Sneak peek preview area 41 conference Zürich 10. - 11- June 2016
•
0 likes•224 views
Meet me at the http://area41.io/ conference #area41 #a41con. Join my session on June 11th afternoon. I will reveal some exclusive social engineering content. Here a sneak peak preview. Cheers Dom The premier technical security conference in Switzerland organized by DEFCON Switzerland. The next Area41 conference will be held June 10.-11.2016 in Zurich
Report
Share
Report
Share
Download to read offline
Recommended
Video integrated teaser awareness campaign seef
Are you still old school social engineering? Get an update
Press release social engineering engagement framework seef social engineering...
BURGISTEIN, Switzerland, September 1st 2016 - Dominique C. Brack, known as D#fu5e and VP of operations at social engineering engagement framework (SEEF), will release the first known social engineering icons, today.
The SEEF social engineering Icons are a powerful visual tool, allowing users to identify a message, without having to think. People recognize icons faster than words. Visual perception is one of the most productive ways through which people can obtain information and process it.
Until today, social engineering had no icons to describe social engineering attack vectors in a detailed and appealing way. The extensive collection of social engineering icons includes icons for: well-known attack vectors, like phishing, dumpster diving, tailgating, or eavesdropping, and for less known attack vectors like: befriending, reciprocation, shoulder surfing, or impersonation. In total, there about 38 icons.
Teaser SEEF hack in Paris presentation
“Intrusion attempts are more and more frequent and sophisticated, regardless of their target (state or corporation). In this context, international hacking events are multiplying. Hack In Paris attendees will discover the realities of hacking, and its consequences for companies.
“The program includes state of the art IT security, industrial espionage, penetration testing, physical security, forensics, malware analysis techniques and countermeasures.
The one-week event consists of three days of training and two days of conferences – all in English – bringing together security officers (CISOs, CIOs) and hacking technical experts.
Hack in Paris is being held from the 27th June – July 1st 2016 at la Maison De la Chimie, Paris.
Press release social engineering engagement framework seef social engineering...
BURGISTEIN, Switzerland, September 1st 2016 - Dominique C. Brack, known as D#fu5e and VP of operations at social engineering engagement framework (SEEF), will release the first known social engineering icons, today.
The SEEF social engineering Icons are a powerful visual tool, allowing users to identify a message, without having to think. People recognize icons faster than words. Visual perception is one of the most productive ways through which people can obtain information and process it.
Until today, social engineering had no icons to describe social engineering attack vectors in a detailed and appealing way. The extensive collection of social engineering icons includes icons for: well-known attack vectors, like phishing, dumpster diving, tailgating, or eavesdropping, and for less known attack vectors like: befriending, reciprocation, shoulder surfing, or impersonation. In total, there about 38 icons.
eMetrics London - The AB Testing Hype Cycle
My talk at eMetrics about how to escape from stupid testing that doesn't work.
Press release 01_september_2016_social_engineering_engagement_framework_seef_...
Dominique C. Brack, known as D#fu5e and VP of operations at social engineering engagement framework (SEEF), will release the first known human-to-social-engineering interface, today.
The SEEF human-to-social-engineering interface is a powerful visual tool, allowing users to set social engineering parameter of an individual person, without having to think.
Until today, social engineering had no human-to-social-engineering interface to plant social engineering attack vectors in a detailed and appealing way.
Towards Secure and Interpretable AI: Scalable Methods, Interactive Visualizat...
We have witnessed tremendous growth in Artificial intelligence (AI) and machine learning (ML) recently. However, research shows that AI and ML models are often vulnerable to adversarial attacks, and their predictions can be difficult to understand, evaluate and ultimately act upon.
Discovering real-world vulnerabilities of deep neural networks and countermeasures to mitigate such threats has become essential to successful deployment of AI in security settings. We present our joint works with Intel which include the first targeted physical adversarial attack (ShapeShifter) that fools state-of-the-art object detectors; a fast defense (SHIELD) that removes digital adversarial noise by stochastic data compression; and interactive systems (ADAGIO and MLsploit) that further democratize the study of adversarial machine learning and facilitate real-time experimentation for deep learning practitioners.
Finally, we also present how scalable interactive visualization can be used to amplify people’s ability to understand and interact with large-scale data and complex models. We sample from projects where interactive visualization has provided key leaps of insight, from increased model interpretability (Gamut with Microsoft Research), to model explorability with models trained on millions of instances (ActiVis deployed with Facebook), increased usability for non-experts about state-of-the-art AI (GAN Lab open-sourced with Google Brain; went viral!), and our latest work Summit, an interactive system that scalably summarizes and visualizes what features a deep learning model has learned and how those features interact to make predictions. We conclude by highlighting the next visual analytics research frontiers in AI.
=== Presenter Bio ===
Polo Chau
Associate Professor and ML Area Leader, College of Computing
Associate Director, MS Analytics
Georgia Institute of Technology
Polo Chau is an Associate Professor of Computing at Georgia Tech. He co-directs Georgia Tech's MS Analytics program. His research group bridges machine learning and visualization to synthesize scalable interactive tools for making sense of massive datasets, interpreting complex AI models, and solving real world problems in cybersecurity, human-centered AI, graph visualization and mining, and social good. His Ph.D. in Machine Learning from Carnegie Mellon University won CMU's Computer Science Dissertation Award, Honorable Mention. He received awards and grants from NSF, NIH, NASA, DARPA, Intel (Intel Outstanding Researcher), Symantec, Google, Nvidia, IBM, Yahoo, Amazon, Microsoft, eBay, LexisNexis; Raytheon Faculty Fellowship; Edenfield Faculty Fellowship; Outstanding Junior Faculty Award; The Lester Endowment Award; Symantec fellowship (twice); Best student papers at SDM'14 and KDD'16 (runner-up); Best demo at SIGMOD'17 (runner-up); Chinese CHI'18 Best paper. His research led to open-sourc
Recommended
Video integrated teaser awareness campaign seef
Are you still old school social engineering? Get an update
Press release social engineering engagement framework seef social engineering...
