Lectures in English - HEK.SI 2017 

• Open Source Intelligence Techniques (OSIT), Michael Stout, Nemsec
  Ever wonder about your Internet footprint? What is the information out there about your organization or you personally? OSIT are used by hackers to gather information on companies before an attack to minimal their exposure. They are also used to focus whaling and spear-phishing attack with precision. Using only a web-browser, Michael Stout will show you how to find out what others can discover about you and your organization.
  
  
• Demystifying the Darknet, Michael Stout, Nemsec
  What lurks in the encrypted bytes of the Internet? In this fast-paced lecture and demonstration, Michael Stout will take you from a Darknet client to Darknet host. Participants will learn how to get onto the Darknet, what one can find in the Darknet and how to set up a Darknet site to better understand the risks (or benefits) the Darknet presents to Information Security professionals.
  
  
• OWASP Internet of Things penetration testing methodology, Mane Piperevski, Piperevski & Associates
  Knowledge to do penetration testing is often considered execution of project based testing in one IT system. Today we are moving forward with use of Internet of Things (IoT) that combines different technologies and IT systems under one solution IoT. Penetration testing is moving forward also by introducing newly constructed penetration testing methodology for IoT introduced by Open Web Application Security Project (OWASP). This lecture will give you short preview of key points in OWASP IoT penetration testing methodology and look inside practical example.
  
  
• ICT Forensics - Investigating Internet of Things Devices, Mane Piperevski, Piperevski & Associates
  We all use them, they are part of our life. Internet of Things (IoT) devices are easily becoming part of some crime and therefor it is up to ICT forensics investigation to help solve the crime. Attend this lecture to see look inside ICT forensics investigation process on finding key evidence from IoT devices. 
  
  

• Security through obscurity - are enterprise level printers & scanners my friends or enemies?, Balázs Hambalkó, Balasec
  What is that tool you have never ever involved into your security forensic processes? When your company get a security related incident which tool will not be suspected of by your IT Security Experts? Generally speaking, your IT team do not want to look under the hood and implement restrictions – everybody is just happy because everything just works fine. I dare say, this approach would lead to a real threat! Let me explain and prove it. If you are interested in, feel free to follow my presentation!

• T(rojan) SQL 2000-2016, Balázs Hambalkó, Balasec
  Based on my research, I have developed a malicious code in TSQL and have implemented into the MsSQL model database successfully. With this brand new idea I was able to leverage a vulnerability even though the company follow the Security Best Practices books. To sum up, I could steal the Sysadmin SQL user's passwords hash and hack it with a dictionary attack – that I developed TSQL as well. I could overwrite a Sysadmin password to a new one. I could create a brand new Sysadmin SQL user and execute any malicious update or delete command in any database... And in the end I demonstrate that I even could circumvent the SQL Security Audit processes in the background. Nobody could not catch my code and there are no entries in the logs.
  
  
• Exploit generation and JavaScript analysis automation with WinDBG, Csaba Fitzl
  Presentation will cover two different topics, which will show how easy and powerful is to automate various tasks with WinDBG.
  
  Part 1:
  Many people are familiar with scripts which can help during an exploit development. But what if we automate the entire process once we have the bug? In the presentation we will show a tool that can take a POC BoF exploit (which generates a crash / EIP overwrite) and from that it can automatically generate a fully working exploit.
  
  Part 2:
  Javascript code deobfuscation always presents a challenge for malware analysts, analysis being time consuming, sometime even anti-debugging techniques make it more difficult.
  
  What if we had a mechanism to see into the very core of the JavaScript engine and the DOM and be able to track down what the malware was up do without having to make any changes to the code and without giving the malware a chance to sense a debugger being present? Eval? Document.write? Lambdas? No problem!

• The behaviour of Malware, Jose Perez Alegre, F-Secure Labs
  The Malware techniques evolve continuously, but its behaviour remains. In this presentation, we will look at some of the common and uncommon ways the Malware act on a Windows system from compromise to persistence.

