BSides Cambridge Programme

DOMAIN NAME STUPIDITY THIS TALK DEMONSTRATES A LARGE HOLE IN INTERNAL SECURITY, BASED ON TESTS PERFORMED ON A WIDE VARIETY OF CLIENTS. TOO OFTEN, DNS IS OVERLOOKED, AND IMPROPER LOGGING AND MONITORING LEADS TO A PLETHORA OF ATTACK VECTORS. THIS TALK WILL ALSO DEMO A NEW TOOL, WHICH ABUSES DNS LOOKUPS OF ARBITRARY (NONE ATTACKER CONTROLLED) DOMAINS TO PROVE DANGEROUS EXFILTRATION ATTACKS ARE POSSIBLE AGAINST EVEN THE MOST SECURE OF NETWORKS. BETTER, IT ALSO SHOWS SOME NOVEL WAYS OF FIXING THIS ISSUE ON LARGE SCALE NETWORKS. HOPEFULLY USEFULLY FOR RED AND BLUE ALIKE.

LIAM FOLLIN SECURITY CONSULTANT 9:30 AM - 10:30 AM

THE OSINT KILL CHAIN WE WILLINGLY SHARE IMMENSE PERSONAL INFORMATION ABOUT OURSELVES ONLINE DISREGARDING THE CONSEQUENCES OF SUCH ACTIONS. PRIVACY IS NOW A WORD WE BOUND AROUND WHILST SIMULTANEOUSLY SHARING WITH THE WORLD EVERY ASPECT OF OUR LIVES WITH NO SECOND THOUGHT. SOCIAL MEDIA, PUBLIC DATABASES AND BREACH DUMPS ARE A TREASURE TROVE OF INFORMATION. FROM ACCOUNT TAKEOVERS, TARGETED PHISHING CAMPAIGNS, FRAUD, STALKING AND BLACKMAIL WE’LL SEE HOW THREAT ACTORS CAN PUT THE JIGSAW PIECES ABOUT US TOGETHER TO CREATE A DETAILED ATTACK PROFILE.

SAM MACDONALD SECURITY CONSULTANT 10:30 AM - 11:00 AM

THIS IS A THOUGHT PROVOKING LOOK AT HOW MUCH PERSONAL INFORMATION WE SHARE AND EXPLORATORY LOOK AT HOW THIS CAN BE USED IN TARGETED CAMPAIGNS. DURING THE TALK ATTENDEES WILL LEARN WHAT TYPE OF PERSONAL INFORMATION IS ATTAINABLE BY OSINT. WORKFLOW OF AN INVESTIGATION INTO A TARGET (USING MYSELF AS AN EXAMPLE) SCENARIOS OF HOW THREAT ACTORS COULD UTILISE THIS DATA WITH REAL WORLD EXAMPLES.

DUDE CHECK YOUR PRIVILEGE!: PRIVILEGED ACCOUNT MANAGEMENT SOLUTIONS AND HOW THEY COULD EITHER BECOME YOUR BESTIE OR TOTALLY RUIN YOUR DAY. ALTHOUGH PAM SOLUTIONS ARE UNABLE TO PROTECT AN ORGANIZATION JUST BY THEMSELVES, THEY DEFINITELY PLAY AN IMPORTANT PART WHEN IT COMES TO SECURITY CONTROLS. A DISCUSSION OF HOW BEST PRACTICES CAN PROVIDE A DEFENSE IN DEPTH LAYER OR HAND ATTACKERS THE KEYS TO THE KINGDOM ON A SILVER PLATTER. IN THIS TALK, I WILL DISCUSS BEST PRACTICES FOR UTILIZING PAM SOLUTIONS TO ENHANCE OVERALL SECURITY AND AVOID INADVERTENTLY EXPOSING SENSITIVE ASSETS TO ATTACKERS. OUTLINE: - WHO AM I - THE BOOK OF SAND (SHORT STORY TO BREAK THE ICE. WHEN SOMETHING COULD BE HARMFUL, YOU HAVE TO KEEP IT SAFE SO IT CAN’T BE MISUSED). - WHAT’S A PAM - WHAT DO WE NEED THEM FOR? - CLOUD VS ON PREM - ADDITIONAL FEATURES - COMMON USE CASES - HOW A PAM PLAYED A ROLE IN THE UBER HACK. - CORE COMPONENTS OF A PAM - DOS AND DONT'S - ONE COMMON MISCONCEPTION ABOUT PAMS FINAL NOTES: ENUMERATE YOUR ASSETS: MORE ASSETS = BIGGER TARGET BIGGER TARGET = BIGGER CHANCES OF YOU GETTING COMPROMISED NO, SERIOUSLY. ENUMERATE YOUR ASSETS (HARD CODED PASSWORDS DISASTER). ESTABLISH A GOOD ROTATION POLICY (EXPLAIN WHY THIS IS IMPORTANT AND WHY LACK OF THIS PRACTICE IS A PENTESTER’S TEENAGE DREAM COME TRUE). REVIEW PERMISSIONS (EVERY ORGANIZATION IS DIFFERENT). DON’T EXCLUSIVELY RELY ON YOUR PAM SOLUTION TO SAVE THE DAY (DEFENSE IN DEPTH, PROVIDE EXAMPLES).

