POSITIVE HACK DAYS



ORGANIZER

Program

Backslash powered scanning: implementing human intuition

Tech

Want to visit   +69

Author: James Kettle

Existing web scanners search for server-side injection vulnerabilities by throwing a canned list of technology-specific payloads at a target and looking for signatures—almost like an anti-virus. The speaker will share with you key insights from the conception and development of an open-source scanner evolved from classic manual techniques that's capable of finding and confirming both known and unknown classes of injection vulnerabilities.

  • Language
  • English

Head of Research at PortSwigger Web Security, where he designs and refines vulnerability detection techniques for Burp Suite's scanner. Recent work has focused on techniques to detect unknown classes of vulnerabilities and exploiting subtle CORS misconfigurations in bitcoin exchanges. He has extensive experience cultivating novel attack techniques, including server and client side RCE, and abusing the HTTP Host header to poison password reset emails and server side caches. He has previously presented at numerous prestigious conferences, including BlackHat and AppSec.

James Kettle James Kettle

Do WAFs dream of static analyzers

Tech

Want to visit   +63

Author: Vladimir Kochetkov

Traditional WAFs regard the applications they protect as a black box: incoming HTTP requests and outgoing HTTP requests are the only means available for attack detection. Obviously, this information is not enough for formal proof, and WAF settles for heuristic approach. Even if we intercept all requests by an application to its environment (filesystem, sockets, BD), it only improves the quality of heuritsics, though it is in no way useful for switching to formal methods. But what if we build a WAF that would treat an application as a white box? What if it could handle the application model obtained as a result of the static code analysis? What if it would be possible to decide if an HTTP request is an attack as we run application code fragments?

  • Language
  • Russian

Head of the application security assessment team. He is engaged in the development of PT Application Inspector being an expert in application security and applied cryptography. He participated in such projects as Nemerle, YAPOET, and SCADA Strangelove. His articles were published in HITB Magazine, The Hacker Magazine, and RSDN Magazine. Spoke at conferences and meetups for developers. He is also the co-organizer of Positive Development User Group, a community for developers who are interested in application security.

Vladimir Kochetkov Vladimir Kochetkov

Backdooring LTE modem radio channel kernel

Fast Track

Want to visit   +54

Author: Andrey Lovyannikov

This report will include findings of a research on radio channel kernel firmware for LTE modem Huawei E3372. The speaker will demonstrate how changes to the kernel can lead to transmission of unencrypted data over a radio channel.

  • Language
  • Russian

A leading security engineer at ASP Labs. A member of BalalaikaCr3w (LC/BC), a CTF team. A PhD student at MEPhI. He is usually engaged in reverse engineering of everything he can lay hands on. The rest of the time, he exploits binary vulnerabilities.

Andrey Lovyannikov Andrey Lovyannikov

Modern techniques and tools in malware analysis

Hands-on Labs

Want to visit   +53

Author: Ivan Piskunov

This hands-on lab will focus on modern countermeasures against malware analysis: antidebugging techniques, using virtual machines, antidisassembly tricks, code packing/encryption using current approaches, and special technologies and tools.

  • Language
  • Russian

Has been working in the IT and IS spheres for more than seven years. He writes on his blog ipiskunov.blogspot.com and in his personal column on SecurityLab.ru. He has written several articles on reversing for The Hacker magazine, and is a resident of the anti-malware.ru portal. His articles were published in magazines and mass media focused on information security, IT audit, and IS department economic management. Has three university degrees: information security, accounting and taxation, and business administration.

Ivan Piskunov Ivan Piskunov

Dust AWL off and take a fresh look!

Tech

Want to visit   +51

Author: Artyom Ilin

Any IT engineer has heard a lot about application whitelisting drawbacks.  Therefore, this technology is rarely used. The speaker will rehabilitate AWL and tell how AWL helps to withstand security threats. The talk will also clarify how to make this technology user-friendly and cover the issues of automated reaction to events and software exceptions.

  • Language
  • Russian

Works as the head of security systems department at the Infosecurity corporate group. Graduated from the Saint Petersburg State University of Aerospace Instrumentation, specializing in computing machines, systems, and networks. He is involved in testing, implementing, and supporting any software ensuring information safety.