BURGISTEIN, Switzerland, September 1st 2016 - Dominique C. Brack, known as D#fu5e and VP of operations at social engineering engagement framework (SEEF), will release the first known social engineering icons, today.
The SEEF social engineering Icons are a powerful visual tool, allowing users to identify a message, without having to think. People recognize icons faster than words. Visual perception is one of the most productive ways through which people can obtain information and process it.
Until today, social engineering had no icons to describe social engineering attack vectors in a detailed and appealing way. The extensive collection of social engineering icons includes icons for: well-known attack vectors, like phishing, dumpster diving, tailgating, or eavesdropping, and for less known attack vectors like: befriending, reciprocation, shoulder surfing, or impersonation. In total, there about 38 icons.
Teaser SEEF hack in Paris presentation
“Intrusion attempts are more and more frequent and sophisticated, regardless of their target (state or corporation). In this context, international hacking events are multiplying. Hack In Paris attendees will discover the realities of hacking, and its consequences for companies.
“The program includes state of the art IT security, industrial espionage, penetration testing, physical security, forensics, malware analysis techniques and countermeasures.
The one-week event consists of three days of training and two days of conferences – all in English – bringing together security officers (CISOs, CIOs) and hacking technical experts.
Hack in Paris is being held from the 27th June – July 1st 2016 at la Maison De la Chimie, Paris.
Press release social engineering engagement framework seef social engineering...
BURGISTEIN, Switzerland, September 1st 2016 - Dominique C. Brack, known as D#fu5e and VP of operations at social engineering engagement framework (SEEF), will release the first known social engineering icons, today.
The SEEF social engineering Icons are a powerful visual tool, allowing users to identify a message, without having to think. People recognize icons faster than words. Visual perception is one of the most productive ways through which people can obtain information and process it.
Until today, social engineering had no icons to describe social engineering attack vectors in a detailed and appealing way. The extensive collection of social engineering icons includes icons for: well-known attack vectors, like phishing, dumpster diving, tailgating, or eavesdropping, and for less known attack vectors like: befriending, reciprocation, shoulder surfing, or impersonation. In total, there about 38 icons.
eMetrics London - The AB Testing Hype Cycle
My talk at eMetrics about how to escape from stupid testing that doesn't work.
Press release 01_september_2016_social_engineering_engagement_framework_seef_...
Dominique C. Brack, known as D#fu5e and VP of operations at social engineering engagement framework (SEEF), will release the first known human-to-social-engineering interface, today.
The SEEF human-to-social-engineering interface is a powerful visual tool, allowing users to set social engineering parameter of an individual person, without having to think.
Until today, social engineering had no human-to-social-engineering interface to plant social engineering attack vectors in a detailed and appealing way.
Towards Secure and Interpretable AI: Scalable Methods, Interactive Visualizat...
We have witnessed tremendous growth in Artificial intelligence (AI) and machine learning (ML) recently. However, research shows that AI and ML models are often vulnerable to adversarial attacks, and their predictions can be difficult to understand, evaluate and ultimately act upon.
Discovering real-world vulnerabilities of deep neural networks and countermeasures to mitigate such threats has become essential to successful deployment of AI in security settings. We present our joint works with Intel which include the first targeted physical adversarial attack (ShapeShifter) that fools state-of-the-art object detectors; a fast defense (SHIELD) that removes digital adversarial noise by stochastic data compression; and interactive systems (ADAGIO and MLsploit) that further democratize the study of adversarial machine learning and facilitate real-time experimentation for deep learning practitioners.
Finally, we also present how scalable interactive visualization can be used to amplify people’s ability to understand and interact with large-scale data and complex models. We sample from projects where interactive visualization has provided key leaps of insight, from increased model interpretability (Gamut with Microsoft Research), to model explorability with models trained on millions of instances (ActiVis deployed with Facebook), increased usability for non-experts about state-of-the-art AI (GAN Lab open-sourced with Google Brain; went viral!), and our latest work Summit, an interactive system that scalably summarizes and visualizes what features a deep learning model has learned and how those features interact to make predictions. We conclude by highlighting the next visual analytics research frontiers in AI.
=== Presenter Bio ===
Polo Chau
Associate Professor and ML Area Leader, College of Computing
Associate Director, MS Analytics
Georgia Institute of Technology
Polo Chau is an Associate Professor of Computing at Georgia Tech. He co-directs Georgia Tech's MS Analytics program. His research group bridges machine learning and visualization to synthesize scalable interactive tools for making sense of massive datasets, interpreting complex AI models, and solving real world problems in cybersecurity, human-centered AI, graph visualization and mining, and social good. His Ph.D. in Machine Learning from Carnegie Mellon University won CMU's Computer Science Dissertation Award, Honorable Mention. He received awards and grants from NSF, NIH, NASA, DARPA, Intel (Intel Outstanding Researcher), Symantec, Google, Nvidia, IBM, Yahoo, Amazon, Microsoft, eBay, LexisNexis; Raytheon Faculty Fellowship; Edenfield Faculty Fellowship; Outstanding Junior Faculty Award; The Lester Endowment Award; Symantec fellowship (twice); Best student papers at SDM'14 and KDD'16 (runner-up); Best demo at SIGMOD'17 (runner-up); Chinese CHI'18 Best paper. His research led to open-sourc
Security researchers participate in conferences such as DefCon t.docx
Security researchers participate in conferences such as DefCon to demonstrate the vulnerabilities of products or present new security tools. For example, DefCon is one of the world's largest hacker conventions, held annually in Las Vegas, Nevada and tens of researchers showcase their work at this conference. Last year in DefCon 2020, researchers presented their recent research on hacking phones, cars, satellite communications, traffic lights, smart home devices, printers, and popular software services, among many others. However, some of these talks require ethical reflection on the harms of these disclosures.
