BlueHat Seattle 2019 || Keynote

•

1 like•343 views

This document discusses some fundamental problems in technology, including a lack of empathy and diversity in teams, an overvaluation of complexity, and misaligned incentives that prioritize growth and headlines over minimizing real-world harm. It argues that technology companies have not been proactively honest about downsides and have failed to learn from past mistakes. Some recommendations are made, including emphasizing empathy and diversity to better predict harm, shifting risk ownership, adjusting incentives away from complexity and towards harm prevention, and teaching these lessons in computer science education.

Technology

The Trust and Safety Crisis
or
Some hard-learned lessons
or
Let’s fail upwards, together

We* ain’t doing so hot
*we == [techies, CS academics, nerds]

The Stamos
Hierarchy of the
Actual Bad Stuff that
Happens Online to
Real People
Abuse
InfoSec

InfoSec
Account Lifecycle/Passwords
Patching
Simple Config Errors
Old App Vulns
0-day
USENIX

We have no good model for the relationship
between individuals, governments and tech
companies

Anonymous
Surveillance
Resistant
Minimal
real-world
harm
Censorship
resistant
Trustworthy
information
Neutral
moderation
No data
leakage
Minimal data
collection
Harassment
free
Data is
portable
Free
Reliable

We are not proactively honest about the
downsides of what we build

Lessons from Yahoo v.
1. If you aren’t moving forward, you are drowning
2. Tech giants can be too responsive to Wall St.
3. IV in -> Phone Off

The key to predicting harm is empathy
The key to empathy is team diversity

Shift risk ownership to those
who make the real decisions

Adjust incentives towards harm,
not complexity or headlines

Bring these lessons back to the classroom

The nerds inherited the earth
We gotta do better

This is the digital technology self-efficacy measure we use in our research. A 17-item digital technology self-efficacy measure adapted from Holcomb, King, & Brown (2004) who reported reliability µ=0.80. Language was updated replacing computer with digital technology. Items were measured with a scale of 1 (strongly disagree) to 4 (strongly agree). A 1.0 score reflects low digital technology self-efficacy, while a 4.0 represents high digital technology self-efficacy. Holcomb, L., King, F. B., & Brown, S. W. (2004). Student traits and attributes contributing to success in online courses: Evaluation of university online courses. The Journal of Interactive Online Learning, 2(3), 1-16.

Keep Your Family Safe Online - Michael Kaiser

IT-oLogy

Ouch 201705 en

Michael Clemons

Cyber saftey for parents

Karishma Samudre

Digital Footprints - NDP

miawalsh

The New Normal - Rackspace Solve 2015

Major Hayden

Bolo bhi-nust-stay-safe-online-

Sanasaleem2

Cybersecurity Standards: The Open Group Explores Security and Ways to Assure ...

Dana Gardner

cybersecurity-101_4Pasquale Tursi

What's hot

Safer Internet Day PowerPoint

Webwise

Van 231 safe

ellenquilt

Internet PublicationDré Davis

Internet Safety for Kids and Parents

Rajesh Soundararajan

Internet Safety for Children Powerpoint

bgmartinez1971

Internet security for parentsShannon Blackerby

Cyber bullying

jun ijan

TIES 2013 Education Technology Conference

Evan Francen

Internet Safety Infographic

uKnow.com

False sense of security

BLeo0001

[PPT] Webinar on Cyber Safety Training for Young Students

Shubham Gupta

Online safetyelioar8

Digital citizenship

Inas Hafi

Digital Technology Self-efficacy Measure

Joan E. Hughes, Ph.D.

Keep Your Family Safe Online - Michael Kaiser

IT-oLogy

Ouch 201705 en

Michael Clemons

Cyber saftey for parents

Karishma Samudre

Digital Footprints - NDP

miawalsh

The New Normal - Rackspace Solve 2015

Major Hayden

Bolo bhi-nust-stay-safe-online-

Sanasaleem2

What's hot (20)

Safer Internet Day PowerPoint

Van 231 safe

Internet Publication

Internet Safety for Kids and Parents

Internet Safety for Children Powerpoint

Internet security for parents

Cyber bullying

TIES 2013 Education Technology Conference

Internet Safety Infographic

False sense of security

[PPT] Webinar on Cyber Safety Training for Young Students

Online safety

Digital citizenship

Digital Technology Self-efficacy Measure

Keep Your Family Safe Online - Michael Kaiser

Ouch 201705 en

Cyber saftey for parents

Digital Footprints - NDP

The New Normal - Rackspace Solve 2015

Bolo bhi-nust-stay-safe-online-

Similar to BlueHat Seattle 2019 || Keynote

Cybersecurity Standards: The Open Group Explores Security and Ways to Assure ...

