0.56 hack-lu-2024 2024-10-22 2024-10-25 4 00:05 https://pretalx.com https://pretalx.com/media/hack-lu-2024/img/hacklu-24-logo-small-no-alpha_N5tmKP2.png Europe/Luxembourg Europe - Main Room Talk 2024-10-22T09:00:00+02:00 09:00 00:30 Botnets have managed to stay relevant in a number of ways, from the incorporation of phishing in their attack chains to a subscription service model. Their adaptability has proved that botnets indeed still represent an effective way to launch devastating attacks. In this talk, we will present a comprehensive overview of our latest research on new groups, delving into their organizational structures, codebases, and tactics. We will explore how these malicious actors share information, select their targets, and offer their services. By sharing our findings, we hope to raise awareness and facilitate a better understanding of these threats, ultimately contributing to the development of more effective countermeasures. hack-lu-2024-51710-insights-from-modern-botnets topic: hack.lu Miguel en Botnets represent a significant and evolving threat in the cybersecurity landscape. This presentation aims to shed light on the inner workings of these networks based on extensive research and real-world examples. Attendees will gain insights into: * Organization and Structure: Understanding how modern botnets are set up and managed. * Code Analysis: A deep dive into the types of code used by botnet operators. * Information Sharing: Exploring whether and how these networks share data amongst themselves. * Victim Selection: Analyzing the criteria and methods used to choose targets. Our aim is to provide a global view of the current state of botnets, offering valuable knowledge that can aid in the detection, analysis, and mitigation of these threats. This talk is designed for security professionals, researchers, and anyone interested in understanding the complexities and dangers posed by botnets in today's digital world. true SLIDES HACKLU 2024 - Insights from Modern Botnets https://pretalx.com/hack-lu-2024/talk/LGQTXM/ https://pretalx.com/hack-lu-2024/talk/LGQTXM/feedback/ Europe - Main Room Talk 2024-10-22T09:30:00+02:00 09:30 00:30 LLMs turn out to be highly practical for summarising and extracting information from unstructured Cyber Threat Intelligence (CTI) reports. However, most models were not trained specifically for understanding CTI. We will present a custom LLM, fine-tuned for CTI purposes. But of course, that only makes sense with a CTI text benchmark dataset. Creating these two systems is a challenging journey. Set-backs guaranteed. We will share our findings. hack-lu-2024-56366-neurocti-a-custom-llm-for-cti-benchmarking-successes-failures-and-lessons-learned-updates topic: CTI Aaron Kaplan en (This is an update from the FIRSTCON24 talk) Many CTI practitioners and companies experimented with LLMs for extracting information from unstructured CTI reports in the last year. Often, the dream is to automate the analyst's job to correctly identify, copy & paste TTPs, threat actors and relationships from the report and to convert it into STIX. Alas, off-the-shelf LLMs often fail at this task (GPT-4-turbo being already pretty good at the submission time). But there is another caveat: the requirements for IT security often demand that data remains on-premise or at least in a virtual server which is fully and only under the control of the organisation's IT team. For that we need local LLMs (as opposed to cloud bases SaaS/FaaS solutions such as openai.com's API). But how to achieve good results with local LLMs ? Can we beat openai? To address the CTI text summarisation and information extraction problem, we 1. propose an open source CTI LLM benchmark dataset which can be used to compare different LLMs and prompts 2. a fine-tuned custom CTI LLM model ("neuroCTI") and 3. evaluate it (as well as other LLMs) against the benchmark dataset and 4. finally, integrate serving the model via ollama and MISP integration. The model is freely available for local deployments. false slides https://pretalx.com/hack-lu-2024/talk/JJVXKP/ https://pretalx.com/hack-lu-2024/talk/JJVXKP/feedback/ Europe - Main Room Talk 2024-10-22T10:15:00+02:00 10:15 00:45 In ‘Tales of the Future Past’, Saâd Kadhi, the Director of CERT-EU, invites you to embark on a time-travelling odyssey. The journey commences with a retrospective dive into the past, where attendees will glean insights from CERT-EU’s unique vantage point on the threat landscape, hovering over noteworthy developments the Cybersecurity Service for the Union entities had been observing. As the time machine propels us into the future, the presentation demystifies the complexities of Artificial Intelligence, shedding light on AI’s burgeoning role in cyber threats. It offers foresight and thoughtful projections on potential AI-powered dangers, equipping the audience with the knowledge to anticipate and navigate future challenges. The expedition culminates with a return to the present where Saâd will share his ideas on how to fortify our defences against the cyber threats of today and tomorrow. Designed for a diverse audience, ‘Tales of the Future Past’ promises to be an enlightening journey, offering a unique blend of historical wisdom, futuristic insights, and practical, present-day solutions. hack-lu-2024-55699-tales-of-the-future-past topic: hack.lu Saâd Kadhi en In ‘Tales of the Future Past’, Saâd Kadhi, the Director of CERT-EU, invites you to embark on a time-travelling odyssey. The journey commences with a retrospective dive into the past, where attendees will glean insights from CERT-EU’s unique vantage point on the threat landscape, hovering over noteworthy developments the Cybersecurity Service for the Union entities had been observing. As the time machine propels us into the future, the presentation demystifies the complexities of Artificial Intelligence, shedding light on AI’s burgeoning role in cyber threats. It offers foresight and thoughtful projections on potential AI-powered dangers, equipping the audience with the knowledge to anticipate and navigate future challenges. The expedition culminates with a return to the present where Saâd will share his ideas on how to fortify our defences against the cyber threats of today and tomorrow. Designed for a diverse audience, ‘Tales of the Future Past’ promises to be an enlightening journey, offering a unique blend of historical wisdom, futuristic insights, and practical, present-day solutions. true https://pretalx.com/hack-lu-2024/talk/W9G3B8/ https://pretalx.com/hack-lu-2024/talk/W9G3B8/feedback/ Europe - Main Room Talk 2024-10-22T11:00:00+02:00 11:00 00:30 This session will walk you through how easy and powerful it can be to integrate new tools into your existing cybersecurity workflows in MISP. You'll learn the practical steps of plugging in external tools using misp-modules and misp-workflows, see a live demo of the process, discuss common integration challenges, and understand how automation with MISP can significantly reduce time to respond to threats and improve efficiency. hack-lu-2024-57126-integrating-new-tools-in-your-workflows-within-minutes-in-misp topic: CTI Sami Mokaddem en This session will walk you through how easy and powerful it can be to integrate new tools into your existing cybersecurity workflows in MISP. You'll learn the practical steps of plugging in external tools using misp-modules and misp-workflows, see a live demo of the process, discuss common integration challenges, and understand how automation with MISP can significantly reduce time to respond to threats and improve efficiency. false Slides https://pretalx.com/hack-lu-2024/talk/KGFZHF/ https://pretalx.com/hack-lu-2024/talk/KGFZHF/feedback/ Europe - Main Room Talk 2024-10-22T11:30:00+02:00 11:30 00:30 Maintaining an open source security project for almost 8 years gives lots of opportunity for collecting experiences...good and bad ones. Time for sharing the experience from maintaining [Sigma](https://sigmahq.io/)! hack-lu-2024-53784-lessons-learned-from-almost-8-years-of-sigma-development topic: hack.lu Thomas Patzke en Development of Sigma started in the end of 2016 as proof-of-concept of an idea to create a language for detections and developed into an open standard widely used by lots of organizations. In between it took a journey from PoC-grade code that people started to use in production, a complete rewrite of the toolchain and growing from a project maintained by few individuals to multiple projects maintained by a community. In this talk I will share the experience from my perspective as a core maintainer of the [Sigma project](https://sigmahq.io/). Some of the topics are: * Organizing and structuring a growing open source security project. * Ensuring quality. * Keeping to maintain existing code *vs* full rewrite. * Contributions, trust and handing over control. * Staying motivated and handling stress and exhaustion. false Slides https://pretalx.com/hack-lu-2024/talk/MMNTPT/ https://pretalx.com/hack-lu-2024/talk/MMNTPT/feedback/ Europe - Main Room Lightning talk 2024-10-22T13:30:00+02:00 13:30 00:05 Phishing attacks continue to be among the most effective and pervasive cyber threats. This session will provide actionable insights into how publicly available data can help bolster defences against phishing schemes. hack-lu-2024-57056-catching-phish-using-publicly-accessible-information hack.lu lightning talk Aurimas Rudinskis en The talk will explore how open-source intelligence (OSINT) can be used to identify phishing infrastructure. Whether you're a cybersecurity professional or just looking to protect yourself better, this session offers practical strategies for leveraging public data to catch phishing threats. false Slidedeck https://pretalx.com/hack-lu-2024/talk/PELM7F/ https://pretalx.com/hack-lu-2024/talk/PELM7F/feedback/ Europe - Main Room Lightning talk 2024-10-22T13:35:00+02:00 13:35 00:05 It’s the story of a research project that is now becoming something more. It has nothing to do with cloud computing but everything to do with helping penetration testers doing their job in specific contexts. hack-lu-2024-57109-cyrus-the-story-of-no-cloud hack.lu lightning talk /media/hack-lu-2024/submissions/7TBNCY/logo_4UeGWEO.jpg Guillaume Ginis en We are 2 researchers in cybersecurity from a belgian research center and we will present to you what Cyrus is. And because we only have 5 minutes let’s explain it to you the quick and fun way. false Slides https://pretalx.com/hack-lu-2024/talk/7TBNCY/ https://pretalx.com/hack-lu-2024/talk/7TBNCY/feedback/ Europe - Main Room Lightning talk 2024-10-22T13:40:00+02:00 13:40 00:05 Kunai is a security monitoring tool for Linux. In this talk, I'll cover the most important updates since last year’s presentation at hack.lu, including the detection and filtering rule engine, IoC-based detections, file scanning with YARA rules, log storage with rotation, and more. hack-lu-2024-57266-latest-updates-on-kunai hack.lu lightning talk Quentin JEROME en Kunai is a security monitoring tool for Linux. In this talk, I'll cover the most important updates since last year’s presentation at hack.lu, including the detection and filtering rule engine, IoC-based detections, file scanning with YARA rules, log storage with rotation, and more. false Slides https://pretalx.com/hack-lu-2024/talk/KW9S7Z/ https://pretalx.com/hack-lu-2024/talk/KW9S7Z/feedback/ Europe - Main Room Lightning talk 2024-10-22T13:45:00+02:00 13:45 00:05 This lightning talk will develop the context and reasons that led to the discovery and disclosure of vulnerabilities in an Electric Vehicle Smart Charging Point (CVE-2024-5313 and CVE-2024-8070). We will discover a specific product, how it works, how it is supposed to be provisioned and some mistakes that were made that enabled the speaker to elevate his privileges. hack-lu-2024-57320-hacking-ev-charging-points-for-fun-and-fixing-the-firmware hack.lu lightning talk Simon Petitjean en Sunday, October 29th 2023, like every Winter, Europe switched to daylight saving time... but my EV Smart Charing Point did not. In this lightning talk, I will explain how I moved from the willingness have a correct a timezone on my charging point, to a full compromise of the appliance. I'll develop the whole process that brought me from a regular user with no access, to root of the charging point, including full disclosure to the company that (partially) developed the product. true https://pretalx.com/hack-lu-2024/talk/SLW7CQ/ https://pretalx.com/hack-lu-2024/talk/SLW7CQ/feedback/ Europe - Main Room Lightning talk 2024-10-22T13:50:00+02:00 13:50 00:05 SkillAegis is a platform to design, run, and monitor exercise scenarios, enhancing skills in applications like MISP and training users in best practices for information management and protective tools. This short session will show you the tool and what it can do. hack-lu-2024-57169-running-exercises-with-skillaegis hack.lu lightning talk /media/hack-lu-2024/submissions/STA7SL/skillaegis-logo_9mTZIHD.png Sami Mokaddem en SkillAegis is a platform to design, run, and monitor exercise scenarios, enhancing skills in applications like MISP and training users in best practices for information management and protective tools. This short session will show you the tool and what it can do. false https://pretalx.com/hack-lu-2024/talk/STA7SL/ https://pretalx.com/hack-lu-2024/talk/STA7SL/feedback/ Europe - Main Room Lightning talk 2024-10-22T13:55:00+02:00 13:55 00:05 QKD networks are a tabu subject between different states of the world. Is QKD technology safe? Is it worth the money? How hard is to integrate classical communication networks with QKD? hack-lu-2024-57143-qkd-is-it-worth-it hack.lu lightning talk /media/hack-lu-2024/submissions/EMPW3K/ronaqci_logo_ivcsU9O.png Mihai Carabas en QKD networks have a special interest specifically in Europe since the EuroQCI initiative was signed. Currently across Europe there are more than 20 national QKD projects under development, where in the US NIST is looking at the quantum resistant algorithms. Which is the way to go? true QKD - is it worth it? (slides) https://pretalx.com/hack-lu-2024/talk/EMPW3K/ https://pretalx.com/hack-lu-2024/talk/EMPW3K/feedback/ Europe - Main Room Talk 2024-10-22T14:00:00+02:00 14:00 00:30 Website cloaking is a technique that enables websites to deliver different content to different clients, with the goal of hiding particular content from certain clients. Website cloaking is based on client detection, which is achieved via browser fingerprinting. In an attempt to hide their malicious web pages from detection, cyber criminals (can) use cloaking. They use vulnerability detection to only target clients that seem vulnerable. On top of that, they (can) also provide benign content in case they suspect someone or something is trying to detect them. In this work, we investigated to what extent security web crawlers can be detected by browser fingerprinting techniques, and provided some suggestions for how to improve them to be able to bypass those techniques. We surveyed security analysts and analyzed a set of threat intelligence sharing communities, to gauge awareness of cloaking as an available detection evasion method for cybercriminals. Finally, we investigated one final technique, the use of Cache-Control: no-store, which an attacker can use to thwart forensic analysis. hack-lu-2024-54378-nothing-to-see-here-on-the-awareness-of-and-preparedness-and-defenses-against-cloaking-malicious-web-content-delivery topic: CTI Jeroen Pinoy en In this talk I present part of my master thesis research in this space, explaining how browser fingerprinting works, and why I think it deserves some more attention from the cyber community and CTI community in particular. false Slides https://pretalx.com/hack-lu-2024/talk/VKE3K8/ https://pretalx.com/hack-lu-2024/talk/VKE3K8/feedback/ Europe - Main Room Talk 2024-10-22T14:30:00+02:00 14:30 00:30 In the current digital landscape, organizations often do not become aware immediately when their data is compromised and sold online. Our objective is to minimize the duration between the exposure of data on the internet and its detection by the public. The dark web serves as a primary marketplace for the trade of personal information, accessible safely only through the use of the Tor browser. This paper focuses on monitoring significant trading forums on the dark web and demonstrates the method of web scraping specifically designed for dark web sites. Utilizing data harvested from these sites, we have trained a BERT classification model to categorize transaction posts into five distinct types of data leaks, enabling rapid identification of the leak type associated with each post. Further, we employ the Retrieval-Augmented Generation (RAG) technique to vectorize dark web data, maintaining privacy while leveraging mainstream large language models to address concerns pertinent to cybersecurity analysts. This approach allows researchers to analyze dark web data effectively. Ultimately, the data collected from the dark web is formatted into STIX (Structured Threat Information Expression) and integrated into the MISP (Malware Information Sharing Platform) system to automate the generation of Cyber Threat Intelligence (CTI) reports. This methodology not only enhances the timeliness and accuracy of threat detection but also contributes to more efficient and proactive cybersecurity management. hack-lu-2024-52738-automating-dark-web-cti-reports-with-rag-insight-for-misp-sharing topic: CTI /media/hack-lu-2024/submissions/AEV77X/breachforums_SpFcROt.png Shing-Li Hung en This talk will include the following topic: Introduce dark web forums Dark web crawler BERT classification retrieval augmented generation introduction and application Dark web CTI case study STIX format CTI MISP for sharing CTI false Slides https://pretalx.com/hack-lu-2024/talk/AEV77X/ https://pretalx.com/hack-lu-2024/talk/AEV77X/feedback/ Europe - Main Room Talk 2024-10-22T15:00:00+02:00 15:00 00:30 Cloud incident response can be daunting, requiring a plethora of tools and skills, while most Cloud Based Startups can’t allocate budget for preventive controls, there is less space for them to understand what to do if they are hacked. That’s why we created Dredge, an Open Source framework designed to streamline cloud incident investigations, allowing engineers to execute non-trivial cloud incident response tasks easily. hack-lu-2024-52096-dredge-an-open-source-framework-for-cloud-incident-response topic: CTI /media/hack-lu-2024/submissions/QFMBPR/santi_y44i60C.jpg Santi Abastante en Working in the SolidarityLabs CSIRT, we help small organizations in Latin America to overcome cybersecurity incidents. Doing so, we found that Cloud incident response can be daunting, requiring a plethora of (expensive) tools and skills, while most Cloud Based companies can’t allocate budget for preventive controls, there is less space for them to understand what to do if they are hacked, specially knowing how hard it is to find (And retain) a security engineer with cloud based skills and incident response mindset. That’s why we created Dredge, an Open Source framework designed to streamline cloud incident investigations, by allowing Cloud Engineers and Incident Responders to execute non-trivial response tasks effortlessly, irrespective of your familiarity with specific cloud platforms nor incident response tactics. The main idea is to empower Engineers to respond to attacks no matter what preparation they had before, taking advantage of most of the out-of-the box security features cloud providers offer but not everybody is aware, like being able to retrieve a forensic image from a running server or getting logs that they didn’t know they had. Some Key Features that differentiate Dredge from existing tooling: - Python-based CLI - Retrieve logs seamlessly from Github, Kubernetes, AWS, GCP or Azure. - Take action: whether it's blocking an IP in an AWS tenant, disabling an AccessKey, isolating an EC2 instance, or strategically extracting crucial post-compromise user data. - Identify tactical misconfigurations that can be exploited by an attacker. - Execute Threat Hunting Techniques - Create an attack timeline based on IOCs. - Analyze retrieved data effortlessly within your terminal, utilizing built-in capabilities from VirusTotal and Shodan. - Cloud Incident Response Guidelines for companies to embrace and build their playbooks. Repo: https://github.com/solidarity-labs/dredge-mvp false Slides https://pretalx.com/hack-lu-2024/talk/QFMBPR/ https://pretalx.com/hack-lu-2024/talk/QFMBPR/feedback/ Europe - Main Room Talk 2024-10-22T15:30:00+02:00 15:30 00:30 An MSSP SOC presents how after a complete change of team and processes - a CTI program was restarted from (nearly) scratch, thanks to an EU-supported project. The SOC Technical Product Manager/CTI project manager will share how plans don't always come to fruition, issues faced with starting a CTI process. By sharing lessons learnt and plans for improvement - we propose some basic but wholistic steps to start a CTI program. hack-lu-2024-54437-you-just-got-a-cti-program-funded-now-what topic: CTI Lukas Vytautas Dagilis en After COVID, and with an almost completely new SOC team – some processes got left behind, some tools forgotten. What happens when your SOC completely falls outside of the CTI process? Where should you start when your CTI process doesn’t even exist? While CTI is understood to be expensive even for internal SOCs - as an MSSP SOC - we need to fund something that we cannot sell to customers. NRD CS was awarded a grant to build out their cyber threat intelligence maturity, but how does that actually work? After a few months with a fancy new title, but still performing your old duties - you're finally handing off all your clients to your replacement, and are getting ready to jump into your new role. And then, here comes your CEO and SOC manager with news that they've just secured a public grant for a CTI program, and they want you to lead it. Part-time. This talk explores managing every aspect of starting a CTI program from (nearly) scratch, where a completely new SOC team takes over old processes and tools. Where do you start when your CTI program doesn't even exist? Our CTI development has already gone from being a CTI consumer with no practical application for the CTI, to a CTI consumer AND producer with standardized production, in addition to being a sharing community administrator. We will also present plans on increasing automation, quality of output, and more. We'll present various challenged faced in kick-starting a CTI program, from what do when your MISP is full of false-positives, how to motivate analysts to contribute to the program, how to build a 'team' when you don't have dedicated staff. We also explore technical issues faced, from connecting separate SIEMs into a central location, impact of infrastructure changes to development work, just how hard hiring dedicated CTI specialists can be, JIRA automation pricing changes completely ruining our initial plans, and more. In the end, we propose a basic plan comprised of a few simple steps and procedures that nearly anyone can implement to get a basic CTI program going. false Slides https://pretalx.com/hack-lu-2024/talk/ZTXHFU/ https://pretalx.com/hack-lu-2024/talk/ZTXHFU/feedback/ Europe - Main Room Talk 2024-10-22T16:15:00+02:00 16:15 00:30 This presentation explores my discovery of unconventional malware persistence techniques through registry modifications and DLL hijacking vulnerabilities. We'll delve into cases involving Windows Internet Explorer, Win32API cryptographic features, Windows Troubleshooting, Microsoft Teams (patched), and Process Hacker 2 (patched in v3). The research highlights the exploitation of legitimate Windows resources for persistence and compares these methods with traditional techniques employed by APT groups and ransomware authors. hack-lu-2024-54199-malware-and-hunting-for-persistence-how-adversaries-exploit-your-windows topic: CTI /media/hack-lu-2024/submissions/XAYHMK/2024-05-06_22-26_vCAV2A0.png cocomelonc en This presentation explores my discovery of unconventional malware persistence techniques through registry modifications and DLL hijacking vulnerabilities. We'll delve into cases involving Windows Internet Explorer, Win32API cryptographic features, Windows Troubleshooting, Microsoft Teams (patched), and Process Hacker 2 (patched in v3). The research highlights the exploitation of legitimate Windows resources for persistence and