Luck, Timing and a Nice Cup of Tea: Essential tools in surviving a cyber attack

Based on his experience as CISO for Maersk Line during the NotPetya attack of 2017, Andy will provide a first hand account of what it felt like to be at the sharp end of what has been described as the single most expensive computer security event in history. He will examine the attack from a human and business perspective but will primarily explore some of the technical elements that made the attack so deadly and recovery so hard.

What I Learned from Attackers in the Past 20 Years

I'll talk about the things that real-world attackers have taught me in the past 20 years. I've had the pleasure of facing state-sponsored attackers, criminals, highly skilled malware authors, and teenagers with too much time on their hands. They've taught me lessons that I use in my daily work, defending companies and individuals. This talk will go through my most memorable encounters with threat actors, my most embarrassing mistakes, and biggest learnings.

Evolution of open source intelligence: what lies ahead?

Open source intelligence (OSINT) has been transformed by mobile internet, social media, and commercial space-based capabilities. Emerging AI applications are promising another major step forward in the field. This presentation will discuss what's possible today with OSINT, and what lies ahead.

Not a Generative AI talk

In 2018 the scene was set for a corporate adventure the likes of which were unlikely at best. In the latest installment of this demi-decade-spectacle Mark will recount tales from the trenches of 2020 to present(ish) day. There will be pirates, pangolins, procurement, possibly placebos and power supplies, all whilst trying to keep business, and some "other things", running whilst the threat landscape looked the weirdest it ever has.

Have U Been Invited? My Journey to Find and Chain macOS Vulns

This is a story about my journey to find logic bugs in macOS. During 2020 - 2022 I found a bunch of them and reported three major vulnerabilities from macOS. I will explain my methodology to find them and walk you through an exploit chain that compromises users' sensitive data with zero click.

This latest chain starts with a zero-click vulnerability that I found in macOS Calendar. It allows an attacker to add or delete arbitrary files inside the Calendar sandbox environment. This will lead to arbitrary code execution.

Some of the patches are still coming so unfortunately I can not disclose the full vulnerability chain yet. Instead, I will concentrate more on the first part of the vulnerability chain.

Additionally I may add some spices from previous vulnerability chains.

Closing the gap: IR expectations and Technical Reality

Effective incident response is a critical component of any cybersecurity strategy. However, slow incident response can present significant challenges for cybersecurity professionals. In this presentation, we will explore the technical complexities that contribute to slow incident response and provide practical insights into improving response times. We will delve into the nuances of threat detection and containment, highlighting the technical difficulties involved in accurately identifying and mitigating threats. We will also address the importance of efficient and effective communication between teams, emphasizing the need for clear lines of responsibility in a multi-team and multi-organization environment. Through real-world examples and case studies, we will illustrate the consequences of slow incident response and provide practical insights into leveraging automation and other advanced technologies to speed up incident response times. Overall, our presentation will challenge attendees to view slow incident response through a technical lens, emphasizing the critical role of technical expertise and advanced technologies in effective incident response. Attendees will leave with actionable insights to improve their incident response capabilities and overcome the technical challenges of slow incident response.

Defending DevOps with Deception

You’ve turned your zero-trust up to 11, and your CI/CD pipeline is bigger and better than Colonial’s. What more can you do to prepare your networks in advance of an intrusion? How can you increase the likelihood of detecting adversaries in their organization? Honeypots have played a crucial role in detecting actual attacks over the years. This talk presents case studies where honeypots or honeytokens worked to detect unauthorized activity, despite all the other defensive products deployed. Additionally research that is specifically looking at how you can maximize deception in cloud-native and CI/CD-first environments is highlighted.

This talk will present the motivation, design, and primitive building blocks, for several practical honeypots and tokens. It covers ideas for cloud workloads and containers, as well as tokens for CI/CD pipelines, documents, API Keys, and database files.

Attendees will learn practical tips for how to integrate honeypots and honeytokens, with existing response tools, such as endpoint, network and cloud based architectures. Attendees will come away with new insights about where best to deploy honeypots, to increase detection and response opportunities. Additional takeaways include novel ideas for using multiple layers of tokens to lay tripwires in their environments to gain visibility into attacker movement.

OSDP auditing for red teamers and facility managers

Open Supervised Device Protocol is an access control communications standard designed to allow door controllers (on the secure side of a door) to communicate with devices such as card readers on the insecure side, in a secure manner. This presentation walks through how it works, how to interface with devices, and most importantly how to review implementations and deployments for security issues where possible, using some randomly selected OSDP capable devices as case studies.

DoSing Azure Active Directory

Azure Active Directory (Azure AD) is used by over 90% of Fortune 500 organisations as their Identity and Access Management service. Even though Azure AD is commonly seen as a safe platform, it is a large and complex service with many optional security features. This talk will cover how some of these features enable Denial of Service (DoS) attacks against Azure AD.

DoS attacks can be performed with various permissions, ranging from Global and On-Prem Administrators to regular users. In this demo-packed session, I’ll show how these attacks can be performed using AADInternals toolkit.

Forward to the Past and Back to the Future - Cybercrime in 2022/2023

Join Sami Laiho, Chief Research Officer of Adminize, for a look back in to what 2022 changed in the Security Threat Landscape and to hear his predictions on what will the future have in store for us. Sami has been architecting and consulting Security concepts for 20+ years for customers ranging from few seats to more than half a million.