided VM true https://pretalx.com/hack-lu-2023/talk/UUS37B/ https://pretalx.com/hack-lu-2023/talk/UUS37B/feedback/ Hollenfels Training 2023-10-17T14:00:00+02:00 14:00 04:00 Command & Control is a cornerstone of any attacker's infrastructure, whether they are affiliated with state actors (APTs), cybercriminals, or legitimate Red Team operators. "Customize Your Own C&C" is a 4-hour workshop designed for those interested in quickly diving into the world of Command & Control design and architecture, and learning how to develop their own implant using a well-known open-source framework. In this bring-your-own-laptop workshop, participants will have the opportunity to learn about the architecture and design of a well-known open-source framework as an example. They will also receive a comprehensive, hands-on introduction to designing a simple custom implant. This will involve working with two already prepared virtual machines and culminating in the creation of their own integrated x64 implant (utilizing a C++/Python wrapper) hack-lu-2023-37541-customize-your-own-command-control-design-and-code-your-own-implant-in-a-real-infrastructure cti-summit Guillaume PrigentAdrien Barchapt-Perrot en Command & Control is a cornerstone of any attacker's infrastructure, whether they are affiliated with state actors (APTs), cybercriminals, or legitimate Red Team operators. "Customize Your Own C&C" is a 4-hour workshop designed for those interested in quickly diving into the world of Command & Control design and architecture, and learning how to develop their own implant using a well-known open-source framework. In this bring-your-own-laptop workshop, participants will have the opportunity to learn about the architecture and design of a well-known open-source framework as an example. They will also receive a comprehensive, hands-on introduction to designing a simple custom implant. This will involve working with two already prepared virtual machines and culminating in the creation of their own integrated x64 implant (utilizing a C++/Python wrapper) true https://pretalx.com/hack-lu-2023/talk/GAKCQP/ https://pretalx.com/hack-lu-2023/talk/GAKCQP/feedback/ Vianden&Wiltz Training 2023-10-17T14:00:00+02:00 14:00 02:00 An Introduction to ARM64 Assembly and Shellcode is a workshop for those interested in getting a quick start into the world of 64-bit ARM binary exploitation. ARM64 is in several ways vastly different than ARM32. In this bring-your-own-laptop workshop, participants will get to learn the key differences between ARM32 and ARM64 from an assembly language perspective, get some hands-on introduction to writing simple ARM64 assembly code, working with a debugging environment and concluding with writing their own ARM64 shellcode. hack-lu-2023-31688-an-introduction-to-arm64-assembly-and-shellcode cti-summit Saumil Shah en AN INTRODUCTION TO ARM64 ASSEMBLY AND SHELLCODE WORKSHOP AGENDA - An introduction to ARM64 architecture and assembly - Working with an emulated ARM64 instance - Fundamental differences between ARM32 and ARM64 assembly - The 64-bit process memory layout and addressing - The ARM64 debugging environment - Exploring memory corruption bugs on ARM64 - Practical ARM64 shellcode To participate interactively in this hands-on workshop, please bring with you: - A Linux/macOS system with Docker installed and running To make the most out of the workshop, it would be awesome if you have: - Familiarity with Intel x86 or ARM32 Assembly Language - Basic experience with disassembly and reverse engineering - A working knowledge of GDB - The ability to write simple Python scripts false https://pretalx.com/hack-lu-2023/talk/XTDTNH/ https://pretalx.com/hack-lu-2023/talk/XTDTNH/feedback/ Vianden&Wiltz Training 2023-10-17T16:30:00+02:00 16:30 02:00 YARA is a commonly used tool to detect and identify malware. There are roughly two types of YARA rules used on binary files: 1) based on metadata and strings and 2) based on code. There are certain benefits by basing YARA rules on code. Since code reuse is frequent amongst binaries of a malware family, it offers plenty of options to base a YARA rule on. If the chosen code is heavily reused amongst the binaries, then it can result in very robust rules. This approach comes with certain challenges. A key aspect is being able to find heavily reused code amongst many binaries of a malware family. Unless some sort of automation is at play, this quickly becomes difficult and time-consuming. Once suitable reused code is identified, it needs to be turned into a YARA rule, so that it works even when compiler differences, optimizations or instruction set changes are involved. In this workshop we will create robust YARA rules for a handful of malware families based on automatically identifying shared code between many binaries of a family. hack-lu-2023-33995-using-systematic-code-reuse-analysis-to-create-robust-yara-rules cti-summit Jonas WagnerCarlos Rubio Ricote en **Required prior knowledge** This workshop is tailored to cybersecurity practitioners that either actively create malware detection and identification rules with YARA or intend to start doing so. Participants must be familiar with: - Basic understanding of YARA rules - Basic knowledge of static binary analysis with disassemblers - Basic knowledge of the x86/x64 instruction set **Required system setup** - Recommended OS: Ubuntu - CPU Arch: Intel 32/64-bit (ARM not supported) - Minimum of 8GB RAM, 16GB recommended - Minimum of 100GB free disk space, 150GB recommended **Background** YARA is a commonly used tool to detect and identify malware. There are roughly two types of YARA rules used on binary files: 1) based on metadata and strings and 2) based on code / instruction sequences. There are benefits by basing YARA rules on code. Since code reuse is frequent amongst binaries of a malware family, it offers plenty of options to base a YARA rule on. If the chosen code is stable across multiple variants of a malware, then it can result in very robust rules. This approach comes with certain challenges. A key aspect is being able to find stable / heavily reused code amongst many binaries of a malware family. Unless some sort of automation is at play, this quickly becomes difficult and time- consuming. Once suitable reused code is identified, it needs to be turned into a YARA rule, so that it works even when compiler differences, optimizations or instruction set changes are involved. Addressing these challenges and adding some automation along the way, enables the creation of robust YARA rules with less manual effort. **Workshop content** The goal of this workshop is to create robust YARA rules for a handful of malware families based on automatically identifying shared code between many binaries of a family. The approach includes the following parts: - Study a set of good and bad examples of existing YARA rules to provide some background. - Pre-process a set of malware binaries, as well as goodware binaries to make their code searchable on the granularity of a function. - We automatically identify which functions are reused frequently for a malware family. - We need to exclude functions that are part of compilers, libraries or other malware families to avoid creating false positives. - From the set of reused functions, we will extract instruction sequences to create YARA rules with. - We will vet our new rules against the corpus of binaries to check for false positives and adjust the rule creation accordingly. We will look at the following real-world challenges: - All binaries share library code from the compiler or 3rd party libraries. This code is not useful for malware identification and will need to be filtered out during the process. - How to reliably generate a YARA rule from a set of instruction sequences. - We need to make choices on how many and which instructions of a function and how many functions in total we want to consider building a Yara rule. A good balance has to be found. - The quality of the function similarity algorithm is crucial in finding the right matches. Especially since compiler versions, compiler optimization flags and instruction set differences have to be considered. - The quality of the disassembler in detecting functions and their content strongly influences the quality of results. During the workshop, we will be exclusively using open source tools and a set of publicly available binaries in unpacked form. The takeaways for the participants of this workshop are: - Understanding the differences between good and bad YARA rules, be it based on code or based on strings/metadata. - Understanding the code reuse approach to YARA rules writing, with its benefits and challenges. - Understanding of the tooling required to identify code reuse over many binaries. - Understanding how to apply this process to real-world malware. true https://pretalx.com/hack-lu-2023/talk/GL99GV/ https://pretalx.com/hack-lu-2023/talk/GL99GV/feedback/ Salle Europe Talk 2023-10-18T09:00:00+02:00 09:00 00:30 Cyber capabilities have been used for military purposes for more than two decades. But the digital operational area of States is no longer limited to cyber operations. In line with the global trend toward digitalization of our societies, armed forces around the world are developing innovative strategies to exploit the digital sphere in more complex ways than ever before. As a result of these developments, the line between civilians and combatants as well as between civilian objects and military targets, is in danger of becoming blurred. In particular, it is now easier than ever to involve civilians in military cyber operations and to harm them using these means. And the more the military is relying on cables, satellites or clouds that are originally designed for civilian use, the more likely it becomes that this infrastructure will be exposed to harm during armed conflicts, with significant adverse consequences on civilians. hack-lu-2023-37540-how-digital-technologies-are-redefining-warfare-and-why-it-matters hack.lu Mauro Vignati en Cyber capabilities have been used for military purposes for more than two decades. But the digital operational area of States is no longer limited to cyber operations. In line with the global trend toward digitalization of our societies, armed forces around the world are developing innovative strategies to exploit the digital sphere in more complex ways than ever before. As a result of these developments, the line between civilians and combatants as well as between civilian objects and military targets, is in danger of becoming blurred. In particular, it is now easier than ever to involve civilians in military cyber operations and to harm them using these means. And the more the military is relying on cables, satellites or clouds that are originally designed for civilian use, the more likely it becomes that this infrastructure will be exposed to harm during armed conflicts, with significant adverse consequences on civilians. false https://pretalx.com/hack-lu-2023/talk/TEUHBF/ https://pretalx.com/hack-lu-2023/talk/TEUHBF/feedback/ Salle Europe Talk 2023-10-18T09:30:00+02:00 09:30 00:30 Volexity has recently uncovered ongoing campaigns by EvilEye, a Chinese state-backed threat actor, targeting three of the five groups the Chinese Communist Party (CCP) refers to as the “Five Poisons”. The targeted groups are members of the Tibetan community, the Uyghur ethnic group, and Taiwanese nationals. Volexity's research has identified both currently active and historic activity for these campaigns. Volexity also identified related campaigns from this threat actor specifically targeting the Uyghur ethnic group back in 2019 and 2020. The ongoing