• Security in health care - when disclosure of vulnerabilities could harm patients, Kevin Kelpen, ERNW
  In the past, medical devices were solely mechanical without any external interfaces. Technical advances have not stopped for these devices as well however: Nowadays they are complex with features like networking and remote management, while security on the other hand has not been a concern. Since vulnerabilities in such devices can directly harm patients, the responsible disclosure of such is very important. We will explore problems that can arise by looking at two cases: The St. Judes Medical pacemaker which vulnerabilities have been disclosed fully without a patch available at the time and our experience with assessing the security of a Magnetic resonance imaging (MRI) device.

• Darktrace – introducing the automated network cyberdefense based on machine learning and advanced mathematics, Akos Bodis, Yellow Cube - Darktrace Distributor and Marko Kašič, Si.mobil - Darktrace Partner
  Darktrace, the enterprise network immune system developed by leading mathematicians and ex-government intelligence specialists has arrived to Slovenia. The Darktrace Enterprise Immune System technology detects and responds to previously unidentified threats, powered by machine learning and mathematics developed by specialists from the University of Cambridge. Without using rules or signatures, Darktrace is uniquely capable of understanding the ‘pattern of life’ of every device, user and network within an organization, and defends against evolving threats that bypass all other systems. Some of the world’s largest corporations rely on Darktrace’s self-learning technology in sectors including energy and utilities, financial services, telecommunications, healthcare, manufacturing, retail and transportation. Darktrace is headquartered in Cambridge, UK and San Francisco, with global offices including New York, Auckland, London, Milan, Mumbai, Paris, Singapore, Sydney, Tokyo, Toronto and Washington D.C.

• Make It Count - Progressing through Pentesting, Bálint Varga-Perke, Silent Signal
  As attacks become more visible and IT security becomes top priority in more and more areas the demand for professional consulting grows rapidly. In the case of penetration testing, this means that many new people get involved in the execution, while many companies run their first ever offensive assessments. This leads to many misunderstandings and ineffective results.
  In this talk, I will describe how a penetration test can contribute the most to your defense and even your security culture. I will show that you can benefit from the test even before the project started and how you can turn one-off results into long-term, robust developments.
  Meanwhile practical tips for effective project scoping and execution will be presented, underpinned with real-world case studies.

   

• A story about a (really bad) hack, Antonio Zekić, Infigo d.o.o.
  "We're so small, in such a small country like Croatia, no one would take interest in hacking our systems."
  Have you ever heard such a sentence? For us - it happens too often: both the saying and the hack!
  This presentation will show findings of a really bad attack against a medium sized company that INFIGO IS performed forensics on.
  The attack was so devastating that not only the attackers stole valuable data, but also managed to practically block the whole company.
  The presentation will show TTP's (Tactics, Techniques, Procedures) used by attackers as well as give recommendations on how to prevent and detect such attacks.

   

• Mobile payments apps data protection, Iztok Štorman, Finspire AG, Švica in Peter Žmak, Finmobile d.o.o.
  The threat landscape is evolving, and mobile threats are on the rise. What can we learn from recent mobile threats to better protect mobile data, end-to-end, today and tomorrow? Security presentation will touch:
  • Understand today's mobile threats and the risk they incur on the end-to-end mobile data workflow
  • See why securing the end-end mobile workflow is important to overall security & trends
  • Hear about area where right mobile security present crucial part for business: mobile payments & apps
  Today, mobile payment solutions are built as very secure — in fact, more secure than the old-fashioned swiping of a credit card at a point-of-sale terminal. But in light of the recent rash of mobile app attacks and the new attack vectors that have emerged, right mobile payment security approach is viable for mobile payments.

   

• Cybersecurity from Airbus – Introducing Stormshield, the all-European, independent network security vendor of the Airbus Group, Akos Bodis, Yellow Cube – Stormshield Master Distributor
  Backdoors and computer networks exploitation is a serious threat to any nation state government or corporation that is looking to safeguard citizen’s personal data and R&D intellectual property. With the new GDPR regulation coming soon into effect in the EU, security officers need to rethink and complement their security stack to avoid data theft and cybersecurity incidents. The foundation of a secure network is a next generation firewall from a trustworthy vendor, and Stormshield from Airbus stands out far above the competition in the field of trusted, backdoor-free, all-European security.