Anastasiia Vixentael – Encryption basics [NoName CyberKids]

•

0 likes•224 views

Originally published https://speakerdeck.com/vixentael/data-encryption-cyberkids-edition Exercises https://www.dropbox.com/s/rbyvvaw9c7vs4ib/cyberkids-encryption-example.pdf?dl=0 NoName CyberKids – charity event for kids and their parents during NoNameCon to teach basics of privacy, security, encryption, anti-bullying, behaviour in social networks, lock picking. https://nonamecon.org https://www.facebook.com/events/2048121308814429/

Шифрування даних
як спілкуватися з друзями так, щоб вашу
переписку було важко прочитати
@vixentael

@vixentael
займаюся
криптографією та
захистом даних

Безпека в реальному світі

Пташки Додо
Аліса Боб

Вони разом спілкуються
привіт
Аліса Боб

Приходить Єва
в неї великі вуха, вона гарно чує

Єва підслуховує
небезпека
привіт
ввімкнути радари!

але пташки ховаються —
Єва перестає їх чути
безпечне місце
нічого не чує 😭

(Не)безпека в реальному світі
проблема: Єва може почути секрети

рішення: сховайтесь/змініть місце

складніше,тому що часто ми
не можемо сховатись
Кібер-безпека

Спілкування в інтернеті
Месенжер Аліси Месенжер Боба

мій пароль: 123
Месенжер Аліси
Спілкування в інтернеті
Месенжер Боба

Єва —кібер-злочинець

Приходить Єва
мій пароль: 123

Єва перехоплює спілкування
{“пароль”:“123”}
мій пароль: 123

—це перетворення даних в інший
вигляд щоб зберегти їх в секреті
Шифрування

Дані
Тексти
Картинки
Відео / аудіо

28dhW108dh
шифрування розшифрування
мій пароль: 123 мій пароль: 123
Шифрування

Шифрування
28dhW108dhмій пароль: 123
ключ 🔑

Розшифрування
28dhW108dhмій пароль: 123
ключ 🔑

Де використовується шифрування?
Імейли (PGP)
Сайти (TLS)
Месенджери
всюди в інтернеті :)

Прості шифри

Прості (старі) шифри
Цезаря
Виженера
Лінійка Сен-Сира

Підстановка

Підстановка

Підстановка

Підстановка + зсув
зсув = 5

Підстановка + зсув
зсув = 5

Випадкова підстановка

Випадкова підстановка

Більш складні шифри

Сучасні шифри та криптосистеми
AES-256
ChaCha20
RSA / DSA

Месенджери

Які месенжери використовувати?
Signal
Telegram
Whatsapp
Wire

Вправи

Шифрування підстановкою
Шифрування випадковою підстановкою

Онлайн матеріали
https://3dnews.ru/916293
https://cryptii.com/
http://algolist.manual.ru/defence/intro.php
https://medium.com/@vixentael/how-to-start-
learning-cryptography-49e7d91b54a8

@vixentael
займаюся
криптографією та
захистом даних
бережіться!

Recommended

Help, my browser is leaking! Exploring XSLeaks attacks and defenses - Tom Van...

Help, my browser is leaking! Exploring XSLeaks attacks and defenses - Tom Van...

Help, my browser is leaking! Exploring XSLeaks attacks and defenses - Tom Van...

https://cfp.nonamecon.org/nnc2020/talk/9LMJAH/ For many years, injection-based vulnerabilities such as XSS and SQL-injection have dominated the web security landscape. However, as browsers and applications are becoming increasingly complex, new vulnerability classes surface. One of these new-kids-on-the-block is XSLeaks, a vulnerability class that exploit side-channel leaks in the browser to extract information across origins. In this presentation, I will describe the various types of leaks in different browser features and the network layer, and discuss how these issues can be exploited to extract sensitive information from an unwitting victim. Furthermore, the talk will cover the numerous (new) defences that need to be adopted in order to safeguard web applications (SameSite cookies, COOP, COEP, ...), and their potential shortcomings. Finally, we will take a peak into the future, and discuss how XSLeaks will likely evolve in the coming months and years.

Ihor Malchenyuk – What is privacy and how to protect it [NoName CyberKids]

Ihor Malchenyuk – What is privacy and how to protect it [NoName CyberKids]

Ihor Malchenyuk – What is privacy and how to protect it [NoName CyberKids]

Olha Pasko - Hunting fileless malware [workshop]

Olha Pasko - Hunting fileless malware [workshop]

Olha Pasko - Hunting fileless malware [workshop]

Original slides https://www.slideshare.net/OlgaPasko/hunting-fileless-malware-149129867 Workshop by Olha Pasko at NoNameCon 2019. https://nonamecon.org Fileless malware and system tools as bypass techniques in cyber-attack. Hunting with SysInternals tools and Digital Forensics techniques. 1. Fileless malware and system tools as bypass technique: an explanation of “bypass technique” and “fileless malware”. Creating custom fileless malware by abusing Powershell. 2. Threat hunting with Sysinternals tools: an explanation of system processes, threads, jobs, resources. Anomaly detection of system processes with Sysinternals tools. Fileless malware detection. 3. Threat hunting with Digital Forensics techniques: an explanation of “digital forensics”. Acquisition and analysis of RAM memory dump with Digital Forensics tools. 4. Summary or “what can participant obtain from this workshop”: knowledge about top bypass techniques, hard skills for detection and hunting malicious code, understand differences of hunting with SysInternals and Digital Forensics tools.

