CONFERENCIA

OpenExpo Europe décima edición, 18 de mayo: El Epicentro de la Innovación y la Transformación Digital



Desde hace nueve años, Open Expo (organizado por MyPublic Inbox ) se ha consolidado como un hito en la divulgación de la Innovación Tecnológica, la Transformación Digital y el Open Source. Comenzó como un encuentro anual que reunía a más de 3.500 profesionales de todas las industrias tecnológicas, desde tomadores de decisiones, técnicos y expertos, hasta usuarios de todos los niveles. Su propósito: presentar las últimas tendencias, herramientas y servicios en innovación y tecnología, además de fomentar la expansión de las redes de contacto. A lo largo de este viaje, OpenExpo Europe ha evolucionado de manera constante, gracias a la dedicada comunidad de profesionales que forman parte de ella, impulsando actividades tanto offline como online para seguir difundiendo contenido tecnológico e innovador.

Material Black Hat USA 2019



*Black Hat 2019*

Ya podemos disfrutar también del material de muchas de las presentaciones de Black Hat USA 2019 :

• Every Security Team is a Software Team Now
• Detecting Deep Fakes with Mice
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Williams-Detecting-Deep-Fakes-With-Mice.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Williams-Detecting-Deep-Fakes-With-Mice-wp.pdf )
• Bypassing the Maginot Line: Remotely Exploit the Hardware Decoder on Smartphone
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Gong-Bypassing-The-Maginot-Line-Remotely-Exploit-The-Hardware-Decoder-On-Smartphone.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Gong-Bypassing-The-Maginot-Line-Remotely-Exploit-The-Hardware-Decoder-On-Smartphone-wp.pdf )
• A Decade After Bleichenbacher '06, RSA Signature Forgery Still Works
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chau-A-Decade-After-Bleichenbacher-06-RSA-Signature-Forgery-Still-Works.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chau-A-Decade-After-Bleichenbacher-06-RSA-Signature-Forgery-Still-Works-wp.pdf )
• ClickOnce and You're in - When Appref-ms Abuse is Operating as Intended
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Burke-ClickOnce-And-Youre-In-When-Appref-Ms-Abuse-Is-Operating-As-Intended.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Burke-ClickOnce-And-Youre-In-When-Appref-Ms-Abuse-Is-Operating-As-Intended-wp.pdf )
• Legal GNSS Spoofing and its Effects on Autonomous Vehicles
• Biometric Authentication Under Threat: Liveness Detection Hacking
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chen-Biometric-Authentication-Under-Threat-Liveness-Detection-Hacking.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Chen-Biometric-Authentication-Under-Threat-Liveness-Detection-Hacking-wp.pdf )
• Battle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Wu-Battle-Of-Windows-Service-A-Silver-Bullet-To-Discover-File-Privilege-Escalation-Bugs-Automatically.pdf )
• SSO Wars: The Token Menace
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Munoz-SSO-Wars-The-Token-Menace.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Munoz-SSO-Wars-The-Token-Menace-wp.pdf )
• Monsters in the Middleboxes: Building Tools for Detecting HTTPS Interception
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Valenta-Monsters-In-The-Middleboxes-Building-Tools-For-Detecting-HTTPS-Interception.pdf )
• Exploiting the Hyper-V IDE Emulator to Escape the Virtual Machine
• Hacking for the Greater Good: Empowering Technologists to Strengthen Digital Society
• Dragonblood: Attacking the Dragonfly Handshake of WPA3
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Vanhoef-Dragonblood-Attacking-The-Dragonfly-Handshake-Of-WPA3.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Vanhoef-Dragonblood-Attacking-The-Dragonfly-Handshake-Of-WPA3-wp.pdf )
• The Most Secure Browser? Pwning Chrome from 2016 to 2019
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Feng-The-Most-Secure-Browser-Pwning-Chrome-From-2016-To-2019.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Feng-The-Most-Secure-Browser-Pwning-Chrome-From-2016-To-2019-wp.pdf )
• Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Metcalf-Attacking-And-Defending-The-Microsoft-Cloud.pdf )
• PicoDMA: DMA Attacks at Your Fingertips
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Sandin-PicoDMA-DMA-Attacks-At-Your-Fingertips.pdf )
• APIC’s Adventures in Wonderland
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Matula-APICs-Adventures-In-Wonderland.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Matula-APICs-Adventures-In-Wonderland-wp.pdf )
  • [Download Tool] ( https://www.ernw.de/download/om/blackhat/us-19-Matula-Block-APICs-Adventures-In-Wonderland-Exploits.zip )
• Behind the Scenes: The Industry of Social Media Manipulation Driven by Malware
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Paquet-Clouston-Behind-The-Scenes-The-Industry-Of-Social-Media-Manipulation-Driven-By-Malware.pdf )
• Attacking Electric Motors for Fun and Profit
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Jablonski-Attacking-Electric-Motors-For-Fun-And-Profit.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Jablonski-Attacking-Electric-Motors-For-Fun-And-Profit-wp.pdf )
• Sensor and Process Fingerprinting in Industrial Control Systems
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Ochoa-Sensor-And-Process-Fingerprinting-In-ICS.pdf )
• HTTP Desync Attacks: Smashing into the Cell Next Door
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Kettle-HTTP-Desync-Attacks-Smashing-Into-The-Cell-Next-Door.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Kettle-HTTP-Desync-Attacks-Smashing-Into-The-Cell-Next-Door-wp.pdf )
  • [Download Tool] ( https://github.com/portswigger/desynchronize )
• Behind the Scenes of Intel Security and Manageability Engine
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Hasarfaty-Behind-The-Scenes-Of-Intel-Security-And-Manageability-Engine.pdf )
• All the 4G Modules Could be Hacked
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shupeng-All-The-4G-Modules-Could-Be-Hacked.pdf )
• New Vulnerabilities in 5G Networks
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shaik-New-Vulnerabilities-In-5G-Networks.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shaik-New-Vulnerabilities-In-5G-Networks-wp.pdf )
• I’m Unique, Just Like You: Human Side-Channels and Their Implications for Security and Privacy
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Wixey-Im-Unique-Just-Like-You-Human-Side-Channels-And-Their-Implications-For-Security-And-Privacy.pdf )
• It’s Not What You Know, It’s What You Do: How Data Can Shape Security Engagement
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Sedova-Know-How-Data-Can-Shape-Security-Engagement.pdf )
• Cyber Insurance 101 for CISO’s
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Smith-Cyber-Insurance-101-For-CISOs.pdf )
• The Path Less Traveled: Abusing Kubernetes Defaults
• Selling 0-Days to Governments and Offensive Security Companies
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shwartz-Selling-0-Days-To-Governments-And-Offensive-Security-Companies.pdf )
• Selling 0-Days to Governments and Offensive Security Companies
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shwartz-Selling-0-Days-To-Governments-And-Offensive-Security-Companies.pdf )
• Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf )
• Integration of Cyber Insurance Into A Risk Management Program
• Come Join the CAFSA - Continuous Automated Firmware Security Analysis
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Mulliner-Come-Join-The-CAFSA-Continuous-Automated-Firmware-Security-Analysis.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Mulliner-Come-Join-The-CAFSA-Continuous-Automated-Firmware-Security-Analysis-wp.pdf )
• Worm Charming: Harvesting Malware Lures for Fun and Profit
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Amini-Worm-Charming-Harvesting-Malware-Lures-For-Fun-And-Profit.pdf )
• MITRE ATT&CK: The Play at Home Edition
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Nickels-MITRE-ATTACK-The-Play-At-Home-Edition.pdf )
• Look, No Hands! – The Remote, Interaction-less Attack Surface of the iPhone
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Silvanovich-Look-No-Hands-The-Remote-Interactionless-Attack-Surface-Of-The-iPhone.pdf )
• Chip.Fail - Glitching the Silicon of the Connected World
• Lessons From Two Years of Crypto Audits
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Aumasson-Lessons-From-Two-Years-Of-Crypto-Audits.pdf )
• Responding to a Cyber Attack with Missiles
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Hypponen-Responding-To-A-Cyber-Attack-With-Missiles.pdf )
• Finding a Needle in an Encrypted Haystack: Leveraging Cryptographic Abilities to Detect the Most Prevalent Attacks on Active Directory
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Simakov-Finding-A-Needle-In-An-Encrypted-Haystack-Leveraging-Cryptographic-Abilities-To-Detect-The-Most-Prevalent-Attacks-On-Active-Directory.pdf )
• Controlled Chaos: The Inevitable Marriage of DevOps & Security
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Shortridge-Controlled-Chaos-The-Inevitable-Marriage-Of-DevOps-And-Security.pdf )
• Arm IDA and Cross Check: Reversing the Boeing 787's Core Network
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Santamarta-Arm-IDA-And-Cross-Check-Reversing-The-787-Core-Network.pdf )
• The Cyber Shell Game – War, Information Warfare, and the Darkening Web
• He Said, She Said – Poisoned RDP Offense and Defense
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Baril-He-Said-She-Said-Poisoned-RDP-Offense-And-Defense.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Baril-He-Said-She-Said-Poisoned-RDP-Offense-And-Defense-wp.pdf )
• How Do Cyber Insurers View The World?
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Prevost-How-Insurers-View-The-World.pdf )
• Internet-Scale Analysis of AWS Cognito Security
• Messaging Layer Security: Towards a New Era of Secure Group Messaging
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Robert-Messaging-Layer-Security-Towards-A-New-Era-Of-Secure-Group-Messaging.pdf )
• Hacking Your Non-Compete
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Stone-Hacking-Your-Non-Compete.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Stone-Hacking-Your-Non-Compete-wp.pdf )
• Hunting for Bugs, Catching Dragons
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Joly-Hunting-For-Bugs-Catching-Dragons.pdf )
• Flying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Landers-Flying-A-False-Flag-Advanced-C2-Trust-Conflicts-And-Domain-Takeover.pdf )
• Going Beyond Coverage-Guided Fuzzing with Structured Fuzzing
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Metzman-Going-Beyond-Coverage-Guided-Fuzzing-With-Structured-Fuzzing.pdf )
• Transparency in the Software Supply Chain: Making SBOM a Reality
• Deconstructing the Phishing Campaigns that Target Gmail Users
• Cybersecurity Risk Assessment for Safety-Critical Systems
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Vessels-Cybersecurity-Risk-Assessment-For-Safety-Critical-Systems.pdf )
• PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Song-PeriScope-An-Effective-Probing-and-Fuzzing-Framework-For-The-Hardware-OS-Boundary.pdf )
• Defense Against Rapidly Morphing DDOS
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Tyagi-Defense-Against-Rapidly-Morphing-DDOS.pdf )
• Reverse Engineering WhatsApp Encryption for Chat Manipulation and More
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Zaikin-Reverse-Engineering-WhatsApp-Encryption-For-Chat-Manipulation-And-More.pdf )
• Detecting Malicious Files with YARA Rules as They Traverse the Network
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-Bernal-Detecting-Malicious-Files-With-YARA-Rules-As-They-Traverse-The-Network.pdf )
• MINimum Failure - Stealing Bitcoins with Electromagnetic Fault Injection
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Wednesday/us-19-OFlynn-MINimum-Failure-Stealing-Bitcoins-With-EMFI.pdf )
  • [Download Tool] (github.com/newaetech/phywhisperer-usb)
• Mobile Interconnect Threats: How Next-Gen Products May be Already Outdated
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Teissier-Mobile-Interconnect-Threats-How-Next-Gen-Products-May-Be-Already-Outdated.pdf )
• On Trust: Stories from the Front Lines
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Farshchi-On-Trust-Stories-From-The-Front-Lines.pdf )
• WebAuthn 101 - Demystifying WebAuthn
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Brand-WebAuthn-101-Demystifying-WebAuthn.pdf )
• Attack Surface as a Service
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Westelius-Attack-Surface-As-A-Service.pdf )
• Woke Hiring Won’t Save Us: An Actionable Approach to Diversity Hiring and Retention
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Lynch-Woke-Hhiring-Wont-Save-Us-An-Actionable-Approach-To-Diversity-Hiring-And-Retention.pdf )
• GDPArrrrr: Using Privacy Laws to Steal Identities
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pavur-GDPArrrrr-Using-Privacy-Laws-To-Steal-Identities.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pavur-GDPArrrrr-Using-Privacy-Laws-To-Steal-Identities-wp.pdf )
• The Future of Securing Intelligent Electronic Devices Using the IEC 62351-7 Standard for Monitoring
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Carcano-The-Future-Of-Securing-IED-Using-The-IEC62351-7-Standard-For-Monitoring.pdf )
• Testing Your Organization's Social Media Awareness
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Wilkin-Testing-Your-Organizations-Social-Media-Awareness.pdf )
• Death to the IOC: What's Next in Threat Intelligence
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Soman-Death-To-The-IOC-Whats-Next-In-Threat-Intelligence.pdf )
• Planning a Bug Bounty: The Nuts and Bolts from Concept to Launch
• Playing Offense and Defense with Deepfakes
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Price-Playing-Offense-And-Defense-With-Deepfakes.pdf )
• All Your Apple are Belong to Us: Unique Identification and Cross-Device Tracking of Apple Devices
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Zheng-All-Your-Apple-Are-Belong-To-Us-Unique-Identification-And-Cross-Device-Tracking-Of-Apple-Devices.pdf )
• The Enemy Within: Modern Supply Chain Attacks
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Doerr-The-Enemy-Within-Modern-Supply-Chain-Attacks.pdf )
• Information Security in the Public Interest
• Breaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Matrosov-Breaking-Through-Another-Side-Bypassing-Firmware-Security-Boundaries-From-Embedded-Controller.pdf )
• Project Zero: Five Years of 'Make 0Day Hard'
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Hawkes-Project-Zero-Five-Years-Of-Make-0day-Hard.pdf )
• Rough and Ready: Frameworks to Measure Persistent Engagement and Deterrence
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Healey-Rough-and-Ready-Frameworks-To-Measure-Persistent-Engagment-and-Deterrence.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Healey-Rough-and-Ready-Frameworks-to-Measure-Persistent-Engagement-and-Deterrence-wp.pdf )
• 100 Seconds of Solitude: Defeating Cisco Trust Anchor With FPGA Bitstream Shenanigans
• Denial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Hauke-Denial-Of-Service-With-A-Fistful-Of-Packets-Exploiting-Algorithmic-Complexity-Vulnerabilities.pdf )
• Women in Security: Building a Female InfoSec Community in Korea, Japan, and Taiwan
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Nakajima-Women-In-Security-Building-A-Female-InfoSec-Community-In-Korea-Japan-And-Taiwan.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Nakajima-Women-In-Security-Building-A-Female-InfoSec-Community-In-Korea-Japan-And-Taiwan-wp.pdf )
• Rogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Bitan-Rogue7-Rogue-Engineering-Station-Attacks-On-S7-Simatic-PLCs.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Bitan-Rogue7-Rogue-Engineering-Station-Attacks-On-S7-Simatic-PLCs-wp.pdf )
• Operational Templates for State-Level Attack and Collective Defense of Countries
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Conti-Operational-Templates-for-State-Level-Attack-and-Collective-Defense-of-Countries.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Conti-Operational-Templates-for-State-Level-Attack-and-Collective-Defense-of-Countries-wp.pdf )
• Process Injection Techniques - Gotta Catch Them All
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Kotler-Process-Injection-Techniques-Gotta-Catch-Them-All.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Kotler-Process-Injection-Techniques-Gotta-Catch-Them-All-wp.pdf )
  • [Download Tool] ( https://github.com/SafeBreach-Labs/pinjectra )
• Bounty Operations: Best Practices and Common Pitfalls to Avoid in the First 6-12 Months
• DevSecOps : What, Why and How
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Shrivastava-DevSecOps-What-Why-And-How.pdf )
• Breaking Encrypted Databases: Generic Attacks on Range Queries
• Finding Our Path: How We're Trying to Improve Active Directory Security
• API-Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Maddux-API-Induced-SSRF-How-Apple-Pay-Scattered-Vulnerabilities-Across-The-Web.pdf )
• Exploiting Qualcomm WLAN and Modem Over The Air
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pi-Exploiting-Qualcomm-WLAN-And-Modem-Over-The-Air.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Pi-Exploiting-Qualcomm-WLAN-And-Modem-Over-The-Air-wp.pdf )
• Practical Approach to Automate the Discovery and Eradication of Open-Source Software Vulnerabilities at Scale
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Almubayed-Practical-Approach-To-Automate-The-Discovery-And-Eradication-Of-Open-Source-Software-Vulnerabilities-At-Scale.pdf )
• Managing for Success: Maintaining a Healthy Bug Bounty Program Long Term
• Ghidra - Journey from Classified NSA Tool to Open Source
• Firmware Cartography: Charting the Course for Modern Server Compromise
• 0-days & Mitigations: Roadways to Exploit and Secure Connected BMW Cars
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Cai-0-Days-And-Mitigations-Roadways-To-Exploit-And-Secure-Connected-BMW-Cars.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Cai-0-Days-And-Mitigations-Roadways-To-Exploit-And-Secure-Connected-BMW-Cars-wp.pdf )
• Infighting Among Russian Security Services in the Cyber Sphere
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Zenz-Infighting-Among-Russian-Security-Services-in-the-Cyber-Sphere.pdf )
• Behind the scenes of iOS and Mac Security
• Zombie Ant Farming: Practical Tips for Playing Hide and Seek with Linux EDRs
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Snezhkov-Zombie-Ant-Farming-Practical-Tips-For-Playing-Hide-And-Seek-With-Linux-EDRs.pdf )
• Predictive Vulnerability Scoring System
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Roytman-Jacobs-Predictive-Vulnerability-Scoring-System.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Roytman-Predictive-Vulnerability-Scoring-System-wp.pdf )
• Towards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Huang-Towards-Discovering-Remote-Code-Execution-Vulnerabilities-In-Apple-FaceTime.pdf )
• Backdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Berta-Backdooring-Hardware-Devices-By-Injecting-Malicious-Payloads-On-Microcontrollers.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Berta-Backdooring-Hardware-Devices-By-Injecting-Malicious-Payloads-On-Microcontrollers-wp.pdf )
• Securing the System: A Deep Dive into Reversing Android Pre-Installed Apps
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Stone-Securing-The-System-A-Deep-Dive-Into-Reversing-Android-Preinstalled-Apps.pdf )
• Preventing Authentication Bypass: A Tale of Two Researchers
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Jaiswal-Preventing-Authentication-Bypass-A-Tale-Of-Two-Researchers.pdf )
• Automation Techniques in C++ Reverse Engineering
• Inside the Apple T2
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Davidov-Inside-The-Apple-T2.pdf )
• Making Big Things Better the Dead Cow Way
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Menn-Making-Big-Things-Better-The-Dead-Cow-Way-wp.pdf )
• Critical Zero Days Remotely Compromise the Most Popular Real-Time OS
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Seri-Critical-Zero-Days-Remotely-Compromise-The-Most-Popular-Real-Time-OS.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Seri-Critical-Zero-Days-Remotely-Compromise-The-Most-Popular-Real-Time-OS-wp.pdf )
• Fantastic Red-Team Attacks and How to Find Them
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Smith-Fantastic-Red-Team-Attacks-And-How-To-Find-Them.pdf )
• The Discovery of a Government Malware and an Unexpected Spy Scandal
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Franceschi-Bicchierai-The-Discovery-Of-A-Government-Malware-And-An-Unexpected-Spy-Scandal.pdf )
• Attacking iPhone XS Max
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Wang-Attacking-IPhone-XS-Max.pdf )
• Securing Apps in the Open-By-Default Cloud
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Howes-Securing-Apps-In-The-Open-By-Default-Cloud.pdf )
• Adventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers
• HostSplit: Exploitable Antipatterns in Unicode Normalization
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Birch-HostSplit-Exploitable-Antipatterns-In-Unicode-Normalization.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Birch-HostSplit-Exploitable-Antipatterns-In-Unicode-Normalization-wp.pdf )
• Hacking Ten Million Useful Idiots: Online Propaganda as a Socio-Technical Security Project
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Perlman-Hacking-Ten-Million-Useful-Idiots-Online-Propaganda-As-A-Socio-Technical-Security-Project.pdf )
• Everybody be Cool, This is a Robbery!
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Campana-Everybody-Be-Cool-This-Is-A-Robbery.pdf )
• A Compendium of Container Escapes
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Edwards-Compendium-Of-Container-Escapes.pdf )
• The Future of ATO
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Martin-The-Future-Of-ATO.pdf )
• Exploring the New World : Remote Exploitation of SQLite and Curl
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Qian-Exploring-The-New-World-Remote-Exploitation-Of-SQLite-And-Curl.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Qian-Exploring-The-New-World-Remote-Exploitation-Of-SQLite-And-Curl-wp.pdf )
• How to Detect that Your Domains are Being Abused for Phishing by Using DNS
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Hoelzel-How-To-Detect-That-Your-Domains-Are-Being-Abused-For-Phishing-By-Using-DNS.pdf )
• Debug for Bug: Crack and Hack Apple Core by Itself - Fun and Profit to Debug and Fuzz Apple Kernel by lldb Script
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Lilang-Debug-For-Bug-Crack-And-Hack-Apple-Core-By-Itself-Fun-And-Profit-To-Debug-And-Fuzz-Apple-Kernel-By-LLDB-Script.pdf )
• Shifting Knowledge Left: Keeping up with Modern Application Security
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Stanislav-Shifting-Knowledge-Left-Keeping-Up-With-Modern-Application-Security.pdf )
• Paging All Windows Geeks – Finding Evil in Windows 10 Compressed Memory
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Sardar-Paging-All-Windows-Geeks-Finding-Evil-In-Windows-10-Compressed-Memory.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Sardar-Paging-All-Windows-Geeks-Finding-Evil-In-Windows-10-Compressed-Memory-wp.pdf )
• Breaking Samsung’s ARM TrustZone
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Peterlin-Breaking-Samsungs-ARM-TrustZone.pdf )
• Command Injection in F5 iRules
  • [Download Presentation Slides] ( http://i.blackhat.com/USA-19/Thursday/us-19-Jerkeby-Command-Injection-In-Irules-Loadbalancer-Scripts.pdf )
  • [Download White Paper] ( http://i.blackhat.com/USA-19/Thursday/us-19-Jerkeby-Command-Injection-In-Irules-Loadbalancer-Scripts-wp.pdf )
• Moving from Hacking IoT Gadgets to Breaking into One of Europe's Highest Hotel Suites
  • [Download Presentation Slides] ( https://i.blackhat.com/USA-19/Thursday/us-19-Ray-Moving-From-Hacking-IoT-Gadgets-To-Breaking-Into-One-Of-Europes-Highest-Hotel-Suites.pdf )
• Lessons and Lulz: The 5th Annual Black Hat USA NOC Report

Material DEF CON 27



*DEF CON 27*

Ya hay disponible bastante material de las presentaciones de DEF CON 27 :

• Anish-Athalye-Strong-Isolation.pdf
  • Anish Athalye - Strong Isolation - Demo 1 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 2 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 3 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 4 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 5 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 6 of 7.mp4
  • Anish Athalye - Strong Isolation - Demo 7 of 7.mp4
• Bernhard-Mueller-The-Ether-Wars.pdf
  • Bernhard-Mueller-demo_01_destructible.mp4
  • Bernhard-Mueller-demo_02_ethernaut.mp4
  • Bernhard-Mueller-demo_03_graph.mp4
  • Bernhard-Mueller-demo_04_scrooge.mp4
• Bill-Graydon-Restricted-Keys.pdf
  • Graydon - Restricted Keys - HPC keyway adapter.mp4
  • Graydon - Restricted Keys - SC1 cut.mp4
  • Graydon - Restricted Keys - m3 slider cut.mp4
  • Graydon - Restricted Keys - mul-t-lock drill press.mp4
  • Graydon - Restricted Keys - standard profile cut.mp4
• Christopher-Wade-Tag-side-attacks-against-NFC.pdf
  • Christopher Wade - Demo 1.mp4
  • Christopher Wade - Demo 2.mp4
  • Christopher Wade - Demo 3.mp4
  • Christopher Wade - Demo 4.mp4
• Damien-Cauquil-Defeating-Bluetooth-Low-Energy-5-PRNG-for-fun-and-jamming.PDF
  • Damien Cauquil - 1.simulating_csa2_attack.mp4
  • Damien Cauquil - 1.simulating_csa2_attack_1.mp4
  • Damien Cauquil - 2.sniffing_csa2.mp4
  • Damien Cauquil - 2.sniffing_csa2_1.mp4
  • Damien Cauquil - 3.jamming_csa2.mp4
  • Damien Cauquil - 3.jamming_csa2_1.mp4
• DimitrySnezhkov-Zombie-Ant-Farm-Practical-Tips.pdf
  • DimitrySnezhkov-Zombie-Ant-Farm-Practical-Tips-1080.mp4
  • DimitrySnezhkov-Zombie-Ant-Farm-Practical-Tips-Demo.mp4
• Dirk-jan-Mollema-Im-in-your-cloud-pwning-your-azure-environment.pdf
  • Dirk-jan Mollema - Im in your cloud pwning your azure environment - demo1.mp4
  • Dirk-jan Mollema - Im in your cloud pwning your azure environment - mfademo.mp4
  • Dirk-jan Mollema - Im in your cloud pwning your azure environment - notepad.mp4
• Douglas-McKee-HVACking-Understanding-the-Delta-Between-Security-and-Reality.pdf
  • Douglas McKee - HVACKing Demo 2.mp4
  • Douglas McKee - HVACKing Demo 3.mp4
  • Douglas McKee HVACKing Demo 1.mp4
• Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin.pdf
  • Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin-rebind-demo1-iPad-5sec.mp4
  • Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin-rebind-demo2-hook-control.mp4
  • Gerald-Doussot-Roger-Meyer-State-of-DNS-Rebinding-Attack-and-Prevention-Techniques-and-the-Singularity-of-Origin-rebind-demo3-automation.mp4
• Hadrien-Barral-The-ABC-of-Next-Gen-Shellcoding.pdf
  • Hadrien-Barral-The-ABC-of-Next-Gen-Shellcoding-armv8.mp4
  • Hadrien-Barral-The-ABC-of-Next-Gen-Shellcoding-english.mp4
  • hash.mp4
  • slash.mp4
  • tick.mp4
• Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoiP-Configuration-Interfaces.pdf
  • Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoIP-Configuration-Interfaces-Demo-1.mp4
  • Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoIP-Configuration-Interfaces-Demo-2.mp4
  • Huber-and-Roskosch-I-m-on-Your-Phone-Listening-Attacking-VoIP-Configuration-Interfaces-Demo-3.mp4
• Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-All.pdf
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-All-Demo-Extras.zip
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllAtomBombing.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllGhostWriting.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllSetWindowsLongPtr.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllStackBomber.mp4
  • Itzik-Kotler-Amit-Klein-Gotta-Catch-Them-AllnmapMap.mp4
• Jack-Baker-Hacking-Web-Assembly-Games.pdf
  • Jack-Baker-Hacking-Web-Assembly-Games-Demo-1.mp4
  • Jack-Baker-Hacking-Web-Assembly-Games-Demo-2.mp4
• Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil.pdf
  • Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil-Demo-1.mp4
  • Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil-Demo-2.mp4
  • Jayson-Grace-MOSE-Using-Configuration-Management-for-Evil-Demo-3.mp4
• Jeff-Dileo-Evil-eBPF-In-Depth.pdf
  • Jeff-Dileo-Evil-eBPF-In-Depth-DEMO-call.mp4
  • Jeff-Dileo-Evil-eBPF-In-Depth-DEMO-reduce.mp4
• Jens-Mueller-Re-Whats-up-Johnny-Covert-Content-Attacks-on-Email-End-to-End-Encryption.pdf
  • Jens Mueller-demo-decryption-oracle.ogv
  • Jens Mueller-demo-signing-oracle.ogv
• Jmaxxz-Your-Car-is-My-Car.pdf
  • OpenRemoteStart-master
    • images/
    • src/
    • LICENSE
    • README.md
    • project.properties
  • Jmaxxz - 0 - BenchCarTour.mp4
  • Jmaxxz - 1 - StartingBenchCarRf.mp4
  • Jmaxxz - 10 - StartImprezaWithoutTransponder.mp4
  • Jmaxxz - 11 -StartMiniWIthoutKey.mp4
  • Jmaxxz - 2 - CloneExistingRemote_ShortEdit - UPDATED V2.mp4
  • Jmaxxz - 2 -CloneExistingRemote.mp4
  • Jmaxxz - 3 - StartCar.mp4
  • Jmaxxz - 4 - DriveOff - UPDATED V2.mp4
  • Jmaxxz - 4 - DriveOff.mp4
  • Jmaxxz - 5 - DisableWheelLockAndDrive.mp4
  • Jmaxxz - 6 - StartCarAfterStop.mp4
  • Jmaxxz - 9 - SqliStartCar.mp4
• Joshua-Maddux-API-Induced-SSRF.pdf
  • Joshua Maddux - API-Induced SSRF - Demo 1 appr-wrapper.mp4
  • Joshua Maddux - API-Induced SSRF - Demo 2 webkitorg.mp4
  • Joshua Maddux - API-Induced SSRF - Demo 3 twilio.mp4
• Leon-Jacobs-Meticulously-Modern-Mobile-Manipulations.pdf
  • Leon Jacobs - 1. http-file-browser.mp4
  • Leon Jacobs - 2. heap-ios-tiktok.mp4
  • Leon Jacobs - 3. reflection-jar-socket.mp4
  • Leon Jacobs - 4. ios-flex-plugin.mp4
  • Leon Jacobs - 5. android-stetho.mp4
  • Leon Jacobs - 6. jenkins-ci.mov.mp4
• Maksim-Shudrak-Zero-Bugs-Found-Hold-My-Beer-AFL-How-to-Improve-Coverage-guided-Fuzzing-and-Find-New-Zero-days-in-Tough-Targets.pdf
  • afl_main_screen_fast.mkv
  • manul_main.mkv
  • zeek_1.mkv
• Nikhil-Mittal-RACE-Minimal-Rights-and-ACE-for-Active-Directory-Dominance.pdf
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo2-ModifyServicePermissions.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo3-JEAToDC.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo4-DumpDCHash.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance - Demo5-CompromiseForestRoot.mp4
  • Nikhil - RACE - Minimal Rights and ACE for Active Directory Dominance- Demo1-PSRemotingToDC.mp4
• Orange-Tsai-and-Meh-Chang-Infiltrating-Corporate-Intranet-Like-NSA-Pre-auth-RCE-on-Leading-SSL-VPNs.pdf
  • Orange-Tsai-and-Meh-Chang-Infiltrating-Corporate-Intranet-Like-NSA-Pre-auth-RCE-on-Leading-SSL-VPNs-Demo-Video.zip
  • Orange-Tsai-and-Meh Chang-Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs-demo_fortigate.mp4
  • Orange-Tsai-and-Meh Chang-Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs-demo_pulsesecure_v1.mp4
• Pedro-Cabrera-SDR-Against-Smart-TVs-URL-and-Channel-Injection-Attacks.pdf
  • 1_video.mp4
  • 2_video.mp4
  • PedroCabrera - SDR Against Smart TVs_video10-B+M.mp4
  • PedroCabrera - SDR Against Smart TVs_video3-NotFinal.mp4
  • PedroCabrera - SDR Against Smart TVs_video4.mp4
  • PedroCabrera - SDR Against Smart TVs_video5_inject_URL.mp4
  • PedroCabrera - SDR Against Smart TVs_video6-IISS-SDR.mp4
  • PedroCabrera - SDR Against Smart TVs_video7-IISS-DNS.mp4
  • PedroCabrera - SDR Against Smart TVs_video8-KL.mp4
  • PedroCabrera - SDR Against Smart TVs_video9-Mi.mp4
• Sheila-A-Berta-Backdooring-hardware-devices-by-injecting-malicious-payloads-on-Microcontrollers.pdf
  • CARSECU_demo.mp4
  • EUSART_demo.mp4
  • ROP_demo.mp4
• Xiling-Gong-Peter-Pi-Exploiting-Qualcomm-WLAN-and-Modem-Over-The-Air.pdf
  • demo - xiling gong, peter pi - exploiting qualcomm wlan and modem over the air.mp4
  • demo - xiling gong, peter pi - exploiting qualcomm wlan and modem over the air_1.mp4
• Yaron-Zinar-and-Marina-Simakov-Relaying-Credentials-Has-Never-Been-Easier-How-to-Easily-Bypass-the-Latest-NTLM-Relay-Mitigations.pdf
  • Zinar Simakov - epa_bypass_final.mp4
  • Zinar Simakov - session_key_final.mp4
• albinowax-HTTP-Desync-Attacks.pdf
  • albinowax-HTTP-Desync-Attacks-whitepaper.pdf
  • albinowax-HTTP-Desync-Attacks-demo.mp4
• albinowax-HTTP-Desync-Attacks-tool
  • build
    • classes/
    • libs/
    • resources/
    • tmp/
  • out
    • artifacts/
    • production/
  • resources
    • CL-TE.py
    • TE-CL.py
  • src
    • burp/
  • build.gradle
  • readme.md
  • sqlite-jdbc-3.23.1.jar
  • turbo-intruder-all.jar
• finalphoenix-Rise-of-the-Hypebots.pdf
  • finalphoenix-Rise-of-the-Hypebots-Complicated Bot.mp4
  • finalphoenix-Rise-of-the-Hypebots-botsThatBot.mp4
  • finalphoenix-Rise-of-the-Hypebots-fancy-monitor.mp4
  • finalphoenix-Rise-of-the-Hypebots-puppeteerBot.mp4
  • finalphoenix-Rise-of-the-Hypebots-simple-monitor.mp4
• Alexandre-Borges-dotNET-Malware-Threats.pdf
• Alon-Weinberg-Please-inject-me-a-x64-code-injection.pdf
  • Alon-Weinberg-Please-inject-me-a-x64-code-injection-Demo.mp4
• Alvaro-Munoz-Oleksandr-Mirosh-SSOWars-The-Token-Menace.pdf
  • Alvaro-Munoz-Oleksandr-Mirosh-SSOWars-The-Token-Menace-Demo-Videos.zip
• Amit-Waisel-and-Hila-Cohen-malproxy.pdf
  • Amit-Waisel-and-Hila-Cohen-malproxy-demo.mp4
• Andreas-Baumhof-Are-Quantum-Computers-Really-A-Threat-To-Cryptography.pdf
• Andy-Grant-Unpacking-pkgs.pdf
  • Andy-Grant-Unpacking-pkgs.mp4
• Ariel-Adversariel-Herbert-Voss-Dont-Red-Team-AI-like-a-Chump.pdf
• Ben-Morris-More-Keys-Than-A-Piano-Finding-Secrets-In-Publicly-Exposed-Ebs-Volumes.pdf
• Ben-Sadeghipour-Owning-the-clout-through-SSRF-and-PDF-generators.pdf
• Bill-Swearingen-HAKC-The-Police.pdf
• Brad-Dixon-Cheating-in-eSports-How-to-cheat-at-virtual-cycling-using-USB-hacks.compressed.pdf
• Brad-Dixon-Cheating-in-eSports-How-to-cheat-at-virtual-cycling-using-USB-hacks.pdf
• Brent-Stone-Reverse-Enginerring-17-Cars.pdf
  • Brent-Stone-Reverse-Enginerring-17-Cars-Video-Demo.mp4
• Brizendine-Stroschein-The-JOP-ROCKET-DEMO-1.mp4
• Brizendine-Stroschein-The-JOP-ROCKET.pdf
  • Brizendine-Stroschein-The-JOP-ROCKET-DEMO.mp4
• Campbell-Murray-GSM-We-can-hear-everyone-now.pdf
• Christopher-Roberts-Firmware-Slap.pdf
  • Christopher-Roberts-DEMO-1.mp4
  • Christopher-Roberts-DEMO-2.mp4
  • Christopher-Roberts-Firmware-Slap-DEMO-1.wmv
  • Christopher-Roberts-Firmware-Slap-DEMO-2.wmv
  • Christopher-Roberts-Firmware-Slap-DEMO-3.wmv
• Dan-Regalado-Defcon27AliDan.pdf
  • Dan-Regalado-ARM-Syscalls.mp4
• Daniel-Romero-and-Mario-Rivas-Why-you-should-fear-your-mundane-office.pdf
• Elliott-Thompson-Mi-Casa-Su-Casa.pdf
  • Elliott-Thompson-Mi-Casa-Su-Casa-Video-Demonstration.mp4
• Eyal-Itkin-Say-Cheese-How-I-Ransomwared-Your-DSLR-Camera.pdf
  • Eyal-Itkin-Say-Cheese-How-I-Ransomwared-Your-DSLR-Camera-Demo.mp4
• Gregory-Pickett-Breaking-The-Back-End-It-Is-Not-Always-A-Bug.-Sometimes-It-Is-Just-Bad-Design.pdf
  • Gregory-Pickett-Breaking-The-Back-End-It-Is-Not-Always-A-Bug.-Sometimes-It-Is-Just-Bad-Design-Demo.mp4
• Jacob-Baines-Help-Me-Vulnerabilities.-Youre-My-Only-Hope.pdf
• Jesse-Michael-Get-off-the-kernel-if-you-cant-drive.pdf
• Joe-Grand-Badge.pdf
  • Joe-Grand-The-Badge.pdf
• Joseph-Cox-How-You-Can-Buy-ATT-T-Mobile-and-Sprint-Real-Time-Location-Data-on-the-Black-Market.pdf
• Joseph-Menn-Change-the-World-cDc-Style.pdf
• Junyu-Zhou-and-Ce-Qin-and-Jianing-Wang-Web2Own-Attacking-Desktop-Apps-From-Web-Securitys-Perspective.pdf
• Katherine-Pratt-Hacking-Your-Thoughts-Batman-Forever-meets-Black-Mirror.pdf
  • Katherine-Pratt-Hacking-Your-Thoughts-Batman-Forever-meets-Black-Mirror.pptx
• Kyle-Gwinnup-Next-Generation-Process-Emulation-with-Binee.pdf
  • Kyle-Gwinnup-Next-Generation-Process-Emulation-with-Binee-Demo.mp4
• Masarah-Paquet-Clouston-Olivier-Bilodeau-The-Industry-of-Social-Media-Manipulation-Driven-by-Malware.pdf
  • Masarah-Paquet-Clouston-Olivier-Bilodeau-The-Industry-of-Social-Media-Manipulation-support-video-luminati-sdk-demo.mp4
• Matt-Wixey-Sound-Effects-Exploring-Acoustic-Cyber-Weapons.pdf
• Michael-Leibowitz-and-Topher-Timzen-EDR-Is-Coming-Hide-Yo-Sht.pdf
  • Michael-Leibowitz-and-Topher-Timzen-EDR-Is-Coming-Hide-Yo-Sht-WINDOWS-DEMO.mp4
• Michael-Stepankin-Apache-Solr-Injection.pdf
• Nicolas-Oberli-Poking-the-S-in-SD-cards.PDF
  • Nicolas-Oberli-Poking-the-S-in-SD-cards-DEMO.mkv
  • Nicolas-Oberli-Poking-the-S-in-SD-cards-DEMO.mp4
• Nina-Kollars-Confessions-of-a-Nespresso-Money-Mule.pdf
• Omer-Gull-SELECT-code-execution-FROM-USING-SQLite.pdf
  • Omer-Gull-SELECT-code-execution-FROM-USING-SQLite-Demo.mp4
  • Omer-Yair-Exploiting-Windows-Exploit-Mitigation-for-ROP-Exploits-Demo.mp4
  • Omer-Yair-Exploiting-Windows-Exploit-Mitigation-for-ROP-Exploits.pdf
• Panel-DC101-The-Panel.pdf
• Patrick-Wardle-Harnessing-Weapons-of-Mac-Destruction.pdf
• Phar-No-Mas-How-One-Side-Channel-Flaw-Opens-Atm-Pharmacies-and-Government-Secrets-Up-to-Attack.pdf
• Philippe-Laulheret-Introduction-to-Hardware-Hacking-Extended-Version.pdf
  • Philippe-Laulheret-Introduction-to-Hardware-Hacking-Demo-Video.mp4
• Roger-Dingledine-TOR-Censorship-Arms-Race.pdf
• Travis-Palmer-First-try-DNS-Cache-Poisoning-with-IPv4-and-IPv6-Fragmentation.pdf
• Truman-Kain-Surveillance-Detection-Scout.pdf
  • Truman-Kain-Surveillance-Detection-Scout-Demo.mp4
• Wenxiang-Qian-Yuxiang-Li-Huiyu-Wu-Breaking-Google-Home-Exploit-It-with-SQLite-Magellan.pdf
• WillC-Phreaking-Elevators.pdf
• Workshop-Anthony-Rose-Introduction-to-AMSI-Bypasses-and-Sandbox-Evasion.pdf
• Xiaohuihui-All-The-4G-Modules-Could-Be-Hacked.pdf
• Zhang-Xiangqian-Liu-Huiming-Your-secret-files-are-mine.pdf
• d4krm4tter-Mike-Spicer-I-Know-What-You-Did-Last-Summer.pdf
  • d4krm4tter-Mike-Spicer-I-Know-What-You-Did-Last-Summer-Demo.mp4
• droogie-go-null-yourself.pdf
• grichter-Reverse-Engineering-4G-Hotspots-For-Fun-Bugs-Net-Financial-Loss.pdf
  • grichter-Reverse-Engineering-4G-Hotspots-For-Fun-Bugs-Net-Financial-Loss-MF910-CSRF-Demo.mp4
• jiska-fabian-vacuum-cleaning-security.pdf
• smea-Adventures-in-smart-buttplug-penetration-testing.pdf

Vídeos DEF CON 26



*DEF CON 26*

Aquí os dejo los vídeos que se han publicado de DEF CON 26 ). Ya tenéis entretenimiento para el fin de semana que se avecina.