compares these methods with traditional techniques employed by APT groups and ransomware authors. Detailed Proposal: What is Malware Persistence? An introduction to malware persistence, explaining how it allows malicious software to maintain a foothold on a compromised system. User Privileged Techniques: Exploring persistence methods that require only user-level privileges, such as registry modifications and leveraging user-specific settings. Admin Privileged Techniques: Investigating persistence techniques that need administrative privileges, including advanced registry modifications and system-level changes. WinAPI Cryptography Features for Persistence: Analyzing how Windows cryptographic APIs can be misused for maintaining persistence. Vulnerability in Process Hacker 2: A case study on exploiting a vulnerability in Process Hacker 2 for persistence, and the subsequent fix in Process Hacker 3. Using Legitimate URLs for Bypassing and Persistence: Examining the use of legitimate URLs and online services to bypass detection and maintain persistence. Hunting for Persistence: From Zero to Hero: A practical guide on hunting for and identifying new persistence techniques, with step-by-step methodologies and real-world examples. Comparison with Classical Techniques: Comparing these new methods with classical persistence techniques used by APT groups and ransomware authors, highlighting their effectiveness and stealthiness. Explore the integration of machine learning models to predict and identify new persistence techniques. Investigate the potential for automated malware persistence using AI to adapt to and evade AV/EDR solutions dynamically. false Malware and Hunting for Persistence https://pretalx.com/hack-lu-2024/talk/XAYHMK/ https://pretalx.com/hack-lu-2024/talk/XAYHMK/feedback/ Europe - Main Room Talk 2024-10-22T16:45:00+02:00 16:45 00:30 Inside operational systems (OT), industrial devices communicating over IP could use a wide range of field-specific, manufacturer-dependent or association-promoted industrial network protocols. To understand each other, they sometimes require an additional component as a gateway to make the translation between protocols. These nearly invisible devices play a crucial role in the industrial process: if the translation stops, the communication stops and possibly operations as well. From an attacker's perspective, this means that targeting them may have significant consequences. With this in mind, I assessed the security of a gateway model I often encounter during penetration tests on OT and I discovered several vulnerabilities that have been reported to the manufacturer. Months later, I would like to discuss the many concerns raised by the vulnerabilities themselves and the disclosure process. This tells us a lot about the current situation, issues and threats faced by such gateways, how they are and can be addressed, and what it means for OT cybersecurity. hack-lu-2024-52926-trying-gateway-bugs-breaking-industrial-protocol-translation-devices-before-the-research-begins topic: hack.lu Claire Vacherot en After introducing the very particular world of industrial network protocols and what they are used for, I will go through a vulnerability research process on a protocol gateway, from discovery to disclosure. Three first vulnerabilities discovered on the device tested will be explained and discussed considering common industrial operations, manufacturers' response, customers' remediation and global OT cybersecurity research. false Claire Vacherot - Trying Gateway Bugs - Presentation https://pretalx.com/hack-lu-2024/talk/ZCBUU9/ https://pretalx.com/hack-lu-2024/talk/ZCBUU9/feedback/ Europe - Main Room Talk 2024-10-22T17:15:00+02:00 17:15 00:30 This talk, "In-Depth Study of Linux Rootkits," will provide a comprehensive examination of the evolution of Linux rootkits, from their inception to the sophisticated variants seen today. Participants will gain insights into advanced rootkit techniques, effective detection strategies, and the future landscape for defenders. By exploring the historical context, current methodologies, and emerging threats, attendees will be equipped with the knowledge and tools necessary to safeguard Linux systems against rootkit attacks. hack-lu-2024-53358-in-depth-study-of-linux-rootkits-evolution-detection-and-defense topic: hack.lu Stephan Berger en 1. Introduction to Linux Rootkits - Overview of Linux rootkit capabilities 2. A History of Linux Rootkits - Early rootkits: origins and initial capabilities - Evolution of rootkit techniques over time 3. Advanced Rootkits: Techniques and Analysis - Kernel-level rootkits: - Techniques for hooking and modifying kernel functions - User-mode rootkits: - Methods for intercepting and manipulating user-space processes - Hybrid rootkits: - Combining kernel and user-space techniques - Rootkit persistence mechanisms and stealth techniques 4. Detection Strategies for Linux Rootkits - Signature-based detection: - Tools and techniques for identifying known rootkits - Limitations of signature-based methods - Behavioral analysis: - Monitoring system behavior for anomalies - Case studies of successful behavioral detection - Integrity checking: - Verifying the integrity of system files and binaries - Challenges in maintaining accurate baselines - Advanced detection tools and frameworks: - Overview of popular rootkit detection tools - Demonstration of practical detection techniques false https://pretalx.com/hack-lu-2024/talk/UWJCEE/ https://pretalx.com/hack-lu-2024/talk/UWJCEE/feedback/ Europe - Main Room Talk 2024-10-22T17:45:00+02:00 17:45 00:30 Honeypots are invaluable tools for monitoring internet-wide scans and understanding attackers' techniques. Traditional low-interaction web honeypots use manual methods to emulate various applications or vulnerabilities. Introducing Galah, an LLM-powered web honeypot that mimics diverse applications with a single prompt. This honeypot dynamically crafts relevant HTTP responses, including headers and body content, to various HTTP requests, effectively simulating multiple web applications. In this talk, I will share lessons learned from building and deploying Galah and address two key questions: How do different large language models perform in generating HTTP messages? Does delivering authentic-looking HTTP responses increase attackers’ engagement with the honeypot? hack-lu-2024-51506-decoding-galah-an-llm-powered-web-honeypot topic: hack.lu Adel Karimi en In this talk, I will explore the limitations of traditional web honeypots and introduce Galah, an innovative LLM-powered solution designed to dynamically generate realistic HTTP responses. By evaluating the performance of different LLMs, we aim to determine their effectiveness in mimicking web applications and enhancing honeypot authenticity. I will share insights into the development process, including how to structure prompts, generate JSON outputs, and overcome common challenges. Additionally, I will present evaluation results, comparing various large language models to highlight their strengths and weaknesses. The talk will also feature interesting examples of LLM-generated HTTP responses. Finally, I will discuss practical insights and broader applications of LLMs beyond honeypots, offering valuable takeaways for attendees interested in leveraging LLMs for diverse use cases. false Slides https://pretalx.com/hack-lu-2024/talk/LGTEXR/ https://pretalx.com/hack-lu-2024/talk/LGTEXR/feedback/ Schengen 1 & 2 Training 2024-10-22T14:00:00+02:00 14:00 02:00 Return Oriented Programming (ROP) has been an essential part of exploit development since over a decade. The ROP landscape on ARM64 is bleak, thanks to severe restrictions laid down in the ARM64 ISA. This workshop provides a hands-on tutorial for starting out with ARM64 ROP gadgets and practical ROP chains. No prior knowledge of ARM64 assembly is required. hack-lu-2024-51940-rop-on-arm64-a-hands-on-tutorial topic: hack.lu Saumil Shah en ### Part 1 - Introduction to essential ARM64 assembly - Introducing ARM64 - Registers and their behaviour on ARM64 - ARM64 vs ARM32 architecture and assembly language - A few ARM64 assembly instructions - Restrictions on operand usage ### Part 2 - ROP Gadgets on ARM64 - Commonly found ROP gadgets on ARM64 - Where to look for ARM64 ROP gadgets - Practical Ret2System ROP chain on ARM64 ### Hands-On Workshop Requirements - Working Laptop running Docker - Linux or macOS preferred as the base OS. Participants will be provided with an ARM64 emulator docker container for use during and after the workshop. false https://pretalx.com/hack-lu-2024/talk/YJYZFT/ https://pretalx.com/hack-lu-2024/talk/YJYZFT/feedback/ Echternach & Diekirch Workshop 2024-10-22T10:15:00+02:00 10:15 01:30 In the evolving cyber threat landscape, reverse engineering is crucial for understanding and mitigating malicious attacks. This session covers the essentials of reverse engineering, including assembly language, binary code, and key tools like disassemblers and debuggers. Participants will explore practical techniques for analyzing malware, learning to identify and dissect various types through real-world examples. The session includes a hands-on demonstration using tools like x32dbg and Ghidra, focusing on unpacking, disassembly, and extracting Indicators of Compromise (IOCs). Additionally, best practices and strategies to overcome common challenges in reverse engineering will be discussed, equipping security professionals with the skills to effectively defend against cyber threats. hack-lu-2024-55202-dissecting-the-threat-a-practical-approach-to-reverse-engineering-malicious-code-for-beginners topic: hack.lu Ankshita Maunthrooa en My session is focused on a deep analysis of malicious threats and what could be an imaginable practical approach to reverse engineer these threats (malware) in a controlled environment. Here is a small breakdown of my session: Introduction: Reverse engineering plays a critical role in understanding and mitigating these threats by providing insights into the inner workings of malicious code. In this session, we will delve into the fundamentals of reverse engineering and explore practical approaches to dissecting malicious code effectively. Fundamentals of Reverse Engineering: Reverse engineering is the process of analyzing software or hardware to understand its design, functionality, and operation. Before diving into the analysis of malicious code, it's essential to grasp the foundational concepts and terminology of reverse engineering. This includes understanding assembly language, binary code, and the role of tools such as disassemblers, debuggers, and decompilers. Participants will gain insights into how these tools are used to examine executable files and extract valuable information from them. Understanding Malicious Code: Malicious code comes in various forms, each with its own set of functionalities and objectives. From viruses and worms to Trojans and ransomware, the threat landscape is diverse and constantly evolving. Through real-world examples, participants will learn to identify different types of malware and understand their behaviors. By gaining insight into the tactics employed by threat actors, security professionals can better prepare for and defend against cyber attacks. Practical Approach to Reverse Engineering: A practical approach to reverse engineering involves a systematic and methodical analysis of malicious code. During this segment, participants will be guided through a step-by-step demonstration of how to dissect a sample of malicious code. This will include techniques such as unpacking, disassembly, and code analysis. By leveraging tools like Ghidra, and OllyDbg, attendees will learn to navigate through the intricate layers of obfuscation employed by malware authors. Techniques for Extracting Indicators of Compromise (IOCs): In addition to understanding the inner workings of malicious code, reverse engineering can also help extract valuable indicators of compromise (IOCs). These IOCs include file hashes, IP addresses, domain names, and patterns of behavior that can be used to detect and mitigate threats. Participants will learn techniques for identifying and extracting IOCs from malware samples, thereby enhancing their ability to detect and respond to cyber attacks. Best Practices and Pitfalls: While reverse engineering is a powerful tool for analyzing malicious code, it is not without its challenges. Participants will gain insights into common pitfalls encountered during the analysis process and learn best practices for overcoming them. This includes strategies for handling obfuscated code, managing complex malware samples, and ensuring the integrity of analysis environments. By adhering to these best practices, security professionals can maximize the effectiveness of their reverse engineering efforts. Conclusion: In conclusion, reverse engineering is a vital skill for security professionals seeking to understand and mitigate cyber threats. By mastering the practical approaches and techniques discussed in this session, participants will be better equipped to dissect malicious code, extract valuable insights, and defend against cyber attacks. As the threat landscape continues to evolve, the ability to reverse engineer malware effectively will remain a critical component of any cybersecurity strategy. true Presentation Slides https://pretalx.com/hack-lu-2024/talk/XEUUFC/ https://pretalx.com/hack-lu-2024/talk/XEUUFC/feedback/ Echternach & Diekirch Training 2024-10-22T14:00:00+02:00 14:00 02:00 The goal of the tool suite is to make it easier to handle suspicious contents reported by your users, friends or constituents. It empowers them to check URLs, emails, or files they receive and take educated decisions without relying on you all the time. This workshop will go in depth on how you can configure Lookyloo and Pandora, and all the other tools that make it a complete tool suite usable in your organization with minimal manual work. We will also look at the correlation features to pivot across captures to find phishing campaigns in the 4+ millions captures gathered across the years on the CIRCL Lookyloo instance. hack-lu-2024-54285-lookyloo-pandora-and-all-the-bells-and-whistles-to-go-with-them topic: hack.lu Raphaël Vinot en [Lookyloo](https://github.com/Lookyloo/lookyloo) is an analysis tool to investigate URLs, [Pandora](https://github.com/pandora-analysis/pandora) is a static file analyzer. They both have public demo interfaces ([1](https://lookyloo.circl.lu/), [2](https://pandora.circl.lu/submit)) and I presented them at [last year pass the salt](https://passthesalt.ubicast.tv/videos/2023-analyse-your-weird-urls-the-easy-way/) (and demo effect is still [a thing](https://passthesalt.ubicast.tv/videos/2023-rump-lookyloo-the-missing-demo-from-the-morning/)). I invite you to watch the videos before attending the workshop so we're all on the same page: this workshop will be very dense as we will cover many tools, so we will start with a quick introduction but we will also assume you have a rough idea of what the tools are. This workshop will be similar to the one we gave at [Pass the Salt 2024](https://cfp.pass-the-salt.org/pts2024/talk/9HQ9VQ/), but with new features and improvements. The main tools we will use are the following: * Lookyloo (to analyze URLs) * Pandora (to analyze files) * Lacus (optionally, to capture the URLs when you have a lot of them) * An URL monitoring interface (to compare a specific URL over time) * Phishtank Lookup (to check if a URL is known or not) We will also have a look at what a capture means for Lookyloo, and a deep dive in the settings you can pass when you're triggering one. Due to time constraints, won't have much time to troubleshoot sysadmin issues on your own machines. Do not worry though, there are pre-configured instances of all the tools you'll be able to play with during the session, and use their APIs. If you want to install the tools on your machine, you'll need admin right on a recent linux box, preferably Ubuntu 24.04. false https://pretalx.com/hack-lu-2024/talk/DSHQJ7/ https://pretalx.com/hack-lu-2024/talk/DSHQJ7/feedback/ Hollenfels Workshop 2024-10-22T10:15:00+02:00 10:15 01:30 During this workshop, you will learn how to use the various tools from the OpenSSH suite. We will start with a presentation of the problems that are solved by OpenSSH, then we will dive into the details of its most important and useful features. Among the topics covered, we will discuss about remote host authentication, password and public key client authentication, key generation, local and remote port forwarding, forward and reverse SOCKS proxying, X11 forwarding, jumphosts, connection to legacy systems, and more. Hands-on exercises will be proposed throughout the exploration of the tool suite using real-life scenarios. There will be space for questions and discussion. This workshop is intended for beginners who wants to improve their practical knowledge and experience with OpenSSH. Basic networking and Linux shell knowledge are required in order to follow this workshop. Each participant will need a Linux machine (on which they have root access) with Docker pre-installed and Internet access. hack-lu-2024-50649-exploring-openssh-hands-on-workshop-for-beginners topic: hack.lu William Robinet en Most beginners only use the *ssh* command from OpenSSH to reach a shell on remote machines, and that's it. They don't really know how to deal with features like port forwarding in order to ease their work. This workshop is designed to help them level up their skills with OpenSSH. This workshop is intended for beginners who want to improve their practical knowledge of the OpenSSH tool suite. Knowledge prerequisites: - Basic networking: IP, TCP/UDP, DNS, tcpdump/Wireshark - Classical Linux shell usage: command execution, redirections, pipes, sudo, basic package management, etc - Basic usage knowledge of OpenSSH true Support repository Slide deck https://pretalx.com/hack-lu-2024/talk/3UBBJQ/ https://pretalx.com/hack-lu-2024/talk/3UBBJQ/feedback/ Vianden & Wiltz Training 2024-10-22T14:00:00+02:00 14:00 02:00 Log events appear differently in SIEMs. There are plenty of different taxonomies, possibilities for customization or just migration scenarios that make it challenging to generate queries from Sigma rules that match on events in given log repositories. Processing pipelines are a feature of the open source Sigma toolchain that offer a solution for these challenges and this session is about some real-world use cases for them. hack-lu-2024-53779-operationalization-of-sigma-rules-with-processing-pipelines topic: hack.lu Thomas Patzke en The [Sigma project](https://sigmahq.io/) offers thousands of open source detection rules that can be used to conduct threat hunting and detection. But before this can be done the conversion tool has to be configured properly to generate queries that match on the given data model in the used SIEM or EDR. [pySigma processing pipelines](https://blog.sigmahq.io/connecting-sigma-rule-sets-to-your-environment-with-processing-pipelines-4ee1bd577070) offer a feature-rich YAML-based language for this purpose that allows a wide range of transformations like: * simple field mappings * value transformation with regular expressions * Addition of conditions * Handling of placeholders * conditional Jinja2-based templating Transformations can be applied conditionally to rules with specific attributes or detection items that match a given pattern. In this hands-on session you will learn some common use cases for processing pipelines and have the opportunity to discuss real-world challenges you encountered while operationalization of Sigma rules in your environment. false Slides https://pretalx.com/hack-lu-2024/talk/UJAWVW/ https://pretalx.com/hack-lu-2024/talk/UJAWVW/feedback/ Vianden & Wiltz Training 2024-10-22T16:15:00+02:00 16:15 02:00 Join us for an immersive hands-on workshop where we'll dive into KubeHound, a Tool for building Kubernetes attack paths. Participants will play the role of an attacker, but we think the best defense is a good offense. With concrete scenarios and a live environment, attendees will learn to leverage KubHound to identify attack paths in Kubernetes clusters at scale with no hustle. hack-lu-2024-54476-0-hands-on-kubernetes-security-with-kubehound-purple-teaming topic: hack.lu Julien en There’s no two ways about it: Kubernetes is a confusing and complex collection of intertwined systems. Finding attack paths in Kubernetes by hand is a frustrating, slow, and tedious process. Defending Kubernetes against those same attack paths is almost impossible without any third party tooling. In this workshop we will present KubeHound - an opinionated, scalable, offensive-minded Kubernetes attack graph tool used by security teams across Datadog. We will cover the custom KubeHound DSL to demonstrate its power to identify some of the most interesting and common attack primitives living in your Kubernetes cluster. If the DSL is not enough, we will cover the basics of Gremlin, the language used by our graph technology so you can find relevant attack paths that matter to you. As attackers (or defenders), there's nothing better to understand an attack than to exploit it oneself. So in this workshop we will cover some of the usual attack paths and exploit them. This way you will see by yourself, the difficulty (or not) to fully compromise a Kubernetes cluster (#DontDoThisAtHome). At last, is this workshop we will also demonstrate two ways of using KubeHound: * As a standalone tool that can be run from a laptop * Or deployed as a service in your own Kubernetes clusters (KubeHound as a Service) The main goal of this workshop is to show how defenders can find and eliminate the most dangerous attack paths and how attackers can have a treasure map to fully compromise a Kubernetes cluster by using the free and open source version of KubeHound. false https://pretalx.com/hack-lu-2024/talk/JDM9V7/ https://pretalx.com/hack-lu-2024/talk/JDM9V7/feedback/ Europe - Main Room Talk 2024-10-23T09:00:00+02:00 09:00 00:30 Discussing a ransomware sample that contains inherent flaws in its cryptographic design. Although well-established cryptographic primitives are used (like AES), they are used in a flawed way and introduce vulnerabilities that when exploited, lead to the decryption of ransomed files without knowing the encryption password and/or key. hack-lu-2024-54209-csirt-and-the-chocolate-factory topic: hack.lu Didier Stevens en Our CSIRT team responded to a ransomware attack at a small company specialized in the production of chocolate machines. All their documentation (technical, commercial, administration, …) was ransomed, and they would go out of business if they could not recover their documentation soon. To prevent this, they paid the ransom and obtained a decryption tool and a key, but it malfunctioned. The files were still ransomed. At this point, our CSIRT was called in and successfully decrypted the ransomed documentation. It turned out that, due to some malfunction, the original ransomware did not encrypt the original files (just changed their extension and added ransomware metadata), while the decryptor then actually encrypted the files (and restored the original extension and removed the ransomware metadata). After this success, research into the algorithms implemented in this ransomware strain started. It became clear that this sample contains inherent flaws in its cryptographic design. Although well-established cryptographic primitives are used (like AES), they are used in a flawed way and introduce vulnerabilities that when exploited, lead to the decryption of ransomed files without knowing the encryption password and/or key. The vulnerabilities are caused by the combination of 1) the use of AES CTR (counter) mode, 2) partial encryption of ransomed files, and 3) reuse of encryption keys across same and different ransomed files. These vulnerabilities enabled our CSIRT to develop decryptor scripts that can decrypt ransomed files in most cases. For example, the redundancy in ransomed ZIP files (like .docx, .xlsx, …) can be used to decrypt a collection of these files. The more ransomed ZIP files available, the better for this decryption method. We will cover different decryption methods during the presentation. Finally, during this presentation, we will demo and share YARA rules to detect this ransomware and new variants (associated with Scarab/Spacecolon), together with our decryption scripts. true https://pretalx.com/hack-lu-2024/talk/8FR7FH/ https://pretalx.com/hack-lu-2024/talk/8FR7FH/feedback/ Europe - Main Room Talk 2024-10-23T09:30:00+02:00 09:30 00:30 How to become an Incident Response Rockstar? After conducting hundreds of Incident Response cases, more data is not always better. Focusing on the most relevant forensic data can speed up the investigation process rapidly. In this talk, we will discuss the importance of various event logs to track down lateral movement paths from the attackers, how to find planted (and seemingly legitimate) backdoors, and how you can work smarter, not harder – which also holds true in digital forensics. As a bonus, we will discuss less-known artifacts like MPLogs and the bitmap cache. By attending this talk, participants will be better and more efficient Incident Responders as they can focus on key aspects of an investigation. After this talk, the audience understands the top artifacts evaluated in every incident response case. For example, we will discuss a variety of event logs, starting from the classic Security event logs to the Remote Desktop event logs, to Amcache, Shimcache, Prefetch files, and more. This discussion will lay the groundwork for how we approach large-scale incident response investigations, how we can track down remote access tools installed by attackers as legitimate backdoors, or how to spot new and unusual services within the environment in no time. As one must work smarter, not harder, we extensively use the Velociraptor artifact DetectRaptor from Matt Green, which works for Rapid7 now. This Velociraptor hunts will find evil within minutes, allowing the Incident Responders responsible for the investigation to concentrate on other aspects of the case or to dig deeper into the hosts where the detections occurred. At the end of the presentation, we will discuss lesser-known artifacts like the Defender MPLogs, which can be a goldmine, the bitmap cache, or the SRUM database. hack-lu-2024-54298-the-gist-of-hundreds-of-incident-response-cases topic: hack.lu Stephan Berger en After this talk, the audience understands the top artifacts evaluated in every incident response case. For example, we will discuss a variety of event logs, starting from the classic Security event logs to the Remote Desktop event logs, to Amcache, Shimcache, Prefetch files, and more. This discussion will lay the groundwork for how we approach large-scale incident response investigations, how we can track down remote access tools installed by attackers as legitimate backdoors, or how to spot new and unusual services within the environment in no time. Speaking of essential event logs, we will discuss the importance of PowerShell event logs and logging, as these are still up to date and frequently used by ransomware groups and APTs. We will showcase how to find suspicious files, which might point out a staging directory from the attacker, as well as the importance of checking the antivirus logs carefully (which is always my first step into a new investigation). On the other hand, we will discuss other important forensics concepts like Shellbags and how you can present them to the customer in which directories the threat actor(s) roamed around. As one must work smarter, not harder, we extensively use the Velociraptor artifact DetectRaptor from Matt Green, which works for Rapid7 now. This Velociraptor hunts will find evil within minutes, allowing the Incident Responders responsible for the investigation to concentrate on other aspects of the case or to dig deeper into the hosts where the detections occurred. At the end of the presentation, we will discuss lesser-known artifacts like the Defender MPLogs, which can be a goldmine, the bitmap cache, or the SRUM database. false https://pretalx.com/hack-lu-2024/talk/GMEUXG/ https://pretalx.com/hack-lu-2024/talk/GMEUXG/feedback/ Europe - Main Room Talk 2024-10-23T10:15:00+02:00 10:15 00:30 Hacking humans with IoT? It is happening now and will only scale. The rapid evolution of AI technologies, mass development and production of IoT equipment which is interconnected and can be orchestrated on backend by massive AI platforms which are sourcing, processing and cross-correlating personal and sensitive data completely changes human vs computer paradigm. No chip implant is needed to control a human, unlike it may be commonly believed. As long as enough biometric and behavioral information is collected on human beings, they and their social contacts can be completely manipulated in predictable manner. The environment of connected society is a perfect stage, where the humans are exposing their harvestable biometric and behavior profiles, by publishing content in social media or giving up the IoT devices around the things which they are reluctant to share with their closest friends. This is the new battle ground where our digital identities are appearing and exposing our strengths and weaknesses at the same time. Those identities can be created, stolen, or replicated without our consent by criminals and state sponsored actors, appear in the places we are not aware, and leveraged to target our digital presence and physical life. By connecting the dots between generative AI, predatory advertisement companies, biometric data harvesting and Human - IoT interactions – we demonstrate the significant expansion of the attack surface against humans and social groups. Disinformation, public opinion manipulation, virtual kidnapping, exploitation of human digital identities are the fruits of the same tree. The data collected and processed in the IoT based smart environments is a gold mine for criminals and state sponsored actors to manipulate humans the way and at the scale which was impossible before. The presentation is focusing on the attack scenarios and case studies of targeted individuals, social groups that we either have observed or to observe in the wild, including election campaigns in social media, assets take over, extortion. The consequences of attacks lead to behavior changes and actions in both, physical and digital world including changing the decisions, social engineering, exfiltration of sensitive information, choosing most vulnerable targets to attack high security environments, swaying opinions, affecting elections and other critical events, that may change the history. We will also cover both, defense options and choke points related to the expanded attack surface. hack-lu-2024-51802-iot-hacks-humans-unexpected-angles-of-human-process-compromise topic: hack.lu Vladimir Kropotov en 1. Introduction (4m) - Human Process Compromise is Business Process Compromise moved one step closer to the human. -- Why Human Process Compromise is a fragile chain under Business Process Compromise umbrella -- How HPCs completely bypass this entire classes of security measures. - IoT angle of HPC - What IoT knows about humans. - Technology enablers for attacks - Techniques to manipulate humans and public opinions. 2. Tools and technologies used (6m) - Use of the connected world data to choose appropriate targets. -- Profiling humans for criminal monetization attacks -- Choosing a targets for espionage operations -- Affecting critical events, like elections - Weaponization - extracting human, social groups and society habits and weaknesses to target - Actions on target - empowering and boosting manipulation techniques with IoT and connected world data. -- Boosting Fake News and Opinion manipulation campaigns with IoT data -- Reshaping Identity linked attack surface like bank account MFA, voice authentication, SIM card based identities using HPC. -- Targeting physical events. - Required knowledge, technologies and cost of operations. 3. Connecting the dots: Attack scenarios and cases studies (15 m) - Underground actors approach and criminal monetization -- Services and Technologies: use and abuse of big data, generative AI, Biometrics, PII, voice, face, source phone number substitution, IoT and cloud IoT technologies and credentials market. -- Typical targets (victims) and attack scenarios -- Criminal business processes and monetization options - State sponsored attack scenarios -- Espionage with HPC -- Forced and disruptive physical actions against critical assets -- Manipulations of negotiations outcomes -- Manipulating the crowds and societies attack scenarios. - Privacy breaches scenarios which leverage IoT connectivity(4m) How to deal with it (3m) Conclusion(2m) false Slides https://pretalx.com/hack-lu-2024/talk/QJAJJK/ https://pretalx.com/hack-lu-2024/talk/QJAJJK/feedback/ Europe - Main Room Talk 2024-10-23T10:45:00+02:00 10:45 00:30 In this talk, we'll dive into KubeHound, a Tool for building Kubernetes attack paths. We will present the genesis of the project and what answers regarding your Kubernetes cluster security it might bring to you. We will cover how KubeHound bring you offensive mindset on a silver platter because we think the best defense is a good offense. Live demos of KubeHound from the defender’s and attacker’s point of view will be performed during the talk. hack-lu-2024-54478-kubehound-identifying-attack-paths-in-kubernetes-clusters-at-scale-with-no-hustle topic: hack.lu Julien en There’s no two ways about it: Kubernetes is a confusing and complex collection of intertwined systems. Understanding interdependencies in a Kubernetes cluster, in particular gaps left open by seemingly innocent configuration changes, is beyond human capability. But all misconfigurations are not equal, some are not a big deal, but some can lead to the full take of an entire Kubernetes cluster. This illustrates the well-known adage: "Defenders think in lists, attackers think in graphs; as long as this is true, attackers win". In this talk we will introduce how KubeHound, an opinionated, scalable, offensive-minded Kubernetes attack graph tool used by security teams across Datadog, can help you pinpoint the most critical attack within your Kubernetes cluster: From a defender’s point of view, it means how to prioritize which security initiative is more important built on concrete Security KPI. From an attacker’s point of view, it means finding the lowest effort attack path that will lead to his goal, usually full take over of the entire cluster. Having a treasure map saves a ton of time for the attacker. In short, single point security findings have little traction either for an attacker or defender. So we will demonstrate how KubeHound being a queryable, graph database of attack paths makes reasoning about security problems via data-driven testing of hypotheses extremely efficient. At the end of the talk, we will leave you with an open-source version of KubeHound designed to be run from a laptop to evaluate the attack paths within a single cluster from an attacker or defender point of view. Finally, we will discuss the approach and challenges of implementing a distributed, large-scale version of the tool at Datadog and how you might implement a similar solution in your own environment. false https://pretalx.com/hack-lu-2024/talk/HWDZGZ/ https://pretalx.com/hack-lu-2024/talk/HWDZGZ/feedback/ Europe - Main Room Talk 2024-10-23T11:15:00+02:00 11:15 00:30 In an era where cognitive warfare has become a pivotal battleground, the strategic manipulation of information to influence public perception and decision-making processes poses significant threats to global security and stability. This multifaceted domain exploits digital interconnectedness, leveraging psychological vulnerabilities and technological platforms to achieve its objectives. The complexity of cognitive warfare necessitates advanced strategies that incorporate cyber threat hunting, open-source intelligence (OSINT), and ethical hacking. These methodologies are critical in identifying, understanding, and mitigating the sophisticated tactics employed by adversaries in the digital landscape. hack-lu-2024-50655-the-web-of-cognitive-warfare topic: CTI /media/hack-lu-2024/submissions/9SSSTW/Session-pic_oqtTuNK.png Jindrich Karasek en In this talk, I use CTI methods to analyse influence operations and cognitive warfare to showcase the ongoing operation done by the threat actor in their new modus operandi - use of paid adds based targeting, combination with finance scams and vast data collection on social networks. The OPSEC of the actor allows for long term campaigns with low levels of detection, even by the AI. false My other work: My LinkedIn profile: Slides - The Web of Cognitive Warfare https://pretalx.com/hack-lu-2024/talk/9SSSTW/ https://pretalx.com/hack-lu-2024/talk/9SSSTW/feedback/ Europe - Main Room Talk 2024-10-23T11:45:00+02:00 11:45 00:30 Over the past 12 months, Volexity has identified two security incidents in customer environments caused by zero-day exploits: CVE-2023-46805 & CVE-2024-21887 (Ivanti Connect Secure), and CVE-2024-3400 (Palo Alto Networks Global Protect). This talk will explore why security issues affecting edge devices remain a persistent problem, examine common detection approaches used by Volexity to identify such incidents, and outline methods organisations can employ to detect similar incidents within their own environments. hack-lu-2024-57506-it-has-been-0-days-since-the-last-edge-device-security-incident topic: CTI Rascagneres en Over the past 12 months, Volexity has identified two security incidents in customer environments caused by zero-day exploits: CVE-2023-46805 & CVE-2024-21887 (Ivanti Connect Secure), and CVE-2024-3400 (Palo Alto Networks Global Protect). This talk will explore why security issues affecting edge devices remain a persistent problem, examine common detection approaches used by Volexity to identify such incidents, and outline methods organisations can employ to detect similar incidents within their own environments. true https://pretalx.com/hack-lu-2024/talk/DNBRHN/ https://pretalx.com/hack-lu-2024/talk/DNBRHN/feedback/ Europe - Main Room Lightning talk 2024-10-23T13:30:00+02:00 13:30 00:10 We need to reduce the inefficiency of each SOC analyzing and countering threats on their own with little to no efficient, actionable knowledge sharing, globally speaking hack-lu-2024-57051-a-quick-monologue-on-global-inefficiency hack.lu lightning talk Claus en A new threat emerges. This could be new malware, new exploitation techniques, new types/classes of vulnerabilities, new cloud attack vectors, whatever it is - the new threats leave every SOC globally, and individually, struggling to understand the threat in order to mitigate and detect This is horribly inefficient. We need something that scales better! I want point out this global inefficiency in order to explain why we need to issue a call for action. What's being done today is that researchers are trying to document their work researching malware, or forensically following the traces of attackers in networks/clouds, or detection teams sharing detections they built to address MITRE ATT&CK techniques. But they're sharing without a standard methodology or framework or even approach, and it also does not scale very well and the shared knowledge is never incorporated into a global body of knowledge. false https://pretalx.com/hack-lu-2024/talk/NXFR3H/ https://pretalx.com/hack-lu-2024/talk/NXFR3H/feedback/ Europe - Main Room Lightning talk 2024-10-23T13:40:00+02:00 13:40 00:05 An open source platform to support analysts to organise their case and tasks hack-lu-2024-57325-flowintel-flow-your-management hack.lu lightning talk Cruciani David en Quick presentation of the tool and main features. false https://pretalx.com/hack-lu-2024/talk/ZBCZDB/ https://pretalx.com/hack-lu-2024/talk/ZBCZDB/feedback/ Europe - Main Room Lightning talk 2024-10-23T13:45:00+02:00 13:45 00:05 The CRA in 2 slides. hack-lu-2024-57274-how-i-learned-to-stop-worrying-and-love-the-nlf hack.lu lightning talk fukami en This lightning talk aims at summarising upcoming EU product and service regulations and how they relate. false Slides Lightning Talk "How I Learned to Stop Worrying and Love the NLF" https://pretalx.com/hack-lu-2024/talk/WDD9BU/ https://pretalx.com/hack-lu-2024/talk/WDD9BU/feedback/ Europe - Main Room Lightning talk 2024-10-23T13:50:00+02:00 13:50 00:05 The 2038 problem will soon start to get picked up by the popular press, which will lead to significant public pressure to do something before our technology stack crashes. However our technology stack is getting so complex with abstraction layers that by 2038 it might positively unmanageable. This presents us with an opportunity to refit our social tech stack with something not only "secure-by-design" but also maintainable-by-future-generations-by-design. Behind all this drama lurks the challenge that as 19 January 2038 draws closer, ever more hands from around the globe will be frantically reaching for increasingly scarce components from one hotly contested island off the coast of the PRC. This is the truly hard problem which lies before us today. hack-lu-2024-57497-any-sufficiently-advanced-technology-is-indistinguishable-from-01-january-1970 hack.lu lightning talk /media/hack-lu-2024/submissions/TQZPPU/97e1z2_nLSHCg8.jpg Trey Darley en The 2038 problem will soon start to get picked up by the popular press, which will lead to significant public pressure to do something before our technology stack crashes. However our technology stack is getting so complex with abstraction layers that by 2038 it might positively unmanageable. This presents us with an opportunity to refit our social tech stack with something not only "secure-by-design" but also maintainable-by-future-generations-by-design. Behind all this drama lurks the challenge that as 19 January 2038 draws closer, ever more hands from around the globe will be frantically reaching for increasingly scarce components from one hotly contested island off the coast of the PRC. This is the truly hard problem which lies before us today. false https://pretalx.com/hack-lu-2024/talk/TQZPPU/ https://pretalx.com/hack-lu-2024/talk/TQZPPU/feedback/ Europe - Main Room Lightning talk 2024-10-23T13:55:00+02:00 13:55 00:05 This lightning talk will bring us to the little overview of the IPv4 exhaustion and time, which we had for being IPv6 ready with our skillsets. hack-lu-2024-57446-how-much-time-we-had-for-ipv6-preparation hack.lu lightning talk Nicol Dankova en The movement to the IPv6 is not only something, what will happen in the future. It has already happened and we often see that crazy thing in logs. How come, that it has happened so fast? Why we have not been prepared? Well, in fact... :) false https://pretalx.com/hack-lu-2024/talk/HGC9ZR/ https://pretalx.com/hack-lu-2024/talk/HGC9ZR/feedback/ Europe - Main Room Talk 2024-10-23T14:00:00+02:00 14:00 00:30 Passwords have long been a foundational element of cybersecurity, but they remain vulnerable to various attacks aimed at acquiring user credentials. Password management software (PM) has emerged as a key defense, yet misconfigurations and user errors can still result in data leaks. This presentation introduces a new red teaming tool, Pandora, capable of extracting credentials from 18 popular PM implementations, including desktop applications, browsers, and browser plugins. Pandora requires the PM to be active to dump its processes and analyzing them for user credentials. Although this vulnerability is not new, Pandora represents the first public tool to exploit it, emphasizing the need for the pentesting community to advocate for stronger protections from vendors to secure user credentials. Additionally, only two vendors have acknowledged the problem, with one CVE ID (CVE-2023-23349) reserved for Kaspersky. hack-lu-2024-52472-i-need-access-exploit-password-management-software-to-obtain-credential-from-memory topic: hack.lu Efstratios Chatzoglou en Passwords have long been a fundamental aspect of cybersecurity, with numerous attacks targeting the covert acquisition of user passwords. Password management software (PM) has emerged as a crucial defense mechanism against such attacks. Despite the security measures embedded in these applications, misconfigurations and user errors can still result in sensitive data breaches. In this context, the current presentation introduces a newly developed red teaming tool called Pandora (https://github.com/efchatz/pandora). Pandora is capable of extracting end-user credentials from 18 widely-used PM implementations, including MS Windows 10 desktop applications and browser plugins. The sole requirement for Pandora to function is for the PM to be active, enabling the tool to dump the PM’s processes. Through experimentation, it was found that only 1Password necessitates high integrity privileges for an attacker to dump the relevant processes. Once executed on a host machine, Pandora will dump the PM’s processes, analyze them, and extract any user credentials it finds. The tool offers various modes to support penetration testers and can provide an additional attack vector in red team engagements, given the widespread use of PMs today. Methodologically, Pandora operates based on the specific implementation of each PM. Many PMs store their entries or master credentials in plaintext format within the corresponding memory processes. Consequently, Pandora consists of different autonomous scripts tailored to each PM implementation. Following a Coordinated Vulnerability Disclosure (CVD) process, most vendors responded that these issues fall outside their scope, as the attacker requires local access, or the antivirus/endpoint detection and response (AV/EDR) systems might prevent such attacks. To date, only two vendors have acknowledged the problem, with one already reserving a CVE ID: CVE-2023-23349 (Kaspersky). It is important to note that this issue is not entirely new. It has long been recognized that there is no foolproof method for desktop applications to be protected against such attacks. However, to the best of our knowledge, this is the first time such a tool has been publicly discussed and made available. Since various PMs use different encryption and obfuscation methods, it is up to the pentesting community to encourage vendors to implement protections that will safeguard user credentials. false Slides https://pretalx.com/hack-lu-2024/talk/WM93CN/ https://pretalx.com/hack-lu-2024/talk/WM93CN/feedback/ Europe - Main Room Talk 2024-10-23T14:30:00+02:00 14:30 00:30 In the dynamic landscape of cybersecurity, continuous skill development is paramount. This presentation, titled "Empowering Cybersecurity Outreach and Learning through Collaborative Challenge Building, Sharing, and Execution," delves into innovative approaches to enhance outreach and learning in the field. Focused on the creation, sharing, and execution of challenges, particularly through platforms like Capture The Flag (CTF), the session aims to illustrate the transformative impact of hands-on experiences with the FIRST.org challenges. The discussion will also outline how it has grown, offering a wide variety of knowledge fields and strong collaboration between the volunteers and their supporting organisation. hack-lu-2024-52366-empowering-cybersecurity-outreach-and-learning-through-collaborative-challenge-building-sharing-and-execution topic: hack.lu Alexandre DulaunoyDavid Durvaux en ## Outline 1. Why a CTF at FIRST and Its Specificities? 2. How Gamification Supports Spreading Knowledge? 3. Are CTFs the Sole Approach? 