К началу 2016 года у многих сложилось впечатление, что проблема DDoS-атак исчерпала себя — настолько тривиальными выглядели сами атаки и меры по защите от них. Спустя год ситуация кардинально изменилась. Обсудим эти изменения, их причины, предпосылки и последствия, а также их взаимосвязь с развитием IoT.
CODE BLUE 2014 : Drone attack by malware and network hacking by DONGCHEOL HONGCODE BLUE
Recently, drone systems are rapidly taking over markets around the world, and drone systems are also made and developed rapidly as well. However, its security aren’t in the same way as you think.
I am going to demonstrate you how to ultimately compromise a drone by using drone's convenient features. My malware, also known as HSDrone, enables itself to spread from one device to an another and takes privileges over to compromise and control them.
DDoS in cloud computing | Distributed Denial of Service | Chandan Singh GhodelaChandan Singh Ghodela
Cloud computing is one of the emerging technologies in which a huge amount of storage, data and services are available over the internet. The main advantage of cloud computing environment is the users have to pay only for what they use. Cloud services are distributed in nature so they can be sharable by millions of users. Because of this, the cloud environment has numerous security challenges. Distributed Denial of Service (DDoS) is most prominent security attack in cloud computing. DDOS is the largest threat which can impact on the availability of cloud services since it has multi-tenant architecture. This paper highlights various DDoS attacks and its countermeasures.
Huiming Liu-'resident evil' of smart phones--wombie attackGeekPwn Keen
In this presentation, Huiming Liu, the researcher of Tencent Security Xuanwu Lab, will present an astonishing mobile wireless zombie(Wombie) attack demo — the smartphone viruses spread like zombies in “Resident Evil”, and the technique details will also be explained. The Wombie doesn’t rely on Internet to spread, so it can’t be detected on the internet. Besides, it can serve as an attack amplifier for many other attack methods. For example, the recent KRACK attack about WPA2 will benefit a lot if combined with the Wombie Attack.
CODE BLUE 2014 : Drone attack by malware and network hacking by DONGCHEOL HONGCODE BLUE
Recently, drone systems are rapidly taking over markets around the world, and drone systems are also made and developed rapidly as well. However, its security aren’t in the same way as you think.
I am going to demonstrate you how to ultimately compromise a drone by using drone's convenient features. My malware, also known as HSDrone, enables itself to spread from one device to an another and takes privileges over to compromise and control them.
DDoS in cloud computing | Distributed Denial of Service | Chandan Singh GhodelaChandan Singh Ghodela
Cloud computing is one of the emerging technologies in which a huge amount of storage, data and services are available over the internet. The main advantage of cloud computing environment is the users have to pay only for what they use. Cloud services are distributed in nature so they can be sharable by millions of users. Because of this, the cloud environment has numerous security challenges. Distributed Denial of Service (DDoS) is most prominent security attack in cloud computing. DDOS is the largest threat which can impact on the availability of cloud services since it has multi-tenant architecture. This paper highlights various DDoS attacks and its countermeasures.
Huiming Liu-'resident evil' of smart phones--wombie attackGeekPwn Keen
In this presentation, Huiming Liu, the researcher of Tencent Security Xuanwu Lab, will present an astonishing mobile wireless zombie(Wombie) attack demo — the smartphone viruses spread like zombies in “Resident Evil”, and the technique details will also be explained. The Wombie doesn’t rely on Internet to spread, so it can’t be detected on the internet. Besides, it can serve as an attack amplifier for many other attack methods. For example, the recent KRACK attack about WPA2 will benefit a lot if combined with the Wombie Attack.
Zhiyun Qian-what leaves attacker hijacking USA Today siteGeekPwn Keen
In GeekPwn2016 Mid-year Contest, doctoral student Cao Yue of Dr.Zhiyun Qian showed ‘TCP hijacking’ attack. This attack can pop up a fishing web page and steal user’s password. This vulnerability in TCP/IP stack exists in almost all Android and Linux editions. Explained by Cao Yue, this vulnerability is found by his director, Mr. Qian found this vulnerability by reviewing Linux kernel source code.
UPC router reverse engineering - case studyDusan Klinec
Security analysis of the UPC UBEE EVW3226 router, reverse engineering, WPA2 password generation algorithm. Statistic analysis of the password generation function is provided. Results from the wardriving.
Nick Stephens-how does someone unlock your phone with noseGeekPwn Keen
In GeeekPwn2016 Shanghai, Nick built an Android APP, which can exploit the vulnerabilities in THE Android devices with TrustZone. It can execute arbitrary code with root privilege. In the demo, the fingerprint authentication module is pwned and set to allow any fingerprint to pass.
