Lectures in English - HEK.SI 2018

• How we introduced NIS Directive into Croatian legislation?, Jurica Čular, Croatian Government's CERT
  On May 9, Croatia will, along with other EU member states, introduce new cyber legislation as a result of NIS Directive transposition. Creating a policy in dominantly non regulated environment was a challenging process that involved many stakeholders with different cyber awareness potential. This talk will bring insight into key stakeholders involved with new policy and detailed explanations of Croatian approach used to tackle with key NIS Directive demands. 

• Why everybody should do CTF/Wargames?, Miroslav Štampar, Croatian Government's CERT
  This presentation covers different aspects of CTF/Wargames that author finds particularly important in self-learning of any individial involved in information security field. Most of all, by presenting couple of cases that could be found (freely) on Internet, audience should get a better picture of vast range of possibilities that could help them to become better at everyday job activities. Instead of sitting helplessly and watching bad guys win the (online) fight, everybody should try harder and prepare by learning (solving) something new each day.

• Core Banking Systems, Crypto coins and other business solutions are under attack, Balázs Hambalkó, Balasec
  What is it? You think you own it because you have bought it. But it's useless for you, thanks for the people's approach. It's IT Security at your system!
  I will be talking about what are the reasons the enterprise level companies/solutions (banks, agencies, Core Banking Systems, Crypto coins, and so on...) are still suffering
  and are being under (successful) attack. Based on some true story I encountered in 2017 ...

• CVE-Scraper, Alex Conti, Politecnico di Milano
  During pentest activity the most painful part is reporting the issues found. We are struggling to improve our reporting method, decreasing in the meanwhile the time we spend on it. We think that in this way it's possible to focus on the real pentest activity, more useful and a lot more enjoyable! I have an idea to make vulnerability reporting faster and also to make it easy to find software vulnerabilities, exploits and remediations. Online there are plenty of sites that make available CVEs for a specific software version and there are also many places where it is possible to find exploits. In order to automate this process, I thought to download and maintain updated some CVE's databases, indexing vulnerabilities and looking for details offline. Alternatively the search could be made online in real-time, in order to waste the less space possible on disk.

• (Advanced) Android Mobile Application Hacking, Mislav Boroš, INFIGO IS d.o.o.
  There are numerous books and tutorials out there describing the basics of Android mobile application security, however, most of them heavily rely on tool usage.
  While tools certainly help, in many situations they simply do not work as intended and leave you in a blind-alley with the deadline approaching.
  This presentation will demonstrate some examples of how to efficiently reverse and modify tested Android applications, based on dozens of mobile application penetration tests performed by INFIGO IS.
  Instead of blindly using different tools, we will get our hands dirty and show how to bypass and intercept custom encryption modes, manually remove different security controls (like certificate pinning and jailbreak detection) and even quickly develop custom testing applications while recycling the original application code.
  
  
• The experience of CERT-UA in cyber threat counteraction, Yevheniia Volivnyk, CERT-UA
  Presentation of CERT-UA team activity. APT attacks on the information systems of Ukraine. Cyber Incident Response Center.

• Designing practical Audit Trails in Oracle, Pete Finnigan, Oracle Security specialist
  Pete will present the situation faced by most DBAs. An Oracle database that has limited audit trail settings provided by Oracle by default. These settings have been enabled since version 10.2 but do they work" do they provide accountability? - lets see. Pete will breifly introduce two web applications that are developed with Oracle as the back end and show how during hacking the applications and revealing such details  as credit card numbers (PCI)c and customer details (GDPR) how well Oracles default audit trails perform; do they catch the actions performed, can we detect what happened and by who. Then Pete will introduce the features of a simple policy based toolkit that he has created himself for the Oracle database and install this. he will then hack the database again and see if the results are instantly better; they should be.

• NAT64 eksperimenti v Go6Lab-u in orodje NAT64Check, Jan Žorž, Go6 / Internet Society
  As many mobile operators were moving to IPv6 only which is incompatible with IPv4 on the wire, it’s necessary to employ transition mechanisms such as 464XLAT or NAT64. The Go6lab NAT64/DNS64 testbed was therefore established so that operators, service providers, and hardware and software vendors can see how their solutions work in these environments.
  This has already generated significant interest, and instructions on how to participate are available on the Go6lab website.
  When using NAT64 there are many things that need to be checked to ensure they work correctly. NAT64check has therefore been developed to allow websites to be checked for consistency over IPv4, IPv6-only and NAT64, as well to compare responsiveness using the different protocols. This allows network and system administrators to easily identify anything is ‘broken’ and to pinpoint where the problems are occurring, thus allowing any non-IPv6 compatible elements on the website to be fixed. For example, even if a web server is not running IPv6 (why not?), hardcoded
  IPv4 addresses can cause NAT64 to fail.

• onyx - unique search engine that crawls entire web and identify outdated platforms , Primož Cigoj, Institut Jožef Stefan
  Onyx is a solution to create a unique search engine that crawls the entire web with one and only purpose to index the current running software version and identify outdated ones. Based on the security hole and indexed version of the software would be possible to assess the potential damage. Owners of the websites who are running vulnerable software could be warned to update their software. Based on collected data (indexed websites) it would be possible to predict and define geographical damage, as geolocation of each server is available to retrieve while indexing websites. Estimated damage caused could be calculated and reported, geographically and in numbers of users.

• Predajaj znanje naprej, pomagaj pri varnosti (Share your knowledge, help with security), Elijah Hlastan in Žiga Deutschbauer, Fogy Tech
  Have you ever sat in a café and logged onto Facebook? Maybe your bank account? Did you ever wonder who else was logging on with you, watching what you do, stealing your credentials?
  As hackers, we think about these problems regularly. Which is why we are creating a product to protect individuals from data theft. Come and interact with us as we present our product in development, and share your ideas with us as we work to build a safer browsing experience for others.
  The world of cybersecurity is strange and uncertain. You could almost say the future is a bit FOGy.

• The PENtesting is mightier than the sword, Matija Verić, Atia Consulting
  The PENtesting is mightier than the sword - We will cover why is Penetration testing important, what are the prerequisites for both, a customer and a penetration tester, to make the best out of the project. Furthermore, we’ll be showing selected information from the real cases.

• Princess and the beast in the cyberworld, Aleksandar Mirkovic, eSigurnost
  From zero to full control
  Demo will include:
  Evil twin attack, Java applet exploit and WannaCry exploit, privilege escalation, hash dump and lateral movement on the network.
  I will create a fairy tale about a Company Manager sending some emails from coffeeshop being unnoticeable hacked, and unintentionally bringing hacker into company, so hacker can hack the whole company from inside.