campaigns consist of two elements, malicious mobile applications and fake websites, which are created by the attacker to facilitate exploitation of end users by way of zero or n-day exploits. The three Android malware families being deployed include new versions of BADBAZAAR, as well as two previously undocumented families. In addition to these Android malware families, there is compelling evidence that EvilEye has developed an iOS implant and tried to distribute it via the Apple App Store. This presentation outlines the current, ongoing campaigns; delves into the technical details of the Android malware families involved; discusses the threat actor's command-and-control (C2) infrastructure and configuration; and reveals how the threat actor builds communities to distribute their malware through trusted platforms. The presentation also explores overlaps between the campaigns and explains links to historic activity. hack-lu-2023-33828-ongoing-evileye-campaigns-targeting-ccp-adversaries hack.lu Rascagneres Paul en Everything is in the abstract. false https://pretalx.com/hack-lu-2023/talk/ZBRV3J/ https://pretalx.com/hack-lu-2023/talk/ZBRV3J/feedback/ Salle Europe Talk 2023-10-18T10:00:00+02:00 10:00 00:30 VPN Always-On is a security control that can be deployed to mobile endpoints that remotely access corporate resources through VPN. It is designed to prevent data leaks and narrow attack surface of enrolled end-user equipment connected to untrusted networks. When it is enforced, the mobile device can only reach the VPN gateway and all connections are tunnelled. We will review the relevant Windows API, the practicalities of this feature, look at popular VPN software ; we will then consider ridiculously complex exfil methods and... finally bypass it with unexpectedly trivial tricks. We will exploit design, implementation and configuration issues to circumvent this control in offensive scenarios. We will then learn how to fix or harden VPN Always-On deployment to further limit the risks posed by untrusted networks. hack-lu-2023-31837-defeating-vpn-always-on hack.lu Maxime Clementz en This talk is more than just the outcome of my technical research against one particular network security feature. It is an attempt to fully embrace the hacker spirit through the revolt against Control, the unreasonable time trying to understand the technological subtleties and finally the sharing of beautifully simple techniques to break free. false https://pretalx.com/hack-lu-2023/talk/JXGQJJ/ https://pretalx.com/hack-lu-2023/talk/JXGQJJ/feedback/ Salle Europe Talk 2023-10-18T10:30:00+02:00 10:30 00:30 Since the beginning of the Ukrainian invasion, we have seen a renaissance of innovation making threats to operational technology (OT) systems more streamlined than ever before. Such activity is reflected in a quick turnaround in the development of malware and capabilities to target OT systems. In this talk, I will provide an overview of the evolution of OT threats since the eve of Ukraine’s invasion and discuss its implications for defenders. Among other topics, I will share recent findings about documentation hinting on Russia’s development of OT cyber capabilities, and newly disclosed OT malware families such as INCONTROLLER, INDUSTROYER.V2 and COSMICENERGY. hack-lu-2023-33819-the-renaissance-of-cyber-physical-offensive-capabilities hack.lu Daniel Kapellmann Zafra en For the last ten years we have seen a fast evolving operational technology (OT) security community learning about cyber physical attacks and how to defend against them. However, since the beginning of the conflict in Ukraine, we have seen a twist in the OT threat landscape. A renaissance or breakthrough period of innovation is making threats to cyber physical systems more streamlined and common than ever before. During the conflict, we have observed the intensification of threat activity coming from different fronts, including criminals, hacktivists, and nation-states. Such activity has resulted in a quick turnaround in the development of malware and capabilities to target OT systems. In this talk, I will provide an overview of the evolution of OT threats focusing primarily on new capabilities we have observed since the eve of Ukraine’s invasion. Among other things, I will discuss recent leaked documents hinting on Russia’s development of OT cyber capabilities, and the recent disclosure of highly specialized malware including INDUSTROYER2, INCONTROLLER, and most recently COSMICENERGY. Using our findings, I will also discuss the implications for defenders in the light of this new era of discovery of cyber physical offensive capabilities. false COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises Contracts Identify Cyber Operations Projects from Russian Company NTC Vulkan https://pretalx.com/hack-lu-2023/talk/JTAB9A/ https://pretalx.com/hack-lu-2023/talk/JTAB9A/feedback/ Salle Europe Talk 2023-10-18T11:00:00+02:00 11:00 00:45 This talk presents a strict analysis of technology, policy, international law, and cyberwarfare, focusing on the realities of armed conflict in cyberspace. Ukraine and other events in Central Eastern Europe will provide food for thoughts and a case study. The main premise is grounded in sound analysis of rules, strategies, and the mechanics of conflicts. Some relevant points to consider follow. What’s the relevance to the armed conflict areas? What’s the relevance to the countries non-neutral in a conflict? Should companies prepare in any way, and if so, how? Are there particular risk to IT companies, IT administrators, developers, software engineers, security engineers? hack-lu-2023-31211-introduction-to-cyberwarfare-theory-and-practice hack.lu Lukasz Olejnik en This talk presents a strict analysis of technology, policy, international law, and cyberwarfare, focusing on the realities of armed conflict in cyberspace. Ukraine and other events in Central Eastern Europe will provide food for thoughts and a case study. The main premise is grounded in sound analysis of rules, strategies, and the mechanics of conflicts. Some relevant points to consider follow. What’s the relevance to the armed conflict areas? What’s the relevance to the countries non-neutral in a conflict? Should companies prepare in any way, and if so, how? Are there particular risk to IT companies, IT administrators, developers, software engineers, security engineers? Ukraine war highlights the importance of cyberware. Yet, the reality may appear different from prior conceptions or expectations. true https://pretalx.com/hack-lu-2023/talk/QYPDSN/ https://pretalx.com/hack-lu-2023/talk/QYPDSN/feedback/ Salle Europe Lightning talk 2023-10-18T13:30:00+02:00 13:30 00:05 It's made possible by today's open-source community, and a vast number of people are now rethinking the way we learn. Let's engage with this! hack-lu-2023-38142-you-can-learn-anything hack.lu lightning talk Pauline Bourmeau (Cookie) en Lightening false https://pretalx.com/hack-lu-2023/talk/GRKRS9/ https://pretalx.com/hack-lu-2023/talk/GRKRS9/feedback/ Salle Europe Lightning talk 2023-10-18T13:35:00+02:00 13:35 00:05 In this talk we showcase how to interact with a Velociraptor server from Tenzir pipelines, speeding up DFIR work by flexibly processing the output of hunts. hack-lu-2023-38148-velocity-raptor-accelerating-velociraptor-hunting-with-tenzir-pipelines hack.lu lightning talk Matthias Vallentin en In this talk we showcase how to interact with a Velociraptor server from Tenzir pipelines, speeding up DFIR work by flexibly processing the output of hunts false https://pretalx.com/hack-lu-2023/talk/DZKRNU/ https://pretalx.com/hack-lu-2023/talk/DZKRNU/feedback/ Salle Europe Lightning talk 2023-10-18T13:40:00+02:00 13:40 00:05 Introducing 🌊**TIDeMEC** : _Threat Informed Detection Modelling and Engineering as Code_ , the platform powering DIGIT S2 CATCH Detection Engineering operations planned to go open source for the benefit of the European and beyond SOC community. hack-lu-2023-38147-tidemec-a-detection-engineering-platform-homegrown-at-the-european-commission hack.lu lightning talk /media/hack-lu-2023/submissions/XNQD37/Screenshot_2023-10-15_151051_yv8fpwf.png Amine Besson en TIDeMEC is a platform that has been built for the better part of the past 2 years at the EC, and builds on top of years of astute observations of what goes **wrong** in the detection engineering field. It is an opinionated end-to-end platform, data model, framework and solution built on top of DevOps and as-code principles, with an emphasis on traceability, consistency, safety and automation. The data model of TIDeMEC scales from the input of a threat intelligence signal to the deployment of a detection rule whilst maintaining programmatic relations between actors, threat, detection objectives, and rules. We will also lay the plans for TIDeX , a potential exchange built on top of the TIDeMEC data objects with the vision to connect SOCs with precise and actionable knowledge objects. true https://pretalx.com/hack-lu-2023/talk/XNQD37/ https://pretalx.com/hack-lu-2023/talk/XNQD37/feedback/ Salle Europe Lightning talk 2023-10-18T13:45:00+02:00 13:45 00:05 Deming is a tool for managing, planning, tracking and reporting the effectiveness of security controls. hack-lu-2023-38143-deming-isms-open-source hack.lu lightning talk /media/hack-lu-2023/submissions/39NCZQ/oie_transparent_8e3prkk.png Didier Barzin en Deming is an Open Source tool designed to help CISOs set up and maintain their information security management system. Using this application, CISOs can easily plan and track the implementation of security controls and the continuous improvement cycle required by ISO 27001. The application is designed to be easy to use and customize, with a intuitive user interface. false Slides https://pretalx.com/hack-lu-2023/talk/39NCZQ/ https://pretalx.com/hack-lu-2023/talk/39NCZQ/feedback/ Salle Europe Lightning talk 2023-10-18T13:50:00+02:00 13:50 00:05 Lightning Talk - A quick intro of the Belgian Military Cyber Reserve. hack-lu-2023-38139-belgian-cyber-reserve-forces hack.lu lightning talk Christophe Vandeplas en A quick intro of the Belgian Military Cyber Reserve. false https://pretalx.com/hack-lu-2023/talk/BNJJVZ/ https://pretalx.com/hack-lu-2023/talk/BNJJVZ/feedback/ Salle Europe Lightning talk 2023-10-18T13:55:00+02:00 13:55 00:05 Until now, two worlds have mostly ignored each others: the resolution of a software package dependency tree or graph to meet functional constraints and the search for package versions are not subject to known, published vulnerabilities (aka. CVEs) . What if we could combine the functional version range constraints from software developers with the known vulnerable version ranges from security specialist? hack-lu-2023-38156-non-vulnerable-package-dependency-resolution hack.lu lightning talk Philippe Ombredanne en Software package ecosystems such as Maven, npm and PyPI as well as Linux distros define rich conventions to document package metadata and dependency relationships and constraints. Vulnerability databases define which range of a package versions are subject to a known vulnerability. Until now, these contexts have been considered separately. - package management tools resolve the version expression of the dependent package of a package to resolved versions in order to install the selected versions. - security tools check if resolved package versions are affected by known vulnerabilities (even when integrated in a package management tool) This leads to duplicated efforts and either to the resolution of a vulnerable dependency graph; or vulnerability remediation that ignore functional constraints and may demand significant code refactoring. We