Botnets have managed to stay relevant in a number of ways, from the incorporation of phishing in their attack chains to a subscription service model. Their adaptability has proved that botnets indeed still represent an effective way to launch devastating attacks. In this talk, we will present a comprehensive overview of our latest research on new groups, delving into their organizational structures, codebases, and tactics. We will explore how these malicious actors share information, select their targets, and offer their services. By sharing our findings, we hope to raise awareness and facilitate a better understanding of these threats, ultimately contributing to the development of more effective countermeasures.

LLMs turn out to be highly practical for summarising and extracting information from unstructured Cyber Threat Intelligence (CTI) reports. However, most models were not trained specifically for understanding CTI. We will present a custom LLM, fine-tuned for CTI purposes. But of course, that only makes sense with a CTI text benchmark dataset. Creating these two systems is a challenging journey. Set-backs guaranteed. We will share our findings.

In the evolving cyber threat landscape, reverse engineering is crucial for understanding and mitigating malicious attacks. This session covers the essentials of reverse engineering, including assembly language, binary code, and key tools like disassemblers and debuggers. Participants will explore practical techniques for analyzing malware, learning to identify and dissect various types through real-world examples. The session includes a hands-on demonstration using tools like IDA Pro and Ghidra, focusing on unpacking, disassembly, and extracting Indicators of Compromise (IOCs). Additionally, best practices and strategies to overcome common challenges in reverse engineering will be discussed, equipping security professionals with the skills to effectively defend against cyber threats.

During this workshop, you will learn how to use the various tools from the
OpenSSH suite. We will start with a presentation of the problems that are solved
by OpenSSH, then we will dive into the details of its most important and useful
features.
Among the topics covered, we will discuss about remote host authentication,
password and public key client authentication, key generation, local and remote
port forwarding, forward and reverse SOCKS proxying, X11 forwarding, jumphosts, connection to legacy systems, and more.

Hands-on exercises will be proposed throughout the exploration of the tool suite
using real-life scenarios. There will be space for questions and discussion.

This workshop is intended for beginners who wants to improve their practical
knowledge and experience with OpenSSH.

Basic networking and Linux shell knowledge are required in order to follow this
workshop. Each participant will need a Linux machine (on which they have root access) with Docker pre-installed and Internet access.

In ‘Tales of the Future Past’, Saâd Kadhi, the Director of CERT-EU invites you to embark on a time-travelling odyssey.

The journey commences with a retrospective dive into the past, where attendees will glean insights from CERT-EU’s unique vantage point on the threat landscape, hovering over noteworthy developments the Cybersecurity Service for the Union entities had been observing.

As the time machine propels us into the future, the presentation demystifies the complexities of Artificial Intelligence, shedding light on AI’s burgeoning role in cyber threats. It offers foresight and thoughtful projections on potential AI-powered dangers, equipping the audience with the knowledge to anticipate and navigate future challenges.

The expedition culminates with a return to the present where Saâd will share his ideas on how to fortify our defences against the cyber threats of today and tomorrow.

Designed for a diverse audience, ‘Tales of the Future Past’ promises to be an enlightening journey, offering a unique blend of historical wisdom, futuristic insights, and practical, present-day solutions.

Cybersecurity incidents continue to be major concern to organizations, necessitating the timely and effective sharing of threat intelligence. The purpose of this study is to investigate the efficient delivery of Indicators of Compromise (IoCs) from the Malware Information Sharing Platform and Threat Sharing System (MISP) to various detection technologies via the ZeroMQ Messaging Protocol (ZMQ).

Kroll leverages this solution to provide rapid detection of indicators found in our DFIR and MDR practice to all of our clients. To demonstrate the proposed solution's efficacy, we developed an integration to facilitate seamless IoC distribution using ZMQ, AWS and custom workflows.

We created a proof-of-concept environment to simulate real-world scenarios, validating the successful transfer of IoCs from MISP to a range of detection technologies, such as security information and event management (SIEM) systems, endpoint detection and response (EDR) systems and next-gen antivirus (NGAV) systems in real time.

The evaluation technique evaluates the distributed IoCs' performance criteria, including speed, accuracy, and consistency across several detection technologies. Furthermore, security processes were implemented to ensure the confidentiality, integrity, and validity of the shared IoCs, hence retaining confidence and reducing the likelihood of false positives or negatives.

Our findings demonstrated that integrating MISP with ZMQ and AWS services enables speedy and reliable IoC distribution, considerably improving organisations' threat detection and incident response capabilities. This research helps to the general development of the cybersecurity landscape by enabling real-time exchange of actionable threat intelligence, as well as encouraging a proactive defense posture against emerging cyber threats.

Maintaining an open source security project for almost 8 years gives lots of opportunity for collecting experiences...good and bad ones. Time for sharing the experience from maintaining Sigma!

The goal of the tool suite is to make it easier to handle suspicious contents reported by your users, friends or constituents. It empowers them to check URLs, emails, or files they receive and take educated decisions without relying on you all the time.

This workshop will go in depth on how you can configure Lookyloo and Pandora, and all the other tools that make it a complete tool suite usable in your organization with minimal manual work. We will also look at the correlation features to pivot across captures to find phishing campaigns in the 4+ millions captures gathered across the years on the CIRCL Lookyloo instance.

