Win the Cyber War! with Precognitive Heuristics technology
•
1 like•1,557 views
Roberto Hammer and Sun Tzu CyberConsulting Inc. promote their Precognitive HeuristicsTM technology and cybersecurity consulting services. They claim to be able to perfectly secure customers and win cyber wars instantly. However, the document does not provide details about their methods and only notes that their mission and success stories are confidential.
Report
Share
Report
Share
Download to read offline
Recommended
Trends bescherming en impact van Internationale Cybercrime - keynote Spaanse ...
Trends bescherming en impact van Internationale Cybercrime - keynote Spaanse businessclub Costa del Sol. Wat is de impact van DDOS? Attack of security? Cyberalarm of valt het mee?
Magnasphere Dealer Presentation
The document advertises the Magnasphere security sensor and compares it to reed switches. It summarizes that Magnasphere sensors are more secure than reed switches as they are resistant to magnetic defeat, high voltages, rough handling, and other issues. The document also notes that Underwriters Laboratories is establishing new security sensor standards and Magnasphere technology will likely be the only product that meets the new highest grade standard.
PPT TEST
The document advertises an upcoming webinar from Cisco on reducing security risks to protect networks. It provides details on the webinar such as the date, presenter, and topics to be discussed including assessing security strategies, maintaining postures, and security services. Information is also provided on Cisco's security services and upcoming webinar sessions.
NOS Webinar: Reduce Security Risks to Protect Your Network Final
This document outlines a webinar from Cisco on reducing security risks to protect networks. The webinar will discuss assessing and evolving security strategies, maintaining security postures, and security services to prepare networks. It promotes following the vulnerability lifecycle of identifying, prioritizing, remediating, and validating the removal of risks. The webinar will also cover Cisco's security services to help secure networks.
PDF TEST
The document announces an upcoming webinar from Cisco on reducing security risks to protect networks. It provides details on the webinar such as the date, time, and how to ask questions. The webinar will discuss assessing and evolving security strategies, maintaining security postures, and security services to prepare networks. It also lists upcoming webinar sessions on related topics and provides contact information for Cisco services.
The Somers Team: Listing Presentation 2016
The Somers Team utilizes a wide-ranging marketing strategy to sell real estate properties, including print, digital, and social media. They have a large online presence on platforms like Facebook, Twitter, YouTube, and their website. They create property videos that receive thousands of views. The team has consistently been a top performing group, selling over 1,000 properties.
Skeptics in the Church of Data: Getting Evangelical
Presented by Cage Data's Aaron Aldrich, DevOps Consultant and Evangelist.
Access the full presentation recordings for GalaxZ17 here: http://ow.ly/WyBu30cakk0
How Silicon Valley startups are approaching security differently
Presented at Secure 360 in May 2015:
Based on my blog post: 5 Ways Silicon Valley “Startups” Are Approaching Security Differently – Available here: http://blog.opendns.com/2014/09/26/5-ways-silicon-valley-startups-approaching-security-differently
The perimeter is dissolving. Your users are going mobile. The Cloud is descending upon us. However you say it, the IT landscape is definitely changing, and thanks to these seismic shifts, cracks in your security have developed that allow the bad guys in. So if you could start from scratch and design your IT organization again with the benefit of today’s technology, how would you do it differently? I asked that question and got answers from a few of the who’s who of the Silicon Valley “startups” that have experienced explosive growth in recent years. While it may be impossible or impractical to immediately apply these changes to your organization, understanding their approach could give you a valuable window into how your organization may be forced to change in the coming months or years if you hope to be successful securing your IT environment of the future.
Recommended
Trends bescherming en impact van Internationale Cybercrime - keynote Spaanse ...
Trends bescherming en impact van Internationale Cybercrime - keynote Spaanse businessclub Costa del Sol. Wat is de impact van DDOS? Attack of security? Cyberalarm of valt het mee?
Magnasphere Dealer Presentation
The document advertises the Magnasphere security sensor and compares it to reed switches. It summarizes that Magnasphere sensors are more secure than reed switches as they are resistant to magnetic defeat, high voltages, rough handling, and other issues. The document also notes that Underwriters Laboratories is establishing new security sensor standards and Magnasphere technology will likely be the only product that meets the new highest grade standard.
PPT TEST
The document advertises an upcoming webinar from Cisco on reducing security risks to protect networks. It provides details on the webinar such as the date, presenter, and topics to be discussed including assessing security strategies, maintaining postures, and security services. Information is also provided on Cisco's security services and upcoming webinar sessions.
NOS Webinar: Reduce Security Risks to Protect Your Network Final
This document outlines a webinar from Cisco on reducing security risks to protect networks. The webinar will discuss assessing and evolving security strategies, maintaining security postures, and security services to prepare networks. It promotes following the vulnerability lifecycle of identifying, prioritizing, remediating, and validating the removal of risks. The webinar will also cover Cisco's security services to help secure networks.
PDF TEST
The document announces an upcoming webinar from Cisco on reducing security risks to protect networks. It provides details on the webinar such as the date, time, and how to ask questions. The webinar will discuss assessing and evolving security strategies, maintaining security postures, and security services to prepare networks. It also lists upcoming webinar sessions on related topics and provides contact information for Cisco services.
