-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathindex.html
1221 lines (1047 loc) · 68.3 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en" ng-app="app">
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="initial-scale=0.7, maximum-scale=1" />
<meta name="description" content="" />
<meta name="author" content="" />
<title>Securi-Tay 2019</title>
<!-- Bootstrap Core CSS -->
<link rel="stylesheet" href="css/bootstrap.min.css" type="text/css" />
<!-- Custom Fonts -->
<link href="https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,200,400,300,600,700,800" rel="stylesheet" type="text/css" />
<link href="https://fonts.googleapis.com/css?family=Merriweather:400,300,300italic,400italic,700,700italic,900,900italic" rel="stylesheet" type="text/css" />
<link rel="stylesheet" href="font-awesome/css/font-awesome.min.css" type="text/css" />
<!-- Custom CSS -->
<link rel="stylesheet" href="./css/creative.css" type="text/css" />
<!-- Favicon code -->
<meta name="application-name" content="Securi-Tay 2018" />
<meta name="msapplication-TileColor" content="#FFFFFF" />
<!-- Coloured application bars -->
<!-- Chrome, Firefox OS and Opera -->
<meta name="theme-color" content="#682d8c" />
<!-- Windows Phone -->
<meta name="msapplication-navbutton-color" content="#682d8c" />
<!-- iOS Safari -->
<meta name="apple-mobile-web-app-status-bar-style" content="#682d8c" />
<!-- HTML5 Shim and Respond.js IE8 support of HTML5 elements and media queries -->
<!-- WARNING: Respond.js doesn't work if you view the page via file:// -->
<!--[if lt IE 9]>
<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
<script src="https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js"></script>
<![endif]-->
<!-- Global site tag (gtag.js) - Google Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-118823811-3"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'UA-118823811-3');
</script>
</head>
<body id="page-top">
<!-- ************************** --
-- Site Design by Adam Rapley --
-- www.adamrapley.com --
-- ************************** -->
<nav id="mainNav" class="navbar navbar-default navbar-fixed-top">
<div class="container-fluid">
<!-- Brand and toggle get grouped for better mobile display -->
<div class="navbar-header">
<button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button>
<a class="navbar-brand page-scroll" href="#page-top"><img class="brandlogo" src="img/ehslogoblackbgfill.png" /></a>
</div>
<!-- Collect the nav links, forms, and other content for toggling -->
<div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1">
<ul class="nav navbar-nav navbar-right pull-right">
<li> <a class="page-scroll" href="#about">About</a> </li>
<li> <a class="page-scroll" href="#sponsors">Sponsors</a> </li>
<li> <a class="page-scroll" href="#schedule">Schedule</a> </li>
<li> <a class="page-scroll" href="#tickets">Tickets</a> </li>
</ul>
</div>
<!-- /.navbar-collapse -->
</div>
<!-- /.container-fluid -->
</nav>
<header>
<div class="header-content">
<div class="header-content-inner">
<!-- Hero image used under CC BY-NC-ND 4.0
Original image by Tim Haynes 2013 and found here:
http://soc.sty.nu/2014/12/bright-light-city/ -->
<img src="img/webwhitelegit.png" class="" id="logo" />
</div>
</div>
</header>
<section class="bg-primary" id="about">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2 text-center">
<h2 class="section-heading">It's time...</h2>
<hr class="light" />
<p class="text-faded">Securi-Tay has been a great success over the many years it has been running and it keeps getting bigger and better each year, even being included on several must-attend infosec conference lists. This year will be the 8th year that Securi-Tay is being run, and it is currently the biggest student-run infosec conference in Europe. What started as a way to get society members involved and engaged with the infosec community has grown into a popular conference which attracts around 350 attendees from a mixture of industry and academic backgrounds.</p>
<p class="text-faded">Securi-Tay offers many advantages for both attendees and sponsors. For attendees, included in the ticket is a day of high-quality talks from a range of industry professionals as well as the chance to network with other attendees and sponsors (plus, our world-famous hog roast). Thanks to our high level of student engagement, attending Securi-Tay offers excellent recruitment opportunities for any sponsors looking to network with potential interns and graduates.</p>
<p class="text-faded"><b>This year the conference will be run on Friday 1st March at Abertay University.</b></p>
</div>
</div>
</div>
</section>
<section class="bg-primary" id="sponsors">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2 text-center">
<h2 class="section-heading">Sponsors</h2>
<hr class="light" />
</div>
</div>
<div class="row no-gutter">
<div class="col-lg-6 col-sm-6 col-lg-offset-3 col-sm-offset-3">
<div class="portfolio-box pb1">
<a href="https://www.mwrinfosecurity.com/" target="_blank">
<div class="portfolio-box-caption">
<div class="portfolio-box-caption-content">
<div class="sponsor-title">
After Party Sponsor
</div>
<div class="company-name">
MWR InfoSecurity
</div>
</div>
</div>
</a>
</div>
</div>
</div>
<div class="row no-gutter">
<div class="col-lg-5 col-sm-5 col-lg-offset-1 col-sm-offset-1">
<div class="portfolio-box pb2">
<a href="https://www.synopsys.com/software" target="_blank">
<div class="portfolio-box-caption">
<div class="portfolio-box-caption-content">
<div class="sponsor-title">
Gold Sponsor
</div>
<div class="company-name">
Synopsys
</div>
</div>