Website cloaking is a technique that enables websites to deliver different content to
different clients, with the goal of hiding particular content from certain clients. Website cloaking is based on client detection, which is achieved via browser fingerprinting. In an
attempt to hide their malicious web pages from detection, cyber criminals (can) use cloaking.
They use vulnerability detection to only target clients that seem vulnerable. On top
of that, they (can) also provide benign content in case they suspect someone or something is
trying to detect them.

In this work, we investigated to what extent security web crawlers can be detected
by browser fingerprinting techniques, and provided some suggestions for how to improve them
to be able to bypass those techniques. We surveyed security analysts and analyzed a set of
threat intelligence sharing communities, to gauge awareness of cloaking as an available
detection evasion method for cybercriminals. Finally, we investigated one final technique,
the use of Cache-Control: no-store, which an attacker can use to thwart
forensic analysis.

Log events appear differently in SIEMs. There are plenty of different taxonomies, possibilities for customization or just migration scenarios that make it challenging to generate queries from Sigma rules that match on events in given log repositories. Processing pipelines are a feature of the open source Sigma toolchain that offer a solution for these challenges and this session is about some real-world use cases for them.

Return Oriented Programming (ROP) has been an essential part of exploit development since over a decade. The ROP landscape on ARM64 is bleak, thanks to severe restrictions laid down in the ARM64 ISA. This workshop provides a hands-on tutorial for starting out with ARM64 ROP gadgets and practical ROP chains. No prior knowledge of ARM64 assembly is required.

In the current digital landscape, organizations often do not become aware immediately when their data is compromised and sold online. Our objective is to minimize the duration between the exposure of data on the internet and its detection by the public. The dark web serves as a primary marketplace for the trade of personal information, accessible safely only through the use of the Tor browser. This paper focuses on monitoring significant trading forums on the dark web and demonstrates the method of web scraping specifically designed for dark web sites. Utilizing data harvested from these sites, we have trained a BERT classification model to categorize transaction posts into five distinct types of data leaks, enabling rapid identification of the leak type associated with each post.

Further, we employ the Retrieval-Augmented Generation (RAG) technique to vectorize dark web data, maintaining privacy while leveraging mainstream large language models to address concerns pertinent to cybersecurity analysts. This approach allows researchers to analyze dark web data effectively. Ultimately, the data collected from the dark web is formatted into STIX (Structured Threat Information Expression) and integrated into the MISP (Malware Information Sharing Platform) system to automate the generation of Cyber Threat Intelligence (CTI) reports. This methodology not only enhances the timeliness and accuracy of threat detection but also contributes to more efficient and proactive cybersecurity management.

Cloud incident response can be daunting, requiring a plethora of tools and skills, while most Cloud Based Startups can’t allocate budget for preventive controls, there is less space for them to understand what to do if they are hacked. That’s why we created Dredge, an Open Source framework designed to streamline cloud incident investigations, allowing engineers to execute non-trivial cloud incident response tasks easily.

An MSSP SOC presents how after a complete change of team and processes - a CTI program was restarted from (nearly) scratch, thanks to an EU-supported project. The SOC Technical Product Manager/CTI project manager will share how plans don't always come to fruition, issues faced with starting a CTI process. By sharing lessons learnt and plans for improvement - we propose some basic but wholistic steps to start a CTI program.

Join us for an immersive hands-on workshop where we'll dive into KubeHound, a Tool for building Kubernetes attack paths. Participants will play the role of an attacker, but we think the best defense is a good offense. With concrete scenarios and a live environment, attendees will learn to leverage KubHound to identify attack paths in Kubernetes clusters at scale with no hustle.

This presentation explores my discovery of unconventional malware persistence techniques through registry modifications and DLL hijacking vulnerabilities. We'll delve into cases involving Windows Internet Explorer, Win32API cryptographic features, Windows Troubleshooting, Microsoft Teams (patched), and Process Hacker 2 (patched in v3). The research highlights the exploitation of legitimate Windows resources for persistence and compares these methods with traditional techniques employed by APT groups and ransomware authors.

Inside operational systems (OT), industrial devices communicating over IP could use a wide range of field-specific, manufacturer-dependent or association-promoted industrial network protocols. To understand each other, they sometimes require an additional component as a gateway to make the translation between protocols. These nearly invisible devices play a crucial role in the industrial process: if the translation stops, the communication stops and possibly operations as well. From an attacker's perspective, this means that targeting them may have significant consequences. With this in mind, I assessed the security of a gateway model I often encounter during penetration tests on OT and I discovered several vulnerabilities that have been reported to the manufacturer. Months later, I would like to discuss the many concerns raised by the vulnerabilities themselves and the disclosure process. This tells us a lot about the current situation, issues and threats faced by such gateways, how they are and can be addressed, and what it means for OT cybersecurity.

