Summary:

Level: Beginner to Intermediate

Learn the entire process of attacks and defenses, from attacker tools, techniques and procedures from the MITRE ATT&CK knowledge base through networking monitoring, forensics, malware analysis, and Windows internals.

We will cover these topics: MITRE ATT&CK, Network Security Monitoring, Defending Windows, Windows Internals and Malware Analysis.

Detailed Outline:

Full-Stack Incident Response (1 day)

Level: Beginner to Intermediate

Learn the entire process of attacks and defenses, from attacker tools, techniques and procedures from the MITRE ATT&CK knowledge base through networking monitoring, forensics, malware analysis, and Windows internals.

We will cover these topics:

MITRE ATT&CK

We will begin with a high-level view of attacks: Groups, Tactics and Techniques in the ATT&CK matrix, and attribution. We will use Caldera or a similar product to simulate the stages of an attack and test defenses.

Network Security Monitoring

We will cover centralized security monitoring in detail, using Splunk and Suricata to find and analyze attacks.

We will use a pre-installed Splunk server with archived attack data to find and analyze attacks including vulnerability scans, brute force attacks, ransomware, Web site defacement.

Then we will analyze network traffic with Wireshark, Virus Total, and Packet Total to find suspicious traffic, reconstruct the attacker's actions, and recover downloaded files. We will generate attack traffic with Scapy and monitor traffic with simple Python scripts.

We will practice using Zeek, the powerful network security monitor formerly called Bro. We'll practice writing simple code to customize Zeek, using it to analyze captured traffic, and then install it on a cloud server and use it to detect live attacks.

Defending Windows

We will use many techniques to defend Windows systems, including detecting ransomware with Sysmon and Splunk, RAM analysis, detecting known malware with yara, and prefetch forensics.

We will use Velociraptor extensively for threat hunting on Windows systems, finding malware and persistence mechanisms, scanning for indicators of compromise, and capturing traffic remotely.

Windows Internals and Malware Analysis

We'll use many techniques to analyze the behavior of malware to find indicators of compromise and understand the harm it does. We'll use simple static analysis with strings, PE file analysis tools, and packers. Then we'll perform dynamic analysis with debuggers, disassembly with IDA Pro, and decompiling with Ghidra.

We will explore the structure of Windows executable files and the operating system itself, to better understand programs, services, malware, and defenses. We will explore the import table, perform DLL injection and DLL proxying, and examine Windows API calls in userland and the kernel in detail.

Projects include: cheating at games, building malicious DLL libraries, stealing passwords from the API, building a keylogger, debugging a driver, and writing custom shellcode. Tools used include pestudio, API Monitor, Visual Studio, OllyDbg, IDA Pro, Ghidra, WinDbg, and the Keystone Engine.

We will examine the MBR and a simple bootkit.

Prior Knowledge and Equipment Requirements

Previous experience with C and assembly language is helpful but not required. Participants will need a laptop with a Web browser and two monitors. We will provide cloud servers for participants who don't want to run the machines locally.

Key Takeaways

Understanding of threat actors and the ATT&CK matrix

Experience with network monitoring tools and Splunk

Thorough understanding of Windows internals and malware analysis

Who Should Take This Course

Analysts and executives responsible for protecting enterprises who wish to understand threat groups, defenses in overview, and the granular details of Windows exploits and defenses.

Add to Calendar

NOTE: For this event you will need to bring a laptop that will support virtualization. Check your computer's manual or vendor's support website to verify this before you come to our session(s). Thank you.

This is Day 1 of a two part training session.  Preregister for this course to guarantee your spot in this two day training.

Summary:

Ethical Hacking and Digital Forensics Techniques in a virtual environment using open source ISOs and tools. Upon completion will have working virtual labs with an environment to run several of the lab examples shown in class. Also have a basic understanding on Digital Forensics and Ethical Hacking techniques.