The Somers Team: Listing Presentation 2016
The Somers Team utilizes a wide-ranging marketing strategy to sell real estate properties, including print, digital, and social media. They have a large online presence on platforms like Facebook, Twitter, YouTube, and their website. They create property videos that receive thousands of views. The team has consistently been a top performing group, selling over 1,000 properties.
Skeptics in the Church of Data: Getting Evangelical
Presented by Cage Data's Aaron Aldrich, DevOps Consultant and Evangelist.
Access the full presentation recordings for GalaxZ17 here: http://ow.ly/WyBu30cakk0
How Silicon Valley startups are approaching security differently
Presented at Secure 360 in May 2015:
Based on my blog post: 5 Ways Silicon Valley “Startups” Are Approaching Security Differently – Available here: http://blog.opendns.com/2014/09/26/5-ways-silicon-valley-startups-approaching-security-differently
The perimeter is dissolving. Your users are going mobile. The Cloud is descending upon us. However you say it, the IT landscape is definitely changing, and thanks to these seismic shifts, cracks in your security have developed that allow the bad guys in. So if you could start from scratch and design your IT organization again with the benefit of today’s technology, how would you do it differently? I asked that question and got answers from a few of the who’s who of the Silicon Valley “startups” that have experienced explosive growth in recent years. While it may be impossible or impractical to immediately apply these changes to your organization, understanding their approach could give you a valuable window into how your organization may be forced to change in the coming months or years if you hope to be successful securing your IT environment of the future.
44CON @ IPexpo - You're fighting an APT with what exactly?
The document discusses strategies for defending against advanced persistent threats (APTs). It notes that many organizations are still relying on network configurations and security tools conceived decades ago. Modern APTs have evolved tactics to avoid detection, like using internal peer-to-peer communications and fast-flux domain naming that evade perimeter-based security tools. The document advocates deploying detection capabilities throughout the network rather than just at the boundary, and maintaining coordinated incident response plans and skills to understand adversaries' techniques.
How to get Started in Cyber Security - Rayan Crasta
This document provides an overview of how to get started in cyber security. It discusses what hacking and cyber security are, popular career paths in the field, and how beginners and intermediate users can start building skills. The careers section outlines 13 in-demand roles, and communities to follow for learning include Null, TheHackersMeetup, and various YouTube and Instagram pages. Certifications like CompTIA and EC-Council are also recommended.
Big Bang Theory: The Evolution of Pentesting High Security Environments
The document discusses how penetration testing methods are outdated and do not adequately evaluate an organization's ability to detect and respond to advanced persistent threats, and it proposes evaluating capabilities across 5 phases of an attack (targeting, initial entry, post-exploitation, lateral movement, data exfiltration) at different levels of sophistication to better assess security posture.
5 of 13 Ways To Prevent Advanced Persistent Threads (APTs)
Is there a magic security bullet anymore? Can we ever feel safe because we have a UTM or Layer 7 Firewalls? Can one security product vendor get it all done for you? What is the right combination of products and processes that can achieve the highest possible security posture for your organization?
These are questions that CIO’s and IT Executives have been asking themselves as of late with the rise of advanced persistent threats (APTs). Unlike traditional Malware and Viruses, new Crimeware and APTs completely hijack your equipment and operate in stealth so that they are more capable of going undetected.
This topic has become an issue of National Security; the biggest businesses in the US are struggling, even with their dedicated security teams.
So, what is a medium business of 100-5000 users to do?
Don’t wait for your installed products to find Malware and Crimeware! Traditional tools are woeful and inadequate.
Over the next 3 months, the CIO Executive Series will review 13 new approaches to Malware/Crimeware defense in order to better prepare you for the upcoming battle you’re sure to fight.
We will help you change the rules of the game by becoming proactive in rooting out malware!
Make it hard for these malicious APTs to operate in stealth.
GO HUNTING!
Blue team reboot - HackFest
Co Speaker: Cheryl Biswas
Talk Description:
How about this: a blue team talk given by red teamers. But here’s our rationale - your best defence right now is a strategic offence. The rules of the game have changed and we need to get defence up to speed.
We’ll show you what the key elements are in a good defence strategy; what you can and need to be using to full advantage. We’ll talk about the new “buzzwords” and how they apply: visibility; patterns; big data. There’s a whole lotta data to wrangle, and you aren’t seeing the whole picture if you aren’t doing things right. Threat intel is about getting the big picture as it applies to you. You’ll learn the importance of context and prioritization so that you can manipulate intel feeds to do your bidding. And then we’ll take things further and talk about hunting the adversary, using an update on proven methodologies.
We’ll show you how to understand your data, correlate threats and pin point attacks. Attendees will leave with a new understanding of the resources they have on hand, and how to leverage those into an Adaptive Proactive Defense Strategy.