Developers and researchers are confronted with a huge number of tools and technologies in their daily work, each of which has its own pros and cons. This realization is important for network devices intended to stop attacks — they should be “omnivores” with regard to network protocols. The speaker’s passion is to study and recreate various hacker attacks, exploits and tactics at the network level in order to develop reliable detection techniques for intrusion detection systems. While working on lots of attacks he noticed some tiny network conditions when a packet sequence slip away from IDS system but get to the target. Will your IDS system detect data network connection was broken? Using nc and a Linux machine, the speaker will demonstrate 4 CVEs he found for bypassing IDS systems, based on the example of the popular Suricata IDS.
Learn how The Weather Company aggregates weather data and delivers it to the rest of the world.
A demo of how to build your own IOT based personal weather station.
Kranky Geek WebRTC 2015 - What's next for WebRTC?Kranky Geek
lways the highlight of this event, Google provides the nitty gritty details on what they are doing to progress WebRTC and their internal developments to help your application succeed. We'll cover more details on the recently announced Alliance for Open Media, an effort to create royalty-free video codecs.
Google Team
HITCON 2015: Your Lightbulb Is Not Hacking You: Observation from a Honeypot B...Philippe Lin
IoT devices are claimed to be vulnerable to massive attack. We tried to assess the status quo with two IoT honeypots in Taipei and Munich, backed by real devices like LIFX, Philips Hue, D-Link and Samsung IPCams, gaming consoles, WDCloud and SmartTV. After four months of observation, we conclude that IoT is somewhat "probed" but still far from being massively attacked.
How Networking works with Data Science HungWei Chiu
Introduce the basic concept of networking model, including the OSI model and TCP/IP model.
Also introduce basic ideas/function in networking, such as routing, classification, security..etc
Zhiyun Qian-what leaves attacker hijacking USA Today siteGeekPwn Keen
In GeekPwn2016 Mid-year Contest, doctoral student Cao Yue of Dr.Zhiyun Qian showed ‘TCP hijacking’ attack. This attack can pop up a fishing web page and steal user’s password. This vulnerability in TCP/IP stack exists in almost all Android and Linux editions. Explained by Cao Yue, this vulnerability is found by his director, Mr. Qian found this vulnerability by reviewing Linux kernel source code.
UPC router reverse engineering - case studyDusan Klinec
Security analysis of the UPC UBEE EVW3226 router, reverse engineering, WPA2 password generation algorithm. Statistic analysis of the password generation function is provided. Results from the wardriving.
Nick Stephens-how does someone unlock your phone with noseGeekPwn Keen
In GeeekPwn2016 Shanghai, Nick built an Android APP, which can exploit the vulnerabilities in THE Android devices with TrustZone. It can execute arbitrary code with root privilege. In the demo, the fingerprint authentication module is pwned and set to allow any fingerprint to pass.
Developers and researchers are confronted with a huge number of tools and technologies in their daily work, each of which has its own pros and cons. This realization is important for network devices intended to stop attacks — they should be “omnivores” with regard to network protocols. The speaker’s passion is to study and recreate various hacker attacks, exploits and tactics at the network level in order to develop reliable detection techniques for intrusion detection systems. While working on lots of attacks he noticed some tiny network conditions when a packet sequence slip away from IDS system but get to the target. Will your IDS system detect data network connection was broken? Using nc and a Linux machine, the speaker will demonstrate 4 CVEs he found for bypassing IDS systems, based on the example of the popular Suricata IDS.
Learn how The Weather Company aggregates weather data and delivers it to the rest of the world.
A demo of how to build your own IOT based personal weather station.
Kranky Geek WebRTC 2015 - What's next for WebRTC?Kranky Geek
lways the highlight of this event, Google provides the nitty gritty details on what they are doing to progress WebRTC and their internal developments to help your application succeed. We'll cover more details on the recently announced Alliance for Open Media, an effort to create royalty-free video codecs.
Google Team
HITCON 2015: Your Lightbulb Is Not Hacking You: Observation from a Honeypot B...Philippe Lin
IoT devices are claimed to be vulnerable to massive attack. We tried to assess the status quo with two IoT honeypots in Taipei and Munich, backed by real devices like LIFX, Philips Hue, D-Link and Samsung IPCams, gaming consoles, WDCloud and SmartTV. After four months of observation, we conclude that IoT is somewhat "probed" but still far from being massively attacked.