Detailed Outline:

Day 1

1) Introductions

2) Virtual Lab Setups

- Downloading ISO images and installers

- CSI Linux

- Kali Live (Forensic Mode)

- Metasploitable2

- Windows

- Build your own VirtualBox test environment

- Scanning and documenting the Virtual lab

3) Forensic Case Management

- Building a Forensic Case using Autopsy

4) OSINT

- Using WebMap for an nmap dashboard

5) Computer Forensics

- Forensic Copy of Windows Registry (20)

- Analyzing Windows Registry for Evidence (21)

6) Steganography

- Using EXIF Tool for read and write EXIF tags

7) Network Forensics

- Wireshark Capture Options

- Capturing Traffic

- Capturing a 3-way TCP Handshake Using Wireshark

8) Questions and Answers Session

Add to Calendar

This talk covers a combination of infrastructure and security as it relates to ADCS (PKI). The details are based on my experience in the subject and touch on areas like avoiding points of failure, exploring configurations that can lead to compromise and general tips for better care and feeding of an enterprise internal PKI.

Attendees will leave the talk with actionable items they can review in their own PKI environments and hopefully use to better design, architect and secure those environments and new environments that may come.

Add to Calendar

This is Day 1 of a two part training session.  Preregister for this course to guarantee your spot in this two day training

Summary:

The hacker/security community continues to struggle with how to get our message across to others. We know what’s wrong, what’s insecure, and what needs to be done to fix the problems. BUT…we seem to hear more stories about failure rather than success stories. Maybe WE are part of the problem. It’s easy to give a talk at a conference where you’re “preaching to the choir” and everyone speaks your language, but how do you fare when you are trying to give the message to your boss, or your bosses’ boss, or C-Level management?

Effective communication, particularly persuasive speech, is part art and part science – and maybe a little luck. I believe there are skills/techniques you can learn that will make you a successful communicator and help you get your message heard. Join this workshop and we’ll explore how to successfully persuade your audience to the desired outcome – what I like to call the Jedi Mind Trick!

This workshop/course will explore a variety of techniques that I’ve learned over my 25+ years of consulting/advising customers about how to get the right message to the right people so real change happen.

Detail Summary:

The workshop will span two days of the conference:

Day One: Workshop (Will cover all of the jedi mind trick materials including practice exercises):

Introductions (Ice Breaker Exercise)

The Science of Communication (why do we we speak?)

• Informative

• Persuasive

• Special Occasions

Group Exercise

The Art of Communication (Persuasive Speech)

Discussion

Group Exercise

Day Two: Practical Application (students will present a short talk to the class and class will critique):

Student Presentations

Speech

Feedback/Discussion

Repeat for each student

Add to Calendar

OSINT (Open Source Intelligence) means folks can find out a lot about you – fast. Our data is breached, leaked, and sold on the daily. Bad actors use this data to “swat” and bully individuals – or worse. What can you do to help protect yourself and mitigate some of the risks of our digital world?

In this talk you will learn about a few of the key OSINT sites out there and just what they know of you, along with key takeaways on how to monitor your digital footprint, and reduce what is known about you.

Add to Calendar

Log4j? Log4Shell? I feel like I’ve heard those terms before… Perhaps you were so bogged down with remediation and incident response that you didn’t get the necessary time to research and understand the full scope of what happened.

In this hands-on talk, we’ll walk through how the vulnerability is exploited and what part it plays in the attack chain. You’ll have an opportunity to emulate the attack or follow along as I demonstrate the attack and various open-source detection methods.

This talk takes a purple team approach by discussing the defender’s and attacker’s infrastructure, attack execution, and how to analyze the traffic for identification and detection.

We’ll finish up by discussing the aftermath of attacks seen in the wild, current APT approaches to this vulnerability, and address any security concerns that remain.

Add to Calendar

Security awareness has been the answer to all security problems since Taz-Mania and Darkwing Duck were tops on Saturday morning. IT people not following procedure? Awareness training. If the developers wrote vulnerable code? Awareness training. If the people clicked on the wrong thing? Training, training, training. And yet studies find that less than 15% of people change their security behavior following security awareness training. After these messages, we'll be right back... with more awareness training. This session shares lessons from behavior economics on to drive action on security initiatives, along with successes organizations have seen from taking a commercial break from the regularly scheduled programming.

