Incident Response procedures differ in the cloud versus when performed in traditional, on-premise, environments. The cloud offers the ability to respond to an incident by programmatically collecting evidence and quarantining instances but with this programmatic ability comes the risk of a compromised API key. The risk of a compromised key can be mitigated but proper configuration and monitoring must be in place.

The talk discusses the paradigm of Incident Response in the cloud and introduces tools to automate the collection of forensic evidence of a compromised host. It highlights the need to properly configure an AWS environment and provides a tool to aid the configuration process.

Cloud IR How is it Different?

Incident response in the cloud is performed differently than when performed in on-premise systems. Specifically, in a cloud environment you can not walk up to the physical asset, clone the drive with a write-blocker, or perform any action that requires hands on time with the system in question. Incident response best practices advise following predefined practiced procedures when dealing with a security incident, but organizations moving infrastructure to the cloud may fail to realize the procedural differences in obtaining forensic evidence. Furthermore, while cloud providers produce documents on handling incident response in the cloud, these documents fail to address the newly released features or services that can aid incident response or help harden cloud infrastructure.

DevOps is changing the way that organizations design, build, deploy and operate online systems. Engineering teams are making hundreds, or even thousands, of changes per day, and traditional approaches to security are struggling to keep up. Security must be reinvented in a DevOps world and take advantage of the opportunities provided by continuous integration and delivery pipelines.

In this talk, we start with a case study of an organization trying to leverage the power of Continuous Integration (CI) and Continuous Delivery (CD) to improve their security posture. Then, we will focus on static analysis, how it fits into Secure DevOps, and introduce you to Puma Scan: a new open-source .NET static analysis tool. Live demonstrations will show Puma Scan identifying vulnerabilities inside Visual Studio and in a Jenkins continuous integration (CI) build pipeline. Attendees will walk away with a better understanding of how static analysis fits into DevOps and a .NET static analysis engine to help secure your organization’s applications.

Developers are always up against rigid deadlines, changing requirements, and constant production support issues. This leaves little time for keeping up with the current threats and defenses, and it inevitably makes security an afterthought. In this presentation, we will be discussing 4 of the vulnerabilities from the OWASP Top 10:

• A1: Injection
• A3: Cross-Site Scripting
• A4: Insecure Direct Object Reference
• A8: Cross-Site Request Forgery

After exploiting these vulnerabilities with a variety of tools (e.g. sqlmap, BeEF, and Burp Suite), we will demonstrate mitigation techniques to correct the vulnerability.

Slides

2016 was the year of Java deserialization apocalypse. Although Java Deserialization attacks were known for years, the publication of the Apache Commons Collection Remote Code Execution (RCE from now on) gadget finally brought this forgotten vulnerability to the spotlight and motivated the community to start finding and fixing these issues. One of the most suggested solutions for avoiding Java deserialization issues was to move away from Java Deserialization altogether and use safer formats such as JSON.

.NET formatters such as BinaryFormatter and NetDataContractSerializer are known to share similar mechanics which make them potentially vulnerable to similar RCE attacks. However, the lack of RCE gadgets led some software vendors to not take this issue seriously as happened to Java before.

In this talk, we will analyze .NET serializers including third party JSON parsers for potential RCE vectors. We will demonstrate that RCE is also possible in .NET and present details about the serializers that are vulnerable to RCE by default and discuss common configurations that make other libraries vulnerable. We will try to generalize the attack techniques to other serialization formats and conclude with presenting several gadgets from system libraries that may be used to achieve RCE for the analyzed serializers. Finally, we will provide recommendations on how to determine if your code is vulnerable, provide remediation advice, and discuss alternative approaches.

Slides

GraphQL is getting increasingly popular and many big companies like GitHub, Twitter and Shopify are already using it in production. In this talk, I want to demonstrate one of the newer and less-known GraphQL features: Realtime Subscriptions. After a quick introduction to the basics of GraphQL, we’ll build a realtime messenger app with React and Apollo Client. I’ll highlight the requirements for building a subscription server that works with Apollo and introduce best practices for implementing subscriptions on the frontend.

This talk will give an introduction of the Tor Project and the current state of encryption/censorship battles. Come to this talk to learn about the different teams at Tor, what is currently being worked on, and what Tor needs help with. Join us in fighting for internet freedom!

Slides

It might be called “Fake News” but it’s really social engineering at a massive scale. And since Fake News taints our information stream, it is also a breach of data integrity, which should be everyone’s concern. To make his point, Michael Schrenk explores the similarities between traditional social engineering and what has led to today’s Fake News epidemic. During this talk, you will learn how hackers use OPSEC (Operations Security) to plan successful social engineering attacks. Additionally, you’ll learn how information is weaponized, who’s making money with fake news, and how it influences decisions at a governmental level (even how countries go to war over false news stories). You’ll also explore techniques to guard against social engineering in your projects.

Credentials have always served as a favorite target for advanced attackers, since these allow to efficiently traverse a network, without using any exploits.

Moreover, compromising the network might not be sufficient, as attackers strive to obtain persistence, which requires the use of advanced techniques to evade the security mechanisms installed along the way.

One of the challenges adversaries must face is: How to create threats that will continuously evade security mechanisms, and even if detected, ensure that control of the environment can be easily regained?

In this talk, we briefly mention some of the past techniques for gaining persistence in a network and discuss why they are insufficient nowadays. Followed by a comprehensive analysis of lesser known mechanisms, using non-mainstream methods.

We focus on how attackers may leverage various Active Directory features and authentication mechanisms (such as object manipulation, Kerberos delegation, etc.) to achieve persistence.
Finally, we show how defenders can secure their environment against such threats.

Building products for the web means building products for everybody. We spend hours and hours on optimising user flows, tweaking designs and A/B testing the heck out of everything. The problem is that we as developers, product owners and designers often think about the targeted customer under optimal conditions and ignore minorities. In this talk, we will take a look at common problems of the web today and demonstrate how we can make it a more welcoming place.

Slides

A language that tracks resource lifetimes and has trait-based generics instead of garbage collection and mainstream object orientation – sounds weird? Rust takes a number of surprising or unfamiliar approaches to defy classic tradeoffs. In this talk innovative language features and idiomatic libraries of this emerging ecosystem are introduced and demonstrated with practical examples along with a glance at the project’s structure. While Rust admittedly demands a mindset different from mainstream languages, it could also reveal a new perspective on your code’s architecture – even in other languages.

A language that tracks resource lifetimes and has trait-based generics instead of garbage collection and mainstream object orientation – sounds weird? Rust takes a number of surprising or unfamiliar approaches to defy classic tradeoffs. In this talk innovative language features and idiomatic libraries of this emerging ecosystem are introduced and demonstrated with practical examples along with a glance at the project’s structure. While Rust admittedly demands a mindset different from mainstream languages, it could also reveal a new perspective on your code’s architecture – even in other languages.