Security and ethical hacking initiative first session
Special thanks & reference:- https://www.youtube.com/watch?v=XLvPpirlmEs&t=374s
Google slide:- https://docs.google.com/presentation/d/16xDioTAN2AdASOoFAqLHeMG7oImMsrdPVhpy5D7T2ec/edit
How to be come a hacker slide for 2600 laos
This document provides information on how to become a hacker and the skills required. It discusses that a hacker is a skilled computer expert who uses technical knowledge to overcome problems or break into systems. It outlines different types of hackers such as white hat, black hat, and grey hat hackers. It then describes the basic skills needed like computer skills, networking skills, Linux/Unix skills, virtualization skills, security concepts, web application skills, and forensics skills. More advanced skills discussed include cryptography, reverse engineering, problem solving, and persistence. The document provides resources for learning these skills to become an ethical hacker or work in cybersecurity.
PEW PEW PEW: Designing Secure Boot Securely
Secure boot is under constant attack on embedded devices used across industries. Secure boot is essential for secure embedded devices as it prevents malicious actors from obtaining persistent runtime control. In this presentation, we present our vision on secure boot design and what it takes to make it secure.
PEW PEW PEW: Designing Secure Boot Securely
Secure boot is under constant attack and therefore bypassed on embedded devices used across industries. Whether bypassed using software vulnerabilities or using hardware attacks like fault injection as we and others have previously shown. Secure boot is paramount for secure embedded devices as it prevents malicious actors from obtaining persistent runtime control. In this talk, we present our vision on secure boot design for embedded devices by means of clear, concrete, practical and easy-to-follow recommendations. We leverage our decade-long experience analyzing and bypassing secure boot implementations of embedded devices used by different industries. We understand, in order to be realistic, we need to consider secure boot's functional requirements, engineering costs, and other non-security related requirements. Where possible, we use practical examples that are easy to follow and implement. To keep it fun, we will have a fault injection demonstration live on stage where we bypass secure boot on a fast and feature-rich chip. The audience will be able to follow up on the discussed topics with two white papers which will be released after our talk.
Web3 + scams = It's a match
The document discusses various scams and vulnerabilities related to cryptocurrency and web3 technologies. It begins by introducing Zoltan Balazs and his work researching vulnerabilities. It then describes several types of scams, including rug pulls, giveaway scams, advance fee fraud, and hardware wallet scams. Best practices are suggested, such as being wary of unsolicited messages, verifying sources of apps/dapps, and using strong passwords and hardware wallets to protect funds. The overall message is that web3 and cryptocurrency technologies have enabled numerous scams that have impacted many users.
Smash antivirus Slides
The document describes a new antivirus software called Smatsh that is being developed by Sun IT Pvt. Ltd in Pakistan. Smatsh aims to provide a more effective and efficient antivirus solution compared to existing alternatives. It utilizes modern technologies and regular updates to protect against viruses, malware, and other cyber threats. The developers believe Smatsh can help address Pakistan's technological backwardness by providing a high-quality local antivirus option. Sun IT Pvt. Ltd plans to target the Pakistani market initially and hopes Smatsh will gain widespread adoption.
Fix Nix deck
FixNix InfoSec Solutions was established in 2012 by Shanmugavel Sankaran to be a top global governance, risk, and compliance solutions company. It provides security products like FixNix EGRC and services including virtual CISO, ISO27001 implementation, and security training. Notable achievements include being a Microsoft Bizspark Challenge finalist and having several awards and new clients since starting in 2012.
Cyber security & gaming - LevelUp! 2018 - v.3.1
This document discusses the convergence of cybersecurity and gaming. It argues that cybersecurity and gaming development share principles like the need for fast, continuous development and deployment. However, gaming also introduces security risks like the theft of user accounts and digital goods. To address these risks, the document recommends integrating cybersecurity practices into gaming development like application security testing, extending PCI security standards to gaming, and ensuring proper IoT security for connected gaming devices. Overall, the document frames cybersecurity and gaming as an "unmissable marriage" where both fields can learn from each other to better secure games and gamers.
Hunt for the red DA
Part one of the DA trilogy
Presented at BSides 2017 Edinburgh presentation
The Hunt For The Red DA by Neil Lines https://youtu.be/pYErty7a5M8
Big Bang Theory: The Evolution of Pentesting High Security Environments
This presentation focuses on pentesting high security environments, new ways of identifying/bypassing common security mechanisms, owning the domain, staying persistent, and ex-filtrating critical data from the network without being detected. The term Advanced Persistent Threat (APT) has caused quite a stir in the IT Security field, but few pentesters actually utilize APT techniques and tactics in their pentests.
enkripsi and authentication
1) Symmetric-key cryptography uses the same key to encrypt and decrypt data but requires a secure way to share the secret key between parties.
2) Public-key cryptography addresses this issue by using different but mathematically linked public and private keys, allowing secure communication without pre-shared keys.
3) Digital signatures use public-key cryptography to authenticate senders, working by encrypting a digest of the message with the sender's private key that can be decrypted and verified using their public key.
Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...
The document discusses various topics related to cyber security including:
1) Types of cyber attacks seen during the COVID-19 pandemic like typo squatting domains and command and control servers.