Recuerda que también tienes el material disponible.

• Rob Joyce - NSA Talks Cybersecurity
• Eyal Itkin, Yaniv Balmas - What the Fax?!
• Josh Mitchell - Ridealong Adventures: Critical Issues with Police Body Cameras
• Svea, Suggy, Till - Inside the Fake Science Factory
• Ladar Levison, hon1nbo - Booby Trapping Boxes
• 0x200b - Detecting Blue Team Research Through Targeted Ads
• [Si, Agent X - Wagging the Tail:Covert Passive Surveillance]( https://www.youtube.com/watch?v=tYFOXeItRFM&list=PL9fPq3eQfaaD0cf5c7wkzMoj2kifz GO4U&index=8&t=0s)
• Alexei Bulazel - Reverse Engineering Windows Defenders Emulator
• Alfonso Alguacil and Murillo Moya - Playback a TLS 1 point 3 story
• Bui and Rao - Last mile authentication problem Exploiting the missing link
• Champion and Law - Building the Hacker Tracker
• Christopher Domas - GOD MODE UNLOCKED Hardware Backdoors in redacted x86
• Christopher Domas - The Ring 0 Facade Awakening the Processors Inner Demons
• Damien virtualabs Cauquil - You had better secure your BLE devices
• Douglas McKee - 80 to 0 in Under 5 Seconds
• Daniel Crowley and Panel - Outsmarting the Smart City
• delta zero and Azeem Aqil - Your Voice is My Passport
• Daniel Zolnikov - A Politicians Successful Efforts to Fight Surveillance
• Dr Holtmanns and Singh - 4G Who is Paying Your Cellular Phone Bill Video
• Dr Rasthofer and Panel - Worrisome Security Issues in Tracker Apps
• Dr Matthews and Panel - A DEF CON Guide to Adversarial Testing of Software
• Elinor Mills and Panel - The L0pht Testimony 20 Years Later and Other Things
• Foster and Ayrey - Dealing with Residual Certificates for Pre-owned Domains
• Franklin and Franklin - Defending the 2018 Midterm Elections from Foreign Adversaries
• Gabriel Ryan - Bypassing Port Security In 2018 Defeating MacSEC and 802 1x 2010
• George Tarnovsky - You Can Run but You Cant Hide Reverse Engineering Using X-Ray
• Greenstadt and Dr Caliskan - De-anonymizing Programmers from Source Code
• Guang Gong - Pwning theToughest Target, the Largest Bug Bounty in the History of ASR
• HuiYu and Qian - Breaking Smart Speakers We are Listening to You
• Ian Haken - Automated Discovery of Deserialization Gadget Chains
• Izycki and Colli - Digital Leviathan A Comprehensive List of Nation State Big Brothers
• Jeanette Manfra - Securing our Nations Election Infrastructure
• Joe Rozner - Synfuzz Building a Grammar Based Retargetable Test Generation Framework
• Johnson and Stavrou - Vulnerable Out of the Box - Evaluation of Android Carrier Devices
• Josep Pi Rodriguez - WingOS: How to Own Millions of Devices .
• Kim and Choi - Your Watch Can Watch You! Pitfalls in the Samsung Gear Smartwatch
• Knight and Speers - Designing and Applying Extensible RF Fuzzing Tools
• Krotofil , Wetzels - Thru the Eyes of the Attacker Designing Embedded Systems for ICS
• Lane Broadbent - Trouble in the Tubes How Internet Routing Security Breaks Down
• ldionmarcil - Edge Side Include Injection Abusing Caching Servers into SSRF
• Levinson and Borges - Ill See Your Missile and Raise You A MIRV
• Maggie Mayhem - Sex Work After SESTA FOSTA
• Maksim Shudrak - Fuzzing Malware For Fun and Profit
• Martin Vigo - Compromising Online Accounts by Cracking Voicemail Systems
• Matt King - Micro Renovator Bringing Processor Firmware up to Code
• Galloway, Yunusov - For the Love of Money Finding and Exploiting Vulns in mPOS Systems
• Zhenxuan Bai and Panel - Replay Attacks on Ethereum Smart Contracts
• Zheng and Panel - Your Peripheral Has Planted Malware An Exploit of NXP SOCs
• Zheng and Bai - Fasten your seatbelts We are escaping iOS 11 Sandbox
• zerosum0x0 - Demystifying MS17 010 Reverse Engineering the ETERNAL Exploits
• zenofex - Dissecting the Teddy Ruxpin Reverse Engineering the Smart Bear
• Zeng and Panel - Lora Smart Water Meter Security Analysis
• Zach and Alex - Infecting The Embedded Supply Chain
• Yu Wang - Attacking the macOS Kernel Graphics Driver
• yawnbox - Privacy Infrastructure Challenges and Opportunities
• Xiao and Panel - Hacking the Brain Customize Evil Protocol to Pwn an SDN Con
• William Martin - SMBetray Backdooring and Breaking Signatures
• William Martin - One Click to OWA
• West and Campbell - barcOwned Popping Shells with Your Cereal Box
• Wesley McGrew - An Attacker Looks at Docker Approaching Multi Container Applications
• Vincent Tan - Hacking BLE Bicycle Locks for Fun and a Small Profit
• Truman Kain - Dragnet Your Social Engineering Sidekick
• Thiago Alves - Hacking PLCs and Causing Havoc on Critical Infrastructures
• The Tarquin - Weaponizing Unicode Homographs Beyond IDNs
• The Dark Tangent and Panel - DEF CON GROUPS
• The Dark Tangent - Welcome To DEF CON & Badge Maker Talk
• The Dark Tangent - DEF CON 26 Closing Ceremonies
• Steven Danneman - Your Banks Digital Side Door
• smea - Jailbreaking the 3DS Through 7 Years of Hardening
• Slava Makkaveev - Man In The Disk
• singe - Practical and Improved Wifi MitM with Mana
• Shkatov and Michael - UEFI Exploitation for the Masses
• Sheng Hao Ma - Playing Malware Injection with Exploit Thoughts
• sghctoma - All Your Math are Belong to Us
• Sean Metcalf - Exploiting Active Directory Administrator Insecurities
• Seamus Burke - A Journey Into Hexagon Dissecting a Qualcomm Baseband
• Sanat Sharma - House of Roman a Leakless Heap Fengshui to Achieve RCE on PIE Binaries
• Ruo Ando - Asura PCAP File Analyzer for Anomaly Packets Detection
• Rowan Phipps - ThinSIM based Attacks on Mobile Money Systems
• Rousseau and Seymour - Finding Xori Malware Analysis Triage with Automated Disassembly
• Romailler and Amiet - Reaping and Breaking Keys at Scale When Crypto Meets Big Data
• Rob Joyce - Building Absurd Christmas Light Shows
• Riedesel and Hakimian - Tineola Taking a Bite Out of Enterprise Blockchain
• Ricky HeadlessZeke Lawshae - Who Controls the Controllers Hacking Crestron
• Richard Thieme - The Road to Resilience How Real Hacking Redeems a Damnable Profession
• Patrick Wardle - The Mouse is Mightier than the Sword
• Patrick Wardle - Fire and Ice Making and Breaking macOS Firewalls
• Paternotte and van Ommeren - It WISNt Me Attacking Industrial Wireless Mesh Networks
• Panel - DC 101 Panel
• Ossmann and Spill - Revolting Radios
• Orange Tsai - Breaking Parser Logic Take Your Path Normalization Off and Pop 0Days Out
• Nirenberg and Buchwald - Reverse Engineering Hacking Documentary Series
• Nick Cano - Relocation Bonus Attacking the Windows Loader
• Nevermoe - One Step Ahead of Cheaters Instrumenting Android Emulators
• Morgan Indrora Gangwere - (Ab)using Binaries from Embedded Devices for Fun and Profit
• Alexandre Borges - Ring 0 Ring 2 Rootkits Bypassing Defenses
• Berta and De Los Santos - Rock appround the Clock Tracking Malware Developers
• David Melendez Cano - Avoiding CounterDrone Systems with NanoDrones
• Eric Sesterhenn - In Soviet Russia Smartcard Hacks You
• Bai and Zheng - Analyzing and Attacking Apple Kernel Drivers

Presentaciones DerbyCon 8.0



*DerbyCon 8.0*

Desde la página de IronGeek podéis ver los vídeos de todas (casi) las presentaciones de DerbyCon 8.0 . Aquí tenéis la lista de los mismos:

• Opening
• How to influence security technology in kiwi underpants Benjamin Delpy
• Panel Discussion - At a Glance: Information Security Ed Skoudis, John Strand, Lesley Carhart. Moderated by: Dave Kennedy
• Red Teaming gaps and musings Samuel Sayen
• A Process is No One: Hunting for Token Manipulation Jared Atkinson, Robby Winchester
• Fuzz your smartphone from 4G base station side Tso-Jen Liu
• Clippy for the Dark Web: Looks Like You’re Trying to Buy Some Dank Kush, Can I Help You With That? Emma Zaballos
• Synfuzz: Building a Grammar Based Re-targetable Test Generation Framework Joe Rozner
• Escoteric Hashcat Attacks Evilmog
• RFID Luggage Tags, IATA vs Real Life Daniel Lagos
• #LOL They Placed Their DMZ in the Cloud: Easy Pwnage or Disruptive Protection Carl Alexander
• Maintaining post-exploitation opsec in a world with EDR Michael Roberts, Martin Roberts
• Hey! I found a vulnerability - now what? Lisa Bradley, CRob
• Foxtrot C2: A Journey of Payload Delivery Dimitry Snezhkov
• Ridesharks Kaleb Brown
• IRS, HR, Microsoft and your Grandma: What they all have in common Christopher Hadnagy, Cat Murdock
• #LOLBins - Nothing to LOL about! Oddvar Moe
• Everything Else I Learned About Security I Learned From Hip-Hop Paul Asadoorian
• Hackers, Hugs, & Drugs: Mental Health in Infosec Amanda Berlin
• Android App Penetration Testing 101 Joff Thyer, Derek Banks
• Draw a Bigger Circle: InfoSec Evolves Cheryl Biswas
• I Can Be Apple, and So Can You Josh Pitts
• From Workstation to Domain Admin: Why Secure Administration Isn’t Secure and How to Fix It Sean Metcalf
• MS17-010? zerosum0x0
• The Unintended Risks of Trusting Active Directory Lee Christensen, Will Schroeder, Matt Nelson
• Lessons Learned by the WordPress Security Team Aaron D. Campbell
• IronPython… omfg Marcello Salvati
• Invoke-EmpireHound - Merging BloodHound & Empire for Enhanced Red Team Workflow Walter Legowski
• When Macs Come Under ATT&CK Richie Cyrus
• Abusing IoT Medical Devices For Your Precious Health Records Saurabh Harit, Nick Delewski
• Detecting WMI exploitation Michael Gough
• Gryffindor | Pure JavaScript, Covert Exploitation Matthew Toussain
• Instant Response: Making IR faster than you thought possible! Mick Douglas, Josh Johnson
• The History of the Future of Cyber-Education Winn Schwartau
• State of Win32k Security: Revisiting Insecure design Vishal Chauhan
• Offensive Browser Extension Development Michael Weber
• Protect Your Payloads: Modern Keying Techniques Leo Loobeek
• Jump Into IOT Hacking with the Damn Vulnerable Habit Helper Device Nancy Snoke, Phoenix Snoke
• Tales From the Bug Mine - Highlights from the Android VRP Brian Claire Young
• Decision Analysis Applications in Threat Analysis Frameworks Emily Shawgo
• Threat Intel On The Fly Tazz
• Make Me Your Dark Web Personal Shopper! Emma Zaballos
• Driving Away Social Anxiety Joey Maresca
• Off-grid coms and power Justin Herman
• CTFs: Leveling Up Through Competition Alex Flores
• Extending Burp to Find Struts and XXE Vulnerabilities Chris Elgee
• Introduction to x86 Assembly DazzleCatDuo
• Pacu: Attack and Post-Exploitation in AWS Spencer Gietzen
• An Inconvenient Truth: Evading the Ransomware Protection in Windows 10 Soya Aoyama
• Brutal Blogging - Go for the Jugular Kate Brew
• RID Hijacking: Maintaining Access on Windows Machines Sebastian Castro
• Your Training Data is Bad and You Should Feel Bad Ryan J. O’Grady
• So many pentesting tools from a $4 Arduino Kevin Bong, Michael Vieau
• Building an Empire with (Iron)Python Jim Shaver
• SAEDY: Subversion and Espionage Directed Against You Judy Towers
• OSX/Pirrit - Reverse engineering mac OSX malware and the legal department of the company who makes it Amit Serper, Niv Yona, Yuval Chuddy
• How to test Network Investigative Techniques(NITs) used by the FBI Dr. Matthew Miller
• Cloud Computing Therapy Session Cara Marie, Andy Cooper
• Silent Compromise: Social Engineering Fortune 500 Businesses Joe Gray
• Going on a Printer Safari - Hunting Zebra Printers James Edge
• Hardware Slashing, Smashing, and Reconstructing for Root access Deral Heiland
• App-o-Lockalypse now! Oddvar Moe
• Web App 101: Getting the lay of the land Mike Saunders
• Invoke-DOSfuscation: Techniques FOR %F IN (-style) DO (S-level CMD Obfuscation) Daniel Bohannon
• WE ARE THE ARTILLERY: Using Google Fu To Take Down The Grids Chris Sistrunk, Krypt3ia, SynAckPwn
• Just Let Yourself In David Boyd
• A “Crash” Course in Exploiting Buffer Overflows (Live Demos!) Parker Garrison
• Living in a Secure Container, Down by the River Jack Mannino
• VBA Stomping - Advanced Malware Techniques Carrie Roberts, Kirk Sayre, Harold Ogden
• Media hacks: an Infosec guide to dealing with journalists Sean Gallagher, Steve Ragan, Paul Wagenseil
• Deploying Deceptive Systems: Luring Attackers from the Shadows Kevin Gennuso
• The Money-Laundering Cannon: Real cash; Real Criminals; and Real Layoffs Arian Evans
• Perfect Storm: Taking the Helm of Kubernetes Ian Coldwater
• How to put on a Con for Fun and (Non) Profit Benny Karnes, John Moore, Rick Hayes, Matt Perry, Bill Gardner, Justin Rogosky, Mike Fry, Steve Truax
• Web app testing classroom in a box - the good, the bad and the ugly Lee Neely, Chelle Clements, James McMurry
• Metasploit Town Hall 0x4 Brent Cook, Aaron Soto, Adam Cammack, Cody Pierce
• Community Based Career Development or How to Get More than a T-Shirt When Participating as part of the Community Kathleen Smith, Magen Wu, Cindy Jones, Kathryn Seymour, Kirsten Renner
• Disaster Strikes: A Hacker’s Cook book Jose Quinones, Carlos Perez
• Ninja Looting Like a Pirate Infojanitor
• Hacking Mobile Applications with Frida David Coursey
• Victor or Victim? Strategies for Avoiding an InfoSec Cold War Jason Lang, Stuart McIntosh
• Ubiquitous Shells Jon Gorenflo
• 99 Reasons Your Perimeter Is Leaking - Evolution of C&C John Askew
• Ship Hacking: a Primer for Today’s Pirate Brian Satira, Brian Olson
• Code Execution with JDK Scripting Tools & Nashorn Javascript Engine Brett Hawkins
• PHONOPTICON - leveraging low-rent mobile ad services to achieve state-actor level mass surveillance on a shoestring budget Mark Milhouse
• Patching: Show me where it hurts Cheryl Biswas
• Advanced Deception Technology Through Behavioral Biometrics Curt Barnard, Dawud Gordon
• We are all on the spectrum: What my 10-year-old taught me about leading teams Carla A Raisler
• No Place Like Home: Real Estate OSINT and OPSec Fails John Bullinger
• The Layer2 Nightmare Chris Mallz
• Attacking Azure Environments with PowerShell Karl Fosaaen
• Blue Blood Injection: Transitioning Red to Purple Lsly Ayyy
• Mirai, Satori, OMG, and Owari - IoT Botnets Oh My Peter Arzamendi
• Comparing apples to Apple Adam Mathis
• How online dating made me better at threat modeling Isaiah Sarju
• Threat Hunting with a Raspberry Pi Jamie Murdock
• M&A Defense and Integration - All that Glitters is not Gold Sara Leal, Jason Morrow
• Social Engineering At Work - How to use positive influence to gain management buy-in for anything April Wright
• Ham Radio 4 Hackers Eric Watkins, Devin Noel
• Getting Control of Your Vendors Before They Take You Down Dan Browder
• Cyber Intelligence: There Are No Rules, and No Certainties Coleman Kane
• Getting Started in CCDC Russell Nielsen
• Changing Our Mindset From Technical To Psychological Defenses Andrew Kalat
• Red Mirror: Bringing Telemetry to Red Teaming Zach Grace
• Two-Factor, Too Furious: Evading (and Protecting) Evolving MFA Schemes Austin Baker, Doug Bienstock
• IoT: Not Even Your Bed Is Safe Darby Mullen
• Fingerprinting Encrypted Channels for Detection John Althouse
• On the Nose: Bypassing Huawei’s Fingerprint authentication by exploiting the TrustZone Nick Stephens
• Bypassing Port-Security In 2018: Defeating MacSEC and 802.1x-2010 Gabriel Ryan
• Goodbye Obfuscation, Hello Invisi-Shell: Hiding Your Powershell Script in Plain Sight Omer Yair
• Cloud Forensics: Putting The Bits Back Together Brandon Sherman
• Killsuit: The Equation Group’s Swiss Army knife for persistence, evasion, and data exfil Francisco Donoso
• The MS Office Magic Show Stan Hegt, Pieter Ceelen
• Living off the land: enterprise post-exploitation Adam Reiser
• Hillbilly Storytime: Pentest Fails Adam Compton
• Bug Hunting in RouterOS Jacob Baines
• Breaking Into Your Building: A Hackers Guide to Unauthorized Access Tim Roberts, Brent White
• The making of an iOS 11 jailbreak: Kiddie to kernel hacker in 14 sleepless nights. Bryce “soen” Bearchell
• Who Watches the Watcher? Detecting Hypervisor Introspection from Unprivileged Guests Tomasz Tuzel
• Pwning in the Sandbox: OSX Macro Exploitation & Beyond Adam Gold, Danny Chrastil
• IOCs Today, Intelligence-Led Security Tomorrow Katie Kusjanovic, Matthew Shelton
• Closing Ceremonies

Presentaciones Usenix 2018



*USENIX 2018*

La 27 edición de la conferencia sobre seguridad USENIX 2018 se acaba de celebrar en Baltimore, MD esta pasada semana. Lo que característica a esta conferencia es que es una conferencia sobre seguridad desde ámbito académico.

El número de presentaciones es bastante amplio y ya podemos acceder tanto a la investigación académica, así, como las diapositivas de la mayoría de dichas presentaciones:

• Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible? Keynote

Material DEF CON 26



*DEF CON 26*

Aquí tenéis el material disponible de la DEF CON 26 :

• Alexei Bulazel
  • Alexei-Bulazel-Reverse-Engineering-Windows-Defender-Demo-Videos
    • Alexei-Bulazel-demo-1-mpclient.mp4
    • Alexei-Bulazel-demo-2-outputdebugstringa.mp4
    • Alexei-Bulazel-demo-3-file-system.mp4
    • Alexei-Bulazel-demo-4-proclist.mp4
    • Alexei-Bulazel-demo-5-apicall.mp4
    • Alexei-Bulazel-demo-6-fuzz.mp4
  • Alexei-Bulazel-Reverse-Engineering-Windows-Defender.pdf
• Alfonso Garcia and Alejo Murillo
  • DEFCON-26-Alfonso-Garcia-and-Alejo-Murillo-Demo-Videos
    • playback_tls_1.mp4
    • playback_tls_2.mp4
    • playback_tls_3.mp4
  • Alfonso-Garcia-and-Alejo-Murillo-Playback-a-TLS-story-Updated.pdf
• Andrea Marcelli
  • Andrea-Marcelli-Demo-Video.mp4
  • Andrea-Marcelli-Looking-for-the-perfect-signature-automatic-YARA-rules.pdf
• Bai Zheng and Chai Wang
  • Bai-Zheng-Chai-Wang-You-May-Have-Paid-more-than-You-Imagine.pdf
• Christopher Domas
  • Christopher-Domas-GOD-MODE- UNLOCKED-hardware-backdoors-in-x86-CPUs.pdf
  • Christopher-Domas-The-Ring-0-Facade.pdf
• DEFCON-26-Damien-Cauquil-Updated
  • DEFCON-26-Damien-Cauquil-Extras
  • DEFCON-26-Damien-Cauquil-Secure-Your-BLE-Devices-Demo-Videos
    • demo-hush.mp4
    • demo-jamming-final.mp4
    • demo-sniff-active.mp4
    • demo-sniff-connreq.mp4
    • volvo-fail.gif
    • volvo-fail.mp4
  • Damien-Cauquil-Secure-Your-BLE-Devices-Updated.pdf
• Damien Cauquil
  • DEFCON-26-Damien-Cauquil-Extras
  • DEFCON-26-Damien-Cauquil-Secure-Your-BLE-Devices-Demo-Videos
    • demo-hush.mp4
    • demo-jamming-final.mp4
    • demo-sniff-active.mp4
    • demo-sniff-connreq.mp4
    • volvo-fail.gif
    • volvo-fail.mp4
  • Damien-Cauquil-Secure-Your-BLE-Devices.pdf
• Dan Crowley - Mauro Paredes - Jen Savage - Updated
  • Crowley-Paredes-Savage-Outsmarting-the-Smart-City-Demo-Video.mp4
  • Crowley-Paredes-Savage-Outsmarting-the-Smart-City-Updated.pdf
• Daniel Zolnikov
  • Daniel-Zolnikov-Politics-and-the-Surveillence-State.pdf
• David Melendez
  • David-Melendez-Project-Interceptor-Demo-Video.mp4
  • David-Melendez-Project-Interceptor-WP.pdf
  • David-Melendez-Project-Interceptor.pdf
• Dongsung Kim and Hyoung Kee Choi
  • Dongsung-Kim-and-Hyoung-Kee-Choi-Demo-Video.mp4
  • Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You.pdf
• Dongsung Kim and Hyoung Kee Choi - Updated
  • Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Demo-Video.mp4
  • Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf
• Douglas Mckee
  • DEFCON-26-Douglas-McKee-Demo-Videos
    • 30To180-2.mp4
    • 80To180-2.mp4
    • Emulation.mp4
    • FlatlineDemo2.mp4
  • Douglas-McKee-80-to-0-in-5-sec-falsifying-medical-pt-vitals.pdf
• Douglas Mckee - Updated
  • Douglas-McKee-80-to-0-in-5-sec-falsifying-medical-pt-vitals-updated.pdf
  • Douglas-McKee-80-to-0-in-5-sec-falsifying-medical-pt-vitals-updated.pptx
• Eric Sesterhenn
  • DEFCON-26-Eric-Sesterhenn-Demo-Videos
    • Eric-Sesterhenn-Soviet-Russia-Smartcard-Hacks-You-PoC1.mp4
    • Eric-Sesterhenn-Soviet-Russia-Smartcard-Hacks-You-PoC2.mp4
  • Eric-Sesterhenn-Soviet-Russia-Smartcard-Hacks-You.pdf
• Feng Xiao - Jianwei Huang - Peng Liu
  • Xiao-Huang-Liu-Hacking-the-Brain-Custom-Attack-SDN-Controller.pdf
  • Huang-Liu-Hacking-the-Brain-Custom-Attack-SDN-Controller-Demo-Video.mp4
• Gabriel Ryan
  • DEFCON-26-Gabriel-Ryan-Demo-Videos
    • Gabriel-Ryan-bait-n-switch.mp4
    • Gabriel-Ryan-bypass-mab.mp4
    • Gabriel-Ryan-classic-8021x-bypass-with-interaction (1920 x 1080).mp4
    • Gabriel-Ryan-classic-8021x-bypass-with-interaction.mp4
    • Gabriel-Ryan-eap-md5-forced-reauth-full.mp4
    • Gabriel-Ryan-rogue-gateway-final (1920 x 1080).mp4
    • Gabriel-Ryan-rogue-gateway-final.mp4
    • Gabriel-Ryan-ryan-gabriel-ryan-bait-n-switch (1920 x 1080).mp4
    • Gabriel-Ryanforged-eapol-start.mp4
  • Gabriel-Ryan-Owning-the-LAN-in-2018-WP.pdf
  • Gabriel-Ryan-Owning-the-LAN-in-2018.pdf
• Joe Rozner
  • Joe-Rozner-Demo-Video.mp4
  • Joe-Rozner-RE-Targetable-Grammer-Based-Test-Case-Generation-Synfuzz.pdf
• John Seymour and Azeem Aqil
  • DEFCON-26-John-Seymour-and-Azeem-Aqil-Demo-Videos
    • 07-01.mp4
    • 10-01-trimmed.mp4
    • 13-01.mp4
    • 16-01.wav
    • 16-02.wav
    • 16-03.wav
    • 21-01.wav
    • 21-02.wav
  • John-Seymour-and-Azeem-Aqil-Your-Voice-is-My-Passport.pdf
• Josep Rodriguez
  • Josep-Rodriguez-Breaking-Extreme-Networks-WingOS.pdf
  • Josep-Rodriguez-Breaking-Extreme-Networks-WingOS-Demo-Video.mp4
• L0pht Panel
  • L0pht-Testimony-20-years-later.pdf
• Leigh Anne Galloway and Tim Yunusov
  • DEFCON-26-Galloway-and-Yunusov-Demo-Videos
    • Galloway-and-Yunusov-RCE.mp4
    • Galloway-and-Yunusov-arbitrary-code.mp4
    • Galloway-and-Yunusov-modifying-amount.mp4
  • Galloway-and-Yunusov-For-the-love-of-money-Findingexploiting-vulns-in-mobile-pos-terminals.pdf
• Louis Dion Marcil
  • DEFCON-26-Louis-Dion-Marcil-Demo-Videos
    • demo1.mp4
    • demo2.mp4
  • Louis-Dion-Marcil-Edge-Side-Include-Injection.pdf
• Martin Vigo
  • DEFCON-26-Martin-Vigo-Demo-Videos
    • demo-bruteforcing-v1.mp4
    • demo-paypal-v1.mp4
    • demo-whatsapp-v1.mp4
  • Martin-Vigo-Compromising-Online-Cracking-Voicemail-Systems.pdf
• Michael West and Collin Campbell
  • Micheal-West-Colin-Campbell-barcOwned-Popping-shells-with-your-cereal box.pdf
  • Micheal-West-Colin-Campbell-barcOwned-Popping-shells-with-your-cereal box.pptx
• Mickey Shkatov and Jesse Micheal
  • DEFCON-26-Mickey-Shkatov-and-Jesse-Micheal-Demo-Videos
    • EvilMaid-BennyHill-Defcon-Video1.mp4
    • exploit-popcalc-text-Defcon-Video2.MP4
    • exploit-popcalc-win10-Defcon-Video3.MP4
    • exploit-shell-Defcon-Video4.MP4
    • exploit-smileyloop.MP4
  • Mickey-Shkatov-and-Jesse-Micheal-UEFI-Exploitation-For-The-Masses.pdf
• Morgan Gangwere
  • DEFCON-26-Morgan-Gangwere-Its-assembler-jim-Demo-Videos
    • demo-1-rootfs.mp4
    • demo-2-tapdrive.mp4
    • demo-3-containers.mp4
    • demo-4-afl.mp4
  • Morgan-Gangwere-Its-assembler-jim-Notes.pdf
  • Morgan-Gangwere-Its-assembler-jim.pdf
• Nafeez
  • Nafeez-Compression-Oracle-attacks-on-VPN-Networks-openvpn3-voracle.gif
  • Nafeez-Compression-Oracle-attacks-on-VPN-Networks.pdf
• Nick Cano
  • DEFCON-26-Nick-Cano-Demo-Videos
    • demo-1-tools.mp4
    • demo-2-launch.mp4
    • demo-3-scan.mp4
    • demo-4-win10.mp4
  • Nick-Cano-Relocation-Bonus-Attacking-the-Win-Loader.pdf
• Patrick Wardle
  • Patrick-Wardle-Fire-and-Ice.pdf
  • Patrick-Wardle-The-Mouse-Is-Mightier-Synthetic0Reality.pdf
• Ruo Ando
  • Ruo-Ando-Asura-Demo-Video.MP4
  • Ruo-Ando-Asura-PCAP-File-Analyzer-for-Anomaly-Packet-Detection-Multithreading-WP.pdf
  • Ruo-Ando-Asura-PCAP-File-Analyzer-for-Anomaly-Packet-Detection-Multithreading.pdf
• Ryan Johnson and Angelos Stavrou
  • DEFCON-26-Johnson-and-Stavrou-Demo-Videos
    • commexec.mp4
    • maliciousApp.mp4
    • zte-zmax-champ-brick.mp4
  • Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP.pdf
  • Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices.pdf
• Ryan Johnson and Angelos Stavrou - Updated
  • DEFCON-26-Johnson-and-Stavrou-Demo-Videos-Updated
    • commExec.mp4
    • factory_reset.mp4
    • lock_user_out.mp4
    • maliciousApp.mp4
    • modem_and_logcat_logs_zte.mp4
    • take_screenshot.mp4
    • zte_zmax_champ_brick.mp4
  • Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-Updated.pdf
  • Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf
• Sanat Sharma
  • Sanat-Sharma-House-of-Roman-Demo-Video.mp4
  • Sanat-Sharma-House-of-Roman.pdf
• Sheila A Berta and Sergio De Los Santos
  • DEFCON-26-Sheila-A-Berta-and-Sergio-De-Los-Santos-Demo-Video
    • freetool.mp4
    • gmtruntime.mp4
  • Sheila-A-Berta-and-Sergio-De-Los-Santos-Tracking-Android-Malware-Developers.pdf
• Siegfried Rasthofer and Stephan Huber
  • Siegfried-Rasthofer-and-Stephan-Huber-Demo-Video
    • demovideo.mp4
    • greenalp-cast.mp4
  • Siegfried-Rasthofer-and-Stephan-Huber-All-Your-Family-Secrets-Belong-to-Us.pdf
• Siegfried Rasthofer and Stephan Huber - Updated
  • Siegfried-Rasthofer-and-Stephan-Huber-Demo-Video-Updated
    • demovideo_Version2.mp4
    • greenalpdemo_Version2.mp4
  • Siegfried-Rasthofer-and-Stephan-Huber-All-Your-Family-Secrets-Belong-to-Us-Updated.pdf
• Silke Holtmanns and Isha Singh
  • Holtmanns-Singh-4G-Who-is-Paying-your-cell-phone-bill.pdf
• Slava Makkaveev
  • DEFCON-26-Slava-Makkaveev-Demo-Videos
    • Slava-Makkaveev-MITD-Demo1-GoogleTranslate.mp4
    • Slava-Makkaveev-MITD-Demo2-LGAppManager.mp4
    • Slava-Makkaveev-MITD-Demo3-XiaomiBrowser.mp4
  • Slava-Makkaveev-Man-In-The-Disk.pdf
• Stark Riedesel and Parsia Hakimian
  • DEFCON-26-Stark-Riedesel-and-Parsia-Hakimian-Demo-Videos
    • 1-tineola-enum-demo.mp4
    • 2-tineola-invoke-TXes.mp4
    • 2-tineola-invoke-demo.mp4
    • 3-tineola-fuzzing-demo.mp4
    • 4-tineolacc-install.mp4
    • 5-tineola-nmap-scan.mp4
    • 6-tineola-direct-db-TXes.mp4
    • 6-tineola-direct-db-demo.mp4
  • Stark-Riedesel-and-Parsia-Hakimian-Tineola-Taking-Bite-Out-of-Enterprise-Blockchain.pdf
• Thanh Bui and Siddharth Rao
  • DEFCON-26-Thanh-Bui-and-Siddharth-Rao-Demo-Videos
    • 1password-demo.mp4
    • fido-demo.mp4
  • Thanh-Bui-and-Siddharth-Rao-Last-Mile-Auth-Problem-Exploiting-End-to-End.pdf
• The Tarquin
  • DEFCON-26-The-Tarquin-Demo-Videos
    • homograph-ocr.mp4
    • homographbomb.mp4
    • java-homograph.mp4
  • The-Tarquin-Weaponizing-Unicode-Homographs-Beyond-IDNs.pdf
• Thiago Alves
  • DEFCON-26-Thiago-Alves-Demo-Videos
    • first-attack.mp4
    • second-attack.mp4
    • third-attack.mp4
  • Thiago-Alves-Hacking-PLCs-and-Causing-Havoc-on-Critical-Infrastructures.pdf
• Torani - Buchwald - Nirenberg
  • Torani-Buchwald-Nirenberg-Reverse-Engineering-Hacker-Docu-Series-Sample-Scene.mp4
  • Torani-Buchwald-Nirenberg-Reverse-Engineering-Hacker-Docu-Series.pdf
• Truman Kain
  • Truman-Kain-Demo-Video.mp4
  • Truman-Kain-Dragnet-Social-Engineering-Sidekick.pdf
• Truman Kain - Updated
  • Truman-Kain-Demo-Video-Updated.mp4
  • Truman-Kain-Dragnet-Social-Engineering-Sidekick-Updated.pdf
• Vincent Tan
  • DEFCON-26-Vincent-Tan-Demo-Videos
    • Vincent-Tan-Hacking-BLE-Bicycle-Locks-Demo-Video-1.mp4
    • Vincent-Tan-Hacking-BLE-Bicycle-Locks-Demo-Video-2.mp4
  • Vincent-Tan-Hacking-BLE-Bicycle-Locks.pdf
• Wesley McGrew
  • Wesley-McGrew-An-Attacker-Looks-at-Docker-Demo-Video.mp4
  • Wesley-McGrew-An-Attacker-Looks-at-Docker-WP.pdf
  • Wesley-McGrew-An-Attacker-Looks-at-Docker.pdf
• William Martin
  • William-Martin-SMBetray-Backdooring-and-Breaking-Signiatures.pdf
  • William-Martin-SMBetray-Demo-Video.mp4
• Wu HuiYu and Qian Wenxiang
  • DEFCON-26-Wu-HuiYu-and-Qian-Wenxiang-Demo-Videos
    • MI-AI-SPEAKER-MIIO.mp4
    • MI-AI-SPEAKER-RCE.mp4
    • amazon-echo-2soldering.mp4
    • amazon-echo-desoldering.mp4
    • amazon-echo-exploit.mp4
    • breaking-smart-speaker-video-1.mp4
    • breaking-smart-speaker-video-2.mp4
    • breaking-smart-speaker-video-3.mp4
    • breaking-smart-speaker-video-4.mp4
  • Wu-HuiYu-and-Qian-Wenxiang-Breaking-Smart-Speakers.pdf
• Xiaolong Bai and Min Zheng
  • DEFCON-26-Xiaolong-Bai-and-Min-Zheng-Demo-Video
    • DemoOnPage13.mp4
    • DemoOnPage78.mp4
  • Xiaolong-Bai-and-Min-Zheng-One-Bite-And-All-Your-Dreams-Will-Come-True.pdf
• Zach Miller and Alex Kissinger
  • DEFCON-26-Zach-Miller-and-Alex-Kissinger-Demo-Videos
    • demo-1-command-file-exploit.mp4
    • demo-2-telnet-exploit.mp4
    • demo-3-mlwar.mp4
  • Zach-Miller-and-Alex-Kissinger-Infecting-Embedded-Supply-Chain.pdf
• Zach Miller and Alex Kissinger - Updated
  • Zach Miller and Alex Kissinger - Extras
    • demo3_mlwar_v2.ogv
    • demo4_brute_force_and_dump_fw.mp4
  • Zach-Miller-and-Alex-Kissinger-Infecting-Embedded-Supply-Chain-Updated.pdf
• nevermoe
  • nevermoe-One-Step-Before-Game-Hackers-Andriod-Emulators-cheat-Demo-Video.mp4
  • nevermoe-One-Step-Before-Game-Hackers-Andriod-Emulators.pdf
• sghctoma
  • DEFCON-26-sghctoma-Demo-Videos
    • maple/
    • mathematica/
    • matlab/
  • sghctoma-all-your-math-are-belong-to-us.pdf
• singe
  • singe-Practical-and-Improved-Wifi-MitM-with-Mana-eap-relay-v1.mp4
  • singe-Practical-and-Improved-Wifi-MitM-with-Mana.pdf
• smea
  • DEFCON-26-smea-Jailbreaking-the-3DS-Demo-Videos
    • fuzz.mp4
    • hbmenu.mp4
    • mcopy.mp4
    • ninjhax.mp4
    • tubehax.mp4
  • smea-Jailbreaking-the-3DS.pdf
• Alex-Levinson-Overview-of-Genesis-Scripting-Engine.pdf
• Alexandre-Borges-Ring-02-Rootkits-bypassing-defenses-Updated.pdf
• Alexandre-Borges-Ring-02-Rootkits-bypassing-defenses.pdf
• Alfonso-Garcia-and-Alejo-Murillo-Playback-a-TLS-story.pdf
• Crowley-Paredes-Savage-Outsmarting-the-Smart-City.pdf
• Eckert-Sumner-Krause-Inside-the-Fake-Science-Factory.pdf
• Eduardo-Izycki-And-Rodrigo-Colli-Digital-Leviathan-Nation-State-Big-Brothers.pdf
• Egypt-One-Liners-to-Rule-Them-All.pdf
• Fireside-Panel-D0-N0-H4RM.pdf
• Fireside-Panel-Goerzen-and-Matthews-Beyond-The-Lulz-Updated.pdf
• Fireside-Panel-Goerzen-and-Matthews-Beyond-The-Lulz.pdf
• Foster-and-Ayrey-Lost-and-Found-Certs-residual-certs-for-pre-owned-domains.pdf
• Galloway-and-Yunusov-For-the-love-of-Money-Finding-And-Exploiting-Vulns-In-Mobile-POS-Updated.pdf
• Ian-Haken-Automated-Discovery-of-Deserialization-Gadget-Chains.pdf
• Jianjun-Dai-Guang-Gong-Wenlin-Yang-Pwning-The-Toughest-Target-Updated.pdf
• Jianjun-Dai-Guang-Gong-Wenlin-Yang-Pwning-The-Toughest-Target.pdf
• Joe-Grand-Searching-for-the-Light-Adventures-w-Opticspy.pdf
• Josep-Rodriguez-Breaking-Extreme-Networks-WingOS-Updated.pdf
• Lawshae-Who-Controls-the-Controllers-Hacking-Crestron.pdf
• Maggie-Mayhem-Sex-Work-After-SESTA.pdf
• Maksim-Shudrak-Fuzzing-Malware-For-Fun-and-Profit.pdf
• Matt-King-Micro-Renovator-Bringing-Proc-Firmware-Up-To-Code.pdf
• Matt-Knight-and-Ryan-Speers-RF-Fuzzing-Tools-to-Expose-PHY-Layer-Vulns.pdf
• Matt-Wixey-Betrayed-by-the-Keyboard-Updated.pdf
• Matt-Wixey-Betrayed-by-the-Keyboard.pdf
• Matthews-Adams-Greco-Youre-Just-Complaining-Because-Youre-Guilty.pdf
• Michael-Ossmann-and-Dominic-Spill-Revolting-Radios.pdf
• Min-Zheng-Xiaolong-Bai-Fasten-your-Seatbelts-Escaping-iOS-11-Sandbox.pdf
• Nils-Amiet-and-Yonal-Romailler-Reaping-and-breaking-keys-at-scale-when-crypto-meets-big-data.pdf
• Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-and-Pop-0days-Out.pdf
• Panel-DCGroups.pdf
• Paternotte-and-van-Ommeren-It-WISNt-Me-Attacking-Industrial-Wireless-Mesh.pdf
• Rachel-Greenstadt-and-Aylin-Caliskan-De-anonymizing-Programmers.pdf
• Richard-Thieme-The-Road-to-Resilience .pdf
• Rob-Joyce-Absurd-Xmas-Lights.pdf
• Rousseau-and-Seymour-Finding-Xori-Malware-Analysis-Triage-w-Auto-Disassembly.pdf
• Seamus-Burke-Journey-Into-Hexagon.pdf
• Sean-Metcalf-Exploiting-Administrator-Insecurities.pdf
• Shortxstack-and-Seth-Law-Building-the-Hacker-tracker.pdf
• Si-and-AgentX-Wagging-The-Tail.pdf
• Steven-Danneman-Your-Banks-Digital-Side-Door.pdf
• Yaniv-Balmas-What-The-FAX.pdf
• YawnBox-Emerald-Onion-Privacy-Infrastructure-Challenges-and-Opportunites.pdf
• Yu-Wang-Attacking-The-MacOS-Kernel-Graphics-Driver.pdf
• Yuwei-Zheng-Shaokun-Cao-Bypass-the-SecureBoot-and-etc-on-NXP-SOCs-Updated.pdf
• Yuwei-Zheng-Shaokun-Cao-Bypass-the-SecureBoot-and-etc-on-NXP-SOCs.pdf
• zerosum0x0-Eternal-Exploits.pdf

También también podéis descargar todo este contenido desde este enlace o por torrent a través de este otro enlace .