How Networking works with Data Science HungWei Chiu
Introduce the basic concept of networking model, including the OSI model and TCP/IP model.
Also introduce basic ideas/function in networking, such as routing, classification, security..etc
DIY Internet: Snappy, Secure Networking with MinimaLT (JSConf EU 2013)Igalia
By Andy Wingo.
Refreshing your Twitter feed is such a drag over 3G, taking forever to connect and fetch those precious kilobytes. The reasons for this go deep into the architecture of the internet: making an HTTPS connection simply has terrible latency.
So let’s fix the internet! MinimaLT is an exciting new network protocol that connects faster than TCP, is more secure than TLS (crypto by DJ Bernstein), and allows mobile devices to keep connections open as they change IP addresses. This talk presents the MinimaLT protocol and a Node library that allows JS hackers to experimentally build a new Internet.
WebSocket is cool, and you probably already played with it. But it’s just a transport technology. If you have thousands of client connections you need to do lots of improvements to make it scalable, reliable and achieve high performance. You need to implement many things on top of it.
We are building financial data streaming platform for thousands of traders using WebSocket. I’m going to share my experience and cover such techniques as delta delivery, conflation, dynamic throttling, bandwidth and frequency limitation and other. I will also do a live demo of how to build scalable WebSocket backend from scratch using Java and Spring.
Инструмент ChangelogBuilder для автоматической подготовки Release NotesPositive Hack Days
1. Основные понятия и определения: продукт, пакет, связи между ними.
2. Как узнать, какие изменения произошли в продукте?
3. Проблемы changelog и release note.
4. Решение: инструмент ChangelogBuilder для автоматической подготовки Release Notes
Как мы собираем проекты в выделенном окружении в Windows DockerPositive Hack Days
1. Обзор Windows Docker (кратко)
2. Как мы построили систему билда приложений в Docker (Visual Studio\Mongo\Posgresql\etc)
3. Примеры Dockerfile (выложенные на github)
4. Отличия процессов DockerWindows от DockerLinux (Долгий билд, баги, remote-регистр.)
Типовая сборка и деплой продуктов в Positive TechnologiesPositive Hack Days
1. Проблемы в построении CI процессов в компании
2. Структура типовой сборки
3. Пример реализации типовой сборки
4. Плюсы и минусы от использования типовой сборки
1. Что такое BI. Зачем он нужен.
2. Что такое Qlik View / Sense
3. Способ интеграции. Как это работает.
4. Метрики, KPI, планирование ресурсов команд, ретроспектива релиза продукта, тренды.
5. Подключение внешних источников данных (Excel, БД СКУД, переговорные комнаты).
Approof — статический анализатор кода для проверки веб-приложений на наличие уязвимых компонентов. В своей работе анализатор основывается на правилах, хранящих сигнатуры искомых компонентов. В докладе рассматривается базовая структура правила для Approof и процесс автоматизации его создания.
Задумывались ли вы когда-нибудь о том, как устроены современные механизмы защиты приложений? Какая теория стоит за реализацией WAF и SAST? Каковы пределы их возможностей? Насколько их можно подвинуть за счет более широкого взгляда на проблематику безопасности приложений?
На мастер-классе будут рассмотрены основные методы и алгоритмы двух основополагающих технологий защиты приложений — межсетевого экранирования уровня приложения и статического анализа кода. На примерах конкретных инструментов с открытым исходным кодом, разработанных специально для этого мастер-класса, будут рассмотрены проблемы, возникающие на пути у разработчиков средств защиты приложений, и возможные пути их решения, а также даны ответы на все упомянутые вопросы.
От экспериментального программирования к промышленному: путь длиной в 10 летPositive Hack Days
Разработка наукоемкого программного обеспечения отличается тем, что нет ни четкой постановки задачи, ни понимания, что получится в результате. Однако даже этом надо программировать то, что надо, и как надо. Докладчик расскажет о том, как ее команда успешно разработала и вывела в промышленную эксплуатацию несколько наукоемких продуктов, пройдя непростой путь от эксперимента, результатом которого был прототип, до промышленных версий, которые успешно продаются как на российском, так и на зарубежном рынках. Этот путь был насыщен сложностями и качественными управленческими решениями, которыми поделится докладчик
Уязвимое Android-приложение: N проверенных способов наступить на граблиPositive Hack Days
Немногие разработчики закладывают безопасность в архитектуру приложения на этапе проектирования. Часто для этого нет ни денег, ни времени. Еще меньше — понимания моделей нарушителя и моделей угроз. Защита приложения выходит на передний план, когда уязвимости начинают стоить денег. К этому времени приложение уже работает и внесение существенных изменений в код становится нелегкой задачей.