2) Web application attacks like SQL injection, XSS, and how to prevent them through input filtering, encoding and CORS.
3) Secure development practices like establishing secure coding norms, separating duties, and fixing issues in a time-bound manner.
4) Quantifying cyber risks using techniques like Six Sigma and creating threat models.
IoT Trust by Design: Lessons Learned in Wearables and Smart Home Products
The world has awakened to the need for tighter security and privacy in consumer-grade IoT offerings. This panel will present a trust framework for IoT, and wearable and smart home experts will discuss top attack vectors, typical vulnerabilities in devices, apps and systems, common reasons for design compromise, the evolution of security and privacy in IoT and where it needs to go
Learning Objectives:
1: Understand security and privacy best practices for IoT product designs.
2: Explore specific examples of common design pitfalls and how to avoid them.
3: Obtain a risk assessment checklist for use in evaluating/procuring IoT solutions.
(Source: RSA Conference USA 2018)
Data Privacy for Activists
Slides from a workshop titled Data Privacy for Activists on January 29th, 2017 for the Data Privacy PDX Meetup group.
Workshop included presentation and live demos of:
- leaked credentials
- metadata fingerprinting
- VPN use
- Encrypted Email
Distributed Immutable Ephemeral - New Paradigms for the Next Era of Security
We are rapidly approaching the next era of security where we need to be focused on the ability to recover from irrecoverable attacks. This can also be defined as resiliency. The traditional view of resiliency attempts to quickly restore assets that support services that we care about. This new approach/paradigm looks at resilience in ways that promote design patterns (distributed, immutable, ephemeral) where we do not care about a given asset at all while still keeping the overall service functioning. This new approach allows us to avoid having to deal with security at all.
Technical challenges with file formats
"Technical challenges"? More like horrors!
Let's explore first the technical debt of old file formats,
with the evolution of the "MP3" format.
Then we go through more recent forms of file format abuses and tools:
polyglots, polymocks, and crypto-polyglots.
Last, an overview of recent collisions and other forms of art with MD5.
They say that with file formats, "specs are enough".
Should we laugh, cry or run away screaming?
Presented at Digital Preservation Coalition's CyberSec & DigiPres event.
Relations between archive formats
The document discusses different archive formats and their relationships. It begins with an introduction to the presenter and then covers zlib, gzip, and zip file formats. Zlib and gzip both wrap deflate compression, but in different ways, so while the compressed data can be transferred between them, the formats are not directly compatible. Zip can use deflate but also other compression methods and a different one for each file. In conclusion, deflate is a common algorithm while the various formats wrap it with different headers and metadata.
More Related Content
Similar to Win the Cyber War! with Precognitive Heuristics technology
44CON @ IPexpo - You're fighting an APT with what exactly?
The document discusses strategies for defending against advanced persistent threats (APTs). It notes that many organizations are still relying on network configurations and security tools conceived decades ago. Modern APTs have evolved tactics to avoid detection, like using internal peer-to-peer communications and fast-flux domain naming that evade perimeter-based security tools. The document advocates deploying detection capabilities throughout the network rather than just at the boundary, and maintaining coordinated incident response plans and skills to understand adversaries' techniques.
How to get Started in Cyber Security - Rayan Crasta
This document provides an overview of how to get started in cyber security. It discusses what hacking and cyber security are, popular career paths in the field, and how beginners and intermediate users can start building skills. The careers section outlines 13 in-demand roles, and communities to follow for learning include Null, TheHackersMeetup, and various YouTube and Instagram pages. Certifications like CompTIA and EC-Council are also recommended.
Big Bang Theory: The Evolution of Pentesting High Security Environments
The document discusses how penetration testing methods are outdated and do not adequately evaluate an organization's ability to detect and respond to advanced persistent threats, and it proposes evaluating capabilities across 5 phases of an attack (targeting, initial entry, post-exploitation, lateral movement, data exfiltration) at different levels of sophistication to better assess security posture.
5 of 13 Ways To Prevent Advanced Persistent Threads (APTs)
Is there a magic security bullet anymore? Can we ever feel safe because we have a UTM or Layer 7 Firewalls? Can one security product vendor get it all done for you? What is the right combination of products and processes that can achieve the highest possible security posture for your organization?
These are questions that CIO’s and IT Executives have been asking themselves as of late with the rise of advanced persistent threats (APTs). Unlike traditional Malware and Viruses, new Crimeware and APTs completely hijack your equipment and operate in stealth so that they are more capable of going undetected.
This topic has become an issue of National Security; the biggest businesses in the US are struggling, even with their dedicated security teams.
So, what is a medium business of 100-5000 users to do?
Don’t wait for your installed products to find Malware and Crimeware! Traditional tools are woeful and inadequate.
Over the next 3 months, the CIO Executive Series will review 13 new approaches to Malware/Crimeware defense in order to better prepare you for the upcoming battle you’re sure to fight.
We will help you change the rules of the game by becoming proactive in rooting out malware!
Make it hard for these malicious APTs to operate in stealth.
GO HUNTING!