</div>
</a>
</div>
</div>
<div class="col-lg-5 col-sm-5 col-lg-offset-1 col-sm-offset-1">
<div class="portfolio-box pb3">
<a href="https://www.capitalone.co.uk/" target="_blank">
<div class="portfolio-box-caption">
<div class="portfolio-box-caption-content">
<div class="sponsor-title">
Gold Sponsor
</div>
<div class="company-name">
Capital One
</div>
</div>
</div>
</a>
</div>
</div>
</div>
<div class="row no-gutter">
<div class="col-lg-5 col-sm-5 col-lg-offset-1 col-sm-offset-1">
<div class="portfolio-box pb4">
<a href="https://www.contextis.com/" target="_blank">
<div class="portfolio-box-caption">
<div class="portfolio-box-caption-content">
<div class="sponsor-title">
Silver Sponsor
</div>
<div class="company-name">
Context
</div>
</div>
</div>
</a>
</div>
</div>
<div class="col-lg-5 col-sm-5 col-lg-offset-1 col-sm-offset-1">
<div class="portfolio-box pb5">
<a href="https://ecs.co.uk/" target="_blank">
<div class="portfolio-box-caption">
<div class="portfolio-box-caption-content">
<div class="sponsor-title">
Silver Sponsor
</div>
<div class="company-name">
ECS
</div>
</div>
</div>
</a>
</div>
</div>
</div>
<div class="row no-gutter">
<div class="col-lg-5 col-sm-5 col-lg-offset-1 col-sm-offset-1">
<div class="portfolio-box pb6">
<a href="https://www.i-confidential.com/" target="_blank">
<div class="portfolio-box-caption">
<div class="portfolio-box-caption-content">
<div class="sponsor-title">
Silver Sponsor
</div>
<div class="company-name">
i-confidential
</div>
</div>
</div>
</a>
</div>
</div>
<div class="col-lg-5 col-sm-5 col-lg-offset-1 col-sm-offset-1">
<div class="portfolio-box pb7">
<a href="https://www.lloydsbankinggroup.com/" target="_blank">
<div class="portfolio-box-caption">
<div class="portfolio-box-caption-content">
<div class="sponsor-title">
Silver Sponsor
</div>
<div class="company-name">
Lloyds Banking Group
</div>
</div>
</div>
</a>
</div>
</div>
</div>
</div>
</div>
</div>
</section>
<section id="schedule">
<div class="container">
<div class="row">
<div class="col-lg-12 text-center">
<h2 class="section-heading">Schedule</h2>
<hr class="primary" />
<p class="text-faded">We're happy to announce the schedule for the conference is now available!</p>
<p class="text-faded">You can also find the programme as a pdf <a href="assets/programme.pdf">here</a>.</p>
<p class="text-faded">We also have a lockpicking village being run all day next to track 3!</p>
<!-- CONTENT -->
<div id="myTabContent" class="tab-content">
<!-- DAY 1 -->
<div role="tabpanel" class="tab-pane active fade in" id="day1" aria-labelledby="day1-tab">
<div class="panel-group" id="accordion1" role="tablist" aria-multiselectable="true">
<!-- 9-00 TIMESTAMP -->
<div class="shed-row-item row">
<div class="col-lg-1 col-md-1 col-sm-1">
<p class="date">8-45</p>
</div>
<!-- T1/2 REGISTRATION -->
<div class="panel panel-default col-lg-11 col-md-11 col-sm-11">
<!-- Program Heading -->
<div class="panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-11 col-md-11 col-sm-11">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#Registration" aria-expanded="true" aria-controls="Registration">
Registration
</a>
</h4>
</div>
</div>
</div>
<div id="Registration" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-7 col-md-7 col-sm-11 col-lg-offset-2 col-md-offset-2">
<p class="speaker-name uppercase">Welcome!</p>
<p>Meet us on the 1st floor of Abertay Union (Across the road from the University)<br>Sign in and collect your free swag!</p>
<p class="abstract">There will be varied breakfast rolls, pastries and fruit waiting for you!</p>
<div class="iconcontainer">
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Bar One</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<!-- 10-00 TIMESTAMP -->
<div class="row shed-row-item shed-dark">
<div class="col-lg-1 col-md-1 col-sm-1">
<p class="date">9-45</p>
</div>
<!-- T1/2 Keynote -->
<div class="panel shed-dark panel-default col-lg-11 col-md-11 col-sm-11">
<!-- Program Heading -->
<div class="shed-dark panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-11 col-md-11 col-sm-11">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#keynote" aria-expanded="true" aria-controls="Keynote">
Introduction & Synopsys Keynote
</a>
</h4>
</div>
</div>
</div>
<div id="keynote" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-7 col-md-7 col-sm-11 col-lg-offset-2 col-md-offset-2">
<h4>Software Security: Never Stop Evolving</h4>
<p class="abstract">From the early days of software bugs through to the modern day, software security practitioners have had to adapt to a cascade of paradigm shifts. As technology has increased in complexity, so have the attack vectors. Not only have we played cat and mouse with the attackers and their evolving attacks, but we’ve had to adapt to how software development has gone from Waterfall to Agile to DevOps.<br><br>As security finally appears to have won enough credibility to be given a voice in software development, there are opportunities and risks. In this talk, I will focus on software security specifically, some of its history, the current challenges, and how you as a security subject matter expert can help shape its future.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">75 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 1 (2516)</span></p>
<hr class="primary" />
</div>
<div class="col-lg-3 col-md-3 col-sm-11">
<h5>About Nick Murison</h5>