We present two examples here to compare and consider from an ethical viewpoint.
A. At DefCon 2020, two researchers (Wesley Neelen and Rik van Duijn) at Netherlands-based applied security research company Zolder, showed how they hacked a traffic light management system that is connected to a smartphone app. They talked about how a hacker could
remotely control traffic lights
. The affected product is used in over 10 municipalities in the Netherlands.
Assume that Wesley and Rik informed these 10 municipalities regarding these issues in the Netherlands, however, only one of them (e.g., Utrecht) took the right action to minimize these risks. Please watch the following YouTube link to get more information about this research talk.
https://www.youtube.com/watch?v=L9UUD3a7xP4
B. At DefCon 2017, two researchers (Josh Schwartz and John Cramb) of Salesforce (i.e., members of the Red Team) aimed to reveal MEATPISTOL, a modular malware framework for implant creation, infrastructure automation, and shell interaction, aimed at reducing the time and energy spent on reconfiguration and rewriting malware. The tool does not launch attacks or exploit systems, but it allows red teamers to control the system once access has been granted. MEATPISTOL was pitched as taking the boring work out of pen-testing to make red teams, including at Salesforce, more efficient and effective. Also, they aimed to make it open-source tool so that other security researchers can improve it. However, an executive at Salesforce told them not to release it as open source because it could be used by hackers for other purposes. Just an hour before they were expected on stage, a Salesforce executive sent a text message to Josh and John for
not to give this talk
. However, the message was not seen until after the talk had ended. On stage, Schwartz told attendees that he would fight to get the tool published. The two researchers were fired as soon as they got off stage by a senior Salesforce executive. Several security researchers criticized Salesforce following the firing, and the community has since forwarded these two researchers a number of job offers. You can watch their talk from the following link.
https://www.youtube.com/watch?v=dbIdo9ilEIY
Answer the following questions based on these two case studies:
Question 1 Stakeholders and Potential Harms/Benefits
(1%)
.
20 Jobs of the Future
In the past, careers were stable, linear and singular. People chose one path and pursued it over the course of their lives from college to retirement. In our modern age of technology driven exponential change - this model no longer works.
Careers are now complex, fragmented, specialized, collaborative and ever evolving. More often than not, our work life will be made up of a portfolio of micro-careers.
This presentation will show you a snapshot of 20 careers that will likely come of age in the next 10 years. Some of these jobs exist now, but will come into greater demand soon. Others do not exist yet, but through our daily scanning of future fringe signals we see strong potential in their emergence.
World of Watson 2016 - Information Insecurity
We call it security, however we’re really dealing with our insecurities, especially around our information.
The recent Yahoo announcement is astonishing, not because it happened or the number of people potentially exposed, but for the time it took to realize it had happened – approximately 2 years(?)! Information is the lifeblood of Analytics. We need it and we need to protect it. Check out these sessions to see what’s new in addressing our Insecurities about our Information.
Visual thinking for service design — CanUX November 2016
The success of service design involves an organisation's ability to restructure itself towards the design and delivery of services in a meaningful, impactful way. Visual thinking provide a powerful means for diverse teams to work through complexity. This workshop introduces visual thinking as an approach to solve service design problems, involving methods like rapid visualisation, visual sensemaking, touchpoint sketching, rich pictures, and service posters.
Múltiplas Facetas do Design, Pedro Scaramuzza
Olhar sobre as transformações do design, aplicações e coisas que vejo por aí + design no SXSW14. Ah, carro tb :- )
Social Innovations for Urban Sustainability: Towards Smarter Cities
Seminar in DICE (Digital Design, Innovation, Creativity and Enterprise) in the joint program between Dublin University and PNU #DCUPNU on Nov 4, 2015 in Riyadh, Saudi Arabia.
[MIX2018]用戶體驗於人工智慧時代的挑戰 - 許伯圳／Microsoft SwiftKey 首席工程師
透過日趨精準的預測，人工智慧將可以大幅改善用戶經驗。同時，這也在介面和互動設計上帶來新的挑戰。人工智慧的演算法能帶來更多的方便，但也可能出現使用者無法預測的行為。我們該怎麼做才能在提供智能預測的同時，保持使用者的主控權？我們能怎麼透過介面設計的引導，幫助使用者利用智能預測達到他們想要的結果？在這次演講中，我將探討設計在人工智慧時代所面臨的挑戰，並分享我們在研發行動裝置的輸入法與影像辨識中所得到的經驗。
The difference between a duck
Presentation by Haroon Meer at IDC in 2006.
The presentation begins with a discussion on google hacking. There is a brief discussion on Kernel-rootkits. The presentation ends with a discussion
on web application hacking.
WSO2CONMay2024OpenSourceConferenceDebrief.pptx
A recap of interesting points and quotes from the May 2024 WSO2CON opensource application development conference. Focuses primarily on keynotes and panel sessions.
Hax at CentraleSupelec
Talk given at CentraleSupelec in Paris on December 2015. Ideas on hardware startups, entrepreneurship, ecosystems and more.
Sicherheit welche gefahren durch drohnen drohen golem.de
Flugobjekte mit biologischen Kampfstoffen, Motorsäge oder Pistole: 140 Risiken durch Drohnen hat der Sicherheitsexterte Dominique Brack gesammelt. Die geplanten Angriffe sind dabei gar nicht die schlimmsten.
Der für das Schweizer Telekommunikationsunternehmen Swisscom tätige Sicherheitsexperte Dominique Brack analysiert zusammen mit anderen Anbietern kritischer Infrastrukturen mögliche Angriffsszenarien mit kommerziell erhältlichen Drohnen. Auf der Sicherheitskonferenz Deepsec in Wien hat er seine Ergebnisse vorgestellt.