Blue team reboot - HackFest
Co Speaker: Cheryl Biswas
Talk Description:
How about this: a blue team talk given by red teamers. But here’s our rationale - your best defence right now is a strategic offence. The rules of the game have changed and we need to get defence up to speed.
We’ll show you what the key elements are in a good defence strategy; what you can and need to be using to full advantage. We’ll talk about the new “buzzwords” and how they apply: visibility; patterns; big data. There’s a whole lotta data to wrangle, and you aren’t seeing the whole picture if you aren’t doing things right. Threat intel is about getting the big picture as it applies to you. You’ll learn the importance of context and prioritization so that you can manipulate intel feeds to do your bidding. And then we’ll take things further and talk about hunting the adversary, using an update on proven methodologies.
We’ll show you how to understand your data, correlate threats and pin point attacks. Attendees will leave with a new understanding of the resources they have on hand, and how to leverage those into an Adaptive Proactive Defense Strategy.
Security and ethical hacking initiative first session
Special thanks & reference:- https://www.youtube.com/watch?v=XLvPpirlmEs&t=374s
Google slide:- https://docs.google.com/presentation/d/16xDioTAN2AdASOoFAqLHeMG7oImMsrdPVhpy5D7T2ec/edit
How to be come a hacker slide for 2600 laos
This document provides information on how to become a hacker and the skills required. It discusses that a hacker is a skilled computer expert who uses technical knowledge to overcome problems or break into systems. It outlines different types of hackers such as white hat, black hat, and grey hat hackers. It then describes the basic skills needed like computer skills, networking skills, Linux/Unix skills, virtualization skills, security concepts, web application skills, and forensics skills. More advanced skills discussed include cryptography, reverse engineering, problem solving, and persistence. The document provides resources for learning these skills to become an ethical hacker or work in cybersecurity.
PEW PEW PEW: Designing Secure Boot Securely
Secure boot is under constant attack on embedded devices used across industries. Secure boot is essential for secure embedded devices as it prevents malicious actors from obtaining persistent runtime control. In this presentation, we present our vision on secure boot design and what it takes to make it secure.
PEW PEW PEW: Designing Secure Boot Securely
Secure boot is under constant attack and therefore bypassed on embedded devices used across industries. Whether bypassed using software vulnerabilities or using hardware attacks like fault injection as we and others have previously shown. Secure boot is paramount for secure embedded devices as it prevents malicious actors from obtaining persistent runtime control. In this talk, we present our vision on secure boot design for embedded devices by means of clear, concrete, practical and easy-to-follow recommendations. We leverage our decade-long experience analyzing and bypassing secure boot implementations of embedded devices used by different industries. We understand, in order to be realistic, we need to consider secure boot's functional requirements, engineering costs, and other non-security related requirements. Where possible, we use practical examples that are easy to follow and implement. To keep it fun, we will have a fault injection demonstration live on stage where we bypass secure boot on a fast and feature-rich chip. The audience will be able to follow up on the discussed topics with two white papers which will be released after our talk.
Web3 + scams = It's a match
The document discusses various scams and vulnerabilities related to cryptocurrency and web3 technologies. It begins by introducing Zoltan Balazs and his work researching vulnerabilities. It then describes several types of scams, including rug pulls, giveaway scams, advance fee fraud, and hardware wallet scams. Best practices are suggested, such as being wary of unsolicited messages, verifying sources of apps/dapps, and using strong passwords and hardware wallets to protect funds. The overall message is that web3 and cryptocurrency technologies have enabled numerous scams that have impacted many users.
Smash antivirus Slides
The document describes a new antivirus software called Smatsh that is being developed by Sun IT Pvt. Ltd in Pakistan. Smatsh aims to provide a more effective and efficient antivirus solution compared to existing alternatives. It utilizes modern technologies and regular updates to protect against viruses, malware, and other cyber threats. The developers believe Smatsh can help address Pakistan's technological backwardness by providing a high-quality local antivirus option. Sun IT Pvt. Ltd plans to target the Pakistani market initially and hopes Smatsh will gain widespread adoption.
Fix Nix deck
FixNix InfoSec Solutions was established in 2012 by Shanmugavel Sankaran to be a top global governance, risk, and compliance solutions company. It provides security products like FixNix EGRC and services including virtual CISO, ISO27001 implementation, and security training. Notable achievements include being a Microsoft Bizspark Challenge finalist and having several awards and new clients since starting in 2012.
Cyber security & gaming - LevelUp! 2018 - v.3.1
This document discusses the convergence of cybersecurity and gaming. It argues that cybersecurity and gaming development share principles like the need for fast, continuous development and deployment. However, gaming also introduces security risks like the theft of user accounts and digital goods. To address these risks, the document recommends integrating cybersecurity practices into gaming development like application security testing, extending PCI security standards to gaming, and ensuring proper IoT security for connected gaming devices. Overall, the document frames cybersecurity and gaming as an "unmissable marriage" where both fields can learn from each other to better secure games and gamers.