Add to Calendar

Are they the hot new threat, or is it just the same old phishing villain in disguise? From Coinbase and Halo to alerts from the FBI, QR codes are fast becoming daily news. This 30 minute talk dives into their configuration, uses, and a realistic look at the risks associated with them. We’ll also take a brief look at resources available for red teams and pentesters who want to incorporate generating malicious QR codes into projects, and realistic mitigation strategies blue teams and defenders can recommend.

Add to Calendar

Summary:  

Level: Beginner

Learn how blockchains, cryptocurrency, coin offerings, and smart contracts work in a series of challenges. We will also cover the underlying cryptography: hashes, symmetric encryption, and asymmetric encryption. We will configure wallets, servers, and vulnerable smart contracts, and exploit them.

We will configure systems using Bitcoin, Ethereum, Hyperledger, Multichain, Stellar, and more. We will perform exploits including double-spend, reentrancy, integer underflow, and logic flaws.

No previous experience with coding or blockchains is required.

Detailed Outline:

The workshop is structured in a CTF format, so each participant can work at their own pace. The techniques will be demonstrated, with complete step-by-step instructions to lead beginners through the easy challenges. There are also harder challenges for more experienced participants. We will help participants as needed, to ensure that everyone learns new techniques.

Participants need a credit card and a few dollars to rent Cloud servers, or a host machine that can run virtual machines. We will use Linux and Windows systems. All the tools we will use are freely available, and all the training materials will remain available to everyone after the workshop ends.

The challenges include:

1. Basic blockchain concepts

a. Simple conceptual blockchain on Github

b. Hashes, collisions, and Pollard's Rho method

2. Wallets

a. MetaMask and Ethereum

b. Prepraring an Android emulator

c. MetaMask mobile wallet

3. Smart Contracts

a. Making a Solidity Contract

b. Making a Coin with Solidity

c. Exploiting a contract with a reentrancy attack

d. Winning an auction by exploiting a logic flaw

e. Hacking PoWHCoin with an underflow

f. Performing a double-spend (51%) attack on Bitcoin

4. Servers

a. Preparing a Linux cloud machine

b. Making a private Ethereum blockchain

c. Making a Node on the Kovan Proof-of-Authority Testnet

d. MetaMask with Local Testnet

e. Hyperledger IROHA (from IBM)

f. Using Multichain

5. Essential Cryptography

a. Symmetric encryption

i. Substitution ciphers

ii. One-time pad and Two-time pad

iii. AES in ECB and CBC modes

iv. AES-GCM with Libsodium

b. Asymmetric encryption

i. RSA

b. Elliptic-curve cryptography with Libsodium

6. Cryptographic attacks

a. Padding oracle attack

b. Existential forgery

c. Finding large primes

d. Factoring large numbers

e. Baby-step, giant-step attack on the Discrete Logarithm Problem (DLP)

f. Pollard-Rho attack on the DLP

7. Madness

a. Quantum computing

b. Homomorphic encryption with Microsoft's SEAL

c. IBM's homomorphic encryption

Add to Calendar

NOTE: For this event you will need to bring a laptop that will support virtualization. Check your computer's manual or vendor's support website to verify this before you come to our session(s). Thank you.

This is Day 2 of the training, if you are wanting to preregister for this training, you must do so on Day 1.

Summary:

Ethical Hacking and Digital Forensics Techniques in a virtual environment using open source ISOs and tools. Upon completion will have working virtual labs with an environment to run several of the lab examples shown in class. Also have a basic understanding on Digital Forensics and Ethical Hacking techniques.