propose a new approach to resolve software package vulnerable version ranges and dependency version constraints together. The obvious benefit is that you get both at once: non-vulnerable code and up-to-date code, and this is something that is not currently done by software package managers nor by security check tools. This is made possible because of a universal syntax to identify packages called Package URL, a universal notation for version ranges that support equally the functional constraints and the vulnerable ranges, and an on-demand dependency resolver that can use these as inputs. And also a vulnerability database that is keyed by Package URLs. false Slides https://pretalx.com/hack-lu-2023/talk/Z7UP7B/ https://pretalx.com/hack-lu-2023/talk/Z7UP7B/feedback/ Salle Europe Talk 2023-10-18T14:00:00+02:00 14:00 00:30 With the increasing adoption of the embedded SIM (eSIM) or embedded Universal Integrated Circuit Card (eUICC), new connectivity opportunities and conveniences are emerging for users. However, with these advances emerge new potential vulnerabilities and security implications. This presentation will shed light on the yet unexplored attack surface of eSIM technology and highlight the potential risks and challenges of this now widely deployed technology. Support for eSIM is now available in modern mobile phones and also in popular desktop devices such as Lenovo Thinkpads running Microsoft Windows 10 and 11. By exploring the intricacies of eSIM security, we aim to raise awareness to the potential for offensive operations serving as technology but also in terms of post compromise situations. hack-lu-2023-35678-embedded-threats-a-deep-dive-into-the-esim-world hack.lu Markus Vervier en This talk is posed to be the 2023 continuation of a talk called "Mobile Authentication Subspace Travel"[^1] given in 2015 at different security conferences. The main point of this talk was to implement what is nowadays called an eSIM by patching the baseband of popular MediaTek phones and to explore the relation of mobile network security, SIM card modules, and the baseband attack surface they pose. Fast-foward to 2023, eSIMs are now a featured standard by the GSMA and present in all modern devices. On top of this, they are now present on Desktop systems such as Microsoft Windows as well. The talk will highlight the security aspects of eSIMs by covering the following topics: 1. Overview of the eSIM attack surface in desktop systems and a comparison with mobile operating systems: We will begin the talk with a comprehensive overview of the attack surface of eSIM technology in desktop systems, addressing the differences and similarities with mobile operating systems. This analysis will address the unique challenges and vulnerabilities that arise from the rather complex architecture and implementation of eSIMs on desktop and mobile platforms, and highlight the need for a comprehensive understanding of the potential risks in both environments. Especially the risks in a multi-user Enterprise environment will be covered. 2. Secure deployment of eSIM profiles (from SM-DP+ to hardware eSIM): Secure deployment of eSIM profiles is a critical component of maintaining the overall security of the mobile networks, but also of the actual hardware devices as well as operating systmes. We will discuss the process from the Subscription Manager - Data Preparation Plus (SM-DP+) server and how the profiles are dployed to the hardware eSIM. By examining key security measures and best practices to ensure the confidentiality, integrity, and availability of eSIM profiles throughout the deployment lifecycle, we will show potential risks arising from profiles originally intended for debugging purposes only and also test if the security mitigations intended by the GSMA to keep control over the eSIM ecosystem are actually effective.. 3. Attack surface on Windows and the Local Profile Assistant (LPA) service in the light of privilege escalation attacks: To investigate security implicatoins on Windows Desktop systems, we will examine the local attack surface, focusing on the Local Profile Assistant (LPA) service and its potential role in privilege escalation attacks both in an organization and on the local system. We will outline the potential vulnerabilities and attack vectors that can be exploited by attackers to gain unauthorized access and elevated privileges within the system, emphasizing the importance of securing the LPA service and its associated components. 4. Use of eSIMs in offensive red-teaming operations: Finally, we will explore the innovative ways in which eSIM technology can be used in offensive red-teaming operations to simulate sophisticated cyber threats and assess an organization's overall security posture. This section will present real-world examples and scenarios that demonstrate how eSIMs can be used to circumvent traditional security measures, exfiltrate sensitive data, and compromise network infrastructures. In summary, the rapid adoption of eSIM technology offers a host of new opportunities and conveniences, but also introduces a number of potential vulnerabilities and security issues. By comprehensively examining the attack surface associated with eSIMs and discussing secure deployment practices, local attack vectors, and red-teaming applications, this presentation aims to inspire a proactive approach to securing eSIM technology. It is critical that the cybersecurity community come together and develop robust strategies to mitigate risks and ensure the continued security and reliability of this breakthrough innovation to ultimately promote a more secure and connected world. [1] https://conference.hitb.org/hitbsecconf2015ams/materials/D1T1%20-%20Markus%20Vervier%20-%20Mobile%20Authentication% false https://pretalx.com/hack-lu-2023/talk/JGQCU3/ https://pretalx.com/hack-lu-2023/talk/JGQCU3/feedback/ Salle Europe Talk 2023-10-18T14:30:00+02:00 14:30 00:30 An investigation of the risks of public charging stations, including a POC that charges a phone, mirrors HDMI, and extracts passwords being typed on the mobile device. hack-lu-2023-36175-building-an-evil-phone-charging-station hack.lu /media/hack-lu-2023/submissions/CUKBTG/IMG_0132_VYzVw2Y.jpg Stef van DopTomás Philippart en In April 2023, multiple news articles got published stating, quote, "the FBI warns consumers not to use public phone charging stations". This lead to quite some interesting discussion online. With experts divided on the risks involved. We will briefly go over older attacks (HID devices, usb-ethernet dongles) and how feasable these are, however the main focus of this presentation is investigating the risks of HDMI (and displayport) mirroring, and building a POC to automatically extract data from the video output. We will also release the code for this research project, we hope you can build on top of it! false https://pretalx.com/hack-lu-2023/talk/CUKBTG/ https://pretalx.com/hack-lu-2023/talk/CUKBTG/feedback/ Salle Europe Talk 2023-10-18T15:00:00+02:00 15:00 00:30 Many file formats (like MP3) were designed around a great idea but a very bad format, leading to many hurdles, headaches and mistakes. This talk will introducing the typical mistakes when conceiving a file format, and during its evolution. hack-lu-2023-31194-do-s-and-don-ts-in-file-formats hack.lu /media/hack-lu-2023/submissions/SVEQQ3/File_formats__Dos_and_donts_x0zi7Br.png Ange Albertini en Having dissected [hundreds](https://github.com/corkami/pics/blob/master/binary/README.md) of file formats and come up with many different kinds of abuses, whether they are design-based (polyglots, hash collision...) or parser-based (insert your typical fuzzing crash here), the author is familiar with looking at the typical mistakes when exploring specifications, designing a format, or assessing the security of a parser. false https://pretalx.com/hack-lu-2023/talk/SVEQQ3/ https://pretalx.com/hack-lu-2023/talk/SVEQQ3/feedback/ Salle Europe Talk 2023-10-18T15:30:00+02:00 15:30 00:30 This talk will give a feedback on the deployment of an ACME proxy in front of a private Certificate Authority (CA). I will explain the caveats of our private CA setup and why we decided to add ACME to our corporate CA architecture. I will then expose the expected (and unexpected!) benefits of using this Internet Security protocol inside your corporate network. Finally, some new opportunities proposed by the industry and relying on ACME used inside corporate networks will be covered. hack-lu-2023-36013-acme-benefits-of-deploying-an-internet-security-protocol-inside-your-corporate-network hack.lu Christophe Brocas en This talk will give a feedback on the deployment of an ACME proxy in front of a private Certificate Authority (CA) in a corporate network. I will expose: - our analysis of the shortcomings of our current CA setup (slowness, heaviness, not so robust security controls), - our search to improve our architecture, - why we look at the Internet CA landscape, - why we choose ACME. I will then detailed to the audience: - the expected benefits of having an ACME service inside your corporate ecosystem like robustness or automation opportunities - but also the unexpected ones like non anticipated uses cases provided directly by our IT users or massive ACME appropriation by a wide variety of IT professionals in the company that were not regular users of our original CA setup. And, finally, I will end speaking about new ACME use cases in private networks provided by the IT security industry like the new ACME challenge, device-attest-01, proposed by Google [1] and used by Apple in its Managed Device Attestation [2] solution used to enrolled new corporate private iOS/MacOS/iPadOS devices. [1] https://www.ietf.org/id/draft-acme-device-attest-01.html [2] https://support.apple.com/guide/deployment/managed-device-attestation-dep28afbde6a/web false Slides https://pretalx.com/hack-lu-2023/talk/Q9JHXM/ https://pretalx.com/hack-lu-2023/talk/Q9JHXM/feedback/ Salle Europe Talk 2023-10-18T16:15:00+02:00 16:15 00:30 With the growth of modern media and AI technologies, have you ever wondered what damage could be done if a picture of your eyes ends up in the hands of a malicious user? In this presentation we dive into threats of exposed biometric data, show how the data can be obtained and abused by malicious users, and what damage can be done once their data is exposed. Such compromised identities are already used in financial crimes, to bypass modern security systems and procedures and also in public opinion manipulation campaigns - which can include critical events, street protests, and elections. But the impact of our exposed data is set to go beyond these in the coming years, and in this talk we discuss the difficulties and work-arounds for these emerging threats. hack-lu-2023-33830-your-unknown-twins-identity-in-the-era-of-deepfakes-ai-and-mass-biometrics-exposure hack.lu Vladimir Kropotov en This presentation includes use cases of face, fingerprint and retina biometric exposure, including recordings of live experiments. Finally, we demonstrate how emerging AI technologies can drastically accelerate the ability for criminal users to build a complete identity theft enterprise - where robust digital twins of everyone unfortunate enough to have leaked details are available for all to buy. false https://pretalx.com/hack-lu-2023/talk/VKSLBY/ https://pretalx.com/hack-lu-2023/talk/VKSLBY/feedback/ Salle Europe Talk 2023-10-18T16:45:00+02:00 16:45 00:30 Local file inclusion methods in PHP evolved through time, there are 2 main objectives when exploiting them: - Getting a remote code execution by including files containing PHP via include() or require() functions. - Leak local files such as PHP sources or configuration files via file_get_contents() or file() functions for example. In the past, the following requirements had to be met to exploit a local file inclusion. To exploit a remote code execution you could inject information in log files and include them, or control a variable in your PHP session to poison the session file. But in most cases, you needed to be able to upload a file on the system. To leak local files, it was required to either fully control the path pointing to the file to leak, or to have a path traversal to go up in the file tree. Most importantly, it was mandatory for the server to send you back its content in the response. In both cases, the affected functions support several wrappers, the most iconic being file:// which is a prefix before a file path. Other wrappers such as php://filter can be passed on these methods and for example it was well known to allow leaking PHP sources by base64 encoding them (ex : php://filter/convert.base64-encode/resource=index.php). In a 2021 CTF write-up by loknop , this wrapper was actually proven to be much more useful. Indeed, it allows setting the encoding of contents passing through it, and most importantly to chain an infinite number of encodings leading to the generation of arbitrary data at the start of a file. In this presentation, the full process will be explained with examples allowing, for instance, to generate interesting prefixes to a file content, such as '<?php system("id"); ?