To see our schedule with full functionality, like timezone conversion and personal scheduling, please enable JavaScript and go here.
09:00
09:00
30min
Insights from Modern Botnets
Miguel

Botnets have managed to stay relevant in a number of ways, from the incorporation of phishing in their attack chains to a subscription service model. Their adaptability has proved that botnets indeed still represent an effective way to launch devastating attacks. In this talk, we will present a comprehensive overview of our latest research on new groups, delving into their organizational structures, codebases, and tactics. We will explore how these malicious actors share information, select their targets, and offer their services. By sharing our findings, we hope to raise awareness and facilitate a better understanding of these threats, ultimately contributing to the development of more effective countermeasures.

topic: hack.lu
Europe - Main Room
09:30
09:30
30min
NeuroCTI - a custom LLM for CTI - benchmarking, successes, failures and lessons learned (updates)
Aaron Kaplan

LLMs turn out to be highly practical for summarising and extracting information from unstructured Cyber Threat Intelligence (CTI) reports. However, most models were not trained specifically for understanding CTI. We will present a custom LLM, fine-tuned for CTI purposes. But of course, that only makes sense with a CTI text benchmark dataset. Creating these two systems is a challenging journey. Set-backs guaranteed. We will share our findings.

topic: CTI
Europe - Main Room
10:00
10:00
15min
Coffee & Tea
Europe - Main Room
10:00
15min
Coffee & Tea
Schengen 1 & 2
10:00
15min
Coffee & Tea
Echternach & Diekirch
10:00
15min
Coffee & Tea
Hollenfels
10:00
15min
Coffee & Tea
Vianden & Wiltz
10:15
10:15
90min
Dissecting the Threat: A Practical Approach to Reverse Engineering Malicious Code
Ankshita Maunthrooa

In the evolving cyber threat landscape, reverse engineering is crucial for understanding and mitigating malicious attacks. This session covers the essentials of reverse engineering, including assembly language, binary code, and key tools like disassemblers and debuggers. Participants will explore practical techniques for analyzing malware, learning to identify and dissect various types through real-world examples. The session includes a hands-on demonstration using tools like IDA Pro and Ghidra, focusing on unpacking, disassembly, and extracting Indicators of Compromise (IOCs). Additionally, best practices and strategies to overcome common challenges in reverse engineering will be discussed, equipping security professionals with the skills to effectively defend against cyber threats.

topic: hack.lu
Echternach & Diekirch
10:15
90min
Exploring OpenSSH: Hands-On Workshop for Beginners
William Robinet

During this workshop, you will learn how to use the various tools from the
OpenSSH suite. We will start with a presentation of the problems that are solved
by OpenSSH, then we will dive into the details of its most important and useful
features.
Among the topics covered, we will discuss about remote host authentication,
password and public key client authentication, key generation, local and remote
port forwarding, forward and reverse SOCKS proxying, X11 forwarding, jumphosts, connection to legacy systems, and more.

Hands-on exercises will be proposed throughout the exploration of the tool suite
using real-life scenarios. There will be space for questions and discussion.

This workshop is intended for beginners who wants to improve their practical
knowledge and experience with OpenSSH.

Basic networking and Linux shell knowledge are required in order to follow this
workshop. Each participant will need a Linux machine (on which they have root access) with Docker pre-installed and Internet access.

topic: hack.lu
Hollenfels
10:15
45min
Tales of the Future Past
Saâd Kadhi

In ‘Tales of the Future Past’, Saâd Kadhi, the Director of CERT-EU invites you to embark on a time-travelling odyssey.

The journey commences with a retrospective dive into the past, where attendees will glean insights from CERT-EU’s unique vantage point on the threat landscape, hovering over noteworthy developments the Cybersecurity Service for the Union entities had been observing.

As the time machine propels us into the future, the presentation demystifies the complexities of Artificial Intelligence, shedding light on AI’s burgeoning role in cyber threats. It offers foresight and thoughtful projections on potential AI-powered dangers, equipping the audience with the knowledge to anticipate and navigate future challenges.

The expedition culminates with a return to the present where Saâd will share his ideas on how to fortify our defences against the cyber threats of today and tomorrow.

Designed for a diverse audience, ‘Tales of the Future Past’ promises to be an enlightening journey, offering a unique blend of historical wisdom, futuristic insights, and practical, present-day solutions.

topic: hack.lu
Europe - Main Room
11:00
11:00
30min
Revolutionizing IoC Sharing: MISP, ZMQ and the Power of Smart Workflows & Taxonomies
Mike

Cybersecurity incidents continue to be major concern to organizations, necessitating the timely and effective sharing of threat intelligence. The purpose of this study is to investigate the efficient delivery of Indicators of Compromise (IoCs) from the Malware Information Sharing Platform and Threat Sharing System (MISP) to various detection technologies via the ZeroMQ Messaging Protocol (ZMQ).

Kroll leverages this solution to provide rapid detection of indicators found in our DFIR and MDR practice to all of our clients. To demonstrate the proposed solution's efficacy, we developed an integration to facilitate seamless IoC distribution using ZMQ, AWS and custom workflows.

We created a proof-of-concept environment to simulate real-world scenarios, validating the successful transfer of IoCs from MISP to a range of detection technologies, such as security information and event management (SIEM) systems, endpoint detection and response (EDR) systems and next-gen antivirus (NGAV) systems in real time.

The evaluation technique evaluates the distributed IoCs' performance criteria, including speed, accuracy, and consistency across several detection technologies. Furthermore, security processes were implemented to ensure the confidentiality, integrity, and validity of the shared IoCs, hence retaining confidence and reducing the likelihood of false positives or negatives.

Our findings demonstrated that integrating MISP with ZMQ and AWS services enables speedy and reliable IoC distribution, considerably improving organisations' threat detection and incident response capabilities. This research helps to the general development of the cybersecurity landscape by enabling real-time exchange of actionable threat intelligence, as well as encouraging a proactive defense posture against emerging cyber threats.

topic: CTI
Europe - Main Room
11:30
11:30
30min
Lessons Learned from (almost) 8 Years of Sigma Development
Thomas Patzke

Maintaining an open source security project for almost 8 years gives lots of opportunity for collecting experiences...good and bad ones. Time for sharing the experience from maintaining Sigma!

topic: hack.lu
Europe - Main Room
12:00
12:00
90min
Lunch
Europe - Main Room
12:00
90min
Lunch
Schengen 1 & 2
12:00
90min
Lunch
Echternach & Diekirch
12:00
90min
Lunch
Hollenfels
12:00
90min
Lunch
Vianden & Wiltz
13:30
13:30
30min
Lightning Talks
Europe - Main Room
14:00
14:00
120min
Lookyloo, Pandora, and all the bells and whistles to go with them.
Raphaël Vinot

The goal of the tool suite is to make it easier to handle suspicious contents reported by your users, friends or constituents. It empowers them to check URLs, emails, or files they receive and take educated decisions without relying on you all the time.