Detailed Outline:

Day 2

1) Introductions

2) Virtual Lab Setups

- Downloading ISO images and installers

- Kali

- Metasploitable2

3) Verify your own VirtualBox test environment

4) Ethical Hacking - Ethics

5) Threat Tactics and Vulnerabilities (MITRE ATT&CK and Common Vulnerabilities and Exposures (CVE))

6) OSINT Active and Passive

7) Scanning and documenting the Virtual lab

8) nmap including scripts

9) Vulnerability Assessment

10) Backdoor exploitation

11) Credential Grabbing

12) Cross Site Scripting

13) Malware exploitation

14) And More

15) Understand different techniques in mitigating vulnerabilities found

16) Finalizing labs

17) Questions and Answers Session

Add to Calendar

Summary: 

Security Orchestration, Automation, and Response (SOAR) is sweeping SOCs and helping reduce workload and increase accuracy. In a world that's ever more API driven, being able to create your own automation workflows is a competitive advantage for companies and a career advantage for staff.

This session will show how to use an interactive computational platform called Jupyter Notebooks can be used to prototype security orchestration (or even build production quality automation). We'll get hands-on with data enrichment APIs to show just how quickly and easily tools can be built.

A web browser and keyboard are required for the interactive parts. Basic knowledge of Python is useful but not strictly required.

Detailed Outline: 

Jupyter Notebooks came out of the data science field. They enable users to write and/or execute code (most commonly Python but over 100 languages are supported), create documentation in Markdown, or embed multimedia.

Commercial SOAR tools are expensive for experimentation and open source ones can be complex to set up. Jupyter Notebooks can enable users to start writing simple workflows in minutes. They can be used as lightweight runbooks but can also be saved to create records of individual investigations.

This session will let do just that. We'll create some simple data enrichment tools using public APIs in Python. Most users probably don't want to use Jupyter as their enterprise SOAR platform but it will let them experiment and possibly automate some of their workflow and prototype what they might do with a fuller platform.

We'll wrap up by highlighting a few open source projects built on top of Jupyter and a few specific ways it's used by Blue Teams. The tool also has some usefulness for automating offensive security.

Time allowing, there could also be an short demonstration on how PowerShell based Jupyter Notebooks can be used to prototype gathering information from Windows based systems.

Audience takeaways:

* What are some ways SOAR is used

* What are Jupyter Notebooks

* How are Jupyter Notebooks set up as far as server options

* Hands on data enrichment examples using public APIs and Python

* Examples of how Jupyter Notebooks are being used in different parts of security

Add to Calendar

The Registry is a critical component of the Windows Operating System that is often misunderstood and even avoided by security professionals. Unfortunately, many adversaries are adept at leveraging the Registry to achieve a variety of objectives against their targets. In order to successfully defend against these attacks we must close this knowledge gap.

This presentation will demystify the Windows Registry and dive into the Registry modifications that State-nexus and eCrime actors leverage in interactive intrusion campaigns. The registry keys covered in this talk come from analysis of hands-on-keyboard commands issued by a range of adversaries during recent real-word intrusions with a focus on Defense Evasion.
Attendees will leave with a stronger understanding of how the registry works, how attackers abuse it, and how to spot suspicious registry changes.

Add to Calendar

The challenges faced by today’s cybersecurity practitioners are well documented. But with all due respect to the many experts who regularly cover the subject, the situation is worse than described. It’s not just that cybersecurity is extremely complex. It’s not just that compliance requirements and the cost of non-compliance both continually escalate. It’s not just that cybersecurity threats evolve at a breathtaking rate. And it’s not just that all of the above have to be managed with increasingly limited pools of cybersecurity personnel and constrained financial resources. The frightening truth is that all of these problems are simultaneously relevant.

Perhaps it’s time to take a page from other industries tasked with managing complex, multidimensional problems. Consider the design processes used to create the next major passenger aircraft. The plane’s engineers do not simply develop to the standards then hope for the best. Instead, they test extensively and collect data. Designs that fail must be improved or discarded.

Is the safety and security of our corporate information systems, our financial data, and our operational technology any less important?