Dana Gardner

cybersecurity-101_4Pasquale Tursi

Security risk presentation

ShanonNasoni

The Cost Of Preventing Breaches Educause Nat Conf Denver Nov 09

Tammy Clark

N3275466 - Final Presentation Advance network (1)Christopher Lisasi

beyond_the_firewall_0103Jack McCullough

11 19-2015 - iasaca membership conference - the state of security

Matthew Pascucci

portfolio.docx

DasolGaming

Joint Presentation on The State of Cybersecurity ('15-'16) & Third Party Cyb...

Rishi Singh

Responsible UseAndrea Tejedor

Security

Bob Cherry

Security In A Connected Society

CentraComm

BSidesPGH - Never Surrender - Reducing Social Engineering Risk

Rob Ragan

The weakest link in the security chain is often between the keyboard and the chair. People are a problem. We have a natural instinct as humans to trust someone's word. Although various technical means have been developed to cope with security threats, human factors have been comparatively neglected. Once you put a human in a security chain, you have a weakness. That problem should be addressed by security practitioners, not every member of an organization. Very few would disagree that social engineering is the the most common and least challenging way to compromise an organization, but most accept the notion that there isn't much they can do about it. False! This talk will focus on the psychological, technical, and physical involvement of social engineering, and also look at how we can remove the human element of the human problem. We will explore what organizations are doing wrong, also the processes and technical controls that can be put in place to achieve a strong social engineering defense. We'll template a solution that can be customized. What will really help? What is the truth? What if we don't want to surrender our organization to social engineers?

The Open Group San Diego Panel Explores Global Cybersecurity Issues for Impro...

Dana Gardner

WANTED – People Committed to Solving our Information Security Language Problem

SecurityStudio

State of Cyber: Views from an Industry Insider

Ben Johnson

Insider Threat - How Do You Find a Wolf in Sheep's Clothing?

dianadvo

Jack Whitsitt - Yours, Anecdotally

EnergySec

Almost 70 years since the first computer bug was discovered, there has been decades of research done on Information Security theory and practice. Yet, despite vast amounts of money being spent, innumerable academic papers, mainstream media obsession, and entire industries being formed, we are left with the impression that the risk is growing, not receding. Why? Some argue a lack of data, but data clearly exists. We’re likely generating it, in some areas, faster than humans will ever be able to process it. Perhaps, after all of this effort, we’ve managed to box ourselves into metaphors and first principles that might be inappropriately constraining how we think about “Information Security Risk”. In fact, it’s worth noting that we can’t even agree if there is a space between “Cyber” and “Security” when it’s written out. This talk will take an anecdotal look at “Information Security Risk”, “What IS Cyber Security?”, and use that perspective to suggest areas of research that are either lacking or should be made more accessible to the markets, industries, and individuals driving risk management change. In an industry filled with data, perhaps an examination of empty space might be helpful.

Why Do Some People Fall for Phishing Scams and What Do I Do About it?

Beth Sallay

Why do certain users fall for phishing attacks? What's going on? Are they on auto-pilot, not fully engaged in their online activities? Are they lacking critical thinking abilities? The short answer is no, they are in fact fully aware of what they are doing and reading but lack the experience to know they are being scammed. There are also several personality traits that contribute to their increased likelihood of victimization.

Persona Driven Journey Maps

Dylan Todd

Similar to BlueHat Seattle 2019 || Keynote (20)

Cybersecurity Standards: The Open Group Explores Security and Ways to Assure ...

cybersecurity-101_4

Security risk presentation

The Cost Of Preventing Breaches Educause Nat Conf Denver Nov 09

N3275466 - Final Presentation Advance network (1)

beyond_the_firewall_0103

11 19-2015 - iasaca membership conference - the state of security

portfolio.docx

Joint Presentation on The State of Cybersecurity ('15-'16) & Third Party Cyb...

Responsible Use

Security

Security In A Connected Society

BSidesPGH - Never Surrender - Reducing Social Engineering Risk

The Open Group San Diego Panel Explores Global Cybersecurity Issues for Impro...

WANTED – People Committed to Solving our Information Security Language Problem

State of Cyber: Views from an Industry Insider

Insider Threat - How Do You Find a Wolf in Sheep's Clothing?

Jack Whitsitt - Yours, Anecdotally

Why Do Some People Fall for Phishing Scams and What Do I Do About it?

Persona Driven Journey Maps

More from BlueHat Security Conference

BlueHat Seattle 2019 || The cake is a lie! Uncovering the secret world of mal...