This workshop will go in depth on how you can configure Lookyloo and Pandora, and all the other tools that make it a complete tool suite usable in your organization with minimal manual work. We will also look at the correlation features to pivot across captures to find phishing campaigns in the 4+ millions captures gathered across the years on the CIRCL Lookyloo instance.

topic: hack.lu
Echternach & Diekirch
14:00
30min
Nothing to see here! On the awareness of and preparedness and defenses against cloaking malicious web content delivery
Jeroen Pinoy

Website cloaking is a technique that enables websites to deliver different content to
different clients, with the goal of hiding particular content from certain clients. Website cloaking is based on client detection, which is achieved via browser fingerprinting. In an
attempt to hide their malicious web pages from detection, cyber criminals (can) use cloaking.
They use vulnerability detection to only target clients that seem vulnerable. On top
of that, they (can) also provide benign content in case they suspect someone or something is
trying to detect them.

In this work, we investigated to what extent security web crawlers can be detected
by browser fingerprinting techniques, and provided some suggestions for how to improve them
to be able to bypass those techniques. We surveyed security analysts and analyzed a set of
threat intelligence sharing communities, to gauge awareness of cloaking as an available
detection evasion method for cybercriminals. Finally, we investigated one final technique,
the use of Cache-Control: no-store, which an attacker can use to thwart
forensic analysis.

topic: CTI
Europe - Main Room
14:00
120min
Operationalization of Sigma Rules with Processig Pipelines
Thomas Patzke

Log events appear differently in SIEMs. There are plenty of different taxonomies, possibilities for customization or just migration scenarios that make it challenging to generate queries from Sigma rules that match on events in given log repositories. Processing pipelines are a feature of the open source Sigma toolchain that offer a solution for these challenges and this session is about some real-world use cases for them.

topic: hack.lu
Vianden & Wiltz
14:00
120min
ROP on ARM64 - a hands-on tutorial
Saumil Shah

Return Oriented Programming (ROP) has been an essential part of exploit development since over a decade. The ROP landscape on ARM64 is bleak, thanks to severe restrictions laid down in the ARM64 ISA. This workshop provides a hands-on tutorial for starting out with ARM64 ROP gadgets and practical ROP chains. No prior knowledge of ARM64 assembly is required.

topic: hack.lu
Schengen 1 & 2
14:30
14:30
30min
Automating Dark Web CTI Reports ​ with RAG Insight for MISP Sharing
Shing-Li Hung

In the current digital landscape, organizations often do not become aware immediately when their data is compromised and sold online. Our objective is to minimize the duration between the exposure of data on the internet and its detection by the public. The dark web serves as a primary marketplace for the trade of personal information, accessible safely only through the use of the Tor browser. This paper focuses on monitoring significant trading forums on the dark web and demonstrates the method of web scraping specifically designed for dark web sites. Utilizing data harvested from these sites, we have trained a BERT classification model to categorize transaction posts into five distinct types of data leaks, enabling rapid identification of the leak type associated with each post.

Further, we employ the Retrieval-Augmented Generation (RAG) technique to vectorize dark web data, maintaining privacy while leveraging mainstream large language models to address concerns pertinent to cybersecurity analysts. This approach allows researchers to analyze dark web data effectively. Ultimately, the data collected from the dark web is formatted into STIX (Structured Threat Information Expression) and integrated into the MISP (Malware Information Sharing Platform) system to automate the generation of Cyber Threat Intelligence (CTI) reports. This methodology not only enhances the timeliness and accuracy of threat detection but also contributes to more efficient and proactive cybersecurity management.

topic: CTI
Europe - Main Room
15:00
15:00
30min
Dredge: An Open Source Framework for Cloud Incident Response
Santi Abastante

Cloud incident response can be daunting, requiring a plethora of tools and skills, while most Cloud Based Startups can’t allocate budget for preventive controls, there is less space for them to understand what to do if they are hacked. That’s why we created Dredge, an Open Source framework designed to streamline cloud incident investigations, allowing engineers to execute non-trivial cloud incident response tasks easily.

topic: CTI
Europe - Main Room
15:30
15:30
30min
You just got a CTI program funded - now what?
Lukas Vytautas Dagilis

An MSSP SOC presents how after a complete change of team and processes - a CTI program was restarted from (nearly) scratch, thanks to an EU-supported project. The SOC Technical Product Manager/CTI project manager will share how plans don't always come to fruition, issues faced with starting a CTI process. By sharing lessons learnt and plans for improvement - we propose some basic but wholistic steps to start a CTI program.

topic: CTI
Europe - Main Room
16:00
16:00
15min
Refreshment
Europe - Main Room
16:00
15min
Refreshment
Schengen 1 & 2
16:00
5min
New Break
Echternach & Diekirch
16:00
15min
Refreshment
Echternach & Diekirch
16:00
15min
Refreshment
Hollenfels
16:00
15min
Refreshment
Vianden & Wiltz
16:15
16:15
120min
Hands-on Kubernetes security with KubeHound (purple teaming)
Julien

Join us for an immersive hands-on workshop where we'll dive into KubeHound, a Tool for building Kubernetes attack paths. Participants will play the role of an attacker, but we think the best defense is a good offense. With concrete scenarios and a live environment, attendees will learn to leverage KubHound to identify attack paths in Kubernetes clusters at scale with no hustle.

topic: hack.lu
Vianden & Wiltz
16:15
30min
Malware and Hunting for Persistence: How Adversaries Exploit Your Windows?
cocomelonc

This presentation explores my discovery of unconventional malware persistence techniques through registry modifications and DLL hijacking vulnerabilities. We'll delve into cases involving Windows Internet Explorer, Win32API cryptographic features, Windows Troubleshooting, Microsoft Teams (patched), and Process Hacker 2 (patched in v3). The research highlights the exploitation of legitimate Windows resources for persistence and compares these methods with traditional techniques employed by APT groups and ransomware authors.

topic: CTI
Europe - Main Room
16:45
16:45
30min
Trying Gateway Bugs: Breaking industrial protocol translation devices before the research begins
Claire Vacherot

Inside operational systems (OT), industrial devices communicating over IP could use a wide range of field-specific, manufacturer-dependent or association-promoted industrial network protocols. To understand each other, they sometimes require an additional component as a gateway to make the translation between protocols. These nearly invisible devices play a crucial role in the industrial process: if the translation stops, the communication stops and possibly operations as well. From an attacker's perspective, this means that targeting them may have significant consequences. With this in mind, I assessed the security of a gateway model I often encounter during penetration tests on OT and I discovered several vulnerabilities that have been reported to the manufacturer. Months later, I would like to discuss the many concerns raised by the vulnerabilities themselves and the disclosure process. This tells us a lot about the current situation, issues and threats faced by such gateways, how they are and can be addressed, and what it means for OT cybersecurity.

topic: hack.lu
Europe - Main Room
17:15
17:15
30min
In-Depth Study of Linux Rootkits: Evolution, Detection, and Defense
Stephan Berger

This talk, "In-Depth Study of Linux Rootkits," will provide a comprehensive examination of the evolution of Linux rootkits, from their inception to the sophisticated variants seen today. Participants will gain insights into advanced rootkit techniques, effective detection strategies, and the future landscape for defenders. By exploring the historical context, current methodologies, and emerging threats, attendees will be equipped with the knowledge and tools necessary to safeguard Linux systems against rootkit attacks.