Intensity levels social engineering engagement framework (seef) first cut d...
Intensity Levels
Intensity level ratings are a unique feature of SEEF’s methods.
The intensity levels are represented by a table of levels ranging
from 1–12, with Level 1 being the least risky and Level 12 the
highest possible risk. The table can be used for planning and scoping social engineering engagements, on a personal level or as company policy. Attack vectors are also developed and based on predefined intensity levels. Levels 1– 3 (green) represent low risk and small potential for legal implications. The green levels mainly contain Open Source Intelligence (OSINT), limited scope (local/ national) and preservation of a person’s or company’s integrity. Levels 4–6 (orange) are medium risk with potential for legal ramifications and include invasive, intrusive or ethically questionable, international or VIP engagements. Levels 7–-9 (red) involve coercion, felonies, high-profile political or medially present organizations or individuals, and risk of collateral damages. Levels 10-12 (black) are highly
illegal, including treason, breach of international law, possible death sentences, cyber warfare, industrial espionage, and loss of lives. Donot engage!
Artikel About Drones and Swisscom Innovation Startup Process
Artikel About Drones and Swisscom Innovation Startup Process. Authors Dominique Brack and Klaus Gribi.
DRONES THE NEW WEAPON OF CHOICE - ALSO FOR HACKERS
My talk will be about drone threats in general and how you can assess drone based threats. I will show the comprehensive threat assessment methodology and the countermeasures you can take against the drone threat. The threat assessment is based on a catalog of about 140 items. Particularly interesting will be looking at the drone threats in relation to:
Planting payload at specific locations (i.e. hacking equipment transported to target location for instance)
Tampering communication equipment with the help of drones
Insider threat communicate with an insider with the help of a drone
Hacking the communication of a drone
Privacy violations
etc.
Quantum Computing Shor algorithm crypto grafic IoT risk management
Das Internet of Things (IoT) verbreitet sich immer mehr, wegen seiner rasanten Entwicklung gerät die Informationssicherheit ins Hintertreffen. Neue Technologien wie Quantum Computing ver schärfen die Situation zusätzlich. Bewährte Sicherheitsmechanismen wie Verschlüsselung
bieten künftig nicht mehr genügend Sicherheit, sobald
der erste Quantum Computer verfügbar sein wird.
Business shoes looking inconspicuous but still enough power to climb a wall o...
Everyone knows business shoes and everyone knows climbing shoes or the soles used by most of them. I never understood why business shoes have this stupid slippery useless soles on them.
It was always my dream to create a combination of a great business shoe with a great sole. My local shoemaker created this wonder for me after my wife encourage me to ask him if he could such a thing. Took some convincing though – since no one does this and it could go wrong.
It got them for my birthday. You can do this with any business shoe. The hard part is finding a capable shoemaker for mounting your Vibram soles onto a pair of business shoes.
As shoe I used a local known Swiss brand Fretzmen. If you want the contact details of my capable shoemaker let me know.
More Related Content
Similar to Sneak peek preview area 41 conference Zürich 10. - 11- June 2016
Security researchers participate in conferences such as DefCon t.docx
Security researchers participate in conferences such as DefCon to demonstrate the vulnerabilities of products or present new security tools. For example, DefCon is one of the world's largest hacker conventions, held annually in Las Vegas, Nevada and tens of researchers showcase their work at this conference. Last year in DefCon 2020, researchers presented their recent research on hacking phones, cars, satellite communications, traffic lights, smart home devices, printers, and popular software services, among many others. However, some of these talks require ethical reflection on the harms of these disclosures.
We present two examples here to compare and consider from an ethical viewpoint.
A. At DefCon 2020, two researchers (Wesley Neelen and Rik van Duijn) at Netherlands-based applied security research company Zolder, showed how they hacked a traffic light management system that is connected to a smartphone app. They talked about how a hacker could
remotely control traffic lights
. The affected product is used in over 10 municipalities in the Netherlands.
Assume that Wesley and Rik informed these 10 municipalities regarding these issues in the Netherlands, however, only one of them (e.g., Utrecht) took the right action to minimize these risks. Please watch the following YouTube link to get more information about this research talk.
https://www.youtube.com/watch?v=L9UUD3a7xP4
B. At DefCon 2017, two researchers (Josh Schwartz and John Cramb) of Salesforce (i.e., members of the Red Team) aimed to reveal MEATPISTOL, a modular malware framework for implant creation, infrastructure automation, and shell interaction, aimed at reducing the time and energy spent on reconfiguration and rewriting malware. The tool does not launch attacks or exploit systems, but it allows red teamers to control the system once access has been granted. MEATPISTOL was pitched as taking the boring work out of pen-testing to make red teams, including at Salesforce, more efficient and effective. Also, they aimed to make it open-source tool so that other security researchers can improve it. However, an executive at Salesforce told them not to release it as open source because it could be used by hackers for other purposes. Just an hour before they were expected on stage, a Salesforce executive sent a text message to Josh and John for
not to give this talk
. However, the message was not seen until after the talk had ended. On stage, Schwartz told attendees that he would fight to get the tool published. The two researchers were fired as soon as they got off stage by a senior Salesforce executive. Several security researchers criticized Salesforce following the firing, and the community has since forwarded these two researchers a number of job offers. You can watch their talk from the following link.
https://www.youtube.com/watch?v=dbIdo9ilEIY
Answer the following questions based on these two case studies:
Question 1 Stakeholders and Potential Harms/Benefits
(1%)
.
20 Jobs of the Future
In the past, careers were stable, linear and singular. People chose one path and pursued it over the course of their lives from college to retirement. In our modern age of technology driven exponential change - this model no longer works.
Careers are now complex, fragmented, specialized, collaborative and ever evolving. More often than not, our work life will be made up of a portfolio of micro-careers.