Presentaciones Black Hat USA 2018



*Black Hat USA 2018*

Aquí tenéis la list de las presentaciones de Black Hat USA de este año, con enlace a las diapositivas y documentos que se han hecho públicos:

• Optimistic Dissatisfaction with the Status Quo: Steps We Must Take to Improve Security in Complex Landscapes
• Finding Xori: Malware Analysis Triage with Automated Disassembly
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Rousseau-Finding-Xori-Malware-Analysis-Triage-With-Automated-Disassembly.pdf )
• Exposing the Bait: A Qualitative Look at the Impact of Autonomous Peer Communication to Enhance Organizational Phishing Detection
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Malmquist-Exposing-The-Bait-A-Qualitative-Look-At-The-Impact-Of-Autonomous-Peer-Communication-To-Enhance-Organizational-Phishing-Detection.pdf )
• Software Attacks on Hardware Wallets
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Volokitin-Software-Attacks-On-Hardware-Wallets.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Volokitin-Software-Attacks-On-Hardware-Wallets-wp.pdf )
• Dissecting Non-Malicious Artifacts: One IP at a Time
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Goland-Dissecting-Non-Malicious-Artifacts-One-IP-At-A-Time.pdf )
• Detecting Credential Compromise in AWS
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Bengtson-Detecting-Credential-Compromise-In-AWS.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Bengtson-Detecting-Credential-Compromise-In-AWS-wp.pdf )
• How I Learned to Stop Worrying and Love the SBOM
• Edge Side Include Injection: Abusing Caching Servers into SSRF and Transparent Session Hijacking
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Dion_Marcil-Edge-Side-Include-Injection-Abusing-Caching-Servers-into-SSRF-and-Transparent-Session-Hijacking.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Dion_Marcil-Edge-Side-Include-Injection-Abusing-Caching-Servers-into-SSRF-and-Transparent-Session-Hijacking-wp.pdf )
• Measuring the Speed of the Red Queen’s Race; Adaption and Evasion in Malware
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Harang-Measuring-the-Speed-of-the-Red-Queens-Race.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Harang-Measuring-the-Speed-of-the-Red-Queens-Race-wp.pdf )
• Holding on for Tonight: Addiction in InfoSec
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Tomasello-Holding-On-For-Tonight-Addiction-In-Infosec.pdf )
• TRITON: How it Disrupted Safety Systems and Changed the Threat Landscape of Industrial Control Systems, Forever
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Carcano-TRITON-How-It-Disrupted-Safety-Systems-And-Changed-The-Threat-Landscape-Of-Industrial-Control-Systems-Forever.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Carcano-TRITON-How-It-Disrupted-Safety-Systems-And-Changed-The-Threat-Landscape-Of-Industrial-Control-Systems-Forever-wp.pdf )
• Stress and Hacking: Understanding Cognitive Stress in Tactical Cyber Ops
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Paul-Stress-and-Hacking.pdf )
• From Bot to Robot: How Abilities and Law Change with Physicality
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Postnikoff-From-Bot-To-Robot-How-Abilities-And-Law-Change-With-Physicality.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Postnikoff-From-Bot-To-Robot-How-Abilities-And-Law-Change-With-Physicality-wp.pdf )
• Miasm: Reverse Engineering Framework
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-DesclauxMougey-Miasm-Reverse-Engineering-Framework.pdf )
• New Trends in Browser Exploitation: Attacking Client-Side JIT Compilers
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Gro ß-New-Trends-In-Browser-Exploitation-Attacking-Client-Side-JIT-Compilers.pdf)
• Deep Neural Networks for Hackers: Methods, Applications, and Open Source Tools
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-saxe-Deep-Learning-For-Hackers-Methods-Applications-and-Open-Source-Tools.pdf )
• KeenLab iOS Jailbreak Internals: Userland Read-Only Memory can be Dangerous
• Blockchain Autopsies - Analyzing Ethereum Smart Contract Deaths
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Little-Blockchain-Autopsies-Analyzing-Ethereum-Smart-Contract-Deaths.pdf )
• A Dive in to Hyper-V Architecture & Vulnerabilities
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Joly-Bialek-A-Dive-in-to-Hyper-V-Architecture-&-Vulnerabilities.pdf )
• No Royal Road … Notes on Dangerous Game
• There will be Glitches: Extracting and Analyzing Automotive Firmware Efficiently
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Milburn-There-Will-Be-Glitches-Extracting-And-Analyzing-Automotive-Firmware-Efficiently.pdf )
• Compression Oracle Attacks on VPN Networks
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Nafeez-Compression-Oracle-Attacks-On-Vpn-Networks.pdf )
• CANCELLED: Too Soft[ware Defined] Networks: SD-WAN VulnerabilityAssessment
• Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Camurati-Screaming-Channels-When-Electromagnetic-Side-Channels-Meet-Radio-Tranceivers.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Camurati-Screaming-Channels-When-Electromagnetic-Side-Channels-Meet-Radio-Tranceivers-wp.pdf )
• Remotely Attacking System Firmware
• Reversing a Japanese Wireless SD Card - From Zero to Code Execution
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Valadon-Reversing-a-Japanese-Wireless-SD-Card-From-Zero-to-Code-Execution.pdf )
• Deep Dive into an ICS Firewall, Looking for the Fire Hole
• Legal Landmines: How Law and Policy are Rapidly Shaping Information Security
• Every ROSE has its Thorn: The Dark Art of Remote Online Social Engineering
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Wixey-Every-ROSE-Has-Its-Thorn-The-Dark-Art-Of-Remote-Online-Social-Engineering.pdf )
• From Workstation to Domain Admin: Why Secure Administration isn’t Secure and How to Fix it
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Metcalf-From-Workstation-To-Domain-Admin-Why-Secure-Administration-Isnt-Secure.pdf )
• An Attacker Looks at Docker: Approaching Multi-Container Applications
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-McGrew-An-Attacker-Looks-At-Docker-Approaching-Multi-Container-Applications.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-McGrew-An-Attacker-Looks-At-Docker-Approaching-Multi-Container-Applications-wp.pdf )
• The Unbearable Lightness of BMC’s
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Waisman-Soler-The-Unbearable-Lightness-of-BMC.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Waisman-Soler-The-Unbearable-Lightness-of-BMC-wp.pdf )
• Mental Health Hacks: Fighting Burnout, Depression and Suicide in the Hacker Community
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Dameff-Mental-Health-Hacks-Fighting-Burnout-Depression-And-Suicide-In-The-Hacker-Community.pdf )
• WireGuard: Next Generation Secure Network Tunnel
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Donenfeld-WireGuard-Next-Generation-Secure-Network-Tunnel.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Donenfeld-WireGuard-Next-Generation-Secure-Nework-Tunnel-wp.pdf )
• Threat Modeling in 2018: Attacks, Impacts and Other Updates
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Shostack-Threat-Modeling-in-2018.pdf )
• Subverting Sysmon: Application of a Formalized Security Product Evasion Methodology
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Graeber-Subverting-Sysmon-Application-Of-A-Formalized-Security-Product-Evasion-Methodology.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Graeber-Subverting-Sysmon-Application-Of-A-Formalized-Security-Product-Evasion-Methodology-wp.pdf )
• Don’t @ Me: Hunting Twitter Bots at Scale
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Anise-Wright-Don'[email protected] )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Anise-Wright-Don'[email protected] )
• A Brief History of Mitigation: The Path to EL1 in iOS 11
  • [] ()
• ZEROing Trust: Do Zero Trust Approaches Deliver Real Security?
• Behind the Speculative Curtain: The True Story of Fighting Meltdown and Spectre
• Breaking Parser Logic: Take Your Path Normalization off and Pop 0days Out!
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf )
• LTE Network Automation Under Threat
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Shaik-LTE-Network-Automation-Under-Threat.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Shaik-LTE-Network-Automation-Under-Threat-wp.pdf )
• Why so Spurious? How a Highly Error-Prone x86/x64 CPU “Feature” can be Abused to Achieve Local Privilege Escalation on Many Operating Systems
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Mulasmajic-Peterson-Why-So-Spurious.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Mulasmajic-Peterson-Why-So-Spurious-wp.pdf )
• Open Sesame: Picking Locks with Cortana
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Beery-Open-Sesame-Picking-Locks-with-Cortana.pdf )
• Breaking the IIoT: Hacking industrial Control Gateways
• Squeezing a Key through a Carry Bit
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Valsorda-Squeezing-A-Key-Through-A-Carry-Bit.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Valsorda-Squeezing-A-Key-Through-A-Carry-Bit-wp.pdf )
• I, for One, Welcome Our New Power Analysis Overlords
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-O'Flynn-I-For-One-Welcome-Our-New-Power-Analysis-Overloards.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-O'Flynn-I-For-One-Welcome-Our-New-Power-Analysis-Overloards-wp.pdf )
• How can Communities Move Forward After Incidents of Sexual Harassment or Assault?
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Peterson-How-Can-Communities-Move-Forward-After-Incidents-Of-Sexual-Harassment-Or-Assault.pdf )
• AFL’s Blindspot and How to Resist AFL Fuzzing for Arbitrary ELF Binaries
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Li-AFLs-Blindspot-And-How-To-Resist-AFL-Fuzzing-For-Arbitrary-ELF-Binaries.pdf )
• Is the Mafia Taking Over Cybercrime?
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Lusthaus-Is-The-Mafia-Taking-Over-Cybercrime.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Lusthaus-Is-The-Mafia-Taking-Over-Cybercrime-wp.pdf )
• The Air-Gap Jumpers
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Guri-AirGap.pdf )
• Beating the Blockchain by Mapping Out Decentralized Namecoin and Emercoin Infrastructure
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Perlow-Beating-the-Blockchain-by-Mapping-Out_Decentralized_Namecoin-and-Emercoin-Infrastructure.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Perlow-Beating-the-Blockchain-by-Mapping-Out_Decentralized_Namecoin-and-Emercoin-Infrastructure-wp.pdf )
• InfoSec Philosophies for the Corrupt Economy
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Munro-Infosec-Philosophies-For-The-Corrupt-Economy.pdf )
• Back to the Future: A Radical Insecure Design of KVM on ARM
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-SINGH-BACK-TO-THE-FUTURE-A-RADICAL-INSECURE-DESIGN-OF-KVM-ON-ARM.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-SINGH-BACK-TO-THE-FUTURE-A-RADICAL-INSECURE-DESIGN-OF-KVM-ON-ARM-wp.pdf )
• A Tangled Curl: Attacks on the Curl-P Hash Function Leading to Signature Forgeries in the IOTA Signature Scheme
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Narula-Heilman-Cryptanalysis-of-Curl-P.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Wed-August-8/us-18-Narula-Heilman-Cryptanalysis-of-Curl-P-wp.pdf )
• ARTist - A Novel Instrumentation Framework for Reversing and Analyzing Android Apps and the Middleware
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Schranz-ARTist-A-Novel-Instrumentation-Framework-for-Reversing-and-Analyzing-Android-Apps-and-the-Middleware.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Schranz-ARTist-A-Novel-Instrumentation-Framework-for-Reversing-and-Analyzing-Android-Apps-and-the-Middleware-wp.pdf )
• Stop that Release, There’s a Vulnerability!
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Gadsby-Stop-That-Release,-There's-A-Vulnerability!.pdf )
• Two-Factor Authentication, Usable or Not? A Two-Phase Usability Study of the FIDO U2F Security Key
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Das-Two-Factor-Authentication-Usable-Or-Not.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Das-Two-Factor-Authentication-Usable-Or-Not-A-Two-Phase-Usability.pdf )
• Fire & Ice: Making and Breaking macOS Firewalls
• The Problems and Promise of WebAssembly
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Silvanovich-The-Problems-and-Promise-of-WebAssembly.pdf )
• Money-rity Report: Using Intelligence to Predict the Next Payment Card Fraud Victims
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Gollnick-Smyth-Money-Rity-Report-Using-Intelligence-To-Predict-The-Next-Payment-Card-Victims.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Gollnick-Smyth-Money-Rity-Report-Using-Intelligence-To-Predict-The-Next-Payment-Card-Victims-wp.pdf )
• Lessons from Virginia - A Comparative Forensic Analysis of WinVote Voting Machines
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Sch ürmann-Carsten-A-Comparative-Forensic-Analysis-of-WinVote-Voting-Machines.pdf)
• Demystifying PTSD in the Cybersecurity Environment
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Slowik-Demystifying-PTSD-In-The-Cybersecurity-Environment.pdf )
• Real Eyes, Realize, Real Lies: Beating Deception Technologies
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Hart-Real-Eyes-Realize-Real-Lies-Beating-Deception-Technologies.pdf )
• Kernel Mode Threats and Practical Defenses
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Desimone-Kernel-Mode-Threats-and-Practical-Defenses.pdf )
• Snooping on Cellular Gateways and Their Critical Role in ICS
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Shattuck-Snooping-on-Cellular-Gateways-and-Their-Critical-Role-in-ICS.pdf )
• Your Voice is My Passport
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Seymour-Aqil-Your-Voice-Is-My-Passport.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Seymour-Aqil-Your-Voice-Is-My-Passport-wp.pdf )
• Identity Theft: Attacks on SSO Systems
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Ludwig-Identity-Theft-Attacks-On-SSO-Systems.pdf )
• Black Box is Dead. Long Live Black Box!
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Stennikov-Blackbox-is-dead--Long-live-Blackbox!.pdf )
• Reconstruct the World from Vanished Shadow: Recovering Deleted VSS Snapshots
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Kobayashi-Reconstruct-The-World-From-Vanished-Shadow-Recovering-Deleted-VSS-Snapshots.pdf )
• The Science of Hiring and Retaining Female Cybersecurity Engineers
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Holtz-The-Science-Of-Hiring-And-Retaining-Female-Cybersecurity-Engineers.pdf )
• The Windows Notification Facility: Peeling the Onion of the Most Undocumented Kernel Attack Surface Yet
• New Norms and Policies in Cyber-Diplomacy
• Pestilential Protocol: How Unsecure HL7 Messages Threaten Patient Lives
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Dameff-Pestilential-Protocol-How-Unsecure-HL7-Messages_Threaten-Patient-Lives.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Dameff-Pestilential-Protocol-How-Unsecure-HL7-Messages-Threaten-Patient-Lives-wp.pdf )
• AI & ML in Cyber Security - Why Algorithms are Dangerous
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Marty-AI-and-ML-in-Cybersecurity.pdf )
• GOD MODE UNLOCKED - Hardware Backdoors in x86 CPUs
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Domas-God-Mode-Unlocked-Hardware-Backdoors-In-x86-CPUs.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Domas-God-Mode-Unlocked-Hardware-Backdoors-In-x86-CPUs-wp.pdf )
• Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform Capabilities
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Geesaman-Detecting-Malicious-Cloud-Account-Behavior-A-Look-At-The-New-Native-Platform-Capabilities.pdf )
• Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Mueller-Dresen-EFAIL-Breaking-SMIME-And-OpenPGP-Email-Encryption-Using-Exfiltration-Channels.pdf )
• Decompiler Internals: Microcode
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Guilfanov-Decompiler-Internals-Microcode.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Guilfanov-Decompiler-Internals-Microcode-wp.pdf )
• Stealth Mango and the Prevalence of Mobile Surveillanceware
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Blaich-Stealth-Mango-and-the-Prevalence-of-Mobile-Surveillanceware.pdf )
• A Deep Dive into macOS MDM (and How it can be Compromised)
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Endahl-A-Deep-Dive-Into-macOS-MDM-And-How-It-Can-Be-Compromised.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Endahl-A-Deep-Dive-Into-macOS-MDM-And-How-It-Can-Be-Compromised-wp.pdf )
• Are You Trading Stocks Securely? Exposing Security Flaws in Trading Technologies
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Hernandez-Are-You-Trading-Stocks-Securely-Exposing-Security-Flaws-in-Trading-Technologies.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Hernandez-Are-You-Trading-Stocks-Securely-Exposing-Security-Flaws-in-Trading-Technologies-wp.pdf )
• Playback: A TLS 1.3 Story
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-GarciaAlguacil-MurilloMoya-Playback-A-TLS-1.3-Story.pdf )
• Outsmarting the Smart City
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Crowley-Savage-Paredes-Outsmarting-The-Smart-City.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Crowley-Outsmarting-The-Smart-City-wp.pdf )
• Protecting the Protector, Hardening Machine Learning Defenses Against Adversarial Attacks
• So I became a Domain Controller
• None of My Pixel is Your Business: Active Watermarking Cancellation Against Video Streaming Service
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Hui-None-Of-My-Pixel-Is-Your-Business-Active-Watermarking-Cancellation-Against-Video-Streaming-Service.pdf )
• WebAssembly: A New World of Native Exploits on the Browser
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-WebAssembly-A-New-World-of-Native_Exploits-On-The-Web.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-WebAssembly-A-New-World-of-Native_Exploits-On-The-Web-wp.pdf )
• Applied Self-Driving Car Security
  • [] ()
• TLBleed: When Protecting Your CPU Caches is Not Enough
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Gras-TLBleed-When-Protecting-Your-CPU-Caches-is-Not-Enough.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Gras-TLBleed-When-Protecting-Your-CPU-Caches-is-Not-Enough-w.pdf )
• Wrangling with the Ghost: An Inside Story of Mitigating Speculative Execution Side Channel Vulnerabilities
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Fogh-Ertl-Wrangling-with-the-Ghost-An-Inside-Story-of-Mitigating-Speculative-Execution-Side-Channel-Vulnerabilities.pdf )
• Another Flip in the Row
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Gruss-Another-Flip-in-the-Row.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Gruss-Another-Flip-In-The-Row-wp.pdf )
• Windows Offender: Reverse Engineering Windows Defender’s Antivirus Emulator
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Bulazel-Windows-Offender-Reverse-Engineering-Windows-Defenders-Antivirus-Emulator.pdf )
• Legal Liability for IOT Cybersecurity Vulnerabilities
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Palansky-Legal-Liability-For-IoT-Vulnerabilities.pdf )
• How can Someone with Autism Specifically Enhance the Cyber Security Workforce?
• Exploitation of a Modern Smartphone Baseband
• Last Call for SATCOM Security
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Santamarta-Last-Call-For-Satcom-Security.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Santamarta-Last-Call-For-Satcom-Security-wp.pdf )
• Automated Discovery of Deserialization Gadget Chains
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Haken-Automated-Discovery-of-Deserialization-Gadget-Chains.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Haken-Automated-Discovery-of-Deserialization-Gadget-Chains-wp.pdf )
• Catch me, Yes we can! – Pwning Social Engineers using Natural Language Processing Techniques in Real-Time
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Harris-Catch-Me-Yes-We-Can –Pwning-Social-Engineers-Using-Natural-Language-Techniques-In-Real-Time.pdf)
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Harris-Catch-Me-Yes-We-Can –Pwning-Social-Engineers-Using-Natural-Language-Techniques-In-Real-Time-wp.pdf)
• From Thousands of Hours to a Couple of Minutes: Automating Exploit Generation for Arbitrary Types of Kernel Vulnerabilities
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Wu-Towards-Automating-Exploit-Generation-For-Arbitrary-Types-of-Kernel-Vulnerabilities.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Wu-Towards-Automating-Exploit-Generation-For-Arbitrary-Types-of-Kernel-Vulnerabilities-wp.pdf )
• SDL That Won’t Break the Bank
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Lipner-SDL-For-The-Rest-Of-Us.pdf )
• Lowering the Bar: Deep Learning for Side Channel Analysis
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-perin-ege-vanwoudenberg-Lowering-the-bar-Deep-learning-for-side-channel-analysis.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-perin-ege-vanwoudenberg-Lowering-the-bar-Deep-learning-for-side-channel-analysis-wp.pdf )
• Mainframe [z/OS] Reverse Engineering and Exploit Development
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Rikansrud-Mainframe-[zOS]-Reverse-Engineering-and-Exploit-Development.pdf )
• Hardening Hyper-V through Offensive Security Research
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Rabet-Hardening-Hyper-V-Through-Offensive-Security-Research.pdf )
• Practical Web Cache Poisoning: Redefining ‘Unexploitable’
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Kettle-Practical-Web-Cache-Poisoning-Redefining-Unexploitable.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Kettle-Practical-Web-Cache-Poisoning-Redefining-Unexploitable-wp.pdf )
• For the Love of Money: Finding and Exploiting Vulnerabilities in Mobile Point of Sales Systems
• SirenJack: Cracking a ‘Secure’ Emergency Warning Siren System
• Understanding and Exploiting Implanted Medical Devices
• IoT Malware: Comprehensive Survey, Analysis Framework and Case Studies
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Costin-Zaddach-IoT-Malware-Comprehensive-Survey-Analysis-Framework-and-Case-Studies.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Costin-Zaddach-IoT-Malware-Comprehensive-Survey-Analysis-Framework-and-Case-Studies-wp.pdf )
• The Finest Penetration Testing Framework for Software-Defined Networks
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Lee-The-Finest-Penetration-Testing-Framework-for-Software-Defined-Networks.pdf )
• It’s a PHP Unserialization Vulnerability Jim, but Not as We Know It
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-It's-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-It's-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It-wp.pdf )
• Unpacking the Packed Unpacker: Reverse Engineering an Android Anti-Analysis Native Library
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Stone-Unpacking-The-Packed-Unpacker.pdf )
• Return of Bleichenbacher’s Oracle Threat (ROBOT)
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Boeck-Young-Return-Of-Bleichenbachers-Oracle-Threat.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Boeck-Young-Return-Of-Bleichenbachers-Oracle-Threat-wp.pdf )
• Over-the-Air: How we Remotely Compromised the Gateway, BCM, and Autopilot ECUs of Tesla Cars
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Liu-Over-The-Air-How-We-Remotely-Compromised-The-Gateway-Bcm-And-Autopilot-Ecus-Of-Tesla-Cars.pdf )
  • [Download White Paper] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Liu-Over-The-Air-How-We-Remotely-Compromised-The-Gateway-Bcm-And-Autopilot-Ecus-Of-Tesla-Cars-wp.pdf )
• DeepLocker - Concealing Targeted Attacks with AI Locksmithing
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Kirat-DeepLocker-Concealing-Targeted-Attacks-with-AI-Locksmithing.pdf )
• Meltdown: Basics, Details, Consequences
• Follow the White Rabbit: Simplifying Fuzz Testing Using FuzzExMachina
  • [Download Presentation Slides] ( http://i.blackhat.com/us-18/Thu-August-9/us-18-Ulitzsch-Follow-The-White-Rabbit-Simplifying-Fuzz-Testing-Using-FuzzExMachina.pdf )
• Lessons and Lulz: The 4th Annual Black Hat USA NOC Report

Presentaciones De Black Hat Asia 2018



*Black Hat Asia 2018*

Ya están disponibles la mayoría de las presentaciones de Black Hat Asi 2018 celebrada el pasado 20-23 de marzo:

• A Short Course in Cyber Warfare
• National Cyber-Aggression and Private-Sector Internet Infrastructure
• A Deal with the Devil: Breaking Smart Contracts
  • Wong-Hemmel-A-Deal-with-the-Devil-Breaking-Smart-Contracts.pdf
• A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!
  • Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages_update_Thursday.pdf
• AES Wireless Keyboard – Template Attack for Eavesdropping
  • Kim-AES-Wireless-Keyboard-Template-Attack-for-Eavesdropping.pdf
• All Your Payment Tokens Are Mine: Vulnerabilities of Mobile Payment Systems
  • zhou-ALL%20YOUR%20PAYMENT%20TOKENS%20ARE%20MINE%20VULNERABILITIES%20OF%20MOBILE%20PAYMENT%20SYSTEMS.pdf
  • zhou-ALL%20YOUR%20PAYMENT%20TOKENS%20ARE%20MINE%20VULNERABILITIES%20OF%20MOBILE%20PAYMENT%20SYSTEMS-wp.pdf
• Analyzing & Breaking Exploit Mitigations and PRNGs on QNX for Automotive Industrial Medical and other Embedded Systems
  • Wetzels_Abassi_dissecting_qnx__PPT.pdf
  • Wetzels_Abassi_dissecting_qnx__WP.pdf
• Back To The Epilogue: How to Evade Windows’ Control Flow Guard with Less than 16 Bytes
  • Lain-Back-To-The-Epilogue-How-To-Evade-Windows-Control-Flow-Guard-With-Less-Than-16-Bytes.pdf
• Breach Detection At Scale With AWS Honey Tokens
  • bourke-grzelak-breach-detection-at-scale-with-aws-honey-tokens.pdf
  • bourke-grzelak-breach-detection-at-scale-with-aws-honey-tokens-wp.pdf
• Breaking State-of-the-Art Binary Code Obfuscation via Program Synthesis
  • Blazytko-Breaking-State-Of-The-Art-Binary-Code-Obfuscation-Via-Program-Synthesis.pdf
  • Blazytko-Breaking-State-Of-The-Art-Binary-Code-Obfuscation-Via-Program-Synthesis-wp.pdf
• Breaking the Attack Graph: How to Leverage Graphs to Strengthen Security in a Domain Environment
  • Simakov-Marina-Breaking-The-Attack-Graph.pdf
• Counter-Infiltration: Future-Proof Counter Attacks Against Exploit Kit Infrastructure
  • papa-Future-Proof%20Counter%20Attacks%20Against%20Exploit%20Kit%20Infrastructure.pdf
• Cyber Comrades: Alliance-Building in Cyberspace
  • Geers-Cyber%20Comrades%20Alliance%20Building%20in%20Cyberspace.pdf
• Death Profile
  • Zhu%20and%20Li-Death%20Profile.pdf
  • Zhu%20and%20Li-Death%20Profile-wp.pdf
• Documenting the Undocumented: The Rise and Fall of AMSI
  • Tal-Liberman-Documenting-the-Undocumented-The-Rise-and-Fall-of-AMSI.pdf
• eMMC & UFS: Security Vulnerabilities Rootkits
• Hourglass Model 2.0: Case Study of Southeast Asia Underground Services Abusing Global 2FA
  • [Asia-18-CHUNG-Hourglass 2.0.pdf]( https://www.blackhat.com/docs/asia-18/Asia-18-CHUNG-Hourglass 2.0.pdf)
• I Don’t Want to Sleep Tonight: Subverting Intel TXT with S3 Sleep
  • Seunghun-I_Dont_Want_to_Sleep_Tonight_Subverting_Intel_TXT_with_S3_Sleep.pdf
• International Problems: Serialized Fuzzing for ICU Vulnerabilities
  • Deng-International-Problems-Serialized-Fuzzing-for-ICU-Vulnerabilities.pdf
• Invoke-DOSfuscation: Techniques FOR %F IN (-style) DO (S-level CMD Obfuscation)
  • bohannon-invoke_dosfuscation_techniques_for_fin_style_dos_level_cmd_obfuscation.pdf
  • bohannon-invoke_dosfuscation_techniques_for_fin_style_dos_level_cmd_obfuscation-wp.pdf
• KSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features
  • WANG-KSMA-Breaking-Android-kernel-isolation-and-Rooting-with-ARM-MMU-features.pdf
• Locknote: Conclusions and Key Takeaways from Black Hat Asia 2018
• Mac-A-Mal: An Automated Platform for Mac Malware Hunting
  • Phuc-Mac-A-Mal-An%20Automated%20Framework%20for%20Mac%20Malware%20Hunting.pdf
  • Phuc-Mac-A-Mal-An%20Automated%20Framework%20for%20Mac%20Malware%20Hunting-wp.pdf
• Nation-State Moneymule’s Hunting Season – APT Attacks Targeting Financial Institutions
  • Shen-Nation-State%20Moneymule%20hunting%20season_Thursday%20.pdf
• New Compat Vulnerabilities in Linux Device Drivers
  • Ding-New-Compat-Vulnerabilities-In-Linux-Device-Drivers.pdf
• Prison Break Season 6: Defeating the Mitigations Adopted by Android OEMs
• return-to-csu: A New Method to Bypass 64-bit Linux ASLR
  • Marco-return-to-csu-a-new-method-to-bypass-the-64-bit-Linux-ASLR.pdf
  • Marco-return-to-csu-a-new-method-to-bypass-the-64-bit-Linux-ASLR-wp.pdf
• RustZone: Writing Trusted Applications in Rust
• Securing Your In-Ear-Fitness Coach: Challenges in Hardening Next Generation Wearables
• Server Tailgating - A Chosen-PlainText Attack on RDP
  • Karni-Zinar-Blachman-Server-Tailgating-A-Chosen-Plaintext-Attack-on-RDP.pdf
• Shadow-Box v2: The Practical and Omnipotent Sandbox for ARM
  • Seunghun-Shadow-Box_v2_The_Practical_and_Omnipotent_Sandbox_for_ARM.pdf
• Tales from the NOC: Going Public in Asia
• UbootKit: A Worm Attack for the Bootloader of IoT Devices
  • Yang-UbootKit-A-Worm-Attack-for-the-Bootloader-of-IoT-Devices.pdf
  • Yang-UbootKit-A-Worm-Attack-for-the-Bootloader-of-IoT-Devices-wp.pdf
• VSPMiner: Detecting Security Hazards in SEAndroid Vendor Customizations via Large-Scale Supervised Machine Learning
• When Good Turns Evil: Using Intel SGX to Stealthily Steal Bitcoins
  • Schwarz-When-Good-Turns-Evil-Using-Intel-SGX-To-Stealthily-Steal-Bitcoins.pdf
  • Schwarz-When-Good-Turns-Evil-Using-Intel-SGX-To-Stealthily-Steal-Bitcoins-wp.pdf
• XOM-switch: Hiding Your Code from Advanced Code Reuse Attacks In One Shot
  • Zhang-xom-switch-mingwei-v1.2.pptx

Vídeos Del Chaos Communication Congress 34



*Chaos Communication Congress 34*

Nada mejor que empezar el año con material de primera calidad. El Chaos Communication Congress, como de costumbre a celebrado su cita con el hacking mundial entre el 27 y el 30 de diciembre . Si tienes algo de tiempo libre hasta después de los reyes, aquí tienes dónde entretenerte.

• [Antipatterns und Missverständnisse in der Softwareentwicklung]( https://media.ccc.de/v/34c3-9095-antipatterns_und_missv erstandnisse_in_der_softwareentwicklung)
• Dude, you broke the Future!
• Eröffnung: tuwat
• Die Lauschprogramme der Geheimdienste
• Ladeinfrastruktur für Elektroautos: Ausbau statt Sicherheit
• Social Bots, Fake News und Filterblasen
• QualityLand
• Methodisch inkorrekt!
• The Ultimate Apollo Guidance Computer Talk
• Die fabelhafte Welt des Mobilebankings
• Internet of Fails
• Relativitätstheorie für blutige Anfänger
• Jahresrückblick des CCC 2017
• Security Nightmares 0x12
• Gamified Control?
• Demystifying Network Cards
• Everything you want to know about x86 microcode, but might have been afraid to ask
• Uncovering British spies’ web of sockpuppet social media personas
• Console Security - Switch
• Free Electron Lasers
• hacking disaster
• Beeinflussung durch Künstliche Intelligenz
• Der PC-Wahl-Hack
• All Computers Are Beschlagnahmt
• Inside Intel Management Engine
• Tiger, Drucker und ein Mahnmal
• Hacker Jeopardy
• How to drift with any car
• Doping your Fitbit
• Are all BSDs created equally?
• Ecstasy 10x yellow Twitter 120mg Mdma
• Pointing Fingers at ‘The Media’
• Trügerische Sicherheit
• DPRK Consumer Technology
• Taxation
• Spy vs. Spy: A Modern Study Of Microphone Bugs Operation And Detection
• Unleash your smart-home devices: Vacuum Cleaning Robot Hacking
• 34C3 Abschluss
• Digitale Bildung in der Schule
• Watching the changing Earth
• Coming Soon: Machine-Checked Mathematical Proofs in Everyday Software and Hardware…
• How risky is the software you use?
• cryptocurrencies, smart contracts, etc.: revolutionary tech?
• Der netzpolitische Wetterbericht
• Mietshäusersyndikat: den Immobilienmarkt hacken
• Deep Learning Blindspots
• Die Sprache der Überwacher
• WTFrance
• eMMC hacking, or: how I fixed long-dead Galaxy S3 phones
• LatticeHacks
• Science is broken
• 1-day exploit development for Cisco IOS
• KRACKing WPA2 by Forcing Nonce Reuse
• Intel ME: Myths and reality
• Schreibtisch-Hooligans
• Protecting Your Privacy at the Border
• Tightening the Net in Iran
• Bildung auf dem Weg ins Neuland
• Schnaps Hacking
• Nougatbytes 11₂
• Die göttliche Informatik / The divine Computer Science
• Home Distilling
• iOS kernel exploitation archaeology
• Decoding Contactless (Card) Payments
• Reverse engineering FPGAs
• The Work of Art in the Age of Digital Assassination
• SCADA - Gateway to (s)hell
• Resilienced Kryptographie
• Financial surveillance
• Growing Up Software Development
• How can you trust formally verified software?
• Opening Closed Systems with GlitchKit
• The Snowden Refugees under Surveillance in Hong Kong
• Ein Festival der Demokratie
• Lets break modern binary code obfuscation
• Access To Bodies
• Holography of Wi-Fi radiation
• Designing PCBs with code
• Social Cooling - big data’s unintended side effect
• Forensic Architecture
• Mobile Data Interception from the Interconnection Link
• BGP and the Rule of Custom
• How Alice and Bob meet if they don’t like onions
• Low Cost Non-Invasive Biomedical Imaging
• 0en & 1en auf dem Acker
• BBSs and early Internet access in the 1990ies
• The making of a chip
• Bringing Linux back to server boot ROMs with NERF and Heads
• Es sind die kleinen Dinge im Leben II
• May contain DTraces of FreeBSD
• End-to-end formal ISA verification of RISC-V processors with riscv-formal
• Electromagnetic Threats for Information Security
• BootStomp: On the Security of Bootloaders in Mobile Devices
• Netzpolitik in der Schweiz
• UPSat - the first open source satellite
• Squeezing a key through a carry bit
• Fuck Dutch mass-surveillance: let’s have a referendum!
• Internet censorship in the Catalan referendum
• Robot Music
• Running GSM mobile phone on SDR
• Treibhausgasemissionen einschätzen
• Lobby-Schlacht um die ePrivacy-Verordnung
• Catch me if you can: Internet Activism in Saudi Arabia
• Defeating (Not)Petya’s Cryptography
• Lightning Talks Day 2
• Why Do We Anthropomorphize Computers?…
• A hacker’s guide to Climate Change - What do we know and how do we know it?
• Blinkenrocket!
• Drones of Power: Airborne Wind Energy
• Inside Android’s SafetyNet Attestation: Attack and Defense
• The Noise Protocol Framework
• Briar
• Vintage Computing for Trusted Radiation Measurements and a World Free of Nuclear Weapons
• Saving the World with Space Solar Power
• We should share our secrets
• WHWP
• Privacy Shield - Lipstick on a Pig?
• Humans as software extensions
• Net Neutraliy Enforcement in the EU
• MQA - A clever stealth DRM-Trojan
• The Internet in Cuba: A Story of Community Resilience
• avatar²
• ASLR on the line
• Implementing an LLVM based Dynamic Binary Instrumentation framework
• Policing in the age of data exploitation
• Lightning Talks Day 3
• Practical Mix Network Design
• Regulating Autonomous Weapons
• Open Source Estrogen
• History and implications of DRM
• Lightning Talks Day 4
• Taking a scalpel to QNX
• The seizure of the Iuventa
• SatNOGS: Crowd-sourced satellite operations
• Afro TECH
• Extended DNA Analysis
• Uncovering vulnerabilities in Hoermann BiSecur
• Making Experts Makers and Makers Experts
• Microarchitectural Attacks on Trusted Execution Environments
• Deconstructing a Socialist Lawnmower
• Italy’s surveillance toolbox
• openPower - the current state of commercial openness in CPU development
• Hardening Open Source Development
• This is NOT a proposal about mass surveillance!
• library operating systems
• Think big or care for yourself
• Algorithmic science evaluation and power structure: the discourse on strategic citation…
• Type confusion: discovery, abuse, and protection
• “Nabovarme” opensource heating infrastructure in Christiania
• Visceral Systems
• TrustZone is not enough
• Electroedibles
• Modern key distribution with ClaimChain
• Simulating the future of the global agro-food system
• Zamir Transnational Network und Zagreb Dairy
• Public FPGA based DMA Attacking
• OONI: Let’s Fight Internet Censorship, Together!
• Tracking Transience
• Organisational Structures for Sustainable Free Software Development
• 34C3 Infrastructure Review
• Ensuring Climate Data Remains Public
• Uncertain Concern
• institutions for Resolution Disputes
• Don’t stop ’til you feel it
• International Image Interoperability Framework (IIIF) – Kulturinstitutionen schaffen…
• Closing the loop: Reconnecting social-technologial dynamics to Earth System science
• On the Prospects and Challenges of Weather and Climate Modeling at Convection-Resolving…

Vídeos DEF CON 25



*DEF CON 25*

Aunque no son todos los vídeos de la DEF CON 25 , ya hay bastantes disponibles. Aquí tenéis una lista organizada en varias secciones:

Main Track 1

• Cheng - The spear to break the security wall of S7CommPlus
• Christopher Domas - Breaking the x86 Instruction Set
• Damien Cauquil - Weaponizing the BBC Micro Bit
• Dennis Maldonado - Real time RFID Cloning in the Field
• Daniel Bohannon, Lee Holmes - Revoke Obfuscation: PowerShell Obfuscation
• Duncan Woodbury, Nicholas Haltmeyer - Linux Stack Based V2X Framework
• Dor Azouri - BITSInject
• Dimitry Snezhkov - Abusing Webhooks for Command and Control
• Gerald Steere, Sean Metcalf - Hacking the Cloud
• Gabriel Ryan - The Black Art of Wireless Post Exploitation
• Hanno Bõck - Abusing Certificate Transparency Logs
• Gil Cohen - Call the plumber: You have a leak in your named pipe
• Hyrum Anderson - Evading next gen AV using AI
• Itzik Kotler, Amit Klein - The Adventures of AV and the Leaky Sandbox
• Ilja van Sprundel - Are all BSDs are created equally? A survey of BSD kerne
• Jeff Moss and Panel - DEF CON Groups Panel
• Jason Haddix - Introducing HUNT Data Driven Web Hacking & Manual Testing
• Joe Rozner - Wiping out CSRF
• JoSh Pitts - Teaching Old Shellcode New Tricks
• K2 - UnFucking Forensics: Active Passive memory hacking debugging
• Luke Young - There’s no place like 127.001: Achieving reliable DNS rebinding
• Lee Holmes - Get $pwnd: Attacking Battle Hardened Windows Server
• Marina Simakov, Igal Gofman - Gaining persistency by abusing advanced authe
• Marc Newlin, Logan Lamb, Chris Grayson - CableTap: Wirelessly Tapping Home Networks
• Matt Knight - Radio Exploitation 101
• Matt Joyce - Amateur Digital Archeology
• Morten Schenk - Taking Windows 10 Kernel Exploitation to the next level
• Min Zheng, Xiangyu Liu - macOS:iOS Kernel Debugging and Heap Feng Shui
• Mikhail Sosonkin - Hacking travel routers like it’s 1999
• Nick Cano - XenoScan Scanning Memory Like a Boss
• Nathan Seidle -Open Source Safe Cracking Robots: Combinations Under 1 Hour
• Redezem - PEIMA Using Power Laws to address Denial of Service Attacks
• Professor Plum - Digital Vengeance Exploiting the Most Notorious C&C Toolki
• Philip Tully, Michael T Raggo - A Picture is Worth a Thousand Words, Literally
• Saif El Sherei - Demystifying Windows Kernel Exploitation by Abusing GDI Objects
• Ryan Baxendale - Microservices and FaaS for Offensive Security
• Romain Coltel, Yves Le Provost - WSUSpendu: How to hang WSUS clients
• Sean Dillon, Zach Harding - Koadic C: Windows COM Command & Control Framework
• Scott Behrens, Jeremy Heffner - Application DoS In Microservice Architectures
• Salvador Mendoza - Exploiting 0ld Mag stripe information with New technology
• spaceB0x - Exploiting Continuous Integration (CI) and Automated Build systems
• Trey Forgety - Inside the “Meet Desai” Attack Defending Distributed Targets
• Tomer Cohen - Game of Chromes: Owning the Web with Zombie Chrome Extensions
• Thomas Mathew, Dhia Mahjoub - Malicious CDNs
• DEF CON 25 -The Dark Tangent, Def Con Goons - DEF CON Closing Ceremonies
• The Dark Tangent - Welcome to DEF CON 25
• Alvaro Muñoz, Alexandr Mirosh - Friday the 13th JSON attacks
• Avi Bashan, Slava Makkaveev - Everything to know about Android packers
• William Knowles - Persisting with Microsoft Office Abusing Extensibility Options
• XlogicX - Assembly Language is Too High Level
• Artem Kondratenko - Cisco Catalyst Exploitation
• Josh Schwartz, John Cramb - MEATPISTOL, A Modular Malware Implant Framework
• Andy Robbins, Will Schroeder - Designing Active Directory DACL Backdoors

Packet Hacking Village

• Chris Wysopal - How Hackers Changed the Security Industry
• Catherine Ullman, Chris Roberts - Breaking the Bad News

AFK2

• HighWiz, Malware Unicorn, Niki7a, Roamer, Wiseacre, Shaggy - DEF CON 101 Panel
• Inbar Raz, Eden Schochat - From One Country, One Floppy to Startup Nation
• Jason Hernandez, Sam Richards, Jerod MacDonald-Evoy - Tracking Spies in the Skies
• John Sotos - Genetic Diseases to Guide Digital Hacks of the Human Genome
• Matt Wixey - See no evil, hear no evil: Hacking invisibly & silently with light & sound
• Octane - Untrustworthy Hardware and How to Fix It
• Snide Owen - Phone system testing and other fun tricks
• Whitney Merrill, Terrell McSweeny - Tick, Tick, Tick Boom You’re Dead: Tech & the FTC
• Jason Staggs - Breaking Wind: Adventures Hacking Wind Farm Control Networks