topic: hack.lu
Europe - Main Room
17:45
17:45
30min
Decoding Galah: an LLM powered web honeypot
Adel Karimi

Honeypots are invaluable tools for monitoring internet-wide scans and understanding attackers' techniques. Traditional low-interaction web honeypots use manual methods to emulate various applications or vulnerabilities. Introducing Galah, an LLM-powered web honeypot that mimics diverse applications with a single prompt. This honeypot dynamically crafts relevant HTTP responses, including headers and body content, to various HTTP requests, effectively simulating multiple web applications. In this talk, I will share lessons learned from building and deploying Galah and address two key questions: How do different large language models perform in generating HTTP messages? Does delivering authentic-looking HTTP responses increase attackers’ engagement with the honeypot?

topic: hack.lu
Europe - Main Room
09:00
09:00
30min
CSIRT and the Chocolate Factory
Didier Stevens

Discussing a ransomware sample that contains inherent flaws in its cryptographic design. Although well-established cryptographic primitives are used (like AES), they are used in a flawed way and introduce vulnerabilities that when exploited, lead to the decryption of ransomed files without knowing the encryption password and/or key.

topic: hack.lu
Europe - Main Room
09:30
09:30
30min
The Gist of Hundreds of Incident Response Cases
Stephan Berger

How to become an Incident Response Rockstar?

After conducting hundreds of Incident Response cases, more data is not always better. Focusing on the most relevant forensic data can speed up the investigation process rapidly. In this talk, we will discuss the importance of various event logs to track down lateral movement paths from the attackers, how to find planted (and seemingly legitimate) backdoors, and how you can work smarter, not harder – which also holds true in digital forensics.

As a bonus, we will discuss less-known artifacts like MPLogs and the bitmap cache.
By attending this talk, participants will be better and more efficient Incident Responders as they can focus on key aspects of an investigation.

After this talk, the audience understands the top artifacts evaluated in every incident response case. For example, we will discuss a variety of event logs, starting from the classic Security event logs to the Remote Desktop event logs, to Amcache, Shimcache, Prefetch files, and more.

This discussion will lay the groundwork for how we approach large-scale incident response investigations, how we can track down remote access tools installed by attackers as legitimate backdoors, or how to spot new and unusual services within the environment in no time.

As one must work smarter, not harder, we extensively use the Velociraptor artifact DetectRaptor from Matt Green, which works for Rapid7 now. This Velociraptor hunts will find evil within minutes, allowing the Incident Responders responsible for the investigation to concentrate on other aspects of the case or to dig deeper into the hosts where the detections occurred.

At the end of the presentation, we will discuss lesser-known artifacts like the Defender MPLogs, which can be a goldmine, the bitmap cache, or the SRUM database.

topic: hack.lu
Europe - Main Room
10:00
10:00
15min
Coffee & Tea
Europe - Main Room
10:00
15min
Coffee & Tea
Schengen 1 & 2
10:00
15min
Coffee & Tea
Echternach & Diekirch
10:00
15min
Coffee & Tea
Hollenfels
10:00
15min
Coffee & Tea
Vianden & Wiltz
10:15
10:15
30min
IoT hacks humans - unexpected angles of Human Process Compromise
Vladimir Kropotov

Hacking humans with IoT? It is happening now and will only scale. The rapid evolution of AI technologies, mass development and production of IoT equipment which is interconnected and can be orchestrated on backend by massive AI platforms which are sourcing, processing and cross-correlating personal and sensitive data completely changes human vs computer paradigm. No chip implant is needed to control a human, unlike it may be commonly believed. As long as enough biometric and behavioral information is collected on human beings, they and their social contacts can be completely manipulated in predictable manner. The environment of connected society is a perfect stage, where the humans are exposing their harvestable biometric and behavior profiles, by publishing content in social media or giving up the IoT devices around the things which they are reluctant to share with their closest friends. This is the new battle ground where our digital identities are appearing and exposing our strengths and weaknesses at the same time. Those identities can be created, stolen, or replicated without our consent by criminals and state sponsored actors, appear in the places we are not aware, and leveraged to target our digital presence and physical life.

By connecting the dots between generative AI, predatory advertisement companies, biometric data harvesting and Human - IoT interactions – we demonstrate the significant expansion of the attack surface against humans and social groups. Disinformation, public opinion manipulation, virtual kidnapping, exploitation of human digital identities are the fruits of the same tree. The data collected and processed in the IoT based smart environments is a gold mine for criminals and state sponsored actors to manipulate humans the way and at the scale which was impossible before.

The presentation is focusing on the attack scenarios and case studies of targeted individuals, social groups that we either have observed or to observe in the wild, including election campaigns in social media, assets take over, extortion. The consequences of attacks lead to behavior changes and actions in both, physical and digital world including changing the decisions, social engineering, exfiltration of sensitive information, choosing most vulnerable targets to attack high security environments, swaying opinions, affecting elections and other critical events, that may change the history. We will also cover both, defense options and choke points related to the expanded attack surface.

topic: hack.lu
Europe - Main Room
10:15
90min
The Heist: get your hands on the goods!
Stijn Tomme

The Heist: get your hands on the goods!

topic: hack.lu
Echternach & Diekirch
10:45
10:45
30min
KubeHound: Identifying attack paths in Kubernetes clusters at scale with no hustle
Julien

In this talk, we'll dive into KubeHound, a Tool for building Kubernetes attack paths. We will present the genesis of the project and what answers regarding your Kubernetes cluster security it might bring to you. We will cover how KubeHound bring you offensive mindset on a silver platter because we think the best defense is a good offense. Live demos of KubeHound from the defender’s and attacker’s point of view will be performed during the talk.

topic: hack.lu
Europe - Main Room
11:15
11:15
30min
The Web of cognitive warfare
Jindrich Karasek

In an era where cognitive warfare has become a pivotal battleground, the strategic manipulation of information to influence public perception and decision-making processes poses significant threats to global security and stability. This multifaceted domain exploits digital interconnectedness, leveraging psychological vulnerabilities and technological platforms to achieve its objectives. The complexity of cognitive warfare necessitates advanced strategies that incorporate cyber threat hunting, open-source intelligence (OSINT), and ethical hacking. These methodologies are critical in identifying, understanding, and mitigating the sophisticated tactics employed by adversaries in the digital landscape.

topic: CTI
Europe - Main Room
12:00
12:00
90min
Lunch
Europe - Main Room
12:00
90min
Lunch
Schengen 1 & 2
12:00
90min
Lunch
Echternach & Diekirch
12:00
90min
Lunch
Hollenfels
12:00
90min
Lunch
Vianden & Wiltz
13:30
13:30
30min
Lightning Talks
Europe - Main Room
14:00
14:00
120min
Chrome V8 exploitation training for beginners
hoseok Lee

Many Chrome exploits can lead to execution of remote code and most of these exploits started out with a vulnerability in V8. So, many Experts dive into bug bounty to find potentially exploitable vulnerabilities. But, there is a significant lack of publicly available analysis guides for beginners to start, and it is challenging to analyze the technical meanings using only documents.