What if there was a cybersecurity testbed, a worldwide collection of active cybersecurity programs, that could be leveraged to collect data on which cybersecurity approaches deliver positive results… and which approaches fail, and at what cost? Such a collection of active cybersecurity programs exists. Every organization with an email address or a website is a live testbed for what actually works in cybersecurity. The global collection of information-enabled organizations is, in effect, a “World-Wide Lab” of cyber strategies and outcomes. Tapping into this nascent data pool can give rise to outcome-based cybersecurity. The results of such a shift in the global cybersecurity landscape could produce outsized positive results and are therefore worth pursuing.

Add to Calendar

Malware continues to advance in sophistication. Well-engineered malware can obfuscate itself from the user and the OS. Volatile memory is the unique structure malware cannot evade. I have engineered a new construct for memory analysis and a new open-source tool that automates memory analysis, correlation, and user-interaction to increase investigation accuracy, reduce analysis time and workload, and better detect malware presence from memory. This talk demos a new visualization construct that creates the ability to interact with memory analysis artifacts. Additionally, this talk demos new, very impactful data XREF and a system manifest analysis features. Data XREF provides an index and memory context detailing how your search data is coupled with processes, modules, and events captured in memory. The System Manifest distills the analysis data to create a new memory analysis snapshot and precise identification of malicious artifacts detectable from malware execution especially useful for exploit dev and malware analysis!

Add to Calendar

Everyone wants to have a secure application, but few know how to get it. Consumers don't know how to ask for security, developers don't know how to build-in security, and managers don't know how to evaluate security. This talk fixes that. Based on the recent minimum software verification recommendations from NIST, you'll learn what tools and processes to use, where to use them, and how to get started. By the end of this talk you'll be able to evaluate how good your current AppSec program is, what's missing from it, and have a plan to achieve Minimum Viable AppSec. This talk is for everyone.

Add to Calendar

In a post-pandemic world, more and more organizations are moving to the cloud. Due to this rapid migration, we have also observed an influx of cloud-based breaches that we have been requested to investigate and respond.

The SolarWinds threat actors introduced another novel method of gaining access to a cloud environment bypassing Federation Services in a technique dubbed the Golden SAML attack. Hope is not lost, though, because even if the federation certificates are compromised, these unauthorized logins are still detectable, as long as authentication logs are correlated between the federation and the cloud environment. By abstracting the attack technique to its core components, using open-source tools, we can engineer detection events relevant to multiple providers and environments.

The presenters will also provide a case study of this novel attack technique (Golden SAML) and demonstrate high-fidelity detection approaches to assist the Security Operations in defending against adversaries. We also will be discussing multiple open-source tools an organization can utilize to assist their understanding of their cloud environments and provide the possibility to identify misconfigurations.

Add to Calendar

Panel presentation from the board of Circle City Con on what it takes to plan and put together a conference. 

Add to Calendar

This is Day 2 of the training, if you are wanting to preregister for this training, you must do so on Day 1.

Summary:

The hacker/security community continues to struggle with how to get our message across to others. We know what’s wrong, what’s insecure, and what needs to be done to fix the problems. BUT…we seem to hear more stories about failure rather than success stories. Maybe WE are part of the problem. It’s easy to give a talk at a conference where you’re “preaching to the choir” and everyone speaks your language, but how do you fare when you are trying to give the message to your boss, or your bosses’ boss, or C-Level management?

Effective communication, particularly persuasive speech, is part art and part science – and maybe a little luck. I believe there are skills/techniques you can learn that will make you a successful communicator and help you get your message heard. Join this workshop and we’ll explore how to successfully persuade your audience to the desired outcome – what I like to call the Jedi Mind Trick!

This workshop/course will explore a variety of techniques that I’ve learned over my 25+ years of consulting/advising customers about how to get the right message to the right people so real change happen.

Detail Summary:

The workshop will span two days of the conference:

Day One: Workshop (Will cover all of the jedi mind trick materials including practice exercises):

Introductions (Ice Breaker Exercise)

The Science of Communication (why do we we speak?)

