News

Beyond Security to sponsor t2’17

We are happy to announce a new sponsor of t2! Beyond Security SSD is a high end vulnerability disclosure program established in 2007. With over a decade of history in the business, they have a solid understanding of researcher needs.

The products in the scope include major operations systems, widely used software components, web platforms and network infrastructure equipment / software. Reported vulnerabilities are communicated to both the affected vendor and Securiteam clients. You can view the latest vulnerability publications on Securiteam blogs. If you have any questions about the process, just tweet!

Should you want to meet them in person, you can do that at t2’17 in Helsinki, October 26-27. Good luck in bug hunting!

News

New location area code detected

After a solid run of nine years, we are changing the venue to Radisson Blu Seaside Hotel.

The old hotel certainly holds dear memories like the once-locked-down-and-restricted-but-now-retired web kiosks *krhm* and the lobby bar. Nevertheless, the new hotel offers freshly renovated guest rooms and larger meeting areas; features which are in the heart of conference experience.

The waterfront area offers a different view into Helsinki as it’s surrounded by both old and new – Sinebrychoff park is a couple of blocks away, while the neighboring Jätkäsaari island is the latest urban development in Helsinki. The Aleksanterikatu and Esplanadi area is as close as before, you just take the tram instead of metro or walking – travel time still under 10 minutes. Most importantly, compared to the previous venue, the odds for a boat chase are considerably better. Looking back, Radisson Blu Royal was the only hotel in t2 infosec history where getaway by boat was not that practical.

Helsinki residents and other long-time visitors may be shocked by the dramatic move of 700 meters (as the crow flies), but in the larger scheme of things, this is nothing – for example those who stayed at Bellagio when Black Hat was still held at Caesars Palace most likely walked to the conference. That distance is greater, despite being mostly indoors.

Staying fresh and keeping up with the times is required to stay in the game. With the challenge format reinvigorated, we hope that the new venue will keep us going strong – after 2017, if everything goes well, the planning for the 15th anniversary begins. Consider this year as the robustness test for the new venue.

Archive, Talks

Morgan Marquis-Boire keynote 2015

In this 2015 keynote headhntr aka Morgan Marquis-Boire philosophizes on nation state attacks, their history, how hackers operate, and the nature of the Internet. As with all philosophical content and/or keynotes, very little has fundamentally changed since the talk.

Is modern technology the Panopticon? What is the East Germany tipping point of today? Do you agree with Morgan at all? Watch the keynote and let us know on the Twitter with #t2infosec !

Trigger warning: Some slides TS/SI

Challenge, News, Talks

t2’17 Challenge – a break from tradition

This year’s pre-conference challenge will be a t2 exclusive bug bounty. For more information on how to participate, please see the t2’17 Challenge page.

As we’ve been organizing challenges for over a decade, you might wonder why change now? For several years in a row, the challenge participant numbers have been steadily declining, despite increased efforts put into creating the technical puzzles, challenge descriptions and back stories, and actual promotion. It’s not just the number of submissions, but also the downloads and page views. Thomas Malmberg kindly pointed out that with conference challenges we’re competing for people’s time – this is the arena where also bug bounties play.

It was time for us to either adapt or perish. This being t2, failure was not an option and quitting is something you do for apps, not in real life. With conference budgets one simply does not organize a bug bounty – you need friends’ help for that. That is the reason we partnered up with LocalTapiola to provide you a t2 exclusive bug bounty, targeting a real world business application running in production environment. To make sure the spirit of t2 challenges is still there, we are emphasizing the vulnerability quality and proof of exploitability. The challenge is not a speed competition – the most elegant and meaningful vulnerability submission will receive the free ticket, and we have adjusted the whole bug bounty process to reflect that.

Once you convert someone else’s medium severity local file read into unauthenticated remote code execution, you start to value proper analysis and investigation into the technical details of a vulnerability. In other words, 2002 called – they want their apache-scalp.c back. The 15 year anniversary is a pure co-incidence, as is Dave Aitel’s headline keynote at t2’17, the stars just happened to align the right way, like good exploitation primitives after putting in the time and effort.

The challenge is dead. Long live the challenge.

We hope you enjoy the reinvigorated format!

News, Talks

Dave Aitel keynote

Those who actually read the CFP announcement might have noticed the fine print in the footnote section where we announced this year’s keynote. Like having an IRC gateway from a BBS group chat, we’re trying to stay modern and understand that since time is money and everybody wants a TL;DR which fits a tweet, we need to provide one:

Breaking: Dave Aitel giving the headline keynote at t2’17! #t2infosec #cyber #leftoflaunch #dailydave #voiceofreason #buffythevampireslayer

In other words, we’re continuing the tradition of inviting former @stake / NSA employees / DailyDave posters  to speak at t2. If you’ve been reading mailing lists and not just clicking on random links from Twitter, you will probably agree that people who have been long enough in the game often have the kind of insight you can only get by having been there and done that. It is our pleasure to welcome Dave Aitel to deliver the keynote this year.

In case you were born after Miami Vice originally aired, do some googling and figure out a way to mention GOBBLES and our keynote speaker in the same sentence.