This presentation will show you a snapshot of 20 careers that will likely come of age in the next 10 years. Some of these jobs exist now, but will come into greater demand soon. Others do not exist yet, but through our daily scanning of future fringe signals we see strong potential in their emergence.
World of Watson 2016 - Information Insecurity
We call it security, however we’re really dealing with our insecurities, especially around our information.
The recent Yahoo announcement is astonishing, not because it happened or the number of people potentially exposed, but for the time it took to realize it had happened – approximately 2 years(?)! Information is the lifeblood of Analytics. We need it and we need to protect it. Check out these sessions to see what’s new in addressing our Insecurities about our Information.
Visual thinking for service design — CanUX November 2016
The success of service design involves an organisation's ability to restructure itself towards the design and delivery of services in a meaningful, impactful way. Visual thinking provide a powerful means for diverse teams to work through complexity. This workshop introduces visual thinking as an approach to solve service design problems, involving methods like rapid visualisation, visual sensemaking, touchpoint sketching, rich pictures, and service posters.
Múltiplas Facetas do Design, Pedro Scaramuzza
Olhar sobre as transformações do design, aplicações e coisas que vejo por aí + design no SXSW14. Ah, carro tb :- )
Social Innovations for Urban Sustainability: Towards Smarter Cities
Seminar in DICE (Digital Design, Innovation, Creativity and Enterprise) in the joint program between Dublin University and PNU #DCUPNU on Nov 4, 2015 in Riyadh, Saudi Arabia.
[MIX2018]用戶體驗於人工智慧時代的挑戰 - 許伯圳／Microsoft SwiftKey 首席工程師
透過日趨精準的預測，人工智慧將可以大幅改善用戶經驗。同時，這也在介面和互動設計上帶來新的挑戰。人工智慧的演算法能帶來更多的方便，但也可能出現使用者無法預測的行為。我們該怎麼做才能在提供智能預測的同時，保持使用者的主控權？我們能怎麼透過介面設計的引導，幫助使用者利用智能預測達到他們想要的結果？在這次演講中，我將探討設計在人工智慧時代所面臨的挑戰，並分享我們在研發行動裝置的輸入法與影像辨識中所得到的經驗。
The difference between a duck
Presentation by Haroon Meer at IDC in 2006.
The presentation begins with a discussion on google hacking. There is a brief discussion on Kernel-rootkits. The presentation ends with a discussion
on web application hacking.
WSO2CONMay2024OpenSourceConferenceDebrief.pptx
A recap of interesting points and quotes from the May 2024 WSO2CON opensource application development conference. Focuses primarily on keynotes and panel sessions.
Hax at CentraleSupelec
Talk given at CentraleSupelec in Paris on December 2015. Ideas on hardware startups, entrepreneurship, ecosystems and more.
Similar to Sneak peek preview area 41 conference Zürich 10. - 11- June 2016 (15)
Security researchers participate in conferences such as DefCon t.docx
Security researchers participate in conferences such as DefCon t.docx
Visual thinking for service design — CanUX November 2016
Visual thinking for service design — CanUX November 2016
Unlimited Attempts AllowedDetails Virtual Sniffing Social Engineering Conside...
Unlimited Attempts AllowedDetails Virtual Sniffing Social Engineering Conside...
Social Innovations for Urban Sustainability: Towards Smarter Cities
Social Innovations for Urban Sustainability: Towards Smarter Cities
[MIX2018]用戶體驗於人工智慧時代的挑戰 - 許伯圳／Microsoft SwiftKey 首席工程師
[MIX2018]用戶體驗於人工智慧時代的挑戰 - 許伯圳／Microsoft SwiftKey 首席工程師
Scaling SlideShare to the World - An Asian Perpective
Scaling SlideShare to the World - An Asian Perpective
More from Reputelligence
Sicherheit welche gefahren durch drohnen drohen golem.de
Flugobjekte mit biologischen Kampfstoffen, Motorsäge oder Pistole: 140 Risiken durch Drohnen hat der Sicherheitsexterte Dominique Brack gesammelt. Die geplanten Angriffe sind dabei gar nicht die schlimmsten.
Der für das Schweizer Telekommunikationsunternehmen Swisscom tätige Sicherheitsexperte Dominique Brack analysiert zusammen mit anderen Anbietern kritischer Infrastrukturen mögliche Angriffsszenarien mit kommerziell erhältlichen Drohnen. Auf der Sicherheitskonferenz Deepsec in Wien hat er seine Ergebnisse vorgestellt.
Intensity levels social engineering engagement framework (seef) first cut d...
Intensity Levels
Intensity level ratings are a unique feature of SEEF’s methods.
The intensity levels are represented by a table of levels ranging
from 1–12, with Level 1 being the least risky and Level 12 the
highest possible risk. The table can be used for planning and scoping social engineering engagements, on a personal level or as company policy. Attack vectors are also developed and based on predefined intensity levels. Levels 1– 3 (green) represent low risk and small potential for legal implications. The green levels mainly contain Open Source Intelligence (OSINT), limited scope (local/ national) and preservation of a person’s or company’s integrity. Levels 4–6 (orange) are medium risk with potential for legal ramifications and include invasive, intrusive or ethically questionable, international or VIP engagements. Levels 7–-9 (red) involve coercion, felonies, high-profile political or medially present organizations or individuals, and risk of collateral damages. Levels 10-12 (black) are highly
illegal, including treason, breach of international law, possible death sentences, cyber warfare, industrial espionage, and loss of lives. Donot engage!
Artikel About Drones and Swisscom Innovation Startup Process
Artikel About Drones and Swisscom Innovation Startup Process. Authors Dominique Brack and Klaus Gribi.