4. Pitfalls and Points of Attention 5. Statistics and Figures 6. Conclusion ## Why Have a CTF at FIRST and Its Specificities? The FIRST.org CTF is designed to reinforce the FIRST community, spread knowledge, and foster trust and collaboration. The focus is placed on defensive and constructive aspects rather than offensive ones. Players are strongly encouraged to participate in teams. Tools are provided to help find potential teammates, resulting in teams composed of players who have not previously worked together. An interesting example was observed at the latest FIRST annual conference, where the team holding the 1st position for most of the week was formed in this manner. This section will, therefore, cover how a CTF, using the FIRST event as an example, is an effective way to contribute to establishing vibrant communities. ## How Gamification Supports Spreading Knowledge? Through challenges, players encounter intellectual hurdles designed for learning. Each challenge is built to ensure that the player learns by doing. Participation motivates players to strive and solve as many puzzles as possible. Working in teams encourages players to contribute to the collective effort and collaborate to maximize their results. A CTF combines rewards for collaborative efforts with a learn-by-doing approach. The CTF team itself demonstrates how organizations that might not typically collaborate can unite efforts toward a common goal. ## Are Only CTFs Useful for Gamification of Training? While CTFs are perhaps the most obvious technique, we will discuss an alternative option that could be offered to communities: [hackathons](https://en.wikipedia.org/wiki/Hackathon). As previously stated, the FIRST CTF is built with a constructive approach: players defend and are not rewarded for breaking things. Hackathons extend this concept further. A group of people collaborates on a dedicated task during a limited time, producing something that yields actual results. This might range from contributing to an existing tool to creating a proof of concept for a new tool. ## Pitfalls and Points of Attention In this section, we will discuss the challenges we encountered and the lessons learned. These encompass various aspects such as addressing cheating, providing on-site assistance, and aligning diverse expectations... ## Statistics and Figures In this section, we will revisit a decade of CTF at FIRST and compile notable statistics. It is particularly significant to highlight the considerable effort required to construct a high-quality CTF and illustrate how this effort is rewarded by robust participation at the conference. false https://pretalx.com/hack-lu-2024/talk/YYCNKP/ https://pretalx.com/hack-lu-2024/talk/YYCNKP/feedback/ Europe - Main Room Talk 2024-10-23T15:00:00+02:00 15:00 00:30 How to scan more than 500 thousand domains and subdomains and identify almost 300 thousand vulnerabilities and misconfigurations, ranging from minor (lack of proper SSL or DMARC configuration), to critical (SQL Injections or RCEs)? hack-lu-2024-52106-artemis-how-cert-pl-improves-the-security-of-the-polish-internet topic: hack.lu Krzysztof Zając en Since the beginning of 2023, CERT PL has been periodically scanning more than 500 thousand domains and subdomains of universities, hospitals, government institutions, schools, banks and other organizations, and detecting hundreds of thousands of issues (including high-severity ones, such as SQL Injection, in important entities). For that task we built a custom tool: Artemis (https://github.com/CERT-Polska/Artemis). It checks various aspects of website security and builds easy-to-read messages informing organizations about the scanning results. During the presentation, I will describe the way Artemis works, what we are looking for, and most significantly - lessons we've learned during our large-scale scanning project. As the tool is open-source, I will touch upon how to set up your own scanning pipeline. false Slides https://pretalx.com/hack-lu-2024/talk/88DSDM/ https://pretalx.com/hack-lu-2024/talk/88DSDM/feedback/ Europe - Main Room Talk 2024-10-23T15:30:00+02:00 15:30 00:30 This talk gives a practical overview and introduction of the [Spicy](https://docs.zeek.org/projects/spicy/en/latest/) parser generator for protocols and file formats. hack-lu-2024-54147-spicy-generating-robust-parsers-for-protocols-file-formats topic: hack.lu Benjamin Bannier en [Spicy](https://docs.zeek.org/projects/spicy/en/latest/) is a parser generator that makes it easy to create robust parsers for network protocols, file formats and more. Spicy is a bit like a "yacc for protocols", but it is much more than that: It is an all-in-one system enabling developers to write attributed grammars that describe both syntax and semantics of an input format using a single, unified language. Think of Spicy as a domain-specific scripting language for all your parsing needs. In the last couple of years we have evolved and used Spicy as a tool in the [Zeek network monitoring ecosystem](https://zeek.org/) to make it easier for researchers and domain experts to surface information transmitted live over the network. Spicy includes dedicated support to work with lossy captures or malformed traffic. By providing an API Spicy can be embedded into other projects (like Zeek embeds Spicy). This talk gives a practical overview and introduction of Spicy. false Slides https://pretalx.com/hack-lu-2024/talk/JU3CXK/ https://pretalx.com/hack-lu-2024/talk/JU3CXK/feedback/ Europe - Main Room Talk 2024-10-23T16:15:00+02:00 16:15 00:30 This talk provides an extensive overview of security challenges in satellite systems. It covers vulnerabilities across space, ground, link, and user segments, using real-world examples in the past security research and the Viasat incident. By analyzing various attack methods from software vulnerabilities to radio frequency interference, this talk offers crucial insights for protecting current satellite infrastructures and anticipating future security challenges in the rapidly evolving field of satellite technology.In addition, the open community cubesat projects are growing.Vulnerabilities in these projects could also be a new threat.There will be 1 case study and new found vulnerabilities sharing for open project and a special case study of ground-station system in this talk. hack-lu-2024-54387-securing-the-stars-comprehensive-analysis-of-modern-satellite-vulnerabilities-and-emerging-attack-surfaces topic: hack.lu Vic Huang en In the past, due to the high costs of satellite manufacturing, design, and launch, as well as regulatory restrictions, satellite research and production were closely linked to government agencies, research institutions, and military defense. In recent years, with the small size and light weight of small satellites, the widespread use of commercial components, and the significant reduction in satellite launch costs, the development and extensive use of small satellites have emerged. As a result, there has been a substantial increase in projects involving self-developed open-source satellite protocols and DIY small satellites. This article will share classic vulnerabilities from past satellite-related attacks and discuss new security vulnerabilities in open-source satellite protocols. The case studies include three vulnerabilities related to CAN bus transmission in the open-source library SPACECAN, which is used for internal satellite communication in the LibreCube project, an open-source satellite project. It also covers issues with libcsp, an open-source satellite communication protocol with a 10-year history that has been used by several satellites, including those of the European Space Agency (ESA). Additionally, the article includes a special case study of a ground station-like system, analyzing the process and implications of achieving remote code execution (RCE) and affecting satellites. false slides https://pretalx.com/hack-lu-2024/talk/NUZYZK/ https://pretalx.com/hack-lu-2024/talk/NUZYZK/feedback/ Europe - Main Room Talk 2024-10-23T16:45:00+02:00 16:45 00:30 CTI practitioners have threat intelligence databases; what about digital forensics practitioners? How can they organize knowledge and ensure that investigations are carried out in a repeatable manner? In the same way that threat intelligence describes attackers, capabilities, and infrastructure, Digital Forensics Intelligence describes the relationship between systems, questions, and investigation techniques. Enter DFIQ (Digital Forensics Investigative Questions; https://dfiq.org/): a framework used to model scenarios, questions and approaches in digital forensics investigations. This talk will take a deeper dive into the DFIQ model, and more importantly the different ways it is practically used to facilitate forensic investigators' day-to-day activities, ensure repeatable conclusions of investigations, and knowledge sharing among analysts. We'll discuss how DFIQ is stored in Yeti, used in Timesketch, and can be used to leverage end-to-end collection and analysis workflows to accelerate and structure investigations in large enterprise environments. hack-lu-2024-54464-dfiq-codifying-digital-forensic-intelligence topic: CTI Thomas Chopitea en High level talk overview: * DFIQ - in theory * DFIQ objects: Scenarios, Facets, Questions, and Approaches * Codifying a common scenario with DFIQ objects * DFIQ - in practice * open source challengesDFIQ Schema evolution, * Implementation * Storing, editing, building a DFIQ graph in Yeti * Using DFIQ to structure an investigation in Timesketch * Examples of full end-to-end evidence collection and analysis workflows with dfTimewolf, GRR / Velociraptor, Plaso, Timesketch false DFIQ - Codifying digital forensics intelligence https://pretalx.com/hack-lu-2024/talk/MLBVAR/ https://pretalx.com/hack-lu-2024/talk/MLBVAR/feedback/ Europe - Main Room Talk 2024-10-23T17:15:00+02:00 17:15 00:30 This paper examines Intelligent Connected Vehicles (ICVs) by focusing on their architecture, capabilities, and security vulnerabilities. hack-lu-2024-54237-cyber-threats-to-advanced-intelligent-connected-vehicle-systems topic: hack.lu Shihao XueYuqiao Ning en To begin with, we analyze vehicle systems and assess hardware such as the T-Box and IVI for shell access. Furthermore, we detail methods for gaining elevated permissions within ICV systems, which include collecting network configurations and accessing critical components like the Driver Monitoring System (DMS) and Main Camera System (MCS). Our file analysis of nine ICV systems reveals significant information leaks, including certificates and private keys, while also identifying vulnerabilities in communication logic and memory management. Notably, key threats arise from remote operation risks via compromised T-Boxes and the potential exploitation of the Controller Area Network (CAN) interface, which could allow manipulation of vehicle control systems. Overall, this research underscores the urgent need for enhanced security measures in the design and implementation of ICVs. true https://pretalx.com/hack-lu-2024/talk/FZ3WJ9/ https://pretalx.com/hack-lu-2024/talk/FZ3WJ9/feedback/ Europe - Main Room Talk 2024-10-23T17:45:00+02:00 17:45 00:30 In May 2024, the NATO publicly condemned cyber espionage operations carried out by a Russian state-sponsored group against targets in Germany and Czechia. We track this group as ITG05 sharing overlaps with APT28, UAC-0028, Forest Blizzard and Fancy Bear. In addition to Germany and Czechia, a large number of NATO member states as well as the Ukraine have been subject to long-term intelligence gathering missions executed by ITG05. ITG05 is also linked to the hack of the German Bundestag in 2015 as well as the attacks targeting the 2016 US presidential elections. hack-lu-2024-52991-apt28-following-bear-tracks-back-to-the-cave topic: CTI Golo Mühr en In this talk we will cover all aspects of ITG05's most recent campaigns, carefully following the timeline of evolving TTPs resulting from shifts in priorities and resources. The most recent lures are indicative of high-profile targets across the globe, and the continuous improvement of malware deployment and capabilities are evidence of the significant threat posed by ITG05. The audience will experience an in-depth analysis tracing malware such as Headlace, Masepie and Oceanmap back to its origins. Finally, we will take a quick peek into the crystal ball and discuss what the future might hold. true https://pretalx.com/hack-lu-2024/talk/HFN9BP/ https://pretalx.com/hack-lu-2024/talk/HFN9BP/feedback/ Schengen 1 & 2 Training 2024-10-23T14:00:00+02:00 14:00 02:00 MISP Kickstart provides a comprehensive introduction to the popular Open Source Threat Intelligence and Sharing Platform, "MISP." The course will establish a foundational understanding of the practical applications of MISP in cyber threat intelligence. This course follows a real-world scenario where participants will set up a local MISP instance, configure an organisation and users, and create events and information based on the threat profile of an organisation and its industry vertical. Participants will develop an understanding of the common use cases for MISP, learn how to set up and manage sharing communities, select relevant threat feeds (and also not what to turn on) and see how MISP automation workflows can be utilised. hack-lu-2024-50949-misp-kickstart topic: CTI Shanna DalyJames Garratt en In this training session we'll cover setting up your own test or development instance of MISP, working through configuration, understanding the security and diagnostics. After that we'll cover everything you'll need to know about events, communities, and feeds. We'll also look at some practical use cases for MISP, whether you're a SOC analyst, intel analyst, or IR consultant. false https://pretalx.com/hack-lu-2024/talk/L7UTNJ/ https://pretalx.com/hack-lu-2024/talk/L7UTNJ/feedback/ Schengen 1 & 2 Training 2024-10-23T16:15:00+02:00 16:15 02:00 Malware Development and Persistence Techniques. The course will teach you how to develop malware, including classic tricks and tricks of modern ransomware found in the wild. Everything is supported by real examples. The course is intended for Red Team specialists to learn in more detail the tricks of malware development (also persistence and AV bypass) and will also be useful to Blue Team specialists when conducting investigations and analyzing malware. The course is divided into four logical sections: - Malware development tricks and techniques (classic injection tricks, DLL injection tricks, shellcode running) - AV evasion tricks (Anti-VM, Anti-Sandbox, Anti-disassembling) - Persistence techniques - Cryptographic functions in malware development (exclusive) hack-lu-2024-53959-malware-development-and-persistence topic: CTI cocomelonc en Whether you are a Red Team or Blue Team specialist, learning the techniques and tricks of malware development gives you the most complete picture of advanced attacks. Also, due to the fact that most (classic) malwares are written under Windows, as a rule, this gives you tangible knowledge of developing under Windows. The course will teach you how to develop malware, including classic tricks and tricks of modern ransomware found in the wild. Everything is supported by real examples. The course is intended for Red Team specialists to learn in more detail the tricks of malware development (also persistence and AV bypass) and will also be useful to Blue Team specialists when conducting investigations and analyzing malware. The course is divided into four logical sections: - Malware development tricks and techniques (classic injection tricks, DLL injection tricks, shellcode running) - AV evasion tricks (Anti-VM, Anti-Sandbox, Anti-disassembling) - Persistence techniques - Cryptographic functions in malware development (exclusive) Most of the example in this course require a entry-level understanding of the Python and C/C++ programming languages. Knowledge of assembly language basics is not required but will be an advantage false https://pretalx.com/hack-lu-2024/talk/PTAEB8/ https://pretalx.com/hack-lu-2024/talk/PTAEB8/feedback/ Schengen 1 & 2 Lightning talk 2024-10-23T19:00:00+02:00 19:00 00:05 Seika.io is an Internet listener service which provides threat intelligence context. This 5 minutes talk will briefly expose the use cases and the roadmap. Disclaimer: this presentation isn't powered by AI hack-lu-2024-57475-a-new-free-internet-listener-in-town hack.lu lightning talk Mathieu LE CLEACH en The mission of Seika.io is to provide context from IP addresses we observed in various context. In addition, we aim at detecting and tracking exploitation of most well-known exposed device. It can be useful combined with a SIEM or a case management (like DFIR IRIS) system for instance. true https://pretalx.com/hack-lu-2024/talk/3X7WPD/ https://pretalx.com/hack-lu-2024/talk/3X7WPD/feedback/ Schengen 1 & 2 Lightning talk 2024-10-23T19:05:00+02:00 19:05 00:05 In this lightning talk, we show inherent security risks of running BEAM virtual machines that power Erlang and Elixir applications. We'll demonstrate how easily nodes can be interconnected and exploited to execute arbitrary code, create reverse shells, and compromise entire clusters. Through live terminal sessions, attendees will witness how attackers can run code on host machines, replace running code, and even infect other nodes—all leveraging BEAM's distributed capabilities. This talk aims to raise awareness about these critical security issues and provide insights on mitigating risks in production environments. hack-lu-2024-57461-unlocking-beam-s-pandora-s-box-security-pitfalls-in-distributed-erlang-and-elixir-systems hack.lu lightning talk en Key Demonstrations depending on time and preparation -_-: - Show how easily nodes can be connected, and how one can execute code on remote nodes (it's a feature, not a bug) - Show how to use :erlang.term_to_binary and Base.url_encode64 to serialize and transmit malicious functions. - Show basics Reverse Shells running on the BEAM - Show how one can replace Modules using Code.compile_string/1 and hot code swapping. - Show what the BEAM can do with SSH (an attacker can start an SSH server inside the BEAM VM, and also initiate SSH connections to further exploit remote systems.) - Illustrate how to spread malicious code to connected nodes using spawn and rpc:cast. - Discuss the risk of connecting to a unknown remote node false Slides for BEAM Virtual Machine shenanigans ligthning talk https://pretalx.com/hack-lu-2024/talk/JNVUN9/ https://pretalx.com/hack-lu-2024/talk/JNVUN9/feedback/ Schengen 1 & 2 Lightning talk 2024-10-23T19:10:00+02:00 19:10 00:05 The best way to share IoC with people (Definitely not) - Based on true events hack-lu-2024-57503-sharing-ioc-wrong-answers-only hack.lu lightning talk Deborah Servili en Quick presentation of the worst sharing methods I came across while looking at OSINT reports. false https://pretalx.com/hack-lu-2024/talk/LYXZQN/ https://pretalx.com/hack-lu-2024/talk/LYXZQN/feedback/ Echternach & Diekirch Workshop 2024-10-23T10:15:00+02:00 10:15 01:30 The Heist: get your hands on the goods! hack-lu-2024-52793-0-the-heist-get-your-hands-on-the-goods topic: hack.lu Stijn TommeDominiek Madou en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timer starts the mission (60 minutes) Goal is to get your hands on the goods that are protected by an alarm system. Triggering the alarm makes the mission fail. false https://pretalx.com/hack-lu-2024/talk/ACPFRF/ https://pretalx.com/hack-lu-2024/talk/ACPFRF/feedback/ Echternach & Diekirch Workshop 2024-10-23T14:00:00+02:00 14:00 01:30 The Heist: get your hands on the goods! hack-lu-2024-52793-1-the-heist-get-your-hands-on-the-goods topic: hack.lu Stijn TommeDominiek Madou en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timer starts the mission (60 minutes) Goal is to get your hands on the goods that are protected by an alarm system. Triggering the alarm makes the mission fail. false https://pretalx.com/hack-lu-2024/talk/ACPFRF/ https://pretalx.com/hack-lu-2024/talk/ACPFRF/feedback/ Echternach & Diekirch Workshop 2024-10-23T16:15:00+02:00 16:15 01:30 The Heist: get your hands on the goods! hack-lu-2024-52793-2-the-heist-get-your-hands-on-the-goods topic: hack.lu Stijn TommeDominiek Madou en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timer starts the mission (60 minutes) Goal is to get your hands on the goods that are protected by an alarm system. Triggering the alarm makes the mission fail. false https://pretalx.com/hack-lu-2024/talk/ACPFRF/ https://pretalx.com/hack-lu-2024/talk/ACPFRF/feedback/ Hollenfels Training 2024-10-23T14:00:00+02:00 14:00 02:00 Software Reverse-Engineering (SRE) is often considered black magic, but with the right tools and knowledge, its processes can be significantly accelerated. Unicorn Engine is a powerful framework that allows you to execute code platform-independently, which can greatly enhance your SRE skills. Why not learn it? hack-lu-2024-52125-defeating-encryption-by-using-unicorn-engine topic: hack.lu Balazs Bucsay en Applications, binaries, and frameworks often contain complex functionalities like encryption and decryption methods that are hidden from the user. Reverse-engineering these can be difficult and time-consuming, especially when they involve non-standard, proprietary or non-documented cryptographic functions. This is where Unicorn Engine comes in. It enables us to execute code dynamically without the need for the proper environment or hardware. By emulating the execution, we can analyse and understand the underlying operations, making the reverse-engineering process more effective. With Unicorn Engine, you can dissect and manipulate code in a controlled environment. Whether you are dealing with malware analysis, software debugging, or vulnerability research, Unicorn Engine is an awesome tool in your reverse-engineering toolkit. This training will focus on reverse-engineering one or more binaries with Ghidra. Participants will identify various encryption or obfuscation functions and write code for Unicorn Engine in Python to utilise these functions without ever executing the binary. No special knowledge is required, but familiarity with Python, Ghidra, and assembly would be beneficial. The training will introduce Unicorn Engine to the audience and explain it in depth. false Slides https://pretalx.com/hack-lu-2024/talk/HXTFKM/ https://pretalx.com/hack-lu-2024/talk/HXTFKM/feedback/ Hollenfels Workshop 2024-10-23T16:15:00+02:00 16:15 01:30 With OpenTIDE the Threat-Informed Detection Engineering framework, Cyber Threat Intelligence and Detection Engineering teams can work together to model the threat vectors (aka attack scenarios) in a structured, actionable and automation-ready object which become at the centre of a knowledge graph. With that framework, Cyber Threat Intelligence teams can prioritise to expand the threat detection coverage while the Detection Engineering teams can measure and report on the current threat coverage hack-lu-2024-53082-unleashing-the-power-of-purple-teaming-with-opentide topic: CTI Remi SeguyAmine Besson en ### Workshop objectives This workshop will introduce the opensource Threat-Informed Detection Engineering framework [OpenTIDE](https://code.europa.eu/ec-digit-s2/opentide) and how it can support collaborative work between the Cyber Threat Intelligence and Detection Engineering teams. The workshop will use a repository on gitlab.com and participants will have the opportunity to develop some models using Visual Studio code. From some example of CTI reports and research, we will showcase how to develop the chained Threat Vector Models (TVMs) that capture the key points of the procedure followed by an attacker to conduct the attack with the granularity required below the kill chain stage and the ATTACK (sub-)techniques to steer the work of the Detection Engineering team in defining the detection objectives resulting from that knowledge gain on the attacker. The workshop should allow to see in practice the benefit of having structured and machine-ready models to automatically build the knowledge graph to maintain over time the detection coverage (and also the threat coverage). In particular, we will demonstrate how to deduplicate the information received from the TI PDF reports, often in PDF, or blog ### Agenda - Introduction to DetectionOps with OpenTIDE with Q&A - Setup – see below - From Intelligence to OpenTIDE – Drafting & Reviewing Threat Vector Models - From TVMs to detection - Building and Deploying detections - Wrap-Up ### Preparation if you plan to attend the workshop You are more than welcome to join this workhop. For a good experience, please read below: * We provide a **private project** on Gitlab.com [Hack.lu OpenTIDE Workshop](https://gitlab.com/moloch_project/hack.lu-opentide-workshop) * Create/Prepare a free **account on [gitlab.com](https://gitlab.com/users/sign_up)** that we will add to the project. Please mention the handle on this [pad](https://hebdo.framapad.org/p/l0z8x0iwps-aaq8?lang=en) it is public. * [Visual Studio Code](https://code.visualstudio.com/) is the main editor we will refer to and use during the workshop; any other IDE you are familiar with should work provided you can easily git clone, commit and push to the gitlab project. * Interest in making CTI actionable / in Detection Engineering - We will propose some CTI reports to turn into Threat Vector Models - You are more than welcome to come with some reports you would like to integrate into OpenTIDE framework. ### Resources * [Main OpenTIDE repository](https://code.europa.eu/ec-digit-s2/opentide) including presentations and other supporting documentation * [Github repository for active development on