Lectures in English

• Hacking the Human Operating System: The role of social engineering within cybercrime, Raj Samani, McAfee EMEA
  Understanding the psychology behind spear phishing based attacks. This presentation considers how cybercriminals are using subconscious levers into performing actions that lead to a breach. We will fully explore the concept of social engineering, what it is, how it works and the best methods to defend against it.
  
• Lets go with Hidden Data Economy, Raj Samani, McAfee EMEA
  What happens after data is stolen? This presentation considers the hidden marketplace for stolen information, this goes well beyond simply the theft of financial information.
• Fast and Transparent Online Banking Fraud Detection and Investigation, Federicco Maggi, Politecnico di Milano
  The significant growth of online banking frauds, fueled by the underground economy of malware, raised the need for effective fraud analysis systems. In this talk I will present an innovative system for online banking fraud analysis, detection and investigation. Our system is able to "learn" easy-to-understand models from each customer's spending habits, based on past transactions. First, it quantifies the anomaly of each transaction with respect to the customer historical profile. Second, it finds global clusters of customers with similar spending habits. Third, it uses a temporal threshold system that measures the anomaly of the current spending pattern of each customer, with respect to his or her past spending behavior. With this threefold profiling approach, it mitigates the under-training due to the lack of historical data for building well-trained profiles, and the evolution of users' spending habits over time. At runtime, our system supports analysts by ranking new transactions that deviate from the learned profiles, with an output that has an easily understandable, immediate statistical meaning.
  Our evaluation on real data, based on fraud scenarios built in collaboration with domain experts that replicate typical, real-world attacks (e.g., credential stealing, banking trojan activity, and frauds repeated over time), shows that our approach correctly ranks complex frauds. Our system ranks frauds and anomalies with up to 98% detection rate and with a maximum daily computation time of 4 min. Given the good results, a leading Italian bank deployed our system in their environment to analyze frauds.
• It's not all about hacking, Jurica Čular, Croatian Government's CERT
  Although we often think on cyber security as purely hacking activities, either offensive or defensive, there is much more in it. This lecture will give you retrospective on why it is important to have strategic thinking on a state level in terms of cyber security.What should be the most important parts of national cyber security strategy, how to implement it and what are the major challenges in starting a process on country-wide scale.
• ABcD - "Automated Bug (cruised) Discovery", Miroslav Štampar, Croatian Goverment's CERT
  Presenting prototype of heuristic, fast, open source and modular web browser plugin for "bug bounty" hunters and/or penetration testers which utilizes cross-browser userscripting (e.g. Greasemonkey). It automatically performs in-browser fast and non-intrusive web vulnerability checks against site(s) as you surf. In case of a positive match, data necessary for successful reproduction is stored for the later (mis)usage or passed to other penetration testing tools. In short: hack as you surf (or the other way around).
• Mobile Application Security, Zsolt Nemeth, Camphora Consulting
  Every mobile app has the potential to steal or leak sensitive and private company information. Risky app behaviors, hidden actions, and malicious malware code can all conspire to exfiltrate valuable information from employee mobile devices.Mr Nemeth will provide a glimpse into the most advanced app risk analysis technologies available for assessing and reporting the risks.
• An unexpected journey: From XSLT injection to a shell, Saša Jušić, Infigo IS d.o.o.
  XSLT (Extensible Stylesheet Language Transformations) is a language that allows transformation of XML documents into various other document formats. Business applications often rely on XSLT to format reports which are subsequently rendered as PDF documents. Such applications also often need to allow a user certain amount of editing of XSL files, which get processed in order to render PDF documents. Malicious users can take advantage of powerful XSLT processing capabilities and perform various malicious activities.This presentation will demonstrate how complete control over a target server can be taken through simple modification of XSL files that are processed by the target (vulnerable) application. The presentation will conclude with demonstration of how OS commands can be executed through static Java classes called through an XSLT processor and how such vulnerabilities can be prevented.
