Thursday Oct 26, 2017
08:30	Registration and Morning Coffee: Powered by Forcepoint
09:15	Opening Words, Tomi Tuominen
09:30	Keynote David Aitel Immunity
10:30	Coffee: Powered by Accenture Security
10:50	Social engineering - Hacking your mind Pete Poskiparta Pete Poskiparta Ky
11:50	Lunch
13:00	T vs T or Why my offensive punch beats your forensics stance Hugo Teso F-Secure	Exploring enterprise Wi-Fi security with Aruba Christoffer Jerkeby F-Secure
14:00	Break
14:20	T vs T or Why my offensive punch beats your forensics stance Hugo Teso F-Secure	Lua code: security overview, practical approaches to static analysis, MSL tool Andrei Costin University of Jyvaskyla
15:20	Coffee: Powered by Accenture Security
15:50	Black Hat Locksmithing (with added Abloy) Matt Smith Citadel Locktools
16:50	Closing Words for the 1st day, Tomi Tuominen
17:00	Cocktails & Networking: Powered by Nixu
18:30	Cocktails & Networking ends
19:00	Afterparty: Powered by F-Secure
21:00	Afterparty ends

Friday Oct 27, 2017
09:30	Morning Coffee: Powered by Beyond Security
10:00	Red Teaming Probably Isn't For You Toby Kohlenberg
11:00	Coffee: Powered by Accenture Security
11:20	Amazon Web Services Security Tips Dave Walker Amazon Web Services	Offensive Malware Analysis Patrick Wardle Synack
12:20	Lunch
13:20	Breaking Tizen Amihai Neiderman tl;dr	A little review of security challenges in Silicon Photonics integrated circuits. Alexander Bolshev IOActive
14:20	Coffee: Powered by Accenture Security
14:40	Death By 1000 Installers; on macOS, it's all broken Patrick Wardle Synack
15:40	Closing Words, Tomi Tuominen
16:00	Conference Ends

Keynote

David Aitel @ Immunity

It's a Keynote!

Social engineering - Hacking your mind

Pete Poskiparta @ Pete Poskiparta Ky

Why social engineering is possible? How it works, why it works and what is the psychology behind it. The process is like magic. You see something but you can not see it.

T vs T or Why my offensive punch beats your forensics stance

Hugo Teso @ F-Secure

Last year, right after 2016 edition of t2 infosec, a challenge was placed, and accepted. The presenter was challenged by the infamous t2 founder, Mr. Touminen, to try to defeat his memory forensic skills in an epic duel that will take place, one year later, at this t2 edition. The contenders, that once used to be friends, will have a fierce battle during the presentation in order to finally answer the question: are the presenter offensive skills better than the host forensic ones? One year of preparations, research and development will be unleashed in the arena of the mighty t2 conference, and the attendees will be the ones to decide the outcome of the match!

Or to put it in a less dramatic way, in this presentation the speaker will show the results of his research in the field of memory forensics, specifically on how to *defeat* that field of incident investigation. All the previous literature about the duel is, nonetheless, true and the match will take place, followed right after the contest by a extensive technical overview of the methodology, tools, techniques and other resources developed on purpose for that challenge. The efficiency of the research will be proven during the duel but, successful or not, all of it will be explained. Although the code developed for this research will be made available to the attendees *during* the presentation, after it the attendees will have the chance to try them by themselves in a couple of environments that will be made available for them during the conference coffee breaks.

What to expect from this presentation? Low level research, Vulnerabilities, Exploits, Tools, GUIs and some fun war stories with the ever present offensive approach of this speaker’s presentations.

Round one. Fight!

Exploring enterprise Wi-Fi security with Aruba

Christoffer Jerkeby @ F-Secure

Gaining keys to the castle through enterprise Wi-Fi. Access points designed to add mobility to a traditional 802.11 set up require control-channel data-channel and heartbeat communications. When establishing a backbone for enterprise Wi-Fi the protection of the control channel and heartbeat mechanism become an attack surface for device and network integrity. This talk show recent security flaws in Aruba AP series devices and how they are exploited.