Artyom Ilin Artyom Ilin

Attacks on video converter: a year later

Tech

Want to visit   +51

Author: Emil Lerner and Pavel Cheremushkin

BlackHat 2016 saw the report on vulnerabilities in video services. The authors continued their research in this area, and are going to tell about new vulnerabilities (logical and binary) and curious ways to exploit them. Look forward to hearing real stories about exploiting these vulnerabilities in bug bounty programs!

  • Language
  • Russian

Emil Lerner
A postgraduate at the information security department at the Faculty of Computational Mathematics and Cybernetics of Moscow State University. Engaged in web application security. A member of Bushwhackers, a CTF team.

Pavel Cheremushkin
A student at the information system security laboratory at the Faculty of Computational Mathematics and Cybernetics of Moscow State University. He has been working in the industry for five years. Currently, he is engaged in binary exploitation and reverse engineering. A member of Bushwhackers, a CTF team.

Emil Lerner and Pavel Cheremushkin Emil Lerner and Pavel Cheremushkin

Jumping from Tenable's SecurityCenter CV to production environments

Tech

Want to visit   +50

Author: Oleksandr Kazymyrov

This talk will cover passive (extracting information on assets, users, passwords, private keys, etc.) and active (encrypted credentials) information gathering on a rooted server with installed Tenable's SecurityCenter. Moreover, a method for lateral movement from DMZ to production environments using features of Nessus scanning will be demonstrated. It will help red teams to penetrate deeper into internal networks, especially into those containing highly valuable information, like cardholder data environments. From the blue team perspective, the demonstrated techniques will help better understand the risk of vulnerability scanners placed unattended in DMZ zones.

  • Language
  • English

Has a PhD in information security from the University of Bergen. A member of non-functional testing group in financial services at EVRY. Holds CEH (Certified Ethical Hacker) and CES (Certified Encryption Specialist) certificates. A co-author of the Ukrainian standards of block cipher and hash function.

Oleksandr Kazymyrov Oleksandr Kazymyrov

Techniques to protect Java apps and ways to bypass them

Fast Track

Want to visit   +47

Author: Philip Lebedev

The report outlines a range of protection strategies for Java apps, for most of which there are bypass scenarios available.

  • Language
  • Russian

An information security engineer at ASP Labs. A member of BalalaikaCr3w, a CTF team. Mostly focused on reverse engineering and exploiting binary vulnerabilities. An expert in researching iterative block ciphers.

Philip Lebedev Philip Lebedev

Breaking bad

Tech

Want to visit   +47

Authors: Gabriel Bergel and Javier Perez

The speakers will talk about insecurity of POS and fraud that can you be on. From the classic skimmer, eavesdropping, modification, and installation of third-party software to hardware tampering POS. The report also covers POS security features, main brands, cybercrime, methodology to POS tamper, impacted models, security countermeasures, PCI DSS, EMV, insecurity of EMV and NFC.

  • Language
  • English

Gabriel Bergel
A computer system engineer, currently coursing a Masters in Cybersecurity in the IMF Business School and Camilo José Cela University (Spain). He has 14 years of experience in different fields of information security. He is a speaker at common courses, lectures, workshops, and conferences for information security both nationally and throughout Latin America. Currently, the chief strategic officer in Dreamlab Technologies and chief security ambassador in 11Paths.

Javier Perez
Fan of tech and security, ISECOM OSSTMM instructor, trainer for security courses, speaker, researcher. Almost 10 years in the security world. During recent years, he has specialized in payment systems EMV, NFC, POS, ATM. Currently, the director of R&D at Dreamlab Technologies.

Gabriel Bergel and Javier Perez Gabriel Bergel and Javier Perez

Internal security awareness (QIWI)

Fast Track

Want to visit   +43

Author: Ekaterina Pukhareva

We arranged quizzes, quests, and CTFs to increase security awareness of QIWI staff. Then we checked what they learned using internal phishing, pentests, and dropping malware-infected media.

  • Language
  • Russian

Currently works for QIWI. Engaged in IT compliance and vulnerability management. An author of several articles on compliance risks and information security audit.