This talk, "In-Depth Study of Linux Rootkits," will provide a comprehensive examination of the evolution of Linux rootkits, from their inception to the sophisticated variants seen today. Participants will gain insights into advanced rootkit techniques, effective detection strategies, and the future landscape for defenders. By exploring the historical context, current methodologies, and emerging threats, attendees will be equipped with the knowledge and tools necessary to safeguard Linux systems against rootkit attacks.

Honeypots are invaluable tools for monitoring internet-wide scans and understanding attackers' techniques. Traditional low-interaction web honeypots use manual methods to emulate various applications or vulnerabilities. Introducing Galah, an LLM-powered web honeypot that mimics diverse applications with a single prompt. This honeypot dynamically crafts relevant HTTP responses, including headers and body content, to various HTTP requests, effectively simulating multiple web applications. In this talk, I will share lessons learned from building and deploying Galah and address two key questions: How do different large language models perform in generating HTTP messages? Does delivering authentic-looking HTTP responses increase attackers’ engagement with the honeypot?

Discussing a ransomware sample that contains inherent flaws in its cryptographic design. Although well-established cryptographic primitives are used (like AES), they are used in a flawed way and introduce vulnerabilities that when exploited, lead to the decryption of ransomed files without knowing the encryption password and/or key.

How to become an Incident Response Rockstar?

After conducting hundreds of Incident Response cases, more data is not always better. Focusing on the most relevant forensic data can speed up the investigation process rapidly. In this talk, we will discuss the importance of various event logs to track down lateral movement paths from the attackers, how to find planted (and seemingly legitimate) backdoors, and how you can work smarter, not harder – which also holds true in digital forensics.

As a bonus, we will discuss less-known artifacts like MPLogs and the bitmap cache.
By attending this talk, participants will be better and more efficient Incident Responders as they can focus on key aspects of an investigation.

After this talk, the audience understands the top artifacts evaluated in every incident response case. For example, we will discuss a variety of event logs, starting from the classic Security event logs to the Remote Desktop event logs, to Amcache, Shimcache, Prefetch files, and more.

This discussion will lay the groundwork for how we approach large-scale incident response investigations, how we can track down remote access tools installed by attackers as legitimate backdoors, or how to spot new and unusual services within the environment in no time.

As one must work smarter, not harder, we extensively use the Velociraptor artifact DetectRaptor from Matt Green, which works for Rapid7 now. This Velociraptor hunts will find evil within minutes, allowing the Incident Responders responsible for the investigation to concentrate on other aspects of the case or to dig deeper into the hosts where the detections occurred.

At the end of the presentation, we will discuss lesser-known artifacts like the Defender MPLogs, which can be a goldmine, the bitmap cache, or the SRUM database.

Hacking humans with IoT? It is happening now and will only scale. The rapid evolution of AI technologies, mass development and production of IoT equipment which is interconnected and can be orchestrated on backend by massive AI platforms which are sourcing, processing and cross-correlating personal and sensitive data completely changes human vs computer paradigm. No chip implant is needed to control a human, unlike it may be commonly believed. As long as enough biometric and behavioral information is collected on human beings, they and their social contacts can be completely manipulated in predictable manner. The environment of connected society is a perfect stage, where the humans are exposing their harvestable biometric and behavior profiles, by publishing content in social media or giving up the IoT devices around the things which they are reluctant to share with their closest friends. This is the new battle ground where our digital identities are appearing and exposing our strengths and weaknesses at the same time. Those identities can be created, stolen, or replicated without our consent by criminals and state sponsored actors, appear in the places we are not aware, and leveraged to target our digital presence and physical life.

By connecting the dots between generative AI, predatory advertisement companies, biometric data harvesting and Human - IoT interactions – we demonstrate the significant expansion of the attack surface against humans and social groups. Disinformation, public opinion manipulation, virtual kidnapping, exploitation of human digital identities are the fruits of the same tree. The data collected and processed in the IoT based smart environments is a gold mine for criminals and state sponsored actors to manipulate humans the way and at the scale which was impossible before.

The presentation is focusing on the attack scenarios and case studies of targeted individuals, social groups that we either have observed or to observe in the wild, including election campaigns in social media, assets take over, extortion. The consequences of attacks lead to behavior changes and actions in both, physical and digital world including changing the decisions, social engineering, exfiltration of sensitive information, choosing most vulnerable targets to attack high security environments, swaying opinions, affecting elections and other critical events, that may change the history. We will also cover both, defense options and choke points related to the expanded attack surface.

The Heist: get your hands on the goods!

In this talk, we'll dive into KubeHound, a Tool for building Kubernetes attack paths. We will present the genesis of the project and what answers regarding your Kubernetes cluster security it might bring to you. We will cover how KubeHound bring you offensive mindset on a silver platter because we think the best defense is a good offense. Live demos of KubeHound from the defender’s and attacker’s point of view will be performed during the talk.

In an era where cognitive warfare has become a pivotal battleground, the strategic manipulation of information to influence public perception and decision-making processes poses significant threats to global security and stability. This multifaceted domain exploits digital interconnectedness, leveraging psychological vulnerabilities and technological platforms to achieve its objectives. The complexity of cognitive warfare necessitates advanced strategies that incorporate cyber threat hunting, open-source intelligence (OSINT), and ethical hacking. These methodologies are critical in identifying, understanding, and mitigating the sophisticated tactics employed by adversaries in the digital landscape.