<p class="small">Nick is the head of software security services for Nordics and BeNeLux within Synopsys’ Software Integrity Group. He’s spent the last 14 years in the security industry, working within R&D, security assessment services, incident response, training, and strategic security initiative development. Combining his passion for software security and butchering multiple languages, Nick helps customers in FinTech, IoT, Embedded Systems and other industries build high quality secure software faster. Nick holds a MSc in Information Security from Royal Holloway, University of London.</p>
<span class="about-speaker"><i class="fa fa-lg fa-twitter"></i> <a class="small" href="https://twitter.com/nickmurison" target="_blank">@nickmurison</a></span><br>
<span class="about-speaker"><i class="fa fa-lg fa-globe"></i> <a class="small" href="https://www.synopsys.com/software" target="_blank">synopsys.com/software</a></span>
</div>
</div>
</div>
</div>
</div>
</div>
<!-- DOUBLETRACK -->
<!-- 11-00 TIMESTAMP -->
<div class="row shed-row-item">
<div class="col-lg-1 col-md-1 col-sm-1">
<p class="date">11-00</p>
</div>
<!-- T1 Snowden -->
<div class="panel panel-default col-lg-3 col-md-3 col-sm-3">
<!-- Program Heading -->
<div class="panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#talk1" href="#talk1" aria-expanded="true" aria-controls="talk1">
We take your security seriously. Or do we?
</a>
</h4>
</div>
</div>
</div>
<div id="talk1" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Snowden Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">In this talk, we discuss the lengths some organisations go to, in order to protect personal data, as opposed to those that say they do, once the personal data they were responsible for has been flooded onto the Web. It's a tale of breach after breach after breach, laced with some hope that certain firms are at least trying to do the right things. We all make mistakes, but we should at least give it our best shot at avoiding doing so..</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 1 (2516)</span></p>
<hr class="thin"/>
<h5>About The Beer Farmers</h5>
<p class="small">Ian Thornton-Trump and Mike Thompson, doing a Beer Farmers 'gig'. Ian is a seasoned InfoSec campaigner, who's delivered many commentaries and talks over recent years, to a great reception. Mike is a relative newcomer to the community, but has a passion and enthusiasm to help educate and improve the security of the citizens of the web. Mike was also invited to deliver his talk on web application firewall technology at 2018's Securi-Tay, however had to withdraw due to a dental fail. Both are members of The Beer Farmers; a parody project, who's aim in life is to help the InfoSec community take itself less seriously, bring some fun, while at the same time help us focus on the important things in what we do.</p>
</div>
</div>
</div>
</div>
</div>
<!-- T2 Cash Only -->
<div class="panel panel-default col-lg-4 col-md-4 col-sm-4">
<!-- Program Heading -->
<div class="panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#talk2" href="#talk2" aria-expanded="true" aria-controls="talk2">
Beyond Windows Forensics with Built-in Microsoft Tooling
</a>
</h4>
</div>
</div>
</div>
<div id="talk2" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">Microsoft has slowly been introducing tools to help organisations better manage and troubleshoot Windows performance and issues; these are now entirely integrated into Windows. To improve performance and troubleshooting capabilities, Microsoft introduced System Resource Usage Monitor (SRUM) in Windows 8 and beyond. PowerShell has become the default “command line” management tool for windows administrators. These tools provide both a wealth of information into what has happened and is present on the system. For Forensics and even Incident Response, these tools are now a go to built-in option to bootstrap and drive the forensics process including opening access to artefacts that overzealous user or even a “smart” attacker has removed. SRUM for instance can provide data points ranging from network to process activitiy providing insight into what, who, when and how an attacker or malicious process introduced itself into the environment. This talk will help the participant build the foundations to identify which built in tools can assist in the Windows Forensics process and the data points that are available as well as examine how services such as SRUM can be used to extract key data points to provide information for incident response or threat hunting activities.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 2 (2517)</span></p>
<hr class="thin"/>
<h5>About Thomas V Fischer</h5>
<p class="small">Thomas has over 30 years of experience in the IT industry ranging from software development to infrastructure & network operations and architecture to settle in information security. He has an extensive security background covering roles from incident responder to security architect at fortune 500 companies, vendors and consulting organisations. He is currently security advocate and threat researcher focused on advising companies on understanding their data protection activities against malicious parties not just for external threats but also compliance instigated.</p>
</div>
</div>
</div>
</div>
</div>
<!-- T3 ish -->
<div class="panel panel-default col-lg-3 col-md-3 col-sm-3">
<!-- Program Heading -->
<div class="panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#talk3" href="#talk3" aria-expanded="true" aria-controls="talk3">
Abertay Student Lightning Talks
</a>
</h4>
</div>
</div>
</div>
<div id="talk3" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract"><b>Talk 1: Obfuscating PDF Malware: How I “nearly” created a FUD</b><br>