>', therefore removing the need to have a file upload when exploiting include() or require() functions to get remote code execution (if the full path is controlled). In 2022, hash_kitten showed that it was also possible to use PHP filters chain as an error-base oracle when used in many built-in functions, such as file_get_contents(). Its method chains encodings that will make the content size of a file exponential, triggering a PHP memory_limit exhaustion. By using other filters, the first character of the file content can also be determined. By using other encodings it is also possible to rotate the chain order to retrieve characters that are located further away in the content. Using this error-based oracle, it is therefore possible to leak the entire file content without having PHP to serve it in a server response. hack-lu-2023-33754-php-filter-chains-how-to-use-it hack.lu /media/hack-lu-2023/submissions/PL3P7Y/prepend_character8_iboDRDB.png Rémi Matasse en This technical talk aims to introduce local file inclusion vulnerabilities on PHP applications. To show why PHP filters chain exploitation can be useful to know during an audit. To illustrate it, we will show vulnerable code samples and ways to patch them. Two tools were developed to exploit it and will also be presented : - https://github.com/synacktiv/php_filter_chain_generator - https://github.com/synacktiv/php_filter_chains_oracle_exploit false https://pretalx.com/hack-lu-2023/talk/PL3P7Y/ https://pretalx.com/hack-lu-2023/talk/PL3P7Y/feedback/ Schengen 1 and 2 Training 2023-10-18T10:00:00+02:00 10:00 02:00 It is time consuming and frankly moderately interesting to handle the submission and treatment of spams and phishing things people would like to report to you, either because it is your job or because your that person who knows computer in your family or friends group. In this workshop, we will see show how to integrate opensource tools that will make your life easier, empower the people reporting thing to you, and hopefully reduce your work load. hack-lu-2023-35420-1-managing-spam-phishing-and-other-boring-tasks-with-your-users-and-constituents cti-summit Raphaël Vinot en Please make sure before attending this workshop that you can install python 3 software on your device, and your device should preferably be running Ubuntu 22.04 or more recent. As the workshop is relatively short and depending on how many people will attend, we may not have time to do a lot of sysadmin work during the workshop. The tools we will use are the following: * Lookyloo (to analyze URLs) * Pandora (to analyze files) * Lacus (optionally, to capture the URLs when you have a lot of them) * An URL monitoring interface (to compare a specific URL over time) * Phishtank Lookup (to check if a URL is known or not) We will also see how to integrate Lookyloo and Pandora to handle the cases where the URL points to a file, and where the file is a web document, or it contains URLs. Integration with 3rd party services: * MISP (to share the indicators) * Ticketing system (to manage interactions with other entities, typically take down requests) * Validate if URL is known with VirusTotal, PhishtankLookup, URLScan, URLHaus * Validate if a file is known with Virustotal, ManwareBazaar, HybridAnalysis, MwDB, JoeSandbox * Add contextual information with SaneJS, uWhoisd, Hashlookup false https://pretalx.com/hack-lu-2023/talk/UCRUZT/ https://pretalx.com/hack-lu-2023/talk/UCRUZT/feedback/ Schengen 1 and 2 Training 2023-10-18T14:00:00+02:00 14:00 01:30 A modern armed conflict has an increasingly elaborate cyber dimension substituting or complementing conventional military operations and originating from both state and non-state parties. Often non-state groups are engaging alongside (and including on behalf of) states in international conflicts without sufficient knowledge of the international law designed to avoid unnecessary harm to civilians and often become victims themselves as de facto parties in a given conflict. They may also deliberately ignore the rules due to sufficiently plausible deniability. Yet, the results of their action to support any of the officially combatant parties, especially targeting civilian objects (including hospitals, schools, community centres etc) might lead to unnecessary casualties as well as otherwise undesirable escalation of the conflict. With a rich choice of examples of such activities in the current conflict in Europe, it seems an important moment to discuss the understanding of ethical limits to non-state actor behaviour in the use of ICTs to ultimately reduce the activity targeting civilians and the chances of undesirable escalation. hack-lu-2023-34026-non-state-actors-cyber-activity-in-armed-conflict-impact-implications-and-remediation hack.lu Deleted UserMauro VignatiElena Rückheim en This session will aim to: - Raise awareness and build knowledge in the community about the potential unwanted consequences of non-state cyber activities and the underlying legal context; - Discuss together with the participants the observed specific TTPs typically used by non-state actors engaged in the cyber dimension of a conflict and the evolving underlying strategies; - Potential mitigation and (self-)restraint measures to avoid civilian targets, unnecessary injury or suffering. E.g. See 8 suggested rules for "civilian hackers" proposed by https://blogs.icrc.org/law-and-policy/2023/10/04/8-rules-civilian-hackers-war-4-obligations-states-restrain-them/ - Long-term effects of the non-state actor engagement ‘banalisation’ - i.e. potential post-conflict consequences of a laissez-faire attitude to the increasingly militarised broader cyber community true https://pretalx.com/hack-lu-2023/talk/GHS8XH/ https://pretalx.com/hack-lu-2023/talk/GHS8XH/feedback/ Echternach&Diekirch Workshop 2023-10-18T09:00:00+02:00 09:00 01:30 Stop the countdown timer and dismantle the bomb by cutting the correct cable. hack-lu-2023-32590-3-dismantle-the-bomb hack.lu Stijn Tomme en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timers starts the mission (75 minutes) Goal is to stop the countdown timer connected to a bomb fixed on a 10l white paint bucket false https://pretalx.com/hack-lu-2023/talk/UDFFNS/ https://pretalx.com/hack-lu-2023/talk/UDFFNS/feedback/ Echternach&Diekirch Workshop 2023-10-18T10:30:00+02:00 10:30 01:30 Stop the countdown timer and dismantle the bomb by cutting the correct cable. hack-lu-2023-32590-4-dismantle-the-bomb hack.lu Stijn Tomme en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timers starts the mission (75 minutes) Goal is to stop the countdown timer connected to a bomb fixed on a 10l white paint bucket false https://pretalx.com/hack-lu-2023/talk/UDFFNS/ https://pretalx.com/hack-lu-2023/talk/UDFFNS/feedback/ Echternach&Diekirch Workshop 2023-10-18T14:00:00+02:00 14:00 01:30 Stop the countdown timer and dismantle the bomb by cutting the correct cable. hack-lu-2023-32590-5-dismantle-the-bomb hack.lu Stijn Tomme en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timers starts the mission (75 minutes) Goal is to stop the countdown timer connected to a bomb fixed on a 10l white paint bucket false https://pretalx.com/hack-lu-2023/talk/UDFFNS/ https://pretalx.com/hack-lu-2023/talk/UDFFNS/feedback/ Echternach&Diekirch Workshop 2023-10-18T16:15:00+02:00 16:15 01:30 Stop the countdown timer and dismantle the bomb by cutting the correct cable. hack-lu-2023-32590-6-dismantle-the-bomb hack.lu Stijn Tomme en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timers starts the mission (75 minutes) Goal is to stop the countdown timer connected to a bomb fixed on a 10l white paint bucket false https://pretalx.com/hack-lu-2023/talk/UDFFNS/ https://pretalx.com/hack-lu-2023/talk/UDFFNS/feedback/ Hollenfels Training 2023-10-18T10:00:00+02:00 10:00 02:00 In this 2 hour workshop, we will use new tools developed by Didier Stevens to deal with malicious Cobalt Strike beacons. There used to be a time, that a blue teamer could say: "this sample I just analyzed is a Cobalt Strike beacon: I'm sure this is a pen test". That is no longer the case: Cobalt Strike has become very popular with common criminals, and even some APT crews. Nowadays, if you encounter a Cobalt Strike sample, your organization is more likely to be under real attack than under simulated attack. hack-lu-2023-33431-analyzing-cobalt-strike-beacons-servers-and-traffic hack.lu Didier Stevens en Didier has developed tools to extract the configuration of Cobalt Strike beacons, to detect Cobalt Strike beacons and to analyze/decrypt Cobalt Strike network traffic. These tools allow you to deal with Cobalt Strike beacons, without having to reverse engineer malicious code. false https://pretalx.com/hack-lu-2023/talk/KRG3WK/ https://pretalx.com/hack-lu-2023/talk/KRG3WK/feedback/ Hollenfels Training 2023-10-18T14:00:00+02:00 14:00 02:00 *pySigma* and *Sigma CLI* are complete rewrites of the legacy *sigmatools* and *sigmac* projects, which will be retired at the end of the year. In this workshop you will learn the new concepts introduced and how these new tools can be used and extended by new target query languages. hack-lu-2023-31911-the-new-sigma-toolchain hack.lu /media/hack-lu-2023/submissions/M9CWW9/Sigma_0.3_u9XI4FY.png Thomas Patzke en This workshop aims to give an introduction to the new Sigma Python toolchain, *pySigma* (the library) and *Sigma CLI* (converter, rule checker, ATT&CK heatmap generator, ...). I will give a brief introduction to some important concepts like plugins, backends and processing pipelines and continue with hands-on exercises: * Discover and install backends and pipelines required for conversion. * Basic conversion of queries. * Building own processing pipelines (e.g. field name mappings). * Rule checking * Creating a MITRE™️ATT&CK heatmap from a rule set. * Creating backends with the cookiecutter template. false https://pretalx.com/hack-lu-2023/talk/M9CWW9/ https://pretalx.com/hack-lu-2023/talk/M9CWW9/feedback/ Hollenfels Workshop 2023-10-18T16:15:00+02:00 16:15 01:30 Linux is an open-source OS; however, performing Threat Hunting on Linux using open-source software (OSS) is not easy, as only a few tools are available and