Ekaterina Pukhareva Ekaterina Pukhareva

Non-signature-based detection of PHP backdoors

Fast Track

Want to visit   +43

Author: Gregory Zemskov

The speaker reports about the developed and implemented algorithm of non-signature-based detection of malicious PHP code fragments.

  • Language
  • Russian

Head of Revisium, a company focused on integrated website security. An IS specialist and developer of free website malware and security scanning tools. A permanent participant of conferences, a lecturer at Moscow State University of Mechanical Engineering, an author of courses, master classes and numerous web app security articles.

Gregory Zemskov Gregory Zemskov

Practical machine learning in infosecurity

Hands-on Labs

Want to visit   +42

Authors: Anto Joseph and Clarence Chio

Machine learning (ML) is the future. The speaker will give an introduction to the topic with the Boolean classification problem and introduce classifiers, which are at the core of many of the most common ML systems. He will also provide a simple example of deploying security machine learning systems in production pipelines using Apache Spark. The speaker will talk about how such systems can be poisoned, misguided, and utterly broken if the architects and implementers are not careful.

  • Language
  • English

Anto Joseph
A security engineer at Intel. He has 5 years of corporate experience in developing and advocating security in mobile and web platforms. Machine learning is one of his key areas of interest. He has been a presenter and trainer at various security conferences including BH USA 2016, DEF CON 24, BruCon, HackInParis, HITB Amsterdam, NullCon, GroundZero, c0c0n, XorConf.

Clarence Chio
Graduated with a B.S. and M.S. in Computer Science from Stanford within four years, specializing in data mining and artificial intelligence. Currently works as a security researcher at Shape Security, building a product that protects high-valued web assets from automated attacks. Spoke on machine learning and security at DEFCON 24, GeekPwn, PHDays, BSides, Code Blue, SecTor, GrrCon, Hack in Paris, QCon, and DeepSec. A community speaker with Intel, and is also the founder and organizer of the Data Mining for Cyber Security meetup group, the largest gathering of security data scientists in the San Francisco Bay Area.

Anto Joseph and Clarence Chio Anto Joseph and Clarence Chio

IPv6 network reconnaissance

Hands-on Labs

Want to visit   +42

Author: Fernando Gont

The Internet Protocol version 6 (IPv6) and the emerging IPv6 deployments somehow change the rules of the "network reconnaissance" game: with the typical 264 addresses per subnetwork, the traditional brute-force approach to address scanning from the IPv4 world becomes unfeasible. This workshop will cover the latest IPv6 network reconnaissance techniques discussed in RFC7707. It will provide an intense IPv6 hacking experience, focusing on hands-on IPv6 network reconnaissance exercises.

  • Language
  • English

A security consultant and researcher for SI6 Networks. He specializes in the field of communications protocols security, working for private and governmental organizations from around the world. He has worked on a number of projects for the UK National Infrastructure Security Co-ordination Centre (NISCC) and the UK Centre for the Protection of National Infrastructure (CPNI) in the field of communications protocols security. He has written a series of recommendations for network engineers and implementers of the TCP/IP protocol suite, and has performed the first thorough security assessment of the IPv6 protocol suite.

Fernando Gont Fernando Gont

Meet and greet the macOS malware class of 2016

Tech

Want to visit   +41

Author: Patrick Wardle

Say hello to KeRanger, Eleanor, Keydnap, and more! 2016 was a busy year for Mac malware authors who released a variety of new macOS malware creations. The talk will provide a technical overview of this malware, by discussing their infection vectors, persistence mechanisms, and features. We will discuss various generic detections that strive to ensure our Mac remain secure.

  • Language
  • English

Director of Research at Synack. Having worked at NASA and the NSA, and well as presented at many security conferences, he is intimately familiar with aliens, spies, and talking nerdy. In his free time, he collects OS X malware and writes free OS X security tools.

Patrick Wardle Patrick Wardle

Java Card platform attacks based on malicious applets

Tech

Want to visit   +40

Author: Sergei Volokitin

The presentation introduces attacks on the secured containers of a Java-based smart card, which allows an attacker to steal cryptographic keys and PINs of the other applets installed on the card.