Everyone and their dog is aware of macro based malware nowadays, but not all know that PDFs can also contain malicious payloads and be used to execute them. Although many anti-virus systems can detect malicious PDFs, basic obfuscation techniques can be applied to fool even the crème de la crème of these systems. In this talk I will discuss the fundamentals of PDFs, how several obfuscation techniques work, how they can be implemented, and their effectiveness (or lack thereof) at evading anti-virus systems.<br><br><b>Talk 2: GPU Accelerated Security</b><br>Since the introduction of general purpose graphics processing units, many trivially scalable tasks have benefitted from GPU acceleration. However, open source security projects have lagged behind, and those that have tried to implement GPU acceleration (such as suricatta) have failed to do it well. This talk takes a brief look at when GPU acceleration should be used, what it is good for, what the caveats are, and how it can be applied to security tools/applications. Accelerating security tools such as IDS and Hard Drive Forensics through GPU optimization.</b><br> </p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">30 mins per talk</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Glass Room (2522)</span></p>
<hr class="thin"/>
<h5>About Jonathan Ross & Andrew Calder</h5>
<p class="small">Jonathan Ross is a 4th Year Ethical Hacking Student at Abertay University and intern cyber security consultant. His interests include offensive security and anti-phishing.<br><span class="about-speaker"><i class="fa fa-lg fa-twitter"></i><a class="small" href="https://twitter.com/JohDJRoss" target="_blank">@JohDJRoss</a></span><br><br>Andrew Calder is a 4th year Abertay hacker, with interests including usb emulation, gpu acceleration, and automation. You can find him on github and twitter below.<br><span class="about-speaker"><i class="fa fa-lg fa-twitter"></i> <a class="small" href="https://twitter.com/Verdnaa" target="_blank">@Verdnaa</a></span><br><span class="about-speaker"><i class="fa fa-lg fa-github"></i> <a class="small" href="https://github.com/AR-Calder" target="_blank">AR-Calder</a></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
<!-- 12-00 TIMESTAMP -->
<!-- DOUBLETRACK -->
<div class="shed-dark row shed-row-item">
<div class="col-lg-1 col-md-1 col-sm-1">
<p class="date">12-00</p>
</div>
<!-- T2 Cash Only -->
<div class="shed-dark panel panel-default col-lg-3 col-md-3 col-sm-3">
<!-- Program Heading -->
<div class="shed-dark panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#attackdetection" aria-expanded="true" aria-controls="attackdetection">
7 Hardware Hacks for 7GBP
</a>
</h4>
</div>
</div>
</div>
<div id="attackdetection" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">We may live in a software world, but all that software runs on hardware at some point down the stack. Sure, you need some hardware to talk to hardware, but that shouldn't be a barrier to entry. The cost of a couple pints is enough to get a device to help you. I'll demonstrate 7 different cases where you can use an FT232H-based board or cable to pull off a hardware hack, including: <br>- Getting a root shell over a UART <br>- Modifying I2C configuration of a device <br>- Sniffing a hardware bus as a Logic Analyzer <br>- Dumping flash off a device for offline analysis <br>- Backdooring firmware and flashing it to a device <br>- Jtag debugger <br>- Replaying custom crafted protocol packet <br>Hopefully you'll come away with the confidence and know-how to tackle a hardware attack of your own.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 1 (2516)</span></p>
<hr class="thin"/>
<h5>About Joe FitzPatrick</h5>
<p class="small">Joe FitzPatrick is an Instructor and Researcher at SecuringHardware.com. Joe has spent over a decade working on low-level silicon debug, security validation, and penetration testing of CPUS, SOCs, and microcontroller. He has spent the past 5 years developing and leading hardware security-related training, instructing hundreds of security researchers, pen-testers, hardware validators worldwide. When not teaching classes on applied physical attacks, Joe is busy developing new course content or working on contributions to the NSA Playset and other misdirected hardware projects, which he regularly presents at all sorts of fun conferences.</p>
<span class="about-speaker"><i class="fa fa-lg fa-twitter"></i> <a class="small" href="https://twitter.com/securelyfitz" target="_blank">@securelyfitz</a></span><br>
</div>
</div>
</div>
</div>
</div>
<!-- T2 Cash Only -->
<div class="shed-dark panel panel-default col-lg-4 col-md-4 col-sm-4">
<!-- Program Heading -->
<div class="shed-dark panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#IoT" aria-expanded="true" aria-controls="IoT">
RATs, Crypters & Zombies: A History of Consumer Malware
</a>
</h4>
</div>
</div>
</div>
<div id="IoT" class="shed-dark panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">Malware has become one of the most prevalent threats to personal computer security: how did this happen? Does every threat actor make their own? Come with me on a journey into the internet's archives, exploring how enterprising malware developers created a new market with ""remote administration tools"" and how they lowered the barrier to running a malware campaign significantly. This talk will help you become familiar with the role generic malware plays in the world of not-so-sophisticated threat actors, how it's built and what job it's designed to do. Expect a deep dive into the different sectors of the malware economy, a timeline of notable events and a technical analysis of some more interesting examples.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 2 (2517)</span></p>