maintained. A port of the well-known Sysmon tool, originally developed for MS Windows, has been made for Linux, but it suffers from several issues. In this presentation, I will introduce a brand-new open-source tool I have been working on for several months. This tool aims to be a Sysmon alternative for Linux and provides several features that Sysmon does not offer. hack-lu-2023-37976-kunai-workshop-your-new-threat-hunting-tool-for-linux hack.lu Quentin JEROME en This workshop aims to introduce the community to Kunai, a new Threat Hunting tool designed specifically for Linux Systems, in addition to the hack.lu talk by the same name false https://pretalx.com/hack-lu-2023/talk/GUNJJH/ https://pretalx.com/hack-lu-2023/talk/GUNJJH/feedback/ Vianden&Wiltz Training 2023-10-18T09:00:00+02:00 09:00 03:00 During almost a decade of our malware analysis experience in cert.pl, we have tried many different approaches. Most of them failed but we have learned a lot about what works and what does not. Finally, after several years of development, we publicly released a bunch of projects that we are proud of: a complete open-source malware repository and analysis platform. The workshop will provide practical hands-on introduction to all aspects of the platform: mwdb: community-based online service for analysis and sharing of malware samples. The service is freely available to a white-hat researchers and provides fully-automated malware extraction and botnet tracking. mwdb core: self-hosted repository of samples and all kinds of technical information related to malware configurations. karton: microservice framework for highly scalable and fault-resistant malware analysis workflows. We will explain the installation and configuration quickly and spend the rest of time on adapting workflows to the karton framework. malduck is our library for malware extraction and analysis. We will explain how to use it effectively and how to create your own modules. All components are already available on our GitHub page: https://github.com/CERT-Polska/training-mwdb. hack-lu-2023-35089-build-your-own-malware-analysis-pipeline-using-open-source-tools hack.lu Michał Praszmopsrok1Jarosław Jedynak en Hands-on workshop showcasing MWDB, mwdblib, Karton and malduck. IMPORTANT: please remember to take your laptop with you. You will need to have a working Linux environment, with a docker-compose and Python installed. false https://pretalx.com/hack-lu-2023/talk/3RBM3A/ https://pretalx.com/hack-lu-2023/talk/3RBM3A/feedback/ Salle Europe Talk 2023-10-19T09:00:00+02:00 09:00 00:30 ONYPHE & ESIEA partnered to create an assessment about satellite modems and their current state of vulnerabilities. We will speak about different brands, give some pictures about how many of them are exposed on the Internet, and give some numbers on their vulnerabilities. hack-lu-2023-37648-internet-exposure-of-satellite-modems-and-their-vulnerabilities hack.lu Patrice AuffretArnaud Girault en ONYPHE & ESIEA partnered to create an assessment about satellite modems and their current state of vulnerabilities. We will speak about different brands, give some pictures about how many of them are exposed on the Internet, and give some numbers on their vulnerabilities. false https://pretalx.com/hack-lu-2023/talk/WKYGQN/ https://pretalx.com/hack-lu-2023/talk/WKYGQN/feedback/ Salle Europe Talk 2023-10-19T09:30:00+02:00 09:30 00:25 In Dec 2021, the media and public discovered the “famous” log4j vulnerability. They realized that for every product or website using software or shared libraries and components , these products can become vulnerable to cyber attack. Companies in technology sector producing «software » had to face the same « disease or scary movie ». A small library used everywhere has damaged almost all software & websites. At this time a part of companies believed they were prepared with a PSIRT or a CSIRT or a CERT, the other part had to “improvise, resolve and learn” Today’s main « key » questions which seems of interest: * Do we all remember (good and bad parts of the experience) ? * Have we realized it’s a miracle the PSIRT teams survived the experience ? * Have we learned the lessons of what happened with log4j ? * Are we now prepare when (‘and not if’) a new « vulnerability scary movie » will come back hack-lu-2023-33264-almost-2-years-after-log4j-if-your-psirt-has-survived-are-the-lessons-learned-or-not-learned-on-security-incident-vulnerability-management hack.lu /media/hack-lu-2023/submissions/USNSEZ/Thales_LOGO_WHITE_ON_BLUE_RGB_ZyfpUpl.png FrederiqueD, Thales en In this talk we will try to: ** Review the theory and framework for security operation (detect/respond/recover & lessons learned) in real case scenario log4j ** Highlight that in security incident management : - PSIRT (when it exists) is not a magic team or heroes - Full recovery takes time ** Admit that there are no other choices than - Shift Left (SSDLC) - Involve the management and accountable players (CMDB, SBOM, BCP) - Collectively align our incident response and vulnerability management approaches and forces true Teaser SlideDeck https://pretalx.com/hack-lu-2023/talk/USNSEZ/ https://pretalx.com/hack-lu-2023/talk/USNSEZ/feedback/ Salle Europe Talk 2023-10-19T10:00:00+02:00 10:00 00:40 The world is awash in large-language model (LLM) AI (e.g., ChatGPT) news, predictions, and of course, content (all for good and ill). This talk takes a step back from the posturing and hype to look at how these models work, and how to detect the content they produce. We will look at the fundamentals of LLM-generated text detection, compare the best in breed: GPTZero, Roberta, and OpenAI's detector with a novel detector, ZipPy. ZipPy is a new, open-source LLM text detector developed by Thinkst Labs that is 60-100x faster than the competition, over 1000x smaller (< 200KB), and for many types of content, more accurate. We will explain the intuition behind ZipPy, show how it works, and they types of content it struggles with. Finally we look at where LLMs can improve their stealth, and fundamental shortcomings in their designs that enable detection long-term. hack-lu-2023-32705-avoiding-the-basilisk-s-fangs-state-of-the-art-in-ai-llm-detection hack.lu Jacob Torrey en Are LLMs going to upend, or just end the world? Will malevolent AIs spread disinformation and FUD to enslave humanity in a world of fear? Will Roko's Basilisk come to pass? In order to help stay these dramatic end-times, LLM detectors are here! We can build safe, AI-free zones to limit the digital "noise" that these models can blast out at scale, if only we can reliably detect and classify a content's origin. This talk does a deep dive into the leading LLM text detectors, both open-source and commercial, and compares them against a number of different datasets. Next, we throw into the mix ZipPy, a novel open-source detector based on code written in the mid-1980s that outperforms the state-of-the-art in a number of dimensions. ZipPy is simple (less than 200 lines of Python), and it codifies the intuition about a core difference between LLMs and humans that no additional amount of data or training cores can overcome--being unique! Using ZipPy we can walk through the features used to differentiate a text's origins and how with a simple, embedded detector we can build a human-centric world where LLMs are used only to help us rather than subvert us. false https://pretalx.com/hack-lu-2023/talk/J3GJY9/ https://pretalx.com/hack-lu-2023/talk/J3GJY9/feedback/ Salle Europe Talk 2023-10-19T10:40:00+02:00 10:40 00:40 Both Android and iOS operating systems interact with the users using a constrained graphical interface, typically occupied at its majority by one application at a time while many of them can run in the background. That being said, a user must rely on the GUI provided by the application itself to verify its legitimacy. This type of behavior has raised concerns within the security research community that have been proved to be well founded, judging from the fact that multiple malware campaigns use GUI confusion as their main attack vector. In this paper we present a novel GUI attack that leverages the fact that an Android activity maintains its graphical state and can receive touches, while it's in the top of the back stack of the device home screen. Whilst most of the techniques that have been introduced so far require the SYSTEM_ALERT_WINDOW permission, the one we present is permissionless and makes use only of the FLAG_NOT_TOUCH_MODAL flag. By using this technique, we were able to create overlapping views over system dialogues, luring the user to unintentionally approve dangerous permissions and access to system services. Third party applications are also at risk, as it is possible to garble their UI by projecting fraudulent views that ostensibly belong to the targeted application's context. For the latter to be successful, the PACKAGE_USAGE_STATS permission must be obtained in order to identify the application that is currently in the foreground. Google addressed the issue (CVE-2021-39617) by not dispatching touches to critical decision windows which are fully or partially obscured, but 3rd party applications are still affected. hack-lu-2023-31205-permissionless-universal-overlays hack.lu Dimitrios Valsamaras en Brief Outline: - The Android User Interface - GUI Confusion Attacks: The story so far - A behavior so far unnoticed - Attacking System Dialogs - Attacking 3rd party applications - Defense and Takeaways Detailed Outline: - The presentation starts with an overview of the Android User Interface, focusing on the components that are relative to the attack that I am going to describe. - Then I am going to present a brief overview of the GUI Confusion techniques so far, and their mass scale usage as an attack vector from many modern malware campaigns. The objective is to give context to the audience about these attacks as well as to underline their impact and why they should not be underestimated. - The next (main) section describes the Android's back stack and focuses on the following behavior: -- When a new activity is pushed on the top of the stack, the overlapped one maintains its graphical state as well as the ability to receive touches from the user. The same behavior applies to system dialogues and system menus that are used to enable or disable special permissions. -- When a transparent activity is pushed on the top of the stack it literally integrates the GUI of the one that was pushed lower. This creates the illusion that the overlapped activity is the one in the foreground. - An Android application can create a transparent activity and apply to its window one or a combination of many flags that are defined in the android.view.WindowManager.LayoutParams class. - These flags can be used to define how a view reacts to user taps and choose to consume or dispatch them to an underlying view. - In the next section I am going to describe my GUI confusion technique which leverages the behavior described in the previous section. I first classify my targets as "Single-Step" (SS) and "Multi-Step" (MS) decision makers, where in the first class belong the dialogs where a single tap suffices to determine a critical permission approval. For the second class the user must be guided to a particular component of a particular screen to approve or decline a special permission (e.g., draw on top of other apps). SS dialogs (like the ones that belong to Contacts/Camera/Call-Logs etc. permission controllers) can be overlapped using a single specially crafted activity. For MS dialogs I use a trampoline Activity which reforms itself according to a step indexing. In both cases a tap is dispatched