MELINA PHILLIPS OFFENSIVE SECURITY ENGINEER III AT GCI 11:00 AM - 12:00 PM

PWNING FOR PLAINTEXT: A HASHCAT 2.0 ADVENTURE ARE THOSE LAST HIGH PRIVILEGE HASHES STILL ELUDING YOU AFTER YOU’VE EXHAUSTED YOUR USUAL ATTACKS? IN THIS TALK WE’LL LOOK AT SOME CREATIVE AND UNORTHODOX PASSWORD CRACKING TECHNIQUES AND ATTACK CHAINS THAT’LL ENABLE YOU TO ATTACK LONGER PASSWORDS, DELIMITED PASSPHRASES, EMOJIS AND EVEN USING HASHES TO CRACK HASHES! WE’LL ALSO EXPLORE SOME LESSER KNOWN RULE INSERTION TECHNIQUES, AS WELL AS WAYS TO IDENTIFY REDUNDANT AND NON-EXECUTING RULES THAT WILL HELP OPTIMISE YOUR ATTACKS.

WILL HUNT CO-FOUNDER AT IN,SECURITY 13:00 PM - 13:55 PM

CVSS IS SH*T! OR IS IT? CVSS HAS A BAD REPUTATION. BUT I FEEL DIFFERENTLY. WHEN USED CORRECTLY IT CAN BECOME AN INCREDIBLY HELPFUL TOOL. IN THIS TALK I WILL DISCUSS SOME OF THE COMMON MISTAKES ORGANISATIONS DO WHEN IT COMES TO CVSS, SOME OF THE THINGS THAT ORGANISATIONS SHOULD DO AS WELL. I WILL ALSO COVER THE NEW CVSS VERSION (VERSION 4) THAT IS DUE TOWARDS THE END OF THE YEAR. FINALLY I WILL ALSO COVER OTHER SOURCES THAT CAN BE USED IN CONJUNCTION WITH CVSS SCORING TO HELP FORM A BETTER PICTURE OF THE ACTUAL RISK THAT A VULNERABILITY POSES TO AN ORGANISATION.

SEAN WRIGHT PRINCIPAL APPLICATION SECURITY ENGINEER AT FEATURESPACE 14:00 PM - 15:00 PM

SLIPPING THE NET: QAKBOT, EMOTET AND DEFENSE EVASION QAKBOT AND EMOTET HAVE A CLEAR WAY ON TO SYSTEMS VIA EMAIL AND A GOAL IN MIND ONCE THEY ARE THERE, BUT THEY ARE CONSTANTLY TWEAKING THE STEPS IN BETWEEN. WE WILL LOOK AT A BRIEF HISTORY OF BOTH GROUPS AND RECENT EXAMPLES OF HOW THEY IMPLEMENT DEFENSE EVASION IN THEIR ATTACK CHAINS.

CIAN HEASLEY THREAT TEAM LEAD AT ADARMA SECURITY 15:05 PM - 16:00 PM

HARNESSING THE POWER OF COLLABORATION: BUILDING A STRONGER CYBERSECURITY COMMUNITY FOR A SAFER DIGITAL FUTURE THIS TALK IS TO EMPHASISE THE CRITICAL IMPORTANCE OF COMMUNITY AND COLLABORATION ON A GLOBAL SCALE FOR THREAT INTELLIGENCE AND THE CYBERSECURITY COMMUNITY. IT HIGHLIGHTS THE ESCALATING CYBER THREATS WE FACE AND EMPHASISES THE NEED FOR UNITY AND TEAMWORK TO COMBAT THESE CHALLENGES EFFECTIVELY. THE TALK EXPLORES THE BENEFITS OF COMMUNITY AND COLLABORATION, INCLUDING ENHANCED THREAT INTELLIGENCE CAPABILITIES, FOSTERING INNOVATION, BUILDING RESILIENCE, AND PROMOTING SHARED RESPONSIBILITY. THE AUDIENCE WILL GAIN INSIGHTS INTO THE POWER OF WORKING TOGETHER TO CREATE A SAFER DIGITAL FUTURE.