We will share the detailed steps needed for beginners who have yet to experience about V8 exploits. First, we describe the detailed structure (memory, object, etc.) and mechanism. Furthermore, we explore bugs via d8 debugger and explain step-by-step how to write exploit code.

The audience will have the opportunity to learn and experience V8 exploit techniques by not only studying the theory but also analyzing the V8 engine through hands-on training. The hands-on training will be conducted through our VDI environment, therefore the audience can access and enjoy it freely with their personal laptops without setting up a practice environment.
※ The audience will be able to enjoy interesting and valuable training in a comfortable practice environment.

We hope that this workshop will encourage many beginners to dive into V8 vulnerability research.

topic: hack.lu
Vianden & Wiltz
14:00
120min
Defeating Encryption By Using Unicorn Engine
Balazs Bucsay

Software Reverse-Engineering (SRE) is often considered black magic, but with the right tools and knowledge, its processes can be significantly accelerated. Unicorn Engine is a powerful framework that allows you to execute code platform-independently, which can greatly enhance your SRE skills. Why not learn it?

topic: hack.lu
Hollenfels
14:00
30min
I Need Access: Exploit Password Management Software To Obtain Credential From Memory
Efstratios Chatzoglou

Passwords have long been a foundational element of cybersecurity, but they remain vulnerable to various attacks aimed at acquiring user credentials. Password management software (PM) has emerged as a key defense, yet misconfigurations and user errors can still result in data leaks. This presentation introduces a new red teaming tool, Pandora, capable of extracting credentials from 18 popular PM implementations, including desktop applications, browsers, and browser plugins. Pandora requires the PM to be active to dump its processes and analyzing them for user credentials. Although this vulnerability is not new, Pandora represents the first public tool to exploit it, emphasizing the need for the pentesting community to advocate for stronger protections from vendors to secure user credentials. Additionally, only two vendors have acknowledged the problem, with one CVE ID (CVE-2023-23349) reserved for Kaspersky.

topic: hack.lu
Europe - Main Room
14:00
120min
MISP Kickstart
Shanna Daly, James Garratt

MISP Kickstart provides a comprehensive introduction to the popular Open Source Threat Intelligence and Sharing Platform, "MISP."
The course will establish a foundational understanding of the practical applications of MISP in cyber threat intelligence.
This course follows a real-world scenario where participants will set up a local MISP instance, configure an organisation and users, and create events and information based on the threat profile of an organisation and its industry vertical. Participants will develop an understanding of the common use cases for MISP, learn how to set up and manage sharing communities, select relevant threat feeds (and also not what to turn on) and see how MISP automation workflows can be utilised.

topic: CTI
Schengen 1 & 2
14:00
90min
The Heist: get your hands on the goods!
Stijn Tomme

The Heist: get your hands on the goods!

topic: hack.lu
Echternach & Diekirch
14:30
14:30
30min
Empowering Cybersecurity Outreach and Learning through Collaborative Challenge Building, Sharing, and Execution
David Durvaux, Alexandre Dulaunoy

In the dynamic landscape of cybersecurity, continuous skill development is paramount. This presentation, titled "Empowering Cybersecurity Outreach and Learning through Collaborative Challenge Building, Sharing, and Execution," delves into innovative approaches to enhance outreach and learning in the field.

Focused on the creation, sharing, and execution of challenges, particularly through platforms like Capture The Flag (CTF), the session aims to illustrate the transformative impact of hands-on experiences with the FIRST.org challenges.

The discussion will also outline how it has grown, offering a wide variety of knowledge fields and strong collaboration between the volunteers and their supporting organisation.

topic: hack.lu
Europe - Main Room
15:00
15:00
30min
Artemis: how CERT PL improves the security of the Polish internet
Krzysztof Zając

How to scan more than 500 thousand domains and subdomains and identify almost 300 thousand vulnerabilities and misconfigurations, ranging from minor (lack of proper SSL or DMARC configuration), to critical (SQL Injections or RCEs)?

topic: hack.lu
Europe - Main Room
15:30
15:30
30min
Spicy — Generating Robust Parsers for Protocols & File Formats
Benjamin Bannier

This talk gives a practical overview and introduction of the Spicy parser generator for protocols and file formats.

topic: hack.lu
Europe - Main Room
16:00
16:00
15min
Refreshment
Europe - Main Room
16:00
15min
Refreshment
Schengen 1 & 2
16:00
15min
Refreshment
Echternach & Diekirch
16:00
15min
Refreshment
Hollenfels
16:00
15min
Refreshment
Vianden & Wiltz
16:15
16:15
120min
Hands-on Kubernetes security with KubeHound (purple teaming)
Julien

Join us for an immersive hands-on workshop where we'll dive into KubeHound, a Tool for building Kubernetes attack paths. Participants will play the role of an attacker, but we think the best defense is a good offense. With concrete scenarios and a live environment, attendees will learn to leverage KubHound to identify attack paths in Kubernetes clusters at scale with no hustle.

topic: hack.lu
Vianden & Wiltz
16:15
120min
Malware Development and Persistence
cocomelonc

Malware Development and Persistence Techniques.
The course will teach you how to develop malware, including classic tricks and tricks of modern ransomware found in the wild. Everything is supported by real examples.
The course is intended for Red Team specialists to learn in more detail the tricks of malware development (also persistence and AV bypass) and will also be useful to Blue Team specialists when conducting investigations and analyzing malware.

The course is divided into four logical sections:
- Malware development tricks and techniques (classic injection tricks, DLL injection tricks, shellcode running)
- AV evasion tricks (Anti-VM, Anti-Sandbox, Anti-disassembling)
- Persistence techniques
- Cryptographic functions in malware development (exclusive)

topic: CTI
Schengen 1 & 2
16:15
30min
Securing the Stars: Comprehensive Analysis of Modern Satellite Vulnerabilities and Emerging Attack Surfaces
Vic Huang

This talk provides an extensive overview of security challenges in satellite systems. It covers vulnerabilities across space, ground, link, and user segments, using real-world examples in the past security research and the Viasat incident. By analyzing various attack methods from software vulnerabilities to radio frequency interference, this talk offers crucial insights for protecting current satellite infrastructures and anticipating future security challenges in the rapidly evolving field of satellite technology.In addition, the open community cubesat projects are growing.Vulnerabilities in these projects could also be a new threat.There will be 1 case study and new found vulnerabilities sharing for open project and a special case study of ground-station system in this talk.

topic: hack.lu
Europe - Main Room
16:15
90min
The Heist: get your hands on the goods!
Stijn Tomme

The Heist: get your hands on the goods!

topic: hack.lu
Echternach & Diekirch
16:15
90min
Unleashing the power of purple teaming with OpenTIDE
Remi Seguy, Amine Besson

With OpenTIDE the Threat-Informed Detection Engineering framework, Cyber Threat Intelligence and Detection Engineering teams can work together to model the threat vectors (aka attack scenarios) in a structured, actionable and automation-ready object which become at the centre of a knowledge graph. With that framework, Cyber Threat Intelligence teams can prioritise to expand the threat detection coverage while the Detection Engineering teams can measure and report on the current threat coverage

topic: CTI
Hollenfels
16:45
16:45
30min
DFIQ - Codifying digital forensic intelligence
Thomas Chopitea

CTI practitioners have threat intelligence databases; what about digital forensics practitioners? How can they organize knowledge and ensure that investigations are carried out in a repeatable manner? In the same way that threat intelligence describes attackers, capabilities, and infrastructure, Digital Forensics Intelligence describes the relationship between systems, questions, and investigation techniques.