Many Chrome exploits can lead to execution of remote code and most of these exploits started out with a vulnerability in V8. So, many Experts dive into bug bounty to find potentially exploitable vulnerabilities. But, there is a significant lack of publicly available analysis guides for beginners to start, and it is challenging to analyze the technical meanings using only documents.

We will share the detailed steps needed for beginners who have yet to experience about V8 exploits. First, we describe the detailed structure (memory, object, etc.) and mechanism. Furthermore, we explore bugs via d8 debugger and explain step-by-step how to write exploit code.

The audience will have the opportunity to learn and experience V8 exploit techniques by not only studying the theory but also analyzing the V8 engine through hands-on training. The hands-on training will be conducted through our VDI environment, therefore the audience can access and enjoy it freely with their personal laptops without setting up a practice environment.
※ The audience will be able to enjoy interesting and valuable training in a comfortable practice environment.

We hope that this workshop will encourage many beginners to dive into V8 vulnerability research.

Software Reverse-Engineering (SRE) is often considered black magic, but with the right tools and knowledge, its processes can be significantly accelerated. Unicorn Engine is a powerful framework that allows you to execute code platform-independently, which can greatly enhance your SRE skills. Why not learn it?

Passwords have long been a foundational element of cybersecurity, but they remain vulnerable to various attacks aimed at acquiring user credentials. Password management software (PM) has emerged as a key defense, yet misconfigurations and user errors can still result in data leaks. This presentation introduces a new red teaming tool, Pandora, capable of extracting credentials from 18 popular PM implementations, including desktop applications, browsers, and browser plugins. Pandora requires the PM to be active to dump its processes and analyzing them for user credentials. Although this vulnerability is not new, Pandora represents the first public tool to exploit it, emphasizing the need for the pentesting community to advocate for stronger protections from vendors to secure user credentials. Additionally, only two vendors have acknowledged the problem, with one CVE ID (CVE-2023-23349) reserved for Kaspersky.

MISP Kickstart provides a comprehensive introduction to the popular Open Source Threat Intelligence and Sharing Platform, "MISP."
The course will establish a foundational understanding of the practical applications of MISP in cyber threat intelligence.
This course follows a real-world scenario where participants will set up a local MISP instance, configure an organisation and users, and create events and information based on the threat profile of an organisation and its industry vertical. Participants will develop an understanding of the common use cases for MISP, learn how to set up and manage sharing communities, select relevant threat feeds (and also not what to turn on) and see how MISP automation workflows can be utilised.

The Heist: get your hands on the goods!

In the dynamic landscape of cybersecurity, continuous skill development is paramount. This presentation, titled "Empowering Cybersecurity Outreach and Learning through Collaborative Challenge Building, Sharing, and Execution," delves into innovative approaches to enhance outreach and learning in the field.

Focused on the creation, sharing, and execution of challenges, particularly through platforms like Capture The Flag (CTF), the session aims to illustrate the transformative impact of hands-on experiences with the FIRST.org challenges.

The discussion will also outline how it has grown, offering a wide variety of knowledge fields and strong collaboration between the volunteers and their supporting organisation.

How to scan more than 500 thousand domains and subdomains and identify almost 300 thousand vulnerabilities and misconfigurations, ranging from minor (lack of proper SSL or DMARC configuration), to critical (SQL Injections or RCEs)?

This talk gives a practical overview and introduction of the Spicy parser generator for protocols and file formats.

Join us for an immersive hands-on workshop where we'll dive into KubeHound, a Tool for building Kubernetes attack paths. Participants will play the role of an attacker, but we think the best defense is a good offense. With concrete scenarios and a live environment, attendees will learn to leverage KubHound to identify attack paths in Kubernetes clusters at scale with no hustle.

Malware Development and Persistence Techniques.
The course will teach you how to develop malware, including classic tricks and tricks of modern ransomware found in the wild. Everything is supported by real examples.
The course is intended for Red Team specialists to learn in more detail the tricks of malware development (also persistence and AV bypass) and will also be useful to Blue Team specialists when conducting investigations and analyzing malware.

The course is divided into four logical sections:
- Malware development tricks and techniques (classic injection tricks, DLL injection tricks, shellcode running)
- AV evasion tricks (Anti-VM, Anti-Sandbox, Anti-disassembling)
- Persistence techniques
- Cryptographic functions in malware development (exclusive)

This talk provides an extensive overview of security challenges in satellite systems. It covers vulnerabilities across space, ground, link, and user segments, using real-world examples in the past security research and the Viasat incident. By analyzing various attack methods from software vulnerabilities to radio frequency interference, this talk offers crucial insights for protecting current satellite infrastructures and anticipating future security challenges in the rapidly evolving field of satellite technology.In addition, the open community cubesat projects are growing.Vulnerabilities in these projects could also be a new threat.There will be 1 case study and new found vulnerabilities sharing for open project and a special case study of ground-station system in this talk.

The Heist: get your hands on the goods!