NIKKI WEBB GLOBAL CHANNEL MANAGER FOR CUSTODIAN360 9:30 AM-9:45 AM

BSIDES CAMBRIDGE : CHOOSE YOUR OWN TALK

DAVE MCKENZIE CYBER SECURITY OPERATIONS DIRECTOR AT NATIONAL GAS TRANSMISSION 9:45 AM-10:30 AM

CAREER ADVICE, WAR STORIES, OPINIONS AND INTERACTION. THIS TALK GIVES THE AUDIENCE THE ABILITY TO CHOOSE FROM SEVERAL TOPICS (9+) FOR AN INTERACTIVE TALK ON THOSE TOPICS: WILL AI STEAL MY JOB? WHAT TO WEAR TO WORK, WORST INCIDENT EVER, WHAT THE HELL IS RISK AND WHY DO PEOPLE KEEP GOING ON ABOUT IT, ,RED TEAM OR BLUE TEAM DEGREES AND CERTS - A HIRING MANAGERS PERSPECTIVE, FAVOURITE TOOL, INCIDENT RESPONSE PLANS - HOW MANY DO I NEED, WHAT MAKES A GOOD SOC ANALYST HOW DO I MAKE IT LIKE ME PROFITING FROM FEAR AND MISERY AND MORE (IF THERE ARE ANY THEMES OR LINKS YOU’D LIKE TO BE DISCUSSED DROP ME A LINE).

THE DOOR'S OPEN THERE'S A LOT OF TALK ABOUT 'BREAKING IN' TO CYBER SECURITY. DOZENS OF INFLUENCERS (SOME WELL INTENTIONED, SOME...LESS SO) TALK ABOUT HOW TO START A CAREER. THERE ARE REAMS OF UNFILTERED TIPS AND ADVICE. NEW CERTIFICATES COME OUT EVERY WEEK. WE EVEN HAVE PEOPLE CHARGING FOR MENTORING. THIS TALK ISN'T PURELY A CRITICAL LOOK AT A LOT OF THE ADVICE OUT THERE ABOUT BREAKING IN, IT'S MORE USEFULLY A LOOK AT HOW PEOPLE REALLY START THEIR CYBER SECURITY CAREER. THE HONEST FACT IS THAT IT'S NEITHER AS HARD, NOR AS EASY, AS MOST OF THE LINKEDINFLUENCERS CHASING CLOUT CLAIM. WE'LL LOOK AT A NUMBER OF PROVEN METHODS, THE SHEER SCOPE OF THE CYBER SECURITY FIELD (AND WHY, JUST MAYBE, YOU SHOULD BE LOOKING MORE AT SECURITY THAN CHASING THE CYBER DREAM), AND ASK SOME TOUGH QUESTIONS ABOUT THE ADVICE GIVEN BY LINKEDINFLUENCERS.

JAMES BORE 10:45 AM - 11:15 AM

LEVELLING THE EMPLOYMENT PLAYING FIELD WITH TECHNOLOGY MY TALK WILL BE ABOUT USING TECHNOLOGY TO EQUALISE THE PLAYING FIELD IN TECH. WHETHER IT BE AT THE RECRUITMENT STAGES OR REASONABLE ADJUSTMENTS FOR A DISADVANTAGED EMPLOYEE. WHAT TECHNOLOGY IS OUT THERE, READY FOR USE, THAT WE CAN TAKE ADVANTAGE OF IN ORDER TO ENSURE THE THERE ARE NO INEQUITIES IN TECH? IT'S ONE THING TO SAY WE WANT DIVERSITY BUT WHAT ARE WE DOING TO ENSURE THAT OUR DIVERSE CANDIDATES A. BECOME EMPLOYEES, AND B. BECOME SUCCESSFUL IN THEIR ROLE.

JENNIFER COX SECURITY ENGINEERING MANAGER, TENABLE 11:15 AM-12:15 PM

WHY CYBER SUCKS FROM TERRIBLE HIRING PRACTICES, TO UNREALISTIC JDS, TO HIGH BARRIERS TO ENTRY FOR ASPIRING CYBER PROFESSIONALS, THE FIELD OF CYBER SECURITY CAN REALLY SUCK! I WANT TO HAVE A REAL DISCUSSION AROUND SOME OF THE PITFALLS OF GETTING INTO THE INDUSTRY AND THEN DISCUSS WITH THE AUDIENCE THEIR PERSPECTIVES AND EXPERIENCES. SLIGHTLY SARCASTIC, IRREVERENT, AND TONGUE IN CHEEK, I AM KNOWN.