  • Language
  • English

A security analyst at Riscure in the Netherlands. Develops new attacks on the Java Card platform installed on the most of the modern smart cards. Received a degree in information security in 2013 and now is working on the Software Science Master program at Radboud University Nijmegen.

Sergei Volokitin Sergei Volokitin

Discovering botnets in corporate networks by intercepting web traffic

Tech

Want to visit   +38

Authors: Tatyana Shishkova and Alexey Vishnyakov

The speakers will share their experience in discovering botnets by intercepting web traffic between the bot and the C&C server, and speak about important parts of traffic that you should pay attention to in order to effectively detect malicious activity. They will also tell about the most recent cases of infections of large corporations and organizations in their practice and give examples of real-world botnet traffic, such as Neurevt, Andromeda, Fareit, Carberp, Tinba.

  • Language
  • Russian

Tatyana Shishkova
Graduated from the Faculty of Computational Mathematics and Cybernetics, Lomonosov Moscow State University. A malware analyst at Kaspersky Lab, has been working in the company since 2013. Specializes in network intrusion detection.

Alexey Vishnyakov
Graduated from the National Research Nuclear University MEPhI in 2015. A malware analyst in the Shift AV Group at Kaspersky Lab. One of his activities is detection and analysis of malicious objects.

Tatyana Shishkova and Alexey Vishnyakov Tatyana Shishkova and Alexey Vishnyakov

DIY anti-APT

Tech

Want to visit   +38

Author: Danil Borodavkin

The speaker will tell about his experience in creating an enterprise open-source system targeted to counter attacks not detected by standard protection tools, supported with examples of attacks detected by this system. Some of these attacks used MS Office exploits, others hacked a partner company and a major air carrier, still others used specific features of JavaScript code execution in CHM files. The speaker will also share the comparative statistics on their system performance, some signature tools, and one commercial anti-APT solution.

  • Language
  • Russian

A security specialist with experience in penetration detection, sandboxes, email filtering, and incident response. An Associate Professor at the Information Security scientific laboratory, initiative of the Siberian Federal University. Passionate about open source, duct tapes, and above all (which is curiously enough) order.

Danil Borodavkin Danil Borodavkin

Will your business stand a ransomware?

Fast Track

Want to visit   +38

Author: Yulia Omelyanenko

You're building your continuity and disaster recovery program, plan how to get over with a crisis caused by fires, power failure, natural disasters. But suddenly you get a notice that your network was hit with a ransomware and every second some data is probably getting lost. We will discuss ransomware threat from a business continuity point of view and analyze options to prevent it or minimize its impact in case a company was infected.

  • Language
  • English

A GRC unit manager in Acronis. Previously worked as a GRC lead in a large FMCG company. Graduated from Moscow Engineering Physics Institute. Has over 6 years of practical experience in information governance.

Yulia Omelyanenko Yulia Omelyanenko

User-friendly, though. (Messaging bots expose sensitive data)

Fast Track

Want to visit   +38

Author: Anton Lopanitsyn

The speech will focus on messaging bots in Telegram: how a useful tool becomes a source of information leakage.

  • Language
  • Russian

A web application security expert at ONSEC. Currently working on Wallarm.

Anton Lopanitsyn Anton Lopanitsyn

How we hacked distributed configuration management systems

Tech

Want to visit   +38

Authors: Francis Alexander and Bharadwaj Machiraju

The talk deals with how the researchers came across and exploited different configuration management systems during their pentests. The speakers will introduce different distributed configuration management tools, like Apache ZooKeeper, HashiCorp Consul and Serf, CoreOS Etcd; discuss multiple ways to fingerprinting these systems, and exploit generic misconfigurations for increasing attack surface.

  • Language
  • English

Francis Alexander
An information security researcher and the author of NoSQL Exploitation Framework. Interested in web app and stand-alone app security, DBMS security, coding tools and fuzzing. Spoke at HITB AMS, Hack in Paris, 44CON, DerbyCon, Defcon.

Bharadwaj Machiraju
The project leader for OWASP OWTF. He is mostly found either building a web app sec tool or hunting bugs for fame. Spoke at such conferences as Nullcon, Troopers, BruCON, PyCon. Apart from information security, he is interested in sleeping, mnemonic techniques, and machine learning.