DRONES THE NEW WEAPON OF CHOICE - ALSO FOR HACKERS
My talk will be about drone threats in general and how you can assess drone based threats. I will show the comprehensive threat assessment methodology and the countermeasures you can take against the drone threat. The threat assessment is based on a catalog of about 140 items. Particularly interesting will be looking at the drone threats in relation to:
Planting payload at specific locations (i.e. hacking equipment transported to target location for instance)
Tampering communication equipment with the help of drones
Insider threat communicate with an insider with the help of a drone
Hacking the communication of a drone
Privacy violations
etc.
Quantum Computing Shor algorithm crypto grafic IoT risk management
Das Internet of Things (IoT) verbreitet sich immer mehr, wegen seiner rasanten Entwicklung gerät die Informationssicherheit ins Hintertreffen. Neue Technologien wie Quantum Computing ver schärfen die Situation zusätzlich. Bewährte Sicherheitsmechanismen wie Verschlüsselung
bieten künftig nicht mehr genügend Sicherheit, sobald
der erste Quantum Computer verfügbar sein wird.
Business shoes looking inconspicuous but still enough power to climb a wall o...
Everyone knows business shoes and everyone knows climbing shoes or the soles used by most of them. I never understood why business shoes have this stupid slippery useless soles on them.
It was always my dream to create a combination of a great business shoe with a great sole. My local shoemaker created this wonder for me after my wife encourage me to ask him if he could such a thing. Took some convincing though – since no one does this and it could go wrong.
It got them for my birthday. You can do this with any business shoe. The hard part is finding a capable shoemaker for mounting your Vibram soles onto a pair of business shoes.
As shoe I used a local known Swiss brand Fretzmen. If you want the contact details of my capable shoemaker let me know.
Seef ebook promotion 18 dez-2015 dcb
If you are observing the social engineering landscape in terms of social engineers, documentation, and frameworks out there, you will realize the topic has, as we call it, a low maturity. Low maturity means there are no well-defined processes or defined frameworks in which professionals can apply and benchmark themselves. Today’s landscape is little like the Wild West. There is lot of fear, uncertainty, and doubt (FUD).
With SEEF we want to oppose this situation. As you maybe have seen, our motto is visible on the book covers badge: Docendo – Discimus. It is a Latin proverb and means: “By teaching, we learn.” This is what we want. We want to teach anyone interested in social engineering the skills to do it properly, professionally, and ethically. This is Social Engineering Engagement Management (SEEF) — FIRST CUT. It is literally the first cut of the framework that we have pioneered and want to share.
Reputelligence lifecycle v3 Volkswagen "defeat device"
May 2014 There was a line up to the problem. It was not sudden. There was time to fix the problem without shortcuts (1 year). Before the problem got out of hand (involvement of authorities).
Big mistake N#1 (unintentionally or intentionally): Volkswagen tells regulators that the differences amount to technical issues and "unexpected" test conditions. First try to cover up or the start of workarounds? Protective statement.
Recall in December 2014. Because the problem couldn't be fixed? The intention to “doctor” could also have been started here.
May 2015 next governmental involvement. Second chance to make things right i.e. coming forward or disclose voluntarily.
July 2015 point of no return. Third chance for a coming out or getting a handle on the problem.
September 2015 problem total out of control on all levels; politically, technically, environmentally, reputation wise.
Reputelligence Lifecycle v3 Volkswagen example
This is lifecycle applied to the Volkswagen "defeat device" problem. It show the lead up to the eruption of the problem on September 18th. Many things followed after that but they will be analysed in another problem lifecycle zooming in on those dates.
«Se Klaud Brojäkt bräiks daun – wot is se först sing yu du?» Hä?
Cloud readiness can be reduced to one simple statement. You don't need a maturity assessment or expensive consultants :-). Have you a working information classification policy? f yes: congratulations you can go now you will be fine. «Se Klaud Brojäkt bräiks daun – wot is se först sing yu du?»
Hä?
U blame se Se Ei O.
No no no, you dreamer you hä dream on. Ei tell dir okey.
Se sewen sinking steps.
1. Finding the right (or left) broblem to solve
2. Sefining the broblem
3. Analysing the broblem
4. Developing bossibilities
5. Selecting se best solution
6. Implementing
7. Evaluating and lörning
Reputelligence power point template lifecycle v3
Today, good news -- or bad news -- breaks in real time. And anything can go viral in short order. This is great for cute babies laughing in videos, or heart-warming tales of good deeds. It's not great, however, for the unexpected, inevitable crisis that any organization will face in its existence at some point. Luckily, nothing in the social media world is too much different than in the "real world."
What is the problem you might ask?
Problems (real- and digital world) usually follow a very specific pattern and dynamic. Understanding the patterns and dynamic behind will significantly improve resiliency. When does an incident become a crisis?
Managing a massive crisis is very difficult because of the information asymmetry.
Defining where you stand in a crisis is even more difficult.
Complex problem or crisis management requires specific techniques and tools. Numerous examples of bad crisis management are known to everyone. If you are managing a crisis from the inside you need actual up to date information on the current situation (where are we) and next steps (what are we going to do next). So far this was a very hard task. Either you have been at the will of a hopefully decent crisis manager or PR firm.
The lack of transparency always bugged me. I was to set out to look for ways of making the problem mangement or crisis management process more transparent for everyone involved.
I always take a highly strategic view of things and aim for practical application and simplification.
Out of this came the Reputelligence™ Problem LifeCycle. At first it looks overwhelming but i will guide you through the construction. This will help you understand the principles behind the life-cycle so you can apply it in your context.
Security agility- dynamic policy creation and rollout
The following example of a recent story is the perfect analogy for dynamic policy creation. The Swiss MediaMarket (Electronics Chain) reacted amicably when we were presented with a heat wave. All over the news people where warned about the topic of leaving your children or your pets in the car. Unfortunately there where fatalities due to the practice of leaving small children in the car. There was a lot of talk but MediaMarkt spun into action. This story has all the ingredients for future security (advanced persistent threats) APT's and how you will have to deal with them. The same process' will have to be applied to your policy framework.