CoreTIDE](https://github.com/EC-DIGIT-CSIRC/CoreTIDE) including raising issues and proposing pull requests. false https://pretalx.com/hack-lu-2024/talk/UXQXUT/ https://pretalx.com/hack-lu-2024/talk/UXQXUT/feedback/ Vianden & Wiltz Training 2024-10-23T14:00:00+02:00 14:00 02:00 Many Chrome exploits can lead to execution of remote code and most of these exploits started out with a vulnerability in V8. So, many Experts dive into bug bounty to find potentially exploitable vulnerabilities. But, there is a significant lack of publicly available analysis guides for beginners to start, and it is challenging to analyze the technical meanings using only documents. We will share the detailed steps needed for beginners who have yet to experience about V8 exploits. First, we describe the detailed structure (memory, object, etc.) and mechanism. Furthermore, we explore bugs via d8 debugger and explain step-by-step how to write exploit code. The audience will have the opportunity to learn and experience V8 exploit techniques by not only studying the theory but also analyzing the V8 engine through hands-on training. The hands-on training will be conducted through our VDI environment, therefore the audience can access and enjoy it freely with their personal laptops without setting up a practice environment. ※ The audience will be able to enjoy interesting and valuable training in a comfortable practice environment. We hope that this workshop will encourage many beginners to dive into V8 vulnerability research. hack-lu-2024-54373-chrome-v8-exploitation-training-for-beginners topic: hack.lu hoseok Lee en <b>Section 1. About V8 Engine</b> The first section focuses on the basic theories necessary to analyze vulnerabilities in V8 and perform exploits. V8 is one of the JavaScript engines and uses a JIT compiler. We talk about the JIT compiler and then explain the V8 compiler mechanism including the newest compiler, Maglev. <b>Section 2. Let’s Debug</b> The second section details how to debug V8 Engine using d8 in the provided VDI environment. We explain the memory structure of V8, the role and operation of the GC (Garbage Collection), and analyze V8 objects via d8. Through this section, the audience will be able to understand the object structure and learn basic V8 debugging techniques. <b>Section 3. Exploiting in V8</b> In the third section, we exploit V8 after analyzing a bug that was found in V8. First, we analyze a bug that was found in V8 and perform PoC (Proof of Concept). Then we examine the optimization process via Turbolizer and analyze in detail the point where the bug occurs. We provide a detailed step-by-step explanation of the exploitation process. Then we create an OOB array using a bug and bypass the V8 sandbox to read/write to arbitrary memory. Eventually, this leads to modifying the RIP to jump to an arbitrary address and executing shellcode. <b>[Requirements]</b> - We provide virtual environments for practice (only need a personal laptop) - Experience using GDB for debugging - Basic JavaScript knowledge - Interest in Browser Exploits true Slides https://pretalx.com/hack-lu-2024/talk/MGZEXX/ https://pretalx.com/hack-lu-2024/talk/MGZEXX/feedback/ Vianden & Wiltz Training 2024-10-23T16:15:00+02:00 16:15 02:00 Join us for an immersive hands-on workshop where we'll dive into KubeHound, a Tool for building Kubernetes attack paths. Participants will play the role of an attacker, but we think the best defense is a good offense. With concrete scenarios and a live environment, attendees will learn to leverage KubHound to identify attack paths in Kubernetes clusters at scale with no hustle. hack-lu-2024-54476-1-hands-on-kubernetes-security-with-kubehound-purple-teaming topic: hack.lu Julien en There’s no two ways about it: Kubernetes is a confusing and complex collection of intertwined systems. Finding attack paths in Kubernetes by hand is a frustrating, slow, and tedious process. Defending Kubernetes against those same attack paths is almost impossible without any third party tooling. In this workshop we will present KubeHound - an opinionated, scalable, offensive-minded Kubernetes attack graph tool used by security teams across Datadog. We will cover the custom KubeHound DSL to demonstrate its power to identify some of the most interesting and common attack primitives living in your Kubernetes cluster. If the DSL is not enough, we will cover the basics of Gremlin, the language used by our graph technology so you can find relevant attack paths that matter to you. As attackers (or defenders), there's nothing better to understand an attack than to exploit it oneself. So in this workshop we will cover some of the usual attack paths and exploit them. This way you will see by yourself, the difficulty (or not) to fully compromise a Kubernetes cluster (#DontDoThisAtHome). At last, is this workshop we will also demonstrate two ways of using KubeHound: * As a standalone tool that can be run from a laptop * Or deployed as a service in your own Kubernetes clusters (KubeHound as a Service) The main goal of this workshop is to show how defenders can find and eliminate the most dangerous attack paths and how attackers can have a treasure map to fully compromise a Kubernetes cluster by using the free and open source version of KubeHound. false https://pretalx.com/hack-lu-2024/talk/JDM9V7/ https://pretalx.com/hack-lu-2024/talk/JDM9V7/feedback/ Europe - Main Room Talk 2024-10-24T09:00:00+02:00 09:00 00:30 There was time when computer security was not a thing. A time blessed by wannabe hackers when sensitive facilities were just wide open because, seriously, who would really attempt to hack into a research or a leading industry system ? This was a long time ago... or was it ? What if I tell you there is a whole branch of information security which still happily lives in this stone-age ? hack-lu-2024-51818-back-to-the-failure-did-your-physical-security-really-evolve-in-the-last-40-years topic: hack.lu Simon Geusebroek en In this presentation we will see how this mindset still survives nowadays in the physical security realm. We will see how the very same mindset leads to the very same errors, false beliefs, and often very expensive false sense of security. A realm which should be blessed by nowadays hackers as doing tourism in so-called "highly secured" data centers and industrial sites is just so fun, and a mindset which should be avoided by the responsible of such sites who actually care about their security. A part of our job is to do physical pentest assessments on those “secure” facilities which usually spend huge amounts of money in various security bell and whistles, from the concrete wall surrounded by shiny barb wire up to highly technological access control, intrusion or theft detection systems such as biometric sensors and some mantraps, all this surrounded by hundreds of surveillance cameras and 24/7 on-site security teams. Too often I encounter the same dated mindset, where all these features are actually thought by vendors to impress honest people (starting with the facility owners themselves) without effectively taking offensive mindset into account. The consequences are usually multiple, but usually end up as our teams getting uninvited free access to the targeted most critical area, with just $30 worth of tools, without feeling concerned by all this costly stuff and without being actually noticed by anyone. The real issue here is not money, it is the mindset, the same security mindset that has been built during the last decades in the cyber world and is, more often than not, totally lacking in the physical realm. The goal of this presentation is therefore to raise awareness about this situation, and by comparing obsolete IT habits from the early 2000s with current physical security practices we will see which kind of vulnerabilities can often be encountered, how they could be exploited, and how they should be prevented. false Slides https://pretalx.com/hack-lu-2024/talk/SVGPXT/ https://pretalx.com/hack-lu-2024/talk/SVGPXT/feedback/ Europe - Main Room Talk 2024-10-24T09:30:00+02:00 09:30 00:30 Since the war(s) broke loose last years, a lot has been said about cyberwarfare, attacks on critical infrastructure, ICS/OT vulnerabilities, you name it. In this talk, we are going to talk about a specific set of ICS: Automated Tank Gauging (ATG) systems. These systems control the safe storage and management of fuel in critical infrastructures like gas stations, military bases, airports and hospitals. We will discuss multiple (10) zero-day vulnerabilities that expose these systems to catastrophic risks, from environmental hazards to significant economic losses. Despite past warnings, thousands of ATG systems remain online, unprotected, and vulnerable to exploitation. This track will talk about past ATG research, the new vulnerabilities found and their technical details, demonstrating how they can be exploited to gain unauthorized control over ATG systems. In the end, we will dive into our quest to cause physical damage remotely, in hopes of blowing up (our) gas station. hack-lu-2024-55396-blowing-up-gas-stations-for-fun-and-profit topic: hack.lu Pedro Umbelino en In the recent years, an increasing number of cyber attacks have been targeting critical infrastructure, especially since the war in Ukraine has started. Automated Tank Gauging (ATG) systems are critical components in the infrastructure of fuel storage and distribution across various sectors, including commercial gas stations, military facilities, and emergency services. These systems monitor fuel levels, detect leaks, and ensure regulatory compliance, but they also present an alarming attack surface when exposed to the Internet and, by their very nature, an interesting target for malicious actors. This presentation will cover the findings of both past and recent investigations, which identified multiple critical vulnerabilities in ATG systems from various vendors, as well as our quest to physically damage such systems remotely. We will explore how these vulnerabilities can be exploited to alter system behaviors, disrupt fuel supply chains, potentially cause significant physical and environmental damage, as well as other out of the box scenarios. We will show global prevalence data from our latest scans, and talk about both our coordination with CISA in order to responsible disclose all these vulnerabilities and our efforts to try to mitigate these risks at a wider scale, in several fronts - one of which is raising awareness within the infosec community. This session is for cybersecurity professionals, industrial system operators, and anyone interested in the security of critical infrastructure. Attendees will leave with a deeper understanding of the risks posed by ATG systems and how to secure them against potential attacks. false https://pretalx.com/hack-lu-2024/talk/V3JMCZ/ https://pretalx.com/hack-lu-2024/talk/V3JMCZ/feedback/ Europe - Main Room Talk 2024-10-24T10:15:00+02:00 10:15 00:30 The good: There's an insider working at your competition, helping you. The bad: There's also an insider working at your business, helping the competition. The ugly: It's Microsoft Copilot. The race to capture the benefits of GenAI is already at full speed, and everybody is diving head-first into putting corporate data and operations in the hands of AI. The concept of a Copilot has emerged as a way to keep AI tamed and under control. However, while employees rarely cross the lines and become rogue, it turns out that Microsoft Copilot is rogue by design. In this talk, we will show how your Copilot Studio bots can easily be used to exfiltrate sensitive enterprise data circumventing existing controls like DLP. We will show how a combination of insecure defaults, over permissive plugins and wishful design thinking makes data leakage probable, not just possible. We will analyze how Copilot Studio puts enterprise data and operations in the hands of GenAI, and expose how this exacerbates the prompt injection attack surface, leading to material impact on integrity and confidentiality. Next, we will drop CopilotHunter, a recon and exploitation tool that scans for publicly accessible Copilots and uses fuzzing and GenAI to abuse them to extract sensitive enterprise data. We will share our findings targeting thousands of accessible bots, revealing sensitive data and corporate credentials. Finally, we will offer a path forward by sharing concrete configurations and mistakes to avoid on Microsoft’s platform, and generalized insights on how to build secure and reliable Copilots. hack-lu-2024-52886-the-good-the-bad-and-the-ugly-microsoft-copilot topic: hack.lu Inbar Raz en Outline: 1. Where we are 1.1. Everybody racing to build GenAI applications and not thinking about implications - Microsoft Copilots, Github Copilot, every major security vendor releasing a security Copilot 1.2. Common concerns that are being ignored - prompt injection, circumventing data classification, inherent uncertainty of what applications will choose to do in production 1.3. GenAI is a No Code movement - drag a few boxes and have your GenAI application ready to use 1.4. Distinction between Copilots and Agents - how Copilots aim to address concerns by tying AI actions to user interaction and therefore intentions 2. Intro to Microsoft Copilot Studio 2.1. Explain focus on Microsoft - tied to OpenAI and already built into every enterprise and their enterprise data 2.2. Brief intro to Copilot Studio - the platform that runs Microsoft Copilots and their extendability, and a platform to build your own Copilots on top of enterprise data 2.3. Capabilities - how GenAI gets plugged into enterprise data, with over 1500 data connectors and user impersonation by design 3. Breaking Copilots 3.1. A methodological breakdown of how Copilot Studio works and a threat analysis for Copilots built with that technology 3.2. User access to Copilot - showing how default configuration leads to publicly accessible bots and sharing with your entire organization. These defaults include: bot is Internet facing with no auth (yes, really), bot is shared with the entire organization (why not?), bot can require authentication but not enforce it (indeed), bot shares maker identity with bot users (identity is best when shared). 3.3. Copilot access to data - Microsoft claims that Copilots are secure because they inherit user permissions and controls. In practice this means user impersonation by by design, no way to distinguish between Copilot and user activity, and embedded credentials (including OAuth refresh tokens) leveraged implicitly without user knowledge 3.4. User-isolation breakdown - how one user can get Copilot to act on behalf of another 3.5. Data classification becomes obsolete - how Copilot can read a document classified sensitive and spew it out without the classification label. So long DLP and thanks for all the fish. 4. Exploitation 4.1. Copilot predictable misconfiguration lead to easy enumeration of publicly accessible copilots 4.2. Once you identify a publically accessible Copilot you need to extract data from it. Show how you can fight fire with fire, using GenAI to fuzz the Copilot into spewing sensitive enterprise data 4.3. Dropping CopilotHunter, a red teaming tool that automates all of the above 5. Where do we go now? 5.1. Bad default configuration in Microsoft Copilot Studio and how to avoid it - clear actionable changes to do today 5.2. Generalizing - how do we build secure and reliable Copilots? Separation of control plane and data plane, not putting too much power in the hands of AI, isolation of user-context false https://pretalx.com/hack-lu-2024/talk/NNFQ3G/ https://pretalx.com/hack-lu-2024/talk/NNFQ3G/feedback/ Europe - Main Room Talk 2024-10-24T10:45:00+02:00 10:45 00:30 In 2022, an insider from one of the scammers' groups switched sides and shared details about the ongoing attacks. This kicked off a multi-year analysis of the underground economy that provides a range of illicit Telegram-based services to facilitate shady activities, offering everything from data breaches and identity theft to financial fraud. The talk will explore how fraudsters leverage platforms' features to launch "Scam as a Service" operations. hack-lu-2024-51946-scam-as-a-service-powered-by-telegram topic: CTI Aurimas Rudinskis en The case study explores real-world scenarios where groups of cybercriminals operate as service providers, offering fake invoices, financial fraud, crypto and NFT investment advisement, data breach, escort and blackmailing services. Furthermore, the study investigates the consequences of this "Scam as a Service" model on individuals, businesses, and society, emphasizing the financial losses, reputational damage, and regulatory challenges resulting from these activities. During the talk, I will cover: - Tactics, techniques and procedures the scammers utilize. Including the recruitment process, what types of services are available, and how the infrastructure is set up. - Insights backed by findings. I got operating manuals, tools and access to the infrastructure. - My experience from several years of analyzing these services and lessons learned. false https://pretalx.com/hack-lu-2024/talk/PPTEWY/ https://pretalx.com/hack-lu-2024/talk/PPTEWY/feedback/ Europe - Main Room Talk 2024-10-24T11:15:00+02:00 11:15 00:45 Phishing has evolved both in the TTPs of attackers, and their targets. From simple clones of a website trying to get a username/password to reverse-proxying systems that steal sessions even with MFA, the target landscape has changed. Many of the defenses against phishing are started to show their age, between block-lists for domains that appear to be illegitimate, SMS/push MFA, and broken functionality cues that may alert someone to the site not being correct. Modern phishing tools, like EvilGinx, Modlishka, and more handle all of these by hiding the phishing content behind a unique "lure" to avoid domain blocking, supporting SMS/push MFA, and seamlessly allowing for login and hand-over once the session has been stolen. This talk is focused on a Canarytoken type that lets you protect a shared-responsibility platforms that are difficult to gain insight into. These include Azure Entra ID, LogTo, and custom sites. The Cloned Site Canarytoken lets you quickly get alerted if someone is mirroring or reverse-proxying a sensitive login page that has any of your users trying to login--you can get alerted about the phishing site's URL before the user has even entered their password! After a view of the landscape of modern phishing techniques, defenses, we'll dive into our novel defenses, and look at the data of token alerts from millions of logins every day to build a view of real-world phishing attacks and their TTPs. We'll finish off with how to respond to alerts, and some attacks against our Canarytoken. Finally we'll discuss our mental model for sharing this information via networks like MISP. hack-lu-2024-54356-from-0-to-millions-protecting-against-aitm-phishing-at-scale topic: CTI Jacob Torrey en After a quick technical overview of the capability, and how it was designed to scale, we'll dive into the data from millions of weekly logins to sites across the web. The token has been deployed to some of the largest Azure tenants out there, large financial sites, and healthcare providers--we'll get to explore phishing data at scale. We'll dive into: - The scale of AitM phishing - TTPs of AitM attackers: - Time from infrastructure start-up to first alert - Domain seasoning - Cross-tenant drag-net attacks Finally, we'll talk about response to these types of alerts, what attackers can do to disrupt our alerts, and how we can flow some of this data into networks like MISP. false Slides https://pretalx.com/hack-lu-2024/talk/MAVVT3/ https://pretalx.com/hack-lu-2024/talk/MAVVT3/feedback/ Europe - Main Room Lightning talk 2024-10-24T13:30:00+02:00 13:30 00:05 Let's talk about some design principles for CTI data visualisation around threat actor tooling. hack-lu-2024-57173-running-circles-around-threat-actor-tooling-using-javascript-data-visualisation hack.lu lightning talk /media/hack-lu-2024/submissions/PVQXTF/ta_tool_data_vis_xrcv68A.png Chris Horsley en There's a wealth of data visualisations that are easy to produce using generic frameworks, but often they're an answer in search of a question. In this session, I'll briefly talk about some questions I had around a dataset concerning tools used by Russian threat actors, the data visualisation principles used, how it was built, and the insights gained. false https://pretalx.com/hack-lu-2024/talk/PVQXTF/ https://pretalx.com/hack-lu-2024/talk/PVQXTF/feedback/ Europe - Main Room Lightning talk 2024-10-24T13:35:00+02:00 13:35 00:05 Using LLM isn't limited only to online services (and often paid services); you can run LLM for free by utilizing open-source models and applications. hack-lu-2024-57125-using-llm-locally hack.lu lightning talk Pauline Bourmeau (Cookie) en It has become easy and convenient to use LLM locally on your machine, even for a couple of gigabytes of RAM. Usage includes: text generation, summarization, question-answering, even local design RAGs. All this is available for free and open-source, with minimal setup. This talk will show a quick demo of some tools and provide references to help you set up your own LLM app. false https://pretalx.com/hack-lu-2024/talk/YVZXTW/ https://pretalx.com/hack-lu-2024/talk/YVZXTW/feedback/ Europe - Main Room Lightning talk 2024-10-24T13:40:00+02:00 13:40 00:05 This presentation provides an overview of WEDOS Global, a decentralized network of servers, running AnyCast DNS, reverse proxy and CDN, with a focus on high-performance, security, and environmental sustainability. The presentation covers the company’s cutting-edge infrastructure, including its geographically distributed data centers and advanced DDoS protection systems, which ensure the reliability and safety of its clients' online assets. Through real-world case studies, the presentation demonstrates how WEDOS Global helps businesses of all sizes optimize their digital presence with scalable, cost-effective solutions, reducing their carbon footprint. hack-lu-2024-57107-future-of-websites-without-ddos hack.lu lightning talk /media/hack-lu-2024/submissions/ZFPPKY/WEDOS_Global_Protection_G3TDWbM.png Lukáš Kršek en The topic of website safety and ways to manage it on both personal and application levels. Basics about encryption, certificates, DNS, WAF and other various confusing abbreviations. We will be taking you on a trip through the most interesting technologies used nowadays to ensure a comfortable and safe experience browsing the internet. In this presentation, we will delve into ways to safeguard websites from cyber threats. How to get multi-layered protection against DDoS attacks, ensuring your website remains accessible even during severe cyber onslaughts. By leveraging BGP Anycast technology and a reverse proxy to efficiently distributes and filter traffic, blocking malicious requests and allowing only legitimate users to access your site. We will also explore the role of CDN caching in speeding up website content delivery across the globe. By caching data and connecting users to the nearest server, reducing response times, enhancing user experience and improving SEO. Additionally, the Web Application Firewall (WAF) provides robust security by monitoring and blocking suspicious activities. false Slides https://pretalx.com/hack-lu-2024/talk/ZFPPKY/ https://pretalx.com/hack-lu-2024/talk/ZFPPKY/feedback/ Europe - Main Room Lightning talk 2024-10-24T13:45:00+02:00 13:45 00:05 In this talk, we evaluate classical AI prediction and recommendation approaches as a system for threat modelling facilitation. This approach should reduce the number of manual research activities and increase organization’s security. hack-lu-2024-57127-analysis-and-forecasting-of-exploits-with-ai hack.lu lightning talk /media/hack-lu-2024/submissions/7YHE8M/hack.lu-rg_ymTbpbh.png Roman Graf en We propose a simple, explainable, effective and fast threat analysis method, which is based on artificial intelligence and can support security experts in threat modelling, organization’s protection strategy planning, and allow them to quickly adopt suitable protection measures for current and future periods. false https://pretalx.com/hack-lu-2024/talk/7YHE8M/ https://pretalx.com/hack-lu-2024/talk/7YHE8M/feedback/ Europe - Main Room Lightning talk 2024-10-24T13:50:00+02:00 13:50 00:05 Vulnerability Lookup (https://github.com/vulnerability-lookup/vulnerability-lookup) facilitates