Enter DFIQ (Digital Forensics Investigative Questions; https://dfiq.org/): a framework used to model scenarios, questions and approaches in digital forensics investigations. This talk will take a deeper dive into the DFIQ model, and more importantly the different ways it is practically used to facilitate forensic investigators' day-to-day activities, ensure repeatable conclusions of investigations, and knowledge sharing among analysts. We'll discuss how DFIQ is stored in Yeti, used in Timesketch, and can be used to leverage end-to-end collection and analysis workflows to accelerate and structure investigations in large enterprise environments.

topic: CTI
Europe - Main Room
17:15
17:15
30min
Cyber Threats to Advanced Intelligent Connected Vehicle Systems
Yuqiao Ning, Shihao Xue

This paper examines Intelligent Connected Vehicles (ICVs) by focusing on their architecture, capabilities, and security vulnerabilities.

topic: hack.lu
Europe - Main Room
17:45
17:45
30min
APT28: Following bear tracks back to the cave
Golo

In May 2024, the NATO publicly condemned cyber espionage operations carried out by a Russian state-sponsored group against targets in Germany and Czechia. We track this group as ITG05 sharing overlaps with APT28, UAC-0028, Forest Blizzard and Fancy Bear. In addition to Germany and Czechia, a large number of NATO member states as well as the Ukraine have been subject to long-term intelligence gathering missions executed by ITG05. ITG05 is also linked to the hack of the German Bundestag in 2015 as well as the attacks targeting the 2016 US presidential elections.

topic: CTI
Europe - Main Room
09:00
09:00
30min
Back to the failure - Did your physical security really evolved in the last 40 years?
Simon Geusebroek

There was time when computer security was not a thing. A time blessed by wannabe hackers when sensitive facilities were just wide open because, seriously, who would really attempt to hack into a research or a leading industry system ? This was a long time ago... or was it ? What if I tell you there is a whole branch of information security which still happily lives in this stone-age ?

topic: hack.lu
Europe - Main Room
09:30
09:30
30min
Blowing up Gas Stations for fun and profit
Pedro Umbelino

Since the war(s) broke loose last years, a lot has been said about cyberwarfare, attacks on critical infrastructure, ICS/OT vulnerabilities, you name it. In this talk, we are going to talk about a specific set of ICS: Automated Tank Gauging (ATG) systems. These systems control the safe storage and management of fuel in critical infrastructures like gas stations, military bases, airports and hospitals.
We will discuss multiple (10) zero-day vulnerabilities that expose these systems to catastrophic risks, from environmental hazards to significant economic losses. Despite past warnings, thousands of ATG systems remain online, unprotected, and vulnerable to exploitation.
This track will talk about past ATG research, the new vulnerabilities found and their technical details, demonstrating how they can be exploited to gain unauthorized control over ATG systems. In the end, we will dive into our quest to cause physical damage remotely, in hopes of blowing up (our) gas station.

topic: hack.lu
Europe - Main Room
10:00
10:00
15min
Coffee & Tea
Europe - Main Room
10:00
15min
Coffee & Tea
Schengen 1 & 2
10:00
15min
Coffee & Tea
Echternach & Diekirch
10:00
15min
Coffee & Tea
Hollenfels
10:00
15min
Coffee & Tea
Vianden & Wiltz
10:15
10:15
90min
NLP deep-dive: Transformers for Text Mining and Text Generation in Cybersecurity
William Robinet, Pauline Bourmeau (Cookie)

The application of Natural Language Processing (NLP) has become increasingly vital for cybersecurity threat intelligence and response strategies today. NLP plays a crucial role by enabling more accurate and nuanced analyses of potential threats through linguistic techniques. Among other applications, NLP allows quicker categorization of threats based on their nature – such as phishing schemes or anomalous behaviors – and enables prioritizing responses accordingly. NLP can also facilitate the development of content prediction schemes for analysts or provide powerful information extraction tools. We will cover two text-mining techniques that we believe are a good starting point with NLP for analysts and incident responders: sentiment analysis and Named Entity Recognition (NER). While sentiment analysis reveals underlying emotions or biases in social media content potentially linked to malicious activities, NER identifies critical information such as IP addresses, domains, and user details essential for correlating incidents across different data sources.

topic: hack.lu
Hollenfels
10:15
90min
Reversing Flutter with Blutter and Radare2
Axelle Apvrille

Flutter is an open-source UI software development kit with the ability to create applications for Android, iOS, and non-mobile platforms using a single codebase. The performance aspect is handled by using ahead-of-time (AOT) native compilation in release builds.

In terms of reverse engineering, Flutter is particularly difficult to tackle because disassemblers do not support its custom binary format, registers and representation of integers.

In this workshop, we will:

  • Learn how to reverse Flutter applications
  • Learn how to use Blutter and understand its output
  • Load symbols in Radare2 to parse the binary more easily
  • Patch a game with a native Frida hook to reveal an Easter Egg
topic: hack.lu
Schengen 1 & 2
10:15
90min
The Heist: get your hands on the goods!
Stijn Tomme

The Heist: get your hands on the goods!

topic: hack.lu
Echternach & Diekirch
10:15
30min
The good, the bad, and the ugly: Microsoft Copilot
Inbar Raz, Michael Bargury

The good: There's an insider working at your competition, helping you.
The bad: There's also an insider working at your business, helping the competition.
The ugly: It's Microsoft Copilot.

The race to capture the benefits of GenAI is already at full speed, and everybody is diving head-first into putting corporate data and operations in the hands of AI. The concept of a Copilot has emerged as a way to keep AI tamed and under control. However, while employees rarely cross the lines and become rogue, it turns out that Microsoft Copilot is rogue by design.

In this talk, we will show how your Copilot Studio bots can easily be used to exfiltrate sensitive enterprise data circumventing existing controls like DLP. We will show how a combination of insecure defaults, over permissive plugins and wishful design thinking makes data leakage probable, not just possible. We will analyze how Copilot Studio puts enterprise data and operations in the hands of GenAI, and expose how this exacerbates the prompt injection attack surface, leading to material impact on integrity and confidentiality.

Next, we will drop CopilotHunter, a recon and exploitation tool that scans for publicly accessible Copilots and uses fuzzing and GenAI to abuse them to extract sensitive enterprise data. We will share our findings targeting thousands of accessible bots, revealing sensitive data and corporate credentials.