Francis Alexander and Bharadwaj Machiraju Francis Alexander and Bharadwaj Machiraju

Stand or Fall

Business

Want to visit   +37

Author: Andrei Masalovich

These days, the Web Standoff is not just a warfare between humans and bots, we are talking about a botnet programmed to act in an intelligent, user-like manner, an army with a proper coordination. DDoS botnets have evolved from a basic tool to a powerful weapon of information confrontation in the hands of hackers, intruders, and intelligence services. The speaker will share some real-life examples: from massive password hacking to influencing electoral outcomes.

  • Language
  • Russian

CEO at Lavina Pulse. Supervisor for a number of successful campaigns aimed at implementing analytical technologies in banking, financial-industrial groups, major retailer networks, and public sector bodies. The author of numerous publications, gave a series of lab courses on methodologies for data search and analysis at several universities in Russia and U.S. Conducted workshops on competitive intelligence through web mining at PHDays and more than 700 uniquely designed lab courses on this topic. Creator of the Avalanche search engine. Candidate of Physics and Mathematics, Distinguished Scholar awarded by the Russian Academy of Sciences, served as a Lieutenant Colonel at the Russian Federal Agency for Government Communications and Information.

Andrei Masalovich Andrei Masalovich

Horizontal penetration in the windows-based infrastructure

Fast Track

Want to visit   +37

Author: Teimur Kheirkhabarov

Every targeted attack consists of several stages. At the initial stage, attackers collect information about the company and its employees to find out the weakest link. Next, the intruders penetrates the corporate network and obtains access to one or several hosts inside the protected perimeter. They will attempt to get authentication data of users with privileges on various corporate hosts. Then, attackers start lurking on hosts in search of relevant information or systems. A multitude of tools for remote execution of Windows commands and other authorized utilities, so popular among system administrators, are at disposal of attackers. The speaker will talk about all these mechanisms and utilities. You will also learn how to find the traces of their usage inevitably left behind in event logs.

  • Language
  • Russian

Engaged in theoretical and practical aspects of information security research for more than six years. SOC analyst at Kaspersky Lab. Formerly, the head of the infosec department at an industrial company. Received specialist's and master's degrees from the Siberian State Aerospace University where later he was giving lectures on IS. An active participant to CTF contests. Spoke at ZeroNights.

Teimur Kheirkhabarov Teimur Kheirkhabarov

Exploring billion states of a program like a pro. How to cook your own fast and scalable DBI-based security tool. A case study

Fast Track

Want to visit   +36

Author: Maksim Shudrak

The main purpose of this talk is to introduce DBI, delve deeper in this topic, demonstrate the power of this technique, and consider typical problems of its application for "industrial" tasks. Audience will get acquainted with DBI in general, will understand in which fields it is successfully applied, what are potential problems of this technique related to implementation of their own tool based on presented frameworks (Intel PIN and DynamoRIO), and see real examples of the technique used for heap-based bug detection in heavyweight programs along with dynamic malware analysis.

  • Language
  • Russian

A cyber security researcher at IBM Research Israel, PhD. Field of interests: reverse engineering, software security analysis, dynamic binary instrumentation, malware analysis, emulation technologies.

Maksim Shudrak Maksim Shudrak

HummingBad: past, present, and future

Tech

Want to visit   +36

Author: Andrey Polkovnichenko

First-hand details on research of one of the most widespread mobile botnets by Check Point specialists. What is HummingBad, what are the perils, what is behind, and how to deal with it.

  • Language
  • Russian

A reverse engineer team lead at Check Point. For the last three years, he has been saving the world from mobile threats.

Andrey Polkovnichenko Andrey Polkovnichenko

Finding your way to domain admin access—and even so, the game isn't over yet

Tech

Want to visit   +35

Author: Keith Lee

There are scenarios where getting domain admin access doesn't mean you have access to all hosts, shares, or databases in the network. The tricky part for an attacker is to find the right account to get in and out of the environment fast. In this presentation, the speaker will discuss the tricky scenarios his team faced during internal penetration test engagements and will tell how they developed a tool to solve those issues.