<hr class="thin"/>
<h5>About Dan Nash</h5>
<p class="small">I'm a software engineering student turned security engineer. I helped run ENUSEC for a while and now i'm helping to improve security with Sophos' Security Engineering team. Lifelong love of CTFs, programming and malware.</p>
</div>
</div>
</div>
</div>
</div>
<!-- T3 ish -->
<div class="panel shed-dark panel-default col-lg-3 col-md-3 col-sm-3">
<!-- Program Heading -->
<div class="panel-heading shed-dark" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#talk6" href="#talk6" aria-expanded="true" aria-controls="talk6">
Lightning Talks
</a>
</h4>
</div>
</div>
</div>
<div id="talk6" class="panel-collapse shed-dark collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract"><b>Talk 1: Profiling The Attacker - Using natural language processing to predict crime</b><br>
What does Minority Report, Black Mirror, and 1984 all have in common?.. Well, turn up to the talk to find out. On a day to day basis we countlessly write notes, send messages and respond to emails. The question is, however, what does what we write actually show about us, and how can we use the meaning behind these pieces of text to predict crimes and attacks. This talk delves into just this - how machine learning, and specifically natural language processing and sentiment analysis, can be used to predict crime and security attacks. This, of course, comes hand in hand with talking about predictive policing approaches, biases in predictive policing, and how natural language processing can be used to automate this whole process.<br><br><b>Talk 2: Using Natural Language Processing Techniques to Crack Passwords</b><br>A custom dictionary that exploits the shared social experience of a userbase can be interactively built by making multiple cracking passes through a hash dump, and on each pass adding other similar words to the dictionary. We might crack one user's password that is based on a local football team and another based on an anime character but if we can add all the other regional football teams and other anime characters to the dictionary for the next cracking pass, we are likely to discover that other users share similar interests. Here we explore the use of Natural Language Processing models for automatically discovering candidate words for a custom password cracking dictionary.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">30 mins per talk</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Glass Room (2522)</span></p>
<hr class="thin"/>
<h5>About James Stevenson & Robin Vickery</h5>
<p class="small">James Stevenson is a Software Engineer and Security Researcher, with a security analyst background. James is qualified as both a Mental and Physical Health First Aider and these days he works at BT Security, as well as speaking at security events across the UK.<br><span class="about-speaker"><i class="fa fa-lg fa-twitter"></i> <a class="small" href="https://twitter.com/_JamesStevenson" target="_blank">@_JamesStevenson</a></span><br><br>Robin is a senior cybersecurity penetration test consultant and has worked across a number of disciplines including offensive and defensive security. This has included offensive security in protecting ultra-high net worth individual’s online reputation and assets as well as more traditional commercial engagements. Prior to that Robin spent time as a developer.</p>
</div>
</div>
</div>
</div>
</div>
</div>
<!-- 13-00 TIMESTAMP -->
<div class="shed-row-item row">
<div class="col-lg-1 col-md-1 col-sm-1">
<p class="date">13-00</p>
</div>
<!-- T1/2 REGISTRATION -->
<div class="panel panel-default col-lg-11 col-md-11 col-sm-11">
<!-- Program Heading -->
<div class="panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-11 col-md-11 col-sm-11">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#lunchone" aria-expanded="true" aria-controls="LunchOne">
Lunch
</a>
</h4>
</div>
</div>
</div>
<div id="lunchone" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-7 col-md-7 col-sm-11 col-lg-offset-2 col-md-offset-2">
<p>Hop over the road to Abertay Student Union for a bite to eat before the afternoon talks.<br /> Oh, lunch is provided as well by the way!</p>
<div class="iconcontainer">
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Bar One</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<!-- DOUBLETRACK -->
<!-- 14-00 TIMESTAMP -->
<div class="shed-dark shed-row-item row">
<div class="col-lg-1 col-md-1 col-sm-1">
<p class="date">14-00</p>
</div>
<!-- T1 Snowden -->
<div class="panel shed-dark panel-default col-lg-3 col-md-3 col-sm-3">
<!-- Program Heading -->
<div class="shed-dark panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#REDarwin" aria-expanded="true" aria-controls="REDarwin">
Ridiculous Radios
</a>
</h4>
</div>
</div>
</div>
<div id="REDarwin" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Snowden Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">There are many Software Defined Radios (SDRs) available, with a great
deal of time and effort having gone in to their design. These are not
those radios. I present four radios that we have designed using crude,
novel, and sometimes ridiculous methods for transmitting and receiving
signals. <br>The arrival of SDR allowed more hackers than ever to experiment with
radio protocols, but we're still using hardware built by other people.