• Security in Smart Metering - Smart grid, Nenad Andrejević, Comtrade d.o.o.
  Understanding security in Smart Metering and Smart Grid. Smart meters have got complex, and they are no longer a measurement instrument attached to a display.Instead they are made up of many components that include electronics and computers with all the same vulnerabilities that any other electronics or computers would have.This presentation explain how to consider security as one of the enablers for IoT.  
• Fighting malicious code, Zubair Khan, Tranchulas
  One of the biggest threats to day-to-day operations of any organization is malware. In this talk, we will discuss malware detection and analysis techniques in interesting ways. We describe how you can conduct investigations and demonstrate techniques for analyzing malicious activity. We will demonstrate how you can recover stolen data from your corporation by reverse engineering malware that encrypts data.
• The art of OSINT, Zubair Khan, Tranchulas
  Open-source intelligence (OSINT) is intelligence collection technique that involves gathering information from publicly available sources and analyzing it to produce actionable intelligence. In today’s data driven age, information does not have to be secret to be valuable. We cover various aspects of OSINT in this talk including methodologies, tools and techniques to monitor social media for intelligence collection.
• ICT Forensics Investigation on IPv6 Attacks, Mane Piperevski, Piperevski&Associates
  Vendors security features don’t cover IPv6 attacks detection and prevention in big way. We must know how to manually identify and investigate this type of attacks. In short we will cover basic methods that are very helpful in forensic investigation on IPv6 attacks.
• Fixing the fixing, Mitja Kolšek, Acros d.o.o.
  Software vulnerabilities are likely the biggest problem of information security, fueling a rapidly growing market for “0days”, “1days” and exploits alike. It can be highly intellectually challenging to find a vulnerability and create an exploit for it, and super entertaining to reveal it all to the bug-hungry crowds (preferably along with a logo and a catchy name, courtesy of the marketing department). As a result, there’s been a lot of innovation and progress on the offensive side of information security, and a corresponding defensive industry is thriving providing quasi-solutions that can be bypassed by any motivated attacker.
  But almost nothing has changed at the core of the problem: software vendors still produce critical vulnerabilities, aren’t motivated to provide patches, and only a handful of them are capable of responding and delivering a security update when a 0day gets published. And then, when a vendor’s security update is available, it takes weeks or months before it gets applied throughout a corporate network as the risk of interrupting business processes requires testing and gradual deployment. (And do we need to mention that exploit kits tend to add exploits just a few days after official patches come out?)
  Now, what if vendors didn’t have a monopoly on patching their code because any vulnerability researcher could write a patch instead of (okay, in addition to) writing an exploit? And what if admins weren’t afraid to apply the patches because patches could be applied instantly without relaunching applications or restarting computer, and could also be instantly un-applied if they turned out to be causing problems? The technology for this exists (hint: 0patch.com), and will allow vulnerability researchers to not only research a vulnerability but also fix it with just a few well-chosen machine code instructions – and monetize their hard work in an unquestionably ethical way. It is time to fix the process of vulnerability fixing.
•  Security is Broken V2.0 (30min) (latest attacks and effective countermeasures) Jorge Sebastiao, CISSP
  “Are you brining a knife to a gun fight? Over the last 5 years information security has been playing catch-up with the hackers. Increasingly sophisticated phishing scams expose users and corporations… Vulnerable code is everywhere: Mobiles, Mobile Apps, Cars, wearable’s, IoT Devices and SCADA and Payment systems… Can we cope?
  The traditional systems of security awareness campaigns, code testing, patching or network signature based detection, firewall, IDS/IPS are no longer enough. The modern hackers are agile, creative, share information and develop new undetectable innovative attack methods. A fresh look at the new generation of potential defence mechanisms and their contribution to diminish the risk. How to use new methodologies, tools, and techniques that can be effective against these new attack vectors and enable us to defend effectively and quickly enough not to be too late…