Hack back series data is an asset - registration strategies v0.1
If there is just one thing you need to remember about information security it's this: "Data is an asset & asset = money"
This is all there is you need to know for information security. I also work on volunteering for a hacker high school project and the most important thing about security I try to teach the teenagers is this. "Data is an asset"
Usually I do it this way: I will have some coins at hand for this. Then I make a list together with the teenagers with attributes they use for registration for a so called "free" service. "If it's free then U are the product in some way or form". The problem with data is an asset is: it's abstract. Giving away information bytes is painless, easy and of no consequence in the first place. So I need to make a connection for the teenagers to remember or to link in the brain: data is an asset. Now the abstract concept of "Data is an asset" has been linked. The discussions becomes focused around: what do I get in return for the money (asset: your name) I paid for. Where is my freedom? Why do I don't get money if people are making money from my data and information (advertising). I should get paid if my information is used to make profit. I shouldn't reveal my information too easily.
Hack back series how to spot fake linked in profiles - a way to figure out f...
Hack back series is all about YOU and how I can contribute to make the internet a safer place for everyone.
LinkedIn Forensic for the standard user. I like to guide you through a forensic approach to check for false profile pictures and false profiles on LinkedIn .
The techniques you learn will are essentials skills now and in the future.
More and more you will have to do this in the digital world since attacks, scams and scum bags are upsizing their attack intelligence.
Protect yourself and become more diligent in the use of digital media.
Sgs cloud 5 mar-2015 bsl dominique c. brack csach - public version
There is no excuse not to use cloud services anymore – except the organisation itself is not ready for it.
Clinton article
If not even a former first lady or future presidential candidate “gets it”, what's wrong with information security awareness? Of course responsibility comes with the person using services but what about the information security adviser? Was this partially his fault too? Had he any change to raise his voice for promoting information security awareness? Fact is we all know how hard it is to train VIP’s, senior executives or developers ;-) in the matter of information security awareness (I am not talking about the great guys out there advocating information security on all levels and ranks, I am talking about the main stream people). At least I could tell you some great stories about my personal experiences with it (next time maybe).
Dumb and dumber or fast and furious
The car industry is now at the exact same point the IT industry was decades ago. The problem is security has not been built into those system rather is has been bolted on. It is saddening to see all the past failures of the software industry have to be repeated by the car industry.
New microsoft power point präsentation
EN- Teaser for tonight's cloud presentation. Will share all the slides after the event. The graphic depicts the typical cloud project phases. Honeymoon (everyone on their horses and charge!), eclipse (oh oh first shadows), etc.
DE- Kleiner Ausblick in die Präsentation von heute Abend. Der Ausschnitt zeigt die Projekt Phasen bei einem Cloud Projekt. Die Hochzeits- Reise Phase (Alles klar sofort loslegen-Action!)
More from Reputelligence (20)
Sicherheit welche gefahren durch drohnen drohen golem.de
Sicherheit welche gefahren durch drohnen drohen golem.de
Intensity levels social engineering engagement framework (seef) first cut d...
Intensity levels social engineering engagement framework (seef) first cut d...
Artikel About Drones and Swisscom Innovation Startup Process
Artikel About Drones and Swisscom Innovation Startup Process
DRONES THE NEW WEAPON OF CHOICE - ALSO FOR HACKERS
DRONES THE NEW WEAPON OF CHOICE - ALSO FOR HACKERS
Quantum Computing Shor algorithm crypto grafic IoT risk management
Quantum Computing Shor algorithm crypto grafic IoT risk management
Business shoes looking inconspicuous but still enough power to climb a wall o...
Business shoes looking inconspicuous but still enough power to climb a wall o...
Reputelligence lifecycle v3 Volkswagen "defeat device"
Reputelligence lifecycle v3 Volkswagen "defeat device"
«Se Klaud Brojäkt bräiks daun – wot is se först sing yu du?» Hä?
«Se Klaud Brojäkt bräiks daun – wot is se först sing yu du?» Hä?
Security agility- dynamic policy creation and rollout
Security agility- dynamic policy creation and rollout
Hack back series data is an asset - registration strategies v0.1
Hack back series data is an asset - registration strategies v0.1
Hack back series how to spot fake linked in profiles - a way to figure out f...
Hack back series how to spot fake linked in profiles - a way to figure out f...
Sgs cloud 5 mar-2015 bsl dominique c. brack csach - public version
Sgs cloud 5 mar-2015 bsl dominique c. brack csach - public version
Recently uploaded
Collapsing Narratives: Exploring Non-Linearity • a micro report by Rosie Wells
Insight: In a landscape where traditional narrative structures are giving way to fragmented and non-linear forms of storytelling, there lies immense potential for creativity and exploration.
'Collapsing Narratives: Exploring Non-Linearity' is a micro report from Rosie Wells.
Rosie Wells is an Arts & Cultural Strategist uniquely positioned at the intersection of grassroots and mainstream storytelling.
Their work is focused on developing meaningful and lasting connections that can drive social change.
Please download this presentation to enjoy the hyperlinks!
Mastering the Concepts Tested in the Databricks Certified Data Engineer Assoc...
• For a full set of 760+ questions. Go to
https://skillcertpro.com/product/databricks-certified-data-engineer-associate-exam-questions/
• SkillCertPro offers detailed explanations to each question which helps to understand the concepts better.
• It is recommended to score above 85% in SkillCertPro exams before attempting a real exam.
• SkillCertPro updates exam questions every 2 weeks.
• You will get life time access and life time free updates
• SkillCertPro assures 100% pass guarantee in first attempt.