quick correlation of vulnerabilities from various sources, independent of vulnerability IDs, and streamlines the management of Coordinated Vulnerability Disclosure (CVD). It is a rewritten and enhanced version of cve-search, an open-source tool originally designed to maintain a local CVE database. hack-lu-2024-57129-improving-the-cvd-process hack.lu lightning talk Cédric Bonhomme en Vulnerability Lookup (https://github.com/vulnerability-lookup/vulnerability-lookup) facilitates quick correlation of vulnerabilities from various sources, independent of vulnerability IDs, and streamlines the management of Coordinated Vulnerability Disclosure (CVD). It is a rewritten and enhanced version of cve-search, an open-source tool originally designed to maintain a local CVE database. false Slides https://pretalx.com/hack-lu-2024/talk/TGV7MK/ https://pretalx.com/hack-lu-2024/talk/TGV7MK/feedback/ Europe - Main Room Lightning talk 2024-10-24T13:55:00+02:00 13:55 00:05 Overview of the latest developments of the MISP playbooks. A sneak peak into a new project for "Proving the Value of Cyber Threat Intelligence" and a MISP community for the ICS world. hack-lu-2024-57184-misp-playbooks-proving-the-value-of-cyber-threat-intelligence-and-ics-csirt-io hack.lu lightning talk /media/hack-lu-2024/submissions/VVF3AU/manga_fwdLUS4.jpg Koen Van Impe en - https://github.com/misp/misp-playbooks - https://github.com/cudeso/proof-value-cti - https://www.ics-csirt.io/ false Slides Slides https://pretalx.com/hack-lu-2024/talk/VVF3AU/ https://pretalx.com/hack-lu-2024/talk/VVF3AU/feedback/ Europe - Main Room Talk 2024-10-24T14:00:00+02:00 14:00 00:30 As quantum computing advances, it presents unique cybersecurity challenges that existing digital security systems are inadequately equipped to handle. This talk explores the realm of quantum cybersecurity, focusing on quantum key distribution (QKD) and post-quantum cryptography (PQC) as essential tools to secure communications against the formidable computational power of quantum computers. We will explore the advantages of these technologies, their necessity in the modern cybersecurity landscape, current interoperability issues between different quantum cryptographic systems, and propose potential solutions to these challenges. The session aims to highlight the future directions of quantum cybersecurity and the ongoing efforts to standardise and enhance the security protocols to address these emerging threats effectively. hack-lu-2024-54250-quantum-cybersecurity-pioneering-a-secure-future topic: hack.lu Samira ChaychiSharif Shahini en Introduction Quantum computing is set to revolutionize various industries like AI by providing powerful computational capabilities that far exceed those of classical computers. However, this technological leap also introduces significant security risks, particularly to existing cryptographic systems that protect the world's digital information. Quantum cybersecurity emerges as a crucial field, promising enhanced security mechanisms through QKD and PQC to withstand quantum computing threats. Advantages of Quantum Cybersecurity Quantum cybersecurity technologies, such as QKD, offer the promise of unbreakable encryption by utilizing the principles of quantum mechanics. Unlike traditional methods, where security is based on the computational difficulty of certain mathematical problems, QKD uses the quantum properties of particles to ensure secure communication that can immediately detect any interception attempts. PQC provides algorithms that are resistant to quantum attacks, aiming to secure our digital infrastructure both now and in the future. Necessity for Quantum-Resistant Solutions The development of quantum computers poses a significant threat to the cryptographic standards currently protecting global communications, financial transactions, and government data. Quantum-resistant cryptographic methods are essential to prevent the quantum threat and safeguard information integrity in the forthcoming quantum era. Current Problems and Future of Quantum Cybersecurity While quantum cryptography offers robust security, it currently faces significant challenges such as high costs, limited range of operation, and complex integration with existing technologies. The future of quantum cybersecurity lies in overcoming these barriers and facilitating widespread adoption. Innovations in satellite quantum communications and the development of quantum repeaters are among the advances that could extend the range and feasibility of QKD systems. Interoperability Challenges A significant obstacle in the deployment of quantum cryptographic solutions is the lack of interoperability between different systems, which often use incompatible protocols and technologies. This challenge hinders the creation of a unified quantum-safe network necessary for global security. Solutions and Challenges of Current Solutions Addressing interoperability involves developing universal standards and protocols that can seamlessly integrate various quantum and classical cryptographic systems. The solution proposed includes creating adaptable interfaces and middleware capable of translating between different quantum cryptographic protocols. However, these solutions must navigate the sophisticated balance between maintaining high security and offering the flexibility to support a diverse ecosystem of technologies. Conclusion Quantum cybersecurity stands at the forefront of the next revolution in digital security. By addressing the challenges of interoperability and advancing the development of user-friendly, cost-effective quantum cryptographic systems, we can pave the way for a secure transition into the quantum computing age. This talk will explore these aspects, offering insights into both the current landscape and the future directions of quantum cybersecurity. true https://pretalx.com/hack-lu-2024/talk/VQGFDL/ https://pretalx.com/hack-lu-2024/talk/VQGFDL/feedback/ Europe - Main Room Talk 2024-10-24T14:30:00+02:00 14:30 00:30 We are surrounded, in our daily life, with devices that have a strong link with cloud infrastructure. Those devices, while still completely operational, can become a useless piece of hardware if the vendor stop the infrastructure for any reason. This aims at discussing how to give a second life to such devices using the practical use case of the EV chargers of the Belgian company PowerDale which went on bankrupt in July 2023. We will discuss the successes and failures of our journey, how a community of enthusiasts manages to build workarounds and what could be our community contribution. hack-lu-2024-53329-making-iot-great-again topic: hack.lu David DurvauxMarc Durvaux en ## Agenda 1. The story of Powerdale EV charger from success to bankrupt 2. How to regain controls over the devices: success and failures 3. What all this says to IOT and their (software) lifetime? 4. Thoughts and conclusions ## Powerdale EV charger from success to bankrupt - Relatively popular brand of EV chargers in Belgium - About 50 000 devices installed in the Belgium - Went out of business in July 2023 - Cloud platform taken over by MyDiego - private customers abandoned with no access to their EV charger - WIFI connected appliances configuration change to slowest charge speed - some installers under heavy pressure to fix unsupported devices - ... ## Gaining access to device - The naive approach (and the failures) - open the box search for available ports - try to reverse the protocol without a functioning app ;) - BLE implementation on PicoW not so easy... - ... - The success: Google - an open-source based on ESPHome was launched by Geert Meersman - extend the solution to address needs on a standalone solution - build scripts to deploy at scale ## What all of this says to IOT? - Why the bankrupt was an issue? - Authentification on cloud (no cloud, no app, no configuration) - No way to configure appliances without mobile application - WIFI connected devices could be reconfigured without user consent - Is this unique? - No... Siemens abandoned its IOT line without notice. - Issues with bike in the Netherlands - Could we act? - Partially... - But this shows that a community can bring back to life our devices ## Thoughts and conclusions - Some idea to avoid such issues - Making code to be stored in source code escrow a legal obligation? - Forcing vendor to allow local configuration of devices (without cloud authentication) - Open APIs - ... false Talk slides https://pretalx.com/hack-lu-2024/talk/TFYNSZ/ https://pretalx.com/hack-lu-2024/talk/TFYNSZ/feedback/ Europe - Main Room Talk 2024-10-24T15:00:00+02:00 15:00 00:30 Stack smashing has become very different in the 21st century. Binary hardening mechanisms used by default by all modern OSes make it nearly impossible to exploit trivial buffer overflows. Since 1996, machines have evolved significantly and you cannot even follow the original "Smashing the stack [...]" tutorial by Aleph One on a modern computer. Yet, there are other kinds of machines that are lacking all the binary hardening we now take for granted. Because of that, they are ideal "target practice" material for those who wish to learn about exploiting stack-based buffer overflows or use them for causing real damage. Too bad these machines "sit" on the edge of home and enterprise networks, often being the only barrier between that the attackers need to overcome for a complete PWN. In this talk I will demonstrate how we could smash the stack of two networking devices from two different vendors (a wireless gateway, and a high-throughput VPN concentrator), allowing for unauthenticated root access. I will also present the vulnerability root-cause analysis and offer insights on why such attacks are still viable in 2024. hack-lu-2024-54386-ghosts-n-gadgets-common-buffer-overflows-that-still-haunt-our-networks topic: hack.lu Stanislav Dashevskyi en I will start the talk with an introduction of the two vulnerable devices, followed by a quick overview of the vulnerability research activities we have performed against them. Next, we will go over the root-cause analysis of these vulnerabilities, focusing on two stack buffer overflow vulnerabilities that allow for Remote Code Execution. I will then demonstrate how we used these vulnerabilites to pop a root shell on both devices (interestingly, they are designed not to allow any kind of root access to the users). I will discuss the binary hardening mechanisms we had to bypass (or lack thereof), and demonstrate the exploits in action. false Slides https://pretalx.com/hack-lu-2024/talk/D7FGK9/ https://pretalx.com/hack-lu-2024/talk/D7FGK9/feedback/ Europe - Main Room Talk 2024-10-24T15:30:00+02:00 15:30 00:30 SQL injections seem to be a solved problem; databases have built-in support for prepared statements, leaving no room for injections. In this session, we will go a level deeper: instead of attacking the query syntax, we will explore smuggling attacks against database wire protocols, through which remote, unauthenticated attackers can inject entire (No)SQL statements into an application's database connection. hack-lu-2024-54431-sql-injection-isn-t-dead-smuggling-queries-at-the-protocol-level topic: hack.lu Paul Gerste en Using vulnerable database driver libraries as case studies, we will bring the concept of HTTP request smuggling to binary protocols. By corrupting the boundaries between protocol messages, we desynchronize an application and its database, allowing the insertion of malicious messages that lead to authentication bypasses, data leakage, and remote code execution. To put our findings into context, we will explore the real-world applicability of this new concept by comparing how robust various languages and frameworks are against these attacks. We will also discuss how smuggling attacks are not specific to database wire protocols but affect all kinds of binary protocols, from databases over message queues to caching. We will end the session with inspirations for future research to explore the topic further. false Slides https://pretalx.com/hack-lu-2024/talk/GFM8HN/ https://pretalx.com/hack-lu-2024/talk/GFM8HN/feedback/ Europe - Main Room Talk 2024-10-24T16:15:00+02:00 16:15 00:30 Software Development Kits (SDKs) allow developers to significantly enhance the functionality and performance of their apps, among other benefits, without writing complex code. By importing SDKs, developers can save time and money, access various services and APIs, and achieve compatibility and integration across different platforms, devices and operating systems. When it comes to app monetization, advertisement SDKs are a common way of generating revenue from apps, especially freeware that rely on in-app purchase or subscription. However, there are also downsides associated with using code from external sources, such as security breaches, data leaks, or malicious attacks and perhaps one of the most effective ways to safeguard an app from such a threat is to perform some type of security audit. Mobile apps though pose a challenge for code review, as they can use webviews to dynamically change their behavior and execute arbitrary code from remote sources, bypassing the security audit of the app. hack-lu-2024-51230-keys-to-the-city-the-dark-trade-off-between-revenue-and-privacy-in-monetizing-sdks topic: hack.lu Dimitrios Valsamaras en This presentation provides an in-depth examination of Advertisement SDKs, particularly focusing on their widespread use of webviews and the potential security risks these may introduce for end users. It explores how these SDKs integrate webviews into their functionality and offers technical insights into the mechanisms behind their implementation. Additionally, the presentation considers the broader security implications that may arise from this usage, aiming to raise awareness about potential areas of concern for developers and users alike. false Slides https://pretalx.com/hack-lu-2024/talk/XDFR83/ https://pretalx.com/hack-lu-2024/talk/XDFR83/feedback/ Europe - Main Room Talk 2024-10-24T16:45:00+02:00 16:45 00:30 Yara, LibMagic (file, binwalk, polyfile), TrID, Yara, Magika, PeID, Pronom, FDD, ShareMime, DiE... How do they work? What are their pros and cons, their limitations, their risks? hack-lu-2024-54289-understanding-file-type-identifiers topic: hack.lu Ange Albertini en There's a lot of misconception around file type identifications and scanning: the existing tools have different needs and use cases, requirements and limitations (that could be abused). Warning: contains raw bytes. false Recording Slides https://pretalx.com/hack-lu-2024/talk/EZ7Z7M/ https://pretalx.com/hack-lu-2024/talk/EZ7Z7M/feedback/ Schengen 1 & 2 Workshop 2024-10-24T10:15:00+02:00 10:15 01:30 Flutter is an open-source UI software development kit with the ability to create applications for Android, iOS, and non-mobile platforms using a single codebase. The performance aspect is handled by using ahead-of-time (AOT) native compilation in release builds. In terms of reverse engineering, Flutter is particularly difficult to tackle because disassemblers do not support its custom binary format, registers and representation of integers. In this workshop, we will: - Learn how to reverse Flutter applications - Learn how to use Blutter and understand its output - Load symbols in Radare2 to parse the binary more easily - Patch a game with a native Frida hook to reveal an Easter Egg hack-lu-2024-53701-reversing-flutter-with-blutter-and-radare2 topic: hack.lu Axelle Apvrille en Pre-requisites: - It is preferable to have basic experience in reading Assembly (but it is not necessary to be fluent). - Pre-Install Radare2 (https://rada.re/n/radare2.html) and Docker (https://docs.docker.com/engine/install/) on your laptop, before the workshop. - If possible, come with an ARM64 Android smartphone. If not, I'll lend one (we only need it shortly). On ARM-based MacOS, instead, you can use an ARM64 Android emulator from Android Studio: download and install Android 14, Google APIs (but not Google Play), ARM64. - Access to Internet. Not necessary: - You do *not* need to install Blutter: we'll learn how to install and use a patched version during the workshop. That patched version runs in a Docker container. - You do *not* need to know how to use Radare2: we'll cover all basic commands you need to use during the workshop. false https://pretalx.com/hack-lu-2024/talk/DFES8D/ https://pretalx.com/hack-lu-2024/talk/DFES8D/feedback/ Schengen 1 & 2 Training 2024-10-24T14:00:00+02:00 14:00 02:00 Let's be honest: cryptography is hard. Luckily, plenty of great cryptographers in the past 70 years did the heavy lifting for us. So our goal here will be to understand how we can use the most common cryptographic algorithms properly, which one to use depending on the context, the common pitfalls and how to avoid them. hack-lu-2024-52384-cryptography-from-zero-to-dont-shoot-yourself-in-the-foot topic: hack.lu Lorenzo Nicolodi en The training will start from the very basics to allow anyone interested to join, so there is no particular presequisite, just really basic math and the willingness to learn without being scared (or to learn regardless of being scared or not :-) ). We will roughly follow the following syllabus: - Encryption 101 - Randomness & entropy - Block ciphers - Stream ciphers - Hash functions - Key generation and key derivation functions / algorithms - RSA - Elliptic curves We only have a couple of hours, so we will not dig deep into algorithms' math and internals, also because this is not the goal of the training. If you are a cryptography expert and you want to join to add details, insights or correct the trainer if needed (we all do mistakes sometimes and we should all keep learning and improving), you are absolutely welcome! PS: the course is partially based on the content of the "Serious Cryptography: A Practical Introduction to Modern Encryption" by Jean-Philippe Aumasson book (ISBN-13: 9781593278267 - No Starch Press). false Slides https://pretalx.com/hack-lu-2024/talk/E93DZB/ https://pretalx.com/hack-lu-2024/talk/E93DZB/feedback/ Schengen 1 & 2 Training 2024-10-24T16:15:00+02:00 16:15 02:00 In this training, trainees deal with BGP hijacking, which involves redirecting internet traffic by manipulating the Border Gateway Protocol. It covers the impact, training details, data sources, and notable BGP hijacking incidents. These incidents include the involvement of the Italian Hacking Team, Amazon DNS, China Telecom, and a recent incident at KlaySwap in South Korea. This hands-on training session will use fully open-source-based intelligence and command-line analysis tools to identify and visualize BGP hijacking incidents in any network. After this training, trainees will be equipped with new skills to detect BGP hijacking when suspicious phenomena occur. hack-lu-2024-54377-open-source-intelligence-and-command-line-based-bgp-hijacking-detection topic: hack.lu Joon Kim en # Introduction BGP hijacking involves illegally redirecting internet traffic from its intended path by manipulating the Border Gateway Protocol (BGP), which exchanges routing information between different networks. In a BGP hijacking attack, an attacker advertises false routing information to routers on the internet, causing traffic to be routed through their network. This can be done for malicious purposes, such as intercepting sensitive data or launching a denial-of-service attack. BGP hijacking can have serious consequences, as it can disrupt internet connectivity and compromise the security and privacy of user data. BGP hijacking is an attack that undermines IP-based defense systems. When an attack occurs, all traffic directed to the hijacked destination IP is routed to an arbitrary location specified by the attacker, incapacitating all existing defense mechanisms. This hands-on training session will use fully open-source-based intelligence and command-line analysis tools to identify and visualize BGP hijacking incidents in any network. After taking this training, trainees are supposed to carry out the BGP hijacking detection process when suspicious activity occurs. To reduce the time wasted in environment settings, trainees are supposed to prepare notebooks with WSL/LINUX/OSX terminals and network connections. # Training Details This training program uses real-world data that has not been artificially modified or generated. The skills acquired in this training can be immediately applied to all networks. The training provides expertise in threat modeling, visualization, and detection methods through case studies of significant historical BGP hijacking incidents. ## Data Source The data used in this course is broadly divided into two categories. To analyze BGP communications, we use archived data provided by the University of Oregon RouteViews Archive Project from 2001 to the present. We utilize data from regional Internet address registries to verify IP address variability. ### Regional Internet Address Registries Data - https://ftp.apnic.net/stats/apnic/delegated-apnic-extended-latest - https://ftp.afrinic.net/stats/afrinic/delegated-afrinic-extended-latest - https://ftp.lacnic.net/pub/stats/lacnic/delegated-lacnic-extended-latest - https://ftp.ripe.net/pub/stats/ripencc/delegated-ripencc-extended-latest ### BGP Archive Data - http://archive.routeviews.org/bgpdata/ ### Tools used - awk, bgpdump, graphviz, feedgnuplot, and other basic bash commands and shell scripts ## BGP Hijacking Incidents Following is the list of possible analysis candidates for well-known BGP hijacking incidents, which can be analyzed in this training session ### Italian Hacking Team BGP Hijacking The Italian group "Hacking Team" was implicated in a state-sponsored BGP hijacking incident. They worked with the Italian Special Operations Group to manipulate the Border Gateway Protocol (BGP) and reroute internet traffic. The release of confidential data unveiled their involvement, and the hacker "Phineas Fisher" admitted to the breach. BGP hijacking poses substantial risks to internet connectivity and the security of user data. ### Amazon DNS BGP Hijacking In 2016, Amazon DNS servers in Route53 experienced a BGP hijacking incident. Attackers manipulated the Border Gateway Protocol (BGP) to redirect traffic intended for Amazon's DNS servers. This misdirection allowed the attackers to intercept and manipulate DNS queries, potentially redirecting users to malicious websites or intercepting sensitive information. The incident underscored the vulnerabilities in BGP and the critical need for enhanced security measures to protect internet infrastructure. ### BGP Man In the Middle Attack China Telecom has been accused of engaging in extensive BGP hijacking activities, redirecting internet traffic through its infrastructure to spy on data and disrupt global communications. This practice, "Leave No Access Point Unexploited," involves manipulating the Border Gateway Protocol (BGP) to reroute traffic from its intended path. These activities have raised significant concerns about the security and integrity of global internet traffic, highlighting vulnerabilities in the BGP system and the potential for state-sponsored cyber espionage. ### Klayswap BGP Hijacking On January 3, 2022, at 11:31 AM, there was a BGP hijacking incident at KlaySwap, a decentralized finance (DeFi) platform in South Korea that operates on the Klaytn blockchain network. The incident led to BGP hijacking attacks on two service-provider networks, resulting in approximately 2.2 billion KRW worth of virtual asset damage and nationwide service disruptions for around one hour. Affected services included QR check-in, Kakao Map Service, and Daum portal services. This incident raised concerns about South Korea's vulnerability to BGP hijacking attacks, highlighting that South Korea is no longer a safe zone from BGP hijacking attacks. false Training slides https://pretalx.com/hack-lu-2024/talk/TJUNCH/ https://pretalx.com/hack-lu-2024/talk/TJUNCH/feedback/ Echternach & Diekirch Workshop 2024-10-24T10:15:00+02:00 10:15 01:30 The Heist: get your hands on the goods! hack-lu-2024-52793-3-the-heist-get-your-hands-on-the-goods topic: hack.lu Stijn TommeDominiek Madou en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timer starts the mission (60 minutes) Goal is to get your hands on the goods that are protected by an alarm system. Triggering the alarm makes the mission fail. false https://pretalx.com/hack-lu-2024/talk/ACPFRF/ https://pretalx.com/hack-lu-2024/talk/ACPFRF/feedback/ Echternach & Diekirch Workshop 2024-10-24T14:00:00+02:00 