BlueHat Security Conference

Santiago Pontiroli With more than 2.5 billion gamers from all over the world, it's no wonder that at least a fraction of them would bring into action additional tools to gain an unfair advantage over their opponents in the virtual world. This is one of the many reasons behind the existence and rapid growth of a multi-million dollar industry that thrives on selling cheats, hacks and modifications to desperate gamers seeking to gain the upper hand in their next match. Let's dissect these tools and understand how modern games and anti-cheating technologies can be easily bypassed, all while we get a glimpse of the dubious market and supporting crews that develop, sell, and maintain the commodities in this illegal economy. It's not unusual for cheats to be more expensive than the actual games they are trying to profit from, or for players to buy a single title over and over until they can avoid being banned by the protective measures implemented in the first place. Fortnite? Overwatch? League of Legends? If you've heard about these games but you don't know what an aim-bot, a wall-hack, or an ESP means, then you might finally understand why all those competitive matches you played have made you feel like a fish out of water. Join me in this presentation and learn the inside-out of an industry that has remained in the shadows for a very long time. I will be presenting real world cheats used by gamers worldwide that in some cases closely mimic techniques that would rival numerous advanced threat actors in the malware ecosystem. Game over? Maybe not….

BlueHat Seattle 2019 || Guarding Against Physical Attacks: The Xbox One Story

BlueHat Security Conference

Tony Chen Every game console since the first Atari was more or less designed to prevent the piracy of games and yet every single game console has been successfully modified to enable piracy. However, this trend has come to an end. Both the Xbox One and the PS4 have now been on the market for close to 6 years, without hackers being able to crack the system to enable piracy or cheating. This is the first time in history that game consoles have lasted this long without being cracked. In this talk, we will discuss how we achieved this for the Xbox One. We will first describe the Xbox security design goals and why it needs to guard against physical attacks, followed by descriptions of the hardware and software architecture to keep the Xbox secure. This includes details about the custom SoC we built with AMD and how we addressed the fact that all data read from flash, the hard drive, and even DRAM cannot be trusted. We will also discuss the corresponding software changes needed with the custom hardware to keep the system and the games secure against physical attacks.

BlueHat Seattle 2019 || Kubernetes Practical Attack and Defense

BlueHat Security Conference

Jay Beale We will attack a real Kubernetes cluster called Bust-a-Kube, which was released in 2019 as a free learning tool. The demonstration will start by compromising a real application running in a Kubernetes pod's container, gaining low privileged remote code execution inside that container. Next, we will explore what that compromised container can see on the cluster, finding the boundaries of its privileges. We will move laterally from that container to attack microservices on the cluster, gaining remote code execution in other containers, with higher privilege. We'll find that one of those can interfere with a final highest-privilege container. That highest privilege container will permit us to abuse the Kubernetes API to compromise the entire cluster. This demonstration will involve graphic "flags," allowing attendees to repeat the attack afterward as a downloadable solitaire "capture the flag" game. We'll then discuss and perform a second demo to teach defenses, working backward to defeat necessary steps in the first demo's chain of attacks. We'll demonstrate using pod security policies to force an AppArmor profile onto any pod (container) being deployed. We'll show how volume whitelists can block an attack, then demonstrate an evasion that defeats this defense. We'll then weaken this attack with root capability limits and AppArmor. We'll demonstrate an attack path where a bad actor can use a low-privilege Kubernetes cluster compromise to abuse the cloud provider APIs. This, in turn, leads to compromising the Kubernetes cluster more fully. We'll discuss how to break this attack using a cloud metadata API security feature that's Kubernetes-specific. In the course of these demonstrations, we'll conduct the attacks both manually and with an open source attack tool called Peirates. Finally, we'll discuss defenses that we did not use, including seccomp syscall whitelists, read-only root filesystems, and freely-available service meshes.

BlueHat Seattle 2019 || Open Source Security, vulnerabilities never come alone

BlueHat Security Conference

Nico Waisman Open source has won and is here to stay, but it comes with challenges. Open Source security is one of them that we face as an industry. We all consume it but what about its code quality, security practices, … Over the last 3 months, Github's Semmle Security Research Team has been triaging all open source CVEs and engaging on a subset of those performing variant analysis trying to uncover what it was missed. During this talk we will present some of these cases where we used QL to perform variant analysis, in addition to some others where we performed the full research (seed vulnerability and variant analysis) such as u-boot.