Finally, we will offer a path forward by sharing concrete configurations and mistakes to avoid on Microsoft’s platform, and generalized insights on how to build secure and reliable Copilots.

topic: hack.lu
Europe - Main Room
10:45
10:45
30min
Scam as a Service powered by Telegram
Aurimas Rudinskis

In 2022, an insider from one of the scammers' groups switched sides and shared details about the ongoing attacks. This kicked off a multi-year analysis of the underground economy that provides a range of illicit Telegram-based services to facilitate shady activities, offering everything from data breaches and identity theft to financial fraud. The talk will explore how fraudsters leverage platforms' features to launch "Scam as a Service" operations.

topic: CTI
Europe - Main Room
11:15
11:15
45min
From 0 to millions: Protecting against AitM phishing at scale
Jacob Torrey

Phishing has evolved both in the TTPs of attackers, and their targets. From simple clones of a website trying to get a username/password to reverse-proxying systems that steal sessions even with MFA, the target landscape has changed. Many of the defenses against phishing are started to show their age, between block-lists for domains that appear to be illegitimate, SMS/push MFA, and broken functionality cues that may alert someone to the site not being correct. Modern phishing tools, like EvilGinx, Modlishka, and more handle all of these by hiding the phishing content behind a unique "lure" to avoid domain blocking, supporting SMS/push MFA, and seamlessly allowing for login and hand-over once the session has been stolen.

This talk is focused on a Canarytoken type that lets you protect a shared-responsibility platforms that are difficult to gain insight into. These include Azure Entra ID, LogTo, and custom sites. The Cloned Site Canarytoken lets you quickly get alerted if someone is mirroring or reverse-proxying a sensitive login page that has any of your users trying to login--you can get alerted about the phishing site's URL before the user has even entered their password!

After a view of the landscape of modern phishing techniques, defenses, we'll dive into our novel defenses, and look at the data of token alerts from millions of logins every day to build a view of real-world phishing attacks and their TTPs. We'll finish off with how to respond to alerts, and some attacks against our Canarytoken. Finally we'll discuss our mental model for sharing this information via networks like MISP.

topic: CTI
Europe - Main Room
12:00
12:00
90min
Lunch
Europe - Main Room
12:00
90min
Lunch
Schengen 1 & 2
12:00
90min
Lunch
Echternach & Diekirch
12:00
90min
Lunch
Hollenfels
12:00
90min
Lunch
Vianden & Wiltz
13:30
13:30
30min
Lightning Talks
Europe - Main Room
14:00
14:00
120min
Cryptography: from zero to dont-shoot-yourself-in-the-foot
Lorenzo Nicolodi

Let's be honest: cryptography is hard. Luckily, plenty of great cryptographers in the past 70 years did the heavy lifting for us. So our goal here will be to understand how we can use the most common cryptographic algorithms properly, which one to use depending on the context, the common pitfalls and how to avoid them.

topic: hack.lu
Schengen 1 & 2
14:00
120min
From protocol analysis to actionable algorithmic and signature detection with Suricata
Peter Manev, Eric Leblond

Suricata is a widely-used high performance, open source network analysis and threat detection software. This training will provide hands-on learning for different techniques using Suricata protocol analysis data for generating useful and actionable algorithmic and signature detection.

topic: hack.lu
Vianden & Wiltz
14:00
30min
Quantum Cybersecurity - Pioneering a Secure Future
Samira Chaychi, Sharif Shahini

As quantum computing advances, it presents unique cybersecurity challenges that existing digital security systems are inadequately equipped to handle. This talk explores the realm of quantum cybersecurity, focusing on quantum key distribution (QKD) and post-quantum cryptography (PQC) as essential tools to secure communications against the formidable computational power of quantum computers. We will explore the advantages of these technologies, their necessity in the modern cybersecurity landscape, current interoperability issues between different quantum cryptographic systems, and propose potential solutions to these challenges. The session aims to highlight the future directions of quantum cybersecurity and the ongoing efforts to standardise and enhance the security protocols to address these emerging threats effectively.

topic: hack.lu
Europe - Main Room
14:00
120min
Scanning with the Artemis security scanner
Krzysztof Zając

At CERT PL we periodically scan 500 thousands of domains and subdomains and automatically report found vulnerabilities and misconfigurations using the Artemis scanner (https://github.com/CERT-Polska/Artemis). Are you e.g. a CSIRT, hosting provider, or an university network administrator and want to set up a similar project?

topic: hack.lu
Hollenfels
14:00
90min
The Heist: get your hands on the goods!
Stijn Tomme

The Heist: get your hands on the goods!

topic: hack.lu
Echternach & Diekirch
14:30
14:30
30min
Making IOT great again
David Durvaux, Marc Durvaux

We are surrounded, in our daily life, with devices that have a strong link with cloud infrastructure. Those devices, while still completely operational, can become a useless piece of hardware if the vendor stop the infrastructure for any reason.

This aims at discussing how to give a second life to such devices using the practical use case of the EV chargers of the Belgian company PowerDale which went on bankrupt in July 2023.

We will discuss the successes and failures of our journey, how a community of enthusiasts manages to build workarounds and what could be our community contribution.

topic: hack.lu
Europe - Main Room
15:00
15:00
30min
Ghosts'n'gadgets: common buffer overflows that still haunt our networks
Stanislav Dashevskyi

Stack smashing has become very different in the 21st century. Binary hardening
mechanisms used by default by all modern OSes make it nearly impossible to
exploit trivial buffer overflows. Since 1996, machines have evolved
significantly and you cannot even follow the original "Smashing the stack
[...]" tutorial by Aleph One on a modern computer.

Yet, there are other kinds of machines that are lacking all the binary
hardening we now take for granted. Because of that, they are ideal "target
practice" material for those who wish to learn about exploiting stack-based
buffer overflows or use them for causing real damage. Too bad these
machines "sit" on the edge of home and enterprise networks, often being the
only barrier between that the attackers need to overcome for a complete PWN.

In this talk I will demonstrate how we could smash the stack of two networking
devices from two different vendors (a wireless gateway, and a high-throughput
VPN concentrator), allowing for unauthenticated root access. I will also
present the vulnerability root-cause analysis and offer insights on why such
attacks are still viable in 2024.

topic: hack.lu
Europe - Main Room
15:30
15:30
30min
SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level
Paul Gerste

SQL injections seem to be a solved problem; databases have built-in support for prepared statements, leaving no room for injections. In this session, we will go a level deeper: instead of attacking the query syntax, we will explore smuggling attacks against database wire protocols, through which remote, unauthenticated attackers can inject entire (No)SQL statements into an application's database connection.

topic: hack.lu
Europe - Main Room
16:00
16:00
15min
Refreshment
Europe - Main Room
16:00
15min
Refreshment
Schengen 1 & 2
16:00
15min
Refreshment
Echternach & Diekirch
16:00
15min
Refreshment
Hollenfels
16:00
15min
Refreshment
Vianden & Wiltz
16:15
16:15
30min
Keys to the City: The Dark Trade-Off Between Revenue and Privacy in Monetizing SDKs
Dimitrios Valsamaras

Software Development Kits (SDKs) allow developers to significantly enhance the functionality and performance of their apps, among other benefits, without writing complex code. By importing SDKs, developers can save time and money, access various services and APIs, and achieve compatibility and integration across different platforms, devices and operating systems. When it comes to app monetization, advertisement SDKs are a common way of generating revenue from apps, especially freeware that rely on in-app purchase or subscription.