Nazar Tymoshyk - Automation in modern Incident Detection & Response (IDR) pro...

Nazar Tymoshyk - Automation in modern Incident Detection & Response (IDR) pro...

Nazar Tymoshyk - Automation in modern Incident Detection & Response (IDR) pro...

Talk by Nazar Tymoshyk at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/GSRUTP/ Incident Detection & Response requires People - to Think, Tools - to provide data and analytics and Processes - to avoid fuckups and assure the quality. But with more alerts, the analysis takes more time, decisions and moreover - actions need to be taken immediately. Attackers actively use automation, so Defenders should also optimize their processes. In our presentation, we'd like to share with the community our lessons learned. Our focus would be on practical moments, the challenges we faced and the simple working solutions we discovered. We plan to challenge the audience with simple but vital questions that will help to establish a good communication bridge to make this delivery effective and valuable for engineers to improve their defense. We'd like to discuss also a variety of actions to be taken after the incident is confirmed. Come and take it.

Ruslan Kiyanchuk - Калина, Купина, та інша флора вітчизняної криптографії

Ruslan Kiyanchuk - Калина, Купина, та інша флора вітчизняної криптографії

Ruslan Kiyanchuk - Калина, Купина, та інша флора вітчизняної криптографії

Talk by Ruslan Kiyanchuk at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/NKB9UF/ Огляд українських криптографічних алгоритмів та стандартів З метою замінити застарілий радянський стандарт шифрування ГОСТ 28147-89 успадкований багатьма країнами СНД, у 2006-му році Служба Безпеки України оголосила відкритий конкурс криптографічних алгоритмів. Знадобилося 8 років розробки, бюрократії, Майдан та революція, щоб стандарт нарешті прийняли: і ось у 2015-му році світ побачили ДСТУ 7624:2014 та ДСТУ 7564:2014 — українські національні стандарти криптографічного захисту інформації, розроблені українськими криптографами. Стандартизованими алгоритмами стали блоковий шифр «Калина» та функція хешування «Купина». У доповіді розглянемо умови та хід проведення конкурсу, криптоалгоритми, котрі брали участь у конкурсі, їхні властивості, переваги та недоліки, а також перспективи застосування у сучасних інформаційних системах.

Artem Storozhuk - Search over encrypted records: from academic dreams to prod...

Artem Storozhuk - Search over encrypted records: from academic dreams to prod...

Artem Storozhuk - Search over encrypted records: from academic dreams to prod...

Talk by Artem Storozhuk at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/NUMHDY/ The search over encrypted data is the modern cryptographic engineering problem. We will talk about existing approaches (both well-known and modern), and concentrate on practical solution based on blind index technique to search data in databases. What’s inside: cryptographic and functional schemes, implementation details, practical security evaluation (risk modelling and potential attacks). We will show how theoretical models turn into real, usable, maintainable, security tools. Lately most conscious companies store data in databases encrypted, but search over encrypted data is still a challenge. There are many existing academic solutions, proposed over the course of years, like CryptDB, Homomorphic/SSE, PEKS, Mylar. Unfortunately, most approaches are far from being production ready, usable and maintainable. We will show the practical solution, that is based on a hardened version of blind indexing, a long-known technique that has several usability constraints and security caveats. There is an open source implementation CipherSweet, and cryptographically it’s pretty solid, but it stores keys on a client side, which may lead to potential problems during usage. Our solution doesn't share this design approach, since the generation of index references and keys to them are stored in a separate node, away from all untrusted sides (client application, backend application, database). Also, our solution enforces several limitations on data, which is going to limit collision risks mentioned in the original technique. We will explain in details how it works, show the functional and cryptographic schemes, and dig into implementation details. We will show to the attendees the process of building complex security tool from theoretical concepts (and mathematical models) to production-ready software.

Stephanie Vanroelen - Mobile Anti-Virus apps exposed

Stephanie Vanroelen - Mobile Anti-Virus apps exposed

Stephanie Vanroelen - Mobile Anti-Virus apps exposed

Talk by Stephanie Vanroelen at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/ZFJFW8/ This talk is about top anti-virus apps on Mobile. An in depth look on how they work and what they do. Do they add to or break the security of the mobile OS? This talk is about top anti-virus apps on Android. An in-depth look at how they work and what they do. The focus will be on the top 5 android apps: Kaspersky Mobile Antivirus Avast Mobile Security Norton Security & Antivirus Sophos Mobile Security Security Master This talk will try to answer the following questions: Do they add to or break the security of the Android sandbox system? What type of information is being shared back to the company (if any)? Are these apps well built? Finally, I will address the following: Do I recommend any of these apps and if so which one and why?

Oksana Safronova - Will you detect it or not? How to check if security team i...

Oksana Safronova - Will you detect it or not? How to check if security team i...

Oksana Safronova - Will you detect it or not? How to check if security team i...