With OpenTIDE the Threat-Informed Detection Engineering framework, Cyber Threat Intelligence and Detection Engineering teams can work together to model the threat vectors (aka attack scenarios) in a structured, actionable and automation-ready object which become at the centre of a knowledge graph. With that framework, Cyber Threat Intelligence teams can prioritise to expand the threat detection coverage while the Detection Engineering teams can measure and report on the current threat coverage

CTI practitioners have threat intelligence databases; what about digital forensics practitioners? How can they organize knowledge and ensure that investigations are carried out in a repeatable manner? In the same way that threat intelligence describes attackers, capabilities, and infrastructure, Digital Forensics Intelligence describes the relationship between systems, questions, and investigation techniques.

Enter DFIQ (Digital Forensics Investigative Questions; https://dfiq.org/): a framework used to model scenarios, questions and approaches in digital forensics investigations. This talk will take a deeper dive into the DFIQ model, and more importantly the different ways it is practically used to facilitate forensic investigators' day-to-day activities, ensure repeatable conclusions of investigations, and knowledge sharing among analysts. We'll discuss how DFIQ is stored in Yeti, used in Timesketch, and can be used to leverage end-to-end collection and analysis workflows to accelerate and structure investigations in large enterprise environments.

This paper examines Intelligent Connected Vehicles (ICVs) by focusing on their architecture, capabilities, and security vulnerabilities.

In May 2024, the NATO publicly condemned cyber espionage operations carried out by a Russian state-sponsored group against targets in Germany and Czechia. We track this group as ITG05 sharing overlaps with APT28, UAC-0028, Forest Blizzard and Fancy Bear. In addition to Germany and Czechia, a large number of NATO member states as well as the Ukraine have been subject to long-term intelligence gathering missions executed by ITG05. ITG05 is also linked to the hack of the German Bundestag in 2015 as well as the attacks targeting the 2016 US presidential elections.

There was time when computer security was not a thing. A time blessed by wannabe hackers when sensitive facilities were just wide open because, seriously, who would really attempt to hack into a research or a leading industry system ? This was a long time ago... or was it ? What if I tell you there is a whole branch of information security which still happily lives in this stone-age ?

Since the war(s) broke loose last years, a lot has been said about cyberwarfare, attacks on critical infrastructure, ICS/OT vulnerabilities, you name it. In this talk, we are going to talk about a specific set of ICS: Automated Tank Gauging (ATG) systems. These systems control the safe storage and management of fuel in critical infrastructures like gas stations, military bases, airports and hospitals.
We will discuss multiple (10) zero-day vulnerabilities that expose these systems to catastrophic risks, from environmental hazards to significant economic losses. Despite past warnings, thousands of ATG systems remain online, unprotected, and vulnerable to exploitation.
This track will talk about past ATG research, the new vulnerabilities found and their technical details, demonstrating how they can be exploited to gain unauthorized control over ATG systems. In the end, we will dive into our quest to cause physical damage remotely, in hopes of blowing up (our) gas station.

The application of Natural Language Processing (NLP) has become increasingly vital for cybersecurity threat intelligence and response strategies today. NLP plays a crucial role by enabling more accurate and nuanced analyses of potential threats through linguistic techniques. Among other applications, NLP allows quicker categorization of threats based on their nature – such as phishing schemes or anomalous behaviors – and enables prioritizing responses accordingly. NLP can also facilitate the development of content prediction schemes for analysts or provide powerful information extraction tools. We will cover two text-mining techniques that we believe are a good starting point with NLP for analysts and incident responders: sentiment analysis and Named Entity Recognition (NER). While sentiment analysis reveals underlying emotions or biases in social media content potentially linked to malicious activities, NER identifies critical information such as IP addresses, domains, and user details essential for correlating incidents across different data sources.

Flutter is an open-source UI software development kit with the ability to create applications for Android, iOS, and non-mobile platforms using a single codebase. The performance aspect is handled by using ahead-of-time (AOT) native compilation in release builds.

In terms of reverse engineering, Flutter is particularly difficult to tackle because disassemblers do not support its custom binary format, registers and representation of integers.

In this workshop, we will:

• Learn how to reverse Flutter applications
• Learn how to use Blutter and understand its output
• Load symbols in Radare2 to parse the binary more easily
• Patch a game with a native Frida hook to reveal an Easter Egg

The Heist: get your hands on the goods!

The good: There's an insider working at your competition, helping you.
The bad: There's also an insider working at your business, helping the competition.
The ugly: It's Microsoft Copilot.

The race to capture the benefits of GenAI is already at full speed, and everybody is diving head-first into putting corporate data and operations in the hands of AI. The concept of a Copilot has emerged as a way to keep AI tamed and under control. However, while employees rarely cross the lines and become rogue, it turns out that Microsoft Copilot is rogue by design.

In this talk, we will show how your Copilot Studio bots can easily be used to exfiltrate sensitive enterprise data circumventing existing controls like DLP. We will show how a combination of insecure defaults, over permissive plugins and wishful design thinking makes data leakage probable, not just possible. We will analyze how Copilot Studio puts enterprise data and operations in the hands of GenAI, and expose how this exacerbates the prompt injection attack surface, leading to material impact on integrity and confidentiality.