However, there are also downsides associated with using code from external sources, such as security breaches, data leaks, or malicious attacks and perhaps one of the most effective ways to safeguard an app from such a threat is to perform some type of security audit. Mobile apps though pose a challenge for code review, as they can use webviews to dynamically change their behavior and execute arbitrary code from remote sources, bypassing the security audit of the app.

topic: hack.lu
Europe - Main Room
16:15
120min
Open source Intelligence and Command line based BGP Hijacking Detection
Joon Kim

In this training, trainees deal with BGP hijacking, which involves redirecting internet traffic by manipulating the Border Gateway Protocol. It covers the impact, training details, data sources, and notable BGP hijacking incidents. These incidents include the involvement of the Italian Hacking Team, Amazon DNS, China Telecom, and a recent incident at KlaySwap in South Korea.
This hands-on training session will use fully open-source-based intelligence and command-line analysis tools to identify and visualize BGP hijacking incidents in any network. After this training, trainees will be equipped with new skills to detect BGP hijacking when suspicious phenomena occur.

topic: hack.lu
Schengen 1 & 2
16:15
90min
The Heist: get your hands on the goods!
Stijn Tomme

The Heist: get your hands on the goods!

topic: hack.lu
Echternach & Diekirch
16:15
120min
iOS Compromise Detection using open source tools
Christophe Vandeplas, David Durvaux

Are you, or your organisation, concerned about potential compromise on your iPhone, iPad, or Apple Watch? This workshop equips you with the knowledge and tools to identify red flags on your iOS device. We delve into the world of sysdiagnose and explore methods to verify potential breaches.

topic: hack.lu
Vianden & Wiltz
16:45
16:45
30min
Understanding file type identifiers & scanners
Ange Albertini

Yara, LibMagic (file, binwalk, polyfile), TrID, Yara, Magika, PeID, Pronom, FDD, ShareMime, DiE...
How do they work? What are their pros and cons, their limitations, their risks?

topic: hack.lu
Europe - Main Room
09:00
09:00
30min
The Ouroboros of Cybercrime: Witnessing Threat Actors go from Pwn to Pwn'd
Estelle

Infostealers are a type of malware designed to secretly collect sensitive information from infected devices. They create stealer logs with valuable data such as login credentials. These malware communicate with Command-and-Control (C2) servers, which direct their actions and receive the stolen data. These stolen logs are highly valuable, forming the basis of a profitable underground market where cybercriminals sell and trade this information.
But what if C2 operators also fell victim to their own skim : the biter bit. In this presentation, we will dive into stealer logs of C2 operators, who have infected themselves accidentally with infostealer malware, to uncover hidden C2 infrastructure and their backstage. Join us as we expose the unexpected vulnerabilities within the cyber underworld.

topic: hack.lu
Europe - Main Room
09:30
09:30
30min
The XE Files - Trust No Router
James Atack

On the 16th October 2023 Cisco Talos shared intelligence about a handful of compromised routers discovered while resolving customer support requests. As the full story unfolded, a handful of backdoored devices turned into tens of thousands, and the massive mobilisation of incident response teams as patches were applied and workarounds implemented. Many months later, the incident may be largely forgotten by Cisco customers and the cyber-security community, but working on these routers remains an objective for somebody.

topic: CTI
Europe - Main Room
10:00
10:00
15min
Coffee & Tea
Europe - Main Room
10:00
15min
Coffee & Tea
Schengen 1 & 2
10:00
15min
Coffee & Tea
Echternach & Diekirch
10:00
15min
Coffee & Tea
Hollenfels
10:00
15min
Coffee & Tea
Vianden & Wiltz
10:15
10:15
30min
New features in the Zeek Network Monitor
Christian Kreibich

This talk provides a tour of new features in the open-source Zeek network monitor that have landed in the past year: scriptability via JavaScript, performance improvements to its scripting language via a new abstract language machine, analyzer development via the Spicy parser generator, a revamped telemetry framework for scraping via Prometheus, and more!

topic: hack.lu
Europe - Main Room
10:15
90min
The Heist: get your hands on the goods!
Stijn Tomme

The Heist: get your hands on the goods!

topic: hack.lu
Echternach & Diekirch
10:15
90min
XOR Cryptanalysis
Didier Stevens

In this 2 hour workshop, Didier will guide you through XOR Cryptanalysis exercises using several open source tools (several of these tools are created and maintained by Didier).

topic: hack.lu
Schengen 1 & 2
10:15
105min
Zeek and Destroy with Python and Machine Learning Workshop (Part 1/2)
Eva Szilagyi, David Szili

Zeek is an open-source network security monitor (NSM) and analytics platform that has been around for quite some time (since the mid-90s). It is used at large university campuses and research labs, but in the past few years, more and more security professionals in the industry have turned their attention to this fantastic tool.

topic: hack.lu
Vianden & Wiltz
10:45
10:45
30min
Sigma Unleashed: A Realistic Implementation
Mathieu LE CLEACH

Sigma is a well-known generic detection rule format in the cybersecurity landscape. While this free, open-source project is very active and offers a wide range of features, its implementation is challenging, and especially for MSSPs. At CERT-EU, we serve the 90 European Union institutions, bodies, offices and agencies (Union entities) and we strive to deliver the best possible services to them. This is why we relentlessly try to enhance the detection capabilities of our Security Log Monitoring Service.

To this endeavour, we created droid, a tool that we specifically built to introduce Detection-as-Code in our environment. In the spirit of fostering a culture of collective progress, we released droid as our take to facilitate the ingestion of Sigma rules for any organisation.

topic: hack.lu
Europe - Main Room
11:15
11:15
30min
Predictive Analytics for Adversary Techniques in the MITRE ATT&CK Framework using Rule Mining
Tristan MADANI

In this presentation, Tristan Madani will delve into "Predictive Analytics for Adversary Techniques in the MITRE ATT&CK Framework using Rule Mining." This talk introduces a novel approach to predicting potential adversary techniques by leveraging historical attack data and applying association rule mining. Attendees will gain insights into how the MITRE ATT&CK framework can be utilized to enhance threat hunting and incident response capabilities. Key takeaways include understanding the methodology behind rule mining, the practical application of the Apriori and FP-Growth algorithms, and the implications of the findings for proactive cybersecurity measures. This presentation is essential for cybersecurity professionals looking to stay ahead of evolving threats by anticipating adversary actions.

topic: hack.lu
Europe - Main Room
12:00
12:00
90min
Lunch
Europe - Main Room
12:00
90min
Lunch
Schengen 1 & 2
12:00
90min
Lunch
Echternach & Diekirch
12:00
90min
Lunch
Hollenfels
12:00
90min
Lunch
Vianden & Wiltz
13:30
13:30
30min
Lightning Talks
Europe - Main Room
14:00
14:00
120min
Exploring Firmwares: Tools and Techniques for (New) Cartographers
Eloïse Brocas