to the underlying view as long as the overlapping window carries the FLAG_NOT_TOUCH_MODAL flag. The taps can be tracked without implementing any special technique, since a single tap moves the activity to the PAUSE state. This event can't be interpreted as a signal to: -- End the activity for SS dialogs -- Respawn a reformed activity for MS dialogs -- Hijack the user interaction for 3rd party applications - Finally, I demonstrate how from zero permissions my application gets dangerous and/or special permissions approved. - In the next section I demonstrate how to attack 3rd party Applications using only the PACKAGE_USAGE_STATS permission in order to track the activity that is currently in the foreground. The difference with similar "App Switch" attacks is that the overlay integrates the GUI of the victim app regardless of the activity that is currently active. As a show case I demonstrate an approval to a fraudulent bank transaction which without my attack would be rejected by the user. - In the last core section, I describe how to defend Android applications from this attack since, even though Google provided a fix for system dialogs, 3rd party applications are still vulnerable. - Wrapping up and key takeaways. false https://pretalx.com/hack-lu-2023/talk/Q89X9U/ https://pretalx.com/hack-lu-2023/talk/Q89X9U/feedback/ Salle Europe Talk 2023-10-19T11:20:00+02:00 11:20 00:30 Using outdated technologies and old methods to sabotage and engage companies and what can be done about it hack-lu-2023-31407-raiders-of-the-lost-arts hack.lu Stefan Hager en Vintage clothing, computers from the 80s, vinyl and retro-games are all the rage: everything that was once old and outdated is making a comeback. Surely we infosec folk are unaffected by such trends. Aren't we at the bleeding edge of the future, protecting our assets with expensive vendors solution that declare their effectiveness with proper buzzwords; Real-Time, Cloud Based and Always On? Unfortunately, this does not seem to be the case. Sure, some modern problems have been addressed, but old and sometimes even ancient attacks persist. Some of them don't show up in your logs, and some are difficult to defend against, assuming you are even looking for them. Can you DDoS a company by sending letters? How much revenue will you lose if the neighboring building receives an unexpected package? Who really gets into trouble when you drop a few USB sticks in the parking lot? Lean back and enjoy an overview of the dangers of unencrypted, unauthenticated protocols, exploitation of human expectations, sabotage and how to spot if someone on the inside is trying to ruin your day without even touching their computer. false https://pretalx.com/hack-lu-2023/talk/EMHDSZ/ https://pretalx.com/hack-lu-2023/talk/EMHDSZ/feedback/ Salle Europe Lightning talk 2023-10-19T13:30:00+02:00 13:30 00:05 A Tool to Detect Fraudulent Token Contracts on Ethereum Blockchain hack-lu-2023-37927-token-smart-contract-analyzer hack.lu lightning talk TGrandjean en Smart contracts have demonstrated new ways to manage and trade digital assets, conduct financial transactions, and transform business processes. Several concepts have emerged to enable investors to own or trade digital assets. Trading platforms relying entirely on decentralized, known as decentralized exchanges, allow unrestricted financial transactions to exchange digital assets. Beyond the opportunities offered, using the decentralized environment remains complex to understand by most of its users, consequently giving adversaries opportunities to benefit from investors based on scamming schemes. The cryptocurrency market is damaged by malicious actors that aim to drain investor funds via scamming token smart contracts. This research paper initially highlights related problems with fraudulent token contracts. Further, it proposes a solution for identifying several fraudulent schemas in the crypto ecosystem via a dynamic algorithmic solution supported by the SC Analyzer tool based on real-time data. false https://pretalx.com/hack-lu-2023/talk/NN9AHG/ https://pretalx.com/hack-lu-2023/talk/NN9AHG/feedback/ Salle Europe Lightning talk 2023-10-19T13:35:00+02:00 13:35 00:05 Writing Suricata signatures is seen by some as a form of art and my most as a nightmare. This talk will introduce Suricata Language Server that is an implementation of LSP to get syntax checking and performance hints from your IDE when writing Suricata signatures. hack-lu-2023-38184-suricata-language-server hack.lu lightning talk Eric Leblond en Suricata Language Server (SLS) is released under the GPLv3 license and is known to work on most editors including vim, neovim, emacs, kate and Visual code. false Slides https://pretalx.com/hack-lu-2023/talk/VXJJP7/ https://pretalx.com/hack-lu-2023/talk/VXJJP7/feedback/ Salle Europe Lightning talk 2023-10-19T13:40:00+02:00 13:40 00:05 The lightning talk will introduce an LLM-guided privilege-escalation tool designed for evaluating different LLMs and prompt strategies against a novel pen-testing benchmark. TL;DR: you got a new pentesting buddy who can help you hack away. hack-lu-2023-38193-wintermute-an-llm-pen-testing-buddy hack.lu lightning talk Aaron Kaplan en We analyze the impact of different prompt designs, benefits of in-context learning, and the advantages of offering highlevel guidance to LLMs. We discuss challenging areas for LLMs, including maintaining focus during testing, coping with errors, and finally compare them with both stochastic parrots as well as with human hackers. The research will be published on arxiv.org the week of hack.lu. false https://pretalx.com/hack-lu-2023/talk/7UTMU8/ https://pretalx.com/hack-lu-2023/talk/7UTMU8/feedback/ Salle Europe Lightning talk 2023-10-19T13:45:00+02:00 13:45 00:05 CVE-2023-29552 is a recent high profile vulnerability that allows for one of the most powerful and still working denial of service reflective amplification attack. Someone has been having fun and we can see it. hack-lu-2023-38207-slp-dos-amplification-someone-is-having-fun cti-summit lightning talk Pedro Umbelino en CVE-2023-29552 is a recent high profile vulnerability that allows for one of the most powerful and still working denial of service reflective amplification attack. Someone has been having fun and we can see it. In five minutes, will explain what this type of attack is and in particular CVE-2023-29552, who is affected and one of the several creative uses that allows us to see what is going on at the moment. false https://pretalx.com/hack-lu-2023/talk/YGXGV7/ https://pretalx.com/hack-lu-2023/talk/YGXGV7/feedback/ Salle Europe Lightning talk 2023-10-19T13:50:00+02:00 13:50 00:05 Edition of DER encoded ASN.1 structures is a pretty tedious work when done manually. Solutions to this problem exist. For instance, der-ascii [0] is a tool written in Go that helps with back and forth conversions from/to DER structures to/from a textual representation using a custom defined language. I present a somehow short Perl script [1] that leverages the OpenSSL configuration language along with the ASN1_generate_nconf(3) function in order to achieve the same goal with almost no dependencies apart from Perl and OpenSSL. This tool can be used to ease the exploitation of CVE-2022-0778 [2] & [3]. [0] https://github.com/google/der-ascii [1] https://github.com/wllm-rbnt/asn1template [2] https://www.openssl.org/news/secadv/20220315.txt [3] https://github.com/drago-96/CVE-2022-0778#using-asn1-templates hack-lu-2023-38208-der-editing-easy-peasy-with-asn1template cti-summit lightning talk William Robinet en https://github.com/wllm-rbnt/asn1template/blob/main/README.md false slides https://pretalx.com/hack-lu-2023/talk/9KSPFC/ https://pretalx.com/hack-lu-2023/talk/9KSPFC/feedback/ Salle Europe Lightning talk 2023-10-19T13:55:00+02:00 13:55 00:05 In today’s interconnected world, organisations rely on a complex network of suppliers, providers, and contractors to deliver software, hardware, and services. However, this very interconnectedness poses a significant cybersecurity risk – supply chain attacks. In this lightning talk, we will share some insights & thoughts on managing and securing an organisation’s supply chain. hack-lu-2023-38218-supply-chain-resilience-challenges-solutions cti-summit lightning talk Saâd Kadhi en In today’s interconnected world, organisations rely on a complex network of suppliers, providers, and contractors to deliver software, hardware, and services. However, this very interconnectedness poses a significant cybersecurity risk – supply chain attacks. In this lightning talk, we will share some insights & thoughts on managing and securing an organisation’s supply chain. true https://pretalx.com/hack-lu-2023/talk/MFUYZL/ https://pretalx.com/hack-lu-2023/talk/MFUYZL/feedback/ Salle Europe Talk 2023-10-19T14:00:00+02:00 14:00 00:30 Over the past 20 years there have been 3 waves of Bluetooth (BT) security research. The first wave peaked in 2004, and rather abruptly ended after 2005. Then for a long time there was very low interest and activity. That began to change around 2011 with the release of BT Low Energy (BLE) and the Ubertooth One. But that wave too petered out around 2015. But we are now living in the 3rd wave, and it's far larger than past ones. In this talk I will be releasing a TiddlyWiki-based, semantically-tagged, timeline of BT security research. Talks have been tagged according to authorship, conferences, and dates. But also according to talk type (attack? defense? reverse engineering? overview?), attack surfaces (L2CAP? BLE LL? ACL-C?), execution environments (Android? Windows? Texas Instruments firmware?), etc. This organized data affords us interesting insights into the most important authors, tools, orgs, and attacks. I will spend the majority of the time talking about some of the extremely critical vulnerabilities (especially protocol-level vulnerabilities) that have been released in the 3rd wave. These are vulnerabilities that, despite ostensibly being patched, in reality mean that anything with infrequent or non-existent firmware updates, are going to remain hackable indefinitely. hack-lu-2023-31573-open-wounds-the-last-5-years-have-left-bluetooth-to-bleed hack.lu Xeno Kovah en . false https://pretalx.com/hack-lu-2023/talk/M8VTSS/ https://pretalx.com/hack-lu-2023/talk/M8VTSS/feedback/ Salle Europe Talk 2023-10-19T14:30:00+02:00 14:30 00:30 Since February 2023, we have observed an attack campaign using MSIX files. MSIX file is the successor format to MSI file, but many people are unaware of its existence and, needless to say, do not know of any abuse cases. This session will first introduce basic information on MSIX file, such as the file format, basic behavior, and the creation method, followed by attack cases of MSIX file abuse. Specifically, we will detail attacks conducted by a financially motivated threat group called SteelClover. In particular, we will delve into the Package Support Framework (PSF). Our session will contribute to your better understanding of the attack flow and the behavior through specific attack cases abusing MSIX files. Finally, we will discuss detection and defense techniques, including the detection logics available for EDR solutions, against attacks that exploit MSIX files. This session will enable SOC analysts, IR team members, CSIRT personnel, and others to gain a deep understanding of the specific attack cases and behavior abusing MSIX files and to take concrete countermeasures. hack-lu-2023-33869-the-rise-of-malicious-msix-file hack.lu Shogo HayashiRintaro Koike en # Basics of MSIX file First, we will present a basics of MSIX file, including how it was devised, what features it provides, and