Next, we will drop CopilotHunter, a recon and exploitation tool that scans for publicly accessible Copilots and uses fuzzing and GenAI to abuse them to extract sensitive enterprise data. We will share our findings targeting thousands of accessible bots, revealing sensitive data and corporate credentials.

Finally, we will offer a path forward by sharing concrete configurations and mistakes to avoid on Microsoft’s platform, and generalized insights on how to build secure and reliable Copilots.

In 2022, an insider from one of the scammers' groups switched sides and shared details about the ongoing attacks. This kicked off a multi-year analysis of the underground economy that provides a range of illicit Telegram-based services to facilitate shady activities, offering everything from data breaches and identity theft to financial fraud. The talk will explore how fraudsters leverage platforms' features to launch "Scam as a Service" operations.

Phishing has evolved both in the TTPs of attackers, and their targets. From simple clones of a website trying to get a username/password to reverse-proxying systems that steal sessions even with MFA, the target landscape has changed. Many of the defenses against phishing are started to show their age, between block-lists for domains that appear to be illegitimate, SMS/push MFA, and broken functionality cues that may alert someone to the site not being correct. Modern phishing tools, like EvilGinx, Modlishka, and more handle all of these by hiding the phishing content behind a unique "lure" to avoid domain blocking, supporting SMS/push MFA, and seamlessly allowing for login and hand-over once the session has been stolen.

This talk is focused on a Canarytoken type that lets you protect a shared-responsibility platforms that are difficult to gain insight into. These include Azure Entra ID, LogTo, and custom sites. The Cloned Site Canarytoken lets you quickly get alerted if someone is mirroring or reverse-proxying a sensitive login page that has any of your users trying to login--you can get alerted about the phishing site's URL before the user has even entered their password!

After a view of the landscape of modern phishing techniques, defenses, we'll dive into our novel defenses, and look at the data of token alerts from millions of logins every day to build a view of real-world phishing attacks and their TTPs. We'll finish off with how to respond to alerts, and some attacks against our Canarytoken. Finally we'll discuss our mental model for sharing this information via networks like MISP.

Let's be honest: cryptography is hard. Luckily, plenty of great cryptographers in the past 70 years did the heavy lifting for us. So our goal here will be to understand how we can use the most common cryptographic algorithms properly, which one to use depending on the context, the common pitfalls and how to avoid them.

Suricata is a widely-used high performance, open source network analysis and threat detection software. This training will provide hands-on learning for different techniques using Suricata protocol analysis data for generating useful and actionable algorithmic and signature detection.

As quantum computing advances, it presents unique cybersecurity challenges that existing digital security systems are inadequately equipped to handle. This talk explores the realm of quantum cybersecurity, focusing on quantum key distribution (QKD) and post-quantum cryptography (PQC) as essential tools to secure communications against the formidable computational power of quantum computers. We will explore the advantages of these technologies, their necessity in the modern cybersecurity landscape, current interoperability issues between different quantum cryptographic systems, and propose potential solutions to these challenges. The session aims to highlight the future directions of quantum cybersecurity and the ongoing efforts to standardise and enhance the security protocols to address these emerging threats effectively.

At CERT PL we periodically scan 500 thousands of domains and subdomains and automatically report found vulnerabilities and misconfigurations using the Artemis scanner (https://github.com/CERT-Polska/Artemis). Are you e.g. a CSIRT, hosting provider, or an university network administrator and want to set up a similar project?

The Heist: get your hands on the goods!

We are surrounded, in our daily life, with devices that have a strong link with cloud infrastructure. Those devices, while still completely operational, can become a useless piece of hardware if the vendor stop the infrastructure for any reason.

This aims at discussing how to give a second life to such devices using the practical use case of the EV chargers of the Belgian company PowerDale which went on bankrupt in July 2023.

We will discuss the successes and failures of our journey, how a community of enthusiasts manages to build workarounds and what could be our community contribution.

Stack smashing has become very different in the 21st century. Binary hardening
mechanisms used by default by all modern OSes make it nearly impossible to
exploit trivial buffer overflows. Since 1996, machines have evolved
significantly and you cannot even follow the original "Smashing the stack
[...]" tutorial by Aleph One on a modern computer.

Yet, there are other kinds of machines that are lacking all the binary
hardening we now take for granted. Because of that, they are ideal "target
practice" material for those who wish to learn about exploiting stack-based
buffer overflows or use them for causing real damage. Too bad these
machines "sit" on the edge of home and enterprise networks, often being the
only barrier between that the attackers need to overcome for a complete PWN.

In this talk I will demonstrate how we could smash the stack of two networking
devices from two different vendors (a wireless gateway, and a high-throughput
VPN concentrator), allowing for unauthenticated root access. I will also
present the vulnerability root-cause analysis and offer insights on why such
attacks are still viable in 2024.

SQL injections seem to be a solved problem; databases have built-in support for prepared statements, leaving no room for injections. In this session, we will go a level deeper: instead of attacking the query syntax, we will explore smuggling attacks against database wire protocols, through which remote, unauthenticated attackers can inject entire (No)SQL statements into an application's database connection.