Talk by Oksana Safronova at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/AXCDXU/ Before the real incident happens, security team must test their detection capabilities in different ways. An overview of MITRE ATT&CK Matrix, test environments and other friends of Blue Team. Obstacles, unexpected discoveries, lack of information, a flood of logs, new technologies - you will meet them all if you want to build an effective defense team. The talk will expend the next topics based on the experience we have: How to test the security team's detection and incident response processes Best practices for endpoint monitoring tools configuration Some problems, that defense team can encounter Additional resources that can help you detect threats

Recommended

Help, my browser is leaking! Exploring XSLeaks attacks and defenses - Tom Van...

Help, my browser is leaking! Exploring XSLeaks attacks and defenses - Tom Van...

Help, my browser is leaking! Exploring XSLeaks attacks and defenses - Tom Van...

https://cfp.nonamecon.org/nnc2020/talk/9LMJAH/ For many years, injection-based vulnerabilities such as XSS and SQL-injection have dominated the web security landscape. However, as browsers and applications are becoming increasingly complex, new vulnerability classes surface. One of these new-kids-on-the-block is XSLeaks, a vulnerability class that exploit side-channel leaks in the browser to extract information across origins. In this presentation, I will describe the various types of leaks in different browser features and the network layer, and discuss how these issues can be exploited to extract sensitive information from an unwitting victim. Furthermore, the talk will cover the numerous (new) defences that need to be adopted in order to safeguard web applications (SameSite cookies, COOP, COEP, ...), and their potential shortcomings. Finally, we will take a peak into the future, and discuss how XSLeaks will likely evolve in the coming months and years.

Ihor Malchenyuk – What is privacy and how to protect it [NoName CyberKids]

Ihor Malchenyuk – What is privacy and how to protect it [NoName CyberKids]

Ihor Malchenyuk – What is privacy and how to protect it [NoName CyberKids]

Olha Pasko - Hunting fileless malware [workshop]

Olha Pasko - Hunting fileless malware [workshop]

Olha Pasko - Hunting fileless malware [workshop]

Original slides https://www.slideshare.net/OlgaPasko/hunting-fileless-malware-149129867 Workshop by Olha Pasko at NoNameCon 2019. https://nonamecon.org Fileless malware and system tools as bypass techniques in cyber-attack. Hunting with SysInternals tools and Digital Forensics techniques. 1. Fileless malware and system tools as bypass technique: an explanation of “bypass technique” and “fileless malware”. Creating custom fileless malware by abusing Powershell. 2. Threat hunting with Sysinternals tools: an explanation of system processes, threads, jobs, resources. Anomaly detection of system processes with Sysinternals tools. Fileless malware detection. 3. Threat hunting with Digital Forensics techniques: an explanation of “digital forensics”. Acquisition and analysis of RAM memory dump with Digital Forensics tools. 4. Summary or “what can participant obtain from this workshop”: knowledge about top bypass techniques, hard skills for detection and hunting malicious code, understand differences of hunting with SysInternals and Digital Forensics tools.

Nazar Tymoshyk - Automation in modern Incident Detection & Response (IDR) pro...

Nazar Tymoshyk - Automation in modern Incident Detection & Response (IDR) pro...

Nazar Tymoshyk - Automation in modern Incident Detection & Response (IDR) pro...

Talk by Nazar Tymoshyk at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/GSRUTP/ Incident Detection & Response requires People - to Think, Tools - to provide data and analytics and Processes - to avoid fuckups and assure the quality. But with more alerts, the analysis takes more time, decisions and moreover - actions need to be taken immediately. Attackers actively use automation, so Defenders should also optimize their processes. In our presentation, we'd like to share with the community our lessons learned. Our focus would be on practical moments, the challenges we faced and the simple working solutions we discovered. We plan to challenge the audience with simple but vital questions that will help to establish a good communication bridge to make this delivery effective and valuable for engineers to improve their defense. We'd like to discuss also a variety of actions to be taken after the incident is confirmed. Come and take it.

Ruslan Kiyanchuk - Калина, Купина, та інша флора вітчизняної криптографії

Ruslan Kiyanchuk - Калина, Купина, та інша флора вітчизняної криптографії

Ruslan Kiyanchuk - Калина, Купина, та інша флора вітчизняної криптографії

Talk by Ruslan Kiyanchuk at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/NKB9UF/ Огляд українських криптографічних алгоритмів та стандартів З метою замінити застарілий радянський стандарт шифрування ГОСТ 28147-89 успадкований багатьма країнами СНД, у 2006-му році Служба Безпеки України оголосила відкритий конкурс криптографічних алгоритмів. Знадобилося 8 років розробки, бюрократії, Майдан та революція, щоб стандарт нарешті прийняли: і ось у 2015-му році світ побачили ДСТУ 7624:2014 та ДСТУ 7564:2014 — українські національні стандарти криптографічного захисту інформації, розроблені українськими криптографами. Стандартизованими алгоритмами стали блоковий шифр «Калина» та функція хешування «Купина». У доповіді розглянемо умови та хід проведення конкурсу, криптоалгоритми, котрі брали участь у конкурсі, їхні властивості, переваги та недоліки, а також перспективи застосування у сучасних інформаційних системах.

Artem Storozhuk - Search over encrypted records: from academic dreams to prod...

Artem Storozhuk - Search over encrypted records: from academic dreams to prod...

Artem Storozhuk - Search over encrypted records: from academic dreams to prod...