Lua code: security overview, practical approaches to static analysis, MSL tool

Andrei Costin @ University of Jyvaskyla

Abstract—Lua is an interpreted, cross-platform, embeddable, performant and low-footprint language. Lua's popularity is on the rise in the last couple of years. Simple design and efficient usage of resources combined with its performance make it attractive for production web applications even to big organizations such as Wikipedia, CloudFlare and GitHub. In addition to this, Lua is one of the preferred choices for programming embedded and IoT devices. This context allows to assume a large and growing Lua codebase yet to be assessed. This growing Lua codebase could be potentially driving production servers and extremely large number of devices, some perhaps with mission-critical function for example in automotive or home-automation domains.

However, there is a substantial and obvious lack of static analysis tools and vulnerable code corpora for Lua as compared to other increasingly popular languages, such as PHP, Python and JavaScript. Even the state-of-the-art commercial tools that support dozens of languages and technologies actually do not support Lua static code analysis.

In this paper we present the first public Static Analysis for Security Testing (SAST) tool for Lua code that is currently focused on web vulnerabilities. We show its potential with good and promising preliminary results that we obtained on simple and intentionally vulnerable Lua code samples that we synthesized for our experiments. We also present and release our synthesized corpus of intentionally vulnerable Lua code, as well as the testing setups used in our experiments in form of virtual and completely reproducible environments. We hope our work can spark additional and renewed interest in this apparently overlooked area of language security and static analysis, as well as motivate community's contribution to these open-source projects. The tool, the samples and the testing VM setups will be released and updated at http://lua.re and http://lua.rocks

Black Hat Locksmithing (with added Abloy)

Matt Smith @ Citadel Locktools

When locksmiths go bad. Black hat lockpicking has been around forever but it is very rarely spoken about. It is the elephant in the lockpicking room. Using some real-life examples, the murky world of the black hat locksmith is explored.

As this talk will be in Finland, it is fitting that I have found myself specialising in Abloy over the last 8 years or so (purely because nobody else had (seemingly) done so). Starting with the 110 year-old Abloy Classic, I have worked my way up the Abloy food chain and now make tools to do open the whole family. Abloy have a mythical status as unpickable locks, so it might be a shock to the average Fin that this is even possible. I will show some weaknesses in Abloy locks and how Abloy have fixed them over the years and why picking Abloy is so difficult.

Red Teaming Probably Isn't For You

Toby Kohlenberg

This talk will be an overview of what red teaming actually is; where it came from, why the majority of people using the term are doing it wrong, how to decide where and when to use it, and where to go to learn how to do it right.

Amazon Web Services Security Tips

Dave Walker @ Amazon Web Services

In addition to discussing various AWS authorisation tips and tweaks to ensure API and asset access authorisation is scoped to a minimum, I'll be introducing the use of AWS Organizations for Mandatory Access Control and an early look at how to integrate compliance measures into a multi-account logging and analysis architecture.

Breaking Tizen

Amihai Neiderman @ tl;dr

Tizen​ ​is​ ​samsung's​ ​newest​ ​OS​ ​for​ ​it's​ ​devices​ ​and​ ​considered​ ​by​ ​them​ ​as​ ​the​ ​operation system​ ​of​ ​everything,​ ​aiming​ ​to​ ​run​ ​on​ ​every​ ​device​ ​from​ ​simple​ ​IoT,​ ​mobile​ ​phones, televisions​ ​to​ ​even...Cars.

Over​ ​the​ ​last​ ​few​ ​months​ ​I​ ​observed​ ​that​ ​samsung​ ​is​ ​laying​ ​the​ ​groundwork​ ​for​ ​a​ ​larger expansion​ ​of​ ​tizen​ ​in​ ​the​ ​mobile​ ​world.​ ​It​ ​appeared​ ​that​ ​samsung​ ​is​ ​adding​ ​more​ ​servers​ ​and more​ ​infrastructure​ ​to​ ​support​ ​an​ ​upcoming​ ​growth​ ​in​ ​the​ ​amount​ ​of​ ​tizen​ ​users​ ​worldwide and​ ​is​ ​planning​ ​to​ ​expand​ ​to​ ​new​ ​markets.