Software Development Kits (SDKs) allow developers to significantly enhance the functionality and performance of their apps, among other benefits, without writing complex code. By importing SDKs, developers can save time and money, access various services and APIs, and achieve compatibility and integration across different platforms, devices and operating systems. When it comes to app monetization, advertisement SDKs are a common way of generating revenue from apps, especially freeware that rely on in-app purchase or subscription.

However, there are also downsides associated with using code from external sources, such as security breaches, data leaks, or malicious attacks and perhaps one of the most effective ways to safeguard an app from such a threat is to perform some type of security audit. Mobile apps though pose a challenge for code review, as they can use webviews to dynamically change their behavior and execute arbitrary code from remote sources, bypassing the security audit of the app.

In this training, trainees deal with BGP hijacking, which involves redirecting internet traffic by manipulating the Border Gateway Protocol. It covers the impact, training details, data sources, and notable BGP hijacking incidents. These incidents include the involvement of the Italian Hacking Team, Amazon DNS, China Telecom, and a recent incident at KlaySwap in South Korea.
This hands-on training session will use fully open-source-based intelligence and command-line analysis tools to identify and visualize BGP hijacking incidents in any network. After this training, trainees will be equipped with new skills to detect BGP hijacking when suspicious phenomena occur.

The Heist: get your hands on the goods!

Are you, or your organisation, concerned about potential compromise on your iPhone, iPad, or Apple Watch? This workshop equips you with the knowledge and tools to identify red flags on your iOS device. We delve into the world of sysdiagnose and explore methods to verify potential breaches.

Yara, LibMagic (file, binwalk, polyfile), TrID, Yara, Magika, PeID, Pronom, FDD, ShareMime, DiE...
How do they work? What are their pros and cons, their limitations, their risks?

Infostealers are a type of malware designed to secretly collect sensitive information from infected devices. They create stealer logs with valuable data such as login credentials. These malware communicate with Command-and-Control (C2) servers, which direct their actions and receive the stolen data. These stolen logs are highly valuable, forming the basis of a profitable underground market where cybercriminals sell and trade this information.
But what if C2 operators also fell victim to their own skim : the biter bit. In this presentation, we will dive into stealer logs of C2 operators, who have infected themselves accidentally with infostealer malware, to uncover hidden C2 infrastructure and their backstage. Join us as we expose the unexpected vulnerabilities within the cyber underworld.

On the 16th October 2023 Cisco Talos shared intelligence about a handful of compromised routers discovered while resolving customer support requests. As the full story unfolded, a handful of backdoored devices turned into tens of thousands, and the massive mobilisation of incident response teams as patches were applied and workarounds implemented. Many months later, the incident may be largely forgotten by Cisco customers and the cyber-security community, but working on these routers remains an objective for somebody.

This talk provides a tour of new features in the open-source Zeek network monitor that have landed in the past year: scriptability via JavaScript, performance improvements to its scripting language via a new abstract language machine, analyzer development via the Spicy parser generator, a revamped telemetry framework for scraping via Prometheus, and more!

The Heist: get your hands on the goods!

In this 2 hour workshop, Didier will guide you through XOR Cryptanalysis exercises using several open source tools (several of these tools are created and maintained by Didier).

Zeek is an open-source network security monitor (NSM) and analytics platform that has been around for quite some time (since the mid-90s). It is used at large university campuses and research labs, but in the past few years, more and more security professionals in the industry have turned their attention to this fantastic tool.

Sigma is a well-known generic detection rule format in the cybersecurity landscape. While this free, open-source project is very active and offers a wide range of features, its implementation is challenging, and especially for MSSPs. At CERT-EU, we serve the 90 European Union institutions, bodies, offices and agencies (Union entities) and we strive to deliver the best possible services to them. This is why we relentlessly try to enhance the detection capabilities of our Security Log Monitoring Service.

To this endeavour, we created droid, a tool that we specifically built to introduce Detection-as-Code in our environment. In the spirit of fostering a culture of collective progress, we released droid as our take to facilitate the ingestion of Sigma rules for any organisation.

In this presentation, Tristan Madani will delve into "Predictive Analytics for Adversary Techniques in the MITRE ATT&CK Framework using Rule Mining." This talk introduces a novel approach to predicting potential adversary techniques by leveraging historical attack data and applying association rule mining. Attendees will gain insights into how the MITRE ATT&CK framework can be utilized to enhance threat hunting and incident response capabilities. Key takeaways include understanding the methodology behind rule mining, the practical application of the Apriori and FP-Growth algorithms, and the implications of the findings for proactive cybersecurity measures. This presentation is essential for cybersecurity professionals looking to stay ahead of evolving threats by anticipating adversary actions.

This workshop will introduce attendees to the world of firmware analysis. It will discuss only structured firmwares---i.e. firmware containing a file system---by opposition to monolithic firmwares also known as baremetal firmwares. Students will discover two major steps of this analysis workflow which are also the most firmware specific ones: extraction of the filesystem and its cartography. Various open-source tools will be introduced, including two developed by Quarkslab: Pyrrha, a mapper collection for firmware analysis, and its underlying API Numbat. Based on this latter, attendees will be able to develop their own cartography tools with a nice UI. All along this workshop, a strong focus will be made on the tasks that could be automated by some existing or future tools but also on the limits of this automatization.