KEITH PRICE SECURITY LEADER 13:15 PM - 14:00 PM

YOU DON'T NEED A CALENDAR TO TELL YOU WHEN TO TEST ASSETS CHANGE FAR MORE THAN ONCE A YEAR, SO IT'S TIME TO DETACH SECURITY VULNERABILITIES FROM EARTH'S CELESTIAL MOTIONS AND TO BREAK FREE FROM TRADITIONAL, PERIODIC TESTING. THIS SESSION EXPLORES THE IMPERATIVE SHIFT TOWARDS CONTINUOUS TESTING, SEVERING TIES WITH OUTDATED ANNUAL POINT-IN-TIME ASSESSMENTS, SO YOU CAN FOCUS ON TESTING THE ONLY THING THAT REALLY MATTERS: CHANGES.

THOMAS BALLIN CO-FOUNDER AT CYTIX 14:15 PM -14:30 PM

WHY YOU SHOULD STAY AFTER 10 YEARS AT COALFIRE, AND 20+ YEARS IN THE INDUSTRY. ITS IMPORTANT TO UNDERSTAND HOW TO GET INTO THE CYBER SECURITY COMMUNITY. HOWEVER FOR MANY ITS AS IMPORTANT TO UNDERSTAND HOW TO STAY. THE INDUSTRY IS AWASH WITH BURN OUT AND FATIGUE, CYNICS AND BOX CHECKERS. I'LL SHARE SOME TIPS WITH HANGING ON, BUILDING SOME RESILIENCE - AND CAREER MANAGEMENT ONCE THE SHINE IS LESS SHINY :) PIVOTING TO LEADERSHIP AND UNDERSTANDING PLAYING TO YOUR STRENGTHS AS A SECURITY PROFESSIONAL.

ANDY BARRATT VP CYBER ASSURANCE AT COALFIRE 15:00 PM-16:00 PM

AVOIDING THE PITFALLS: HOW NOT TO BE A RED TEAMER

HANI MOMENINIA FOUNDER OF INVEST CYBER 16:05 PM - 17:00 PM

RED TEAMING IS AN ESSENTIAL COMPONENT OF MODERN CYBERSECURITY, WHERE TEAMS SIMULATE ATTACKS ON AN ORGANISATION TO IDENTIFY VULNERABILITIES AND STRENGTHEN DEFENCES. HOWEVER, THE RED TEAMING APPROACH CAN BE MISUSED OR CAUSE UNINTENDED HARM IF NOT CONDUCTED PROPERLY. IN THIS TALK, I WILL DISCUSS THE COMMON PITFALLS THAT RED TEAMERS FACE, AND HOW TO AVOID THEM. I WILL DELVE INTO TOPICS SUCH AS ETHICAL CONSIDERATIONS, EFFECTIVE COMMUNICATION, AND APPROPRIATE SCOPE DEFINITION. ATTENDEES WILL GAIN A BETTER UNDERSTANDING OF HOW TO CONDUCT RED TEAMING EXERCISES WITH CARE AND RESPONSIBILITY, WITHOUT COMPROMISING THE INTEGRITY OF THE ORGANISATION THEY ARE WORKING WITH.

EXPLORING HOW AI CAN HELP WITH REVERSE ENGINEERING OF APPLICATION BINARIES THIS TALK CONSIDERS HOW AI CAN BE LEVERAGED TO IMPROVE REVERSE ENGINEERING (OR STATIC ANALYSIS) WORKFLOWS ON STRIPPED AND/OR OBFUSCATED BINARIES. WE BEGIN WITH A GENTLE INTRODUCTION TO A COMMON RE WORKFLOW, DISCUSS HOW DIFFERENT AI/ML ARCHITECTURES CAN BE USED TO ASSIST OUR ANALYSIS, AND FINISH WITH A WORKED EXAMPLE OF HOW THESE TECHNIQUES CAN BE USED FOR TASKS LIKE BINARY FUNCTION IDENTIFICATION.