Hunt for the red DA
Part one of the DA trilogy
Presented at BSides 2017 Edinburgh presentation
The Hunt For The Red DA by Neil Lines https://youtu.be/pYErty7a5M8
Big Bang Theory: The Evolution of Pentesting High Security Environments
This presentation focuses on pentesting high security environments, new ways of identifying/bypassing common security mechanisms, owning the domain, staying persistent, and ex-filtrating critical data from the network without being detected. The term Advanced Persistent Threat (APT) has caused quite a stir in the IT Security field, but few pentesters actually utilize APT techniques and tactics in their pentests.
enkripsi and authentication
1) Symmetric-key cryptography uses the same key to encrypt and decrypt data but requires a secure way to share the secret key between parties.
2) Public-key cryptography addresses this issue by using different but mathematically linked public and private keys, allowing secure communication without pre-shared keys.
3) Digital signatures use public-key cryptography to authenticate senders, working by encrypting a digest of the message with the sender's private key that can be decrypted and verified using their public key.
Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...
The document discusses various topics related to cyber security including:
1) Types of cyber attacks seen during the COVID-19 pandemic like typo squatting domains and command and control servers.
2) Web application attacks like SQL injection, XSS, and how to prevent them through input filtering, encoding and CORS.
3) Secure development practices like establishing secure coding norms, separating duties, and fixing issues in a time-bound manner.
4) Quantifying cyber risks using techniques like Six Sigma and creating threat models.
IoT Trust by Design: Lessons Learned in Wearables and Smart Home Products
The world has awakened to the need for tighter security and privacy in consumer-grade IoT offerings. This panel will present a trust framework for IoT, and wearable and smart home experts will discuss top attack vectors, typical vulnerabilities in devices, apps and systems, common reasons for design compromise, the evolution of security and privacy in IoT and where it needs to go
Learning Objectives:
1: Understand security and privacy best practices for IoT product designs.
2: Explore specific examples of common design pitfalls and how to avoid them.
3: Obtain a risk assessment checklist for use in evaluating/procuring IoT solutions.
(Source: RSA Conference USA 2018)
Data Privacy for Activists
Slides from a workshop titled Data Privacy for Activists on January 29th, 2017 for the Data Privacy PDX Meetup group.
Workshop included presentation and live demos of:
- leaked credentials
- metadata fingerprinting
- VPN use
- Encrypted Email
Distributed Immutable Ephemeral - New Paradigms for the Next Era of Security
We are rapidly approaching the next era of security where we need to be focused on the ability to recover from irrecoverable attacks. This can also be defined as resiliency. The traditional view of resiliency attempts to quickly restore assets that support services that we care about. This new approach/paradigm looks at resilience in ways that promote design patterns (distributed, immutable, ephemeral) where we do not care about a given asset at all while still keeping the overall service functioning. This new approach allows us to avoid having to deal with security at all.
Similar to Win the Cyber War! with Precognitive Heuristics technology (20)
44CON @ IPexpo - You're fighting an APT with what exactly?
44CON @ IPexpo - You're fighting an APT with what exactly?
How to get Started in Cyber Security - Rayan Crasta
How to get Started in Cyber Security - Rayan Crasta
Big Bang Theory: The Evolution of Pentesting High Security Environments
Big Bang Theory: The Evolution of Pentesting High Security Environments
5 of 13 Ways To Prevent Advanced Persistent Threads (APTs)
5 of 13 Ways To Prevent Advanced Persistent Threads (APTs)
Security and ethical hacking initiative first session
Security and ethical hacking initiative first session
Big Bang Theory: The Evolution of Pentesting High Security Environments
Big Bang Theory: The Evolution of Pentesting High Security Environments
Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...
Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...
IoT Trust by Design: Lessons Learned in Wearables and Smart Home Products
IoT Trust by Design: Lessons Learned in Wearables and Smart Home Products
Distributed Immutable Ephemeral - New Paradigms for the Next Era of Security
Distributed Immutable Ephemeral - New Paradigms for the Next Era of Security
More from Ange Albertini
Technical challenges with file formats
"Technical challenges"? More like horrors!
Let's explore first the technical debt of old file formats,
with the evolution of the "MP3" format.
Then we go through more recent forms of file format abuses and tools:
polyglots, polymocks, and crypto-polyglots.
Last, an overview of recent collisions and other forms of art with MD5.
They say that with file formats, "specs are enough".
Should we laugh, cry or run away screaming?
Presented at Digital Preservation Coalition's CyberSec & DigiPres event.
Relations between archive formats
The document discusses different archive formats and their relationships. It begins with an introduction to the presenter and then covers zlib, gzip, and zip file formats. Zlib and gzip both wrap deflate compression, but in different ways, so while the compressed data can be transferred between them, the formats are not directly compatible. Zip can use deflate but also other compression methods and a different one for each file. In conclusion, deflate is a common algorithm while the various formats wrap it with different headers and metadata.
Abusing archive file formats
This document is a slide presentation about hash collisions and generating polyglot files that have the same hash but different content. It discusses existing attacks on hashes like MD5 and SHA1 that allow two files to be generated with the same hash. It then explains how collisions can be generated for ZIP and TAR.GZ files by manipulating the ZIP file format in a way that maintains compatibility with ZIP parsers but results in different files with the same hash. Examples of colliding file pairs are shown with identical prefixes and suffixes and differing collision blocks in the middle.