The proliferation of new Top-Level Domains (TLDs) has sparked security concerns primarily around phishing and social engineering attacks. However, the emergence of these new TLDs has broadened the attack surface, making it easier for threat actors to exploit other domain-related vulnerabilities. Our research explored another critical but often overlooked vulnerability: Internal Domain Name Collision.

The Heist: get your hands on the goods!

Zeek is an open-source network security monitor (NSM) and analytics platform that has been around for quite some time (since the mid-90s). It is used at large university campuses and research labs, but in the past few years, more and more security professionals in the industry have turned their attention to this fantastic tool.

But Zeek is so much more than just a NIDS generating alerts (notices) and log files! Zeek's scripting language allows security analysts to perform arbitrary analysis tasks such as extracting files from sessions, detecting brute-force attacks, or, most importantly, interfacing with external sources, such as Python! The Zeek Python bindings allow us, the analysts, to use powerful Python libraries such as Numpy, Pandas, and Tensorflow and apply machine learning-based detection on network traffic.

During this two-hour workshop, we will learn about the following topics:
- Super fast introduction to Zeek (architecture, events, logs, signatures, etc.)
- Using machine learning and data science tools on Zeek logs (as an example, we will use Fourier Analysis to detect C2 beaconing)
- Super fast crash course in Zeek scripting (just enough to understand how to create new logs)
- Connecting Zeek and Python via the Zeek Broker Communication Framework
- Using machine learning tools in Python on the data we receive from Zeek for detection (as an example, we will use convolutional neural network and random forest models to compare them, and then use them to find unknown malware in live network traffic)

Requirements for the workshop:
- A laptop with at least 16 GB of RAM and more than 50 GB of free disk space (VT-x support must be enabled on the host system).
- Application to run Virtual Images (type-2 hypervisor): VMWare Workstation Pro (recommended), VMWare Workstation Player, VMWare Fusion, or VirtualBox.
- Only 64-bit Intel-compatible (Intel or AMD) processors are supported. WARNING: ARM-based (like Apple Silicon, Qualcomm Snapdragon, some Microsoft Surface laptops) devices cannot perform the necessary virtualization and therefore cannot be used for the workshop.

The Kroll Cyber Threat Intelligence (CTI) team discovered new malware resembling the VBScript based BABYSHARK malware that we've called TODDLERSHARK.

The malware was used in post-compromise activity following exploitation of two vulnerabilities in ScreenConnect, which were responsibly disclosed by a Kroll analyst but quickly weaponised after detail of the vulnerability was published.

BABYSHARK has been associated, by several sources, with a threat actor Kroll tracks as KTA082 (Kimsuky).

The malware utilized legitimate Microsoft binary and alternate data streams and exhibited elements of polymorphic behavior.

This talk will detail how the exploits work, how Kimsuky was able to quickly operationalize a n-day vulnerability, a teardown of TODDLERSHARK and how simple detection methods were able to stop an APT group.

ACVTool is a sophisticated bytecode instrumentation tool designed for highlighting instruction coverage in Android apps. In 2024, ACVTool received a major update unlocking smali coverage analysis for modern complex Android apps. Now, ACVTool supports Multidex and Multi-APK applications of any size. Secondly, ACVTool can highlight a particular feature, e.g. to see the code actually executed when tapping a button. To further depict selected app behavior, ACVTool may partially shrink not executed code. ACVTool works on 3rd-party Android without source code, and it does not require a rooted device.

For defending Windows, EDR software is the simple, easy path. On Linux – not so much. Since products are designed and developed for Windows, they lack important capabilities on other platforms. We chose a different path.

Computer attacks are becoming increasingly sophisticated and occur in a rapidly evolving environment. To effectively address these challenges, organizations need a comprehensive understanding of their information systems. Achieving this requires implementing a detailed map of the Information System.

In 2023, the gaming industry reached a worldwide revenue of US$384.9 billion. Yet, this industry is facing a growing number of cheating actors and techniques.

We introduce new attacks targeting multiplayer games based on Unreal Engine such as Fortnite, PUBG, Valorant... These attacks disconnect a player from an ongoing game session against his will. Cheaters can launch it as a Denial-of-Service against opponents with very few packets (sometimes only one). In most cases, the attacker can steal the victory from the target without exposing himself as a cheater.

It is important to understand that these attacks do not exist because of a vulnerability or an implementation error. They are conscious design choices, dictated by the constraints inherent to a widely distributed multiplayer game. Mitigating these attacks is thus not trivial.

This talk shows how such issues present in a single game engine can spread widely, across several games produced by different editors. It is quite probable that other game engines, such as Unity, are not immune to these issues. However, this presentation solely focuses on the Unreal Engine whose source code is available. We present our analysis of the design and implementation choices made within the Unreal Engine. We explain how to exploit the protocols used. We cover and discuss how to defeat some common countermeasures used on the Internet against IP spoofing, such as Source Address Validation. We mention some mitigation strategies for video game developers. We show videos of these attacks against real popular games.