BlueHat Seattle 2019 || Modern Binary Analysis with ILs

BlueHat Security Conference

Jordan Wiens & Peter LaFosse Modern binary analysis, whether for discovering vulnerabilities or analyzing malware needs automation to deal with the volume of code under inspection. And yet, while Intermediate Languages (ILs) have been used for decades in compiler design and implementation, too few reverse engineers have any experience with them even though many reverse engineering tools (Binary Ninja, Ghidra, IDA) are built on top of ILs. Given that, it's time to demystify this space and make it accessible beyond just computer scientists and researchers. There's many potentially unfamiliar concepts related to ILs: single-static assignment, value-set analysis, three argument form versus tree-based designs, and others. But what matters is how these ILs can help you build better binary analysis tools. This talk not only gives you an overview of existing ILs used in reverse engineering, but more importantly, shows you how your tooling can benefit from them. From cross-platform analysis (follow a botnet from an x86-64 desktop to a mobile arm, to an embedded MIPS), to leveraging existing data-flow capabilities that brings some of the benefits both dynamic and static analysis together, this talk will demonstrate several examples of plugins that leverage ILs to improve your ability to automatically reason over compiled code.

BlueHat Seattle 2019 || Don't forget to SUBSCRIBE.

BlueHat Security Conference

Elvis Collado This talk is about how an unauthenticated heap-based buffer overflow vulnerability was discovered and exploited within a router distributed by a market-leading ISP. Despite the targeted process utilizing mitigations such as DEP and ASLR, it still fell prey to known exploitation techniques. This talk will go over the thought process, failures, and road-blocks that were encountered and how they were overcame.

BlueHat Seattle 2019 || I'm in your cloud: A year of hacking Azure AD

BlueHat Security Conference

Dirk-jan Mollema How does one research the cloud? With solutions such as Azure AD and Office 365, the underlying platform architecture and designs are not publicly documented or accessible in the same way as on-premise. This makes analyzing the security of the platform harder for external researchers. In this talk I will explain the journey and discoveries of a year of trying to understand Azure AD, including the vulnerabilities discovered in the process. This ranges from gathering information about Azure AD via undocumented APIs to installing invisible backdoors and escalating privileges via limited roles or via the link with on-premise. While some of these vulnerabilities have been resolved, several of these are unintended consequences of Azure AD's architecture and thus are important to consider when evaluating the security of your Azure AD environment. A basic understanding of Azure AD, Office 365 and its terminology is assumed for this talk.

BlueHat Seattle 2019 || Autopsies of Recent DFIR Investigations

BlueHat Security Conference

John-Luke Peck This presentation will review in hindsight and retrospect several recent incident response engagements performed over the last 12 months by a 3rd-party (non-Microsoft affiliated) security and incident response services provider. During the talk the presenter will review what went well and what did not go well during the various engagements, with a particular focus on the data, services , and support available from Microsoft & Office365/AzureAD, and how they were and were not able to be leveraged during the various engagements. This will include a focus on areas where: * Necessary data was not available because the client had not taken, or were unaware of the need to take, steps to enable collection of the data * The data & services available were successfully used during response efforts The presentation will highlight: * Lessons learned about Office365/AzureAD and Incident Response * How Office365, AzureAD, and ATP services and data were used in the response efforts * Recommendations for Office365/AzureAD tenants to improve their security & IR capabilities /before/ an incident occurs All presented examples and incidents will be de-identified to maintain and protect privacy and operational security. What this is NOT: * A service provider's sales presentation

BlueHat Seattle 2019 || The good, the bad & the ugly of ML based approaches f...

BlueHat Security Conference

Li Chen & Ravi Sahita In this talk, we juxtapose the resiliency and trustworthiness of composition of DL and classical ML algorithms for security, via a case study of evaluating the resiliency of ransomware detection via the generative adversarial network (GAN). We propose to use GAN to automatically produce dynamic features that exhibit generalized malicious behaviors that can reduce the efficacy of black-box ransomware classifiers. We examine the quality of the GAN-generated samples by comparing the statistical similarity of these samples to real ransomware and benign software. Further we investigate the latent subspace where the GAN-generated samples lie and explore reasons why such samples cause a certain class of ransomware classifiers to degrade in performance. The automatically generated adversarial samples can then be fed into the training set to reduce the blind spots of the detectors. There has been a surge of interest in using machine learning (ML) particularly deep learning (DL) to automatically detect malware through their dynamic behaviors. These approaches have achieved significant improvement in detection rates and lower false positive rates at large scale compared with traditional malware analysis methods. ML in threat detection has demonstrated to be a good cop to guard platform security. However it is imperative to evaluate - is ML-powered security resilient enough? To generate reliable traces of system activity, we can utilize CPU-based telemetry such as Intel Processor Trace which can be extracted via a hypervisor without guest instrumentation. We advocate that file I/O events extracted from Intel processor trace together with algorithmic improvements have shown potential stronger defense in ML -based model deployment in the wild to combat ransomware attack. Our results and discoveries should pose relevant questions for defenders such as how ML models can be made more resilient for robust enforcement of security objectives.

BlueHat Seattle 2019 || Are We There Yet: Why Does Application Security Take ...