TimeCryption
Clean now, malicious later.
AKA Abusing one-time pads with binary polyglots.
April 08, 2021 Stefan Kölbl, Ange Albertini
Recording @ https://www.youtube.com/watch?v=liancIA1m9w
You are *not* an idiot
You are *not* an idiot ~ or maybe we're all idiots.
Keynote at NorthSec 2021.
Talking about school, failure, success, diploma, impostor syndrom, manipulators, burn out, suicide, and how to deal with them.
The talk delivery was more personal, the slides are kept generic.
The recording is available @ https://youtu.be/Iu70J49bPlE?t=20869 (starts at 5:47:49)
Improving file formats
The document discusses the author's experience with malware and file formats over 13 years, noting how specifications are often outdated and incomplete which can lead to misunderstandings. It advocates for better tools to analyze, document, and validate file formats to improve understanding of their current usage and behaviors. The author has created several open source projects focused on file format analysis and validation.
KILL MD5
Demystifying hash collisions.
Pass the Salt, 1st July 2019.
video @ https://passthesalt.ubicast.tv/videos/kill-md5-demystifying-hash-collisions/
Hack.Lu, 22 October 2019.
video @ https://www.youtube.com/watch?v=JXazRQ0APpI
No more dumb hex!
Troopers, Heidelberg, Germany
21 March 2019
co-presented and designed with Rafał Hirsz
https://github.com/corkami/sbud
https://github.com/evoL/albert
Beyond your studies
Beyond your studies ~ You studied X at Y. now what?
HackPra, July 2018
A student's life ago, the author somehow managed to graduate.
On the way, he made a lot of mistakes -- and he still does.
A few people since called him 'successful', but LOL, if only they knew....
And now, the author will do another (big!) mistake:
instead of hiding in shame as he probably should,
he'll share his mistakes with anyone bored enough to attend,
in the hope that he's the last person to ever look that dumb to commit such mistakes.
If you're a genius and you know what to do in life, please skip this. Seriously.
If, like the author at the time, you wonder WTF is going on with graduation, professional work and life, then hopefully you learn a few things. Maybe.
Btw the author is 42 (WTF - old!).
Maybe that will help to provide a few answers.
An introduction to inkscape
This document provides an introduction and overview of Inkscape, an open-source vector graphics editor. It discusses Inkscape's features such as its use of Scalable Vector Graphics (SVG), tools for drawing objects and manipulating nodes, layers, transformations, and more. The document also includes tutorials for tasks like tracing an image, creating a poster, and converting code snippets to SVG. Throughout, it emphasizes that Inkscape is non-destructive and files remain editable, while also noting some limitations like unsupported gradients along paths.
The challenges of file formats
The document discusses the author's perspectives on file formats after over 30 years of experience working with computers and digital preservation. The author believes specifications are imperfect and do not fully define what constitutes a valid file, as implementations can interpret specifications differently and become outdated. The author has experimented with creating extreme files that push the boundaries of specifications in order to understand formats better and find potential issues.
Exploiting hash collisions
Exploiting (identical prefix) hash collisions.
Presented at BlackAlps in November 2017
PoCs @ https://github.com/corkami/pocs/tree/master/pdf/shattered
recording @ https://www.youtube.com/watch?v=Y-oJWEYKVLA
Infosec & failures
video recording https://www.youtube.com/watch?v=erZ2JlfTtcE
(smaller deck, but w/ more personal details)
Ange Ąż杏 Albertini
Hack.Lu - October 2017
Connecting communities
This document contains the table of contents for an issue of PoC||GTFO, a journal for sharing technical content in unconventional ways. It lists over 60 articles across various topics including hardware hacking, firmware reverse engineering, embedded exploitation, and unusual file formats. The sections are numbered and titled with references to hacking, unconventional thinking, and sharing knowledge in new ways.
TASBot - the perfectionist
https://www.youtube.com/watch?v=s-bKWT9fj8Y
written and presented by dwangoAC at DEF CON 24, SVLUG & NBLUG
[slides collaboration]
Caring for file formats
Presented at Troopers 2016.
When Infosec and Digipres share interests...
TL;DR
- Attack surface with file formats is too big.
- Specs are useless (just a nice ‘guide’), not representing reality.
- We can’t deprecate formats because we can’t preserve and we can’t define how they really work
- We need open good libraries to simplify landscape, and create a corpus to express the reality of file format, which gives us real “documentation”.
- Then we can preserve and deprecate older format, which reduces attack surface.
- From then on, we can focus on making the present more secure.
- We don't need new formats: reality will diverge from the specs anyway - we need 'alive' (up to date, traceable) specs.
Hacks in video games
Game developers are able to create better video games than what the limitations of computers allow by understanding how things truly work at a detailed level. They discovered tricks to get around limitations, such as updating colors rapidly to display more than the limited palette or changing sounds quickly to generate new voices. Understanding the underlying systems allows developers to creatively solve problems like drawing huge animated monsters that surpass the small allowed object sizes. This knowledge of how things really function provides advantages beyond initial restrictions.