  • Language
  • English

Senior Security Consultant with Trustwave's SpidersLabs (one of the world's largest specialist security teams with over 100 consultants spread across North and South America, Europe, and the Asia Pacific). Focuses on penetration testing, social engineering, and incident response services to clients in the Asia-Pacific region.

Keith Lee Keith Lee

How to find zero-days in the Linux kernel

Fast Track

Want to visit   +35

Author: Andrey Konovalov

This talk will present how to find vulnerabilities in the Linux kernel using syzkaller. It is a coverage-guided Linux syscall fuzzer. The fuzzer has found over 400 bugs during internal Linux kernel testing and numerous bugs while being used by external users.

  • Language
  • Russian

A Google software engineer working on various bug finding tools for the Linux kernel.

Andrey Konovalov Andrey Konovalov

SOC in a large corporate network: challenge accepted

Tech

Want to visit   +35

Author: Andrey Dugin

The Security Operations Center at MTS had been at work for several years already, when the issue of creating SOC came to light at security conferences in Russia.  Throughout these years, we have been gaining knowledge and experience facing a variety of cases at our SOC.  What challenges do you face when establishing SOC?  What specific features do you need to consider when implementing technologies and business processes in order to ensure IP/MPLS security in a large-scale network?  What is the bottom line of our participation at PHDays VI: The Standoff? The speaker will answer to all these and many other questions in his talk.

  • Language
  • Russian

Works with MTS as a head of information security department. One of the tasks of his department is to ensure CCNP Security.

Andrey Dugin Andrey Dugin

Cyber Defense Operations Center—Microsoft experience

Tech

Want to visit   +34

Author: Andrei Miroshnikov

Review of the Microsoft Cyber Defense Operations Center in the context of functionality, design, specifics, and workflow management. Security incident detection, investigation, and response with Windows Defender ATP, Microsoft ATA, O365 Threat Explorer, and WEF—tools that allow monitoring security risks within the Microsoft network.

  • Language
  • Russian

A Senior Security Analyst in the Information Security Risk Management team at Microsoft's Cyber Defense Operations Center. The author and organizer of Forensics CTF (for the DEFCON 24). Spoke at Microsoft BlueHat. The author of "Windows 10 and Windows Server 2016 security auditing and monitoring reference." Graduated from Irkutsk State University with a Master's Degree in Computer Science. Currently getting an MBA degree at Washington State University.

Andrei Miroshnikov Andrei Miroshnikov

Awareness Center Phishman

Tech

Want to visit   +34

Author: Nikolay Agninsky

The speaker will introduce an effective and easy-to-use knowledge management system aimed at improving employee competencies in security, protection against phishing attacks and misuse of confidential information.

  • Language
  • Russian

CEO of Lead Auditor. Certified auditor (CISA, CISM, ISO 27001). Over 10 years of experience as an engineer, auditor, adviser, project manager in system analytics, IT and security management system audit and design, and information system programming and automation development. Knowledge of complex systems science, system analysis, decision theory, and queuing theory. Expertise in working with international standards and in design of IT processes and systems.

Nikolay Agninsky Nikolay Agninsky

Developing DBFW from scratch

Tech

Want to visit   +34

Author: Denis Kolegov

The talk describes technical aspects of developing a Database Firewall prototype from scratch, such as:  what is required to develop DBFW; whether machine learning can be used for effective detection of SQL injection based on SQL requests; how to detect SQL injections using syntax analysis; and how to implement attribute and role-based access control. The speaker will also tell about prospective application protection mechanisms based on firewalls and static code analysis.

  • Language
  • Russian

PhD in Technical Sciences. An Associate Professor at the Tomsk State University (the information security and cryptography department). The lead of the application protection research team at Positive Technologies.