Talk by Artem Storozhuk at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/NUMHDY/ The search over encrypted data is the modern cryptographic engineering problem. We will talk about existing approaches (both well-known and modern), and concentrate on practical solution based on blind index technique to search data in databases. What’s inside: cryptographic and functional schemes, implementation details, practical security evaluation (risk modelling and potential attacks). We will show how theoretical models turn into real, usable, maintainable, security tools. Lately most conscious companies store data in databases encrypted, but search over encrypted data is still a challenge. There are many existing academic solutions, proposed over the course of years, like CryptDB, Homomorphic/SSE, PEKS, Mylar. Unfortunately, most approaches are far from being production ready, usable and maintainable. We will show the practical solution, that is based on a hardened version of blind indexing, a long-known technique that has several usability constraints and security caveats. There is an open source implementation CipherSweet, and cryptographically it’s pretty solid, but it stores keys on a client side, which may lead to potential problems during usage. Our solution doesn't share this design approach, since the generation of index references and keys to them are stored in a separate node, away from all untrusted sides (client application, backend application, database). Also, our solution enforces several limitations on data, which is going to limit collision risks mentioned in the original technique. We will explain in details how it works, show the functional and cryptographic schemes, and dig into implementation details. We will show to the attendees the process of building complex security tool from theoretical concepts (and mathematical models) to production-ready software.

Stephanie Vanroelen - Mobile Anti-Virus apps exposed

Stephanie Vanroelen - Mobile Anti-Virus apps exposed

Stephanie Vanroelen - Mobile Anti-Virus apps exposed

Talk by Stephanie Vanroelen at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/ZFJFW8/ This talk is about top anti-virus apps on Mobile. An in depth look on how they work and what they do. Do they add to or break the security of the mobile OS? This talk is about top anti-virus apps on Android. An in-depth look at how they work and what they do. The focus will be on the top 5 android apps: Kaspersky Mobile Antivirus Avast Mobile Security Norton Security & Antivirus Sophos Mobile Security Security Master This talk will try to answer the following questions: Do they add to or break the security of the Android sandbox system? What type of information is being shared back to the company (if any)? Are these apps well built? Finally, I will address the following: Do I recommend any of these apps and if so which one and why?

Oksana Safronova - Will you detect it or not? How to check if security team i...

Oksana Safronova - Will you detect it or not? How to check if security team i...

Oksana Safronova - Will you detect it or not? How to check if security team i...

Talk by Oksana Safronova at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/AXCDXU/ Before the real incident happens, security team must test their detection capabilities in different ways. An overview of MITRE ATT&CK Matrix, test environments and other friends of Blue Team. Obstacles, unexpected discoveries, lack of information, a flood of logs, new technologies - you will meet them all if you want to build an effective defense team. The talk will expend the next topics based on the experience we have: How to test the security team's detection and incident response processes Best practices for endpoint monitoring tools configuration Some problems, that defense team can encounter Additional resources that can help you detect threats

Bert Heitink - 10 major steps for Cybersecurity

Bert Heitink - 10 major steps for Cybersecurity

Bert Heitink - 10 major steps for Cybersecurity

Talk by Bert Heitink at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/DXN7DM/ There's no such thing as 100% security, but this talk will demonstrate 10 main topics what needs attention to reduce the risk of being hacked. Our current digital era creates a lot of possibilities, also for Ukraine! But how to deal with the threats on business and national level? 10 pragmatic steps you cannot ignore and are indisputable. Some are easy to implement, even tomorrow.

Ievgen Kulyk - Advanced reverse engineering techniques in unpacking

Ievgen Kulyk - Advanced reverse engineering techniques in unpacking

Ievgen Kulyk - Advanced reverse engineering techniques in unpacking

Talk by Ievgen Kulyk at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/HMVMNL/ There are a lot of packers/protectors used to hide the functionality of the software. Sometimes this software is legal, sometimes malicious. It is vital to be able to unpack such software for future investigation. But the main issue is that many commercial protections use different algorithms to make automation of unpacking difficult. We will discuss more advanced techniques that are powerful and can be used to break strong protection. We will talk about debugging without debugging API. Year, it's strange but it's real life. During the debugging, we often talk about debugging API on windows or ptrace routine on Linux. These mechanisms are provided by OS developers. So it is strongly recommended to use them for user-mode debugging (debugging in ring3). But software protection systems can use a lot of techniques for detecting and preventing debugging. In practical reverse engineering anti-anti debugging plugins can be used. The most famous of them: - Phantom and StrongOD (for OllyDbg); - ScyllaHide (for x64dbg, IDA Pro) But such plugins can only protect from well-known detection algorithms. If some unknown technique will be used they will fail. So we will talk about how to implement your own tracing/debugging engine without debugging API and hide such an engine from anti-debug. We will dive into kernel development and implement our engine from scratch.

Stanislav Kolenkin & Igor Khoroshchenko - Knock Knock: Security threats with ...

Stanislav Kolenkin & Igor Khoroshchenko - Knock Knock: Security threats with ...

Stanislav Kolenkin & Igor Khoroshchenko - Knock Knock: Security threats with ...