Biohacking Village

• Stanislav Naydin, Vlad Gostomelsky - Medical Device Ethics
• Amanda Plimpton, Evan Anderson - Psychoactive Chemicals in Combat
• Christopher Frenz - Standardizing Deployment Of Medical Devices
• Kevin Sacco - Tales of A Healthcare Hacker
• Szkatulski Lawless - How Your Doctor Might Be Trying To Kill You
• Trevor Goodman - Hack Your Senses: Sensory Augementation
• Travis Lawrence - Hacking the Second Genetic Code
• Tim Cannon - The Moral Imperative of Biohacking
• Tess Schrodinger - Total Recall: Implicit Learning As Crypto
• Ryan Schmoll, Peter Hefley - Trigraph: Ethereum-based Teleradiology
• Robin Farmanfarmaian - The Patient as CEO
• RenderMan - Hacking The Internet of Dongs
• Paul Ashley - The Future is Fake Identities
• Meow Ludo Meow Meow - DIYBioweapons and Regulation
• Louis Auguste Jr - Microscopes Are Stupid
• Jun Axup - The Brave New World of Bio Entrepreneurship
• John Bass - Medical Industry Disrupt: Blockchain
• Jeffrey Tibbetts - Biohackers Die
• Jay Radcliffe - The Scientific Method in Security Research
• Gingerbread - Neurogenic Peptides Smart Drugs 4 Minute Mile
• Edward You - Biotechnology Needs A Security Patch Badly
• Amirs Panel - Ethics in BioHacking
• C00p3r, Cur50r - Implantable Technology Show and Tell

Mobile

• Yuwue Zheng, Lin Huang - Ghost Telephonist Impersonates You Through LTE CSF
• David Robinson - Using GPS Spoofing to control time
• Haoqi Shan, Jian Yuan - Man in the NFC
• Chaosdata - Ghost in the Droid: Possessing Android Applications with ParaSpectre

R00tz

• Tarah - How To Explain Crypto To Practically Anyone
• Rsnake Robert Hansen - Searching The Invisible Internet
• Patrick McCanna - Tips for Internet Privacy at College
• Leonard Bailey - Everything You Need To Know About The US Dept of Justice
• Erin Owens - Drone Wars
• Erin Owens - Hacking & Robotics v2 point 0
• EFF, Nic0 - Opening Ceremonies:A Place Where Kids Learn White Hat Hacking
• Deviant - Home Depot and A Plan of Attack for Hackers
• David Weinman - Introduction To Cheat Engine
• Cory Doctorow - You are not a Digital Native and that’s OK
• Corban Villa - Arm Mounted Weaponized Platform and Anime Viewer
• Aron Rosenberg, Aaron Standridge - Hacking an Insecure WiFi Camera
• Alex Stamos, CSO Facebook - Keynote

Cryptocurrency

• Matt Suiche - Porosity A Decompiler For Blockchain Based Smart Contracts Bytecode
• Josh Datko, Chris Quartier - Breaking Bitcoin Hardware Wallets
• Konstantinos Karagiannis - Hacking Smart Contracts

Recon Village

• Tyler Rorabaugh - DFIR Automation Orchestration Tools For OSINT Recon
• Tracy Maleeff - Into the Bird’s Nest: A Comprehensive Look at Twitter
• Winner Announcement Prize Distribution
• Simon Roses - OSINT Tactics on Source Code and Developers
• Shane MacDougal - Keynote: Seeing is Believing The Future of Recon
• Mikhail Sasonkin - Up Close and Personal: Keeping an Eye On Mobile
• Leah Figueroa - FERPA: Only Grades Are Safe; OSINT In Higher Education
• Kunal Aggarwal - DataSploit Open Source Assistant for OSINT
• Jason Haddix - Domain Discovery:Expanding Your Scope Like A Boss
• Inbar Raz - Do Tinder Bots Dream of Electric Toys
• Guillermo Buendia, Yael Esquivel - How To Obtain 100 Facebooks a Day
• Dakota Nelson -Total Recoll
• Anthony Russell - Building Google For Criminal Enterprises
• Andrew Hay - An Introduction to Graph Theory for OSINT
• Abhijeth Dugginapeddi - Recon and Bug Bounties What A Great Love Story

Car Hacking Village

• Corey Theun - Heavy Truck and Electronic Logging Devices
• Weston Hecker - Grand Theft Radio Stopping SDR Relay Attacks
• Vlad Gostomelsky - GPS System Integrity
• Tim b1tbane, Mitch Johnson, ehntoo - That’s No Car Its a Network
• Sheila Ayelen Berta, Claudio Caracciolo - The Bicho
• Sameer Dixit, Vlad Gostomelsky - Abusing Smart Cars with QR Codes
• Montalbano, Gillispie, Connett - Attacking Wireless Interfaces
• Jeffrey Quesnelle - An Introduction to AUTOSAR Secure Onboard
• Woodbury, Haltmeyer - Linux Stack Based V2X Framework
• Badge Life: DEFCON Unofficial Badges Panel
• Mickey Shkatov, Jesse Michael, Oleksandr Bazhaniuk - Driving down the rabbit hole

AFK

• Rhett Greenhagen - Skip Tracing For Fun and Profit
• J0n J4rv1s - Surveillance Capitalism Will Continue til Morale Improves
• [Deleted video]
• Gus Fritschie, Evan Teitelman - Backdooring the Lottery and Other Security Tales
• Svea Eckert, Andreas Dewes - Dark Data
• Yan Shoshitaishvili - 25 Years of Program Analysis
• Chris Sumner - Rage Against the Weaponized AI Propaganda Machine
• Ryan Lackey - Cypherpunks History
• Kevin Sacco - Tales of A Healthcare Hacker

Wifi Village

• Aardvark, Darkmatter - WIGLE Like You Mean It Maximizing Your Wardriving
• Woody, Tim Kuester - GODUMPiNG packet sniffing the Gotenna
• Vivek Ramachandran, Nishant Sharma, Ashish Bhangale- Deceptacon
• Robert Ghilduta - Designing An Automatic Gain Control
• Nick Delewski - Failsafe: Yet Another SimpliSafe Attack Vector
• Matt Blaze - Sigint for the rest of us
• Eric Escobar - SecureWorks: SDR Replay Attacks On Home Security Systems
• Balint Seeber - Hacking Some More of the Wireless World
• Andrew Strutt - Suitcase Repeater Build for UHF 70cm
• Andrew Strutt - POCSAG Amateur Pager Network
• Alexander Zakarov - Large Scale Wireless Monitoring: KISMET Packet Sniffer

Voting Village

• Jake Braun - Securing the Election Office A Local Response
• Joseph Hall, David Jefferson - Common Misconceptions and False Parallels
• Matt Blaze - How did we get here? A history of voting technology
• Mary Brady, Josh Franklin - The State of US Voting System Security
• Joseph Hall - Election Hacking: Legal Considerations from the Civil Side
• Harri Hursti - Brief history of election machine hacking
• General Douglas Lute - National Security Implications of Voting Attacks
• Barbara Simons, David Jefferson - Election Systems: More Than the Booth

SE Village

• Billy Boatright - Nor Lose The Common Touch
• Fahey Owens - Beyond Phishing – Building & Sustaining a Corporate SE Program
• Robert Wood - Thematic Social Engineering
• Yaiza Rubio, Félix Brezo - Heavy Diving For Credentials
• Tyler Rosonke - Social Engineering With Web Analytics
• Jayson Street - Strategies on Securing Your Banks and Enterprises
• Helen Thackray - Hackers Gonna Hack , But Do They Know Why?
• Chris Hadnagy - SE vs Predator: Using SE In Ways I Never Thought
• Brent White, Tim Roberts - Skills For A Red Teamer
• John Nye -The Human Factor Why Are We So Bad at Security
• Michele Fincher - Are You Killing Your Security Program?
• Keith Conway, Cameron Craig - Change Agents How to Affect Corp. Culture

ICS Village

• Arnaud Soullié - Fun with Modbus 0x5a Nothing New Still Relevant?
• DEF CON 25 ICS Village Blake Johnson Dissecting Industrial Wireless Implementations
• Bryson Bort, Atlas - Grid Insecurity and How to Really Fix This Shit
• Chris Sistrunk - What’s the DFIRence for ICS
• Joe Weiss - Cyber Security Issues with Level 0 through 1 Devices
• Thomas Brandsetter - InSecurity in Building Automation

Privacy

• Cooper Quintin, Kashmir Hill - The Internet Already Knows I’m Pregnant
• Jim Nitterauer - DNS: Devious Name Services Destroying Privacy & Anonymity w/o consent
• Peyton Engel - Learning about Government Surveillance Software
• Roger Dingledine - Next Generation Tor Onion Services
• Richard Thieme - When Privacy Goes Poof! Why It’s Gone and Never Coming Back
• Tess Schrodinger - Total Recall Implanting Passwords in Cognitive Memory
• Weston Hecker - Opt Out or Deauth Trying! AntiTracking Bots & Keystroke Injection

IoT

• Steinthor Bjarnason, Jason Jones - The call is coming from inside the house
• Sarah Zatko - CITL and the Digital Standard: A Year Later
• Zenofex, 0x00string, CJ 000, Maximus64 - All Your Things Are Belong To Us
• Francis Brown, David Latimer - Putting the Emerging Drone Defense Market to the Test
• Andrew Tierney, Ken Munro - IoT From DVRs to Dildos
• Alex Jay Balan - IoT: The Gift That Keeps on Giving
• Aaron Guzman - Hide Yo Keys, Hide Yo Car
• Aaron Alva, Mark Eichorn - IoT Updates to Help Protect Consumers
• Deral Heiland - The Internet of Vulnerabilities
• Dan Regalado - Inside the Alaris Infusion Pump, not too much medicine, plz
• Brian Knopf - Redesigning PKI For IoT Because Crypto is Hard
• Vladimir Dashchenko, Sergey Temnikov - Pwning the Industrial IoT
• Vivek Ramachandran, Nishant Sharma, Ashish Bhangale - IIDS: IDS FOR IOT
• Rick Ramgattie - Rethinking the Researcher-Vendor Relationshipe
• Caleb Madrigal - Controlling IoT devices with crafted radio signals

Vídeos De Usenix 17



*USENIX 17*

Además del material de USENIX 17 , ya están disponibles también los vídeos de las charlas.

Aquí tenéis la lista completa:

• Opening Remarks and Awards
• When Your Threat Model Is “Everything”: Defensive Security in Modern Newsrooms
• How Double-Fetch Situations turn into Double-Fetch Vulnerabilities…
• Postmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts
• Ninja: Towards Transparent Tracing and Debugging on ARM
• Prime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSX
• On the effectiveness of mitigations against floating-point timing channels
• Constant-Time Callees with Variable-Time Callers
• Neural Nets Can Learn Function Type Signatures From Binaries
• CAn’t Touch This…
• Efficient Protection of Path-Sensitive Control Security
• Digtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities
• kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
• Venerable Variadic Vulnerabilities Vanquished
• Towards Practical Tools for Side Channel Aware Software Engineering…
• Strong and Efficient Cache Side-Channel Protection…
• CacheD: Identifying Cache-Based Timing Channels in Production Software
• An Ant in a World of Grasshoppers
• From Problems to Patterns to Practice…
• BinSim: Trace-based Semantic Binary Diffing…
• PlatPal: Detecting Malicious Documents with Platform Diversity
• Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART
• Global Measurement of DNS Manipulation
• Characterizing the Nature and Dynamics of Tor Exit Blocking
• DeTor: Provably Avoiding Geographic Regions in Tor
• SmartAuth: User-Centered Authorization for the Internet of Things
• AWare: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings
• 6thSense: A Context-aware Sensor-based Attack Detector for Smart Devices
• Identifier Binding Attacks and Defenses in Software-Defined Networks
• HELP: Helper-Enabled In-Band Device Pairing…
• Attacking the Brain: Races in the SDN Control Plane
• Detecting Credential Spearphishing in Enterprise Settings
• SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data
• When the Weakest Link is Strong…
• Hacking in Darkness: Return-oriented Programming against Secure Enclaves
• vTZ: Virtualizing ARM TrustZone
• Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing
• AuthentiCall: Efficient Identity and Content Authentication for Phone Calls
• Picking Up My Tab…
• TrustBase: An Architecture to Repair and Strengthen…
• Transcend: Detecting Concept Drift in Malware Classification Models
• Syntia: Synthesizing the Semantics of Obfuscated Code
• Predicting the Resilience of Obfuscated Code…
• Differential Privacy: From Theory to Deployment
• OSS-Fuzz - Google’s continuous fuzzing service for open source software
• Extension Breakdown…
• CCSP: Controlled Relaxation of Content Security Policies…
• Same-Origin Policy: Evaluation in Modern Browsers
• Locally Differentially Private Protocols for Frequency Estimation
• BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model
• Computer Security, Privacy, and DNA Sequencing…
• BootStomp: On the Security of Bootloaders in Mobile Devices
• Seeing Through The Same Lens…
• Oscar: A Practical Page-Permissions-Based Scheme…
• PDF Mirage: Content Masking Attack Against Information-Based Online Services
• Loophole: Timing Attacks on Shared Event Loops in Chrome
• Game of Registrars…
• Speeding up detection of SHA-1 collision attacks…
• Phoenix: Rebirth of a Cryptographic Password-Hardening Service
• Vale: Verifying High-Performance Cryptographic Assembly Code
• Exploring User Perceptions of Discrimination in Online Targeted Advertising
• Measuring the Insecurity of Mobile Deep Links of Android
• How the Web Tangled Itself
• Towards Efficient Heap Overflow Discovery
• DR. CHECKER: A Soundy Analysis for Linux Kernel Drivers
• Dead Store Elimination (Still) Considered Harmful
• Telling Your Secrets without Page Faults…
• CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management
• AutoLock: Why Cache Attacks on ARM Are Harder Than You Think
• USENIX Security ’17 - Understanding the Mirai Botnet
• MPI: Multiple Perspective Attack Investigation…
• Detecting Android Root Exploits by Learning from Root Providers
• USB Snooping Made Easy: Crosstalk Leakage Attacks on USB Hubs
• Reverse Engineering x86 Processor Microcode
• See No Evil, Hear No Evil, Feel No Evil
• The Loopix Anonymity System
• MCMix: Anonymous Messaging via Secure Multiparty Computation
• ORide: A Privacy-Preserving yet Accountable Ride-Hailing Service
• Adaptive Android Kernel Live Patching
• CHAINIAC: Proactive Software-Update Transparency…
• ROTE: Rollback Protection for Trusted Execution
• A Longitudinal, End-to-End View of the DNSSEC Ecosystem
• Measuring HTTPS Adoption on the Web
• “I Have No Idea What I’m Doing” - On the Usability of Deploying HTTPS
• Beauty and the Burst: Remote Identification of Encrypted Video Streams
• Walkie-Talkie…
• A Privacy Analysis of Cross-device Tracking
• SmartPool: Practical Decentralized Pooled Mining
• REM: Resource-Efficient Mining for Blockchains
• Ensuring Authorized Updates in Multi-user Database-Backed Applications
• Qapla: Policy compliance for database-backed systems
• Data Hemorrhage, Inequality, and You…

Material De Usenix Security 17, sesiones técnicas y talleres



Hace una semana se celebró en Canadá la conferencia “académica” sobre ciber seguridad Usenix junto a un puñado de talleres . Todo el material está disponible de forma gratuita para descarga de ambos eventos: Sesiones Técnicas y Talleres .

Aquí tenéis la lista completa de las charlas y sus correspondientes enlaces:

Sesiones técnicas de Usenix Security ‘17

• When Your Threat Model Is “Everything”: Defensive Security in Modern Newsrooms
• Erinn Clark, Lead Security Architect, First Look Media/The Intercept
• How Double-Fetch Situations turn into Double-Fetch Vulnerabilities: A Study of Double Fetches in the Linux Kernel
  • Paper
  • Slides
• Postmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts
  • Paper
• Ninja: Towards Transparent Tracing and Debugging on ARM
  • Paper
  • Slides
• Prime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSX
  • Paper
• On the effectiveness of mitigations against floating-point timing channels
  • Paper
  • Slides
• Constant-Time Callees with Variable-Time Callers
  • Paper
  • Slides
• Neural Nets Can Learn Function Type Signatures From Binaries
  • Paper
• CAn’t Touch This: Software-only Mitigation against Rowhammer Attacks targeting Kernel Memory
  • Paper
• Efficient Protection of Path-Sensitive Control Security
  • Paper
• Digtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities
  • Paper
• kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
  • Paper
• Venerable Variadic Vulnerabilities Vanquished
  • Paper
• Towards Practical Tools for Side Channel Aware Software Engineering: ‘Grey Box’ Modelling for Instruction Leakages
  • Paper
  • Slides
• Strong and Efficient Cache Side-Channel Protection using Hardware Transactional Memory
  • Paper
  • Slides
• CacheD: Identifying Cache-Based Timing Channels in Production Software
  • Paper
• An Ant in a World of Grasshoppers
• Ellen Cram Kowalczyk, Microsoft
• From Problems to Patterns to Practice: Privacy and User Respect in a Complex World
• Lea Kissner, Google
• BinSim: Trace-based Semantic Binary Diffing via System Call Sliced Segment Equivalence Checking
  • Paper
• PlatPal: Detecting Malicious Documents with Platform Diversity
  • Paper
  • Slides
• Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART
  • Paper
• Global Measurement of DNS Manipulation
  • Paper
• Characterizing the Nature and Dynamics of Tor Exit Blocking
  • Paper
• DeTor: Provably Avoiding Geographic Regions in Tor
  • Paper
• SmartAuth: User-Centered Authorization for the Internet of Things
  • Paper
• AWare: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings
  • Paper
  • Slides
• 6thSense: A Context-aware Sensor-based Attack Detector for Smart Devices
  • Paper
• Identifier Binding Attacks and Defenses in Software-Defined Networks
  • Paper
• HELP: Helper-Enabled In-Band Device Pairing Resistant Against Signal Cancellation
  • Paper
• Attacking the Brain: Races in the SDN Control Plane
  • Paper
• Detecting Credential Spearphishing in Enterprise Settings
  • Paper
• SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data
  • Paper
• When the Weakest Link is Strong: Secure Collaboration in the Case of the Panama Papers
  • Paper
  • Slides
• Hacking in Darkness: Return-oriented Programming against Secure Enclaves
  • Paper
• vTZ: Virtualizing ARM TrustZone
  • Paper
  • Slides
• Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing
  • Paper
• AuthentiCall: Efficient Identity and Content Authentication for Phone Calls
  • Paper
• Picking Up My Tab: Understanding and Mitigating Synchronized Token Lifting and Spending in Mobile Payment
  • Paper
  • Slides
• TrustBase: An Architecture to Repair and Strengthen Certificate-based Authentication
  • Paper
• Transcend: Detecting Concept Drift in Malware Classification Models
  • Paper
• Syntia: Synthesizing the Semantics of Obfuscated Code
  • Paper
• Predicting the Resilience of Obfuscated Code Against Symbolic Execution Attacks via Machine Learning
  • Paper
• Differential Privacy: From Theory to Deployment
• Abhradeep Guha Thakurta, University of California, Santa Cruz
• OSS-Fuzz - Google’s continuous fuzzing service for open source software
  • Slides
• Kostya Serebryany, Google
• Extension Breakdown: Security Analysis of Browsers Extension Resources Control Policies
  • Paper
• CCSP: Controlled Relaxation of Content Security Policies by Runtime Policy Composition
  • Paper
• Same-Origin Policy: Evaluation in Modern Browsers
  • Paper
• Locally Differentially Private Protocols for Frequency Estimation
  • Paper
• BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model
  • Paper
• Computer Security, Privacy, and DNA Sequencing: Compromising Computers with Synthesized DNA, Privacy Leaks, and More
  • Paper
• BootStomp: On the Security of Bootloaders in Mobile Devices
  • Paper
  • Slides
• Seeing Through The Same Lens: Introspecting Guest Address Space At Native Speed
  • Paper
• Oscar: A Practical Page-Permissions-Based Scheme for Thwarting Dangling Pointers
  • Paper
• PDF Mirage: Content Masking Attack Against Information-Based Online Services
  • Paper
• Loophole: Timing Attacks on Shared Event Loops in Chrome
  • Paper
• Game of Registrars: An Empirical Analysis of Post-Expiration Domain Name Takeovers
  • Paper
• Speeding up detection of SHA-1 collision attacks using unavoidable attack conditions
  • Paper
• Phoenix: Rebirth of a Cryptographic Password-Hardening Service
  • Paper
• Vale: Verifying High-Performance Cryptographic Assembly Code
  • Paper
• Exploring User Perceptions of Discrimination in Online Targeted Advertising
  • Paper
• Measuring the Insecurity of Mobile Deep Links of Android
  • Paper
• How the Web Tangled Itself: Uncovering the History of Client-Side Web (In)Security
  • Paper
• Towards Efficient Heap Overflow Discovery
  • Paper
• DR. CHECKER: A Soundy Analysis for Linux Kernel Drivers
  • Paper
• Dead Store Elimination (Still) Considered Harmful
  • Paper
• Telling Your Secrets without Page Faults: Stealthy Page Table-Based Attacks on Enclaved Execution
  • Paper
• CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management
  • Paper
• AutoLock: Why Cache Attacks on ARM Are Harder Than You Think
  • Paper
• Understanding the Mirai Botnet
  • Paper
• MPI: Multiple Perspective Attack Investigation with Semantic Aware Execution Partitioning
  • Paper
• Detecting Android Root Exploits by Learning from Root Providers
  • Paper
• USB Snooping Made Easy: Crosstalk Leakage Attacks on USB Hubs
  • Paper
• Reverse Engineering x86 Processor Microcode
  • Paper
• See No Evil, Hear No Evil, Feel No Evil, Print No Evil? Malicious Fill Patterns Detection in Additive Manufacturing
  • Paper
• The Loopix Anonymity System
  • Paper
• MCMix: Anonymous Messaging via Secure Multiparty Computation
  • Paper
• ORide: A Privacy-Preserving yet Accountable Ride-Hailing Service
  • Paper
• Adaptive Android Kernel Live Patching
  • Paper
• CHAINIAC: Proactive Software-Update Transparency via Collectively Signed Skipchains and Verified Builds
  • Paper
• ROTE: Rollback Protection for Trusted Execution
  • Paper
• A Longitudinal, End-to-End View of the DNSSEC Ecosystem
  • Paper
• Measuring HTTPS Adoption on the Web
  • Paper
• “I Have No Idea What I’m Doing” - On the Usability of Deploying HTTPS
  • Paper
• Beauty and the Burst: Remote Identification of Encrypted Video Streams
  • Paper
• Walkie-Talkie: An Efficient Defense Against Passive Website Fingerprinting Attacks
  • Paper
• A Privacy Analysis of Cross-device Tracking
  • Paper
• SmartPool: Practical Decentralized Pooled Mining
  • Paper
• REM: Resource-Efficient Mining for Blockchains
  • Paper
• Ensuring Authorized Updates in Multi-user Database-Backed Applications
  • Paper
• Qapla: Policy compliance for database-backed systems
  • Paper
• Data Hemorrhage, Inequality, and You: How Technology and Data Flows are Changing the Civil Liberties Game
• Shankar Narayan, Technology and Liberty Project Director, American Civil Liberties Union of Washington

Material de los talleres

• Good tools gone bad: Are we on a slippery slope to communications chaos?
• Chester Wisniewski, Sophos
• dr0wned – Cyber-Physical Attack with Additive Manufacturing
  • Paper
• Automated PCB Reverse Engineering
  • Paper
• BADFET: Defeating Modern Secure Boot Using Second-Order Pulsed Electromagnetic Fault Injection
  • Paper
• From random block corruption to privilege escalation: A filesystem attack vector for rowhammer-like attacks
  • Paper
• Leveraging Flawed Tutorials for Seeding Large-Scale Web Vulnerability Discovery
  • Paper
• One Side-Channel to Bring Them All and in the Darkness Bind Them: Associating Isolated Browsing Sessions
  • Paper
• unCaptcha: A Low-Resource Defeat of reCaptcha’s Audio Challenge
  • Paper
• POTUS: Probing Off-The-Shelf USB Drivers with Symbolic Fault Injection
  • Paper
• Exploitations of Uninitialized Uses on macOS Sierra
  • Paper
  • Slides
• Static Exploration of Taint-Style Vulnerabilities Found by Fuzzing
  • Paper
• Software Grand Exposure: SGX Cache Attacks Are Practical
  • Paper
• Stalling Live Migrations on the Cloud
  • Paper
• SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit
  • Paper
• Breaking and Fixing Gridcoin
  • Paper
• Adversarial Example Defense: Ensembles of Weak Defenses are not Strong
  • Paper
  • Slides
• AutoCTF: Creating Diverse Pwnables via Automated Bug Injection
  • Paper
• Shedding too much Light on a Microcontroller’s Firmware Protection
  • Paper
  • Slides
• Breaking (and Fixing) a Widely Used Continuous Glucose Monitoring System
  • Paper
• One Car, Two Frames: Attacks on Hitag-2 Remote Keyless Entry Systems Revisited
  • Paper
• Shattered Trust: When Replacement Smartphone Components Attack
  • Paper
• White-Stingray: Evaluating IMSI Catchers Detection Applications
  • Paper
  • Slides
• fastboot oem vuln: Android Bootloader Vulnerabilities in Vendor Customizations
  • Paper

Presentaciones de DEF CON 25



*DEF CON 25*

Pues ahora le toca el turno a DEF CON, en este caso la edición 25 que se acaba de celebrar y ya tienes también acceso a las presentaciones :

• 5A1F/
  • 5A1F-Demystifying-Kernel-Exploitation-By-Abusing-GDI-Objects-WP.pdf
  • 5A1F-Demystifying-Kernel-Exploitation-By-Abusing-GDI-Objects.pdf
• Cheng Lei/
  • Cheng-Lei-The-Spear-to-Break-the-Security-Wall-of-S7CommPlus-WP.pdf
  • Cheng-Lei-The-Spear-to-Break-the-Security-Wall-of-S7CommPlus.pdf
• Denton Gentry/
  • Denton-Gentry-I-Know-What-You-Are-By-The-Smell-Of-Your-Wifi-WP.pdf
  • Denton-Gentry-I-Know-What-You-Are-By-The-Smell-Of-Your-Wifi.pdf
• Dimitry Snezhkov/
  • Dimitry Snezhkov - Extras/
  • Dimitry-Snezhkov-Abusing-Web-Hooks.pdf
• Dor Azouri/
  • Dor-Azouri-BITSInject-WP.pdf
  • Dor-Azouri-BITSInject.pdf
• Duncan Woodbury and Nicholas Haltmeyer/
  • Woodbury-and-Haltmeyer-Linux-Stack-Based-V2X-Framework-Hack-Connected-Vehicles-WP.pdf
  • Woodbury-and-Haltmeyer-Linux-Stack-Based-V2X-Framework-Hack-Connected-Vehicles.pdf
• Itzik Kotler and Amit Klein/
  • Itzik-Kotler-and-Amit-Klein-The-Adventures-of-AV-and-the-Leaky-Sandbox-WP.pdf
  • Itzik-Kotler-and-Amit-Klein-The-Adventures-of-AV-and-the-Leaky-Sandbox.pdf
• Josh Pitts/
  • Josh Pitts - Extras/
  • Josh-Pitts-Teaching-Old-Shellcode-New-Tricks.pdf
• Mark Newlin Logan Lamb and Christopher Grayson/
  • Newlin-Lamb-Grayson-CableTap-Wirelessly-Tapping-Your-Home-Network.pdf
• Matt Knight and Marc Newlin/
  • Matt-Knight-and-Marc-Newlin-Radio-Exploitation-WP.pdf
  • Matt-Knight-and-Marc-Newlin-Radio-Exploitation.pdf
• Matt Suiche/
  • Matt-Suiche-Porosity-Decompiling-Ethereum-Smart-Contracts-WP.pdf
  • Matt-Suiche-Porosity-Decompiling-Ethereum-Smart-Contracts.pdf
• Morten Schenk/
  • Morten-Schenk-Taking-Windows-10-Kernel-Exploitation-to-the-next-level-Leveraging-vulns-in-Creators-Update-WP.pdf
  • Morten-Schenk-Taking-Windows-10-Kernel-Exploitation-to-the-next-level-Leveraging-vulns-in-Creators-Update.pdf
• Phillip Tully and Michael Raggo/
  • Phillip-Tully-Michael-Raggo-A-Picture-is-Worth-a-Thousand-Words-Literally-WP.pdf
  • Phillip-Tully-Michael-Raggo-A-Picture-is-Worth-a-Thousand-Words-Literally.pdf
• Romain Coltel and Yves Le Provost/
  • Coltel-LeProvost-WSUSpendu-How-To-Hang-Its-Clients-WP.pdf
  • Coltel-LeProvost-WSUSpendu-How-To-Hang-Its-Clients.pdf
• Steinthor Bjarnason and Jason Jones/
  • Steinthor-Bjarnason-and-Jason-Jones-The-Call-Is-Coming-From-Inside-The-House-WP.pdf
  • Steinthor-Bjarnason-and-Jason-Jones-The-Call-Is-Coming-From-Inside-The-House.pdf
• Tomer Cohen/
  • Tomer-Cohen-Game-Of-Chromes-Owning-The-Web-With-Zombie-Chrome-Extensions-WP.pdf
  • Tomer-Cohen-Game-Of-Chromes-Owning-The-Web-With-Zombie-Chrome-Extensions.pdf
• 0ctane-Untrustworthy-Hardware.pdf
• Alvaro-Munoz-JSON-attacks.pdf
• Andrew-Robbins-and-Will-Schroeder-An-Ace-Up-The-Sleeve.pdf
• Artem-Kondratenko-Cisco-Catalyst-Exploitation.pdf
• Ayoul3-Dealing-the-Perfect-Hand-Shuffling-memory-blocks-on-zOS.pdf
• Caleb-Madrigal-IOT-Hacking-With-SDR.pdf
• Chris-Thompson-MS-Just-Gave-The-Blue-Teams-Tactical-Nukes.pdf
• Christopher-Domas-Breaking-The-x86-ISA.pdf
• Cincvolflt-Inside-The-Meet-Desai-Attack.pdf
• Damien-Cauquil-Weaponizing-the-BBC-MicroBit.pdf
• Daniel-Bohannon-and-Lee-Holmes-Revoke-Obfuscation.pdf
• Datko-and-Quartier-Breaking-Bitcoin-Hardware-Wallets.pdf
• Dhia-Mahjoub-and-Thomas-Mathew-Malicious-CDNs-Identifying-Zbot-Domains-en-Masse.pdf
• Foofus-Secret-Tools-Learning-About-Gov-Surveillance-Software.pdf
• Gabriel-Ryan-Advanced-Wireless-Attacks-Against-Enterprise-Networks-Course-Guide.pdf
• Gabriel-Ryan-Advanced-Wireless-Attacks-Against-Enterprise-Networks-Lab-Setup-Guide.pdf
• Gabriel-Ryan-Advanced-Wireless-Attacks-Against-Enterprise-Networks.pdf
• Gerald-Steere-and-Sean-Metcalf-Hacking-the-Cloud.pdf
• Gil-Cohen-Call-The-Plumber-You-Have-A-Leak-In-Your-(named)-Pipe.pdf
• Gus-Frischie-and-Evan-Teitelman-Backdooring-the-Lottery.pdf
• Hanno-Boeck-Abusing-Certificate-Transparency-Logs.pdf
• Haoqi-Shan-and-Jian-Yuan-Man-in-the-NFC.pdf
• Hernandez-Richards-MacDonald-Evoy-Tracking-Spies-in-the-Skies.pdf
• Hyrum-Anderson-Evading-Next-Gen-AV-Using-AI.pdf
• Ilja-van-Sprundel-BSD-Kern-Vulns.pdf
• Inbar-and-Eden-Story-of-Early-Israeli-Hacking-Community.pdf
• Jason-Staggs-Breaking-Wind-Hacking-Wind-Farm-Control-Networks.pdf
• Jesse-Michael-and-Mickey-Shkatov-Driving-Down-the-Rabbit-Hole.pdf
• Jhaddix-HUNT-Data-Driven-Web-Hacking-and-Manual-Testing.pdf
• Jim-Nitterauer-DNS-Devious-Name-Services-Destroying-Privacy-Anonymity-Without-Your-Consent.pdf
• Joe-Rozner-Wiping-Out-CSRF.pdf
• Karit-ZX-Security-Using-GPS-Spoofing-To-Control-Time.pdf
• Konstantinos-Karagiannis-Hacking-Smart-Contracts.pdf
• Lee-Holmes-Attacking-Battle-Hardened-Windows-Server.pdf
• Marina-Simakov-and-Igal-Gofman-Here-to-stay-Gaining-persistence-by-abusing-auth-mechanisms.pdf
• Matt-Wixey-See-No-Evil-Hear-No-Evil.pdf
• Max-Bazaliy-Jailbreaking-Apple-Watch.pdf
• Mikhail-Sosonkin-Hacking-Travel-Routers-Like-1999.pdf
• Min-Spark-Zheng-macOS-iOS-Kernel-Debugging.pdf
• Nathan-Seidle-Open-Source-Safe-Cracking-Robots.pdf
• Omar-Eissa-Attacking-Autonomic-Networks.pdf
• Orange-Tsai-A-New-Era-of-SSRF-Exploiting-URL-Parser-in-Trending-Programming-Languages.pdf
• Owen-Snide-Phone-System-Testing-and-other-fun-tricks.pdf
• Patrick-DeSantis-From-Box-to-Backdoor-Using-Old-School-Tools.pdf
• Patrick-Wardle-Offensive-Malware-Analysis-Fruit-Fly.pdf
• Plore-Popping-a-Smart-Gun.pdf
• Professor-Plum-Digital Vengeance-Exploiting-Notorious-Toolkits.pdf
• Roger-Dingledine-Next-Generation-Tor-Onion-Services.pdf
• Ryan-Baxendale-Microservices-and-FaaS-for-Offensive-Security.pdf
• Salvador-Mendoza-Exploiting-0ld-Magstripe-Info-with-New-Technology.pdf
• Scott-Behrens-and-Jeremy-Heffner-Starting-The-Avalanche-Application-DoS-In-Microservice-Architectures.pdf
• Slava-Makkaveev-and-Avi-Bashan-Unboxing-Android.pdf
• Stephan-Huber-and-Seigfried-Rasthofer-Password-Manager-Investigation.pdf
• Suggy-Sumner-Rage-Against-The-Weaponized-AI-Propaganda-Machine.pdf
• Svea-Eckert-Andreas-Dewes-Dark-Data.pdf
• Tess-Schrodinger-Total-Recall.pdf
• Tomer-Cohen-Game-Of-Chromes-Owning-The-Web-With-Zombie-Chrome-Extensions-WP.pdf
• Tomer-Cohen-Game-Of-Chromes-Owning-The-Web-With-Zombie-Chrome-Extensions.pdf
• Vasillios-Mavroudis-Trojan-Tolerant-Hardware.pdf
• Weston-Hecker-Opt-Out-or-Deauth-Trying.pdf
• Whitney-Merrill-and-Terrell-McSweeny-Tick-Tick-Boom-Tech-and-the-FTC.pdf
• William-Knowles-Persisting-With-Microsoft-Office.pdf
• XlogicX-Assembly-Language-Is-Too-High-Level.pdf
• Yuwei-Zheng-UnicornTeam-Ghost-Telephonist.pdf
• chaosdata-Ghost-in-the-Droid-ParaSpectre.pdf
• r00killah-and-securelyfitz-Secure-Tokin-and-Doobiekeys.pdf
• skud-and-Sky-If-You-Give-A-Mouse-A-Microchip.pdf
• spaceB0x-Exploiting-Continuous-Integration.pdf
• zerosum0x0-alephnaught-Koadic-C3.pdf

Presentaciones de Black Hat USA 2017



*BlackHat 2017*

Ya están disponible las presentaciones de Black Hat USA 2017 :