NATHAN SECURITY RESEARCHER 9:30 AM - 9:45 PM

AI VS. HACKERS: UNMASKING THE CYBER BATTLE OF THE FUTURE

TIMON JOHNSON SECURITY CONSULTANT AT 2SEC CONSULTING 9:45 AM - 10:00 AM

JOIN ME AT BSIDES CAMBRIDGE FOR A MIND-BLOWING 10-MINUTE JOURNEY INTO THE CAPTIVATING WORLD OF "AI VS. HACKERS: UNMASKING THE CYBER BATTLE OF THE FUTURE." GET READY TO BE THRILLED, ENTERTAINED, AND ENLIGHTENED AS WE EXPLORE THE INTRIGUING INTERSECTION OF ARTIFICIAL INTELLIGENCE AND THE MISCHIEVOUS ANTICS OF HACKERS. TOGETHER, WE'LL UNRAVEL THE SECRETS, UNVEIL THE LATEST CYBER TRICKS, AND DISCOVER HOW WE CAN TRIUMPH IN THIS EXHILARATING DIGITAL SHOWDOWN. DON'T MISS OUT ON THIS ELECTRIFYING ADVENTURE OF WIT, HUMOR, AND CUTTING-EDGE CYBERSECURITY. SECURE YOUR SPOT NOW AND BE PART OF THE FUTURE-DEFINING BATTLE THAT LEAVES NO ROOM FOR SECOND PLACE.

"DINOSAUR CODES AND AI BONES: A LIGHT-HEARTED EXPEDITION INTO CYBER-PALEONTOLOGY FOR NEXT-GEN CYBERSECURITY INNOVATION" THIS TALK OFFERS A UNIQUE PERSPECTIVE ON THE INTERSECTION OF CRITICAL THINKING, AI, AND CYBERSECURITY INNOVATION, FOCUSING ON ADVANCED PERSISTENT THREATS (APTS) CASE STUDY. IT SHOWCASES THE POTENTIAL OF AI AND THE IMPORTANCE OF CRITICAL THINKING IN SHAPING THE FUTURE OF CYBERSECURITY RESEARCH.

ALSA TIBBIT ASSOCIATE LECTURER AT SHEFFIELD HALLAM UNIVERSITY 10:15 AM - 10:45 AM

AI IN THE SHELL: AUTOMATING NETWORK SCANNING & REPORTING WITH LLMS

MATT ADAMS SECURITY ARCHITECT, SANTANDER UK 10:50 AM - 11:20 AM

IN THIS TALK, WE WILL EXPLORE THE INNOVATIVE INTERSECTION OF ARTIFICIAL INTELLIGENCE AND CYBERSECURITY, DEMONSTRATING HOW LANGUAGE MODELS (LLMS) CAN BE HARNESSED TO AUTOMATE THE TRADITIONALLY LABOR-INTENSIVE TASKS OF NETWORK SCANNING AND REPORT GENERATION. WE WILL DELVE INTO THE FUNCTIONALITY OF A NOVEL TOOL, SCAN2REPORT, WHICH USES LLMS TO INTERPRET NATURAL LANGUAGE DESCRIPTIONS OF DESIRED SCANS, EXECUTE THESE SCANS USING TOOLS LIKE NMAP AND NIKTO, AND SUBSEQUENTLY GENERATE COMPREHENSIVE, HUMAN-READABLE REPORTS OF THE RESULTS. THE DISCUSSION WILL ENCOMPASS BOTH A HIGH-LEVEL OVERVIEW OF HOW AI, SPECIFICALLY LLMS, CAN BE APPLIED TO CYBERSECURITY TASKS, AND A DEEP DIVE INTO THE PRACTICAL WORKINGS OF THE SCAN2REPORT TOOL. WE WILL DEMONSTRATE A LIVE DEMO OF SCAN2REPORT, ILLUSTRATING HOW IT SIMPLIFIES NETWORK SCANNING AND REPORTING, WHILE ALSO PROVIDING VALUABLE INSIGHTS FROM THE SCANS. THIS TALK IS DESIGNED FOR CYBERSECURITY PROFESSIONALS, AI ENTHUSIASTS, AND ANYONE INTERESTED IN THE FUSION OF THESE TWO DYNAMIC FIELDS. PRIOR KNOWLEDGE OF AI OR CYBERSECURITY TOOLS IS HELPFUL, BUT NOT REQUIRED, AS THE TALK WILL PROVIDE AN UNDERSTANDING OF THE CORE CONCEPTS INVOLVED.