In the time honored hacker tradition of rolling our own tools, we'll
demonstrate four simple radios that can be home-built using commonly
available parts for little to no cost.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 1 (2516)</span></p>
<hr class="thin"/>
<h5>About Dominic Spill</h5>
<p class="small">Dominic is a senior security researcher at Great Scott Gadgets, where he
builds tools and investigates communications protocols.</p>
</div>
</div>
</div>
</div>
</div>
<!-- T2 Cash Only -->
<div class="panel shed-dark panel-default col-lg-4 col-md-4 col-sm-4">
<!-- Program Heading -->
<div class="shed-dark panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#TLSHipsterism" aria-expanded="true" aria-controls="TLSHipsterism">
Physical Security Games: Lessons Learnt Building CTF Challenges for Hackers
</a>
</h4>
</div>
</div>
</div>
<div id="TLSHipsterism" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">In the past, I've built a number of challenges for a variety of events. I've always tended towards the more physical side of things. It's remarkably hard to second guess the skill level of potential players, and to build something that hits the fine balance between being achievable without being too easy, when given competitors of varying ability. Sometimes things go well, sometimes, almost comically less so. I'll give some examples of games I've built in the past, the approaches I took when designing them, and some lessons learnt actually getting people stress testing them in the real world...</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 2 (2517)</span></p>
<hr class="thin"/>
<h5>About Steve Wilson</h5>
<p class="small">22+ year veteran of the security industry. Forgotten more than I remember. :-( Physical security nutjob, currently doing advanced red team work. Builder of games for the likes of Hack Fu and the Cyber Security Challenge. Long time friend of Abertay (ask Colin) and occasional Ladywell drunk.</p>
</div>
</div>
</div>
</div>
</div>
<!-- T3 ish -->
<div class="panel shed-dark panel-default col-lg-3 col-md-3 col-sm-3">
<!-- Program Heading -->
<div class="panel-heading shed-dark" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#talk9" href="#talk9" aria-expanded="true" aria-controls="talk9">
Striking While the Iron's Hot - The do’s and dont's for getting a job in infosec
</a>
</h4>
</div>
</div>
</div>
<div id="talk9" class="panel-collapse shed-dark collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">What’s a job in infosec really like? In fact how do you even get one in the first place? Based off experiences from their first few years in industry the team break down some of their favorite do’s and don'ts with getting your first job in infosec.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Glass Room (2522)</span></p>
<hr class="thin"/>
<h5>About James Stevenson, Chlöe Ungar, Brett Calderbank, Daniel Nash & Jack Wilson</h5>
<p class="small">A team with a mix of backgrounds from entering the industry through university to working in internships and apprenticeships. We now all work, in one form or another, in computer security companies from small startups to large global organisations.</p>
</div>
</div>
</div>
</div>
</div>
</div>
<!-- DOUBLETRACK -->
<!-- 15-00 TIMESTAMP -->
<div class="shed-row-item row">
<div class="col-lg-1 col-md-1 col-sm-1">
<p class="date">15-00</p>
</div>
<!-- T1 Snowden -->
<div class="panel panel-default col-lg-3 col-md-3 col-sm-3">
<!-- Program Heading -->
<div class="panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#securedesktop" aria-expanded="true" aria-controls="securedesktop">
Hardware Isn't Hard
</a>
</h4>
</div>
</div>
</div>
<div id="securedesktop" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Snowden Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">With the advent of IoT connected everything - doorbells, dishwashers, ovens, alarms, and uh... more private items - you may be interested to try your hand at pwning some devices. Messing with web portals and network traffic is one thing, but what about the board itself? What do those components do? What is that chip doing? How do I not electrocute myself? All equally important questions. This talk covers the basic hardware knowledge you need to start picking apart boards, accessing debug functionality, dumping firmware, and finding juicy secrets.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 1 (2516)</span></p>
<hr class="thin"/>
<h5>About Graham Sutherland</h5>
<p class="small">Graham works as a senior researcher at Nettitude, and prior to that spent many years tinkering with various bits of hardware. He has only given himself near-fatal electric shocks twice. His main areas of focus are hardware, cryptography, and Windows internals.</p>
</div>
</div>
</div>
</div>
</div>
<!-- T2 Cash Only -->
<div class="panel panel-default col-lg-4 col-md-4 col-sm-4">
<!-- Program Heading -->
<div class="panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#lightningtalks" aria-expanded="true" aria-controls="lightningtalks">
Mobile Application Hardening: Protecting Business Critical Apps
</a>
</h4>
</div>
</div>
</div>
<div id="lightningtalks" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">Mobile application security isn't always super exciting or challenging but when it comes to application hardening things get more interesting. These days, it is not uncommon for particular types of application to go out of their way to defend themselves at runtime. Such application types would include but are not limited to:<br>- financial apps<br>- multiplayer games<br>- apps which feature DRM protected content<br>- apps with intellectual property etc. <br>It's often the case that such applications attempt to protect themselves via internally developed controls, as well as leveraging commercial products. During this talk we'll look at some of the typical controls that Android/iOS applications exhibit, how they work, how to spot them, and how to sidestep them. We’ll be demonstrating analysis and techniques using free open source tooling such as Radare, Frida, and for some parts we’ll also leverage IDA Pro. Since automation is the buzzword of the year too we’ll also be discussing how to automate some of these activities that typically take up most of the assessment window.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 2 (2517)</span></p>