Presentatie 8. Joost van der Linde & Daniel Anderton - Eliq 28 mei 2024
Dutch Power Event
“AI – Navigeren naar de toekomst?”
Op 28 mei 2024 bij Info Support.
Doctoral Symposium at the 17th IEEE International Conference on Software Test...
Doctoral Symposium at the 17th IEEE International Conference on Software Test...Sebastiano Panichella
Doctoral Symposium at the
17th IEEE International Conference on Software Testing, Verification and Validation
(ICST 2024)Media as a Mind Controlling Strategy In Old and Modern Era
This presentation, created by Syed Faiz ul Hassan, explores the profound influence of media on public perception and behavior. It delves into the evolution of media from oral traditions to modern digital and social media platforms. Key topics include the role of media in information propagation, socialization, crisis awareness, globalization, and education. The presentation also examines media influence through agenda setting, propaganda, and manipulative techniques used by advertisers and marketers. Furthermore, it highlights the impact of surveillance enabled by media technologies on personal behavior and preferences. Through this comprehensive overview, the presentation aims to shed light on how media shapes collective consciousness and public opinion.
Announcement of 18th IEEE International Conference on Software Testing, Verif...
Announcement of 18th IEEE International Conference on Software Testing, Verif...Sebastiano Panichella
Announcement of 18th IEEE International Conference on Software Testing, Verification and Validation (ICST) 2025, Napoli, ItalyTom tresser burning issue.pptx My Burning issue
Addressing the status of black home ownership in America. and what actions are taken to impact these trends.
Supercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdf
During the May 2024 SSP Conference in Boston, MA, Margie Hlava gave this presentation during the Industry Breakout Session on May 29, 2024.
somanykidsbutsofewfathers-140705000023-phpapp02.pptx
Reminiscing on my Father and what he meant in my life, and regretting that so many children suffer and have no family in their home or lives...
International Workshop on Artificial Intelligence in Software Testing
International Workshop on Artificial Intelligence in
Software Testing
Obesity causes and management and associated medical conditions
Obesity causes and management and associated medical conditionsFaculty of Medicine And Health Sciences
Causes and management of obesity and associated medical conditions María Carolina Martínez - eCommerce Day Colombia 2024
María Carolina Martínez - eCommerce Day Colombia 2024
AWANG ANIQKMALBIN AWANG TAJUDIN B22080004 ASSIGNMENT 2 MPU3193 PHILOSOPHY AND...
National education philosophy ( N.E.P)
Presentatie 4. Jochen Cremer - TU Delft 28 mei 2024
Dutch Power Event
“AI – Navigeren naar de toekomst?”
Op 28 mei 2024 bij Info Support.
2024-05-30_meetup_devops_aix-marseille.pdf
Slides de notre meetup DevOps AixMarseille du 30 mai 2024 chez SmarTribune
Sujets: platform engineering / terragrunt / test containers
Recently uploaded (19)
Collapsing Narratives: Exploring Non-Linearity • a micro report by Rosie Wells
Collapsing Narratives: Exploring Non-Linearity • a micro report by Rosie Wells
Mastering the Concepts Tested in the Databricks Certified Data Engineer Assoc...
Mastering the Concepts Tested in the Databricks Certified Data Engineer Assoc...
Presentatie 8. Joost van der Linde & Daniel Anderton - Eliq 28 mei 2024
Presentatie 8. Joost van der Linde & Daniel Anderton - Eliq 28 mei 2024
Doctoral Symposium at the 17th IEEE International Conference on Software Test...
Doctoral Symposium at the 17th IEEE International Conference on Software Test...
Media as a Mind Controlling Strategy In Old and Modern Era
Media as a Mind Controlling Strategy In Old and Modern Era
Announcement of 18th IEEE International Conference on Software Testing, Verif...
Announcement of 18th IEEE International Conference on Software Testing, Verif...
Supercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdf
Supercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdf
somanykidsbutsofewfathers-140705000023-phpapp02.pptx
somanykidsbutsofewfathers-140705000023-phpapp02.pptx
International Workshop on Artificial Intelligence in Software Testing
International Workshop on Artificial Intelligence in Software Testing
Obesity causes and management and associated medical conditions
Obesity causes and management and associated medical conditions
María Carolina Martínez - eCommerce Day Colombia 2024
María Carolina Martínez - eCommerce Day Colombia 2024
AWANG ANIQKMALBIN AWANG TAJUDIN B22080004 ASSIGNMENT 2 MPU3193 PHILOSOPHY AND...
AWANG ANIQKMALBIN AWANG TAJUDIN B22080004 ASSIGNMENT 2 MPU3193 PHILOSOPHY AND...
Presentatie 4. Jochen Cremer - TU Delft 28 mei 2024
Presentatie 4. Jochen Cremer - TU Delft 28 mei 2024
Sneak peek preview area 41 conference Zürich 10. - 11- June 2016
- 1. www.seef.reputelligence.com Area41 security conference 10.-11. June 2016 Zürich, Switzerland Day 2 (11.6.) Room 2 (Klub UG) 15:00 - 15:50 Unlike in the past, social engineering has become an engineering discipline with precise tools, selected dynamic approaches and execution plans. This makes it also so damn hard to define counter-measures against SE attacks on the receiving end. You really never know where you could get hit next. http://area41.io/
- 2. www.seef.reputelligence.com • Vulnerability logo design a new business? • Are vulnerabilities without logo also dangerous? • SE has no logos… Social Engineering Logo wars, the fight for attention and resources.
- 3. www.seef.reputelligence.com Social Engineering • There is help on the way… Shoulder Surfing Reciprocation Social Engineer Pretexting Spear Phishing Phishing Whaling Ego Impersonation Logo wars, the fight for attention and resources.
- 4. www.seef.reputelligence.com Micro Expressions Guess the expression
- 5. www.seef.reputelligence.com Micro Expressions Guess the expression