DETECTING NETWORK BEACONING WITH CONVOLUTIONAL NETWORKS AND ZEEK LOGS WE WILL INTRODUCE A ROBUST APPROACH TO DETECT NETWORK BEACONING ACROSS DNS, SSL, AND HTTP USING ZEEK LOGS. WE WILL START BY ANALYZING PATTERNS EXHIBITED BY C2 FRAMEWORKS SUCH AS METERPRETER, EMPIRE, SLIVER, OR CALDERA. THE WIDE RANGE OF OBSERVED BEHAVIORS WILL MOTIVATE A MACHINE LEARNING APPROACH THAT CONSISTS IN A) GENERATING SYNTHETIC DATA THAT ACCOUNTS FOR DIFFERENT BEACONING FREQUENCIES, JITTERING, AND LATENCIES, AND B) TRAINING A CONVOLUTIONAL NEURAL NETWORK THAT ANALYZES THE INTERVALS BETWEEN ACTIVITIES. FINALLY, WE WILL SHOWCASE REAL-WORLD DETECTIONS AND EQUIP THE AUDIENCE WITH ALL THE TOOLS NEEDED TO APPLY THE APPROACH TO THEIR DATA.

IGNACIO ARNALDO (NACHO) DATA SCIENTIST AT CORELIGHT 11:30 PM - 12:15 PM

Q&A THE PITFALLS AND POSSIBILITY WITH AI IN CYBER SECURITY AN OPEN ASK ME ANYTHING ABOUT THE IMPLICATIONS OF AI FOR CYBER SECURITY BRING YOUR QUESTIONS FOR THIS INTERACTIVE SESSION

CRAIG NICHOLSON CISO AT CAMBRIDGE UNIVERSITY PRESS AND ASSESSMENT 13:15 PM - 13:45 PM

IKNOW U: SNIFFING AIRTAG PROTOCOL IN TOWN LEVERAGING OPEN SOURCE HARDWARE FOR BLE SNIFFING TO IDENTIFY THE PRESENCE OF AIRTAG PROTOCOL, AND TO ENUMERATE APPLES’S BLE USAGE. THINK WARDRIVING FOR IOS DEVICES.

DIEGO PORRAS 13:55 PM - 14:30 PM

CHAOS CREATED BY DLL BEHAVIOUR - UNDER THE LENS OF A SOC ANALYST DLL HIJACKING TECHNIQUES ENABLE THE EXECUTION OF MALICIOUS CODE BY MISUSING THE TRUST CHAIN OF THE WINDOWS OPERATING SYSTEM. USER-SPACE EXPLOIT DETECTION AND DEFENSIVE MEASURES PROVIDED

BY AV AND EDR SOLUTIONS MAY NOT ALWAYS BE EFFECTIVE AT DETECTING SUCH ACTIVITY RIGHT OUT OF THE BOX AND MAY NOT IMMEDIATELY STOP THE EXECUTION OF UNTRUSTED CODE. THERE ARE NUMEROUS EXAMPLES OF THREAT ACTORS THAT HAVE BEEN SEEN TO LEVERAGE DLL HIJACKING TO ACHIEVE THEIR OBJECTIVES. DURING THE SESSION, WE ARE GOING TO EXPLORE SEVERAL EXAMPLES THAT CHALLENGED THE SOC ANALYST'S DECISION-MAKING ABILITY WHEN VERIFYING THE LEGITIMACY OF A DLL FILE.

AMILLA PERERA SENIOR SOC ANALYST AT PWC 14:30 PM - 15:00 PM

ARBITRARY CODE & FILE EXECUTION IN R/O FS – AM I WRITE? IN CONTAINERIZED ENVIRONMENTS, SUCH AS KUBERNETES CLUSTERS, READ-ONLY FILESYSTEMS ARE VIEWED AS AN ADDITIONAL LAYER OF DEFENSE, AS THEY ALLOW FOR BETTER CONTROL AND MANAGEMENT OF CONTAINERIZED APPLICATIONS. IMMUTABLE CONTAINERS ARE CONSISTENT AND PREDICTABLE, MAKING COMPLIANCE AND AUDITING SIMPLER, AND ALLOWING FOR MORE ACCURATE THREAT DETECTION. THEY ARE ALSO EASILY REPLICATED TO ENSURE HIGH AVAILABILITY AND CAN BE ROLLED BACK WITH EASE WHEN NECESSARY. IN THIS TALK I WILL PRESENT MY RESEARCH ON BYPASSING WRITE AND EXECUTION RESTRICTIONS TO ULTIMATELY EXECUTE ARBITRARY CODE AND EXECUTABLE FILES IN READ-ONLY FILESYSTEMS. THE THREE METHODS I USED TO SUCCESSFULLY EXECUTE ARBITRARY CODE WILL BE COVERED AND DEMONSTRATED LIVE. WE WILL THEN COVER WAYS TO REMEDIATE THESE ATTACKS WHERE POSSIBLE AND MONITOR & ALERT WHERE THEY ARE NOT.