BlueHat Security Conference

Chris Eng Why does it take so long to fix insecure code? We pair new data about the lifecycle of a vulnerability with learnings from application security programs to answer this perennial question. This analysis is not based on a survey – it's real data from real application scans. The data set contains 85,000 unique applications and 1.4 million individual assessments over a 12-month period, easily the largest application security data set of its size. Chris will describe the analysis process and some of the techniques, such as survival analysis, that were applied to the data set in order to measure and visualize outcomes. We'll focus specifically on identifying the factors that correlate most strongly (or not at all!) with fix rates. Finally, we'll provide data-backed insights on the contentious question of whether DevOps practices are a boon or a burden for security.

BlueHat Seattle 2019 || Building Secure Machine Learning Pipelines: Security ...

BlueHat Security Conference

Anamitra Dutta Majumdar & Anubhav Saini Increasing adoption of Machine Learning and Artificial Intelligence by data-driven organizations like LinkedIn is posing some important challenges related to data security and privacy. On the one hand, member data is an asset that unlocks unlimited business potential whereas, on the other hand, the consumption of the data must happen in a secure and privacy-preserving manner. This poses an interesting challenge for security and operations teams in the organization. In this presentation, we will walk through all the well-known use cases of machine learning at LinkedIn and also the phases of a machine learning pipeline. We will identify key security gaps and the corresponding security controls to address the gaps at each phase of any machine learning pipeline. The associated scalability and operational challenges for the application of security control will be explained. Controls in each phase would be put into the perspective of the Productive Machine Learning pipeline phases being built at LinkedIn There will be a section on how Blueshift will impact the application of security controls once compute and data have been decoupled. By the end of the talk, we would have described what a secure machine learning pipeline looks like and what are the key security patterns to be put in place to secure the pipeline.

BlueHat v18 || First strontium uefi rootkit unveiled

BlueHat Security Conference

Jean-Ian Boutin, ESET Frédéric Vachon, ESET BIOS rootkits have been researched and discussed heavily in the past few years, but sparse evidence has been presented of real campaigns actively trying to compromise a system at this level. Our talk will reveal such a campaign successfully executed by STRONTIUM. Earlier this year, there was a public report stating that the infamous Sofacy/APT28/Sednit APT group successfully trojanized a userland LoJack agent and used it against their targets. LoJack, a controversial anti-theft software, was scrutinized by security researchers in the past because of its unusual persistence method: a module preinstalled in many computers' UEFI/BIOS software. Several security risks were found through the years in their product, but no large in-the-wild activity was ever detected until the discovery of the STRONTIUM group leveraging some of these vulnerabilities affecting the userland agent. However, through our research, we now know that they did not stop there: they also tried, and succeeded, in installing a custom UEFI module directly in the systems' SPI flash memory. In this talk, we will detail the full infection chain showing how STRONTIUM was able to install their custom UEFI module on key targets' computers. Additionally, we will provide an in-depth analysis of their UEFI module and the associated trojanized LoJack agent.

BlueHat v18 || WSL reloaded - Let's try to do better fuzzing

BlueHat Security Conference

Anthony LAOU HINE TSUEI, Tencent, Keen Security Lab Peter Hlavaty, KeenLab, Tencent Fuzzing has become a cheap and fast process for any entity looking to test the robustness of a system. In this talk we will consider the Windows Subsystem for Linux, which is a brand new subsystem implemented in the Windows Kernel. It features a compatibility interface with most of the Linux Kernel’s APIs and File systems that allows Linux developers to run their code directly on Windows. Due to the complexity and the originality of this attack surface, Microsoft has thoroughly put it under Trinity’s stress testing. Our purpose will be to provide insights on how to improve upon previous attempts in order to discover new bugs and review the architecture of WSL for further research.

BlueHat v18 || The hitchhiker's guide to north korea's malware galaxy

BlueHat Security Conference

Christiaan F Beek, McAfee Jay Rosenberg, Intezer Labs The Lazarus, Silent Chollima, Group 123, Hidden Cobra, DarkSeoul, Blockbuster, Operation Troy, 10 Days of Rain attacks are all believed to originate from North Korea. But how can they be attributed with certainty? And what connection does a DDoS and disk wiping attack from July 4 2009, have with WannaCry, one of the largest cyber-attacks in the history of the cyber-sphere? We have conducted a comparative research over more than 10 years of malware and tools being used by North Korean adversaries. The results were intriguing and we will share our discoveries but also hunt tactics during our talk. We discovered new links between campaigns and were able to group malware families towards actor groups and discovere interesting patterns.