<hr class="thin"/>
<h5>About Grant Douglas & Nikola Cucakovic</h5>
<p class="small">Both Grant & Nikola are Abertay Alumni and are now working in security consulting at Synopsys Software Integrity Group (SIG). Grant Douglas is an associate principal consultant specialising in mobile security, having researched & worked in the space for over 7 years. Grant has published mobile tooling which has featured in books such as the mobile app hackers handbook as well as iOS Forensics. My particular areas of interest are in reverse engineering, application hardening, Runtime Application Self Protection (RASP), etc. Nikola Cucakovic is a security consultant, specialising in mobile security with a particular focus on financial services. Nikola has worked in a number of mobile based roles including Android software engineer, security testing, and also security architecture. Nikola is particularly interested in Reverse Engineering, Application Hardening, and Biometrics.</p>
</div>
</div>
</div>
</div>
</div>
<!-- T3 ish -->
<div class="panel panel-default col-lg-3 col-md-3 col-sm-3">
<!-- Program Heading -->
<div class="panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#talk12" href="#talk12" aria-expanded="true" aria-controls="talk12">
Lightning Talks
</a>
</h4>
</div>
</div>
</div>
<div id="talk12" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract"><b>Talk 1: From Breaking In to Breaking Through: the applicability of skills from social engineering to teaching security behaviours</b><br>What isn’t there to love about talking your way into places you’re not allowed, free stuff, or any number of other things that leave you with epic stories? We glorify and revel in impressive and amusing social engineering hijinks, which is great until the point where we need to get our colleagues to be better about security behaviours and the first “soft skills" that we think of using in the context of security are about deception and manipulation. Social engineering can be powerful for getting people to do things for you, but helping people to be better with security practices requires a different approach to be effective. This talk will cover some basics tips from teaching and behaviour change interventions, which skills developed in the context of social engineering have some crossover, and pitfalls with using social engineering tactics on your coworkers.<br><br><b>Talk 2: Intro to Machine Learning for Hackers</b><br>As cyber security students & professionals, do we really need to care about Machine Learning? In this talk we will go over what machine learning is, what it can do, and how it can (and can't) help the cyber security profession. After taking a deep dive into a particular algorithm, where we will learn a bit of maths and logic behind how ML works, will focus on: examining how the industry is currently utilising it (ML for phishing detection, ML for NIDS and ML for SIEM), how adversaries could use it to our disadvantage and how Machine Learning is vulnerable to attack itself.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">30 mins per talk</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Glass Room (2522)</span></p>
<hr class="thin"/>
<h5>About Rose Regina Lawrence &: Helena Lucas</h5>
<p class="small">Rose Regina Lawrence is the digital security coordinator at Tactical Tech in Berlin. She has supported activists, human rights defenders, and journalists in heightened risk settings both in the US and internationally for over a decade. Her graduate level training in Public Health/ Community Health Education with a focus on communicating for behaviour change on individual and collective risk has deeply shaped her approach to digital security education. In addition to digital security workshops and interventions for activists and their attorneys, she has developed materials and presented on digital security and sexuality, including the specific needs of sex workers, people who have experienced domestic and intimate partner violence, and the queer community.<br><br>Helena Lucas: I am a Cyber Security and Forensics student currently on placement, which is where I first came into contact with Machine Learning. At Uni I was on the committee of ENUSEC and organised a TEDx conference. Oh and if you see me around, ask me to do a card trick !</p>
</div>
</div>
</div>
</div>
</div>
</div>
<!-- DOUBLETRACK -->
<!-- 16-00 TIMESTAMP -->
<div class="row shed-dark shed-row-item">
<div class="col-lg-1 col-md-1 col-sm-1">
<p class="date">16-00</p>
</div>
<!-- T1 Snowden -->
<div class="panel shed-dark panel-default col-lg-3 col-md-3 col-sm-3">
<!-- Program Heading -->
<div class="panel-heading shed-dark" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#Ring0" aria-expanded="true" aria-controls="Ring0">
Where 2 Worlds Collide: Bringing Mimikatz et al to UNIX
</a>
</h4>
</div>
</div>
</div>
<div id="Ring0" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Snowden Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">Over the past fifteen years there's been an uptick in "interesting" UNIX infrastructures being integrated into customers' existing AD forests. Whilst the threat models enabled by this should be quite familiar to anyone securing a heterogeneous Windows network, they may not be as well understood by a typical UNIX admin who does not have a strong background in Windows and AD. Over the last few months I've spent some time looking a number of specific AD integration solutions (both open and closed source) for UNIX systems and documenting some of the tools, tactics and procedures that enable attacks on the forest to be staged from UNIX.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 1 (2516)</span></p>
<hr class="thin"/>
<h5>About Tim Wadhwa-Brown</h5>
