t2 2021 officially announced

The next edition of t2 will happen in spring 2021. We’re opening our thought process below.

As the first phase of COVID-19 pandemic is almost behind us, it may initially seem counter-intuitive to cancel now. Rest assured, we still know what we’re doing. t2 has always been an event for the community by the community, and shifting the traditional October event was not an easy decision, but it was the only one we could make.

This isn’t the case of being risk averse, rather it’s about understanding both the upsides and the downsides, our own values and focusing on what truly matters.

As a community event, protecting both our audience and speakers is the only important thing at the moment. While countermeasures and protocols against the novel coronavirus and other infectious diseases have been implemented all over Europe, there’s very little practical experience on living with the “new normal”. Second wave might be coming in the fall and that’s just Europe. Last year we had visitors from 17 different countries.

Being a practically-non-commercial event, we can err on the side of caution – there’s no need to calculate “acceptable infection rate”. If you don’t personally know your audience and guests, you might be tempted to categorize “95-99% uninfected” as a job well done, and the few infected just being the cost of doing business. Yet, many of our visitors are longtime t2 attendees and good friends – the rest, new friends and (hopefully) future t2 visitors. Who’s an acceptable casualty?

With the heavy parts out of the way, we can now ridicule glitchy webinars as full blown conference replacements. No doubt watching a hung-over Grugq deliver a keynote over Zoom, wearing just Vibrams without pants, and waiting for the video to buffer like it’s RealPlayer’s heyday, is the epitome of conference immersion for many. After all, how cool it is to sit at home, unshaven and alone, in pajamas, while tweeting how awesome a conference you’re attending? During breaks, you can either join a chat room with thirty to fifty other introverts trying to make awkward small talk all implementing CSMA/CD, or better yet, call one of the other attendees you know and with whom you speak weekly in any case. Instead of proving Dave Aitel so wrong by serving him pizza in Europe at 02:30AM, you can play online (chat) roulette or read someone else’s retweets.

The in-person interaction, exchange of gifts/drinks/insults/cash/exploits, lobby bar chats, meeting new people or old friends whom you mostly meet in conferences, or just casually (and legally!) analysing the security level of a publicly available computing device are the key ingredients for a successful t2. Just like Campari & Soda, t2 is an acquired taste.

By postponing the event to 2021, we have plenty of time to scout for a new venue, with a functional lobby bar. Having t2 in spring means better weather in Helsinki – we’re expecting to finally reach the Security Vacation Club Global Top 5000 list and are thus preparing accordingly. In the meanwhile, we’ll collect more data on the global pandemic and event safety processes, which actually work. 

Exact dates and CFP will come out later. Stay safe. Be Brave.

Hacking ML in images (and everywhere else)

This time we’re looking back into our archives to bring you a presentation from Guy Barnhart-Magen and Ezra Caltum. In their t2’18 talk the BSidesTLV co-founders cover offensive research possibilities when it comes to machine learning systems. Do you know which ML attacks have the most business impact? Watch the video to learn more.

The presentation will be answering questions such as “what does it mean to hack a machine learning system?” and “what would you actually target?”, with an emphasis on the methodology and the way Guy and Ezra approached the problem.

We have always enjoyed these types of talks, as the shared knowledge powers the audience to do research and find their own zero days. Speaking of research and zero days – don’t forget to checkout BSidesTLV, coming July 2 2020!

John Lambert keynote

Merry Christmas! As a small Christmas gift, we’re publishing John Lambert‘s t2’19 keynote “Advancing InfoSec”.

In the keynote John demonstrates with practical examples how we can accelerate learning through “Githubication of Infosec”. If you are a modern defender, or aspire to be one, this is the presentation to watch. Without giving away too much, graphs, MITRE ATT&CK (with cloud updates), winter2020, and repeatable analysis with Jupyter notebooks are all covered.

Thank you John for keynoting this year, and our warmest gratitude for the following kind words:

t2 has always had that commitment to technical excellence. .. Conferences, they may start like this, but they don’t always end up like this.