BlueHat v18 || Retpoline - the anti-spectre (type 2) mitigation in windows

BlueHat Security Conference

Andrea Allievi, Microsoft Spectre and Meltdown CPU have been one of the biggest security problem of the year 2018. Mitigations have already been delivered to the customers by both CPU manufacturers and OS developers. While the mitigations for Spectre type 1 and Meltdown have been successfully delivered, the mitigation for Spectre type 2, Retpoline, has been deferred for various problems. This talk will describe the implementation details of Retpoline in Windows 10 (19H1) and all the problem that we faced while testing it. Designing Retpoline has requested the collaboration of different teams in Microsoft, especially between the Kernel and the Compiler team. This talk will explain how we overcame all the implementation issues and allow all the involved Windows Kernel components to work with Retpoline in a retro-compatible way. At the end we will analyze the performance issues and explain how the Kernel team has found a solution for them

BlueHat v18 || Memory resident implants - code injection is alive and well

BlueHat Security Conference

Luke Jennings, Countercept Attackers have been avoiding disk and staying memory resident for over a decade and this has traditionally proven an Achilles heels for security products and the teams that operate them. The boom in both EDR products and memory forensics toolkits in more recent years have helped defenders to fight back but attackers are already adapting their approaches. This talk will cover both classic and modern techniques for injecting code into legitimate processes on Microsoft Windows systems, as well as several techniques for detecting them. This will include both system tracing methods, good for proactive detection, as well as memory analysis techniques that have the added benefit of allow detection of pre-existing compromises in real-world incident response scenarios, with a brief case study example. As part of this, practical examples will be given showing how Microsoft’s ATP and Sysmon help in this area as well as other techniques. Finally, the future of this area will be considered, including how the .NET runtime already complicates detection techniques in this area and how this will likely become increasingly challenging as more attackers discover and exploit this. By the end of the talk, the audience should understand the importance of code injection in the context of memory-resident implants, the key techniques for performing it and detecting it and the challenges of achieving this in the real-world at enterprise scale.

BlueHat v18 || Massive scale usb device driver fuzz without device

BlueHat Security Conference

Zhuo Ma, Tencent USB is one of the most common interface supported on modern computer. Modern OSes offer tons of USB drivers to support frequently used USB device classes. For other 3rd party USB device, Microsoft provide automatic driver downloading and installation via Windows AutoUpdate Service. In this talk, we consider this as a novel attacking surface exposed by Windows. We are trying to assess the vulnerability in those USB drivers provided via Windows AutoUpdate Service, which can be automatic installed and run after device plugged in. Obviously, these drivers are all designed for real USB device, which have to talk to device during running. So, the biggest obstacle for assessing these drivers is we can not prepare real USB devices for all of these drivers. To overcome this, We developed a system to emulate these USB device, further, we are trying to fuzz these drivers against our emulated USB device. By using this system, we can fuzz device drivers without the real USB device. In further, we can also precisely fuzz every stage of driver loading. We can feed any custom data to the drivers to trigger vulnerabilities. Also, this system supports IO Control Code fuzz as well. And all in all, all of this progress can be done automatically. We tested about 6000 drivers, yielded hundreds of crash by fuzzing. IO Control Fuzz also gave a reasonable result. We are going to divide our talk into three parts: the first part is about how we get the list of automatic installed USB drivers, and how to analyze these drivers in automatic ways; the second part is about the fuzzing system we designed, including the architecture of system, ways to emulating devices, key points for designing; the last part will show some vulnerabilities we found by this system.

BlueHat v18 || Modern day entomology - examining the inner workings of the bu...

BlueHat Security Conference

Brian Gorenc, Trend Micro Much like their six-legged counterparts in nature, bugs in software have a lifecycle. They are discovered, they get exploited, they get reported, they get patched, and usually, they go away. At each stage of this lifecycle, information about the vulnerability equates to a monetary value, and, depending on how this information is disseminated, that monetary value can drastically change. Various marketplaces exist for security research, and the current gray and black markets can be as robust as their white market counterparts. Different agents within these markets influence research trends by shifting finances to or away from specific areas, resulting in more bugs discovered and reported in that area. Even if you don’t directly participate in this economy, it impacts you and the systems you defend. Bugs bought and sold in the marketplace often become security patches and sometimes get wrapped into exploit kits or malware. Administering the world’s largest vendor agnostic bug bounty program puts us in a unique position to examine the inner workings of these transactions. While firmly in the white market, our experience and relationships provide us with insight across the entire exploit landscape. Some of these factors might not be obvious to those outside of the marketplace until exposed through data leaks or compromise. These hidden factors can shift prices and send researchers – and thus exploits – in new directions. Like any open market, various factors can spur changes in supply and demand, and market actors can shape what types of research either becomes public – or finds its way into an exploit kit. This presentation covers the inner-workings of the exploit marketplace, the main players in various sectors, and the winding, often controversial lifespan of a security bug. We include real-world examples of how effectively run programs have disrupted nation-state exploit usage in the wild, and take a look at how existing and impending legislation could irrevocably affect the exploit marketplace – and maybe not for the better.