Trusting files (and their formats)
1. File formats are complex with many stakeholders who interpret specifications differently, leading to divergent implementations over time.
2. Specifications are often incomplete, unclear, non-free, or do not reflect reality, making it difficult to determine what a valid file is.
3. Relying on specifications alone is not sufficient - one must also analyze sample files and code to understand how file formats work in practice.
Let's write a PDF file
The document provides a step-by-step guide to writing a basic "Hello World" PDF file. It explains the overall PDF file structure and key elements like the file body, cross-reference table, trailer, and objects. Objects are used to define things like the catalog, pages, and a single page. The guide demonstrates creating three objects - one for the catalog that refers to a pages object, which in turn refers to a page object defining a single page.
PDF: myths vs facts
A presentation for the digital preservation community,
during a Digital Preservation Coalition event at Oxford,
15th July 2015
More from Ange Albertini (20)
Recently uploaded
Letter-from-ECI-to-MeiTY-21st-march-2024.pdf
भारत सरकार द्वारा बड़े पैमाने पर व्हाट्सएप अभियान चलाए जाने से डेटा गोपनीयता, नैतिकता और चुनावों की निष्पक्षता पर सवाल उठते हैं।
Essential Tools for Modern PR Business .pptx
Discover the essential tools and strategies for modern PR business success. Learn how to craft compelling news releases, leverage press release sites and news wires, stay updated with PR news, and integrate effective PR practices to enhance your brand's visibility and credibility. Elevate your PR efforts with our comprehensive guide.
What Ukraine Has Lost During Russia’s Invasion
An astonishing, first-of-its-kind, report by the NYT assessing damage in Ukraine. Even if the war ends tomorrow, in many places there will be nothing to go back to.
Gabriel Whitley's Motion Summary Judgment
Here is Gabe Whitley's response to my defamation lawsuit for him calling me a rapist and perjurer in court documents.
You have to read it to believe it, but after you read it, you won't believe it. And I included eight examples of defamatory statements/
04062024_First India Newspaper Jaipur.pdf
Find Latest India News and Breaking News these days from India on Politics, Business, Entertainment, Technology, Sports, Lifestyle and Coronavirus News in India and the world over that you can't miss. For real time update Visit our social media handle. Read First India NewsPaper in your morning replace. Visit First India.
CLICK:- https://firstindia.co.in/
#First_India_NewsPaper
EED - The Container Port PERFORMANCE INDEX 2023
El Puerto de Algeciras continúa un año más como el más eficiente del continente europeo y vuelve a situarse en el “top ten” mundial, según el informe The Container Port Performance Index 2023 (CPPI), elaborado por el Banco Mundial y la consultora S&P Global.
El informe CPPI utiliza dos enfoques metodológicos diferentes para calcular la clasificación del índice: uno administrativo o técnico y otro estadístico, basado en análisis factorial (FA). Según los autores, esta dualidad pretende asegurar una clasificación que refleje con precisión el rendimiento real del puerto, a la vez que sea estadísticamente sólida. En esta edición del informe CPPI 2023, se han empleado los mismos enfoques metodológicos y se ha aplicado un método de agregación de clasificaciones para combinar los resultados de ambos enfoques y obtener una clasificación agregada.
Acolyte Episodes review (TV series)..pdf
Acolyte Episodes review (TV series) The Acolyte. Learn about the influence of the program on the Star Wars world, as well as new characters and story twists.
Recently uploaded (10)
Win the Cyber War! with Precognitive Heuristics technology
- 1. Win the Cyber War! with Precognitive HeuristicsTM technology Roberto Hammer, CISSP Cyber Expert Sun Tzu CyberConsulting Inc. Roberto Hammer, CISSP (Cyber Expert) Win the Cyber War Sun Tzu CyberConsulting Inc. 1/6
- 2. I’m simply awesome CISSP, Cyber APT and AVT expert l33t awesome pwner Computerzombienetzwerkversteher World Champion in Gwall Cyfieithu Roberto Hammer, CISSP (Cyber Expert) Win the Cyber War Sun Tzu CyberConsulting Inc. 2/6
- 3. Our mission ALL our customers perfectly secure big data, cloud web 2.0, cyberconsulting expert blackhat anonymous hack-back cyber mercenaries win the Cyber War in the snap of a finger We don’t engage in illegal activityTM Roberto Hammer, CISSP (Cyber Expert) Win the Cyber War Sun Tzu CyberConsulting Inc. 3/6
- 4. How we win [CONFIDENTIAL] Roberto Hammer, CISSP (Cyber Expert) Win the Cyber War Sun Tzu CyberConsulting Inc. 4/6
- 5. Success stories [TOP SECRET] Roberto Hammer, CISSP (Cyber Expert) Win the Cyber War Sun Tzu CyberConsulting Inc. 5/6
- 6. Thank you! Questions? simply awesome@suntzu.com Roberto Hammer, CISSP (Cyber Expert) Win the Cyber War Sun Tzu CyberConsulting Inc. 6/6