Talk byStanislav Kolenkin & Igor Khoroshchenko at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/3EXNKX/ We will try to describe the most interesting security problems with Kubernetes environments from a DevOps and Security side. We'll discuss the actual cloud security threats and trends for 2019. Look behind the curtain of modern data breaches, weak identity and access management and incident response flaws. The rise of Serverless and Kubernetes as Enterprise solutions and lack of related security expertise during SDLC. Summarize the analytics and practical researches on adversaries techniques and tactics, a mass scan of cloud services and the uncertainty of business impacts behind them. Provide materials for further education.

Pavlo Zhavoronkov - What is autumn like in prison camps?

Pavlo Zhavoronkov - What is autumn like in prison camps?

Pavlo Zhavoronkov - What is autumn like in prison camps?

Talk by Pavlo Zhavoronkov at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/BARKBD/ This speech will give you a complete understanding of how to get in jail by doing cybercrimes in Ukraine. What is autumn like in prison camps? This speech will give you a complete understanding of how to get in jail by doing cybercrimes in Ukraine. Speech contents: The complete overview of Ukrainian court practice on articles in the section "CRIME IN THE FIELD OF USE OF ELECTRONIC COMPUTING MACHINES (COMPUTERS), SYSTEMS AND COMPUTER NETWORKS AND DIGITAL COMMUNICATIONS NETWORKS" of the Criminal Code of Ukraine. Stories about the most famous Ukrainian cybercriminals. Thoughts on current state of Ukrainian judicial system.

Alexander Olenyev & Andrey Voloshin - Car Hacking: Yes, You can do that!

Alexander Olenyev & Andrey Voloshin - Car Hacking: Yes, You can do that!

Alexander Olenyev & Andrey Voloshin - Car Hacking: Yes, You can do that!

Talk by Alexander Olenyev & Andrey Voloshin at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/AARZTL/ The complete list of (I hope) all {not only} publicly disclosed vulnerabilities in car hacking. Contains a detailed description of Who When How has been hacked, toolz and technics. Encourage every other-field pentester to use their skills in car hacking giving fundamental knowledge of where to start and what to expect. Tesla, BMW, Toyota, Nissan — few words about all of them 

Kostiantyn Korsun - State Cybersecurity vs. Cybersecurity of the State. #FRD ...

Kostiantyn Korsun - State Cybersecurity vs. Cybersecurity of the State. #FRD ...

Kostiantyn Korsun - State Cybersecurity vs. Cybersecurity of the State. #FRD ...

Talk by Kostiantyn Korsun at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/DA3TLK/ Про роль кібер-волонтерів та кібер-чиновників у сучасній кібер-війні Кібервійна проти України триває вже п'ять років. За цей час регулярні війська України стали однією з найбільш боєздатних армій Європи та Світу. Але чи став таким ж крутими кіберзахист України? У виступі серед інших обговорюватимуться наступні питання: Роль кібер-волонтерів та кібер-чиновників у сучасній кібер-війні; Наскільки ефективний кіберзахист державним коштом та скільки це коштує платнику податків; Оціночна ефективність роботи кібер-чиновників та кібер-міністерства; Яким шляхом краще йти кібер-Україні: довгим чи коротким, дешевим чи дорогим, закритим чи прозорим? Презентація майже повністю складається зі скріншотів #FRD та демонструє ретроспективу ролі волонтерської ініціативи #FRD та зміну ставлення до неї з часом.

Eugene Pilyankevich - Getting Secure Against Challenges Or Getting Security C...

Eugene Pilyankevich - Getting Secure Against Challenges Or Getting Security C...

Eugene Pilyankevich - Getting Secure Against Challenges Or Getting Security C...

Alexander Olenyev & Andrey Voloshin - Car Hacking 101 by NoNameCon

Alexander Olenyev & Andrey Voloshin - Car Hacking 101 by NoNameCon

Alexander Olenyev & Andrey Voloshin - Car Hacking 101 by NoNameCon

Stas Kolenkin & Taras Bobalo - CloudFlare Recon Workshop

Stas Kolenkin & Taras Bobalo - CloudFlare Recon Workshop

Stas Kolenkin & Taras Bobalo - CloudFlare Recon Workshop

Serhii Korolenko - Passing Security By

Serhii Korolenko - Passing Security By

Serhii Korolenko - Passing Security By

Serhii Aleynikov - Remote Forensics of a Linux Server Without Physical Access

Serhii Aleynikov - Remote Forensics of a Linux Server Without Physical Access

Serhii Aleynikov - Remote Forensics of a Linux Server Without Physical Access

Oleg Bondarenko - Threat Intelligence particularities world-wide. Real life u...

Oleg Bondarenko - Threat Intelligence particularities world-wide. Real life u...

Oleg Bondarenko - Threat Intelligence particularities world-wide. Real life u...

Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...

Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...

Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...

Lukas Apa - Hacking Robots Before SkyNet

Lukas Apa - Hacking Robots Before SkyNet

Lukas Apa - Hacking Robots Before SkyNet

Eugene Kulik & Pavel Kryvko - Executable Code Protection in ARM Systems

Eugene Kulik & Pavel Kryvko - Executable Code Protection in ARM Systems

Eugene Kulik & Pavel Kryvko - Executable Code Protection in ARM Systems

Jeremiah O'Connor & David Maynor - Chasing the Crypto Workshop: Tracking Fina...

Jeremiah O'Connor & David Maynor - Chasing the Crypto Workshop: Tracking Fina...