BlueHat v18 || The matrix has you - protecting linux using deception

BlueHat Security Conference

Ross Bevington, Microsoft In ‘The Matrix’ sentient machines subdue the population by developing a highly sophisticated simulation. High interaction honeypots are a lot like The Matrix, designed to convince an attacker to execute an attack so we can monitor them. But these honeypots are flawed! Attackers are continually adapting in order to evade our defenses - meaning that it’s often not enough to just set up a honeypot and watch the results roll in. Is a new approach better? Did you know that 40% of IaaS VMs in Azure are Linux? For Microsoft to protect itself and its customers Linux is a priority. At MSTIC we’ve developed a new type of Linux honeypot that allows us to deceive and control the behavior of an attacker. We are using this to understand the person behind the attack, examining them as they examine us. Using these techniques, we are able to better track the person behind the threat, build better protections and ultimately protect more Linux users - whether they are using Azure or not. In this presentation I’ll show some of the successes of running a Matrix like environment, failures where a glitch was spotted as well as deception approaches that could be applied to other domains. Finally I’ll show how easy it is to leverage Azure’s big data capabilities to build and ultimately query all this data at scale as well as how you can immediately reap the benefits of this work by connecting your Linux box to Azure Security Center.

BlueHat v18 || An ice-cold boot to break bit locker

BlueHat Security Conference

Olle Segerdahl, F-Secure Pasi Saarinen, F-Secure A decade ago, academic researchers demonstrated how computer memory remanence could be used to defeat popular disk encryption systems[1]. Today, most seem to believe that these attacks are too impractical for real world use. Microsoft has played down the threat of memory remanence attacks against BitLocker using words such as "they are not possible using published techniques"[2]. We will show techniques that allow recovery of BitLocker encryption keys from RAM on most, if not all, currently available laptops and tablets. These techniques allow bypassing of security controls such as password protected BIOS configuration, UEFI-based Secure Boot and the TCG Platform Reset Attack Mitigation by directly manipulating the firmware storage device (EFI SPI flash chip). [1] https://www.usenix.org/legacy/event/sec08/tech/full_papers/halderman/halderman.pdf [2] https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure

More from BlueHat Security Conference (20)

BlueHat Seattle 2019 || The cake is a lie! Uncovering the secret world of mal...

BlueHat Seattle 2019 || Guarding Against Physical Attacks: The Xbox One Story

BlueHat Seattle 2019 || Kubernetes Practical Attack and Defense

BlueHat Seattle 2019 || Open Source Security, vulnerabilities never come alone

BlueHat Seattle 2019 || Modern Binary Analysis with ILs

BlueHat Seattle 2019 || Don't forget to SUBSCRIBE.

BlueHat Seattle 2019 || I'm in your cloud: A year of hacking Azure AD

BlueHat Seattle 2019 || Autopsies of Recent DFIR Investigations

BlueHat Seattle 2019 || The good, the bad & the ugly of ML based approaches f...

BlueHat Seattle 2019 || Are We There Yet: Why Does Application Security Take ...

BlueHat Seattle 2019 || Building Secure Machine Learning Pipelines: Security ...

BlueHat v18 || First strontium uefi rootkit unveiled

BlueHat v18 || WSL reloaded - Let's try to do better fuzzing

BlueHat v18 || The hitchhiker's guide to north korea's malware galaxy

BlueHat v18 || Retpoline - the anti-spectre (type 2) mitigation in windows

BlueHat v18 || Memory resident implants - code injection is alive and well

BlueHat v18 || Massive scale usb device driver fuzz without device

BlueHat v18 || Modern day entomology - examining the inner workings of the bu...