I​ ​then​ ​decided​ ​to​ ​start​ ​and​ ​research​ ​tizen​ ​due​ ​to​ ​the​ ​fact​ ​that​ ​it​ ​seems​ ​that​ ​nobody​ ​is​ ​doing​ ​it! The​ ​tizen​ ​mobile​ ​firmware​ ​was​ ​obtained​ ​pretty​ ​quickly​ ​and​ ​from​ ​a​ ​thorough​ ​investigation​ ​it seems​ ​that​ ​samsung​ ​hasn't​ ​learned​ ​anything​ ​from​ ​the​ ​publications​ ​about​ ​0days​ ​in​ ​the​ ​past few​ ​years.​ ​The​ ​code​ ​is​ ​not​ ​designed​ ​with​ ​security​ ​in​ ​mind,​ ​is​ ​not​ ​up​ ​to​ ​any​ ​modern​ ​security standards​ ​(you​ ​can​ ​find​ ​strcpy,​ ​memcpy,​ ​sprintf​ ​almost​ ​anywhere.​ ​and​ ​always​ ​to​ ​a​ ​fixed​ ​size buffers). during​ ​the​ ​course​ ​of​ ​a​ ​few​ ​days​ ​I​ ​found​ ​over​ ​40​ ​different​ ​vulnerabilities​ ​in​ ​tizen​ ​-​ ​some​ ​logical and​ ​some​ ​just​ ​classic​ ​(really​ ​classic!)​ ​memory​ ​corruptions​ ​bugs.​ ​Almost​ ​every​ ​system​ ​app​ ​is vulnerable.

Offensive Malware Analysis

Patrick Wardle @ Synack

In this talk, we'll focus on the 'B' variant of FruitFly that even now, is only detected by a handful of security products. We'll begin by analyzing the malware's dropper, an obfuscated perl script. As this language is rather archaic and uncommon in malware droppers, we'll discuss some debugging techniques and fully deconstruct the script. While this dropper component also communicates with the C&C server and supports some basic commands, it drops a binary payload in order to perform more complex actions.

However, instead of fully reversing this piece of the malware, the talk will focus on an initial triage and show how this was sufficient for the creation of a custom C&C server. With such a server, we can easily coerce the malware to reveal it's full capabilities. For example, the malware invokes a handful of low-level mouse & graphics APIs, passing in a variety of dynamic parameters. Instead of spending hours reversing and debugging this complex code, via the C&C server, we can simply send it various commands and observe the effects.

Of course this approach hinges on the ability to closely observe the malware's actions. As such, we'll discuss macOS-specific tools that can monitor various events, and where necessary detail the creation of custom ones (e.g. a 'mouse sniffer' that locally observes and decodes commands sent from the malware to the OS, in order to control the mouse).

While some of this talk is FruitFly and/or macOS specific, conceptually it should broadly apply to analyzing other malware, even on other operating systems.

A little review of security challenges in Silicon Photonics integrated circuits.

Alexander Bolshev @ IOActive

Silicon photonics is the study and application of photonic systems which use silicon as an optical medium. This is kind of new technology, which grows and develops very fast. For example, this year, several vendors started to sell first silicon photonics devices, and silicon photonics computing circuits (e.g. one of them do optical solution of traveling salesman problem, based on neural networks) were presented. So far, the security areas of this technology remains in shadow. But with this talk, let's try to uncover some of them. Brief introduction to the silicon photonics devices will be given, we will discuss reverse engineering approaches to the silicon photonics ICs and talk about possible ways of exploiting optical photonics switch circuits. In the end of the talk, we will discuss how to defend against this attack vector.

Death By 1000 Installers; on macOS, it's all broken

Patrick Wardle @ Synack

Ever get an uneasy feeling when an installer asks for your password?

Well, your gut was right! The majority of macOS installers & updaters are vulnerable to a wide range of priv-esc attacks. It began with the discovery that Apple's OS updater could be abused to bypass SIP (CVE-2017-6974). Next, turns out Apple's core installer app may be subverted to load unsigned dylibs which may elevate privileges to root. And what about 3rd-party installers? I looked at what's installed on my Mac, and ahhh, so many bugs!

Firewall, Little Snitch: EoP via race condition of insecure plist Anti-Virus, Sophos: EoP via hijack of binary component Browser, Google Chrome: EoP via script hijack Virtualization, VMWare Fusion: EoP via race condition of insecure script IoT, DropCam: EoP via hijack of binary component and more! ...and 3rd-party auto-update frameworks like Sparkle -yup vulnerable too!

Though root is great, we can't bypass SIP nor load unsigned kexts. However with root, I discovered a few other bugs that could now be triggered - such as SIP bypass and a ring-0 heap-overflow that provides complete system control. We'll talk about these too! Though the talk will discuss a variety of discovery mechanisms, 0days, and macOS exploitation techniques, it won't be all doom and gloom. We'll end by discussing ways to perform authorized installs/upgrades that don't undermine system security.