This workshop will introduce attendees to the world of firmware analysis. It will discuss only structured firmwares---i.e. firmware containing a file system---by opposition to monolithic firmwares also known as baremetal firmwares. Students will discover two major steps of this analysis workflow which are also the most firmware specific ones: extraction of the filesystem and its cartography. Various open-source tools will be introduced, including two developed by Quarkslab: Pyrrha, a mapper collection for firmware analysis, and its underlying API Numbat. Based on this latter, attendees will be able to develop their own cartography tools with a nice UI. All along this workshop, a strong focus will be made on the tasks that could be automated by some existing or future tools but also on the limits of this automatization.

topic: hack.lu
Schengen 1 & 2
14:00
30min
Internal Domain Name Collision 2.0
Philippe Caturegli

The proliferation of new Top-Level Domains (TLDs) has sparked security concerns primarily around phishing and social engineering attacks. However, the emergence of these new TLDs has broadened the attack surface, making it easier for threat actors to exploit other domain-related vulnerabilities. Our research explored another critical but often overlooked vulnerability: Internal Domain Name Collision.

topic: hack.lu
Europe - Main Room
14:00
90min
The Heist: get your hands on the goods!
Stijn Tomme

The Heist: get your hands on the goods!

topic: hack.lu
Echternach & Diekirch
14:00
105min
Zeek and Destroy with Python and Machine Learning Workshop (Part 2/2)
David Szili, Eva Szilagyi

Zeek is an open-source network security monitor (NSM) and analytics platform that has been around for quite some time (since the mid-90s). It is used at large university campuses and research labs, but in the past few years, more and more security professionals in the industry have turned their attention to this fantastic tool.

But Zeek is so much more than just a NIDS generating alerts (notices) and log files! Zeek's scripting language allows security analysts to perform arbitrary analysis tasks such as extracting files from sessions, detecting brute-force attacks, or, most importantly, interfacing with external sources, such as Python! The Zeek Python bindings allow us, the analysts, to use powerful Python libraries such as Numpy, Pandas, and Tensorflow and apply machine learning-based detection on network traffic.

During this two-hour workshop, we will learn about the following topics:
- Super fast introduction to Zeek (architecture, events, logs, signatures, etc.)
- Using machine learning and data science tools on Zeek logs (as an example, we will use Fourier Analysis to detect C2 beaconing)
- Super fast crash course in Zeek scripting (just enough to understand how to create new logs)
- Connecting Zeek and Python via the Zeek Broker Communication Framework
- Using machine learning tools in Python on the data we receive from Zeek for detection (as an example, we will use convolutional neural network and random forest models to compare them, and then use them to find unknown malware in live network traffic)

Requirements for the workshop:
- A laptop with at least 16 GB of RAM and more than 50 GB of free disk space (VT-x support must be enabled on the host system).
- Application to run Virtual Images (type-2 hypervisor): VMWare Workstation Pro (recommended), VMWare Workstation Player, VMWare Fusion, or VirtualBox.
- Only 64-bit Intel-compatible (Intel or AMD) processors are supported. WARNING: ARM-based (like Apple Silicon, Qualcomm Snapdragon, some Microsoft Surface laptops) devices cannot perform the necessary virtualization and therefore cannot be used for the workshop.

topic: hack.lu
Vianden & Wiltz
14:30
14:30
30min
TODDLERSHARK: Kimsuky's Hastily Built Variant of BABYSHARK Deployed Using an 1-Day Exploit
George Glass

The Kroll Cyber Threat Intelligence (CTI) team discovered new malware resembling the VBScript based BABYSHARK malware that we've called TODDLERSHARK.

The malware was used in post-compromise activity following exploitation of two vulnerabilities in ScreenConnect, which were responsibly disclosed by a Kroll analyst but quickly weaponised after detail of the vulnerability was published.

BABYSHARK has been associated, by several sources, with a threat actor Kroll tracks as KTA082 (Kimsuky).

The malware utilized legitimate Microsoft binary and alternate data streams and exhibited elements of polymorphic behavior.

This talk will detail how the exploits work, how Kimsuky was able to quickly operationalize a n-day vulnerability, a teardown of TODDLERSHARK and how simple detection methods were able to stop an APT group.

topic: CTI
Europe - Main Room
15:00
15:00
30min
Reverse engineering Android apps with ACVTool
Aleksandr Pilgun

ACVTool is a sophisticated bytecode instrumentation tool designed for highlighting instruction coverage in Android apps. In 2024, ACVTool received a major update unlocking smali coverage analysis for modern complex Android apps. Now, ACVTool supports Multidex and Multi-APK applications of any size. Secondly, ACVTool can highlight a particular feature, e.g. to see the code actually executed when tapping a button. To further depict selected app behavior, ACVTool may partially shrink not executed code. ACVTool works on 3rd-party Android without source code, and it does not require a rooted device.

topic: hack.lu
Europe - Main Room
15:30
15:30
30min
Detection And Response for Linux without EDR
Hilko Bengen

For defending Windows, EDR software is the simple, easy path. On Linux – not so much. Since products are designed and developed for Windows, they lack important capabilities on other platforms. We chose a different path.

topic: hack.lu
Europe - Main Room
16:00
16:00
15min
Refreshment
Europe - Main Room
16:00
15min
Refreshment
Schengen 1 & 2
16:00
15min
Refreshment
Echternach & Diekirch
16:00
15min
Refreshment
Hollenfels
16:00
15min
Refreshment
Vianden & Wiltz
16:15
16:15
30min
Mercator - Mapping the information system
Didier Barzin

Computer attacks are becoming increasingly sophisticated and occur in a rapidly evolving environment. To effectively address these challenges, organizations need a comprehensive understanding of their information systems. Achieving this requires implementing a detailed map of the Information System.

topic: hack.lu
Europe - Main Room
16:45
16:45
30min
Disconnecting games with a single packet: an Unreal untold story
Hugo Bertin

In 2023, the gaming industry reached a worldwide revenue of US$384.9 billion. Yet, this industry is facing a growing number of cheating actors and techniques.

We introduce new attacks targeting multiplayer games based on Unreal Engine such as Fortnite, PUBG, Valorant... These attacks disconnect a player from an ongoing game session against his will. Cheaters can launch it as a Denial-of-Service against opponents with very few packets (sometimes only one). In most cases, the attacker can steal the victory from the target without exposing himself as a cheater.

It is important to understand that these attacks do not exist because of a vulnerability or an implementation error. They are conscious design choices, dictated by the constraints inherent to a widely distributed multiplayer game. Mitigating these attacks is thus not trivial.

This talk shows how such issues present in a single game engine can spread widely, across several games produced by different editors. It is quite probable that other game engines, such as Unity, are not immune to these issues. However, this presentation solely focuses on the Unreal Engine whose source code is available. We present our analysis of the design and implementation choices made within the Unreal Engine. We explain how to exploit the protocols used. We cover and discuss how to defeat some common countermeasures used on the Internet against IP spoofing, such as Source Address Validation. We mention some mitigation strategies for video game developers. We show videos of these attacks against real popular games.

topic: hack.lu
Europe - Main Room