К счастью, разработчики тоже люди, и в коде разных приложений можно встретить однотипные недостатки. В докладе речь пойдет об опасных ошибках, которые чаще всего допускают разработчики Android-приложений. Затрагиваются особенности ОС Android, приводятся примеры реальных приложений и уязвимостей в них, описываются способы устранения.
Разработка любого софта так или иначе базируется на требованиях. Полный перечень составляют бизнес-цели приложения, различные ограничения и ожидания по качеству (их еще называют NFR). Требования к безопасности ПО относятся к последнему пункту. В ходе доклада будут рассматриваться появление этих требований, управление ими и выбор наиболее важных.
Отдельно будут освещены принципы построения архитектуры приложения, при наличии таких требований и без, и продемонстрировано, как современные (и хорошо известные) подходы к проектированию приложения помогают лучше строить архитектуру приложения для минимизации ландшафта угроз.
Доклад посвящен разработке корректного программного обеспечения с применением одного из видов статического анализа кода. Будут освещены вопросы применения подобных методов, их слабые стороны и ограничения, а также рассмотрены результаты, которые они могут дать. На конкретных примерах будет продемонстрировано, как выглядят разработка спецификаций для кода на языке Си и доказательство соответствия кода спецификациям.
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf91mobiles
91mobiles recently conducted a Smart TV Buyer Insights Survey in which we asked over 3,000 respondents about the TV they own, aspects they look at on a new TV, and their TV buying preferences.
UiPath Test Automation using UiPath Test Suite series, part 4DianaGray10
Welcome to UiPath Test Automation using UiPath Test Suite series part 4. In this session, we will cover Test Manager overview along with SAP heatmap.
The UiPath Test Manager overview with SAP heatmap webinar offers a concise yet comprehensive exploration of the role of a Test Manager within SAP environments, coupled with the utilization of heatmaps for effective testing strategies.
Participants will gain insights into the responsibilities, challenges, and best practices associated with test management in SAP projects. Additionally, the webinar delves into the significance of heatmaps as a visual aid for identifying testing priorities, areas of risk, and resource allocation within SAP landscapes. Through this session, attendees can expect to enhance their understanding of test management principles while learning practical approaches to optimize testing processes in SAP environments using heatmap visualization techniques
What will you get from this session?
1. Insights into SAP testing best practices
2. Heatmap utilization for testing
3. Optimization of testing processes
4. Demo
Topics covered:
Execution from the test manager
Orchestrator execution result
Defect reporting
SAP heatmap example with demo
Speaker:
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...UiPathCommunity
💥 Speed, accuracy, and scaling – discover the superpowers of GenAI in action with UiPath Document Understanding and Communications Mining™:
See how to accelerate model training and optimize model performance with active learning
Learn about the latest enhancements to out-of-the-box document processing – with little to no training required
Get an exclusive demo of the new family of UiPath LLMs – GenAI models specialized for processing different types of documents and messages
This is a hands-on session specifically designed for automation developers and AI enthusiasts seeking to enhance their knowledge in leveraging the latest intelligent document processing capabilities offered by UiPath.
Speakers:
👨🏫 Andras Palfi, Senior Product Manager, UiPath
👩🏫 Lenka Dulovicova, Product Program Manager, UiPath
Connector Corner: Automate dynamic content and events by pushing a buttonDianaGray10
Here is something new! In our next Connector Corner webinar, we will demonstrate how you can use a single workflow to:
Create a campaign using Mailchimp with merge tags/fields
Send an interactive Slack channel message (using buttons)
Have the message received by managers and peers along with a test email for review
But there’s more:
In a second workflow supporting the same use case, you’ll see:
Your campaign sent to target colleagues for approval
If the “Approve” button is clicked, a Jira/Zendesk ticket is created for the marketing design team
But—if the “Reject” button is pushed, colleagues will be alerted via Slack message
Join us to learn more about this new, human-in-the-loop capability, brought to you by Integration Service connectors.
And...
Speakers:
Akshay Agnihotri, Product Manager
Charlie Greenberg, Host
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualityInflectra
In this insightful webinar, Inflectra explores how artificial intelligence (AI) is transforming software development and testing. Discover how AI-powered tools are revolutionizing every stage of the software development lifecycle (SDLC), from design and prototyping to testing, deployment, and monitoring.