GOLAN MYERS SECURITY CONSULTANT, WITHSECURE 15:00 PM - 15:30 PM

METHODS OF LATERAL MOVEMENT USING WINDOWS OPENSSH WINDOWS' RECENT PORTS OF OPENSSH ALLOWS ADMINS TO ACCESS THEIR WINDOWS ESTATE WITH THE SAME TOOLS AS THEIR LINUX ESTATE. THIS TALK WILL SHOW HOW A MISCONFIGURED WINDOWS SSH SERVICE COMBINES THE WORST CASE SCENARIOS OF BOTH AD AND SSH AND CAN EVEN ALLOW THE THEFT OF PLAINTEXT DOMAIN CREDENTIALS. THOSE WELL-VERSED IN ACTIVE DIRECTORY EXPLOITATION WILL SEE HOW A FEW OLD FAVOURITE TECHNIQUES CAN BE WEAPONISED IN A NEW CONTEXT, AND HOW THE PARTICULAR QUIRKS OF WINDOWS OPENSSH CAN MAKE THEM EVEN MORE POTENT.

MATT LUCAS SECURITY CONSULTANT, WITHSECURE 15:30 PM - 16:00 PM

DEMONSTRATING NOVEL METHODS OF FINDING AND EXPLOITING EXPOSED CLOUD ASSETS AT SCALE THIS TALK WALKS THROUGH THE PROCESS I TOOK TO IDENTIFY MISCONFIGURED INSTANCES OF AWS COGNITO AT SCALE. IT ALSO TALKS THROUGH THE IMPACT OF THESE MISCONFIGURATIONS, WHICH CAN INCLUDE UNAUTHORIZED ACCESS TO APPLICATIONS AND THE AWS ACCOUNT. IT IS AIMED AT THOSE INTERESTED IN ATTACK SURFACE MANAGEMENT (ASM) AND CLOUD RESEARCH BUT IS DESIGNED TO BE ACCESSIBLE TO ALL SKILL LEVELS. IT BEGINS WITH MY EXPERIENCE LEARNING ABOUT AWS COGNITO AND HOW IT CAN BE MISCONFIGURED. I THEN GO ON TO DESCRIBE MY THOUGHT PROCESS BEHIND FINDING NOVEL WAYS OF ENUMERATING CLOUD SERVICES, AND MY FINDINGS FROM RUNNING AUTOMATED TOOLS BASED ON THESE METHODS. I UTILISE SEO TOOLING AND CERTIFICATE TRANSPARENCY LOGS TO PERFORM ASSET DISCOVERY IN A COMPLETELY NOVEL WAY. I DEMONSTRATE ITS EFFICACY THROUGH A CASE STUDY I DID BY IDENTIFYING EXPLOITABLE INSTANCES OF AWS COGNITO. THIS TALK AIMS TO INCREASE INTEREST IN CLOUD SECURITY RESEARCH, PARTICULARLY WITH HOW IT LINKS TO ASM AS IT PRESENTS A DIFFERENT ATTACK SURFACE WHICH PROVIDES RESEARCHERS NEW OPPORTUNITIES TO INNOVATE.

SHAHNOOR KIANI (SN0ARLAX) SECURITY CONSULTANT, WITHSECURE 16:05 PM - 17:00 PM

THE ANATOMY OF A THREAT HUNT: FROM ARTICLE TO INCIDENT. USING THE EXAMPLE OF A SINGLE THREAT WE WILL GO ON A JOURNEY FROM HOW YOU FIND NEW VULNERABILITIES/IOCS BY USING FEEDLY AND OTHER SOURCES EFFICIENTLY, THOUGH USING ELASTIC STACK TO SEARCH ENVIRONMENTS TO FIND VULNERABILITIES WITHIN A CUSTOMER BASE TO RAISING THIS WITH THE CUSTOMER EFFECTIVELY. ATTENDEES WILL GET A BETTER UNDERSTANDING OF THE THREAT HUNT PROCESS AND THOSE CONSIDERING GOING INTO THE FIELD WILL GAIN POINTERS TO HONE THEIR SKILLS.