14:00 01:30 The Heist: get your hands on the goods! hack-lu-2024-52793-4-the-heist-get-your-hands-on-the-goods topic: hack.lu Stijn TommeDominiek Madou en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timer starts the mission (60 minutes) Goal is to get your hands on the goods that are protected by an alarm system. Triggering the alarm makes the mission fail. false https://pretalx.com/hack-lu-2024/talk/ACPFRF/ https://pretalx.com/hack-lu-2024/talk/ACPFRF/feedback/ Echternach & Diekirch Workshop 2024-10-24T16:15:00+02:00 16:15 01:30 The Heist: get your hands on the goods! hack-lu-2024-52793-5-the-heist-get-your-hands-on-the-goods topic: hack.lu Stijn TommeDominiek Madou en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timer starts the mission (60 minutes) Goal is to get your hands on the goods that are protected by an alarm system. Triggering the alarm makes the mission fail. false https://pretalx.com/hack-lu-2024/talk/ACPFRF/ https://pretalx.com/hack-lu-2024/talk/ACPFRF/feedback/ Hollenfels Workshop 2024-10-24T10:15:00+02:00 10:15 01:30 The application of Natural Language Processing (NLP) has become increasingly vital for cybersecurity threat intelligence and response strategies today. NLP plays a crucial role by enabling more accurate and nuanced analyses of potential threats through linguistic techniques. Among other applications, NLP allows quicker categorization of threats based on their nature – such as phishing schemes or anomalous behaviors – and enables prioritizing responses accordingly. NLP can also facilitate the development of content prediction schemes for analysts or provide powerful information extraction tools. We will cover two text-mining techniques that we believe are a good starting point with NLP for analysts and incident responders: sentiment analysis and Named Entity Recognition (NER). While sentiment analysis reveals underlying emotions or biases in social media content potentially linked to malicious activities, NER identifies critical information such as IP addresses, domains, and user details essential for correlating incidents across different data sources. hack-lu-2024-54352-nlp-deep-dive-transformers-for-text-mining-and-text-generation-in-cybersecurity topic: hack.lu Pauline Bourmeau (Cookie)William Robinet en The workshop provides a hands-on, iterative deep dive into transformer-based NLP techniques and their applications in text mining and generation for cybersecurity threat intelligence and response strategies. It is dedicated to people who have already an experience using natural language processing and LLM or LLM only, to deeper their understanding and skills. Program: - Quick Introduction to Transformers, best current models - Hands-on: Text Preprocessing and Tokenization - Text-preprocessing - Transformer-Based Sentiment Analysis - Choose and load a pre-trained transformer model - Step-by-step building of an NLP pipeline using transformers library - Run the sentiment analysis task on an imported dataset - Same adapted the pipeline to Named Entity Recognition (NER) - Results interpretation - Same adapted pipeline to text-generation - Compare basic and light models (e.g., BART, T5, Llama) - Discussion: Applications in Cybersecurity - Apply transformer-based NLP techniques to cybersecurity problems - Limitations and future directions of transformer-based NLP in cybersecurity By the end of this workshop, you will have a deep understanding of transformer-based NLP techniques and their applications in text mining and generation for cybersecurity. You will be able to apply your new skills to real-world problems and develop practical solutions for threat intelligence and incident response. You'll be able to work directly on the code and scale your analysis. Familiarity with Python programming is expected. Prior experience with deep learning libraries such as PyTorch is a plus, along with practice of LLMs (with frontend). true https://pretalx.com/hack-lu-2024/talk/SQUPHL/ https://pretalx.com/hack-lu-2024/talk/SQUPHL/feedback/ Hollenfels Training 2024-10-24T14:00:00+02:00 14:00 02:00 At CERT PL we periodically scan 500 thousands of domains and subdomains and automatically report found vulnerabilities and misconfigurations using the Artemis scanner ([https://github.com/CERT-Polska/Artemis](https://github.com/CERT-Polska/Artemis)). Are you e.g. a CSIRT, hosting provider, or an university network administrator and want to set up a similar project? hack-lu-2024-52110-scanning-with-the-artemis-security-scanner topic: hack.lu Krzysztof Zając en During the training, you will learn how to set up and use Artemis. For best results you are encouraged to have a Linux virtual machine with Docker and Docker Compose and a list of domains to scan. During the training, you’ll configure Artemis and initiate a scan that will end with a package of e-mails ready to be sent to the affected entities. We recommend starting with a list of 100 domains. Note that having a list of domains is not required. If you don't bring one, you will still learn how Artemis works and how to use it in practice. You will configure Artemis (or use a demo instance I will set up) and scan exemplary domains. false slides https://pretalx.com/hack-lu-2024/talk/JMKWXX/ https://pretalx.com/hack-lu-2024/talk/JMKWXX/feedback/ Vianden & Wiltz Training 2024-10-24T14:00:00+02:00 14:00 02:00 Suricata is a widely-used high performance, open source network analysis and threat detection software. This training will provide hands-on learning for different techniques using Suricata protocol analysis data for generating useful and actionable algorithmic and signature detection. hack-lu-2024-54454-from-protocol-analysis-to-actionable-algorithmic-and-signature-detection-with-suricata topic: hack.lu Eric LeblondPeter Manev en Suricata is an versatile open source engine that has been evolving beginning in 2009 to currently being able to provide  network protocol, flow, alert, anomaly logs, file extraction and PCAP at very high speeds. It is being used currently across the world as Network Security Monitoring, Intrusion Detection System, Intrusion Prevention System and even firewall..  The training will employ actual hands-on review of malware network pcap traces. Starting from protocol analysis and generic signatures events, the attendee will discover  the different queries and techniques that could be applied to detect the malware activity on the network. All of that keeping noise reduction in mind. The training aims to review a few cases of recent samples of malware families to give attendees practical experiences defending against modern threats. Attendees can expect to leave prepared to  to use algorithmic detection formulas, methods and signatures that can be implemented at home or at work. In addition, they will gain experience finding relevant malware data. false https://pretalx.com/hack-lu-2024/talk/GCYGYP/ https://pretalx.com/hack-lu-2024/talk/GCYGYP/feedback/ Vianden & Wiltz Training 2024-10-24T16:15:00+02:00 16:15 02:00 Are you, or your organisation, concerned about potential compromise on your iPhone, iPad, or Apple Watch? This workshop equips you with the knowledge and tools to identify red flags on your iOS device. We delve into the world of sysdiagnose and explore methods to verify potential breaches. hack-lu-2024-52411-ios-compromise-detection-using-open-source-tools topic: hack.lu David DurvauxChristophe Vandeplas en Are you, or your organisation, concerned about potential compromise on your iPhone, iPad, or Apple Watch? This workshop equips you with the knowledge and tools to identify red flags on your iOS device. We delve into the world of sysdiagnose and explore methods to verify potential breaches. During this workshop we will be: - discussing some ways to know if an iOS device may be compromised - explore which opensource tools exist to perform analysis - generating a sysdiagnose file on an iPhone, iPad iWatch, ... (bring your own device) - use multiple methods to collect the sysdiagnose (sharing, custom app, PyMobileDevice3, ...) - use the open source sysdiagnose parser to convert the diagnostics data to something usable - explore what data it contains - generate a timeline and load it in timesketch - ... false Intro slides Exercise workbook https://pretalx.com/hack-lu-2024/talk/YYNBVZ/ https://pretalx.com/hack-lu-2024/talk/YYNBVZ/feedback/ Europe - Main Room Talk 2024-10-25T09:00:00+02:00 09:00 00:30 Infostealers are a type of malware designed to secretly collect sensitive information from infected devices. They create stealer logs with valuable data such as login credentials. These malware communicate with Command-and-Control (C2) servers, which direct their actions and receive the stolen data. These stolen logs are highly valuable, forming the basis of a profitable underground market where cybercriminals sell and trade this information. But what if C2 operators also fell victim to their own skim : the biter bit. In this presentation, we will dive into stealer logs of C2 operators, who have infected themselves accidentally with infostealer malware, to uncover hidden C2 infrastructure and their backstage. Join us as we expose the unexpected vulnerabilities within the cyber underworld. hack-lu-2024-54376-the-ouroboros-of-cybercrime-witnessing-threat-actors-go-from-pwn-to-pwn-d topic: hack.lu /media/hack-lu-2024/submissions/YLWAQJ/hacklu_presentation_kA57Bl7.jpg EstelleStuart Beck en Through a meticulous investigation of stealer logs, an ironic twist in the cyber threat landscape has been unveiled: C2 operators falling prey to their own skim. In this presentation, we will explore stealer logs of (C2) operators, offering an unparalleled opportunity to delve into the backstage of cybercriminal networks. By analyzing these compromised logs, we have uncovered detailed information about the hidden criminal infrastructure operated by C2 operators. The captured data includes sensitive details such as computer information, browser autofill content, usernames and passwords, and active browser cookies. Notably, we have identified numerous logs containing cybercrime credentials, revealing the administrative access to various C2 platforms and databases. The investigation highlighted five specific C2 operators, exploring their use of different malware families, locations, and operational tendencies. One operator stood out: "The Dutch Man," also known as the Malware Maestro, who demonstrated sophisticated management of multiple malware types, including Private Loader, Mystic, Asuka, and Raccoon Stealer, forming a versatile malicious ecosystem. Join us as we dive into the trail of the cybercrime ecosystem provided by the threat actors’ own compromise. This talk will provide invaluable insights into the operation of a versatile malicious ecosystem, highlighting the complexity of C2 networks. Discover how analyzing stealer logs from operators associated with known C2 IPs can uncover and allow the study of hidden criminal infrastructure, identify new, previously unknown, C2 endpoints, and create indicators of compromise (IOCs). false Slides https://pretalx.com/hack-lu-2024/talk/YLWAQJ/ https://pretalx.com/hack-lu-2024/talk/YLWAQJ/feedback/ Europe - Main Room Talk 2024-10-25T09:30:00+02:00 09:30 00:30 On the 16th October 2023 Cisco Talos shared intelligence about a handful of compromised routers discovered while resolving customer support requests. As the full story unfolded, a handful of backdoored devices turned into tens of thousands, and the massive mobilisation of incident response teams as patches were applied and workarounds implemented. Many months later, the incident may be largely forgotten by Cisco customers and the cyber-security community, but working on these routers remains an objective for somebody. hack-lu-2024-52360-the-xe-files-trust-no-router topic: CTI /media/hack-lu-2024/submissions/UURWBY/we-files-title_jhMsMmv.jpg James Atack en On the 16th October 2023 Cisco Talos shared intelligence about a handful of compromised routers discovered while resolving customer support requests. As the full story unfolded, a handful of backdoored devices turned into tens of thousands, and the massive mobilisation of incident response teams as patches were applied and workarounds implemented. Many months later, the incident may be largely forgotten by Cisco customers and the cyber-security community, but working on these routers remains an objective for somebody. In this talk we explore the world of compromised IOS XE devices using data from weekly scans of all the potentially affected systems. The number of infected routers has changed over time showing a persistent motivation to maintain the backdoor’s installed base and giving insights in to the life of the adversary. At the time of writing, two-thirds of all exposed devices show signs of compromise. We investigate who was quick to apply the vendor’s advice, and what kind of organizations the compromised devices belong to. We observe that some mature organizations with competent cyberdefence teams seem to be maintaining affected routers. Finally we look at the potential utility of a network of compromised routers, making the link to Operational Relay Box (ORB) networks as recently defined by Mandiant (Google Cloud), and the challenge this poses for Threat Intelligence analysts and cyber-defence teams more broadly. false Slides https://pretalx.com/hack-lu-2024/talk/UURWBY/ https://pretalx.com/hack-lu-2024/talk/UURWBY/feedback/ Europe - Main Room Talk 2024-10-25T10:15:00+02:00 10:15 00:30 This talk provides a tour of new features in the open-source Zeek network monitor that have landed in the past year: scriptability via JavaScript, performance improvements to its scripting language via a new abstract language machine, analyzer development via the Spicy parser generator, a revamped telemetry framework for scraping via Prometheus, and more! hack-lu-2024-54150-new-features-in-the-zeek-network-monitor topic: hack.lu /media/hack-lu-2024/submissions/QLCNGS/zeek-favicon-white_sWs8LIF.png Christian Kreibich en Network monitoring is key for understanding your infrastructure, whether that's your home network or a thousand-seat corporate environment. Zeek is the world's de-facto open-source standard for longitudinal network monitoring — a permissively licensed, mature, battle-hardened platform and ecosystem that runs on anything from Raspberry Pi's to industrial-scale deployments like Microsoft Defender. Over the past year Zeek has made important strides into new areas, which I'll present in this talk. Top among those are support for scripting Zeek's network events in JavaScript, opening up the Node ecosystem to network analysis; ZAM, the Zeek Abstract Machine, bringing substantial improvements to Zeek's script interpretation performance; expanded use of the Spicy parser generator, and an expansion of Zeek's telemetry framework for easy scraping via Prometheus. I'll also cover how to get started with Zeek via our Docker images, binary packages, or building it yourself, and will give a sneak preview of our upcoming roadmap. false Slides https://pretalx.com/hack-lu-2024/talk/QLCNGS/ https://pretalx.com/hack-lu-2024/talk/QLCNGS/feedback/ Europe - Main Room Talk 2024-10-25T10:45:00+02:00 10:45 00:30 Sigma is a well-known generic detection rule format in the cybersecurity landscape. While this free, open-source project is very active and offers a wide range of features, its implementation is challenging, and especially for MSSPs. At CERT-EU, we serve the 90 European Union institutions, bodies, offices and agencies (Union entities) and we strive to deliver the best possible services to them. This is why we relentlessly try to enhance the detection capabilities of our Security Log Monitoring Service. To this endeavour, we created [droid](https://github.com/certeu/droid), a tool that we specifically built to introduce Detection-as-Code in our environment. In the spirit of fostering a culture of collective progress, we released [droid](https://github.com/certeu/droid) as our take to facilitate the ingestion of Sigma rules for any organisation. hack-lu-2024-54451-sigma-unleashed-a-realistic-implementation topic: hack.lu Mathieu LE CLEACH en In this talk, we will mainly talk about how we implemented Sigma in a practical way and about [droid](https://github.com/certeu/droid) that unlocks the following use cases: - Detection content versioning - Vendor agnostic approach - Cross-tool detection content - Testing and validating detection rules, by taking advantage of Atomic Red Team - Automation of exporting the rules to multiple SIEMs and EDRs. The tool is under development and we aim at adding more platforms and testing features. false https://pretalx.com/hack-lu-2024/talk/TLGDKX/ https://pretalx.com/hack-lu-2024/talk/TLGDKX/feedback/ Europe - Main Room Talk 2024-10-25T11:15:00+02:00 11:15 00:30 In this presentation, Tristan Madani will delve into "Predictive Analytics for Adversary Techniques in the MITRE ATT&CK Framework using Rule Mining." This talk introduces a novel approach to predicting potential adversary techniques by leveraging historical attack data and applying association rule mining. Attendees will gain insights into how the MITRE ATT&CK framework can be utilized to enhance threat hunting and incident response capabilities. Key takeaways include understanding the methodology behind rule mining, the practical application of the Apriori and FP-Growth algorithms, and the implications of the findings for proactive cybersecurity measures. This presentation is essential for cybersecurity professionals looking to stay ahead of evolving threats by anticipating adversary actions. hack-lu-2024-52976-predictive-analytics-for-adversary-techniques-in-the-mitre-att-ck-framework-using-rule-mining topic: hack.lu Tristan MADANI en ### Detailed Outline 1. Introduction (3 minutes) - Greeting and Introduction - Brief introduction of Tristan Madani and his credentials. - Overview of the presentation’s objectives. 2. Overview of MITRE ATT&CK Framework (5 minutes) - Introduction to MITRE ATT&CK - Explanation of the framework's purpose and structure. - Importance in the cybersecurity community. - Challenges Addressed - Discuss the vast number of TTPs and their evolution. - Need for prioritizing and predicting critical techniques. 3. Methodology (7 minutes) - Data and Tools Used - Description of the dataset (version 13.1, May 2023) and STIX 2.1 format. - Tools used for data manipulation (Python). - Rule Mining Techniques - Explanation of Apriori and FP-Growth algorithms. - Definition of key parameters: min_support (0.2) and min_threshold (0.7). - Process - Conversion of TTP data into transactional data. - Generation of frequent itemsets and association rules using the Mlxtend library. - Filtering and sorting rules based on support, confidence, lift, and Zhang's metric. 4. Key Findings (10 minutes) - Top Association Rules - Presentation of the top 5 rules using different metrics (confidence, lift, conviction, Zhang's metric). - Significant Associations - Brief discussion of notable associations: - T1204.001 (Malicious Link) with T1566.002 (Spearphishing Link). - T1059.005 (Visual Basic) with T1204.002 (Malicious File) and T1566.001 (Spearphishing Attachment). - T1203 (Exploitation for Client Execution) with T1566.001 and T1204.002. - Insights on Tactics - Key findings related to specific tactics like Initial Access, Execution, Command and Control. - Importance of associations involving PowerShell, Windows Command Shell, etc. 5. Visual Representations (3 minutes) - Heat Maps and Parallel Coordinates - Explanation of these visual tools. - Brief examples to illustrate strong relationships and patterns. 6. Conclusion (2 minutes) - Implications for Cybersecurity - Practical benefits of the predictive approach for threat hunting and proactive defense. - How organizations can prioritize security resources based on predictions. - Future Enhancements - Potential for enhancing the dataset with more comprehensive data. - Importance of ongoing research to keep up with evolving threats. 7. Q&A (5 minutes) - Open the Floor for Questions - Encourage audience questions and discussion. ### Total Time: 30 minutes true https://pretalx.com/hack-lu-2024/talk/KTE9WR/ https://pretalx.com/hack-lu-2024/talk/KTE9WR/feedback/ Europe - Main Room Lightning talk 2024-10-25T13:30:00+02:00 13:30 00:05 As cyber threats continue to evolve, traditional adversary simulation methods are struggling to keep pace with the sophisticated tactics, techniques, and procedures (TTPs) used by attackers today. In this talk, we explore the shortcomings of current simulation frameworks and introduce the ACTOR Model, a comprehensive and forward-thinking approach designed to overcome these challenges. Leveraging real-world insights and integrating the MITRE ATT&CK framework and Structured Threat Information Expression (STIX) data, the ACTOR Model enhances realism, scalability, and customization in adversary simulation. Through the lens of humor and deep technical analysis, we declare the end of outdated methods and present the future of simulation: a strategic, adaptable, and highly effective framework that equips organizations to stay ahead of adversaries. Join us as we dive into the next generation of adversary simulation — it’s far from dead, it’s just evolving. hack-lu-2024-57118-introducing-the-actor-model-adversary-simulation-is-dead-long-live-adversary-simulation hack.lu lightning talk Tristan MADANI en The landscape of cyber threats has outgrown many of the traditional methods used in adversary simulation. Enter the ACTOR Model: a fresh and comprehensive framework that addresses the limitations of current simulation tools. In this talk, titled "Adversary Simulation is dead, long live Adversary Simulation!", Tristan Madani takes you through a humorous yet deeply technical journey of how adversary simulation has evolved. The session will explore the five key components of the ACTOR Model—Adversary, Capabilities, Target, Operations, and Results—while showing how they interconnect to create realistic, customizable simulations that reflect modern-day cyber threats. Whether you're a security practitioner looking to refine your approach to adversary simulation or simply intrigued by the future of cybersecurity, this talk will offer valuable insights into how the ACTOR Model bridges the gap between theory and practical defense strategies. It’s not just about surviving the cyber battlefield; it's about simulating it with precision, foresight, and strategy. true https://pretalx.com/hack-lu-2024/talk/DJ7SZA/ https://pretalx.com/hack-lu-2024/talk/DJ7SZA/feedback/ Europe - Main Room Lightning talk 2024-10-25T13:35:00+02:00 13:35 00:05 Extracting Hidden gems in QR codes from Telegram and Tor with the AIL Project - https://ail-project.org/ hack-lu-2024-57205-ail-project-secrets-in-squares-qr-codes hack.lu lightning talk /media/hack-lu-2024/submissions/GUYCCV/ail-project-medium_yyJmKFy.png Aurelien Thirion en AIL Project is an open source framework to collect, crawl, dig and analyse unstructured data. The framework can be used to find information leaks, intelligence, insights and much more. AIL includes an extensible Python-based framework for analysis of unstructure information collected via an advanced Crawler manager or from different feeders (such as Twitter, Discord, Telegram Stream providers) or custom feeders. false https://pretalx.com/hack-lu-2024/talk/GUYCCV/ https://pretalx.com/hack-lu-2024/talk/GUYCCV/feedback/ Europe - Main Room Lightning talk 2024-10-25T13:40:00+02:00 13:40 00:05 Using LLMs and other ML tools for attack surface discovery and pentesting. hack-lu-2024-54441-pentests-using-llms hack.lu lightning talk Al Mochkin en Conjunction of LLMs and GANs in cybersecurity: network, OSINT, social engineering. Active probing techniques. Relation to LLM-based coding, TDD, test oracles, fuzzing. Next steps: adversarial SUT replication, humans as weakness, arms race dilemma. false Talk slides https://pretalx.com/hack-lu-2024/talk/Y8AAE9/ https://pretalx.com/hack-lu-2024/talk/Y8AAE9/feedback/ Europe - Main Room Lightning talk 2024-10-25T13:45:00+02:00 13:45 00:05 Do you sometimes tell yourself that something is too difficult to learn? Well, it all depends on how you approach this new thing at first. hack-lu-2024-57123-learn-anything-reload hack.lu lightning talk Pauline Bourmeau (Cookie) en There's no secret: you can actually learn anything. false https://pretalx.com/hack-lu-2024/talk/AK3C7H/ https://pretalx.com/hack-lu-2024/talk/AK3C7H/feedback/ Europe - Main Room