• Stepping Up Our Game: Re-focusing the Security Community on Defense and Making Security Work for Everyone
• ‘Ghost Telephonist’ Link Hijack Exploitations in 4G LTE CS Fallback
  • Yuwei-Ghost-Telephonist-Link-Hijack-Exploitations-In-4G-LTE-CS-Fallback.pdf
• (in)Security in Building Automation: How to Create Dark Buildings with Light Speed
  • Brandstetter-insecurity-In-Building-Automation-How-To-Create-Dark-Buildings-With-Light-Speed.pdf
  • Brandstetter-insecurity-In-Building-Automation-How-To-Create-Dark-Buildings-With-Light-Speed-wp.pdf
• A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!
  • Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf
• Advanced Pre-Breach Planning: Utilizing a Purple Team to Measure Effectiveness vs. Maturity
• Adventures in Attacking Wind Farm Control Networks
  • Staggs-Adventures-In-Attacking-Wind-Farm-Control-Networks.pdf
• All Your SMS & Contacts Belong to ADUPS & Others
  • Johnson-All-Your-SMS-&-Contacts-Belong-To-Adups-&-Others.pdf
  • Johnson-All-Your-SMS-&-Contacts-Belong-To-Adups-&-Others-wp.pdf
• An ACE Up the Sleeve: Designing Active Directory DACL Backdoors
  • Robbins-An-ACE-Up-The-Sleeve-Designing-Active-Directory-DACL-Backdoors.pdf
  • Robbins-An-ACE-Up-The-Sleeve-Designing-Active-Directory-DACL-Backdoors-wp.pdf
• And Then the Script-Kiddie Said Let There be No Light. Are Cyber-Attacks on the Power Grid Limited to Nation-State Actors?
  • Keliris-And-Then-The-Script-Kiddie-Said-Let-There-Be-No-Light-Are-Cyberattacks-On-The-Power-Grid-Limited-To-Nation-State-Actors-wp.pdf
• Attacking Encrypted USB Keys the Hard(ware) Way
• Automated Detection of Vulnerabilities in Black-Box Routers (and Other Network Devices)
• Automated Testing of Crypto Software Using Differential Fuzzing
  • Aumasson-Automated-Testing-Of-Crypto-Software-Using-Differential-Fuzzing.pdf
• AVPASS: Leaking and Bypassing Antivirus Detection Model Automatically
  • Jung-AVPASS-Leaking-And-Bypassing-Anitvirus-Detection-Model-Automatically.pdf
• Behind the Plexiglass Curtain: Stats and Stories from the Black Hat NOC
• Betraying the BIOS: Where the Guardians of the BIOS are Failing
  • Branco-Firmware-Is-The-New-Black-Analyzing-Past-Three-Years-Of-BIOS-UEFI-Security-Vulnerabilities
• Big Game Theory Hunting: The Peculiarities of Human Behavior in the InfoSec Game
  • Shortridge-Big-Game-Theory-Hunting-The-Peculiarities-Of-Human-Behavior-In-The-Infosec-Game.pdf
• Blue Pill for Your Phone
• Bochspwn Reloaded: Detecting Kernel Memory Disclosure with x86 Emulation and Taint Tracking
  • Jurczyk-Bochspwn-Reloaded-Detecting-Kernel-Memory-Disclosure-With-X86-Emulation-And-Taint-Tracking.pdf
• Bot vs. Bot for Evading Machine Learning Malware Detection
  • Anderson-Bot-Vs-Bot-Evading-Machine-Learning-Malware-Detection.pdf
  • Anderson-Bot-Vs-Bot-Evading-Machine-Learning-Malware-Detection-wp.pdf
• Break
• Breakfast (Sponsored by FireEye McAfee Qualys & Tenable Network Security)
• Breaking Electronic Door Locks Like You’re on CSI: Cyber
  • OFlynn-Breaking-Electronic-Locks.pdf
• Breaking the Laws of Robotics: Attacking Industrial Robots
  • Quarta-Breaking-The-Laws-Of-Robotics-Attacking-Industrial-Robots.pdf
  • Quarta-Breaking-The-Laws-Of-Robotics-Attacking-Industrial-Robots-wp.pdf
• Breaking the x86 Instruction Set
  • Domas-Breaking-The-x86-ISA.pdf
  • Domas-Breaking-The-x86-Instruction-Set-wp.pdf
• Broadpwn: Remotely Compromising Android and iOS via a Bug in Broadcom’s Wi-Fi Chipsets
• Bug Collisions Meet Government Vulnerability Disclosure
  • Ablon-Bug-Collisions-Meet-Government-Vulnerability-Disclosure-Zero-Days-Thousands-Of-Nights-RAND.pdf
  • [Herr-Bug-Collisions-Meet-Government-Vulnerability-Disclosure-Taking Stock - Vulnerability-Rediscovery-HKS.pdf]( https://www.blackhat.com/docs/us-17/thursday/us-17-Herr-Bug-Collisions-Meet-Government-Vulnerability-Disclosure-Taking Stock - Vulnerability-Rediscovery-HKS.pdf)
• Business Hall Welcome Reception (Sponsored by Forcepoint McAfee LogRhythm & Tenable Network Security)
• Challenges of Cooperation Across Cyberspace
• Champagne Toast (Sponsored by ESET North America Fidelis Cybersecurity Fortinet Leidos Palo Alto Networks Raytheon & Symantec)
• Cloak & Dagger: From Two Permissions to Complete Control of the UI Feedback Loop
  • Fratantonio-Cloak-And-Dagger-From-Two-Permissions-To-Complete-Control-Of-The-UI-Feedback-Loop.pdf
  • Fratantonio-Cloak-And-Dagger-From-Two-Permissions-To-Complete-Control-Of-The-UI-Feedback-Loop-wp.pdf
• Coffee Service
• Cracking the Lens: Targeting HTTP’s Hidden Attack-Surface
  • Kettle-Cracking-The-Lens-Exploiting-HTTPs-Hidden-Attack-Surface.pdf
  • Kettle-Cracking-The-Lens-Exploiting-HTTPs-Hidden-Attack-Surface-wp.pdf
  • Kettle-Cracking-The-Lens-Exploiting-HTTPs-Hidden-Attack-Surface-tool.zip
• Cyber Wargaming: Lessons Learned in Influencing Security Stakeholders Inside and Outside Your Organization
  • Nichols-Cyber-Wargaming-Lessons-Learned-In-Influencing-Stakeholders-Inside-And-Outside-Your-Organization.pdf
  • Nichols-Cyber-Wargaming-Lessons-Learned-In-Influencing-Stakeholders-Inside-And-Outside-Your-Organization-wp.pdf
• Datacenter Orchestration Security and Insecurity: Assessing Kubernetes Mesos and Docker at Scale
• Defeating Samsung KNOX with Zero Privilege
  • Shen-Defeating-Samsung-KNOX-With-Zero-Privilege.pdf
  • Shen-Defeating-Samsung-KNOX-With-Zero-Privilege-wp.pdf
• Delivering Javascript to World+Dog
  • Randolph-Delivering-Javascript-to-World-Plus-Dog.pdf
  • Randolph-Delivering-Javascript-to-World-Plus-Dog-wp.pdf
• Developing Trust and Gitting Betrayed
• Digital Vengeance: Exploiting the Most Notorious C&C Toolkits
  • Grange-Digital-Vengeance-Exploiting-The-Most-Notorious-C&C-Toolkits.pdf
  • Grange-Digital-Vengeance-Exploiting-The-Most-Notorious-C&C-Toolkits-wp.pdf
• Don’t Trust the DOM: Bypassing XSS Mitigations via Script Gadgets
  • Lekies-Dont-Trust-The-DOM-Bypassing-XSS-Mitigations-Via-Script-Gadgets.pdf
• Electronegativity - A Study of Electron Security
  • Carettoni-Electronegativity-A-Study-Of-Electron-Security.pdf
  • Carettoni-Electronegativity-A-Study-Of-Electron-Security-wp.pdf
• Escalating Insider Threats Using VMware’s API
  • Ziv-Escalating-Insider-Threats-Using-Vmware’s-Api.pdf
• Evading Microsoft ATA for Active Directory Domination
  • Mittal-Evading-MicrosoftATA-for-ActiveDirectory-Domination.pdf
• Evil Bubbles or How to Deliver Attack Payload via the Physics of the Process
• Evilsploit – A Universal Hardware Hacking Toolkit
  • Chui-Evilsploit-A-Universal-Hardware-Hacking-Toolkit.pdf
  • Chui-Evilsploit-A-Universal-Hardware-Hacking-Toolkit-wp.pdf
• Evolutionary Kernel Fuzzing
  • Johnson-Evolutionary-Kernel-Fuzzing
• Exploit Kit Cornucopia
• Exploiting Network Printers
  • Mueller-Exploiting-Network-Printers.pdf
• Fad or Future? Getting Past the Bug Bounty Hype
• Fighting Targeted Malware in the Mobile Ecosystem
  • Ruthven-Fighting-Targeted-Malware-In-The-Mobile-Ecosystem.pdf
• Fighting the Previous War (aka: Attacking and Defending in the Era of the Cloud)
• Firmware is the New Black - Analyzing Past Three Years of BIOS/UEFI Security Vulnerabilities
• FlowFuzz - A Framework for Fuzzing OpenFlow-Enabled Software and Hardware Switches
  • Gray-FlowFuzz-A-Framework-For-Fuzzing-OpenFlow-Enabled-Software-And-Hardware-Switches.pdf
• Fractured Backbone: Breaking Modern OS Defenses with Firmware Attacks
• Free-Fall: Hacking Tesla from Wireless to CAN Bus
  • Nie-Free-Fall-Hacking-Tesla-From-Wireless-To-CAN-Bus.pdf
  • Nie-Free-Fall-Hacking-Tesla-From-Wireless-To-CAN-Bus-wp.pdf
• Friday the 13th: JSON Attacks
  • Munoz-Friday-The-13th-Json-Attacks.pdf
  • Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
• Game of Chromes: Owning the Web with Zombie Chrome Extensions
  • Cohen-Game-Of-Chromes-Owning-The-Web-With-Zombie-Chrome-Extensions-wp.pdf
  • Cohen-Game-Of-Chromes-Owning-The-Web-With-Zombie-Chrome-Extensions-wp.pdf
• Garbage In Garbage Out: How Purportedly Great Machine Learning Models can be Screwed Up by Bad Data
  • Sanders-Garbage-In-Garbage-Out-How-Purportedly-Great-ML-Models-Can-Be-Screwed-Up-By-Bad-Data.pdf
  • Sanders-Garbage-In-Garbage-Out-How-Purportedly-Great-ML-Models-Can-Be-Screwed-Up-By-Bad-Data-wp.pdf
• Go Nuclear: Breaking Radiation Monitoring Devices
  • [Santamarta-Go-Nuclear-Breaking Radition-Monitoring-Devices.pdf]( https://www.blackhat.com/docs/us-17/wednesday/us-17-Santamarta-Go-Nuclear-Breaking Radition-Monitoring-Devices.pdf)
  • [Santamarta-Go-Nuclear-Breaking Radition-Monitoring-Devices-wp.pdf]( https://www.blackhat.com/docs/us-17/wednesday/us-17-Santamarta-Go-Nuclear-Breaking Radition-Monitoring-Devices-wp.pdf)
• Go to Hunt Then Sleep
  • Bianco-Go-To-Hunt-Then-Sleep.pdf
• Hacking Hardware with a $10 SD Card Reader
  • Etemadieh-Hacking-Hardware-With-A-$10-SD-Card-Reader.pdf
  • Etemadieh-Hacking-Hardware-With-A-$10-SD-Card-Reader-wp.pdf
• Hacking Serverless Runtimes: Profiling AWS Lambda Azure Functions and More
  • Krug-Hacking-Severless-Runtimes.pdf
  • Krug-Hacking-Severless-Runtimes-wp.pdf
• Honey I Shrunk the Attack Surface – Adventures in Android Security Hardening
• How We Created the First SHA-1 Collision and What it Means for Hash Security
• Hunting GPS Jammers
  • Gostomelsky-Hunting-GPS-Jammers.pdf
• Ice Cream Social (Sponsored by Code42 Software Core Security Cybereason Darktrace F5 Networks iboss Malwarebytes & Optiv Security)
• Ichthyology: Phishing as a Science
  • Burnett-Ichthyology-Phishing-As-A-Science.pdf
  • Burnett-Ichthyology-Phishing-As-A-Science-wp.pdf
• Industroyer/Crashoverride: Zero Things Cool About a Threat Group Targeting the Power Grid
  • Lee-Industroyer-Crashoverride-Zero-Things-Cool-About-A-Threat-Group-Targeting-The-Power-Grid.pdf
• Infecting the Enterprise: Abusing Office365+Powershell for Covert C2
  • Dods-Infecting-The-Enterprise-Abusing-Office365-Powershell-For-Covert-C2.pdf
• Influencing the Market to Improve Security
  • Nakibly-Automated-Detection-of-Vulnerabilities-in-Black-Box-Routers.pdf
  • Nakibly-Automated-Detection-of-Vulnerabilities-in-Black-Box-Routers-wp.pdf
• Intel AMT Stealth Breakthrough
  • Evdokimov-Intel-AMT-Stealth-Breakthrough.pdf
  • Evdokimov-Intel-AMT-Stealth-Breakthrough-wp.pdf
• Intel SGX Remote Attestation is Not Sufficient
  • Swami-SGX-Remote-Attestation-Is-Not-Sufficient-wp.pdf
  • Swami-SGX-Remote-Attestation-Is-Not-Sufficient-wp.pdf
• Intercepting iCloud Keychain
  • Radocea-Intercepting-iCloud-Keychain.pdf
• IoTCandyJar: Towards an Intelligent-Interaction Honeypot for IoT Devices
  • Luo-Iotcandyjar-Towards-An-Intelligent-Interaction-Honeypot-For-IoT-Devices.pdf
  • Luo-Iotcandyjar-Towards-An-Intelligent-Interaction-Honeypot-For-IoT-Devices-wp.pdf
• kR^X: Comprehensive Kernel Protection Against Just-In-Time Code Reuse
  • [Pomonis-KR^X- Comprehensive- Kernel-Protection-Against-Just-In-Time-Code-Reuse.pdf]( https://www.blackhat.com/docs/us-17/thursday/us-17-Pomonis-KR^X- Comprehensive- Kernel-Protection-Against-Just-In-Time-Code-Reuse.pdf)
• Lies and Damn Lies: Getting Past the Hype of Endpoint Security Solutions
  • Giuliano-Lies-And-Damn-Lies-Getting-Past-The-Hype-Of-Endpoint-Security-Solutions.pdf
• Lunch Break (Sponsored by Cisco Forcepoint LogRhythm & RSA)
• Many Birds One Stone: Exploiting a Single SQLite Vulnerability Across Multiple Software
  • Feng-Many-Birds-One-Stone-Exploiting-A-Single-SQLite-Vulnerability-Across-Multiple-Software.pdf
• Mimosa Bar (Sponsored by AlienVault Arbor Networks Carbon Black CrowdStrike Cylance DarkMatter Digital Guardian & IBM)
• Network Automation is Not Your Safe Haven: Protocol Analysis and Vulnerabilities of Autonomic Network
  • Eissa-Network-Automation-Isn’t-Your-Safe-Haven-Protocol-Analysis-And-Vulnerabilities-Of-Autonomic-Network.pdf
• New Adventures in Spying 3G and 4G Users: Locate Track & Monitor
  • Borgaonkar-New-Adventures-In-Spying-3G-And-4G-Users-Locate-Track-And-Monitor.pdf
• Ochko123 - How the Feds Caught Russian Mega-Carder Roman Seleznev
• Offensive Malware Analysis: Dissecting OSX/FruitFly via a Custom C&C Server
  • Wardle-Offensive-Malware-Analysis-Dissecting-OSXFruitFly-Via-A-Custom-C&C-Server.pdf
• OpenCrypto: Unchaining the JavaCard Ecosystem
  • Mavroudis-Opencrypto-Unchaining-The-JavaCard-Ecosystem.pdf
• Orange is the New Purple - How and Why to Integrate Development Teams with Red/Blue Teams to Build More Secure Software
  • Wright-Orange-Is-The-New-Purple.pdf
  • Wright-Orange-Is-The-New-Purple-wp.pdf
• PEIMA: Harnessing Power Laws to Detect Malicious Activities from Denial of Service to Intrusion Detection Traffic Analysis and Beyond
• Practical Tips for Defending Web Applications in the Age of DevOps
  • [Lackey-Practical Tips-for-Defending-Web-Applications-in-the-Age-of-DevOps.pdf]( https://www.blackhat.com/docs/us-17/thursday/us-17-Lackey-Practical Tips-for-Defending-Web-Applications-in-the-Age-of-DevOps.pdf)
• Protecting Pentests: Recommendations for Performing More Secure Tests
  • McGrew-Protecting-Pentests-Recommendations-For-Performing-More-Secure-Tests.pdf
  • McGrew-Protecting-Pentests-Recommendations-For-Performing-More-Secure-Tests-wp.pdf
• Protecting Visual Assets: Digital Image Counter-Forensics
  • Mazurov-Brown-Protecting-Visual-Assets-Digital-Image-Counter-Forensics.pdf
• Pwnie Awards
• Quantifying Risk in Consumer Software at Scale - Consumer Reports’ Digital Standard
• RBN Reloaded - Amplifying Signals from the Underground
• Real Humans Simulated Attacks: Usability Testing with Attack Scenarios
  • Cranor-Real-Users-Simulated-Attacks.pdf
• Redesigning PKI to Solve Revocation Expiration and Rotation Problems
  • Knopf-Redesigning-PKI-To-Solve-Revocation-Expiration-And-Rotation-Problems.pdf
  • Knopf-Redesigning-PKI-To-Solve-Revocation-Expiration-And-Rotation-Problems-wp.pdf
• Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science
  • [Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And Evasion-Using-Science.pdf]( https://www.blackhat.com/docs/us-17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And Evasion-Using-Science.pdf)
  • [Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And Evasion-Using-Science-wp.pdf]( https://www.blackhat.com/docs/us-17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And Evasion-Using-Science-wp.pdf)
• rVMI: A New Paradigm for Full System Analysis
  • Pfoh-rVMI-A-New-Paradigm-For-Full-System-Analysis.pdf
• ShieldFS: The Last Word in Ransomware Resilient File Systems
  • Continella-ShieldFS-The-Last-Word-In-Ransomware-Resilient-Filesystems.pdf
  • Continella-ShieldFS-The-Last-Word-In-Ransomware-Resilient-Filesystems-wp.pdf
• Skype & Type: Keystroke Leakage over VoIP
  • Lain-Skype-&-Type-Keystroke-Leakage-Over-VoIP.pdf
• Smoothie Social (Sponsored by Bromium Proofpoint Inc. Rapid7 SentinelOne Trend Micro Webroot StackPath & Tanium)
• So You Want to Market Your Security Product…
  • Alva-So-You-Want-To-Market-Your-Security-Product.pdf
• Sonic Gun to Smart Devices: Your Devices Lose Control Under Ultrasound/Sound
  • Wang-Sonic-Gun-To-Smart-Devices-Your-Devices-Lose-Control-Under-Ultrasound-Or-Sound.pdf
• Splunking Dark Tools - A Pentesters Guide to Pwnage Visualization
  • Bates-Splunking-Dark-Tools-A-Pentesters-Guide-To-Pwnage-Visualization.pdf
• SS7 Attacker Heaven Turns into Riot: How to Make Nation-State and Intelligence Attackers’ Lives Much Harder on Mobile Networks
  • Kacer-SS7-Attacker-Heaven-Turns-Into-Riot-How-To-Make-Nation-State-And-Intelligence-Attackers-Lives-Much-Harder-On-Mobile-Networks.pdf
  • Kacer-SS7-Attacker-Heaven-Turns-Into-Riot-How-To-Make-Nation-State-And-Intelligence-Attackers-Lives-Much-Harder-On-Mobile-Networks-wp.pdf
• Taking DMA Attacks to the Next Level: How to do Arbitrary Memory Reads/Writes in a Live and Unmodified System Using a Rogue Memory Controller
• Taking Over the World Through MQTT - Aftermath
  • Lundgren-Taking-Over-The-World-Through-Mqtt-Aftermath.pdf
• Taking Windows 10 Kernel Exploitation to the Next Level – Leveraging Write-What-Where Vulnerabilities in Creators Update
  • Schenk-Taking-Windows-10-Kernel-Exploitation-To-The-Next-Level–Leveraging-Write-What-Where-Vulnerabilities-In-Creators-Update.pdf
  • Schenk-Taking-Windows-10-Kernel-Exploitation-To-The-Next-Level–Leveraging-Write-What-Where-Vulnerabilities-In-Creators-Update-wp.pdf
• The Active Directory Botnet
  • Miller-The-Active-Directory-Botnet
• The Adventures of AV and the Leaky Sandbox
  • Kotler-The-Adventures-Of-Av-And-The-Leaky-Sandbox.pdf
  • Kotler-The-Adventures-Of-Av-And-The-Leaky-Sandbox-wp.pdf
• The Art of Securing 100 Products
  • Valtman-The-Art-Of-Securing-100-Products.pdf
• The Avalanche Takedown: Landslide for Law Enforcement
• The Epocholypse 2038: What’s in Store for the Next 20 Years
  • Hypponen-The-Epocholypse-2038-Whats-In-Store-For-The-Next-20-Years.pdf
• The Future of ApplePwn - How to Save Your Money
  • Yunusov-The-Future-Of-Applepwn-How-To-Save-Your-Money.pdf
• The Industrial Revolution of Lateral Movement
  • Beery-The-Industrial-Revolution-Of-Lateral-Movement.pdf
• The Origin of Array [@@species]: How Standards Drive Bugs in Script Engines
  • Silvanovich-The-Origin-Of-Array-Symbol-Species.pdf
• The Shadow Brokers – Cyber Fear Game-Changers
• They’re Coming for Your Tools: Exploiting Design Flaws for Active Intrusion Prevention
• Tracking Ransomware End to End
  • Invernizzi-Tracking-Ransomware-End-To-End.pdf
• Web Cache Deception Attack
  • Gil-Web-Cache-Deception-Attack.pdf
  • Gil-Web-Cache-Deception-Attack-wp.pdf
• Well that Escalated Quickly! How Abusing Docker API Led to Remote Code Execution Same Origin Bypass and Persistence in the Hypervisor via Shadow Containers
  • Cherny-Well-That-Escalated-Quickly-How-Abusing-The-Docker-API-Led-To-Remote-Code-Execution-Same-Origin-Bypass-And-Persistence.pdf
  • Cherny-Well-That-Escalated-Quickly-How-Abusing-The-Docker-API-Led-To-Remote-Code-Execution-Same-Origin-Bypass-And-Persistence_wp.pdf
• What They’re Teaching Kids These Days: Comparing Security Curricula and Accreditations to Industry Needs
  • Sanders-What-They’re-Teaching-Kids-These-Days-Comparing-Security-Curricula-And-Accreditations-To-Industry-Needs.pdf
• What’s on the Wireless? Automating RF Signal Identification
  • Ossmann-Whats-On-The-Wireless-Automating-RF-Signal-Identification.pdf
  • Ossmann-Whats-On-The-Wireless-Automating-RF-Signal-Identification-wp.pdf
• When IoT Attacks: Understanding the Safety Risks Associated with Connected Devices
  • Rios-When-IoT-Attacks-Understanding-The-Safety-Risks-Associated-With-Connected-Devices.pdf
  • Rios-When-IoT-Attacks-Understanding-The-Safety-Risks-Associated-With-Connected-Devices-wp.pdf
• White Hat Privilege: The Legal Landscape for a Cybersecurity Professional Seeking to Safeguard Sensitive Client Data
  • Osborn-White-Hat-Privilege-The-Legal-Landscape-For-A-Cybersecurity-Professional-Seeking-To-Safeguard-Sensitive-Client-Data.pdf
• Why Most Cyber Security Training Fails and What We Can Do About it
• WiFuzz: Detecting and Exploiting Logical Flaws in the Wi-Fi Cryptographic Handshake
  • Ventura-Theyre-Coming-For-Your-Tools-Exploiting-Design-Flaws-For-Active-Intrusion-Prevention.pdf
  • Ventura-Theyre-Coming-For-Your-Tools-Exploiting-Design-Flaws-For-Active-Intrusion-Prevention-wp.pdf
  • Vanhoef-WiFuzz-Detecting-And-Exploiting-Logical-Flaws-In-The-Wi-Fi-Cryptographic-Handshake-tools.zip
• Wire Me Through Machine Learning
  • Singh-Wire-Me-Through-Machine-Learning.pdf
• WSUSpendu: How to Hang WSUS Clients
  • Coltel-WSUSpendu-Use-WSUS-To-Hang-Its-Clients.pdf
  • Coltel-WSUSpendu-Use-WSUS-To-Hang-Its-Clients-wp.pdf
• Zero Days Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits
  • Ablon-Zero-Days-Thousands-Of-Nights-The-Life-And-Times-Of-Zero-Day-Vulnerabilities-And-Their-Exploits.pdf

Vídeos de OWASP AppSec Europa 2017



*OWASP AppSec EU 2017*

Perfecto para el fin de semana si no tienes nada planeado, ya están disponibles los vídeos de la OWASP AppSec Europa 2017 :

• Conference Opening Address by Gary Robinson
• The Gift Of Feedback by Shannon Lietz
• Boosting The Security Of Your Angular 2 Application by Philippe De Ryck
• Don’t Trust The DOM: Bypassing XSS Mitigations Via Script Gadgets by Sebastian Lekies
• The Key Under The Doormat by Stephan Huber and Steven Arzt
• OWASP Juice Shop by Björn Kimminich
• Printer Security by Jens Müller and Vladislav Mladenov
• 2017: Rise Of The Machines by Kev D’Arcy, Nicholas Raite and Rohini Sulatycki
• Looking Back To Look Ahead by Brian Honan
• Making Vulnerability Management Suck Less With DefectDojo by Greg Ande
• Don’t Get Caught Em-bed by Aaron Guzman
• So We Broke All CSPs You Won’t Guess What Happened Next by Michele Spagnuolo
• Long Term Study On SSL TLS Certificates by Enrico Branca
• What Is A DevSecOps Engineer? by Helen Beal
• Security And The Self Contained Unit Of Software by Gareth Rushgrove
• I Am Not A Robot: Job Security In A DevSecOps World by Correy Voo
• Improving The Security Of Software Defined Infrastructures by Theodoor Scholte
• An SDLC For The DevSecOps Era by Zane Lackey
• Requirements Gathering For Succesful DevSecOps Pipeline by A Volkman and H Yasar
• Integrating Security In Agile Projects by Elena Kravchenko and Efrat Wasserman
• Secure DevOps Journey: A How To Guide by Peter Chestna
• Embedding GDPR Into The SDLC by Sebastien Deleersnyder and Siebe De Roovere
• Threat Modeling with PASTA by Tony UcedaVelez
• The Flaws In Hordes, The Security In Crowds by Mike Shema
• The Dark Side Of Search Engines Optimizations Campaigns by Or Katz
• The Evil Friend In Your Browser by Achim D Brucker
• Introducing The OWASP ModSecurity Core Rule Set 3 0 by Christian Folini
• What The Kidnapping And Ransom Economy Teaches Us About Ransomware by J Grossman
• Pentesting Voice Biometrics Solutions by Jakub Kaluzny
• How To Steal Mobile Wallet? by Wojtek Dworakowski and Slawomir Jasek
• Exploiting CORS Misconfigurations For Bitcoins And Bounties by James Kettle
• Analysis And Detection Of Authentication Cross Site Request Forgery by Luca Compagna
• Preventing 10 Common Security Mistakes In The MEAN Stack by David Bohannon
• On The (In-)Security Of JavaScript Object Signing And Encryption by Dennis Detering
• Everything Is Quantum! by Jaya Baloo
• Conference Closing Address by Gary Robinson
• How To Lead Better Security Through Our Mini Hardening Project by Kazuki Tsubo
• Security Best Practices In Azure Cloud by Viktorija Almazova
• Fixing Mobile AppSec: The OWASP Mobile Project by Bernhard Mueller and Sven Schleier
• The Path Of Secure Software by Katy Anton
• DNS Hijacking Using Cloud Providers: No Verification Needed by Frans Rosén
• Combining The Security Risks Of Native And Web Development Hybrid Apps
• The DevSecOps Playbook From A Practitioner’s Perspective by Shannon Lietz
• DevSecOps: A Rose By Any Other Name Would Smell Sweeter by Nigel Kersten
• Pushing Left Like A Boss: Application Security Foundations by Tanya Janca
• Security In The Land Of Microservices by Jack Mannino
• Application Security For DevSecOps by Joseph Feiman
• Securing The Continuous Integration Process by Irene Michlin
• Monitoring Attack Surface And Integrating Security Into DevOps Pipelines
• DevSec: Continuous Patch And Security Assessment With Inspec by Christoph Hartmann
• Creating An AppSec Pipeline With Containers In A Week by Jeroen Willemsen
• DevSecOps Roundup: An Overview Of The Current State Of DevSecOps
• Incremental Threat Modeling by Irene Michlin
• How To Put The Sec In DevOps by Helen Bravo
• Could A Few Lines Of Code F!#ck It All Up! by Erez Yalon
• An Introduction To Quantum Safe Cryptography by Liz O’Sullivan
• Dangerous Optimizations And The Loss Of Causality by Robert C Seacord

Presentaciones de Black Hat Asia 2017



*Black Hat Asia 2017*

Ya podemos acceder a muchas de las presentaciones de la edición asiática de Black Hat de este año :

• The Seven Axioms of Security
• Why We are Not Building a Defendable Internet
• Man-in-the-SCADA: Anatomy of Data Integrity Attacks in Industrial Control Systems
• 24 Techniques to Gather Threat Intel and Track Actors
• 3G/4G Intranet Scanning and its Application on the WormHole Vulnerability
• All Your Emails Belong to Us: Exploiting Vulnerable Email Clients via Domain Name Collision
• Anti-Plugin: Don’t Let Your App Play as an Android Plugin
  • asia-17-Luo-Anti-Plugin-Don’t-Let-Your-App-Play-As-An-Android-Plugin.pdf
  • asia-17-Luo-Anti-Plugin-Don’t-Let-Your-App-Play-As-An-Android-Plugin-wp.pdf
• Betting Against the House: Security and Stability When the Odds are Against You
• Beyond the Blacklists: Detecting Malicious URL Through Machine Learning
• Breaking Korea Transit Card with Side-Channel Attack - Unauthorized Recharging
  • asia-17-Kim-Breaking-Korea-Transit-Card-With-Side-Channel-Attack-Unauthorized-Recharging.pdf
  • asia-17-Kim-Breaking-Korea-Transit-Card-With-Side-Channel-Attack-Unauthorized-Recharging-wp.pdf
• Cache Side Channel Attack: Exploitability and Countermeasures
• Cross the Wall - Bypass All Modern Mitigations of Microsoft Edge
  • asia-17-Li-Cross-The-Wall-Bypass-All-Modern-Mitigations-Of-Microsoft-Edge.pdf
• Daily-Life Peeper: Bug Hunting and Exploit Techniques in IoT
• Delegate to the Top: Abusing Kerberos for Arbitrary Impersonations and RCE
  • asia-17-Hart-Delegate-To-The-Top-Abusing-Kerberos-For-Arbitrary-Impersonations-And-RCE.pdf
  • asia-17-Hart-Delegate-To-The-Top-Abusing-Kerberos-For-Arbitrary-Impersonations-And-RCE-wp.pdf
  • asia-17-Hart-Delegate-To-The-Top-Abusing-Kerberos-For-Arbitrary-Impersonations-And-RCE-tool.ps1
• Dig Into the Attack Surface of PDF and Gain 100+ CVEs in 1 Year
  • asia-17-Liu-Dig-Into-The-Attack-Surface-Of-PDF-And-Gain-100-CVEs-In-1-Year.pdf
  • asia-17-Liu-Dig-Into-The-Attack-Surface-Of-PDF-And-Gain-100-CVEs-In-1-Year-wp.pdf
• Domo Arigato Mr. Roboto: Security Robots a la Unit-Testing
  • asia-17-Law-Domo-Arigato-Mr-Roboto-Security-Robots-A-La-Unit-Testing.pdf
  • asia-17-Law-Domo-Arigato-Mr-Roboto-Security-Robots-A-La-Unit-Testing-wp.pdf
• Drop the ROP: Fine-Grained Control-Flow Integrity for the Linux Kernel
  • asia-17-Moreira-Drop-The-Rop-Fine-Grained-Control-Flow-Integrity-For-The-Linux-Kernel.pdf
• Exploiting USB/IP in Linux
  • asia-17-Korchagin-Exploiting-USBIP-In-Linux.pdf
  • asia-17-Korchagin-Exploiting-USBIP-In-Linux-wp.pdf
• Fried Apples: Jailbreak DIY
  • asia-17-Bazaliy-Fried-Apples-Jailbreak-DIY.pdf
• Go Get My/Vulnerabilities: An In-Depth Analysis of Go Language Runtime and the New Class of Vulnerabilities It Introduces
• Hack Microsoft Using Microsoft Signed Binaries
• Hacking HTTP/2 - New Attacks on the Internet’s Next Generation Foundation
• Hello From the Other Side: SSH Over Robust Cache Covert Channels in the Cloud
  • asia-17-Schwarz-Hello-From-The-Other-Side-SSH-Over-Robust-Cache-Covert-Channels-In-The-Cloud.pdf
  • asia-17-Schwarz-Hello-From-The-Other-Side-SSH-Over-Robust-Cache-Covert-Channels-In-The-Cloud-wp.pdf
  • asia-17-Schwarz-Hello-From-The-Other-Side-SSH-Over-Robust-Cache-Covert-Channels-In-The-Cloud-tool.zip
• Locknote: Conclusions and Key Takeaways from Black Hat Asia 2017
• MASHaBLE: Mobile Applications of Secret Handshakes Over Bluetooth LE
• Mobile-Telephony Threats in Asia
• Myth and Truth About Hypervisor-Based Kernel Protector: The Reason Why You Need Shadow-Box
• Never Let Your Guard Down: Finding Unguarded Gates to Bypass Control Flow Guard with Big Data
• Open Sourcing Automotive Diagnostics
• Phishing for Funds: Understanding Business Email Compromise
  • asia-17-Turpin-Phishing-For-Funds-Understanding-Business-Email-Compromise.pdf
• Remotely Compromising iOS via Wi-Fi and Escaping the Sandbox
• The Irrelevance of K-Bytes Detection - Building a Robust Pipeline for Malicious Documents
  • asia-17-Amiga-The-Irrelevance-Of-K-Byte-Detection-Building-A-Robust-Pipeline-For-Malicious-Document.pdf
• The Power of Data-Oriented Attacks: Bypassing Memory Mitigation Using Data-Only Exploitation Techniques
• The UEFI Firmware Rootkits: Myths and Reality
• What Malware Authors Don’t Want You to Know - Evasive Hollow Process Injection
  • asia-17-KA-What-Malware-Authors-Don’t-Want-You-To-Know-Evasive-Hollow-Process-Injection.pdf
  • asia-17-KA-What-Malware-Authors-Don’t-Want-You-To-Know-Evasive-Hollow-Process-Injection-wp.pdf

Vídeos de Usenix Enigma 2017



Aquí tenéis los charlas (vídeos y algunas diapositivas) de la edición de este año de la conferencia Usenix Enigma:

• Human Computation with an Application to Passwords
• Moving Account Recovery beyond Email and the "Secret" Question
• Secrets at Scale: Automated Bootstrapping of Secrets & Identity in the Cloud
• Inside "MOAR TLS:" How We Think about Encouraging External HTTPS Adoption on the Web
• Ghost in the Machine: Challenges in Embedded Binary Security
• LLC Cache Attacks: Applicability and Countermeasures
• IoT, a Cybercriminal's Paradise
• Hacking Sensors
• Test Driven Security in Continuous Integration
• As We May Code
• Leveraging the Power of Automated Reasoning in Security Analysis of Web Applications and Beyond
• Startups + Industry: How Everyone Can Win
• Behaviors and Patterns of Bulletproof and Anonymous Hosting Providers
• StreamAlert: A Serverless, Real-time Intrusion Detection Engine
• Neural and Behavioral Insights on Trust
• What Does the Brain Tell Us about Usable Security?
• Brains Can Be Hacked. Why Should You Care?
• Won't Somebody Please Think of the Journalists?
• Security in the Wild for Low-Profile Activists
• Why Philanthropy Is Critical for Cybersecurity
• Security for Vulnerable Populations—On the Interplay of Weapons of Influence and Life Domains in Predicting Older Adults' Susceptibility to Spear-Phishing Emails
• Beyond Warm & Fuzzy: Ethics as a Value Prop
• Legislative Engineering: Design Privacy Laws, Don't Just Draft Them
• The Paper Ballot Is Not Enough
• What Cybersecurity Can Learn from the Secret Service
• How WhatsApp Reduced Spam while Launching End-to-End Encryption
• Drawing the Foul: Operation of a DDoS Honeypot
• Putting Privacy Notices to the Test
• Understanding and Designing for End Users' Security Expectations
• Deviation from the Norms: The Necessity and Challenges of a Norms-based Approach to Digital Offense
• FeatureSmith: Learning to Detect Malware by Mining the Security Literature
• Classifiers under Attack
• Adversarial Examples in Machine Learning
• Cyber Security: A DARPA Perspective
• National Scale Cyber Security
• Green Sprouts: Encouraging Signs of Life from the Department of Defense’s 2016 Security Strategy
• Understanding and Securing DoD Weapon Systems

Vídeos de RSA USA 2017



Si no tienes nada que hacer este fin de semana, aquí tienes lo vídeos de la conferencia RSA USA 2017.

• Hello False Flags! The Art of Deception in Targeted Attack Attribution
• The Blockchain Identity Crisis
• From Boot-to-Root: A Method for Successful Security Training
• CISO as Change Agent: Getting to Yes
• Deconstructing Identity Analytics for Higher Risk Awareness
• IoT: End of Shorter Days
• Workplace Violence and IT Sabotage: Two Sides of the Same Coin?
• Radical Innovation: Revolutionizing the Future of Cybersecurity
• Cloud Security Assessments: You're Doing It Wrong!
• Encryption and Back Doors: The Line between Privacy and National Security
• Open Security Controller: Security Orchestration for OpenStack
• Security Policy, Behavior and Analytics for Emerging Architectures
• The Seven Most Dangerous New Attack Techniques, and What's Coming Next
• Break the Risk Paradigms: Overhauling Your Risk Program
• The State of Digital Supplier Risk Management: In Partners We Trust
• War Stories: Corporate Cyberespionage Tales from the Trenches
• Delivering Effective Security Outcomes
• Cybersecurity Roadmap: Global Healthcare Security Architecture
• Cyberwar in 2020
• Delivering Secure, Client-Side Technology to Billions of Users
• Cyber-Apocalypse and the New Cyberwarfare
• The Dridex Swiss Army Knife: Big Data Dissolves the APT and Crime Grey Area
• The Coming Disruption in Security
• Adventures in Underland: What System Stores on the Disk Without Telling You
• Beyond Stuxnet: State of the Art in Cyberwarfare and Weapons
• Eggs and Beacon--Scrambling IoT Beacon Indoor Proximity Systems
• Find Map, Get Treasure, Avoid Pirates--Data Security and Privacy Best Practice
• Hacker's Perspective on Your Windows Infrastructure: Mandatory Check List
• Resurrecting Privacy in the Cloud: A Privacy Engineering Implementation
• Security Leadership Lessons from the Dark Side
• Why Cyber-Training Is Key, and How to Do It Right
• Catching Ghosts: Smart Strategies for Successful Recruitment
• Securing What You Don’t Own or Control: The Current State of Wi-Fi Security
• An Aflac Case Study: Moving a Security Program from Defense to Offense
• Applied Machine Learning: Defeating Modern Malicious Documents
• Crown Jewels Risk Assessment: Cost-Effective Risk Identification
• Auditors in the Cloud: Audit Risk and SaaS Applications
• Planning for Chaos
• RSA Conference 2017 Excellence Awards
• Mobile Authentication at Different Levels of Assurance
• Protecting and Defending against Cyberthreats in Uncertain Times
• Sweating the Small Stuff on a Global Scale
• Briefing the Board: Lessons Learned from CISOs and Directors
• The War in Cyberspace: Why We Are Losing--and How to Fight Back
• EU Data Privacy: What US Orgs Need to Do Now to Prepare for GDPR
• Culture Hacker: How to Herd CATTs and Inspire Rebels to Change the World!
• RSAC TV: Interview with Michael Dell
• Check out RSAC 2017 Expo Halls
• The Cryptographers' Panel
• How to Improve Phishing Awareness by 300 Percent in 18 Months
• Hacking Blockchain
• Hands-On Perspectives: Deploying FIDO-Based Modern Authentication Solutions
• Building a Healthy Organization: The Last Great Competitive Advantage
• STRONG: Leading Security into the Future
• What's Next in Cyber-Policy
• RSAC TV: Oliver Friedrichs Interview
• IoT Ecosystems: An Adversary's Perspective
• A Field Guide to Insider Threat Helps Manage the Risk
• The Five Secrets of High-Performing CISOs
• Global Approaches to Protecting Critical National Infrastructure
• The Human Exploitation Kill Chain
• Regulating the Internet of Things
• What Is Needed in the Next Generation Cloud Trusted Platform?
• What CISOs Wish They Could Say Out Loud
• Tidal Forces: The Changes Ripping Apart Security as We Know It
• Cyber-Insurance--I Do Not Think That Word Means What You Think It Means
• Saving Security: Real Change Starts with You, Me and Everyone
• Hot Topics in Privacy: A Conversation with Google, Microsoft and Cisco
• Help Wanted: Security Heroes and Heroines Only Need Apply
• A Virtual and Software-Defined Security Architecture Workshop
• All Children Left Behind
• Who is Who During a Cyber Incident Response Investigation
• How Google Protects Its Corporate Security Perimeter without Firewalls
• Building a Strategic Plan for Your Security Awareness Program
• Congressional Oversight in the Wake of Russian Hacking
• Changing Face/Fate of Identity
• High-Performance Computing Will Make or Break Cybersecurity
• Advances in Cloud-Scale Machine Learning for Cyber-Defense
• The Future of Ransomware on the Internet of Things
• Security Implications of Non-Financial Uses of Blockchain Technology
• RSAC TV: Phyllis Schneck Interview
• How to Do Security WITH Your Organization, Not TO It
• From Vision to Reality: Delivering Emerging Cyber-Technologies Effectively
• Effective Application Security Testing for DevOps
• The Adversary's New Game Plan
• Three Keys to CISO Success
• Innovation Sandbox 2017: Cato
• RSAC TV: Jennifer Minella Interview
• RSAC TV: Mischel Kwon Interview
• A New Approach for Cybersafety Rules and the “Tech Talk” with Kids
• How to Break the Internet
• NERC: A Comprehensive Approach to Managing Grid Security Risks
• Innovation Sandbox 2017: RedLock
• Innovation Sandbox 2017: Enveil
• Innovation Sandbox 2017: Claroty
• Innovation Sandbox 2017: Contrast
• Innovation Sandbox 2017: Veriflow
• Innovation Sandbox 2017: UnifyID
• Threat Intelligence and Data Analytics Jujutsu
• Innovation Sandbox 2017: GreatHorn
• Innovation Sandbox 2017: UpLevel
• Data Plays the Victim: What Ransomware Has Taken from the Kidnapping and Ransom Industry
• RSAC Innovation Sandbox 2017 - Highlights
• RSAC TV: Gidi Cohen Interview
• Innovation Sandbox 2017: Baffle
• From Hello Barbie to Pokemon Go: The New World of Online Safety
• RSAC TV: Jessy Irwin Interview
• RSAC TV: Chenxi Wang Interview
• Security for Real People: A Case Study
• Quick Look: Hashes for the Masses
• Quick Look: Crowdsourced Security at the Government Level: It Takes a Nation (of Hackers)
• Virtual Session: Know Before You Go, Your RSAC Attack Plan
• Quick Look: Hacking Exposed NextGen
• Quick Look: Diagnosis SOC-Atrophy: What to Do When Your SOC Is Sick
• Quick Look: Charting the Course to GDPR: Setting Sail
• Quick Look: Find Map, Get Treasure, Avoid Pirates--Data Security and Privacy Best Practice
• Quick Look: Opening the Door to DoD Perspectives on Cyberthreat Intelligence
• Quick Look: Drive Revenue by Protecting Customer Privacy: Progress and 2017 Predictions
• Quick Look: IoT End of Days
• Quick Look: Hacker's Perspective on Your Windows Infrastructure: Mandatory Check List
• Quick Look: Psychology of an Eastern European Cybercriminal: Mindset Drives Behavior
• Quick Look: Securing Serverless Applications in the Cloud
• Quick Look: Tracking Darknet: A Window into Attackers' Motives, Methods and Targets
• Quick Look: CISO as Change Agent: Getting to Yes
• Quick Look: One-Hit Wonders: Dealing with Millions of Anomalies
• Quick Look: Meaningful Use or Meltdown: Is Your Electronic Health Record System Secure?
• Quick Look: Measuring Authentication: NIST 800-63 and Vectors of Trust
• HOW TO: Reserve Your Seat for A Session at RSA Conference
• Virtual Session: The Six Most Dangerous New Cyberattack Techniques

Vídeos de ekoparty 12 - 2016



Si no tienes nada planeado para este fin de semana, aquí tienes algo de distracción, los vídeos de las charlas de la pasada conferencia sobre seguridad informática celebrada en Buenos Aires, Argentina, Ekoparty 12.