<p class="small">Tim Brown joined Cisco as part of their acquisition of Portcullis for whom he worked for almost 12 years. He is equally happy performing white box assessments with access to source code or where necessary diving into proprietary binaries and protocols using reverse engineering methodologies. Tim has contributed to a number of Cisco's bespoke methodologies covering subjects as diverse as secure development, host hardening, risk and compliance, ERP and SCADA. In 2016-2017, Tim looked at targets as varied as Active Directory, z/OS mainframes, power stations, cars, banking middleware and enterprise SAP Landscapes. Outside of the customer driven realm of information assurance, Tim is also a prolific researcher with papers on UNIX, KDE, Vista and web application security to his name. Tim is credited with almost 150 vulnerability advisories covering both kernel and userland, remote and local. Tim particularly like to bug hunt enterprise UNIX solutions.</p>
</div>
</div>
</div>
</div>
</div>
<!-- T2 Cash Only -->
<div class="panel shed-dark panel-default col-lg-4 col-md-4 col-sm-4">
<!-- Program Heading -->
<div class="panel-heading shed-dark" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#VRHeadset" aria-expanded="true" aria-controls="VRHeadset">
Weaponising Layer-8
</a>
</h4>
</div>
</div>
</div>
<div id="VRHeadset" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract">Do you think users are the weakest link in the security chain? Here is some duct tape to change that, and to raise the bar for social engineers and other attackers alike. Over the last few decades, sysadmins and people working in IT have called users names and generally rolled their eyes at the antics of those allegedly lazy, stupid and uneducated people. From PEBKAC to ID-Ten-T we have been calling them names and didn't want them on our networks. This way of destructive thinking needs an overhaul, and here are some easy tricks how users can become the valuable asset in corporate security that indeed they should be. Finding creative solutions to existing problems has been a standard skill for red teamers, whereas those defending networks often rely on standards. Discover some creative solutions people have come up with to significantly raise their security - most of them are easy to implement - and how users can become a major asset of any security team.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">60 mins</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Lecture Theatre 2 (2517)</span></p>
<hr class="thin"/>
<h5>About Stefan Hager</h5>
<p class="small">Stefan works for the Internet Security Team at German company DATEV eG. Having started with computers and starting to be puzzled by reality in the 80s, he started out as a programmer in the early 90s. Since 2000 he has been securing networks and computers for various enterprises in Germany and Scotland. His main focus nowadays is security research, raising security awareness, coming up with creative solutions to security problems and discussing new ideas concerning threat mitigation. When not trying to do any of the stuff mentioned above, he is either travelling, procrastinating or trying to beat some hacking challenge. Stefan also writes blog posts (in English and German) on his site https://cyberstuff.org.</p>
</div>
</div>
</div>
</div>
</div>
<!-- T3 ish -->
<div class="panel shed-dark panel-default col-lg-3 col-md-3 col-sm-3">
<!-- Program Heading -->
<div class="panel-heading shed-dark" role="tab" id="heading1">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#talk15" href="#talk15" aria-expanded="true" aria-controls="talk15">
Lightning Talks
</a>
</h4>
</div>
</div>
</div>
<div id="talk15" class="panel-collapse shed-dark collapse" role="tabpanel" aria-labelledby="heading1">
<!-- Registration Content -->
<div class="panel-body">
<div class="row">
<div class="col-lg-12 col-md-12 col-sm-12">
<p class="abstract"><b>Talk 1: It might get loud! Exfiltrating data using audio interfaces</b><br>Data exfiltrating is often the final and most important phases of an attack as this is when the target data is actively stolen and transmitted across network boundaries. However, on restricted and isolated environments, this stage becomes more challenging as avenues for data to be transferred are drastically reduced, and it is quite common for removable storage devices to be disabled. How about using devices that are usually permitted such as sound cards to exfiltrate the data? Turning files into analogue signals is not a novel idea, modems did this many years ago... but how about using a USB soundcard to transfer files from a computer to another device? When classical methods fail, jazz it up and rock it out! (This can involve very low or high frequency sounds).<br><br><b>Talk 2: Back to School: Bringing it Back to the Students</b><br>This talk will discuss tools, tricks and stories from students on how to advance yourself and get a foothold in the infosec industry. Whether for a current student, a newbie or a hacking veteran, hopefully this talk brings some inspiration and knowledge to you.</p>
<p class="itemIcon"><i class="fa fa-lg fa-clock-o"></i> <span class="small">30 mins per talk</span></p>
<p class="itemIcon"><i class="fa fa-lg fa-map-marker"></i> <span class="small">Glass Room (2522)</span></p>
<hr class="thin"/>
<h5>About Miguel Marques & Callan Garratley</h5>
<p class="small">Miguel is a senior cybersecurity penetration test consultant and brings many years of experience across a range of disciplines. Prior to joining Commissum, Miguel led successful engagements across complex systems including banking platforms and biometric based authentication systems. He specialises in web application testing, infrastructure testing and mobile application security assessments.<br><br>Callan is a 4th year student & part time consultant. I love learning, talking and hacking things</p>
</div>
</div>
</div>
</div>
</div>
</div>
<!-- 12-00 TIMESTAMP -->
<div class="row shed-row-item">
<div class="col-lg-1 col-md-1 col-sm-1">
<p class="date">17-00</p>
</div>
<!-- T1/2 REGISTRATION -->
<div class="panel panel-default col-lg-11 col-md-11 col-sm-11">
<!-- Program Heading -->
<div class="panel-heading" role="tab" id="heading1">
<div class="row">
<div class="col-lg-11 col-md-11 col-sm-11">
<h4 class="panel-title">
<a data-toggle="collapse" data-parent="#accordion" href="#breaktwo" aria-expanded="true" aria-controls="breaktwo">
Break