LORI TALIESIN TSX (THREAT SECURITY EXPERT) @ FORTA'S ALERT LOGIC 14:00 PM - 14:30 PM

ELVIS MAY NOT HAVE LEFT THE BUILDING… AI AND THE FUTURE OF TRUST RELATIONSHIPS, WHERE DO WE GO FROM HERE? I GOT ALL SHOOK UP WATCHING AN ELVIS IMPERSONATOR, ON AMERICA’S GOT TALENT AND REALISING ADVANCES IN AI MEAN WE NEED TO START PLANNING WHAT OUR TRUST VERIFICATION PROCESSES WILL LOOK LIKE IN THE FUTURE. I DON’T HAVE THE ANSWERS BUT AM PREPARED TO ASK THE QUESTION ARE DEEP FAKE TECHNOLOGIES THE FUTURE OR JUST THE DEVIL IN DISGUISE?

JANETTE BONAR LAW SENIOR SPECIALIST PEOPLE CYBER RISK MANAGEMENT, THE COVENTRY BUILDING SOCIETY 10:45 AM - 11:15 AM

MIND THE GOOP! AS PEOPLE ENTER THE INDUSTRY THERE IS A WEALTH OF INFORMATION AND GUIDANCE AVAILABLE. WHILST THIS IS POSITIVE IT CAN BE EXTREMELY OVERWHELMING; HOW DO WE PRIORITISE WHERE TO FOCUS OUR ATTENTION SO THAT THE INFORMATION SERVES US RATHER THAN DISTRACTING US FROM OUR JOURNEY. THIS TALK WILL EXPLORE THE IMPORTANCE OF SHOWING UP WITH AUTHENTICITY AND TRUSTING YOUR JOURNEY RATHER THAN TRYING TO LIVE UP TO EXPECTATIONS AND OPINIONS OF OTHERS. IT WILL ALSO ADDRESS WHY SAYING NO INSTEAD OF DEFAULTING TO YES IS OK AND NECESSARY FOR YOUR ONGOING DEVELOPMENT AND WELLBEING.

DAWN O'CONNOR CO-FOUNDER AT SHIFT KEY CYBER 11:30 AM - 12:00 PM

AN INTRODUCTION TO ASSEMBLY AND REVERSE ENGINEERING THIS TALK WOULD BE AN OVERVIEW OF HOW BASIC ASSEMBLY AND MEMORY WORKS, THE STRUCTURE OF PROGRAMS COMPILED IN C AND HOW TO FOLLOW THE LOGIC OF DISASSEMBLED PROGRAMS. I’D ALSO COVER HOW TO USE TOOLS SUCH AS GHIDRA TO DECOMPILE CODE AND TO MAKE THE REVERSE ENGINEERING PROCESS MORE EFFICIENT, AND THINGS SUCH AS BUFFER OVERFLOWS, PATCHING CODE AND RETURN ORIENTED PROGRAMMING.

TOM BLUE 13:00 PM - 14:00 PM

THE BALLAD OF BUSTER SCRUGGS ALEX PEDERSEN, A JOURNEY OF COMPLIANCE AS A TECHIE “THE WILD WEST, COMPLIANCE, AND A JOURNEY OF GETTING AN AUDIT COMPLETED. IT’S SOMETHING MANY OF US HAVE TO GO THROUGH, BUT HOPEFULLY THIS WILL HELP GET YOU PREPARED.”

ALEX PEDERSEN SENIOR PLATFORM SECURITY ENGINEER AT FEATURESPACE 15:00 PM - 15:15 PM

EDUCATION VS EXPERIENCE, WHY NOT BOTH? DEGREE APPRENTICESHIPS. THIS WOULD INCLUDE BUT NOT LIMITED TO: HOW THEY WORK? 'EARN WHILE YOU LEARN?' WHY? ENTRY POINTS. SUCCESSES & LOSSES. NEXT STEPS...

CHARLIE DELLER SECURITY OPERATIONS ANALYST AT FEATURESPACE 15:45 PM - 16:00 PM

THE BALLAD OF BUSTER SCRUGGS ALEX PEDERSEN, A JOURNEY OF COMPLIANCE AS A TECHIE “THE WILD WEST, COMPLIANCE, AND A JOURNEY OF GETTING AN AUDIT COMPLETED. IT’S SOMETHING MANY OF US HAVE TO GO THROUGH, BUT HOPEFULLY THIS WILL HELP GET YOU PREPARED.”

MOLLY ELLIOTT THREAT INTELLIGENCE ANALYST, BAE SYSTEMS DIGITAL INTELLIGENCE 16:05 PM - 17:00 PM