Jeremiah O'Connor & David Maynor - Chasing the Crypto Workshop: Tracking Fina...

Igor Andriushchenko - Tips and tricks for the efficient white-box security au...

Igor Andriushchenko - Tips and tricks for the efficient white-box security au...

Igor Andriushchenko - Tips and tricks for the efficient white-box security au...

Bert Heitink - Technical Insights for the SOC as Technical Centre for IT Secu...

Bert Heitink - Technical Insights for the SOC as Technical Centre for IT Secu...

Bert Heitink - Technical Insights for the SOC as Technical Centre for IT Secu...

More Related Content

More from NoNameCon

Bert Heitink - 10 major steps for Cybersecurity

Bert Heitink - 10 major steps for Cybersecurity

Bert Heitink - 10 major steps for Cybersecurity

Talk by Bert Heitink at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/DXN7DM/ There's no such thing as 100% security, but this talk will demonstrate 10 main topics what needs attention to reduce the risk of being hacked. Our current digital era creates a lot of possibilities, also for Ukraine! But how to deal with the threats on business and national level? 10 pragmatic steps you cannot ignore and are indisputable. Some are easy to implement, even tomorrow.

Ievgen Kulyk - Advanced reverse engineering techniques in unpacking

Ievgen Kulyk - Advanced reverse engineering techniques in unpacking

Ievgen Kulyk - Advanced reverse engineering techniques in unpacking

Talk by Ievgen Kulyk at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/HMVMNL/ There are a lot of packers/protectors used to hide the functionality of the software. Sometimes this software is legal, sometimes malicious. It is vital to be able to unpack such software for future investigation. But the main issue is that many commercial protections use different algorithms to make automation of unpacking difficult. We will discuss more advanced techniques that are powerful and can be used to break strong protection. We will talk about debugging without debugging API. Year, it's strange but it's real life. During the debugging, we often talk about debugging API on windows or ptrace routine on Linux. These mechanisms are provided by OS developers. So it is strongly recommended to use them for user-mode debugging (debugging in ring3). But software protection systems can use a lot of techniques for detecting and preventing debugging. In practical reverse engineering anti-anti debugging plugins can be used. The most famous of them: - Phantom and StrongOD (for OllyDbg); - ScyllaHide (for x64dbg, IDA Pro) But such plugins can only protect from well-known detection algorithms. If some unknown technique will be used they will fail. So we will talk about how to implement your own tracing/debugging engine without debugging API and hide such an engine from anti-debug. We will dive into kernel development and implement our engine from scratch.

Stanislav Kolenkin & Igor Khoroshchenko - Knock Knock: Security threats with ...

Stanislav Kolenkin & Igor Khoroshchenko - Knock Knock: Security threats with ...

Stanislav Kolenkin & Igor Khoroshchenko - Knock Knock: Security threats with ...

Talk byStanislav Kolenkin & Igor Khoroshchenko at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/3EXNKX/ We will try to describe the most interesting security problems with Kubernetes environments from a DevOps and Security side. We'll discuss the actual cloud security threats and trends for 2019. Look behind the curtain of modern data breaches, weak identity and access management and incident response flaws. The rise of Serverless and Kubernetes as Enterprise solutions and lack of related security expertise during SDLC. Summarize the analytics and practical researches on adversaries techniques and tactics, a mass scan of cloud services and the uncertainty of business impacts behind them. Provide materials for further education.

Pavlo Zhavoronkov - What is autumn like in prison camps?

Pavlo Zhavoronkov - What is autumn like in prison camps?

Pavlo Zhavoronkov - What is autumn like in prison camps?

Talk by Pavlo Zhavoronkov at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/BARKBD/ This speech will give you a complete understanding of how to get in jail by doing cybercrimes in Ukraine. What is autumn like in prison camps? This speech will give you a complete understanding of how to get in jail by doing cybercrimes in Ukraine. Speech contents: The complete overview of Ukrainian court practice on articles in the section "CRIME IN THE FIELD OF USE OF ELECTRONIC COMPUTING MACHINES (COMPUTERS), SYSTEMS AND COMPUTER NETWORKS AND DIGITAL COMMUNICATIONS NETWORKS" of the Criminal Code of Ukraine. Stories about the most famous Ukrainian cybercriminals. Thoughts on current state of Ukrainian judicial system.

Alexander Olenyev & Andrey Voloshin - Car Hacking: Yes, You can do that!

Alexander Olenyev & Andrey Voloshin - Car Hacking: Yes, You can do that!

Alexander Olenyev & Andrey Voloshin - Car Hacking: Yes, You can do that!

Talk by Alexander Olenyev & Andrey Voloshin at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/AARZTL/ The complete list of (I hope) all {not only} publicly disclosed vulnerabilities in car hacking. Contains a detailed description of Who When How has been hacked, toolz and technics. Encourage every other-field pentester to use their skills in car hacking giving fundamental knowledge of where to start and what to expect. Tesla, BMW, Toyota, Nissan — few words about all of them 

Kostiantyn Korsun - State Cybersecurity vs. Cybersecurity of the State. #FRD ...

Kostiantyn Korsun - State Cybersecurity vs. Cybersecurity of the State. #FRD ...