• Tyler Curtis - Encryption out of LINE
• Juan Berner - Exploiting A/B Testing for Fun and Profit
• Nahuel Cayetano Riva - Getting fun with Frida
• Rodrigo Cetera y Javier Bassi - #KillTheHashes - El Gran Libro para Colorear Malware
• Ezequiel Fernandez y Sergio Viera - Multiple Vulnerabilities in SE PLC
• Joernchen - Let Me GitHub That For You (2016 Argentinian Edition)
• Martin Gendler - Juegos Online, Sociedad y Privacidad: un recorrido socio-histórico
• Sheila Berta y Claudio Caracciolo - Backdooring CAN Bus for Remote Car Hacking
• Nahuel Sánchez y Sergio Abraham - SAP HANA under the hood
• Enrique Nissim - I Know Where Your Page Lives: De-randomizing the Windows 10 Kernel
• Sebastian Garcia - Stratosphere IPS. The free machine learning malware detection
• Patrick Wardle - Strolling into Ring-0 via I/O Kit Drivers
• Nicolas Economou y Diego Juarez - Abusing GDI for ring0 exploit primitives: Reloaded
• Martin Vigo - Do-it-Yourself Spy Program: Abusing Apple's Call Relay Protocol
• Javier Smaldone y Iván Ariel Barrera Oro - Una mala elección
• Drew Suarez y Daniel Mayer - Don't Be a Dummy: A Crash Course in Automotive Security
• Travis Morrow y Josh Pitts - Genetic Malware: Designing Payloads for Specific Targets
• Andrew Robbins y Rohan Vazarkar - Six Degrees of Domain Admin
• Rolf Rolles - Synesthesia: Automated Generation of Encoding-Restricted Machine...
• Julien Lenoir y Raphaël Rigo - Lost your "secure" HDD PIN? We can help!
• Salvador Mendoza - Samsung Pay: Numeros Tokenizados y sus Fallas
• Entrega de premios y cierre
• Moritz Jodeit - Look Mom, I don't use Shellcode: Browser Exploitation for IE 11

Vídeos del Chaos Communication Congress (33c3)



Aunque el congreso sobre hacking/seguridad, Chaos Communication Congress todavía no ha terminado, los vídeos de las charlas que ya se han dado están disponibles. En los momentos de escribir estas líneas, estos son los vídeos disponibles:

• 33C3 Closing Ceremony
• Security Nightmares 0x11
• Surveilling the surveillers
• 33C3 Infrastructure Review
• Virtual Secure Boot
• The Ultimate Game Boy Talk
• Privatisierung der Rechtsdurchsetzung
• Warum in die Ferne schweifen, wenn das Ausland liegt so nah?
• Understanding the Snooper’s Charter
• Rebel Cities
• The Transhumanist Paradox
• Datenschutzgrundverordnung: Rechte für Menschen, Pflichten für Firmen & Chancen für uns
• Genetic Codes and what they tell us – and everyone else
• Retail Surveillance / Retail Countersurveillance
• Lightning Talks Day 4
• The High Priests of the Digital Age
• Beyond Virtual and Augmented Reality
• Community
• The Economic Consequences of Internet Censorship
• Methodisch inkorrekt!
• Ethics in the data society
• Hebocon
• The Zcash anonymous cryptocurrency
• The Universe Is, Like, Seriously Huge
• Edible Soft Robotics
• Eavesdropping on the Dark Cosmos
• PUFs, protection, privacy, PRNGs
• The 12 Networking Truths
• What We Can Learn about Creativity from 3D Printing
• Hacking collective as a laboratory
• Lasers in the sky (with asteroids)
• Irren ist staatlich
• Interplanetary Colonization
• From Server Farm to Data Table
• Saving the World with (Vegan) Science
• The Moon and European Space Exploration
• Von Alpakas, Hasenbären und Einhörnern – Über Anerkennungskultur
• Berechnete Welt
• The woman behind your WiFi
• An Elevator to the Moon (and back)
• Hochsicherheits-Generalschlüssel Marke Eigenbau
• Decoding the LoRa PHY
• No Love for the US Gov.
• Technologien für und wider Digitale Souveränität
• Talking Behind Your Back
• Dissecting HDMI
• A New Dark Age
• Making Technology Inclusive Through Papercraft and Sound
• Building Custom Pinball Machines
• Machine Dreams
• Do as I Say not as I Do: Stealth Modification of Programmable Logic Controllers I/O by…
• Dissecting modern (3G/4G) cellular modems
• Liberté, Égalité, Fraternité... and privacy ?!
• On Smart Cities, Smart Energy, And Dumb Security
• Memory Deduplication: The Curse that Keeps on Giving
• Lightning Talks Day 3
• Corporate surveillance, digital tracking, big data & privacy
• Million Dollar Dissidents and the Rest of Us
• radare demystified
• How do we know our PRNGs work properly?
• Fnord-Jahresrückblick
• Eine kleine Geschichte der Parlamentsschlägerei
• Code BROWN in the Air
• ATMs how to break them to stop the fraud
• Durchmarsch von Rechts
• Shining some light on the Amazon Dash button
• SpinalHDL : An alternative hardware description language
• SpiegelMining – Reverse Engineering von Spiegel-Online
• Intercoms Hacking
• Build your own NSA
• Downgrading iOS: From past to present
• The Untold Story of Edward Snowden’s Escape from Hong Kong
• Stopping law enforcement hacking
• On the Security and Privacy of Modern Single Sign-On in the Web
• A world without blockchain
• Formal Verification of Verilog HDL with Yosys-SMTBMC
• Searchwing - Mit Drohnen leben retten
• Einführung zu Blockchains
• 3 Years After Snowden: Is Germany fighting State Surveillance?
• Die Sprache der Populisten
• Hacking Reality
• Copywrongs 2.0
• No USB? No problem.
• Haft für Whistleblower?
• Von Kaffeeriechern, Abtrittanbietern und Fischbeinreißern
• Recount 2016: An Uninvited Security Audit of the U.S. Presidential Election
• In Search of Evidence-Based IT-Security
• Gone in 60 Milliseconds
• Wheel of Fortune
• Tapping into the core
• Welcome to the Anthropocene?
• Hacking the World
• Lightning Talks Day 2
• The Clash of Digitalizations
• Syrian Archive
• How physicists analyze massive data: LHC + brain + ROOT = Higgs
• Es sind die kleinen Dinge im Leben
• Der 33 Jahrerückblick
• A look into the Mobile Messaging Black Box
• International exchange of tax information
• Nicht öffentlich.
• Woolim – Lifting the Fog on DPRK’s Latest Tablet PC
• Console Hacking 2016
• You can -j REJECT but you can not hide: Global scanning of the IPv6 Internet
• Visiting The Bear Den
• Netzpolitik in Österreich
• Lockpicking in the IoT
• Deploying TLS 1.3: the great, the good and the bad
• Where in the World Is Carmen Sandiego?
• Netzpolitik in der Schweiz 2016
• Nintendo Hacking 2016
• Make Wi-Fi fast again
• Software Defined Emissions
• Dieselgate – A year later
• Keys of Fury
• Bonsai Kitten waren mir lieber - Rechte Falschmeldungen in sozialen Netzwerken
• What's It Doing Now?
• Make the Internet Neutral Again
• Untrusting the CPU
• A Data Point Walks Into a Bar
• Routerzwang und Funkabschottung
• Pegasus internals
• Geolocation methods in mobile networks
• A Story of Discrimination and Unfairness
• Anthropology for kids - What is privacy?
• Shut Up and Take My Money!
• Kampf dem Abmahnunwesen
• Space making/space shaping
• Check Your Police Record!
• Law Enforcement Are Hacking the Planet
• The Nibbletronic
• The DROWN Attack
• Zwischen Technikbegeisterung und kritischer Reflexion: Chaos macht Schule
• Predicting and Abusing WPA2/802.11 Group Keys
• Bootstraping a slightly more secure laptop
• How Do I Crack Satellite and Cable Pay TV?
• Building a high throughput low-latency PCIe based SDR
• The Fight for Encryption in 2016
• Exploiting PHP7 unserialize
• Reverse engineering Outernet
• What could possibly go wrong with ?
• Everything you always wanted to know about Certificate Transparency
• The Global Assassination Grid
• 33C3 Opening Ceremony

Iremos actualizando esta entrada durante los próximos días añadiendo los vídeos que se vayan publicando.

33c3 Works for me



Un año más se celebra en Hamburgo, Alemania, el que, para mi, es el mejor congreso sobre seguridad/hacking del planeta. El Chaos Communication Congress (33c3), este año en su 33 edición, ha comenzado hoy y durará cuatro días. El panel de las charlas como de costumbre es impresionante.

Si no has podido asistir, siempre puedes seguir las charlas en directo desde la página de streaming.

Vídeos de App Sec USA 2016



Ya están disponibles los vídeos de las presentaciones de App Sec USA 2016

• Cleaning Your Applications' Dirty Laundry with Scumblr - AppSecUSA 2016
• Everything is Terrible: Three Perspectives on Building, Configuring, and Securing Software
• HTTPS & TLS in 2016: Security practices from the front lines - AppSecUSA 2016
• Justin Collins - Practical Static Analysis for Continuous Application Security - AppSecUSA 2016
• Using language-theoretics and runtime visibility to align AppSec with DevOps - AppSecUSA 2016
• Manideep Konakandla - Breaking and Fixing your ‘Docker’ ized environments - AppSecUSA 2016
• Chris Gates & Ken Johnson - DevOops: Redux - AppSecUSA 2016
• Zane Lackey - Practical tips for web application security in the age of agile and DevOps
• Chenxi Wang - Protect Containerized Applications With System Call Profiling - AppSecUSA 2016
• Scaling Security Assessment at the Speed of DevOps - AppSecUSA 2016
• Yair Amit - The Ways Hackers Are Taking To Win The Mobile Malware Battle - AppSecUSA 2016
• Your License for Bug Hunting Season - AppSecUSA 2016
• When encryption is not enough: Attacking Wearable - AppSecUSA 2016
• Jimmy Mesta - Containerizing your Security Operations Center - AppSecUSA 2016
• Practical Tips For Running A Successful Bug Bounty Program - AppSecUSA 2016
• Simon Thorpe - Why using SMS in the authentication chain is risky - AppSecUSA 2016
• Marco Lancini - Needle: Finding Issues within iOS Applications - AppSecUSA 2016
• Patterns of Authentication and Self-Announcement in IoT - AppSecUSA 2016
• [AUDIO] Should there be an Underwriters Laboratories certification for software in IoT products?
• Arshan Dabirsiaghi - How To Find The Next Great Deserialization CVE - AppSecUSA 2016
• Stephen De Vries - Threat Modeling With Architectural Risk Patterns - AppSecUSA 2016
• Kevin Johnson & Jason Gillam - Next Gen Web Pen Testing - AppSecUSA 2016
• Dave Lewis - Barbarians at the Gate(way) - AppSecUSA 2016
• Eric Johnson - Continuous Integration: Live Static Analysis using Visual Studio & the Roslyn API
• Matt Tesauro - AppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
• Dan Kuykendall - SPArring with the Security of Single Page Applications - AppSecUSA 2016
• Automating API Penetration Testing using fuzzapi - AppSecUSA 2016
• James Kettle - Exploiting CORS Misconfigurations for Bitcoins and Bounties - AppSecUSA 2016
• Evan Johnson - Misconfigured CORS and why web appsec is not getting easier - AppSecUSA 2016
• Ofer Maor - Putting an 'I' in Code Review Turning Code Reviewing Interactive - AppSecUSA 2016

Presentaciones de Black Hat Europe 2016



Ya se encuentran disponibles las presentaciones de otra de las ediciones de Black Hat, la edición europea de 2016 en este caso.

• (Pen)Testing Vehicles with CANToolz eu-16-Sintsov-Pen-Testing-Vehicles-With-Cantoolz.pdf
• 50 Thousand Needles in 5 Million Haystacks: Understanding Old Malware Tricks to Find New Malware Families eu-16-Valeros-50-Thousand-Needles-In-5-Million-Haystacks-Understanding-Old-Malware-Tricks-To-Find-New-Malware-Families.pdf
• AI based Antivirus: Can AlphaAV Win the Battle in which Man Has Failed? eu-16-Wang-AI-Based-Antivirus-Can-Alphaav-Win-The-Battle-In-Which-Man-Has-Failed.pdf
• Another Brick Off the Wall: Deconstructing Web Application Firewalls Using Automata Learning eu-16-Argyros-Another-Brick-Off-The-Wall-Deconstructing-Web-Application-Firewalls-Using-Automata-Learning.pdf eu-16-Argyros-Another-Brick-Off-The-Wall-Deconstructing-Web-Application-Firewalls-Using-Automata-Learning-wp.pdf eu-16-Argyros-Another-Brick-Off-The-Wall-Deconstructing-Web-Application-Firewalls-Using-Automata-Learning-too-lightbulb-framework.zip
• ARMageddon: How Your Smartphone CPU Breaks Software-Level Security and Privacy eu-16-Lipp-ARMageddon-How-Your-Smartphone-CPU-Breaks-Software-Level-Security-And-Privacy.pdf eu-16-Lipp-ARMageddon-How-Your-Smartphone-CPU-Breaks-Software-Level-Security-And-Privacy-wp.pdf armageddon
• Attacking Windows by Windows eu-16-Liang-Attacking-Windows-By-Windows.pdf
• Automating Incident Response: Sit Back and Relax Bots are Taking Over… eu-16-Hovor-Automating-Incident-Investigations-Sit-Back-And-Relax-Bots-Are-Taking-Over.pdf
• Backslash Powered Scanning: Hunting Unknown Vulnerability Classes eu-16-Kettle-Backslash-Powered Scanning-Hunting-Unknown-Vulnerability-Classes.pdf eu-16-Kettle-Backslash-Powered Scanning-Hunting-Unknown-Vulnerability-Classes-wp.pdf eu-16-Kettle-Backslash-Powered Scanning-Hunting-Unknown-Vulnerability-Classes-backslashPoweredScanner.zip eu-16-Kettle-Backslash-Powered Scanning-Hunting-Unknown-Vulnerability-Classes-distributeDamage.zip
• Breaking BHAD: Abusing Belkin Home Automation Devices eu-16-Tenaglia-Breaking-Bhad-Abusing-Belkin-Home-Automation-Devices.pdf
• Breaking Big Data: Evading Analysis of the Metadata of Your Life eu-16-Venable-Breaking-Big-Data-Evading-Analysis-Of-The-Metadata-Of-Your-Life.pdf
• Bypassing Clang's SafeStack for Fun and Profit
• Bypassing Secure Boot Using Fault Injection eu-16-Timmers-Bypassing-Secure-Boot-Using-Fault-Injection.pdf
• Chasing Foxes by the Numbers: Patterns of Life and Activity in Hacker Forums eu-16-Ahlberg-Chasing-Foxes-By-The-Numbers-Patterns-Of-Life-And-Activity-In-Hacker-Forums.pdf
• Code Deobfuscation: Intertwining Dynamic Static and Symbolic Approaches eu-16-David-Code-Deobfuscation-Intertwining-Dynamic-Static-And-Symbolic-Approaches.pdf
• CTX: Eliminating BREACH with Context Hiding eu-16-Karakostas-Ctx-Eliminating-BREACH-With-Context-Hiding.pdf eu-16-Karakostas-Ctx-Eliminating-BREACH-With-Context-Hiding-wp.pdf
• Cyber Judo: Offensive Cyber Defense eu-16-Beery-Grady-Cyber-Judo-Offensive-Cyber-Defense.pdf
• Detach Me Not - DoS Attacks Against 4G Cellular Users Worldwide from your Desk eu-16-Holtmanns-Detach-Me-Not.pdf
• DRAMA: How Your DRAM Becomes a Security Problem eu-16-Schwarz-How-Your-DRAM-Becomes-A-Security-Problem.pdf eu-16-Schwarz-How-Your-DRAM-Becomes-A-Security-Problem-wp.pdf eu-16-Schwarz-How-Your-DRAM-Becomes-A-Security-Problem-tool.zip
• Effective File Format Fuzzing – Thoughts Techniques and Results eu-16-Jurczyk-Effective-File-Format-Fuzzing-Thoughts-Techniques-And-Results.pdf
• EGO MARKET: When People's Greed for Fame Benefits Large-Scale Botnets eu-16-Paquet-Clouston-Ego-Market_When-Greed-for-Fame-Benefits-Large-Scale-Botnets.pdf eu-16-Paquet-Clouston-Ego-Market_When-Greed-for-Fame-Benefits-Large-Scale-Botnets-wp.pdf
• Flip Feng Shui: Rowhammering the VM's Isolation eu-16-Razavi-Flip-Feng-Shui-Rowhammering-The-VMs-Isolation.pdf eu-16-Razavi-Flip-Feng-Shui-Rowhammering-The-VMs-Isolation-wp.pdf
• Ghost in the PLC: Designing an Undetectable Programmable Logic Controller Rootkit eu-16-Abbasi-Ghost-In-The-PLC-Designing-An-Undetectable-Programmable-Logic-Controller-Rootkit.pdf eu-16-Abbasi-Ghost-In-The-PLC-Designing-An-Undetectable-Programmable-Logic-Controller-Rootkit-wp.pdf
• GPU Security Exposed eu-16-Taft-GPU-Security-Exposed.pdf
• How to Fool an ADC Part II or Hiding Destruction of Turbine with a Little Help of Signal Processing eu-16-Gonzalez-How-To-Fool-An-ADC-Part-II-Or-Hiding-Destruction-Of-Turbine-With-A-Little-Help-Of-Signal-Processing.pdf
• I Know What You Saw Last Minute - The Chrome Browser Case eu-16-Dubin-I-Know-What-You-Saw-Last-Minute-The-Chrome-Browser-Case.pdf eu-16-Dubin-I-Know-What-You-Saw-Last-Minute-The-Chrome-Browser-Case-WP.pdf
• Inside Web Attacks: The Real Payloads
• Locknote: Conclusions and Key Takeaways from Black Hat Europe 2016
• Mobile Espionage in the Wild: Pegasus and Nation-State Level Attacks eu-16-Bazaliy-Mobile-Espionage-in-the-Wild-Pegasus-and-Nation-State-Level-Attacks.pdf
• Narcos Counterfeiters and Scammers: An Approach to Visualize Illegal Markets eu-16-Lewman-Narcos-Counterfeiters-And-Scammers-An-Approach-To-Visualize-Illegal-Markets.pdf
• Pocket-Sized Badness: Why Ransomware Comes as a Plot Twist in the Cat-Mouse Game eu-16-Maggi-Pocket-sized Badness-Why-Ransomware Comes-as-a-Plot-Twist-in-the-Cat-Mouse-Game.pdf heldroid
• Randomization Can't Stop BPF JIT Spray eu-16-Reshetova-Randomization-Can't-Stop-BPF-JIT-Spray.pdf eu-16-Reshetova-Randomization-Can't-Stop-BPF-JIT-Spray-wp.pdf
• Real-World Post-Quantum Cryptography: Introducing the OpenQuantumSafe Software Project
• Rooting EVERY Android: From Extension to Exploitation eu-16-Shen-Rooting-Every-Android-From-Extension-To-Exploitation.pdf eu-16-Shen-Rooting-Every-Android-From-Extension-To-Exploitation-wp.pdf eu-16-Shen-Rooting-Every-Android-From-Extension-To-Exploitation-wp.pdf
• Signing Into One Billion Mobile App Accounts Effortlessly with OAuth2.0 eu-16-Yang-Signing-Into-Billion-Mobile-Apps-Effortlessly-With-OAuth20.pdf eu-16-Yang-Signing-Into-Billion-Mobile-Apps-Effortlessly-With-OAuth20-wp.pdf
• Stumping the Mobile Chipset eu-16-Donenfeld-Stumping-The-Mobile-Chipset.pdf eu-16-Donenfeld-Stumping-The-Mobile-Chipset-wp.pdf
• Talking Behind Your Back: Attacks and Countermeasures of Ultrasonic Cross-Device Tracking eu-16-Mavroudis-Talking-Behind-Your-Back-Attacks-And-Countermeasures-Of-Ultrasonic-Cross-Device-Tracking.pdf
• Towards a Policy-Agnostic Control-Flow Integrity Implementation eu-16-Sullivan-Towards-A-Policy-Agnostic-Control-Flow-Integrity-Implementation.pdf
• Use-After-Use-After-Free: Exploit UAF by Generating Your Own eu-16-Wen-Use-After-Use-After-Free-Exploit-UAF-By-Generating-Your-Own.pdf eu-16-Wen-Use-After-Use-After-Free-Exploit-UAF-By-Generating-Your-Own-wp.pdf
• When Virtualization Encounter AFL: A Portable Virtual Device Fuzzing Framework with AFL eu-16-Li-When-Virtualization-Encounters-AFL-A-Portable-Virtual-Device-Fuzzing-Framework-With-AFL.pdf eu-16-Li-When-Virtualization-Encounters-AFL-A-Portable-Virtual-Device-Fuzzing-Framework-With-AFL-wp.pdf
• WiFi-Based IMSI Catcher eu-16-OHanlon-WiFi-IMSI-Catcher.pdf
• Witchcraft Compiler Collection: Towards Self Aware Computer Programs eu-16-Brossard-Witchcraft-Compiler-Collection-Towards-Self-Aware-Computer-Programs.pdf eu-16-Brossard-Witchcraft-Compiler-Collection-Towards-Self-Aware-Computer-Programs-wp.pdf

Presentaciones de Ruxcon 2016



Ya podemos acceder a las presentaciones de Ruxcon Security Conference 2016:

• Windows Metafiles: An Analysis of the EMF Attack Surface & Recent Vulnerabilities
• Forcing A Targeted LTE Cellphone Into An Unsafe Network
• $hell on Earth: From Browser to System Compromise
• Demystifying the Secure Enclave Processor
• Strolling into Ring-0 via I/O Kit Drivers
• Rainbow Over the Windows: More Colors Than You Could Expect
• Hacker-Machine Interface - State of the Union for SCADA HMI Vulnerabilities
• Breaking out of QEMU
• Make iOS App more Robust and Security through Fuzzing
• Exploiting COF Vulnerabilities In The Linux Kernel
• Of Mice and Keyboards: On the Security of Modern Wireless Desktop Sets
• Firmware Biopsy: Towards Taming The Lunacy
• Leaking Windows Kernel Pointers
• FRAPL - Next Generation Reverse Engineering Framework
• Documented to Fail
• Writing Malware While The Blue Team Is Staring At You
• Fighting Metamorphism using Deep Neural Network with Fourier
• On Her Majesty’s Secret Service – GRX and a Spy Agency
• Orbiting The Saturn: Investigating A Decades-Old DRM System
• Make Event Tracing Great Again

Golosas iniciativas de Incibe en #CyberCamp16 para programadores



Incibe, el instituto sobre ciberseguridad español, celebra de su segundo evento anual sobre ciberseguridad CyberCamp del 1 al 4 de diciembre en León, España.

Este año, edición 16, trae dos nuevas iniciativas: novedades en el Hackathon y un torneo sobre desarrollo de software seguro.

Un Hackathon o “maratón de hacking”, es una actividad que está muy de moda en los círculos de la programación y el desarrollo de software. Esto no es necesariamente una competición, de hecho muchos grupos de desarrolladores se reúnen de forma mensual o cada X tiempo, para desarrollar aplicaciones para la comunidad, empresas sin ánimo de lucro, etc. En el caso de CyberCamp es una competición por equipos que se llevará a cabo durante los días del evento y cuyo objetivo es crear alguna herramienta nueva o mejorar alguna ya existente. El plazo de inscripción está actualmente abierto hasta el 1 de noviembre. La novedad, es que este año hay un apartado enfocado a los sistemas industriales SCADA, Supervisory Control And Data Acquisition (Supervisión, Control y Adquisición de Datos). Los participantes que se interesen por esta temática recibirán con antelación información adicional sobre la arquitectura de la plataforma industrial a utilizar en el evento. Además de esto y como un aliciente a las nuevas promesas del sector, se otorgaran créditos ECTS a todos los estudiantes universitarios que deseen participar en el evento

Vídeos de DEF CON 24



Junto con las presentaciones de DEF CON 24, ya también tenemos acceso a los vídeos:

• WIFI 204 Insteon, Inste off, Inste open
• WIFI 202 Evil ESP
• WIFI 201 WCTF Day 2 Kickoff
• WIFI 105 Introducing the HackMeRF
• WIFI 104 Handing Full Control of the Radio Spectrum Over to the Machines
• WIFI 103 How Do IBLE Hacking
• WIFI 102 Decoding LoRa Exploring Next Gen Wireless
• WIFI 101 Wireless Capture the Flag Inbrief
• Weaponizing Data Science for Social Engineering Automated E2E spear phishing on Twit
• weaponize your feature codes
• VLAN hopping, ARP poisoning & MITM Attacks in Virtualized Environments
• Use Their Machines Against Them Loading Code with a Copier
• Universal Serial aBUSe Remote physical access attacks
• toxic proxies bypassing HTTPS and VPNs to pwn your online identity
• The Remote Metamorphic Engine Detecting, Evading, Attacking the AI and Reverse Engin
• the next gen of emergency ph0nage
• T1 Jeopardy 2
• T1 Jeopardy 1
• Stumping the Mobile Chipset
• sticky keys to the kingdom
• Stargate Pivoting Through VNC To Own Internal Networks
• so you think you want to be a pentester
• Slouching Towards Utopia The State of the Internet Dream
• Sk3wlDbg Emulating all well many of the things with Ida
• Six Degrees of Domain Admin
• Side channel attacks on high security electronic safe locks
• sentient storage do ssd's have a mind of their own
• secure penetration testing operations
• SE 301 The Live SE Podcast
• SE 205 Advanced Social Engineering Techniques and The Rise of Cyber Scam Industrial
• SE 204 How to Un Work your job Revolutionism Radicals, and Engineering by Committee
• SE 203 SCAM CALL Call Dropped
• SE 202 Total Fail and Bad Mistakes I've Made a Few
• SE 201 Human Hacking You ARE the weakest link
• SE 105 You are being manipulated
• SE 104 US Interrogation Techniques and Social Engineering
• SE 103 7 Jedi Mind Tricks Influence Your Target without a Word
• SE 102 The Wizard of Oz Painting a reality through deception
• SE 101 Does Cultural differences become a barrier for social engineering
• Samsung Pay Tokenized Numbers, Flaws and Issues
• Robot Hacks Video Games How TASBot Exploits Consoles with Custom Controllers
• Retweet to win How 50 lines of Python made me the luckiest guy on Twitter
• Research on the Machines Help the FTC Protect Privacy & Security
• real time bluetooh device detection with blue hydra
• propaganda and you
• Project CITL
• Playing Through the Pain The Impact of Secrets and Dark Knowledge
• Platform Agnostic Kernel Fuzzing
• pin2pwn How to Root an Embedded Linux Box with a Sewing Needle
• Picking Bluetooth Low Energy Locks from a Quarter Mile Away
• phishing without failure and frustration
• PH 301 Packet Hacking Village, Block 5
• PH 202 Packet Hacking Village, Block 4
• PH 201 Packet Hacking Village, Block 3
• PH 102 Packet Hacking Village, Block 2
• PH 101 Packet Hacking Village, Block 1
• network protocol reverse engineering
• Mr Robot Panel
• MouseJack Injecting Keystrokes into Wireless Mice
• mouse jiggler offense and defense
• malware command and control channels a journey into darkness
• Maelstrom are you plaing with a full deck
• Machine Duping Pwning deep learning systems
• LOCK 302 Sesame Style Pad Locks
• LOCK 203 Intro to LockpickingPower
• LOCK 202 Intro to LockpickingPower
• LOCK 201 Intro to LockpickingDuffley
• LOCK 104 Intro to Lock PickingFitzhugh
• LOCK 102 Locking Picking 101
• LOCK 101 Locking Picking 101
• Light Weight Protocol! Serious Equipment! Critical Implications!
• Let's Get Physical Network Attacks Against Physical Security Systems
• Jittery MacGyver Lessons Learned from Building a Bionic Hand out of a Coffee Maker
• I've got 99 Problems, but LittleSnitch ain't one
• IOT 203 Tranewreck More Internet, More Problems
• IOT 202 Reversing and Exploiting Embedded Devices
• IOT 103 Is Your Internet Light On Protecting Consumers In the Age of Connected Every
• IOT 102 Btlejuice The Bluetooth Smart Mitm Framework
• Introduction the Wichcraft Compiler Collection Towards universal code theft
• inexpensive coordinated gsm anomaly detection
• I Fight For The Users, Episode I Attacks Against Top Consumer Products
• How To Remote Control An Airliner Security Flaws in Avionics
• How to overthrow a Government
• How to Make Your Own DEF CON Black Badge
• how to launch or improve your vulnerablitity research game
• how to generate a 4tbs DDOS for $5
• How to do it Wrong Smartphone Antivirus and Security Applications Under Fire
• How to design distributed systems resilient despite malicious participants
• how to build a processor in 10 minutes or less
• Honey Onions Exposing Snooping Tor HSDir Relays Guevara Noubir & Amirali Sanatinia
• Hiding Wookiees in HTTP HTTP smuggling
• HH 301 Basics of EAGLE CAD and PCB design tips
• HH 201 Basic Firmware Extraction
• HH 102 Why Amateur Radio in the Age of the Internet
• HH 101 Building malicious hardware out of analog circuits
• Help, I've got ANTs!!!
• Hacking Next Gen ATM's From Capture to Cashout
• Hacking Hotel Keys and Point of Sale systems
• hacking boarding passes for fun and profit
• Hacker Machine Interface State of the Union for SCADA HMI Vulnerabilities
• Game over, man! Reversing Video Games to Create an Unbeatable AI Player
• frontrunning the frontrunners
• Forcing a Targeted LTE Cellphone into Unsafe Network
• feds and 0days from before hearthbleed to after FBI apple
• Exploiting and attacking seismological networks remotely
• exploit mitigation techniques on iOS
• Examining the Internet's pollution
• esoteric exfiltration
• escaping the sandbox by not breaking it
• Drunk Hacker History Hacker Stories Powered by C2H6O for Fun & Profit
• Drones Hijacking multi dimensional attack vectors & countermeasures
• DIY Nukeproofing a new dig at data mining
• Discovering and Triangulating Rogue Cell Towers
• Direct Memory Attack the Kernel
• Developing Managed Code Rootkits for the Java Runtime Environment
• DEF CON Welcome & Badge Talk
• def con 101 panel III rise of the noobs
• DC 202
• DARPA Cyber Grand Challenge Award Ceremony
• Cyber Who Done It! Attribution Analysis Through Arrest History
• Cyber Grand Shellphish
• Cunning with CNG Soliciting Secrets from Schannel
• Crypto State of the Law
• CP 301 My Usability Goes to 11 A Hacker's Guide to User Experience Research
• CP 203 Catching a cheat practical exercise in code breaking
• CP 202 Blue Coat SSL Visibility Exposed
• CP 103 How to Backdoor Diffie Hellman
• CP 102 Security Logs Aren't Good Enough
• CP 101 Revocation, the Frailty of PKI
• compelled decryption state of the art doctrinal perversions
• Closing Ceremonies
• Cheap Tools for Hacking Heavy Trucks
• CH 201
• CH 301 Understanding Heavy Truck Event Data
• CH 203 Security Flaws in Automotive Immobilizer
• CH 202 Deep Learning on CAN BUS
• CH 103 Hacking the CHV Badge
• CH 102 The Mitsubishi Hack Explained
• CH 101 Vehicle to Infrastructure V2X
• CANSPY A Framework for Auditing CAN Devices
• Can You Trust Autonomous Vehicles Contactless Attacks
• CAN i haz car secret plz
• Bypassing Captive Portals and Limited Networks
• BSODomizer
• Breaking the Internet of Vibrating Things
• BlockFighting with a Hooker BlockfFghter2!
• BIO 305 Attention Hackers Cannabis Needs Your Help!
• BIO 304 Implants
• BIO 303 Hacking Perception
• BIO 302 CrisprCas9 Newest Tools for Biohacking Fun!
• BIO 301 Nootropics Better Living Through Chemistry or Modern Day Prometheus
• BIO 206 Transcranial Direct Current Stimulation Brain Stimulation the Do It Yourself
• BIO 205 Intro to Brain Based Authentication
• BIO 204 The Next Big Thing in Bioterrorism
• BIO 203 The Era of Bio Big Data Benefits and Challenges for Information Security, He
• BIO 202 The Bioethics of BioHacking
• BIO 201 Oday for the Soul
• Beyond the MCSE Red teaming active directory
• Backdooring the Frontdoor
• auditing 6loWPAN networks
• Attacking BaseStations an Odyssey through a Telco's Network
• Ask the EFF
• anti forensics AF
• An introduction to Pinworm man in the middle for your metadata
• All Your Solar Panels are belong to Me
• ADD 3 SDR Tips and Tricks
• ADD 2 Covert Cupid Under 11 Veil Approach for Covert WiFi
• ADD 1 I Amatuer Radio And So Can You!
• Abusing Bleeding Edge Web Standards for AppSec Glory
• A Monitor Darkly Reversing and Exploiting Ubiquitous
• 401 a frame work for managing security allerts
• 101 ways to brick your hardware
• Abusing Smart Cities the dark age of modern mobility

Vídeos de Black Hat USA 2016



Ya también están disponibles de los vídeos de Black Hat USA 2016, así como el material presentado:

• Why This Internet Worked How We Could Lose It and the Role Hackers Play
• A Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land
• The Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android
• Call Me: Gathering Threat Intelligence on Telephony Scams to Detect Fraud
• Applied Machine Learning for Data Exfil and Other Fun Topics
• Canspy: A Platform for Auditing Can Devices
• Dangerous Hare: Hanging Attribute References Hazards Due to Vendor Customization
• Over the Edge: Silently Owning Windows 10's Secure Browser
• How to Make People Click on a Dangerous Link Despite Their Security Awareness
• Certificate Bypass: Hiding and Executing Malware From a Digitally Signed Executable
• Pay No Attention to That Hacker Behind the Curtain: A Look Inside the Black Hat Network
• Drone Attacks on Industrial Wireless: A New Front in Cyber Security
• Hackproofing Oracle Ebusiness Suite
• Using Undocumented CPU Behavior to See Into Kernel Mode and Break Kaslr in the Process
• Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool
• Measuring Adversary Costs to Exploit Commercial Software
• Removing Roadblocks to Diversity
• HEIST: HTTP Encrypted Information Can Be Stolen Through TCP-Windows
• Memory Forensics Using Virtual Machine Introspection for Cloud Computing
• Secure Penetration Testing Operations: Demonstrated Weaknesses in Learning Material and Tools
• Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS
• Towards a Holistic Approach in Building Intelligence to Fight Crimeware
• Subverting Apple Graphics: Practical Approaches to Remotely Gaining Root
• The Remote Malicious Butler Did It!
• Xenpwn: Breaking Paravirtualized Devices
• PWNIE
• An Open Collaborative Effort to Ameliorate Android N-Day Root Exploits
• Understanding HL7 2.X Standards, Pen Testing, and Defending HL7 2.X Messages
• 1000 Ways to Die in Mobile Oauth
• A Retrospective on the Use of Export Cryptography
• Windows 10 Segment Heap Internals
• Abusing Bleeding Edge Web Standards for Appsec Glory
• AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
• Analysis of the Attack Surface of Windows 10 Virtualization-Based Security
• Augmenting Static Analysis Using Pintool: Ablation
• An Insider's Guide to Cyber-Insurance and Security Guarantees
• Cunning With Cng: Soliciting Secrets From Schannel
• Beyond the Mcse: Active Directory for the Security Professional
• Does Dropping Usb Drives in Parking Lots and Other Places Really Work?
• Demystifying the Secure Enclave Processor
• I Came to Drop Bombs: Auditing the Compression Algorithm Weapon Cache
• Breaking Payment Points of Interaction (POI)
• Into the Core: In-Depth Exploration of Windows 10 IoT Core
• Hacking Next-Gen Atms: From Capture to Cashout
• Can You Trust Me Now? An Exploration Into the Mobile Threat Landscape
• Investigating DDOS - Architecture Actors and Attribution
• Intra-Process Memory Protection for Applications on ARM and X86: Leveraging the ELF ABI
• Capturing 0Day Exploits With Perfectly Placed Hardware Traps
• Next-Generation of Exploit Kit Detection By Building Simulated Obfuscators
• HTTP/2 & Quic - Teaching Good Protocols to Do Bad Things
• Pwning Your Java Messaging With Deserialization Vulnerabilities
• Language Properties of Phone Scammers: Cyberdefense At the Level of the Human
• Recover a RSA Private Key From a TLS Session With Perfect Forward Secrecy
• The Linux Kernel Hidden Inside Windows 10
• O-Checker: Detection of Malicious Documents Through Deviation From File Format Specifications
• The Tao of Hardware the Te of Implants
• Access Keys Will Kill You Before You Kill the Password
• Hell on Earth: From Browser to System Compromise
• Discovering and Exploiting Novel Security Vulnerabilities in Apple Zeroconf
• BadWPAD
• Breaking Kernel Address Space Layout Randomization (Kaslr) With Intel TSX
• Airbnbeware: Short Term Rentals Long Term Pwnage
• Account Jumping Post Infection Persistency & Lateral Movement in AWS
• Captain Hook: Pirating Avs to Bypass Exploit Mitigations
• Hardening AWS Environments and Automating Incident Response for AWS Compromises
• Crippling HTTPs With Unholy PAC
• Horse Pill: A New Type of Linux Rootkit
• Design Approaches for Security Automation
• Greatfet: Making Goodfet Great Again
• SGX Secure Enclaves in Practice: Security and Crypto Review
• Using EMET to Disable EMET
• Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing on Twitter
• Viral Video - Exploiting Ssrf in Video Converters
• AVLeak: Fingerprinting Antivirus Emulators for Advanced Malware Evasion
• Windows 10 Mitigation Improvements
• Brute-Forcing Lockdown Harddrive Pin Codes
• Building a Product Security Incident Response Team: Learnings From the Hivemind
• Bad for Enterprise: Attacking BYOD Enterprise Mobile Security Solutions
• Cyber War in Perspective: Analysis From the Crisis in Ukraine
• Breaking Fido: Are Exploits in There?
• Security Through Design - Making Security Better By Designing for People
• Iran's Soft-War for Internet Dominance
• Side-Channel Attacks on Everyday Applications
• The Risk From Power Lines: How to Sniff the G3 and Prime Data and Detect the Interfere Attack
• Unleash the Infection Monkey: A Modern Alternative to Pen-Tests
• OSS Security Maturity: Time to Put on Your Big Boy Pants!
• Watching Commodity Malware Get Sold to a Targeted Actor
• PanGu 9 Internals
• A Lightbulb Worm?
• BadTunnel: How Do I Get Big Brother Power?
• PLC-Blaster: A Worm Living Solely in the PLC
• A Risk-Based Approach for Defining User Training and Awarding Administrative Privileges
• Dungeons Dragons and Security
• The Year in Flash
• Dark Side of the DNS Force
• VoIP Wars: the Phreakers Awaken
• Keystone Engine: Next Generation Assembler Framework
• Pindemonium: A DBI-Based Generic Unpacker for Windows Executable
• Web Application Firewalls: Analysis of Detection Logic
• Defense At Hyperscale: Technologies and Policies for a Defensible Cyberspace

Vídeos de GrrCON 2016



Ya tenemos acceso a los vídeos de las charlas de GrrCON 2016, celebrada en Michigan los pasados 6 y 7 de octubre.