• Informative

• Persuasive

• Special Occasions

Group Exercise

The Art of Communication (Persuasive Speech)

Discussion

Group Exercise

Day Two: Practical Application (students will present a short talk to the class and class will critique):

Student Presentations

Speech

Feedback/Discussion

Repeat for each student

Add to Calendar

This is training is a more indepth discussion of the presentation given on Friday

Summary: 

Log4j? Log4Shell? I feel like I’ve heard those terms before… Perhaps you were so bogged down with remediation and incident response that you didn’t get the necessary time to research and understand the full scope of what happened.

In this hands-on talk, we’ll walk through how the vulnerability is exploited and what part it plays in the attack chain. You’ll have an opportunity to emulate the attack or follow along as I demonstrate the attack and various open-source detection methods.

This talk takes a purple team approach by discussing the defender’s and attacker’s infrastructure, attack execution, and how to analyze the traffic for identification and detection.

We’ll finish up by discussing the aftermath of attacks seen in the wild, current APT approaches to this vulnerability, and address any security concerns that remain.

Detailed Outline: 

Overview: 

What is Log4j?

How the Log4j vulnerability is used in the attack chain

Quick CVE overview (currently 7 related to Log4j)

Demo: 

Setting up the defensive infrastructure (vuln app, suricata, packet capture)

Setting up the attacker’s infrastructure (Malicious LDAP server)

Executing the payloads (POC and reverse shell)

Detection and Identification (network detection and log analysis)

Aftermath: 

Current attacks seen in the “wild” and APT tactics

Hardening infrastructure and prevention of similar vulnerabilities

Security concerns that remain

Add to Calendar

First, there is no such thing as an average day in the life of a threat hunter. Every day in cyber security is different but there are common elements that describe what we do on a regular basis. The target audience for this presentation includes aspiring or new security analysts, primarily geared toward SOC analysts/blue teamers. If you aren't sure what a SOC analyst or a blue teamer is, this is the presentation for you!

Add to Calendar

Security teams are often tasked with building a layered control environment through a defense-in-depth approach. Audit and compliance teams may even require these controls to align to a specific benchmark or framework. Unfortunately, the scenario often arises where these controls are only put to the test when a real attack occurs leading teams confused when responding to an incident. Assumptions are made by all business units about the operating effectiveness of the environment. Remember when we all relied on the perimeter firewall for security a decade ago? We now have the same problem with heavily relying on default configs within EDR’s. Business leaders may be lulled into thinking that these tools will prevent sophisticated attack chains by nation state adversaries and meanwhile get burned by lazy PowerShell tradecraft that goes undetected. These assumptions are rarely validated through active testing or standard day-to-day activity due to the complexities of a behavior or technique. From an auditing perspective, this is a critical hidden gap that creates a cyclical problem. We are maybe the only industry that provides technical solutions that still requires customers to continuously tune and validate they are working as intended. Although the controls may align to a specific need on paper, significant gaps go unnoticed allowing attackers to achieve their end objectives. A purple team/threat emulation exercise can help prevent this. However, most businesses are often unequipped to know where to begin.

Many of us are not speaking the same language as the business when attempting to introduce the enterprise matrix from MITRE ATT&CK(®). Further, we have now entered an unfortunate reality where every vendor, tool, and third party reference the framework. As an industry, we need to be able to use this framework in a concise and repeatable manner. We also must be honest with the short comings of ATT&CK and what it cannot be used for. It is extremely enticing to fall under several traps when attempting to use the framework and perform simulations internally. This includes playing bingo and not truly understanding how techniques are emulated in an environment.

As assessors we build test procedures to identify gaps, remediate issues, and retest just like any traditional audit. When examined closely, we are effectively quality assurance for cybersecurity. We have specific playbooks of what adversaries attempt upon achieving initial access. Think about the Conti Playbook that was released and translated earlier this year. We can leverage existing tooling to emulate the identified behaviors in our environment creating a “data-driven” and threat informed test. Equipped with this knowledge, we can layout controls that allow the business to operate and provide assurances that an attack chain is mitigated. We have rich and continuously improving public cyber threat intelligence reports that must be used in our programs. Public annual reports from Red Canary, Microsoft, DFIR Report, Scythe, and countless others all can be used to tune our controls against a specific threat. Security professionals can emulate adversaries for cheap all the while expanding budgets and showcasing their work to executives. My hope is to be able to bridge existing understanding of ATT&CK and provide a path to reliably use it regardless of size or complexity of an institution.