Kostiantyn Korsun - State Cybersecurity vs. Cybersecurity of the State. #FRD ...

Talk by Kostiantyn Korsun at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/DA3TLK/ Про роль кібер-волонтерів та кібер-чиновників у сучасній кібер-війні Кібервійна проти України триває вже п'ять років. За цей час регулярні війська України стали однією з найбільш боєздатних армій Європи та Світу. Але чи став таким ж крутими кіберзахист України? У виступі серед інших обговорюватимуться наступні питання: Роль кібер-волонтерів та кібер-чиновників у сучасній кібер-війні; Наскільки ефективний кіберзахист державним коштом та скільки це коштує платнику податків; Оціночна ефективність роботи кібер-чиновників та кібер-міністерства; Яким шляхом краще йти кібер-Україні: довгим чи коротким, дешевим чи дорогим, закритим чи прозорим? Презентація майже повністю складається зі скріншотів #FRD та демонструє ретроспективу ролі волонтерської ініціативи #FRD та зміну ставлення до неї з часом.

Eugene Pilyankevich - Getting Secure Against Challenges Or Getting Security C...

Eugene Pilyankevich - Getting Secure Against Challenges Or Getting Security C...

Eugene Pilyankevich - Getting Secure Against Challenges Or Getting Security C...

Alexander Olenyev & Andrey Voloshin - Car Hacking 101 by NoNameCon

Alexander Olenyev & Andrey Voloshin - Car Hacking 101 by NoNameCon

Alexander Olenyev & Andrey Voloshin - Car Hacking 101 by NoNameCon

Stas Kolenkin & Taras Bobalo - CloudFlare Recon Workshop

Stas Kolenkin & Taras Bobalo - CloudFlare Recon Workshop

Stas Kolenkin & Taras Bobalo - CloudFlare Recon Workshop

Serhii Korolenko - Passing Security By

Serhii Korolenko - Passing Security By

Serhii Korolenko - Passing Security By

Serhii Aleynikov - Remote Forensics of a Linux Server Without Physical Access

Serhii Aleynikov - Remote Forensics of a Linux Server Without Physical Access

Serhii Aleynikov - Remote Forensics of a Linux Server Without Physical Access

Oleg Bondarenko - Threat Intelligence particularities world-wide. Real life u...

Oleg Bondarenko - Threat Intelligence particularities world-wide. Real life u...

Oleg Bondarenko - Threat Intelligence particularities world-wide. Real life u...

Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...

Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...

Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...

Lukas Apa - Hacking Robots Before SkyNet

Lukas Apa - Hacking Robots Before SkyNet

Lukas Apa - Hacking Robots Before SkyNet

Eugene Kulik & Pavel Kryvko - Executable Code Protection in ARM Systems

Eugene Kulik & Pavel Kryvko - Executable Code Protection in ARM Systems

Eugene Kulik & Pavel Kryvko - Executable Code Protection in ARM Systems

Jeremiah O'Connor & David Maynor - Chasing the Crypto Workshop: Tracking Fina...

Jeremiah O'Connor & David Maynor - Chasing the Crypto Workshop: Tracking Fina...

Jeremiah O'Connor & David Maynor - Chasing the Crypto Workshop: Tracking Fina...

Igor Andriushchenko - Tips and tricks for the efficient white-box security au...

Igor Andriushchenko - Tips and tricks for the efficient white-box security au...

Igor Andriushchenko - Tips and tricks for the efficient white-box security au...

Bert Heitink - Technical Insights for the SOC as Technical Centre for IT Secu...

Bert Heitink - Technical Insights for the SOC as Technical Centre for IT Secu...

Bert Heitink - Technical Insights for the SOC as Technical Centre for IT Secu...

More from NoNameCon (18)

Bert Heitink - 10 major steps for Cybersecurity

Bert Heitink - 10 major steps for Cybersecurity

Bert Heitink - 10 major steps for Cybersecurity

Ievgen Kulyk - Advanced reverse engineering techniques in unpacking

Ievgen Kulyk - Advanced reverse engineering techniques in unpacking

Ievgen Kulyk - Advanced reverse engineering techniques in unpacking

Stanislav Kolenkin & Igor Khoroshchenko - Knock Knock: Security threats with ...

Stanislav Kolenkin & Igor Khoroshchenko - Knock Knock: Security threats with ...

Stanislav Kolenkin & Igor Khoroshchenko - Knock Knock: Security threats with ...

Pavlo Zhavoronkov - What is autumn like in prison camps?

Pavlo Zhavoronkov - What is autumn like in prison camps?

Pavlo Zhavoronkov - What is autumn like in prison camps?

Alexander Olenyev & Andrey Voloshin - Car Hacking: Yes, You can do that!

Alexander Olenyev & Andrey Voloshin - Car Hacking: Yes, You can do that!

Alexander Olenyev & Andrey Voloshin - Car Hacking: Yes, You can do that!

Kostiantyn Korsun - State Cybersecurity vs. Cybersecurity of the State. #FRD ...

Kostiantyn Korsun - State Cybersecurity vs. Cybersecurity of the State. #FRD ...

Kostiantyn Korsun - State Cybersecurity vs. Cybersecurity of the State. #FRD ...

Eugene Pilyankevich - Getting Secure Against Challenges Or Getting Security C...