Denis Kolegov Denis Kolegov

Hacker-machine interface

Tech

Want to visit   +34

Authors: Brian Gorenc and Fritz Sands

This talk covers an in-depth analysis performed on a corpus of 200+ confirmed SCADA and HMI vulnerabilities. It details out the popular vulnerability types discovered in HMI solutions developed by the biggest SCADA vendors, including Schneider Electric, Siemens, General Electric, and Advantech. It studies the weaknesses in the technologies used to develop HMI solutions and describes how critical vulnerabilities manifest in the underlying code. The talk will compare the time-to-patch performance of various SCADA vendors, and provide a comparison of the SCADA industry to the rest of the software industry. Additional guidance will be provided to SCADA developers and operators looking to reduce the available attack surface along with a prediction on what we expect next in attacks that leverage SCADA and HMI vulnerabilities.

  • Language
  • English

Brian Gorenc
A senior manager of Vulnerability Research at Trend Micro. He leads the Zero Day Initiative (ZDI) program, which represents the world's largest vendor-agnostic bug bounty program. His focus includes analyzing and performing root-cause analysis on hundreds of zero-day vulnerabilities submitted by ZDI researchers from around the world. The ZDI works to expose and remediate weaknesses in the world's most popular software. He is also responsible for organizing and adjudicating the ever-popular Pwn2Own hacking competitions.

Fritz Sands
A security researcher with Trend Micro's Zero Day Initiative. In this role, he analyzes and performs root-cause analysis on vulnerabilities submitted to the ZDI program, which is the world's largest vendor-agnostic bug bounty program. Also focuses on writing tools to perform static and dynamic analysis for discovering vulnerabilities. Prior to joining the ZDI in 2014, was in Microsoft's Trustworthy Computing and Secure Windows Initiative operations where he audited Windows code and developed dynamic analysis tools, and before that he was a system developer for multiple iterations of Microsoft Windows.

Brian Gorenc and Fritz Sands Brian Gorenc and Fritz Sands

Injecting security into web apps in the runtime

Tech

Want to visit   +33

Author: Ajin Abraham

This paper discusses the research outcomes on implementing a runtime application patching algorithm on an insecurely-coded application to protect it against code injection vulnerabilities and other logical issues related to web applications, and will introduce the next generation web application defending technology dubbed as Runtime Application Self-Protection (RASP) that defends against web attacks by working inside your web application. RASP relies on runtime patching to inject security into web apps implicitly without introducing additional code changes. The talk concludes with the challenges in this new technology and gives you an insight on future of runtime protection.

  • Language
  • English

Ajin Abraham is a security engineer for IMMUNIO with 7+ years of experience in application security including 4 years of security research. He is passionate on developing new and unique security tools. Some of his contributions to the hacker arsenal include OWASP Xenotix XSS Exploit Framework, Mobile Security Framework (MobSF), Xenotix xBOT, NodeJsScan. He has been invited to speak at multiple security conferences: ClubHack, Nullcon, OWASP AppSec, Black Hat (Europe, U.S., Asia), Hack Miami, Confidence, ToorCon, Ground Zero Summit, Hack In the Box, and c0c0n.

Ajin Abraham Ajin Abraham

Interface through web analyst's eyes: experience with usage of web analytics widgets on online banking login pages

Fast Track

Want to visit   +33

Author: Dmitry Pavlov

Vast majority of websites and applications for monitoring visitors behavior use web analytics tools. The received data is used for the purposes of promotion and optimization of a website. Banks also use web statistics tools on their websites; sometimes, on online banking login pages. The speaker will represent statistics of using JavaScript widgets for analytics on online banking login pages, which contain sensitive information.

  • Language
  • Russian

A fourth-year student of the Faculty of Computational Mathematics and Cybernetics at MSU.

Dmitry Pavlov Dmitry Pavlov

Cyberespionage in Central Asia

Fast Track

Want to visit   +33

Author: Anton Cherepanov

ESET researchers recently discovered an interesting cyberespionage campaign in several Central Asia countries. The discovered malware has been used in targeted attacks against high-value targets since at least 2016. The talk will uncover details about the campaign and provide technical analysis of the used malicious toolkit.

  • Language
  • Russian

A senior malware researcher in ESET. Responsibilities include analysis of complex threats. Spoke at numerous conferences, including Virus Bulletin, CARO Workshop, 4SICS (ICS security summit), and ZeroNights. His interests focus on IT security, reverse engineering, and malware analysis automation.

Anton Cherepanov Anton Cherepanov