Add to Calendar

IoT devices can be anything from temperature sensors to that new Smart Fridge in your house. When reviewing these devices for security issues, there are a wide variety of methods to discover weaknesses. Many companies will publish their firmware on the internet to allow users to update their systems. This is a great place to start finding vulnerabilities, and you can do it without even owning the device. The world of IoT presents difficulties for security, because many times these devices don’t have the capacity to run full security stacks such as Anti-Virus and logging. Come on a journey where you can learn how to hack hardware and software!

Add to Calendar

In this talk, we will discuss how alert fatigue incorrectly results in normalizing danger across a wide range of industries while sharing lessons to combat it. By learning from multiple industries that have life or death consequences to ignoring alert fatigue, cybersecurity teams can improve their alert systems, response procedures, and their cybersecurity posture as a whole. We will discuss how other industries approach alert development, tuning, and handoff procedures and how programs of any size or maturity can benefit from these established lessons.

Add to Calendar

We have learned many things from the last few years, but one thing is for sure - Help is probably not on the way; it's more likely lost in the supply chain. Connections are tenuous, long range support can be impossible in a crisis, and defenders are easily overwhelmed, When the victim is a local government, citizens suffer.

But local and regional governments are strained for resources - who wants to float a bond issue to remediate vulnerabilities and hire trained SOC staff, or maybe start one in the first place? Do we really want to answer that question? Regardless of the ultimate answer, volunteers can step into the breach (pun intended) and help their neighbors.

For the past 6 years, Michigan has developed a program to leverage the skills of volunteer infosec professionals to assist local and regional governments in the event of cyber disruptions. Legislation has been passed and updated, and the program is getting national attention. Indiana has considered similar legislation in the last session, and it will likely be introduced again this year.

Come hear our experience, and think about how you can be part of the Indiana version!

Add to Calendar

The eerie glow of the monitor pierced the shadows of her room. Heart racing with indecision, she stared intensely at the blinking cursor. Should she reply? Just delete? As attackers become more clever, determining the legitimacy of email messages can be a real challenge. Join the presenter for a walk through an examination of the attackers fingerprints both to establish the message's origin and report the attacker before they strike again!

Add to Calendar

Passwords are problematic, and they're not disappearing anytime soon. As one of the largest attack vectors used by multiple protocols, have you ever wanted to learn how to hack these long-suffering logins?

Join the presenter as she uses some of our favorite cartoon characters to introduce the whacky world of password exploitation. In this animated crash course you'll learn the difference between password spraying and cracking, along with the magic of credential stuffing. Learn how to create killer wordlists, and how to audit your own password policy to better protect yourself.

While there are multiple misconceptions about password security, tune in for some no-nonsense talk about the strengths and weaknesses of different offensive tactics.

Add to Calendar

At first it was mostly talked about in theory, then it was struts in an Equifax application, and most recently it was a high severity vulnerability in Log4j. The challenges of the almost ubiquitous use of open source libraries in modern development continue to confound engineering, security and even vendor management teams across organizations. One practice that has gotten some traction but admittedly less than deserved attention up until recently is Software Composition Analysis (SCA).

In this session I’ll present the various challenges that modern development ecosystems leveraging open source libraries and packages present to us. You’ll hear about various forms of tooling from simple Development Environment capabilities to full blown commercial solutions that can help address some of those challenges through SCA. Together we’ll case-study the real-world impact SCA’s capabilities made in an enterprise organization’s Log4j response. From there we’ll discuss how to message the value proposition of SCA and win support from not just your security teams but your engineering, product, and vendor management teams as well. You’ll leave this session with valuable knowledge you can use tomorrow to make the case for introducing SCA capabilities into your organizations software development pipeline.