Eugene Pilyankevich - Getting Secure Against Challenges Or Getting Security C...

Eugene Pilyankevich - Getting Secure Against Challenges Or Getting Security C...

Alexander Olenyev & Andrey Voloshin - Car Hacking 101 by NoNameCon

Alexander Olenyev & Andrey Voloshin - Car Hacking 101 by NoNameCon

Alexander Olenyev & Andrey Voloshin - Car Hacking 101 by NoNameCon

Stas Kolenkin & Taras Bobalo - CloudFlare Recon Workshop

Stas Kolenkin & Taras Bobalo - CloudFlare Recon Workshop

Stas Kolenkin & Taras Bobalo - CloudFlare Recon Workshop

Serhii Korolenko - Passing Security By

Serhii Korolenko - Passing Security By

Serhii Korolenko - Passing Security By

Serhii Aleynikov - Remote Forensics of a Linux Server Without Physical Access

Serhii Aleynikov - Remote Forensics of a Linux Server Without Physical Access

Serhii Aleynikov - Remote Forensics of a Linux Server Without Physical Access

Oleg Bondarenko - Threat Intelligence particularities world-wide. Real life u...

Oleg Bondarenko - Threat Intelligence particularities world-wide. Real life u...

Oleg Bondarenko - Threat Intelligence particularities world-wide. Real life u...

Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...

Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...

Nazar Tymoshyk et al - Night in Defense Workshop: Hunting for a needle in a h...

Lukas Apa - Hacking Robots Before SkyNet

Lukas Apa - Hacking Robots Before SkyNet

Lukas Apa - Hacking Robots Before SkyNet

Eugene Kulik & Pavel Kryvko - Executable Code Protection in ARM Systems

Eugene Kulik & Pavel Kryvko - Executable Code Protection in ARM Systems

Eugene Kulik & Pavel Kryvko - Executable Code Protection in ARM Systems

Jeremiah O'Connor & David Maynor - Chasing the Crypto Workshop: Tracking Fina...

Jeremiah O'Connor & David Maynor - Chasing the Crypto Workshop: Tracking Fina...

Jeremiah O'Connor & David Maynor - Chasing the Crypto Workshop: Tracking Fina...

Igor Andriushchenko - Tips and tricks for the efficient white-box security au...

Igor Andriushchenko - Tips and tricks for the efficient white-box security au...

Igor Andriushchenko - Tips and tricks for the efficient white-box security au...

Bert Heitink - Technical Insights for the SOC as Technical Centre for IT Secu...

Bert Heitink - Technical Insights for the SOC as Technical Centre for IT Secu...

Bert Heitink - Technical Insights for the SOC as Technical Centre for IT Secu...

Anastasiia Vixentael – Encryption basics [NoName CyberKids]

1. Шифрування даних як спілкуватися з друзями так, щоб вашу переписку було важко прочитати @vixentael

2. @vixentael займаюся криптографією та захистом даних

3. Безпека в реальному світі

4. Пташки Додо Аліса Боб

5. Вони разом спілкуються привіт Аліса Боб

6. Приходить Єва в неї великі вуха, вона гарно чує

7. Єва підслуховує небезпека привіт ввімкнути радари!

8. але пташки ховаються — Єва перестає їх чути безпечне місце нічого не чує 😭

9. (Не)безпека в реальному світі проблема: Єва може почути секрети рішення: сховайтесь/змініть місце

10. складніше,тому що часто ми не можемо сховатись Кібер-безпека

11. Спілкування в інтернеті Месенжер Аліси Месенжер Боба

12. мій пароль: 123 Месенжер Аліси Спілкування в інтернеті Месенжер Боба

13. Єва —кібер-злочинець

14. Приходить Єва мій пароль: 123

15. Єва перехоплює спілкування {“пароль”:“123”} мій пароль: 123

16.

17. —це перетворення даних в інший вигляд щоб зберегти їх в секреті Шифрування

18. Дані Тексти Картинки Відео / аудіо

19. 28dhW108dh шифрування розшифрування мій пароль: 123 мій пароль: 123 Шифрування

20. Шифрування 28dhW108dhмій пароль: 123 ключ 🔑

21. Розшифрування 28dhW108dhмій пароль: 123 ключ 🔑

22. Де використовується шифрування? Імейли (PGP) Сайти (TLS) Месенджери всюди в інтернеті :)

23. Прості шифри

24. Прості (старі) шифри Цезаря Виженера Лінійка Сен-Сира

25.

26.

27. Підстановка

28. Підстановка

29. Підстановка

30. Підстановка + зсув зсув = 5

31. Підстановка + зсув зсув = 5

32. Випадкова підстановка

33. Випадкова підстановка

34. Більш складні шифри

35. Сучасні шифри та криптосистеми AES-256 ChaCha20 RSA / DSA

36. Месенджери

37. Які месенжери використовувати? Signal Telegram Whatsapp Wire

38. Вправи

39. Шифрування підстановкою Шифрування випадковою підстановкою

40. Онлайн матеріали https://3dnews.ru/916293 https://cryptii.com/ http://algolist.manual.ru/defence/intro.php https://medium.com/@vixentael/how-to-start- learning-cryptography-49e7d91b54a8

41.

42. @vixentael займаюся криптографією та захистом даних бережіться!