Lightning talk 2024-10-25T13:50:00+02:00 13:50 00:05 A use case where full disk encryption do not do what you expected, and you should be aware of it. hack-lu-2024-57132-luks-full-disk-encryption-upside-down hack.lu lightning talk Michael Hamm en A live demo where I show, what happen with plaintext data, that was stored on the disk before full disk encryption got activated. false Slides https://pretalx.com/hack-lu-2024/talk/WYPGG7/ https://pretalx.com/hack-lu-2024/talk/WYPGG7/feedback/ Europe - Main Room Lightning talk 2024-10-25T13:55:00+02:00 13:55 00:05 We will demonstrate how to Backdooring Powershell using Phantom DLL Hijacking. hack-lu-2024-57196-phantom-dll-hijacking-in-powershell-exe-aka-backdooring-powershell-for-fun-and-profit hack.lu lightning talk Tristan MADANI en This technique requires local administrator or system privileges to exploit, but it could be enticing for threat actors or red teams as it allows the loading of malicious code from a trusted process and a signed binary. true https://pretalx.com/hack-lu-2024/talk/RMMUL7/ https://pretalx.com/hack-lu-2024/talk/RMMUL7/feedback/ Europe - Main Room Talk 2024-10-25T14:00:00+02:00 14:00 00:30 The proliferation of new Top-Level Domains (TLDs) has sparked security concerns primarily around phishing and social engineering attacks. However, the emergence of these new TLDs has broadened the attack surface, making it easier for threat actors to exploit other domain-related vulnerabilities. Our research explored another critical but often overlooked vulnerability: Internal Domain Name Collision. hack-lu-2024-55301-internal-domain-name-collision-2-0 topic: hack.lu Philippe Caturegli en During our research, we examined how legacy systems configured before the TLD boom can become susceptible to these collisions, potentially allowing threat actors to redirect or intercept sensitive internal traffic. This vulnerability can have a ripple effect, impacting even newly installed systems that rely on configurations from those legacy systems (e.g. DHCP, DNS Suffix, etc.). This presentation will showcase our methodology for identifying vulnerable domains and present real-world examples of high-value targets at risk, including a major European city, a US Police Department, and critical infrastructure companies. These examples underscore the scale and the urgency of addressing this know but often overlooked aspect of internal domain name collisions. false https://pretalx.com/hack-lu-2024/talk/VLZFAQ/ https://pretalx.com/hack-lu-2024/talk/VLZFAQ/feedback/ Europe - Main Room Talk 2024-10-25T14:30:00+02:00 14:30 00:30 Do you hate ransomware? Good, so do we. Are you curious about gangs TTPs, leak value and effective strategies to limit the impact of a breach? We will do our best to share our ongoing research and to provide you with all of this. And possibly some more. hack-lu-2024-57601-lucky-leaks-400-mln-files-are-worth-a-thousand-words topic: hack.lu Lorenzo Nicolodi en Me and my good friend Eireann spent the last two years collecting and studying the activity of 50+ ransomware groups through their DLS (Data Leak Site), more often than not hidden by the Tor network. We discovered that the list of the files inside the leaks can provide plenty of information about the gang's TTP, the impact for the victim and the most effective countermeasures. We also started in August 2024 to automatically analyse leaks at scale, to better understand the real impact for the compromised entity. We want to present the current results of this ongoing research effort, together with some methodologies we used and some mistakes criminals did that we were able to exploit. The talk will not be recorded and is tagged TLP:RED. true https://pretalx.com/hack-lu-2024/talk/99DP7K/ https://pretalx.com/hack-lu-2024/talk/99DP7K/feedback/ Europe - Main Room Talk 2024-10-25T15:00:00+02:00 15:00 00:30 ACVTool is a sophisticated bytecode instrumentation tool designed for highlighting instruction coverage in Android apps. In 2024, ACVTool received a major update unlocking smali coverage analysis for modern complex Android apps. Now, ACVTool supports Multidex and Multi-APK applications of any size. Secondly, ACVTool can highlight a particular feature, e.g. to see the code actually executed when tapping a button. To further depict selected app behavior, ACVTool may partially shrink not executed code. ACVTool works on 3rd-party Android without source code, and it does not require a rooted device. hack-lu-2024-53554-reverse-engineering-android-apps-with-acvtool topic: hack.lu Aleksandr Pilgun en ACVTool was initially developed within University of Luxembourg with an idea of driving the coverage guided fuzzing and other automated testing frameworks for closed-source Android apps. Turned out, Android bytecode has many interesting peculiarities, which made ACVTool a highly challenging project. Over the past year, ACVTool project underwent a major revision. ACVTool has evolved into a well defined tool capable of effectively depicting executed code when reverse engineering Android apps. The 2024 ACVTool release solved the major Multidex instrumentation challenge making it possible to handle modern Android apps. ACVTool also has learnt to deal with multiple APKs as Google Play nowadays delivers bundles apps in several APKs. This requires maintaining same signature over all APKs when repackaging only one of them. When it comes to repackaging, we learnt that Apktool, the most widely used repackaging tool, fails too often on complex applications. Therefore, ACVTool now implements more effective solution moving away from Apktool to the baksmali project. ACVTool runs baksmali to rewrite instrumented DEX files, and then we patch and rewrite AndroidManifest right inside the APK, which was apparently another challenge. Additionally, ACVTool now allows for highlighting a particular feature execution. This may help reverse engineers significantly narrow the scope of analysed code and also better depict a feature execution. We demonstrate how it works on a preselected app. Finally, ACVTool includes an experimental shrinking functionality to further limit the analysis surface. From our experience, an average app may run less than 20% of its code when tested exhaustively. Usually, this still results in a huge pile of smali code to examine. Thus, instruction coverage of a single feature combined with shrinking gives a perfect slice of just executed code. Convenient to analyse! ACVTool is freely available on GitHub under Apache 2.0 License. The Multidex instrumentation technique was patented, however, its implementation is free and fully available under ACVTool repository https://github.com/pilgun/acvtool. false GitHub: ACVTool Slides https://pretalx.com/hack-lu-2024/talk/JKUEDF/ https://pretalx.com/hack-lu-2024/talk/JKUEDF/feedback/ Europe - Main Room Talk 2024-10-25T15:30:00+02:00 15:30 00:30 For defending Windows, EDR software is the simple, easy path. On Linux – not so much. Since products are designed and developed for Windows, they lack important capabilities on other platforms. We chose a different path. hack-lu-2024-54342-detection-and-response-for-linux-without-edr topic: hack.lu Hilko Bengen en In modern, networked, enterprise IT environments, the focus of defense teams has shifted from monitoring network infrastructure towards endpoints. Installing endpoint detection and response (EDR) software on user workstations and servers – and actually monitoring their activities and findings – has become an easy default choice. However, it appears that in development of most EDR products, with their heritage in antivirus software, a very Windows-centric worldview is retained. Support for other operating systems, especially Linux, seems to come as an afterthought, leaving visibility gaps that may be easily exploited by skilled attackers. After evaluating several EDR vendors' products specifically for use in a large, heterogeneous Linux server landscape, we found that the capabilities were no match to our existing near-real-time detection mechanisms. We couldn't even replicate our previous work using the products. Deciding against any EDR product meant that we need to find an alternative approach to building out response capabilities. This talk illustrates mostly home-grown approaches to detection and response engineering that provide analysts with tools for generating context and for large-scale threat hunting while making it as pleasant as possible for operations teams to integrate the required components into their systems. false Slide deck https://pretalx.com/hack-lu-2024/talk/VAZ8JH/ https://pretalx.com/hack-lu-2024/talk/VAZ8JH/feedback/ Europe - Main Room Talk 2024-10-25T16:15:00+02:00 16:15 00:30 Computer attacks are becoming increasingly sophisticated and occur in a rapidly evolving environment. To effectively address these challenges, organizations need a comprehensive understanding of their information systems. Achieving this requires implementing a detailed map of the Information System. hack-lu-2024-51792-mercator-mapping-the-information-system topic: hack.lu /media/hack-lu-2024/submissions/TNXGJL/logo3_RkFkOq7.png Didier Barzin en Creating a detailed map of the Information System provides a holistic view of all its components, enhancing readability and control. This cartography is crucial for the protection, defense, and resilience of the information system. It serves as an essential tool for managing information systems effectively and is mandatory for essential entities (NIS2) as part of a broader risk management framework. GitHub of the project : https://github.com/dbarzin/mercator false Powerpoint presentation https://pretalx.com/hack-lu-2024/talk/TNXGJL/ https://pretalx.com/hack-lu-2024/talk/TNXGJL/feedback/ Europe - Main Room Talk 2024-10-25T16:45:00+02:00 16:45 00:30 In 2023, the gaming industry reached a worldwide revenue of US$384.9 billion. Yet, this industry is facing a growing number of cheating actors and techniques. We introduce new attacks targeting multiplayer games based on Unreal Engine such as Fortnite, PUBG, Valorant... These attacks disconnect a player from an ongoing game session against his will. Cheaters can launch it as a Denial-of-Service against opponents with very few packets (sometimes only one). In most cases, the attacker can steal the victory from the target without exposing himself as a cheater. It is important to understand that these attacks do not exist because of a vulnerability or an implementation error. They are conscious design choices, dictated by the constraints inherent to a widely distributed multiplayer game. Mitigating these attacks is thus not trivial. This talk shows how such issues present in a single game engine can spread widely, across several games produced by different editors. It is quite probable that other game engines, such as Unity, are not immune to these issues. However, this presentation solely focuses on the Unreal Engine whose source code is available. We present our analysis of the design and implementation choices made within the Unreal Engine. We explain how to exploit the protocols used. We cover and discuss how to defeat some common countermeasures used on the Internet against IP spoofing, such as Source Address Validation. We mention some mitigation strategies for video game developers. We show videos of these attacks against real popular games. hack-lu-2024-54435-disconnecting-games-with-a-single-packet-an-unreal-untold-story topic: hack.lu Hugo Bertin en ## Introduction Cheating is a major threat to the Multiplayer Online Game industry, undermining the fairness among players and impacting their user experience. ## Unreal Engine: crucial common pieces of many games Game engine are software framework designed for the creation of video games, providing core functionalities to developers. Vulnerabilities within the engine, shared by multiple games can spread widely. This talk focuses on Unreal Engine (UE), powering some of the most famous games in the industry. We introduce UE's network architecture, highlighting the UDP-based application-layer protocols used for communication, as well as the encryption components available. ## A new attack exploiting Unreal Engine security features We introduce new attacks that we have reported to all affected games through a responsible disclosure process. The general idea is to disconnect opponents within the same match by sending a single, specific packet. The attack exists under several flavors, with different packets, for different reasons. We present concrete examples of the attack in practice with three video demonstrations on the following games: Fortnite, The Finals, and Valorant. We present the methods we applied to investigate the root causes behind these vulnerabilities, combining static code analysis and dynamic profiling using an experimental game, developed with Unreal Engine. We present and explain our findings: When parsing a received packet, the engine checks the data's validity to detect corrupted values that could propagate to errors in the game logic. In some specific cases, this can lead to the client being disconnected from the ongoing game. This feature is likely to have been designed for security purposes to disconnect suspicious clients trying to tamper with the game packets. However, a malicious player A can exploit this by spoofing player B's IP address and sending a single faulty packet to disconnect B from the game, performing a Denial-of-Service attack against B. We explain the limitations of Unreal Engine’s encryption components in preventing those attacks. ## Practical exploitability of the attack We present two detailed procedures to carry out this attack in different contexts. 1. By broadcasting the specific packet within a LAN. 2. In an online Game context over the Internet. We outline the steps required: finding the target's IP address (using the ICE protocols to establish a P2P communication traversing firewalls), spoofing an IP address over the Internet (bypassing Source Address Validation), and launching the attack. We discuss potential mitigations that Unreal developers could implement. ## Conclusion While making the task easier for game developers, game engines inadvertently broaden the scope of vulnerabilities. Consequently, achieving security at the engine level is primordial to strengthen the overall game industry. New powerful attacks targeting big names in the video games industry are disclosed and explained, with a focus on the limitations of the network devices used for security: firewall traversal, and IP address spoofing. It is an eye-opener for that community. Beyond video games, Unreal Engine is also used in VR, digital twins, automotive HMI, and more. While we haven't identified other exploitations of this vulnerability yet, it could lead to more critical issues in the future. Therefore, it's crucial to raise awareness and fix it. false Slides https://pretalx.com/hack-lu-2024/talk/8GX8MS/ https://pretalx.com/hack-lu-2024/talk/8GX8MS/feedback/ Schengen 1 & 2 Workshop 2024-10-25T10:15:00+02:00 10:15 01:30 In this 2 hour workshop, Didier will guide you through XOR Cryptanalysis exercises using several open source tools (several of these tools are created and maintained by Didier). hack-lu-2024-54208-xor-cryptanalysis topic: hack.lu Didier Stevens en In this 2 hour workshop, Didier will guide you through XOR Cryptanalysis exercises using several open source tools (several of these tools are created and maintained by Didier). After an introduction to the XOR operator and its use in cryptography, we will work through several exercises that will familiarize you with tools like: CyberChef translate.py XOR 010 Editor script XORSearch xor-kpa.py And we will end with exercises using custom ransomware decryption tools that Didier developed for a particular ransomware strain with flawed crypto. false https://pretalx.com/hack-lu-2024/talk/3FRCUT/ https://pretalx.com/hack-lu-2024/talk/3FRCUT/feedback/ Schengen 1 & 2 Training 2024-10-25T14:00:00+02:00 14:00 02:00 This workshop will introduce attendees to the world of firmware analysis. It will discuss only structured firmwares---i.e. firmware containing a file system---by opposition to monolithic firmwares also known as baremetal firmwares. Students will discover two major steps of this analysis workflow which are also the most firmware specific ones: extraction of the filesystem and its cartography. Various open-source tools will be introduced, including two developed by Quarkslab: Pyrrha, a mapper collection for firmware analysis, and its underlying API Numbat. Based on this latter, attendees will be able to develop their own cartography tools with a nice UI. All along this workshop, a strong focus will be made on the tasks that could be automated by some existing or future tools but also on the limits of this automatization. hack-lu-2024-53820-exploring-firmwares-tools-and-techniques-for-new-cartographers topic: hack.lu Eloïse Brocas en *Each section will start by a quick theoretical introduction, then attendees will practice a lot through guided examples or real hands-on. The number of exercises done will depend of the workshop duration.* **Extraction** is the acquisition of the filesystem contained in the firmware. Classically, two types of techniques could be employed, either using hardware access to dump its content or directly having the firmware accessible as an archive file. This workshop will only discuss the second one. Firmware files could have various formats, from the most classical ones which can be easily mount or extracted to the undocumented handmade ones. In this case, a format reverse-engineering should be done to create the appropriated unpacker. Labs: Using Binwalk[3]/Unblob[4] to extract a firmware. - Extraction of a router firmware using binwalk or unblob, discussion of the limits of these tools. - Create your own extractor using Kaitai Struct[4]. **Cartography** consists in gathering any information about the firmware and to identify points of interest which will require deeper analysis to potentially find a vulnerability or assess the correct security of it. First, we will introduce what we are usually looking for in a firmware: - boot process and initialization system; - attack surface; - classic weaknesses like SSL NO_VERIFY_PEER option; - deprecated OpenSSL options; - strcpy calls; - etc. Lab: - Navigation into the firmware executables and their imports with Pyrrha. Manipulation of the different views proposed by the UI to identify potential entrypoints that will lead to a given binary (identified as the "vulnerable" one). The router firmware extracted at the previous step will be used as an example. **Develop your own tools** As seen in the previous sections, some steps of the analysis could be supported by some tools/scripts. This last part of the workshop tends to offer attendees tools to help this development. Two main ideas will be introduced: first, integrate a new mapper in Pyrrha based on a new heuristic or to handle a specific need. The second relies on Numbat, the API used by Pyrrha to create a graph that could be rendered and looked in, in a user-friendly UI. The idea is to quickly develop a UI for already existing tools --- [1] Quarkslab. Pyrrha. 2023. url: https://github.com/quarkslab/pyrrha. [2] Quarkslab. Numbat. 2024. url: https://github.com/quarkslab/numbat. [3] ReFirm Labs. Binwalk. 2010. url: https://github.com/ReFirmLabs/binwalk. [4] Onekey. Unblob. 2021. url: https://github.com/onekey-sec/unblob. [5] Katai Struct. 2015. url: https://github.com/kaitai-io/kaitai_struct. false Custom Format Lab: Student Material https://pretalx.com/hack-lu-2024/talk/VZN7KU/ https://pretalx.com/hack-lu-2024/talk/VZN7KU/feedback/ Echternach & Diekirch Workshop 2024-10-25T10:15:00+02:00 10:15 01:30 The Heist: get your hands on the goods! hack-lu-2024-52793-6-the-heist-get-your-hands-on-the-goods topic: hack.lu Stijn TommeDominiek Madou en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timer starts the mission (60 minutes) Goal is to get your hands on the goods that are protected by an alarm system. Triggering the alarm makes the mission fail. false https://pretalx.com/hack-lu-2024/talk/ACPFRF/ https://pretalx.com/hack-lu-2024/talk/ACPFRF/feedback/ Echternach & Diekirch Workshop 2024-10-25T14:00:00+02:00 14:00 01:30 The Heist: get your hands on the goods! hack-lu-2024-52793-7-the-heist-get-your-hands-on-the-goods topic: hack.lu Stijn TommeDominiek Madou en In a 90 minute workshop a team of max. 5 persons can enter the room. During the first 15 minutes they will receive a briefing on the mission. The countdown timer starts the mission (60 minutes) Goal is to get your hands on the goods that are protected by an alarm system. Triggering the alarm makes the mission fail. false https://pretalx.com/hack-lu-2024/talk/ACPFRF/ https://pretalx.com/hack-lu-2024/talk/ACPFRF/feedback/ Vianden & Wiltz Workshop 2024-10-25T10:15:00+02:00 10:15 01:45 Zeek is an open-source network security monitor (NSM) and analytics platform that has been around for quite some time (since the mid-90s). It is used at large university campuses and research labs, but in the past few years, more and more security professionals in the industry have turned their attention to this fantastic tool. hack-lu-2024-56650-zeek-and-destroy-with-python-and-machine-learning-workshop-part-1-2 topic: hack.lu Eva SzilagyiDavid Szili en The Zeek open-source NSM platform is so much more than just the vanilla Zeek log files. With a bit of Zeek scripting and Python bindings, you can connect it via Zeek Broker to your Python programs and libraries like Numpy, Pandas, and Tensorflow. Join us and use Python with machine learning to supercharge your Zeek environment! false Slides https://pretalx.com/hack-lu-2024/talk/SM9XM3/ https://pretalx.com/hack-lu-2024/talk/SM9XM3/feedback/ Vianden & Wiltz Training 2024-10-25T14:00:00+02:00 14:00 01:45 Zeek is an open-source network security monitor (NSM) and analytics platform that has been around for quite some time (since the mid-90s). It is used at large university campuses and research labs, but in the past few years, more and more security professionals in the industry have turned their attention to this fantastic tool. But Zeek is so much more than just a NIDS generating alerts (notices) and log files! Zeek's scripting language allows security analysts to perform arbitrary analysis tasks such as extracting files from sessions, detecting brute-force attacks, or, most importantly, interfacing with external sources, such as Python! The Zeek Python bindings allow us, the analysts, to use powerful Python libraries such as Numpy, Pandas, and Tensorflow and apply machine learning-based detection on network traffic. During this two-hour workshop, we will learn about the following topics: - Super fast introduction to Zeek (architecture, events, logs, signatures, etc.) - Using machine learning and data science tools on Zeek logs (as an example, we will use Fourier Analysis to detect C2 beaconing) - Super fast crash course in Zeek scripting (just enough to understand how to create new logs) - Connecting Zeek and Python via the Zeek Broker Communication Framework - Using machine learning tools in Python on the data we receive from Zeek for detection (as an example, we will use convolutional neural network and random forest models to compare them, and then use them to find unknown malware in live network traffic) Requirements for the workshop: - A laptop with at least 16 GB of RAM and more than 50 GB of free disk space (VT-x support must be enabled on the host system). - Application to run Virtual Images (type-2 hypervisor): VMWare Workstation Pro (recommended), VMWare Workstation Player, VMWare Fusion, or VirtualBox. - Only 64-bit Intel-compatible (Intel or AMD) processors are supported. WARNING: ARM-based (like Apple Silicon, Qualcomm Snapdragon, some Microsoft Surface laptops) devices cannot perform the necessary virtualization and therefore cannot be used for the workshop. hack-lu-2024-54225-zeek-and-destroy-with-python-and-machine-learning-workshop-part-2-2 topic: hack.lu Eva SzilagyiDavid Szili en The Zeek open-source NSM platform is so much more than just the vanilla Zeek log files. With a bit of Zeek scripting and Python bindings, you can connect it via Zeek Broker to your Python programs and libraries like Numpy, Pandas, and Tensorflow. Join us and use Python with machine learning to supercharge your Zeek environment! false Slides https://pretalx.com/hack-lu-2024/talk/KRJMJB/ https://pretalx.com/hack-lu-2024/talk/KRJMJB/feedback/