• 116 Security Guards LOL Brent White Tim Roberts
• 115 Attacking the Hospitality and Gaming Industries Tracking an Attacker Around the World in 7 Years
• 318 Welcome to The World of Yesterday Tomorrow Joel Cardella
• 317 On being an Eeyore in Infosec Stefan Edwards
• 217 Phish your employees for fun Kristoffer Marshall
• 216 Binary Ninja Jared Demott
• 316 Piercing the Air Gap Network Steganography for Everyone John Ventura
• 315 So Youve Inherited a Security Department Now What Amanda Berlin
• 215 Whats in your Top Ten Intelligent Application Security Prioritization Tony Miller
• 214 Tales from the Cryptanalyst Jeff Man
• 114 Breaking Android Apps for Fun and Profit Bill Sempf
• 113 Back to the Future Understanding our future but following the past Kevin Johnson
• 313 Alignment of business and IT Security Shane Harsch
• 213 Money Fame Power Build your success as a security professional Nathan Dragun
• 212 Machine Duping Pwning Deep Learning Systems Clarence Chio
• 211 Magnetic Stripes 101 Tyler Keeton
• 112 Guarding Lunch J Wolfgang Goerlich
• 111 Predator to Prey Tracking Criminals with Trojans and Data Mining for Fun and Profit Ken Westin
• 110 and bad mistakes Ive made a few Jayson Street
• 312 Contracting Privacy Security and 3rd Party Nathan Steed Kenneth Coleman
• 312 Contracting Privacy Security and 3rd Party Nathan Steed Kenneth Coleman
• 110 and bad mistakes Ive made a few Jayson Street (only first 30 min or so)
• 210 Encryption Mobility Cloud Oh My Bill Harmer
• 209 Using Virus Total Intelligence to track the latest Phishing Document campaigns Wyatt Roersma
• 311 Stop attacking your mothers car Charles Parker II
• 208 Cruise Ship Pentesting OR Hacking the High Seas Chad M Dewey
• 207 Quick and Easy Windows Timelines with Pyhon MySQL and Shell Scripting Dr Phil Polstra
• 310 How to Implement Crypto Poorly Sean Cassidy
• 309 Reality Checking Your AppSec Program Darren Meyer
• 308 Bad Guys Look Just Like You Justin Beard
• 205 Threat Detection Response with Hipara J Brett Cunningham
• 204 Reversing and Exploiting Embedded Devices Walking the software and hardware stack Elvis Collado
• 203 Surreal Paradigms Automotive Culture Crash D0xt0r Z3r0
• 108 Secure Dicks Michael Kemp
• 206 still broken after all these years aka utility security for smarties doug nibbelink
• 307 Getting to the Root of Advanced Threats Before Impact Josh Fazio
• 306 Fighting the Enemy Within Matt Crowe
• 305 How Do You Secure What You Dont Control Dimitri Vlachos
• 304 Pentester to customerI will 0wn your network Customer to pentesterNo I will make you cry David F
• 303 Make STEHM Great Again David HealWHans Schwartzberg
• 205 Threat Detection Response with Hipara J Brett Cunningham
• 204 Reversing and Exploiting Embedded Devices Walking the software and hardware stack Elvis Collado
• 203 Surreal Paradigms Automotive Culture Crash D0xt0r Z3r0
• 105 Abnormal Behavior Detection in Large Environments Dave Kennedy
• 302 Five Nights At Freddys What We Can Learn About Security From Possessed Bears Nick Jacob
• 300 Securing Trust Defending Against Next generation Attacks John Muirhead Gould
• 202 What do you mean Im pwnd I turned on automatic updates Scott Thomas Jeff Baruth
• 201 So You Want to Be a Pentester Absolute0x0
• 200 Internet of Things IoT radio frequency RF Analysis With Software Defined Radio Kevin Bong
• 103 Becoming a Cyborg The First Step Into Implantable Technology Michael Vieau
• 102 Weaponizing Nanotechnology and hacking humans defining the boundaries Chris Roberts
• 100 Act Three The Evolution of Privacy Finux

 

Presentaciones de LinuxCon Europa 2016



Del 4 al 6 de octubre se ha celebrado la LinuxCon edición Europa en Berlín, Alemania. Como puedes imaginar ésta, es una conferencia alrededor del kernel de Linux. Desde la web de la Fundación Linux puedes acceder a dichas presentaciones, que a continuación listo:

• Linux Kernel Security Update
• Ceph and Flash
• Efficient kernel backporting
• Making More Open: Creating open source infrastructure for your open source project
• Flowgrind: a TCP traffic generator for developers
• Efficient unit test and fuzz tools for kernel/libc porting
• Adding CPU frequency scaling for your ARM platform to Linux kernel
• entry_*.S: A carefree stroll through kernel entry code
• The Set of Programmers: How Math Restricts Us
• Why you hate security, and what you can do about it.
• The world of 100G Networking
• lguest: A journey of learning the Linux kernel internals
• Gender-Diversity Analysis of Technical Contributions to the Linux Kernel
• Chrome OS running Android in a container
• ELK: a log files management framework
• Bringing Android Explicit Fencing to Mainline: A new era for graphics
• Solving the Paradox: Less Downtime - More Security
• Application Profiling and Tuning – Or How I Stopped Worrying and Learned to Love the Tweak
• Using the Linux Tracing Infrastructure
• Deploying pNFS over Distributed File Storage
• Outreachy kernel internship report
• Strategic use of Free Software at Siemens
• Reimagining OpenStack
• Locking Down your systemd Services
• How Linux keeps mission critical application up 24x7
• Persistent Memory usage within Linux environment
• How Google Uses and Contributes to Open Source
• Linux DRM: new picture processing API
• openQA - Avoiding Disasters of Biblical Proportions
• Boosting Enterprise Transaction Processing using Hardware Acceleration
• Geo-Replication and Disaster recovery for cloud object storage with Ceph Rados Gateway
• Linux-Kernel Memory Ordering: Help Arrives At Last!
• Real life example of scaling load balancing using open source on commodity hardware
• Tutorial on Persistent Memory Programming with NVML
• Extending programming languages with persistent memory semantics
• PM Infrastructure in the Linux Kernel - Current Status and Future
• Open Enterprise & Open Community - Empowering Each Other
• If You Build It, They Won't Come
• NorNet -- Building an Inter-Continental Internet Testbed based on Open Source Software
• Clang: Much more than just a C/C++ compiler
• Tracking huge files with Git LFS
• Persistent Memory Extensions to libstdc++/libc++
• Graphite@Scale or How to store millon metrics per second
• Kernel Development - I still think we have a scaling problem
• Documenting Your Software Supply Chain with Linked Data

[Finished in 0.8s]

Vídeos de Derbycon 2016



Ya tenemos disponibles los vídeos (faltan algunos) de una de las conferencias que más ha crecido en los últimos años: Derbycon. La edición de este año 2016 acaba de terminar y nos ha dejado un gran número de charlas interesantes:

• Key Note - Jeffrey Snover, Lee Holmes
• Carlos Perez - Thinking Purple
• Ed Skoudis - Internet of Things, Voice Control, AI, and Office Automation: BUILDING YOUR VERY OWN J.A.R.V.I.S.
• David Maloney, James Lee, Brent Cook, Tod Beardsley, Lance Sanchez - Metasploit Townhall
• Parker Schmitt - Data Obfuscation: How to hide data and payloads to make them "not exist"
• Jason Smith - Go with the Flow
• Devon Greene - Abusing RTF: Evasion, Exploitation and Counter Measures
• Mubix "Rob" Fuller - Writing malware while the blue team is staring at you
• Christopher Hadnagy - Mind Reading for Fun and Profit using DISC
• JDuck - Stagefright: An Android Exploitation Case Study
• Arian J Evans & James Pleger - Top 10 2015-2016 compromise patterns observed & how to use non-traditional Internet datasets to detect & avoid them
• Aaron Lafferty - Information Security Proposed Solutions Series - 1. Talent
• Alfredo Ramirez - DNSSUX
• Tyler Halfpop , Jacob Soo - Macs Get Sick Too
• Joe Desimone - Hunting for Exploit Kits
• Stephen Breen, Chris Mallz - Rotten Potato - Privilege Escalation from Service Accounts to SYSTEM
• Nick Cano - +1,000,000 -0: Cloning a Game Using Game Hacking and Terabytes of Data
• Wartortell and Aaron Bayles - Nose Breathing 101: A Guide to Infosec Interviewing
• William McLaughlin - Android Patchwork
• Will Schroeder, Matt Nelson - A Year in the Empire
• Kevin Johnson and Jason Gillam - Next Gen Web Pen Testing: Handling modern applications in a penetration test
• Ken Johnson, Chris Gates - DevOops Redux
• Ryan Voloch and Peter Giannoutsos - To Catch a Penetration Tester: Top SIEM Use Cases
• Spencer McIntyre - Is that a penguin in my Windows?
• Brent White && Tim Roberts - Real World Attacks VS Check-box Security
• Ben0xA - PowerShell Secrets and Tactics
• Michael Allen - Beyond The ?Cript: Practical iOS Reverse Engineering
• Jayson E. Street - .... and bad mistakes I've made a few.....
• Matthew Dunwoody, Nick Carr - No Easy Breach: Challenges and Lessons from an Epic Investigation
• Natalie Vanatta - ARRR Maties! A map to the legal hack-back
• Michael Wharton, Project MVP - Hacking and Protecting SharePoint
• Marcello Salvati - CrackMapExec - Owning Active Directory by using Active Directory
• Rockie Brockway & Adam Hogan - Adaptation of the Security Sub-Culture
• Zach Grace, Brian Genz - Better Network Defense Through Threat Injection and Hunting
• nyxgeek - Hacking Lync (or, 'The Weakest Lync')
• Kevin Gennuso - Responder for Purple Teams
• Ken Toler - Metaprogramming in Ruby and doing it wrong.
• Paul Coggin - Exploiting First Hop Protocols to Own the Network
• Nick Landers - Outlook and Exchange for the Bad Guys
• Valerie Thomas and Harry Regan - It's Never So Bad That It Can't Get Worse
• Nathan Clark - AWSh*t. Pay-as-you-go Mobile Penetration Testing
• Nancy Snoke - Evolving your Office's Security Culture
• Michael Schearer - Confronting Obesity in Infosec
• Mark Mager - Defeating The Latest Advances in Script Obfuscation
• Michael Gough - From Commodity to Advanced (APT) malware, are automated malware analysis sandboxes as useful as your own basic manual analysis?
• Tim MalcomVetter - Breaking Credit Card Tokenization Without Cryptanalysis
• Bill V – Privileged Access Workstations (PAWs)
• Scott Lyons and Joshua Marpet - Business Developement: The best non-four letter dirty word in infosec.
• Scot Berner, Jason Lang - Tool Drop 2.0 - Free As In Pizza
• Joseph Tegg - We're a Shooting Gallery, Now What?
• Doug Burns - Malicious Office Doc Analysis for EVERYONE!
• Sean Metcalf & Will Schroeder - Attacking EvilCorp: Anatomy of a Corporate Hack
• Matt Graeber, Jared Atkinson - Living Off the Land 2: A Minimalist's Guide to Windows Defense
• Kyle Wilhoit - Point of Sale Voyuer- Threat Actor Attribution Through POS Honeypots
• Jeremy Mio, David Lauer, Mike Woolard - The Art of War, Attacking the Organization and Raising the Defense
• Justin Herman & Anna-Jeannine Herman - The 1337 Gods of Geek Mythology
• Josh Huff - Open Source Intelligence - What I learned by being an OSINT creeper
• Jay Beale - Phishing without Failure and Frustration
• Larry Pesce - I don't give one IoTA: Introducing the Internet of Things Attack Methodology.
• Anti-Forensics AF int0x80 (of Dual Core)
• Deral Heiland, Matthew Kienow - Managed to Mangled: Exploitation of Enterprise Network Management Systems
• Joey Maresca - Finding Your Balance
• EvilMog - Hashcat State of the Union
• egypt - New Shiny in Metasploit Framework
• Hacking with Ham Radios: What I have learned in 25 years of being a ham.
• John Strand - Penetration Testing Trends
• Ellen Hartstack and Matthew Sullivan - Garbage in, garbage out
• Casey Smith - Establishing A Foothold With JavaScript
• Jesika McEvoy - Overcoming Imposter Syndrome (even if you're totally faking it)
• FuzzyNop - Embrace the Bogeyman: Tactical Fear Mongering for Those Who Penetrate
• Eric Conrad - Introducing DeepBlueCLI, a PowerShell module for hunt teaming via Windows event logs
• Dr. Jared DeMott & Mr. Josh Stroschein - Using Binary Ninja for Modern Malware Analysis
• Scott M - Fuzzing basics...how to break software
• Craig Bowser - Security v. Ops: Bridging the Gap
• Chris "Lopi" Spehn - From Gaming to Hacking The Planet
• Jason Blanchard - How to Social Engineer your way into your dream job!
• Lee Holmes - Attackers Hunt Sysadmins - It's time to fight back
• Adam Compton, Austin Lane - Scripting Myself Out of a Job - Automating the Penetration Test with APT2
• Branden Miller - Hacking for Homeschoolers: STEM projects for under $20
• Scott Sutherland - SQL Server Hacking on Scale using PowerShell
• Brian Marks, Andrea Sancho Silgado - Dive into DSL: Digital Response Analysis with Elasticsearch
• David Schwartzberg and Chris Sistrunk - Make STEHM Great Again
• Charles L. Yost - Python 3: It's Time
• Philip Martin - DNS in Enterprise IR: Collection, Analysis and Response
• Drew Branch - Need More Sleep? REST Could Help
• Bill Gardner - Making Our Profession More Professional
• Abe Miller - How are tickets paid for?
• Bill Sempf - Breaking Android Apps for Fun and Profit
• Amanda Berlin & Lee Brotherston - So You've Inherited a Security Department, Now What?
• Brandon Young - Reverse engineering all the malware... and why you should stop.
• Nathan Magniez - Body Hacking 101 (or a Healthy Lifestyle for Security Pros)
• Jimmy Byrd - Security Automation in your Continuous Integration Pipeline
• Chad M. Dewey - Cruise Ship Security OR Hacking the High Seas
• Karl Fosaaen - Attacking ADFS Endpoints with PowerShell
• Stephen Hilt - The 90's called, they want their technology back
• Lee Neely - Web Security for Dummies
• Kirk Hayes - I Love myBFF (Brute Force Framework)
• Cameron Craig, Keith Conway - Nobody gets fired by choosing IBM... but maybe they should.
• Mirovengi - Shackles, Shims, and Shivs - Understanding Bypass Techniques
• Jared Haight - Introducing PowerShell into your Arsenal with PS>Attack
• James Jardine - Recharging Penetration Testing to Maximize Value
• hypervista - Poetically Opaque (or other John Updike Quotes)
• David Boyd - Hack Yourself: Building A Pentesting Lab
• Ronnie Flathers - Abusing Linux Trust Relationships: Authentication Back Alleys and Forgotten Features
• Salvador Mendoza - Samsung Pay: Tokenized Numbers, Flaws and Issues
• Andrew Krug & Alex McCormack - Hardening AWS Environments and Automating Incident Response
• Andrew Plunkett - Yara Rule QA: Can't I Write Code to do This for Me?
• Anthony Kasza - Java RATS: Not even your Macs are safe
• Beau Bullock, Derek Banks, Joff Thyer - The Advanced Persistent Pentester (All Your Networks Are Belong 2 Us)
• Russell Butturini - Fire Away! Sinking the Next Gen Firewall
• Daniel Bohannon - Invoke-Obfuscation: PowerShell obFUsk8tion Techniques & How To (Try To) D""e`Tec`T 'Th'+'em'
• Dav Wilson - Mobile Device Forensics
• Casey Cammilleri & Hans Lakhan - Hashview, a new tool aimed to improve your password cracking endeavors.
• Brian Fehrman - Hardware Hacking the Easyware Way
• Matthew Lichtenberger - PacketKO - Data Exfiltration Via Port Knocking
• Jamie Murdock - Ransomware: An overview
• Ben Stillman - MariaDB: Lock it down like a chastity belt
• Aaron Guzman - IoT Defenses - Software, Hardware, Wireless and Cloud
• Adam Cammack & Brent Cook - Static PIE: How and Why
• Braden Hollembaek, Adam Pond - Finding a Weak Link: Attacking Windows OEM Kernel Drivers
• Dan Bougere - The Beginner's Guide to ICS: How to Never Sleep Soundly Again

RootedCON Valencia 2016

El congreso RootedValencia se celebrará los días 9 y 10 de Septiembre. El viernes día 9 tendrá lugar un training llamado "RB16-1 Hacking ético" (pulsa aquí para más información) y durante el sábado día 10 se celebrarán conferencias desde las 10am hasta las 8pm. Nosotros estaremos por allí el sábado para saludar a viejos y nuevos amigos, disfrutar de las conferencias y además tomar algunas cervezas ;)

Lugar: ADEIT - Fundación Universidad - Plaza Virgen de la Paz, 3, 46001 Valencia (España)

Material de USENIX Security 2016



Otra de las conferencias referentes sobre seguridad, USENIX Security 2016, ha publicado el material presentado:

• Flip Feng Shui: Hammering a Needle in the Software Stack - PDF
• One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks and Privilege Escalation - PDF - Slides
• PIkit: A New Kernel-Independent Processor-Interconnect Rootkit - PDF - Slides
• Verifying Constant-Time Implementations - PDF
• Secure, Precise, and Fast Floating-Point Operations on x86 Processors - PDF - Slides
• überSpark: Enforcing Verifiable Object Abstractions for Automated Compositional Security Analysis of a Hypervisor - PDF
• Undermining Information Hiding (and What to Do about It) - PDF
• Poking Holes in Information Hiding - PDF
• What Cannot Be Read, Cannot Be Leveraged? Revisiting Assumptions of JIT-ROP Defenses - PDF - Slides
• zxcvbn: Low-Budget Password Strength Estimation - PDF - Slides
• Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks - PDF - Slides
• An Empirical Study of Textual Key-Fingerprint Representations - PDF
• Off-Path TCP Exploits: Global Rate Limit Considered Dangerous - PDF
• Website-Targeted False Content Injection by Network Operators - PDF
• The Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered Blackhat SEO - PDF - Slides
• A Comprehensive Measurement Study of Domain Generating Malware - PDF
• Enhancing Bitcoin Security and Performance with Strong Consistency via Collective Signing - PDF - Slides
• Faster Malicious 2-Party Secure Computation with Online/Offline Dual Execution - PDF - Slides
• Egalitarian Computing - PDF
• Post-quantum Key Exchange—A New Hope - PDF
• Automatically Detecting Error Handling Bugs Using Error Specifications - PDF
• APISan: Sanitizing API Usages through Semantic Cross-Checking - PDF
• On Omitting Commits and Committing Omissions: Preventing Git Metadata Tampering That (Re)introduces Software Vulnerabilities - PDF
• Defending against Malicious Peripherals with Cinch - PDF - Slides
• Making USB Great Again with USBFILTER - PDF - Slides
• Micro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks - PDF
• Request and Conquer: Exposing Cross-Origin Resource Size - PDF
• Trusted Browsers for Uncertain Times - PDF
• Tracing Information Flows Between Ad Exchanges Using Retargeted Ads - PDF - Slides
• Virtual U: Defeating Face Liveness Detection by Building Virtual Models from Your Public Photos - PDF - Slides
• Hidden Voice Commands - PDF - Slides
• FlowFence: Practical Data Protection for Emerging IoT Application Frameworks - PDF
• ARMageddon: Cache Attacks on Mobile Devices - PDF - Slides
• DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks - PDF - Slides
• An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries - PDF - Slides
• Stealing Machine Learning Models via Prediction APIs - PDF - Slides
• Oblivious Multi-Party Machine Learning on Trusted Processors - PDF
• Thoth: Comprehensive Policy Compliance in Data Retrieval Systems - PDF - Slides
• Dancing on the Lip of the Volcano: Chosen Ciphertext Attacks on Apple iMessage - PDF
• Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys - PDF
• DROWN: Breaking TLS Using SSLv2 - PDF - Slides
• All Your Queries Are Belong to Us: The Power of File-Injection Attacks on Searchable Encryption - PDF - Slides
• Investigating Commercial Pay-Per-Install and the Distribution of Unwanted Software - PDF
• Measuring PUP Prevalence and PUP Distribution through Pay-Per-Install Services - PDF - Slides
• UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware - PDF - Slides
• Towards Measuring and Mitigating Social Engineering Software Download Attacks - PDF - Slides
• Specification Mining for Intrusion Detection in Networked Control Systems - PDF - Slides
• Optimized Invariant Representation of Network Traffic for Detecting Unseen Malware Variants - PDF - Slides
• Authenticated Network Time Synchronization - PDF
• fTPM: A Software-Only Implementation of a TPM Chip - PDF
• Sanctum: Minimal Hardware Extensions for Strong Software Isolation - PDF - Slides
• Ariadne: A Minimal Approach to State Continuity - PDF
• The Million-Key Question—Investigating the Origins of RSA Public Keys - PDF - Slides
• Fingerprinting Electronic Control Units for Vehicle Intrusion Detection - PDF - Slides
• Lock It and Still Lose It —on the (In)Security of Automotive Remote Keyless Entry Systems - PDF
• OblivP2P: An Oblivious Peer-to-Peer Content Sharing System - PDF
• AuthLoop: End-to-End Cryptographic Authentication for Telephony over Voice Channels - PDF
• You Are Who You Know and How You Behave: Attribute Inference Attacks via Users' Social Friends and Behaviors - PDF
• Internet Jones and the Raiders of the Lost Trackers: An Archaeological Study of Web Tracking from 1996 to 2016 - PDF
• Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability Notification - PDF - Slides
• You've Got Vulnerability: Exploring Effective Vulnerability Notifications - PDF
• Mirror: Enabling Proofs of Data Replication and Retrievability in the Cloud - PDF
• ZKBoo: Faster Zero-Knowledge for Boolean Circuits - PDF
• The Cut-and-Choose Game and Its Application to Cryptographic Protocols - PDF - Slides
• On Demystifying the Android Application Framework: Re-Visiting Android Permission Specification Analysis - PDF - Slides
• Practical DIFC Enforcement on Android - PDF - Slides
• Screen after Previous Screens: Spatial-Temporal Recreation of Android App Displays from Memory Images - PDF
• Harvesting Inconsistent Security Configurations in Custom Android ROMs via Differential Analysis - PDF
• Identifying and Characterizing Sybils in the Tor Network - PDF - Slides
• k-fingerprinting: A Robust Scalable Website Fingerprinting Technique - PDF
• Protecting Privacy of BLE Device Users - PDF - Slides
• Privacy in Epigenetics: Temporal Linkability of MicroRNA Expression Profiles - PDF - Slides

Presentaciones de DEF CON 24



Una vez más una de las conferencias sobre seguridad informática ha llegado a su fin: DEF CON 24. Por ahora, se han puesto disponible las diapositivas y algún material extra de las presentaciones que se pudieron presenciar.

• Amro-Abdelgawad-Extras/
• Jonathan-Brossard-Extras/
• Lucas-Lundgren-Extras/
• Mike-Rich-Extras/
• Regilero-Extras/
• Robert-Olson-Extras/
• Seymour-Tully-Extras/
• SixVolts-and-Haystack-Extras/
• Wesley-McGrew-Extras/
• 3alarmlampscoot-DIY-Nukeproofing.pdf
• Adam-Donenfeld-Stumping-The-Mobile-Chipset.pdf
• Allan-Cecil-dwangoAC-Tasbot-The-Perfectionist.pdf
• Amro-Abdelgawad-The-Remote-Metamorphic-Engine.pdf
• Anch-So-you-want-to-be-a-pentester-DC101.pdf
• Anto-Joseph-Fuzzing-Android-Devices.pdf
• Arnaud-Soullie-Workshop-Pentesting-ICS-101.pdf
• Ashmastaflash-Sitch-Inexpensive-Coordinated-GSM-Anomaly-Detection-Writeup.pdf
• Ashmastaflash-Sitch-Inexpensive-Coordinated-GSM-Anomaly-Detection.pdf
• Benjamin-Holland-Developing-Managed-Code-Rootkits-For-Java-Runtime.pdf
• Bertin-Bervis-James-Jara-Exploiting-And-Attacking-Seismological-Networks-Remotely.pdf
• Bigezy-Saci-Pinworm-MITM-for-Metadata.pdf
• Brad-Dixon-Pin2Pwn-How-to-Root-An-Embedded-Linux-Box-With-A-Sewing-Needle.pdf
• Brad-Woodberg-Malware-Command-And-Control-Channels-A-Journey-Into-Darkness.pdf
• Bryant-Zadegan-Ryan-Lester-Abusing-Bleeding-Edge-Web-Standards-For-Appsec-Glory.pdf
• Chapman-Stone-Toxic-Proxies-Bypassing-HTTPS-and-VPNs.pdf
• Chris-Rock-How-to-overthrow-a-Government-Kuwait-Coup-WP.pdf
• Chris-Rock-How-to-overthrow-a-Government.pdf
• Clarence-Chio-Machine-Duping-101.pdf
• Demay-Auditing-6LoWPAN-Networks-Using-Standard-Penetration-Testing-Tools-WP.pdf
• Demay-Auditing-6LoWPAN-Networks-Using-Standard-Penetration-Testing-Tools.pdf
• Demay-Lebrun-Canspy-A-Platorm-For-Auditing-Can-Devices.pdf
• Dr-Phil-Polstra-Mouse-Jigglers.pdf
• Drake-Christey-Vulnerabilities-101.pdf
• Eagle-Sk3Wldbg-Emulating-with-Ida.pdf
• Eric-Escobar-Rogue-Cell-Towers.pdf
• Evan-Booth-Jjittery-Macgyver.pdf
• Fasel-Jacobs-I-fight-for-the-users.pdf
• Fitzpatrick-and-Grand-101-Ways-To-Brick-Your-Hardware.pdf
• Forgety-Kreilein-Ng9-1-1-The-Next-Gene-Of-Emergency-Ph0Nage.pdf
• Fred-Bret-Mounet-All-Your-Solar-Panels-Are-Belong-To-Me.pdf
• Gorenc-Sands-Hacker-Machine-Interface.pdf
• Granolocks-Zero-Chaos-Bluehydra-Realtime-Blutetooth-Detection.pdf
• Grant-Bugher-Captive-Portals.pdf
• Guevara-Noubir-Amirali-Sanatinia-Honey-Onions-Exposing-Snooping-Tor-Hsdir-Relays-WP.pdf
• Guevara-Noubir-Amirali-Sanatinia-Honey-Onions-Exposing-Snooping-Tor-Hsdir-Relays.pdf
• Hendrik-Schmidt-Brian-Butter-Attacking-BaseStations.pdf
• Huber-Rasthofer-Smartphone-Antivirus-And-Security-Applications-Under-Fire.pdf
• Hunter-Scott-Rt2Win-The-Luckiest-Guy-On-Twitter.pdf
• Int0X80-Anti-Forensics-AF.pdf
• Jay-Beale-Larry-Pesce-Phishing-without-Frustration.pdf
• Jennifer-Granick-Slouching-Towards-Utopia.pdf
• Jkambic-Cunning-With-Cng-Soliciting-Secrets-From-Schannel-WP.pdf
• Jkambic-Cunning-With-Cng-Soliciting-Secrets-From-Schannel.pdf
• Jmaxxz-Backdooring-the-Frontdoor-Bypass-Cert-Pinning.pdf
• Jmaxxz-Backdooring-the-Frontdoor-Extracting-Secrets-From-Log.pdf
• Jmaxxz-Backdooring-the-Frontdoor.pdf
• Joe-Grand-Zoz-BSODomizerHD.pdf
• Jonathan-Brossard-Intro-to-Witchcraft-Compiler.pdf
• Karyn-Benson-Examining-The-Internets-Pollution.pdf
• Klijnsma-Tentler-Stargate-Pivoting-Through-VNC.pdf
• Ladar-Levison-Compelled-Decryption.pdf
• Liu-Yan-Xu-Can-You-Trust-Autonomous-Vehicles-WP.pdf
• Liu-Yan-Xu-Can-You-Trust-Autonomous-Vehicles.pdf
• Lucas-Lundgren-Light-Weight Protocol-Critical-Implications.pdf
• Luke-Young-The-4TbS-Ddos-For-5-bucks.pdf
• Maldonado-Mcguffin-Sticky-Keys-To-The-Kingdom.pdf
• Marc-Newlin-MouseJack-Injecting-Keystrokes-Into-Wireless-Mice-WP.pdf
• Marc-Newlin-MouseJack-Injecting-Keystrokes-Into-Wireless-Mice.pdf
• Max-Bazaliy-A-Journey-Through-Exploit-Mitigation-Techniques-On-Ios.pdf
• Mcsweeny-Cranor-Research-On-The-Machines.pdf
• Mike-Rich-Use-Their-Machines-Against-Them-WP.pdf
• Mike-Rich-Use-Their-Machines-Against-Them.pdf
• Nick-Rosario-Weaponize-Your-Feature-Codes.pdf
• Panel-How-To-Make-A-DEFCON-Black-Badge.pdf
• Patrick-Wardle-99-Problems-Little-Snitch.pdf
• Plore-Side-Channel-Attacks-On-High-Security-Electronic-Safe-Locks.pdf
• Przemek-Jaroszewski-How-To-Get-Good-Seats-In-The-Security-Theater.pdf
• Radia-Perlman-Resilience-Despite-Malicious-Pariticpants.pdf
• Regilero-Hiding-Wookiees-In-Http.pdf
• Ricky-Lawshae-Lets-Get-Physical.pdf
• Robbins-Vazarkar-Schroeder-Six-Degrees-of-Domain-Admin.pdf
• Robert-Olson-Writing-Your-First-Exploit.pdf
• Rogan-Dawes-Dominic-White-Universal-Serial-aBUSe-Remote-Attacks.pdf
• Rose-Ramsey-Picking-Bluetooth-Low-Energy-Locks.pdf
• Salvador-Mendoza-Samsung-Pay-Tokenized-Numbers-WP.pdf
• Salvador-Mendoza-Samsung-Pay-Tokenized-Numbers.pdf
• Sean-Metcalf-Beyond-The-MCSE-Red-Teaming-Active-Directory.pdf
• Seymour-Tully-Weaponizing-Data-Science-For-Social-Engineering-WP.pdf
• Seymour-Tully-Weaponizing-Data-Science-For-Social-Engineering.pdf
• Shane-Steiger-Maelstrom-Are-You-Playing-With-A-Full-Deck-V14-Back.pdf
• Shane-Steiger-Maelstrom-Rules-V10.pdf
• SixVolts-and-Haystack-Cheap-Tools-For-Hacking-Heavy-Trucks.pdf
• Tamas-Szakaly-Help-I-got-ANTS.pdf
• Thomas-Wilhelm-Hacking-Network-Protocols-Using-Kali.pdf
• Thomas-Wilhelm-Intrusion-Prevention-System-Evasion-Techniques.pdf
• Tim-Estell-Katea-Murray-NPRE-Eavesdropping-on-the-Machines-Literature-Survey.pdf
• Tim-Estell-Katea-Murray-NPRE-Eavesdropping-on-the-Machines.pdf
• Tom-Kopchak-SSD-Forensics-Research-WP.pdf
• Tom-Kopchak-Sentient-Storage.pdf
• Ulf-Frisk-Direct-Memory-Attack-the-Kernel.pdf
• Wesley-McGrew-Secure-Penetration-Testing-Operations-WP.pdf
• Wesley-McGrew-Secure-Penetration-Testing-Operations.pdf
• Willa-Riggins-Esoteric-Exfiltration.pdf
• Zhang-Shan-Forcing-Targeted-Lte-Cellphone-Into-Unsafe-Network.pdf
• Zhong-Lee-411-A-Framework-For-Managing-Security-Alerts.pdf
• the-bob-ross-fan-club-Propaganda-and-you.pdf

Material de Black Hat USA 2016



Para pasar las tardes de verano, ya tenemos disponible la mayoría del material presentado en Black Hat USA 2016:

• $hell on Earth: From Browser to System Compromise us-16-Molinyawe-Shell-On-Earth-From-Browser-To-System-Compromise.pdf
• 1000 Ways to Die in Mobile OAuth us-16-Tian-1000-Ways-To-Die-In-Mobile-OAuth.pdf us-16-Tian-1000-Ways-To-Die-In-Mobile-OAuth-wp.pdf
• A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf
• A Lightbulb Worm? us-16-OFlynn-A-Lightbulb-Worm.pdf us-16-OFlynn-A-Lightbulb-Worm-wp.pdf
• Abusing Bleeding Edge Web Standards for AppSec Glory us-16-Zadegan-Abusing-Bleeding-Edge-Web-Standards-For-AppSec-Glory.pdf
• Access Keys Will Kill You Before You Kill the Password us-16-Simon-Access-Keys-Will-Kill-You-Before-You-Kill-The-Password.pdf
• Account Jumping Post Infection Persistency & Lateral Movement in AWS us-16-Amiga-Account-Jumping-Post-Infection-Persistency-And-Lateral-Movement-In-AWS.pdf us-16-Amiga-Account-Jumping-Post-Infection-Persistency-And-Lateral-Movement-In-AWS-wp.pdf
• Adaptive Kernel Live Patching: An Open Collaborative Effort to Ameliorate Android N-Day Root Exploits us-16-Zhang-Adaptive-Kernel-Live-Patching-An-Open-Collaborative-Effort-To-Ameliorate-Android-N-Day-Root-Exploits.pdf us-16-Zhang-Adaptive-Kernel-Live-Patching-An-Open-Collaborative-Effort-To-Ameliorate-Android-N-Day-Root-Exploits-wp.pdf
• AirBnBeware: Short Term Rentals Long Term Pwnage us-16-Galloway-AirBnBeware-Short-Term-Rentals-Long-Term-Pwnage.pdf
• AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It us-16-Mittal-AMSI-How-Windows-10-Plans-To-Stop-Script-Based-Attacks-And-How-Well-It-Does-It.pdf
• An AI Approach to Malware Similarity Analysis: Mapping the Malware Genome With a Deep Neural Network us-16-Berlin-An-AI-Approach-To-Malware-Similarity-Analysis-Mapping-The-Malware-Genome-With-A-Deep-Neural-Network.pdf
• Analysis of the Attack Surface of Windows 10 Virtualization-Based Security us-16-Wojtczuk-Analysis-Of-The-Attack-Surface-Of-Windows-10-Virtualization-Based-Security.pdf us-16-Wojtczuk-Analysis-Of-The-Attack-Surface-Of-Windows-10-Virtualization-Based-Security-wp.pdf
• Applied Machine Learning for Data Exfil and Other Fun Topics us-16-Wolff-Applied-Machine-Learning-For-Data-Exfil-And-Other-Fun-Topics.pdf
• Attacking SDN Infrastructure: Are We Ready for the Next-Gen Networking? us-16-Yoon-Attacking-SDN-Infrastructure-Are-We-Ready-For-The-Next-Gen-Networking.pdf
• AVLeak: Fingerprinting Antivirus Emulators for Advanced Malware Evasion us-16-Bulazel-AVLeak-Fingerprinting-Antivirus-Emulators-For-Advanced-Malware-Evasion.pdf
• Bad for Enterprise: Attacking BYOD Enterprise Mobile Security Solutions us-16-Tan-Bad-For-Enterprise-Attacking-BYOD-Enterprise-Mobile-Security-Solutions.pdf us-16-Tan-Bad-For-Enterprise-Attacking-BYOD-Enterprise-Mobile-Security-Solutions-wp.pdf us-16-Tan-Bad-For-Enterprise-Attacking-BYOD-Enterprise-Mobile-Security-Solutions-tool.zip
• badWPAD us-16-Goncharov-BadWpad.pdf us-16-Goncharov-BadWpad-wp.pdf
• Beyond the MCSE: Active Directory for the Security Professional us-16-Metcalf-Beyond-The-MCSE-Active-Directory-For-The-Security-Professional.pdf us-16-Metcalf-Beyond-The-MCSE-Active-Directory-For-The-Security-Professional-wp.pdf
• Blunting the Phisher's Spear: A Risk-Based Approach for Defining User Training and Awarding Administrative Privileges us-16-Vishwanath-Blunting-The-Phishers-Spear-A-Risk-Based-Approach-For-Defining-User-Training-And-Awarding-Administrative-Privileges.pdf us-16-Vishwanath-Blunting-The-Phishers-Spear-A-Risk-Based-Approach-For-Defining-User-Training-And-Awarding-Administrative-Privileges-wp.pdf
• Breaking FIDO: Are Exploits in There? us-16-Chong-Breaking-FIDO-Are-Exploits-In-There.pdf
• Breaking Hardware-Enforced Security with Hypervisors us-16-Sharkey-Breaking-Hardware-Enforced-Security-With-Hypervisors.pdf
• Breaking Kernel Address Space Layout Randomization (KASLR) with Intel TSX us-16-Jang-Breaking-Kernel-Address-Space-Layout-Randomization-KASLR-With-Intel-TSX.pdf us-16-Jang-Breaking-Kernel-Address-Space-Layout-Randomization-KASLR-With-Intel-TSX-wp.pdf
• Breaking Payment Points of Interaction (POI) us-16-Valtman-Breaking-Payment-Points-of-Interaction.pdf
• Brute-Forcing Lockdown Harddrive PIN Codes us-16-OFlynn-Brute-Forcing-Lockdown-Harddrive-PIN-Codes.pdf
• Building Trust & Enabling Innovation for Voice Enabled IoT us-16-Terwoerds-Building-Trust-&-Enabling-Innovation-For-Voice-Enabled-IoT.pdf
• Call Me: Gathering Threat Intelligence on Telephony Scams to Detect Fraud us-16-Marzuoli-Call-Me-Gathering-Threat-Intelligence-On-Telephony-Scams-To-Detect-Fraud.pdf us-16-Marzuoli-Call-Me-Gathering-Threat-Intelligence-On-Telephony-Scams-To-Detect-Fraud-wp.pdf
• Can You Trust Me Now? An Exploration into the Mobile Threat Landscape us-16-Thomas-Can-You-Trust-Me-Now.pdf
• CANSPY: A Platform for Auditing CAN Devices us-16-Demay-CANSPY-A-Platorm-For-Auditing-CAN-Devices.pdf us-16-Demay-CANSPY-A-Platorm-For-Auditing-CAN-Devices-wp.pdf
• Captain Hook: Pirating AVs to Bypass Exploit Mitigations us-16-Yavo-Captain-Hook-Pirating-AVs-To-Bypass-Exploit-Mitigations.pdf us-16-Yavo-Captain-Hook-Pirating-AVs-To-Bypass-Exploit-Mitigations-wp.pdf
• Capturing 0day Exploits with PERFectly Placed Hardware Traps us-16-Pierce-Capturing-0days-With-PERFectly-Placed-Hardware-Traps.pdf us-16-Pierce-Capturing-0days-With-PERFectly-Placed-Hardware-Traps-wp.pdf
• Certificate Bypass: Hiding and Executing Malware from a Digitally Signed Executable us-16-Nipravsky-Certificate-Bypass-Hiding-And-Executing-Malware-From-A-Digitally-Signed-Executable-wp.pdf
• Crippling HTTPS with Unholy PAC us-16-Kotler-Crippling-HTTPS-With-Unholy-PAC.pdf
• Cunning with CNG: Soliciting Secrets from Schannel us-16-Kambic-Cunning-With-CNG-Soliciting-Secrets-From-SChannel.pdf us-16-Kambic-Cunning-With-CNG-Soliciting-Secrets-From-SChannel-wp.pdf
• Cyber War in Perspective: Analysis from the Crisis in Ukraine us-16-Geers-Cyber-War-In-Perspective-Analysis-From-The-Crisis-In-Ukraine.pdf us-16-Geers-Cyber-War-In-Perspective-Analysis-From-The-Crisis-In-Ukraine-wp.pdf
• Dangerous Hare: Hanging Attribute References Hazards Due to Vendor Customization us-16-Zhang-Dangerous-Hare-Hanging-Attribute-References-Hazards-Due-To-Vendor-Customization.pdf
• Dark Side of the DNS Force us-16-Wu-Dark-Side-Of-The-DNS-Force.pdf
• Defense at Hyperscale: Technologies and Policies for a Defensible Cyberspace us-16-Healey-Defense-At-Hyperscale-Technologies-And-Policies-For-A-Defensible-Cyberspace.pdf us-16-Healey-Defense-At-Hyperscale-Technologies-And-Policies-For-A-Defensible-Cyberspace-wp.pdf
• Demystifying the Secure Enclave Processor us-16-Mandt-Demystifying-The-Secure-Enclave-Processor.pdf
• Discovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf us-16-Bai-Discovering-And-Exploiting-Novel-Security-Vulnerabilities-In-Apple-Zeroconf.pdf
• Does Dropping USB Drives in Parking Lots and Other Places Really Work? us-16-Bursztein-Does-Dropping-USB-Drives-In-Parking-Lots-And-Other-Places-Really-Work.pdf
• Drone Attacks on Industrial Wireless: A New Front in Cyber Security us-16-Melrose-Drone-Attacks-On-Industrial-Wireless-A-New-Front-In-Cyber-Security.pdf
• Dungeons Dragons and Security us-16-Romand-Latapie-Dungeons-Dragons-And-Security.pdf us-16-Romand-Latapie-Dungeons-Dragons-And-Security-wp.pdf
• Exploiting Curiosity and Context: How to Make People Click on a Dangerous Link Despite Their Security Awareness us-16-Benenson-Exploiting-Curiosity-And-Context-How-To-Make-People-Click-On-A-Dangerous-Link-Despite-Their-Security-Awareness.pdf
• GATTacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool us-16-Jasek-GATTacking-Bluetooth-Smart-Devices-Introducing-a-New-BLE-Proxy-Tool.pdf us-16-Jasek-GATTacking-Bluetooth-Smart-Devices-Introducing-a-New-BLE-Proxy-Tool-wp.pdf
• GreatFET: Making GoodFET Great Again us-16-Ossmann-GreatFET-Making-GoodFET-Great-Again.pdf us-16-Ossmann-GreatFET-Making-GoodFET-Great-Again-wp.pdf
• Hacking Next-Gen ATMs: From Capture to Cashout us-16-Hecker-Hacking-Next-Gen-ATMs-From-Capture-To-Cashout.pdf
• Hackproofing Oracle eBusiness Suite us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite.pdf us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite-wp-1.pdf us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite-wp-2.pdf us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite-wp-3.pdf us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite-wp-4.pdf us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite-wp-5.pdf
• Hardening AWS Environments and Automating Incident Response for AWS Compromises us-16-Krug-Hardening-AWS-Environments-And-Automating-Incident-Response-For-AWS-Compromises.pdf us-16-Krug-Hardening-AWS-Environments-And-Automating-Incident-Response-For-AWS-Compromises-wp.pdf
• HEIST: HTTP Encrypted Information can be Stolen Through TCP-Windows us-16-VanGoethem-HEIST-HTTP-Encrypted-Information-Can-Be-Stolen-Through-TCP-Windows.pdf us-16-VanGoethem-HEIST-HTTP-Encrypted-Information-Can-Be-Stolen-Through-TCP-Windows-wp.pdf
• Horse Pill: A New Type of Linux Rootkit us-16-Leibowitz-Horse-Pill-A-New-Type-Of-Linux-Rootkit.pdf
• HTTP Cookie Hijacking in the Wild: Security and Privacy Implications us-16-Sivakorn-HTTP-Cookie-Hijacking-In-The-Wild-Security-And-Privacy-Implications.pdf us-16-Sivakorn-HTTP-Cookie-Hijacking-In-The-Wild-Security-And-Privacy-Implications-wp.pdf
• HTTP/2 & QUIC - Teaching Good Protocols To Do Bad Things us-16-Pearce-HTTP2-&-QUIC-Teaching-Good-Protocols-To-Do-Bad-Things.pdf us-16-Pearce-HTTP2-&-QUIC-Teaching-Good-Protocols-To-Do-Bad-Things-code.zip
• I Came to Drop Bombs: Auditing the Compression Algorithm Weapon Cache us-16-Marie-I-Came-to-Drop-Bombs-Auditing-The-Compression-Algorithm-Weapons-Cache.pdf
• Into The Core - In-Depth Exploration of Windows 10 IoT Core us-16-Sabanal-Into-The-Core-In-Depth-Exploration-Of-Windows-10-IoT-Core.pdf us-16-Sabanal-Into-The-Core-In-Depth-Exploration-Of-Windows-10-IoT-Core-wp.pdf
• Intra-Process Memory Protection for Applications on ARM and x86: Leveraging the ELF ABI us-16-Bratus-Intra-Process-Memory-Protection-For-Applications-On-ARM-And-x86.pdf us-16-Bratus-Intra-Process-Memory-Protection-For-Applications-On-ARM-And-x86-wp.pdf
• Iran's Soft-War for Internet Dominance us-16-Guarnieri-Iran-And-The-Soft-War-For-Internet-Dominance.pdf us-16-Guarnieri-Iran-And-The-Soft-War-For-Internet-Dominance-wp.pdf
• Language Properties of Phone Scammers: Cyberdefense at the Level of the Human us-16-Tabron-Language-Properties-Of-Phone-Scammers-Cyberdefense-At-The-Level-Of-The-Human.pdf
• Measuring Adversary Costs to Exploit Commercial Software: The Government-Bootstrapped Non-Profit C.I.T.L.
• Memory Forensics Using Virtual Machine Introspection for Cloud Computing us-16-Zillner-Memory-Forensics-Using-VMI-For-Cloud-Computing.pdf
• Next-Generation of Exploit Kit Detection by Building Simulated Obfuscators us-16-Luo-Next-Generation-Of-Exploit-Kit-Detection-By-Building-Simulated-Obfuscator.pdf us-16-Luo-Next-Generation-Of-Exploit-Kit-Detection-By-Building-Simulated-Obfuscator-wp.pdf
• Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS us-16-Devlin-Nonce-Disrespecting-Adversaries-Practical-Forgery-Attacks-On-GCM-In-TLS.pdf us-16-Devlin-Nonce-Disrespecting-Adversaries-Practical-Forgery-Attacks-On-GCM-In-TLS-wp.pdf
• O-checker: Detection of Malicious Documents Through Deviation from File Format Specifications us-16-Otsubo-O-checker-Detection-of-Malicious-Documents-through-Deviation-from-File-Format-Specifications.pdf us-16-Otsubo-O-checker-Detection-of-Malicious-Documents-through-Deviation-from-File-Format-Specifications-wp.pdf us-16-Otsubo-O-checker-Detection-of-Malicious-Documents-through-Deviation-from-File-Format-Specifications-tool.zip
• OSS Security Maturity: Time to Put On Your Big Boy Pants! us-16-Kouns-OSS-Security-Maturity-Time-To-Put-On-Your-Big-Boy-Pants.pdf
• Pangu 9 Internals us-16-Wang-Pangu-9-Internals.pdf
• PINdemonium: A DBI-Based Generic Unpacker for Windows Executable us-16-Mariani-Pindemonium-A-Dbi-Based-Generic-Unpacker-For-Windows-Executables.pdf us-16-Mariani-Pindemonium-A-Dbi-Based-Generic-Unpacker-For-Windows-Executables-wp.pdf
• PLC-Blaster: A Worm Living Solely in the PLC us-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC.pdf us-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf
• Pwning Your Java Messaging with Deserialization Vulnerabilities us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities.pdf us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-jmet-src-0.1.0.tar.bz2
• Recover a RSA Private Key from a TLS Session with Perfect Forward Secrecy us-16-Ortisi-Recover-A-RSA-Private-Key-From-A-TLS-Session-With-Perfect-Forward-Secrecy.pdf us-16-Ortisi-Recover-A-RSA-Private-Key-From-A-TLS-Session-With-Perfect-Forward-Secrecy-wp.pdf us-16-Ortisi-Recover-A-RSA-Private-Key-From-A-TLS-Session-With-Perfect-Forward-Secrecy-tools.zip
• Samsung Pay: Tokenized Numbers Flaws and Issues us-16-Mendoza-Samsung-Pay-Tokenized-Numbers-Flaws-And-Issues.pdf us-16-Mendoza-Samsung-Pay-Tokenized-Numbers-Flaws-And-Issues-wp.pdf
• Secure Penetration Testing Operations: Demonstrated Weaknesses in Learning Material and Tools us-16-McGrew-Secure-Penetration-Testing-Operations-Demonstrated-Weaknesses-In-Learning-Material-And-Tools.pdf us-16-McGrew-Secure-Penetration-Testing-Operations-Demonstrated-Weaknesses-In-Learning-Material-And-Tools-wp.pdf us-16-McGrew-Secure-Penetration-Testing-Operations-Demonstrated-Weaknesses-In-Learning-Material-And-Tools-snagterpreter.py
• Security Through Design - Making Security Better by Designing for People us-16-Niemantsverdriet-Security-Through-Design-Making-Security-Better-By-Designing-For-People.pdf
• SGX Secure Enclaves in Practice: Security and Crypto Review us-16-Aumasson-SGX-Secure-Enclaves-In-Practice-Security-And-Crypto-Review.pdf us-16-Aumasson-SGX-Secure-Enclaves-In-Practice-Security-And-Crypto-Review-wp.pdf
• Side-Channel Attacks on Everyday Applications us-16-Hornby-Side-Channel-Attacks-On-Everyday-Applications.pdf us-16-Hornby-Side-Channel-Attacks-On-Everyday-Applications-wp.pdf
• Subverting Apple Graphics: Practical Approaches to Remotely Gaining Root us-16-Chen-Subverting-Apple-Graphics-Practical-Approaches-To-Remotely-Gaining-Root.pdf us-16-Chen-Subverting-Apple-Graphics-Practical-Approaches-To-Remotely-Gaining-Root-wp.pdf
• TCP Injection Attacks in the Wild - A Large Scale Study us-16-Nakibly-TCP-Injection-Attacks-in-the-Wild-A-Large-Scale-Study.pdf us-16-Nakibly-TCP-Injection-Attacks-in-the-Wild-A-Large-Scale-Study-wp.pdf us-16-Nakibly-TCP-Injection-Attacks-in-the-Wild-A-Large-Scale-Study-samples.zip
• The Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android us-16-Kralevich-The-Art-Of-Defense-How-Vulnerabilities-Help-Shape-Security-Features-And-Mitigations-In-Android.pdf
• The Art of Reverse Engineering Flash Exploits us-16-Oh-The-Art-of-Reverse-Engineering-Flash-Exploits.pdf us-16-Oh-The-Art-of-Reverse-Engineering-Flash-Exploits-wp.pdf
• The Beast Within - Evading Dynamic Malware Analysis Using Microsoft COM us-16-Hund-The-Beast-Within-Evading-Dynamic-Malware-Analysis-Using-Micro.pdf
• The Remote Malicious Butler Did It! us-16-Beery-The-Remote-Malicious-Butler-Did-It.pdf us-16-Beery-The-Remote-Malicious-Butler-Did-It-wp.pdf
• The Risk from Power Lines: How to Sniff the G3 and Prime Data and Detect the Interfere Attack us-16-Lei-The-Risk-From-Power-Lines-How-To-Sniff-The-G3-And-Prime-Data-And-Detect-The-Interfere-Attack.pdf us-16-Lei-The-Risk-From-Power-Lines-How-To-Sniff-The-G3-And-Prime-Data-And-Detect-The-Interfere-Attack-wp.pdf
• The Tao of Hardware the Te of Implants us-16-FitzPatrick-The-Tao-Of-Hardware-The-Te-Of-Implants.pdf us-16-FitzPatrick-The-Tao-Of-Hardware-The-Te-Of-Implants-wp.pdf
• The Year in Flash us-16-Silvanovich-The-Year-In-Flash.pdf
• Timing Attacks Have Never Been So Practical: Advanced Cross-Site Search Attacks us-16-Gelernter-Timing-Attacks-Have-Never-Been-So-Practical-Advanced-Cross-Site-Search-Attacks.pdf
• Using an Expanded Cyber Kill Chain Model to Increase Attack Resiliency us-16-Malone-Using-An-Expanded-Cyber-Kill-Chain-Model-To-Increase-Attack-Resiliency.pdf
• Using EMET to Disable EMET us-16-Alsaheel-Using-EMET-To-Disable-EMET.pdf
• Using Undocumented CPU Behavior to See into Kernel Mode and Break KASLR in the Process us-16-Fogh-Using-Undocumented-CPU-Behaviour-To-See-Into-Kernel-Mode-And-Break-KASLR-In-The-Process.pdf us-16-Fogh-Using-Undocumented-CPU-Behaviour-To-See-Into-Kernel-Mode-And-Break-KASLR-In-The-Process-wp.pdf
• Viral Video - Exploiting SSRF in Video Converters us-16-Ermishkin-Viral-Video-Exploiting-Ssrf-In-Video-Converters.pdf
• VOIP WARS: The Phreakers Awaken us-16-Ozavci-VoIP-Wars-The-Phreakers-Awaken.pdf us-16-Ozavci-VoIP-Wars-The-Phreakers-Awaken.rb
• Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing on Twitter us-16-Seymour-Tully-Weaponizing-Data-Science-For-Social-Engineering-Automated-E2E-Spear-Phishing-On-Twitter.pdf us-16-Seymour-Tully-Weaponizing-Data-Science-For-Social-Engineering-Automated-E2E-Spear-Phishing-On-Twitter-wp.pdf us-16-Seymour-Tully-Weaponizing-Data-Science-For-Social-Engineering-Automated-E2E-Spear-Phishing-On-Twitter-tool.zip
• Web Application Firewalls: Analysis of Detection Logic us-16-Ivanov-Web-Application-Firewalls-Analysis-Of-Detection-Logic.pdf
• What's the DFIRence for ICS? us-16-Sistrunk-Triplett-Whats-The-DFIRence-For-ICS.pdf
• When Governments Attack: State Sponsored Malware Attacks Against Activists Lawyers and Journalists us-16-Quintin-When-Governments-Attack-State-Sponsored-Malware-Attacks-Against-Activists-Lawyers-And-Journalists.pdf us-16-Quintin-When-Governments-Attack-State-Sponsored-Malware-Attacks-Against-Activists-Lawyers-And-Journalists-wp.pdf
• When the Cops Come A-Knocking: Handling Technical Assistance Demands from Law Enforcement us-16-Granick-When-The-Cops-Come-A-Knocking-Handling-Technical-Assistance-Demands-From-Law-Enforcement.pdf
• Windows 10 Mitigation Improvements us-16-Weston-Windows-10-Mitigation-Improvements.pdf
• Windows 10 Segment Heap Internals us-16-Yason-Windows-10-Segment-Heap-Internals.pdf us-16-Yason-Windows-10-Segment-Heap-Internals-wp.pdf
• Xenpwn: Breaking Paravirtualized Devices us-16-Wilhelm-Xenpwn-Breaking-Paravirtualized-Devices.pdf us-16-Wilhelm-Xenpwn-Breaking-Paravirtualized-Devices-wp.pdf