its file format and the behavior. We will also cover how to create MSIX files and its third-party builders. In addition, this chapter will provide what the Package Support Framework is and how it can be exploited by threat actors. # Attack Cases In this chapter, we will detail specific attack cases of MSIX file abuse. In particular, we will share attack cases by an attack group we call SteelClover. SteelClover, also known as DEV-0569 or Water Minyades, is a financially motivated threat group that has been active since around 2019. This attack group delivers malware through Exploit Kit or fake software distribution starting with a malvertising. We have confirmed that they began abusing MSIX files in March 2023. This chapter will briefly offer basic information on SteelClover and victimology, and then share specific attack flows. Additionally, we will show a detailed process tree and our analysis result of how a malicious MSIX file is delivered to a potential victim user, and how it causes a compromise when executed. This gives the audience an in-depth understanding of actual attack cases that exploit MSIX files. # Defense This chapter will focus on defenses against attacks that exploit MSIX files. For example, it will provide interesting characteristics of file creation, process creation, and other behaviors, along with specific detection logic to detect these behaviors. MSIX files have many characteristic behaviors, and without knowing them, it is extremely difficult to understand the nature of the breach. This chapter will enable the audience to know how to protect your own organization against MSIX file abuses and to take concrete actions. # Wrap-Up Finally, we will wrap up our presentation. Based on specific attack cases of compromise using MSIX files, we will consider defensive measures to protect one's own organization from such threats. This session will help the audience gain a basic overview of an MSIX file and a deeper understanding of attack cases that exploit MSIX files, and to take concrete countermeasures. # Appendix: IoCs We will list the IoCs of the malicious MSIX files presented in this session. false https://pretalx.com/hack-lu-2023/talk/WULFLD/ https://pretalx.com/hack-lu-2023/talk/WULFLD/feedback/ Salle Europe Talk 2023-10-19T15:00:00+02:00 15:00 00:20 Crowdsec is an open-source IDS/IPS and we recently added a detection capability that is based on Bayesian inference, a technique which has long been used to detect email spam. We show that this old and simple tool is still incredibly powerful and present how other threat analysts can improve their threat detection using Bayesian inference. hack-lu-2023-36586-reviving-our-oldest-tool-using-bayesian-inference-to-detect-cyber-attacks hack.lu Emanuel Seemann en Crowdsec is an open source IPS/IDS that is built on the leaky bucket algorithm. This algorithm can detect a lot of common cyber attack patterns such as bruteforce attacks or exploits with known payload delivery vectors such as log4shell. However it is suboptimal at detecting attacks at the application level. To amend this we created the Bayesian bucket, which uses Bayesian inference internally to determine whether a given user is behaving in fraudulent ways. Bayesian inference has long been used to fight email spam and we show that it is quite adept at fighting other cybercrime. In particular we present: * How we implemented the Bayesian bucket * How you can train it using our open source toolkit * A demo on real world data false https://pretalx.com/hack-lu-2023/talk/YAQLW9/ https://pretalx.com/hack-lu-2023/talk/YAQLW9/feedback/ Salle Europe Talk 2023-10-19T15:30:00+02:00 15:30 00:30 The talk will demonstrate how to use Sysdiagnose for forensics purposes of Apple devices. Sysdiagnose is a tool which was originally intended for other purposes The presenters will share with the audience hands-on experiences and share what works and what does not work with this approach. Incident responders will leave the talk with a deeper understanding of Sysdiagnose and a novel tool in their IR arsenal. hack-lu-2023-33744-using-apple-sysdiagnose-for-mobile-forensics-and-integrity-checks hack.lu David DurvauxAaron Kaplan en Intended audience: Incident handlers and forensic investigators. Introduction: --------------- For a long time, the incident response analysis of iOS devices has been… essentially challenging. While the analyst is usually interested in understanding what the system was doing (system logs), typical acquisition tools only focus on collecting users’ data. Thus they often do not provide what the incident responder was looking for. Furthermore, the usual way to get access to the full device is by jailbreaking the device or using specialised (expensive) tools reserved for law enforcement. Jailbreaking has the downside of breaking the chain of custody and therefore the trust in the final state of the device as well as the immutability of the analysis is put into question. Enter Sysdiagnose… ----------------------- This talk will focus on repurposing an Apple feature which was originally intended for diagnostic and debugging purposed for developers as well as for repair shops. The Sysdiagnose process on Apple devices collects data on how the system behaves and is typically what an analyst wants to look at. Collecting Sysdiagnose artefacts ----------------------------------- Sysdiagnose is triggered by a user action and creates archives containing system information in various formats, such as: - plist configuration files - logs and output of commands - sqlite databases with application histories etc. The result can be extended by pushing extra profiles to the device that turn on extra debugging and enhance the content of the archive. Collecting Sysdiagnose archives on IOS ------------------------------------------- While the process is well described on Apple’s website, we will quickly show how to start the acquisition process on an iPhone and how to retrieve the data via a few different techniques ranging from AirDrop to typical forensic tools. Collecting Sysdiagnose archives on other Apple devices ------------------------------------------------------------ While the research motivating this talk is coming from the need to analyse iOS devices, in practice the features which we are looking at will be available throughout all of Apple OSes: - Mac OS (MacBook Air, MacBook Pro, Mac Pro, iMac…) - Watch OS (Apple Watch) - iPad OS (for tablets) -TV OS (Apple TV) - … Extracting information from Sysdiagnose archives and building a timeline ------------------------------------------------------------------------------ In this part we will present some Python scripts to extract all timestamped information from the Sysdiagnose archive in order to build a timeline in your favorite timeline analysis tool Splunk & Timesketch In order to perform investigations on the gathered data, an easy solution is to import it into a dedicated SIEM. In this part, we will present how we standardise the outputs from our scripts to easily import them into tools like Splunk for further forensics analysis. We also developed a re-usable TimeSketch module to import the generated timeline in TimeSketch. Challenges -------------------- Sysdiagnose is calling different tools and commands to generate its output. Unfortunately, all those tools have their own output format, especially regarding timestamps. We will present some specificities of Sysdiagnose’s output and how we handled them. Identifying IOS system tampering using Sysdiagnose artefacts ------------------------------------------------------------------- In this section we show practically how an iOS device can be analysed by using the Sysdiagnose artefacts and their value: applicate update history, running processes, memory mapping… Examples of investigation ---------------------------- In this section we shows practical examples of analysis with Sysdiagnose. We did a few Sysdiagnose acquisitions on test devices to simulate scenarii and prove the effectivness of this analysis technique. Issues and limits of Sysdiagnose ----------------------------------- The Sysdiagnose process raises a few issues and concerns: The data is collected by a process which runs on the investigated device. The output can only be trusted as long as it runs normally. Rootkits and binaries alteration could affect the results and lead to wrong conclusions. The format of the files included into the archive depends on the version of iOS and running applications. The SQLite DB schema, for instance, can radically change with an application update. Keeping a working toolset therefore requires continuous research, testing and validation. The Sysdiagnose output is mostly undocumented. Every single file needs to be manually analysed and understood to correctly interpret the results and avoid wrong conclusions. Alternative ways to check integrity -------------------------------------- In this last section we will discuss how integrity can be checked by using more intrusives methods that could be combined with a jailbreak. While those techniques give a full access, they will also question the value of the results from a forensic perspective due to their intrusiveness. References ------------ https://www.jessesquires.com/blog/how-to-sysdiagnose-ios/ https://www.manpagez.com/man/1/sysdiagnose/ https://github.com/cheeky4n6monkey/iOS_sysdiagnose_forensic_scripts https://www.apple.com/business/docs/site/iOS_Security_Guide.pdf https://developer.apple.com/bug-reporting/profiles-and-logs/ https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ false https://pretalx.com/hack-lu-2023/talk/YXMSQV/ https://pretalx.com/hack-lu-2023/talk/YXMSQV/feedback/ Salle Europe Talk 2023-10-19T16:15:00+02:00 16:15 00:30 We propose to provide an overview of the maritime sector's cybersecurity, its strengths and weaknesses, the attacks that are taking place and the initiatives being taken to deal with them. hack-lu-2023-36566-a-deep-dive-into-maritime-cybersecurity hack.lu JACQ en Although it is still too little known, the maritime and port sector is essential to our modern economies. Ships and ports should now be seen as complex information systems. This increased digitalisation brings with it new risks that must be taken into account by international organisations, administrations, public and private operators, shipowners and shipbuilders. What are the vulnerabilities? Which incidents happened over the last years? After a description of the sector for the non-mariners, we will take a deep dive into the maritime systems, and detail the unique incident statistics we compile at the Maritime Computer Emergency Response Team. true https://pretalx.com/hack-lu-2023/talk/FXZEVC/ https://pretalx.com/hack-lu-2023/talk/FXZEVC/feedback/ Salle Europe Talk 2023-10-19T16:45:00+02:00 16:45 00:30 This talk delves into the captivating story of DuckTail, a notorious infostealer operation that emerged as one of the prominent threats in 2022 and 2023. With a global reach, DuckTail effectively targeted both individuals and organizations, leveraging customized malware and innovative delivery techniques. Thriving in the remote work landscape driven by the COVID pandemic, DuckTail's success did not shield them from committing critical operational security (OPSEC) mistakes. These lapses ultimately led to the complete exposure of their operation and the individuals responsible for it. Join me as we explore the gripping pursuit of these cybercriminals, unraveling their intricate methods and providing an exceptional glimpse into the workings of a criminal enterprise. hack-lu-2023-33964-operation-duck-hunt-a-peak-behind-the-curtain-of-ducktail hack.lu Pol Thill en