Add to Calendar

Summary:  

Level: Intermediate

Learn how to take control of Windows and Linux servers running vulnerable software, in a hands-on CTF-style workshop. We begin with easy command injections and SQL injections, and proceed through binary exploits incuding buffer overflows on the stack and the heap, format string vulnerabilities, and race conditions.

After this workshop, you will understand how memory is used by software, and why computers are so easily tricked into executing bytes as code that entered the system as data.

We will exploit 32-bit and 64-bit Intel systems, and also ARM-based systems. We will examine modern Windows defenses in detail and how to defeat them, including ASLR, DEP, stack cookies, and SEHOP. We will also design custom shellcode with the Keystone Engine.

Previous experience with C and assembly language is helpful but not required.

Detailed Outline:  

Level: Intermediate

Learn how to take control of Windows and Linux servers running vulnerable software, in a hands-on CTF-style workshop. We begin with easy command injections and SQL injections, and proceed through binary exploits incuding buffer overflows on the stack and the heap, format string vulnerabilities, and race conditions.

After this workshop, you will understand how memory is used by software, and why computers are so easily tricked into executing bytes as code that entered the system as data.

We will exploit 32-bit and 64-bit Intel systems, and also ARM-based systems. We will examine modern Windows defenses in detail and how to defeat them, including ASLR, DEP, stack cookies, and SEHOP. We will also design custom shellcode with the Keystone Engine.

Previous experience with C and assembly language is helpful but not required.

Add to Calendar

Summary:

Secure clouds are often thought of an oxymoron. However, cloud technology is built for deny by default - so how can you leverage this technology in a safe, secure way while still getting business done?

This workshop will take you through building a VPC in AWS with a private and public subnet, EC2 instances running in each, with secure access through SSH.

Detail Outline:

Enable account (attendees will need a credit card to enable the free tier account; however, this lab does not incur charges).

Enable billing alerts (this step is SOP in case the account is used other work and study later)
Discussion: Regions and Availability Zones
Discussion: Virtual Private Clouds: What are they?
Building a VPC without a wizard: this details the specifics of what is created in a VPC and the control methods available to make private and public resources
Creating EC2 instances
Securing EC2 instances with network ACLs and Security Groups
Hello World! Verifying our security policies.

Note:

Students need access to a terminal command line, a web browser, and the internet. This training will be limited to 30 attendees. A sandbox account will be provided for use.

Add to Calendar

Summary:

This is a 2-hour instructor-led live hands-on workshop. Attendees will learn the operational basics of packet analysis using Wireshark. Though we perform a live packet capture demo as part of the workshop, attendees only need the capability of opening PCAP files within Wireshark. Attendees should bring a laptop with them with Wireshark installed in order to get the most out of this workshop. However, the instructors will step through the entire workshop lab guide so even casual observers sitting in on the workshop still have the ability to learn.

Topics Covered

 I - Navigating Wireshark

II -  TCP and UDP packets

III - Packet flow basics

IV - Analyzing packets

V - Suspicious TCP connections

VI -  Plain text protocols and grabbing creds

 VII -  Extracting objects and data

VIII -  Log4j exploit attempts

IX -  Decrypting encrypted packet data

 X. Further learning

Add to Calendar

This historical retrospective will explore the evolution of erotic imagery from 7200 BCE until today. We will discuss the role that erotica has played in the development of technology as well as the way that technology has been used to foster connection, romance, and sexuality. In addition to a timeline-style discussion of erotica, we will discuss the sociological and psychological perspectives of cybersex and teledildonics. This session contains adult content- including photographs and video- and is not appropriate for attendees under 18.

Add to Calendar

I'm a hacker. Are you a hacker? How do you know? How can you tell? I took a look at myself and tried to identify the things about me that make me a hacker. I also realized that when I applied to the National Security Agency they put me through a series of aptitude tests that looked for many of the same things. I realized that NSA knew how to spot hackers and hire them! At least this one.

Add to Calendar