— John Lambert


Honoring that tradition has kept us going for the past sixteen years, and we promise to continue work hard to keep it this way, as t2 has always been and always will be an event for the community. Next year’s conference dates are Oct 29-30, 2020.

Finance With Attitude

Those who personally partake in the autumn theater, or have bosses who are in the game, know this is the time of the year when bigger decisions are made.

Since everybody is exposed to big ticket items and larger numbers, throwing in the annual training cost is best done close to those discussions. A pro player separates the travel costs from the event cost, as these come from a different category anyways. Depending on your organization, there may or may not be leeway, so act accordingly.

Why go through all this trouble, our junior readers ask? Well, the discussion of attending t2’20 (and your other favorite cons) is a lot more easier for you and your boss, when everything has been agreed already beforehand and there is the money available for it. If you have a boss who appreciates employees making their life a tiny bit easier, giving the right support at the right time can go a long way. 

At the end of the day, your boss is the one who needs to figure out the right course of action after the Good Idea Fairy visited C-level executive(s) and they decided to go three levels deep into the budgeting spreadsheet to make cuts without any discussion on its impact or guidance on a new direction. Or maybe your boss was naive enough to provide accurate numbers from the get-go, when everyone else was inflating their numbers in anticipation of the first round of cuts. 

The worst kind of budgeting wizard just runs out of money in Q4, and the rest of the organization takes the hit. For those, you reserve your sneakiest DDE payload, figure out a chain of actions resulting in the file on their workstation, get the code running (everyone clicks OK at some point), establish persistence and wipe the payload from the original file. Whatever happens after this is left as an exercise for the reader.

Talking of planning, the big game hunter is saving up their Office 0days for this time of the year. Depending on the organization structure and budgeting process, it might be trivial to land your carefully crafted version of the budgeting numbers on at least one C-level workstation. Be sure to take note well in advance if someone is deviating from corporate policy with their device choice – this is most likely one of the easiest targets from exploitation perspective, as you can bet it lacks some or all hardening. IT isn’t too keen on debugging mysterious crashes happening to a unique snowflake, in case your toolkit isn’t that stable. Bonus points given for pretexting service desk with a false track record of unstable behaviour on a similar device, if you just can’t be bothered to get your budget items stable enough.

Not that any of these kinds of hypothetical things ever happen in real life. It would be ridiculous to potentially burn valuable exploits when you can just enjoy the adrenaline rush of quick rubber ducky action on the top floor, or casually misplace USB-cables in the right meeting rooms (Outlook Scheduling Assistant is your friend here).

So, get those events locked down on the budget level. Getting the commitment for your attendance well in advance never hurts.

After all, bug bounty and exploit money is typically reserved for bottle service, fast cars, exotic vacations and expensive handbags. And yeah, while Helsinki definitely can tick those boxes, we hope that the main reason for attending is our curated and hand picked program – finally available in its complete version.

t2’19 speakers confirmed

The CFP is over for this year and the speaker lineup is ready for your reading pleasure.

Without sounding too enthusiastic for a Finn, it’s difficult not to get excited when there are entries on the agenda like the keynote from John Lambert, Distinguished Engineer and General Manager of the Microsoft Threat Intelligence Center. A seasoned t2 attendee might remember him from sparking the original inspiration behind olleB’s t2’15 talk ”If attackers think in graphs, why can’t we?”.

Looking at the schedule, it’s both refreshing and rousing to see research targeting wireless input devices and VPN clients. Both could easily be dismissed during target selection as mature technology, yet here we are. Having said that, there’s still a healthy focus on modern and up-and-coming tech in the agenda, such as using machine learning for vulndev.

Traditionally this post always ends with a gentle reminder to get your ticket early. The sales have been open for a couple of months and a good chunk of the tickets have already been sold. If you haven’t bought yours already, there’s not a better time for action than right now.