Through an extensive investigation into DuckTail's infrastructure, a critical vulnerability in their exfiltration methodology was uncovered. The exploitation of this flaw resulted in the acquisition of numerous screenshots extracted from the personal machines of the threat actors, exposing glaring deficiencies in operational security (OPSEC) practices. These screenshots provide a revealing glimpse into various aspects of DuckTail's operations. Notably, they divulge fragments of the infostealer's source code, reveal the techniques employed by the threat actors to disseminate the malware, and unveil confidential dialogues exchanged among the perpetrators, ultimately leading to their identification. This talk will delve into the intricacies of DuckTail's exfiltration infrastructure and its inherent weakness. I will demonstrate the threat actors' methods of infection and delivery. Furthermore, attendees will gain invaluable insights into the clandestine activities that unfolded behind the scenes, providing a comprehensive understanding of the broader context. It will shed light on the concealed elements of DuckTail's operations, offering a unique opportunity to deepen your knowledge of the evolving cyber threat landscape, highlighting how modern criminal enterprises operate and infect their targets. false https://pretalx.com/hack-lu-2023/talk/DCQYBF/ https://pretalx.com/hack-lu-2023/talk/DCQYBF/feedback/ Salle Europe Talk 2023-10-19T17:15:00+02:00 17:15 00:30 Linux is an open-source OS; however, performing Threat Hunting on Linux using open-source software (OSS) is not easy, as only a few tools are available and maintained. A port of the well-known Sysmon tool, originally developed for MS Windows, has been made for Linux, but it suffers from several issues. In this presentation, I will introduce a brand-new open-source tool I have been working on for several months. This tool aims to be a Sysmon alternative for Linux and provides several features that Sysmon does not offer. hack-lu-2023-33919-1-kunai-your-new-threat-hunting-tool-for-linux cti-summit Quentin JEROME en This presentation aims to introduce the community to Kunai, a new Threat Hunting tool designed specifically for Linux Systems. I'll start by discussing the project's origin and my motivations for initiating it, followed by an exploration of the tool's inner workings and implementation details. This section will conclude with an overview of the challenges encountered during the tool's development. Next, I will highlight its key features, emphasizing how it differs from existing tools. The latter part of this section will explore practical Threat Hunting scenarios that can be realized with the tool. In conclusion, I will summarize the key takeaways from this tool and share our future plans for its development. false https://pretalx.com/hack-lu-2023/talk/MGMYZA/ https://pretalx.com/hack-lu-2023/talk/MGMYZA/feedback/ Schengen 1 and 2 Training 2023-10-19T14:00:00+02:00 14:00 02:00 This workshop will showcase a suite of free and open source tools to leverage threat intelligence in DFIR investigations. Participants will be setting up a full forensics pipeline, including collection ([GRR](https://github.com/google/grr)), processing ([Plaso](https://github.com/log2timeline/plaso)) and analysis ([Timesketch](https://github.com/google/timesketch/)), and orchestration ([dfTimewolf](https://github.com/log2timeline/dftimewolf)). In addition to that, they'll be using [Yeti](https://github.com/yeti-platform/yeti) to augment their processing and analysis with threat intelligence. Thw workshop will last two hours and is open for anyone to attend. Experience installing packages on Linux and using the Linux CLI in general is required. Experience running and managing Docker containers would be a nice addition. Participants will be given an initial list of Docker containers to pull and set up before the workshop [UPDATE] Here's the list! https://docs.google.com/document/d/1TKqOleH2rdtPjybUt3PYybJ7RrH59kqaHnmywJhRPGk/preview [UPDATE2] Here's the slides with the links to everything: https://docs.google.com/presentation/d/1_IIhazlZF4Nxa_fn4YJ0SieFPJGzP91OwuAO4LIUWOg/edit#slide=id.g24fcb0d3240_0_70 hack-lu-2023-33976-full-stack-forensics-with-foss hack.lu Thomas ChopiteaSébastien Larinier en - Introduction - What to expect of the workshop - Quick tour / install / configuration - Timesketch - Yeti - Adding some forensics intelligence to Yeti - Your first forensic analysis with Timesketch! - Adding threat intelligence to the mix Optional (if time permits) - dfTimewolf - Configuring all these tools to work together, triggering a first analysis using dfTimewolf. - Tweaking Timesketch analyzers false https://pretalx.com/hack-lu-2023/talk/7G8EKN/ https://pretalx.com/hack-lu-2023/talk/7G8EKN/feedback/ Schengen 1 and 2 Workshop 2023-10-19T16:15:00+02:00 16:15 01:30 MISP has been a widely used open source CTI platform for the past decade, with a long list of tools that allow users to customise the data models and contextualisation of the platform, yet true customisation of the actual workflows and processes had to be done externally using custom scripts. With the introduction of MISP workflows, this has changed and the workshop aims to walk the audience through some of the potential ideas of how one could adapt the tool to their own CSIRT’s or SOC’s workflows by using some hands-on examples during the session. hack-lu-2023-37977-building-your-own-workflows-in-misp-tutorial-and-hands-on hack.lu Sami Mokaddem en MISP has been a widely used open source CTI platform for the past decade, with a long list of tools that allow users to customise the data models and contextualisation of the platform, yet true customisation of the actual workflows and processes had to be done externally using custom scripts. With the introduction of MISP workflows, this has changed and the workshop aims to walk the audience through some of the potential ideas of how one could adapt the tool to their own CSIRT’s or SOC’s workflows by using some hands-on examples during the session. false https://pretalx.com/hack-lu-2023/talk/TLTFKF/ https://pretalx.com/hack-lu-2023/talk/TLTFKF/feedback/ Echternach&Diekirch Workshop 2023-10-19T09:00:00+02:00 09:00 01:30 Stop the countdown timer and dismantle the bomb by cutting the correct cable. hack-lu-2023-32590-7-dismantle-the-bomb hack.lu Stijn Tomme en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timers starts the mission (75 minutes) Goal is to stop the countdown timer connected to a bomb fixed on a 10l white paint bucket false https://pretalx.com/hack-lu-2023/talk/UDFFNS/ https://pretalx.com/hack-lu-2023/talk/UDFFNS/feedback/ Echternach&Diekirch Workshop 2023-10-19T10:30:00+02:00 10:30 01:30 Stop the countdown timer and dismantle the bomb by cutting the correct cable. hack-lu-2023-32590-8-dismantle-the-bomb hack.lu Stijn Tomme en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timers starts the mission (75 minutes) Goal is to stop the countdown timer connected to a bomb fixed on a 10l white paint bucket false https://pretalx.com/hack-lu-2023/talk/UDFFNS/ https://pretalx.com/hack-lu-2023/talk/UDFFNS/feedback/ Echternach&Diekirch Workshop 2023-10-19T14:00:00+02:00 14:00 01:30 Stop the countdown timer and dismantle the bomb by cutting the correct cable. hack-lu-2023-32590-9-dismantle-the-bomb hack.lu Stijn Tomme en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timers starts the mission (75 minutes) Goal is to stop the countdown timer connected to a bomb fixed on a 10l white paint bucket false https://pretalx.com/hack-lu-2023/talk/UDFFNS/ https://pretalx.com/hack-lu-2023/talk/UDFFNS/feedback/ Hollenfels Training 2023-10-19T14:00:00+02:00 14:00 02:00 In this 2 hour workshop, Didier will start with a quick intro to CyberChef, with some simple exercises, and then we will setup a development environment for CyberChef. In this environment, we will start with simple exercises (enhancing existing operations) and then move on to creating your own operations from scratch. The operations will focus on blue team activities, like assisting with the analysis of malware. hack-lu-2023-33430-cyberchef-enhancing-existing-operations-and-adding-new-operations hack.lu Didier Stevens en Like usual with workshops from Didier Stevens, this will be very hands-on with many exercises. This workshop requires a Linux laptop or a Windows/Linux/Mac laptop with a Linux virtual machine. false https://pretalx.com/hack-lu-2023/talk/PFNABT/ https://pretalx.com/hack-lu-2023/talk/PFNABT/feedback/ Vianden&Wiltz Training 2023-10-19T10:00:00+02:00 10:00 02:00 DFIRTrack (Digital Forensics and Incident Response Tracking application) is an open source web application focused on handling major incidents with many affected systems. This workshop will show you how to use DFIRTrack in an efficient way using the various features. hack-lu-2023-33924-dfirtrack-the-incident-response-tracking-application hack.lu /media/hack-lu-2023/submissions/MSZDZD/dfirtrack_logo_ig5vAHA.png Mathias StuhlmacherLionne Stangier en Are you an Incident Responder working on large (customer) security incidents? Are you tired of maintaining huge spreadsheets (aka _Spreadsheet of DOOM_)? Do you have to manually create customer system or artifact reports? Then DFIRTrack may be just what you are looking for... In this workshop we will show you how to install, configure and use DFIRTrack. We will cover the following features in detail: - Installation ( manually and using docker or ansible) - Configuration and customization - Overview of the main entities (systems, artifacts, tasks, ...) - Import, export and manipulation capabilities - Automation through scheduled tasks and workflows - Roadmap, feedback and feature discussion Most things will be done through hands-on examples. A notebook is required, ideally with a working Docker setup. false https://pretalx.com/hack-lu-2023/talk/MSZDZD/ https://pretalx.com/hack-lu-2023/talk/MSZDZD/feedback/ Vianden&Wiltz Training 2023-10-19T14:00:00+02:00 14:00 03:00 On a Linux system we will prepare an USB stick with 3 little test files like 'test1.txt', 'test2.txt' and 'test3.txt' with some little test content inside. If connecting the spooky USB stick to a Windows based PC (VM guest) the USB stick is mounted and we see three '.txt' files. But the content is different and doesn't match the content we created on the Linux PC. Analyzing the stick with different tools leads to confusing results. It does not help to understand what is going wrong here. The idea of this workshop is to provide the students with the knowledge to build their own *spooky* USB stick. hack-lu-2023-32704-as-we-are-many hack.lu /media/hack-lu-2023/submissions/9ZY9VJ/screen4twitter_AFiwZ7a.png Michael Hamm en On a Linux system we will prepare an USB stick with 3 little test files like 'test1.txt', 'test2.txt' and 'test3.txt' with some little test content inside. If connecting the spooky USB stick to a Windows based PC (VM guest) the USB stick is mounted and we see three '.txt' files. But the content is different and doesn't match the content we created on the Linux PC. Analyzing the stick with different tools leads to confusing results. It does not help to understand what is going wrong here. The idea of this workshop is to provide the students with the knowledge to build their own *spooky* USB stick. Students should bring a Linux alike workstation and an empty USB stick, to build their own *spooky* USB stick.. A VM with a Windows OS guest system would help to test the results. Attendees should be familiar with the command line interface. false https://pretalx.com/hack-lu-2023/talk/9ZY9VJ/ https://pretalx.com/hack-lu-2023/talk/9ZY9VJ/feedback/