BlueHat v18 || The matrix has you - protecting linux using deception

BlueHat v18 || An ice-cold boot to break bit locker

Recently uploaded

Essentials of Automations: Optimizing FME Workflows with Parameters

Safe Software

Are you looking to streamline your workflows and boost your projects’ efficiency? Do you find yourself searching for ways to add flexibility and control over your FME workflows? If so, you’re in the right place. Join us for an insightful dive into the world of FME parameters, a critical element in optimizing workflow efficiency. This webinar marks the beginning of our three-part “Essentials of Automation” series. This first webinar is designed to equip you with the knowledge and skills to utilize parameters effectively: enhancing the flexibility, maintainability, and user control of your FME projects. Here’s what you’ll gain: - Essentials of FME Parameters: Understand the pivotal role of parameters, including Reader/Writer, Transformer, User, and FME Flow categories. Discover how they are the key to unlocking automation and optimization within your workflows. - Practical Applications in FME Form: Delve into key user parameter types including choice, connections, and file URLs. Allow users to control how a workflow runs, making your workflows more reusable. Learn to import values and deliver the best user experience for your workflows while enhancing accuracy. - Optimization Strategies in FME Flow: Explore the creation and strategic deployment of parameters in FME Flow, including the use of deployment and geometry parameters, to maximize workflow efficiency. - Pro Tips for Success: Gain insights on parameterizing connections and leveraging new features like Conditional Visibility for clarity and simplicity. We’ll wrap up with a glimpse into future webinars, followed by a Q&A session to address your specific questions surrounding this topic. Don’t miss this opportunity to elevate your FME expertise and drive your projects to new heights of efficiency.

Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...

Thierry Lestable

Elevating Tactical DDD Patterns Through Object Calisthenics

Dorra BARTAGUIZ

After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!

Leading Change strategies and insights for effective change management pdf 1.pdf

OnBoard

How world-class product teams are winning in the AI era by CEO and Founder, P...

Product School

By Design, not by Accident - Agile Venture Bolzano 2024

Pierluigi Pugliese

A tale of scale & speed: How the US Navy is enabling software delivery from l...

sonjaschweigert1

Rapid and secure feature delivery is a goal across every application team and every branch of the DoD. The Navy’s DevSecOps platform, Party Barge, has achieved: - Reduction in onboarding time from 5 weeks to 1 day - Improved developer experience and productivity through actionable findings and reduction of false positives - Maintenance of superior security standards and inherent policy enforcement with Authorization to Operate (ATO) Development teams can ship efficiently and ensure applications are cyber ready for Navy Authorizing Officials (AOs). In this webinar, Sigma Defense and Anchore will give attendees a look behind the scenes and demo secure pipeline automation and security artifacts that speed up application ATO and time to production. We will cover: - How to remove silos in DevSecOps - How to build efficient development pipeline roles and component templates - How to deliver security artifacts that matter for ATO’s (SBOMs, vulnerability reports, and policy evidence) - How to streamline operations with automated policy checks on container images

FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf

FIDO Alliance

Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™

UiPathCommunity

In questo evento online gratuito, organizzato dalla Community Italiana di UiPath, potrai esplorare le nuove funzionalità di Autopilot, il tool che integra l'Intelligenza Artificiale nei processi di sviluppo e utilizzo delle Automazioni. 📕 Vedremo insieme alcuni esempi dell'utilizzo di Autopilot in diversi tool della Suite UiPath: Autopilot per Studio Web Autopilot per Studio Autopilot per Apps Clipboard AI GenAI applicata alla Document Understanding 👨‍🏫👨‍💻 Speakers: Stefano Negro, UiPath MVPx3, RPA Tech Lead @ BSP Consultant Flavio Martinelli, UiPath MVP 2023, Technical Account Manager @UiPath Andrei Tasca, RPA Solutions Team Lead @NTT Data

FIDO Alliance Osaka Seminar: Overview.pdf

FIDO Alliance

Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf

Paige Cruz

Monitoring and observability aren’t traditionally found in software curriculums and many of us cobble this knowledge together from whatever vendor or ecosystem we were first introduced to and whatever is a part of your current company’s observability stack. While the dev and ops silo continues to crumble….many organizations still relegate monitoring & observability as the purview of ops, infra and SRE teams. This is a mistake - achieving a highly observable system requires collaboration up and down the stack. I, a former op, would like to extend an invitation to all application developers to join the observability party will share these foundational concepts to build on:

Assuring Contact Center Experiences for Your Customers With ThousandEyes

ThousandEyes

PHP Frameworks: I want to break free (IPC Berlin 2024)

Ralf Eggert

In this presentation, we examine the challenges and limitations of relying too heavily on PHP frameworks in web development. We discuss the history of PHP and its frameworks to understand how this dependence has evolved. The focus will be on providing concrete tips and strategies to reduce reliance on these frameworks, based on real-world examples and practical considerations. The goal is to equip developers with the skills and knowledge to create more flexible and future-proof web applications. We'll explore the importance of maintaining autonomy in a rapidly changing tech landscape and how to make informed decisions in PHP development. This talk is aimed at encouraging a more independent approach to using PHP frameworks, moving towards a more flexible and future-proof approach to PHP development.

Monitoring Java Application Security with JDK Tools and JFR Events

Ana-Maria Mihalceanu

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf

FIDO Alliance

Free Complete Python - A step towards Data Science

RinaMondal9

Elizabeth Buie - Older adults: Are we really designing for our future selves?

Nexer Digital

Introduction to CHERI technology - Cybersecurity

mikeeftimakis1

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Albert Hoitingh