Learn about:
• The Future of Testing: How AI is shifting testing towards verification, analysis, and higher-level skills, while reducing repetitive tasks.
• Test Automation: How AI-powered test case generation, optimization, and self-healing tests are making testing more efficient and effective.
• Visual Testing: Explore the emerging capabilities of AI in visual testing and how it's set to revolutionize UI verification.
• Inflectra's AI Solutions: See demonstrations of Inflectra's cutting-edge AI tools like the ChatGPT plugin and Azure Open AI platform, designed to streamline your testing process.
Whether you're a developer, tester, or QA professional, this webinar will give you valuable insights into how AI is shaping the future of software delivery.
Epistemic Interaction - tuning interfaces to provide information for AI supportAlan Dix
Paper presented at SYNERGY workshop at AVI 2024, Genoa, Italy. 3rd June 2024
https://alandix.com/academic/papers/synergy2024-epistemic/
As machine learning integrates deeper into human-computer interactions, the concept of epistemic interaction emerges, aiming to refine these interactions to enhance system adaptability. This approach encourages minor, intentional adjustments in user behaviour to enrich the data available for system learning. This paper introduces epistemic interaction within the context of human-system communication, illustrating how deliberate interaction design can improve system understanding and adaptation. Through concrete examples, we demonstrate the potential of epistemic interaction to significantly advance human-computer interaction by leveraging intuitive human communication strategies to inform system design and functionality, offering a novel pathway for enriching user-system engagements.
Generating a custom Ruby SDK for your web service or Rails API using Smithyg2nightmarescribd
Have you ever wanted a Ruby client API to communicate with your web service? Smithy is a protocol-agnostic language for defining services and SDKs. Smithy Ruby is an implementation of Smithy that generates a Ruby SDK using a Smithy model. In this talk, we will explore Smithy and Smithy Ruby to learn how to generate custom feature-rich SDKs that can communicate with any web service, such as a Rails JSON API.
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...DanBrown980551
Do you want to learn how to model and simulate an electrical network from scratch in under an hour?
Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)!
During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook.
PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides:
- A fully editable and extendable library for grid component modelling;
- Visualization tools to display your network;
- Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses;
The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well.
What you will learn during the webinar:
- For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills;
- For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.
27. Wordpress Pingback
GET /whatever
User-Agent: WordPress/3.9.2;
http://example.com/;
verifying pingback
from 192.0.2.150
• 150 000 – 170 000
vulnerable servers
at once
• SSL/TLS-enabled
• Millions of vulnerable servers
available in the Internet
28. Internet of Things
• Webcams, routers, smartphones, coffee makers
• Cheap hardware and software
• (Little to) NO software updates
29. Internet of Things
• Webcams, routers, smartphones, coffee makers
• Cheap hardware and software
• (Little to) NO software updates, including security fixes
30. Internet of Things
• Webcams, routers, smartphones, coffee makers
• Cheap hardware and software
• (Little to) NO software updates, including security fixes
•Default logins/passwords
31. Internet of Things
• Webcams, routers, smartphones, coffee makers
• Cheap hardware and software
• (Little to) NO software updates, including security fixes
•Default logins/passwords
•Full Internet access
32. Internet of Things
• Webcams, routers, smartphones, coffee makers
• Cheap hardware and software
• (Little to) NO software updates, including security fixes
•Default logins/passwords
•Full Internet access
•And all it takes – a crawler.
33.
34. 21:30:01.226868 IP 94.251.116.51 > 178.248.233.141:
GREv0, length 544:
IP 184.224.242.144.65323 > 167.42.221.164.80:
UDP, length 512
21:30:01.226873 IP 46.227.212.111 > 178.248.233.141:
GREv0, length 544:
IP 90.185.119.106.50021 > 179.57.238.88.80:
UDP, length 512
21:30:01.226881 IP 46.39.29.150 > 178.248.233.141:
GREv0, length 544:
IP 31.173.79.118.42580 > 115.108.7.79.80:
UDP, length 512
35. 21:30:01.226868 IP 94.251.116.51 > 178.248.233.141:
GREv0, length 544:
IP 184.224.242.144.65323 > 167.42.221.164.80:
UDP, length 512
21:30:01.226873 IP 46.227.212.111 > 178.248.233.141:
GREv0, length 544:
IP 90.185.119.106.50021 > 179.57.238.88.80:
UDP, length 512
21:30:01.226881 IP 46.39.29.150 > 178.248.233.141:
GREv0, length 544:
IP 31.173.79.118.42580 > 115.108.7.79.80:
UDP, length 512