Vídeos de HOPE XI



Ayer terminó la conferencia organizada por el grupo de 2600, HOPE XI (Hackers On Planet Earth). La mayoría de los vídeos ya están disponibles.

Hubo tres pistas (tracks) en paralelo: (desde el mismo player puedes hacer cambiar los vídeos derecha/izquierda)

Lamarr:

Noether:

Friedman:

Vídeos de OWASP AppSec Europe 2016



Se han publicado los vídeos de las charlas de OWASP Europe 2016 celebrada en Roma. La lista de las charlas publicadas es la siguiente:

• Abhay Bhargav - SecDevOps: A View from the Trenches
• A. Brucker, S. Dashevskyi, F. Massacci - Using Third Party Components for building a
• Adam Muntner - Open Source Approaches to Security for Applications and Services at Mo
• Ajin Abraham - Automated Mobile Application Security Assessment with MobSF
• Amol Sarwate - 2016 State of Vulnerability Exploits
• Andreas Falk - Building secure cloud - native applications with spring boot and spring
• Arne Swinnen - The Tales of a Bug Bounty Hunter - 10 Interesting Vulnerabilities
• B. Stock, B. Kaiser, S. Lekies, S. Pfistner - From Facepalm to Brain Bender
• Chris Romeo - AppSec Awareness - A Blue Print for Security Culture Change
• C. Mainka, C. Spth, V. Mladenov - From DTD to XXE - An Evaluation of XML - Parsers
• C. Mainka, V. Mladenov, T. Wich - Systematically Breaking and Fixing OpenID Connect
• Christian Schneider, Alvaro Muoz - Surviving the Java serialization apocalypse
• Christian Wressnegger - Analyzing and Detecting Flash - based Malware
• Dan Cornell - The ABCs of Source-Assisted Web Application Penetration Testing
• Daniel Kefer, Rene Reuter - Addressing Security Requirements in Development Projects
• David Lindner, Jack Mannino - Dont Touch Me That Way
• David Rook - Leveling up your application security program
• Dinis Cruz - Using JIRA to manage Risks and Security Champions activities
• Dirk Wetter - Calm down HTTPS is not a VPN
• Felix Leder - Bug Hunting on the Dark Side
• Giancarlo Pellegrino - Compression Bombs Strike Back
• Glen ten Cate - OWASP Security Knowledge Framework - Making the web secure by design
• Grant McCracken, Shpend Kurtishaj - Running a bug bounty - what you need to know.
• Ikka Turunen - A chain of trust-How to implement a supply chain approach to build and
• Jacky Fox - Attracting and retaining women in Cyber Security
• Jakub Kaluzny - Big problems with big data - Hadoop interfaces security
• Johannes Dahse - Static Code Analysis of Complex PHP Application Vulnerabilities
• John Dickson - Making OpenSAMM More Effective in a DevOps World
• John Kozyrakis - Everything You Need to Know About Certificate Pinning But Are Too
• Jonathan Kuskos - The Top 10 Web Hacks of 2015
• J. Rose, R. Sulatycki - Grow up AppSec-A case study of maturity models and metrics
• Julia Knecht - SAASY SPLC
• Liesbeth Kempen - Idiot proof is not enough make it villain proof
• L. Compagna, A. Sudhodanan, A. Armando, R. Carbone - Attack Patterns for Black-Box Det
• Marisa Fagan - The Cool Factor - Securitys Secret Weapon
• Matthias Rohr - Practical Threat Modeling with Microsofts Threat Modeling Tool 2016
• Michele Spagnuolo, Lukas Weichselbaum - Making CSP great again
• Mike West - Keynote - Hardening the Web Platform
• Oliver Lavery - Framework Security - Have You Hugged A Developer Today
• Rob van der Veer - Grip on SSD - Dutch government standard for outsourcing secure
• Scott Davis - Scanning with swagger - Using the Open API specification to find first
• Sebastian Lekies - Securing AngularJS Applications
• Simone Onofri - Security Project Management - how to be Agile in
• Tobias Gondrom - OWASP CISO Survey Report Tactical Insights for Managers
• Tom Van Goethem - The Timing Attacks They Are a - Changin
• Tony Uceda Velez - Attack tree vignettes for Containers as a Service applications and
• Wojtek Dworakowski - Internet banking safeguards vulnerabilities
• Yair Amit - Why Hackers Are Winning The Mobile Malware Battle - Bypassing

Material de Hack In The Box Amsterdam 2016



Aquí os dejo para el fin de semana el material publicado de la Hack In The Box 2016 celebrada en Amsterdam:

• CLOSING KEYNOTE - Sophia D Antoine - Hardware Side Channels in Virtualized Environments.pdf
• D1 COMMSEC - Elisabeth de Leeuw - Unformation in the Era of Hyper Connectivity.pdf
• D1 COMMSEC - Marc Newlin - Applying Regulatory Data to IoT RF Reverse Engineering.pdf
• D1 COMMSEC - Martin Knobloch - Don't Feed the Hippos.pdf
• D1 COMMSEC - Nadav Markus and Gal De Leon - Exploiting GLIBC - Hacking Everything.pdf
• D1T1 - Jacob Torrey - Using the Observer Effect and Cyber Fengshui.pdf
• D1T1 - Lin Huang - Forcing a Targeted LTE Cellphone into an Eavesdropping Network.pdf
• D1T1 - Nick Biasini - Exploit Kits - Hunting the Hunters .pdf
• D1T1 - Radu Caragea - Peering into the Depths of TLS Traffic in Real Time.pdf
• D1T1 - Shengping Wang and Xu Liu - Escape From The Docker-KVM-QEMU Machine.pdf
• D1T1 - Tang Qing Hao - Virtualization System Vulnerability Discovery Framework.pdf
• D1T2 - Broderick Aquilino and Wayne Low - Kernel Exploit Hunting and Mitigation.pdf
• D1T2 - Chilik Tamir - Profiting from iOS Malware.pdf
• D1T2 - Michele Spagnuolo and Lukas Weichselbaum - CSP Oddities.pdf
• D1T2 - Seunghun Han - Create Your Own Bad USB Device.pdf
• D1T2 - Tim Xia - Adaptive Android Kernel Live Patching.pdf
• D1T2 - Yann Allain and Julien Moinard - Hardsploit Project.pdf
• D1T3 - Gustavo Grieco - Vulnerability Discovery Using Machine Learning.pdf
• D1T3 LABS - Anto Joseph - Droid-FF.pdf
• D1T3 LABS - Tony Trummer and Tushar Dalvi - Mobile Application Security for iOS and Android.zip
• D2 COMMSEC - Mattijs van Ommeren - A Series Of Unfortunate Events - Where Malware Meets Murphy.pdf
• D2T1 - Anders Fogh - Cache Side Channel Attacks.pdf
• D2T1 - Felix Wilhelm - Attacking Next Generation Firewalls.pdf
• D2T1 - Jun Li - CANSsee - An Automobile Intrusion Detection System.pdf
• D2T1 - Yuwei Zheng and Haoqi Shan - Forging a Wireless Time Signal to Attack NTP Servers.pdf
• D2T1 Itzik Kotler and Amit Klein - The Perfect Exfiltration Technique.pdf
• D2T2 - Mikhail Egorov and Sergey Soldatov - New Methods for Exploiting ORM Injections in Java Applications.pdf
• D2T2 - Peter blasty Geissler - Breaking Naive ESSID WPA2 Key Generation Algorithms.pdf
• D2T2 - Richard Johnson - Go Speed Tracer - Guided Fuzzing.pdf
• D2T2 - Shangcong Luan - Xen Hypervisor VM Escape.pdf
• D2T2 - Wish Wu - Perf - From Profiling to Kernel Exploiting.pdf
• D2T3 LABS - Matteo Beccaro - Electronic Access Control Security.pdf
• KEYNOTE 1 - John Adams - Beyond FBI v Apple.pdf
• KEYNOTE 2 - Adam Laurie - The Future Has Arrived and it's Effin Hilarious.odp

Presentaciones de CanSecWest 2016



Ya se ha publicado el material de las presentaciones dadas en CanSecWest 2016, celebrada en Vancouver, Canadá:

• Csw2016 freingruber bypassing_application_whitelisting
• Csw2016 chen grassi-he-apple_graphics_is_compromised
• Csw2016 song li-smart_wars
• Csw2016 tang virtualization_device emulator testing technology
• Csw2016 macaulay eh_trace-rop_hooks
• Csw2016 d antoine_automatic_exploitgeneration
• Csw2016 gawlik bypassing_differentdefenseschemes
• Csw2016 wang docker_escapetechnology
• Csw2016 gong pwn_a_nexus_device_with_a_single_vulnerability
• Csw2016 wheeler barksdale-gruskovnjak-execute_mypacket
• Csw2016 economou nissim-getting_physical
• Csw2016 chaykin having_funwithsecuremessengers_and_androidwear
• Csw2016 julien moinard-hardsploit
• Csw2016 evron sysman_apt_reports_and_opsec_evolution
• Csw2016 li xu-bad_winmail_and_emailsecurityoutlook_final
• Csw2016 nicolas joly-0_days_exploits_and_bug_bounties

Vídeos de DeepSec 2015



Después de que se publicara el material de DeepSec 2015, ahora también tenemos los vídeos disponibles:

[DS15] ZigBee Smart Homes – A Hacker’s Open House - Tobias Zillner, Florian Eichelberger [DS15] The German Data Privacy Laws and IT Security - Stefan Schumacher [DS15] Revisiting SOHO Router Attacks [DS15] Remote Browser Based Fingerprinting of Local Network Devices - Manfred Kaiser [DS15] Not so Smart - On Smart TV Apps - Marcus Niemietz [DS15] 50 Shades of WAF Exemplified at Barracuda & Sucuri - Ashar Javed [DS15] Yes, Now YOU Can Patch That Vulnerability Too! Mitja Kolsek [DS15] Visualizing Wi Fi Packets the Hacker’s Way - Milan Gabor [DS15] Temet Nosce - Know thy Endpoint Through and Through; Processes to Data - Thomas Fischer [DS15] Measuring the TOR Network - Jens Kubieziel [DS15] Keynote Can Societies manage the SIGINT Monster - Duncan Campbell [DS15] illusoryTLS Nobody But Us Impersonate,Tamper and Exploit - Alfonso De Gregorio [DS15] IntelMQ - L. Aaron Kaplan [DS15] How to Break XML Encryption – Automatically – Juraj Somorovsky [DS15] HORNET High speed Onion Routing at the Network Layer - Chen Chen [DS15] Have We Penetrated Yet?? - Johnny Deutsch [DS15] HackingTeam – How They Infected Your Android Device By 0days - Attila Marosi [DS15] Hacking Cookies in Modern Web Applications and Browsers - Dawid Czagan [DS15] File Format Fuzzing in Android Giving a Stagefright to the Android Installer [DS15] Extending a Legacy Platform Providing a Minimalistic, Secure Single Sign On Library [DS15] Agile Security The Good, The Bad, and mostly the Ugly - Daniel Liber [DS15] Bridging the Air Gap Data Exfiltration from Air Gap Networks - [DS15] Building a Better Honeypot Network - Josh Pyorre [DS15] Chw00t How To Break Out from Various Chroot Solutions - Balazs Bucsay [DS15] Continuous Intrusion Why CI Tools Are an Attacker’s Best Friends - Nikhil Mittal [DS15] Cryptographic Enforcement of Segregation of Duty within Work Flows - Thomas Maus [DS15] Cryptography Tools, Identity Vectors for ‘Djihadists’ - Julie Gommes [DS15] Deactivating Endpoint Protection Software in an Unauthorized Manner Matthias Deeg [DS15] DDoS Barbarians at the Gateway - Dave Lewis [DS15] Cyber Cyber Cyber Warfare Mistakes from the MoDs – Raoul Chiesa [DS15] A Case Study on the Security of Application Whitelisting René Freingruber [DS15] A Death in Athens The inherent Vulnerability of “Lawful Intercept” Programs James Bamford [DS15] Advanced SOHO Router Exploitation - Lyon Yang [DS15] Legal Responses Against Cyber Incidents - Oscar Serrano

Material de Black Hat Asia 2016



Una de las conferencias sobre seguridad referente a nivel mundial, Black Hat, ya ha publicado el material de la edición Asia 2016.

• Devaluing Attack: Disincentivizing Threats Against the Next Billion Devices
• A New CVE-2015-0057 Exploit Technology asia-16-Wang-A-New-CVE-2015-0057-Exploit-Technology.pdf asia-16-Wang-A-New-CVE-2015-0057-Exploit-Technology-wp.pdf
• Android Commercial Spyware Disease and Medication asia-16-Saad-Android-Commercial-Spyware-Disease-And-Medication.pdf asia-16-Saad-Android-Commercial-Spyware-Disease-And-Medication-wp.pdf
• Automated Detection of Firefox Extension-Reuse Vulnerabilities
• Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces asia-16-Costin-Automated-Dynamic-Firmware-Analysis-At-Scale-A-Case-Study-On-Embedded-Web-Interfaces.pdf asia-16-Costin-Automated-Dynamic-Firmware-Analysis-At-Scale-A-Case-Study-On-Embedded-Web-Interfaces-wp.pdf
• Break Out of the Truman Show: Active Detection and Escape of Dynamic Binary Instrumentation asia-16-Sun-Break-Out-Of-The-Truman-Show-Active-Detection-And-Escape-Of-Dynamic-Binary-Instrumentation.pdf
• Bypassing Browser Security Policies for Fun and Profit asia-16-Baloch-Bypassing-Browser-Security-Policies-For-Fun-And-Profit.pdf asia-16-Baloch-Bypassing-Browser-Security-Policies-For-Fun-And-Profit-wp.pdf
• CANtact: An Open Tool for Automotive Exploitation
• DSCompromised: A Windows DSC Attack Framework asia-16-Kazanciyan-DSCompromised-A-Windows-DSC-Attack-Framework.pdf
• Enterprise Apps: Bypassing the iOS Gatekeeper asia-16-Bashan-Enterprise-Apps-Bypassing-The-iOS-Gatekeeper.pdf asia-16-Bashan-Enterprise-Apps-Bypassing-The-iOS-Gatekeeper-wp.pdf
• Exploiting Linux and PaX ASLR's Weaknesses on 32-bit and 64-bit Systems asia-16-Marco-Gisbert-Exploiting-Linux-And-PaX-ASLRS-Weaknesses-On-32-And-64-Bit-Systems.pdf asia-16-Marco-Gisbert-Exploiting-Linux-And-PaX-ASLRS-Weaknesses-On-32-And-64-Bit-Systems-wp.pdf
• Hacking a Professional Drone asia-16-Rodday-Hacking-A-Professional-Drone.pdf
• Hey Your Parcel Looks Bad - Fuzzing and Exploiting Parcel-ization Vulnerabilities in Android asia-16-He-Hey-Your-Parcel-Looks-Bad-Fuzzing-And-Exploiting-Parcelization-Vulnerabilities-In-Android.pdf asia-16-He-Hey-Your-Parcel-Looks-Bad-Fuzzing-And-Exploiting-Parcelization-Vulnerabilities-In-Android-wp.pdf
• I'm Not a Human: Breaking the Google reCAPTCHA asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA.pdf asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf
• Incident Response @ Scale - Building a Next Generation SOC asia-16-Cohen-Incident-Response-At-Scale-Building-A-Next-Generation-SOC.pdf
• Let's See What's Out There - Mapping the Wireless IoT asia-16-Zillner-Complete-Lets-See-Whats-Out-There-Mapping-The-Wireless-IOT.pdf
• Locknote: Conclusions and Key Takeaways from Black Hat Asia 2016
• Multivariate Solutions to Emerging Passive DNS Challenges asia-16-Vixie-Multivariate-Solutions-to-Emerging-Passive-DNS-Challenges.pdf
• Never Trust Your Inputs: Causing 'Catastrophic Physical Consequences' from the Sensor (or How to Fool ADC) asia-16-Bolshev-Never-Trust-Your-Inputs-Causing-Catastrophic-Physical-Consequences-From-The-Sensor.pdf
• NumChecker: A System Approach for Kernel Rootkit Detection and Identification
• PLC-Blaster: A Worm Living Solely in the PLC asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC.pdf asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf
• Practical New Developments in the BREACH Attack asia-16-Karakostas-Practical-New-Developments-In-The-BREACH-Attack.pdf asia-16-Karakostas-Practical-New-Developments-In-The-BREACH-Attack-wp.pdf
• Rapid Radio Reversing asia-16-Ossmann-Rapid-Radio-Reversing.pdf asia-16-Ossmann-Rapid-Radio-Reversing-wp.pdf
• su-a-Cyder: Homebrewing Malware for iOS Like a B0$$! asia-16-Tamir-Su-A-Cyder-Homebrewing-Malware-For-iOS-Like-A-B0SS.pdf
• The Kitchen's Finally Burned Down: DLP Security Bakeoff
• The Perl Jam 2: The Camel Strikes Back asia-16-Rubin-The-Perl-Jam-2-The-Camel-Strikes-Back.pdf
• The Security Wolf of Wall Street: Fighting Crime with High-Frequency Classification and Natural Language Processing asia-16-Reuille-The-Security-Wolf-Of-Wall-Street-Fighting-Crime-With-High-Frequency-Classification-And-Natural-Language-Processing.pdf asia-16-Reuille-The-Security-Wolf-Of-Wall-Street-Fighting-Crime-With-High-Frequency-Classification-And-Natural-Language-Processing-wp.pdf
• The Tactical Application Security Program: Getting Stuff Done asia-16-Scott-Tactical-Application-Security-Program-Getting-Stuff-Done.pdf

PD: no están todas las presentaciones, pero si publican más actualizaremos la lista.

Presentaciones de Troopers 16



Troopers, otra conocida conferencia sobre seguridad con sede en Alemania, ha publicado la mayoría de las presentaciones de la edición de este año (Troopers 16), celebrada el pasado mes de marzo.

• Opening Keynote
• Hiding your White-Box Designs is Not Enough
• Mind The Gap - Exploit Free Whitelisting Evasion Tactics
• Patch me if you can
• Attacking Next-Generation Firewalls
• Towards a LangSec-aware SDLC
• Preventing vulnerabilities in HANA-based deployments
• QNX: 99 Problems but a Microkernel ain't one!
• An easy way into your multi-million dollar SAP systems: An unknown default SAP account
• unrubby: reversing without reversing
• Imma Chargin Mah Lazer - How to protect against (D)DoS attacks
• Deep-dive into SAP archive file formats
• Crypto code: the 9 circles of testing
• Passive Intelligence Gathering and Analytics - It’s all Just Metadata!
• BetterCrypto: three years in
• The road to secure Smart Cars: ENISA approach
• Medical Device Security: Hack or Hype?
• The Joy of Sandbox Mitigations
• Caring for file formats
• Unpatchable Living with a vulnerable implanted device
• One tool to rule them all - and what can it lead to
• Planes, Trains and Automobiles: The Internet of Deadly Things

Vídeos de Black Hat Europe 2015



Después de las diapositivas, ya se han puesto disponible los vídeos de Black Hat Europe 2015:

• Keynote: What Got Us Here Wont Get Us There
• Bypassing Self-Encrypting Drives (SED) in Enterprise Environments
• Breaking Access Controls with Blekey
• Cybersecurity for Oil and Gas Industries: How Hackers Can Manipulate Oil Stocks
• Panel: What You Need To Know About The Changing Regulatory Landscape In Information Security
• Attacking The XNU Kernel In El Capitain
• Automating Linux Malware Analysis Using Limon Sandbox
• Even The Lastpass Will Be Stolen, Deal With It!
• Silently Breaking ASLR In The Cloud
• A Peek Under the Blue Coat
• Androbugs Framework: An Android Application Security Vilnerability Scanner
• Stegospolit - Exploit Delivery With Steganography and Polyglots
• Watching The Watchdog: Protecting Kerberos Authentication With Network Monitoring
• Authenticator Leakage Through Backup Channels on Android
• Cybercrime in The Deep Web
• Hey Man, Have You Forgotten To Intialize Your Memory?
• Unboxing The White-Box: Practical Attacks Against Obfuscated Ciphers
• Commix: Detecting and Exploiting Command Injection Flaws
• Is Your Timespace Safe? - Time and Position Spoofing Opensourcely
• Lessons From Defending The Indefensible
• Your Scripts In My Page - What Could Possibly Go Wrong?
• Continuous Intrusion: Why CI Tools Are An Attacker's Best Friends
• Going Auth The Rails On A Crazy Train
• Hiding In Plain Sight - Advances In Malware Covert Communication Channels
• LTE & IMSI Catcher Myths
• How To Break XML Encryption - Automatically
• Implementing Practical Electrical Glitching Attacks
• (In-)Security of Backend-As-A-Service
• Defending Against Malicious Application Compatibility Shims
• Exploiting Adobe Flash Player In The Era Of Control Flow Guard
• Fuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android
• VOIP Wars: Destroying Jar Jar Lync
• Faux Disk Encryption: Realities of Secure Storage On Mobile Devices
• New (And Newly - Changed) Fully Qualified Doman Names: A View of Worldwide Changes to DNS
• Self-Driving and Connected Cars: Fooling Sensors and Tracking Drivers
• Vulnerability Exploitation In Docker Container Environments
• All your Root Checks Belong To Us: The Sad State of Root Detection
• Bypassing Local Windows Authentication To Defeat Full Disk Encryption
• New Tool For Discovering Flash player 0-Day Attacks in the Wild from Various Channels
• Triaging Crashed With Backward Taint Analysis For Arm Architecture
• Locknote: Conclusions and Key Takeaways from Black Hat Europe 2015

Vídeos de USENIX Enigma 2016



Otra de las grandes conferencias USENIX que tuvo lugar a finales de enero Enigma 2016, enfocada a ataques emergentes, tiene publicado los vídeos de las presentaciones. La lista no es muy amplia, pero la mayoría muy interesantes:

• ToStaticHTML for Everyone! About DOMPurify, ...
• Building a Competitive Hacking Team
• Verification, Auditing, and Evidence: If We Didn’t Notice Anything Wrong...
• Keys Under Doormats: Mandating Insecurity...
• Trust Beyond the First Hop–What Really Happens to Data Sent to HTTPS Websites
• Drops for Stuff: An Analysis of Reshipping Mule Scams
• Sanitize, Fuzz, and Harden Your C++ Code
• Dolla Dolla Bill Y'all: Cybercrime Cashouts
• Usable Security–The Source Awakens
• Defending, Detecting, and Responding to Hardware and Firmware Attacks
• Timeless Debugging
• Modern Automotive Security: History, Disclosure, and Consequences
• Protecting High Risk Users
• Opening Video
• PKI at Scale Using Short-lived Certificates
• We Need Something Better—Building STAR Vote
• Bullet-Proof Credit Card Processing
• Why Is Usable Security Hard, and What Should We Do about it?
• NSA TAO Chief on Disrupting Nation State Hackers
• The Golden Age of Bulk Surveillance
• Hacking Health: Security in Healthcare IT Systems

Vídeos de linux.conf.au 2016



Ya están publicadas todas las charlas de linux.conf.au 2016. Aquí os dejo como de costumbre la lista completa:

• Open Hardware Miniconf - Lightning talks, project showcase and general discussions
• Functional Programming Lightning Talks and Miniconf Close
• Open Knowledge Miniconf Opening
• Music and Multimedia Miniconf Lightning Talks
• Using Lnav
• Real Time Tuning Analysis
• Synchronised multi-room multimedia playback and synchronised live media processing and mixing with G
• Improving thread synchronization in GlusterD (Daemon for Gluster) using Userspace RCU (Read-copy-upd
• Record and replay debugging with "rr"
• The future belongs to unikernels.
• Open information: Documenting data and methods
• Intro to Open Street Map
• Prospects and pitfalls in open demography
• Terry & the path to an autonomous robot
• Usable formal methods - are we there yet?
• Vanguard Linux receiver 'Dreambox'
• Security Topics in Open Cloud: Advanced Threats, 2015's Vulnerabilities ...
• Using Linux features to make a hacker's life hard
• Building and deploying the Genomics Virtual Laboratory on the cloud(s)
• Forcing Change in Healthcare through Open Standards
• From Commit to Cloud
• Keeping Pinterest Running
• Accessibility and Security
• Lightning Talks and Conference Closing
• Tutorial: The eChronos Real-Time Operating System - Just what you want, when you want it
• Open Source Software in Silicon Manufacturing
• Tutorial: Hunting Linux malware for fun and $flags
• Using the OpenRadio as RF test equipment
• Overcoming barriers to open source adoption in the public sector
• Raspberry Pi Hacks
• Order in the chaos: or lessons learnt on planning in operations
• Site Reliability Engineering at Dropbox
• He aha te mea nui?
• GStreamer in the living room and in outer space
• Keynote #4 - Ms Genevieve Bell
• Helicopters and rocket-planes
• secretd - another take on securely storing credentials
• The Emperor’s New Closure: FP in Javascript
• Open Source Two Way Radio
• Linux Guest RDMA On Hyper-V
• Troublesome Privacy Measures: using TPMs to protect users
• Haskell is Not For Production and Other Tales
• Open Source Technologies in Neuroscience
• Swift Functional Programming
• Practical Functional Architecture
• Data made out of functions
• Fuzz all the things!
• Speaking their language: How to write for technical and non-technical audiences
• Open Radio Miniconf Panel Discussion
• Tutorial - Embedded sensor data with Lora radio modules
• All Your Modem are Belong To Us
• Machine Ethics and Emerging Technologies
• Free as in cheap gadgets: the ESP8266
• Copyleft For the Next Decade: A Comprehensive Plan
• Creating bespoke logging systems and dashboards with Grafana, in fifteen minutes
• The life of a sysadmin in a research environment
• Pingbeat: y'know, for pings!
• 'Can you hear me now?' Networking for containers
• A Gentle Introduction to Ceph
• CloudABI: Cloud computing meets fine-grained capabilities
• CloudABI: Cloud computing meets fine-grained capabilities
• Revisiting Unix principles for modern systems automation
• The world of 100G networking
• Export Control: A primer for open source hackers
• Life is better with Rust's community automation
• Ergonomics of Automation
• Python's Dark Corners
• Cloud Anti-Patterns
• Open information: Documenting data and methods
• Preventing Cat-astrophes with GNU MediaGoblin
• Network Performance Tuning
• Functional programming in Python with Toolz and fn.py
• The Essential Tools of Open-Source: Functional Programming, Parametricity, Types
• Prying Open Government - An Introduction to Freedom of Information
• What a Good Procedure is Made of
• Cutdown!: HAB Telemetry System
• Kernel Miniconf Unconference
• Kernel Miniconf Unconference
• Cloud Crafting – Public / Private / Hybrid
• RCU Mutation Testing
• Changes in the security module infrastructure
• Kerbal space program simulator hardware controller and display
• Hardware projects using eChronos and IwIP: toward high-assurance IoT
• LinuxCNC for fun and profit - now with deadly lasers!
• Open source car engine management
• ESP8266 ESPlant (Wi-Fi garden sensors) design and operation
• Pick and Place Machine (live demonstration)
• The Twelve-Factor Container
• Open Hardware Assembly Workshop Continued
• Tutorial: Packets don't lie: how can you use tcpdump/tshark (wireshark) to prove your point.
• Education and the AGPL: A Case Study
• Continuous Delivery using blue-green deployments and immutable infrastructure
• Tutorial: Applied Data Science in Python
• How To Write A Linux Security Module That Makes Sense For You
• Playing to lose: making sensible security decisions by assuming the worst
• Tutorial: The Power of Open Data with ELK
• Tutorial: Identity Management with FreeIPA
• Open Source and back again
• An introduction to monitoring and alerting with timeseries at scale, with Prometheus
• Embrace the Atomic (Display) Age
• What I've learned as the kernel docs maintainer
• Adventures in OpenPower Firmware
• Using Persistent Memory for Fun and Profit
• Creating an open and distributed video broadcast production environment using GStreamer
• Challenges when Scaling: Adventures in Swift's Sharding
• Building museum exhibits with open hardware: Raspberry Pi & Arduino
• Documentation Miniconf
• Builds, dependencies and deployment in the modern multiplatform world
• My beautiful jacket
• Two years of tech writing
• edlib - because one more editor is never enough
• SubPos - A "Dataless" Wi-Fi Positioning System
• Opening classrooms through the Australian Curriculum
• Sentrifarm - open hardware telemetry system for Australian farming conditions
• What Happens When 4096 Cores All Do synchronize_rcu_expedited()?
• Dropbox Database Infrastructure
• Open Source Tools for Distributed Systems Administration
• Five* non-cryptographic hash functions enter. One hash function leaves.
• Message fromthe ABACBS President
• Hardware and Software Architecture of The Machine
• Keynote #2 - Ms Catarina Mota
• Internet Archive: Universal Access. Open APIs
• Open Data + Video Games = Win
• Linux driven microwave
• A Detailed Look at Erasure Codes in OpenStack Swift
• Welcoming Everyone: Five Years of Inclusion and Outreach Programmes at PyCon Australia
• Open-Source Software Stack for High-Assurance Autonomous Vehicles
• Wait, ?tahW: The Twisted Road to Right-to-Left Language Support
• Open Tech School - Open learning in practice
• A live demo of the CubicSDR open source SDR software
• Keynote #1 - Mr George Fong
• Conference Opening
• Melvin: A new implementation of LVM in Rust
• Is that a data-center in your pocket?
• On working from home
• A brief history of technical writing with examples
• Informal Jam / Demo session and Lightning Talks
• Twoskip - a robust single-file key-value database
• Conference Recording 2.0: Building a Better System
• Free Software in the Audiokinetic Laboratory
• Why no FOSS on stage right?
• An Open Approach to Whole-House Audio
• Sequencing your poo with a USB stick
• Applied bioinformatics using open source software
• Going Faster: Continuous Delivery for Firefox
• R and Bioconductor: open source software for analysing genomic data
• Production Pathology: from spinning wheels to knitting mills
• Open Sourcing Anti-Harassment Methodologies
• Law and technology: impedance mismatch
• Microscopium: Interactive clustering of high content screen images
• Many Roads to Bioinformatics
• Computer Performance Microscopy with SHIM
• Clinical Genomics: a Computational Perspective
• Open Source and Bioinformatics Miniconf Welcome
• Live Migration of Linux Containers
• clsXlca Opening
• Managing Infrastructure as Code

Vídeos de Shmoocon 2016



Ya tenemos disponibles los vídeos de la última edición de Shmoocon, conferencia de seguridad que se celebra en Washington DC.

• 0wn The Con
• Ask the EFF
• Attack On Titans
• AVLeak: Turning Antivirus Emulators Inside Out
• Be Free Little Guardbunny
• Breaking Bulbs Briskly By Bogus Broadcasts 1
• Building an Encyclopedia of Malware Configs (to punch miscreants)
• Closing Plenary: Information Security Programs in Academia
• Compressed Context Analytical Results For Computer Vision
• Containing an Attack with Linux Containers and AppArmor/SELinux
• Crypto and Quantum and Post Quantum
• Exploiting Memory Corruption
• Gatekeeper Exposed
• Hacking The Wireless World
• Hiding From The Investigator
• Keynote Address
• LostPass: Pixel-perfect LastPass Phishing
• LTE Security & Protocol Exploits
• Making Milware
• My Hash Is My Passport
• No Easy Breach
• Online No One Knows You're Dead
• Opening Remarks Rumblings Ruminatons Rants
• OSX Vulnerability Research and Why We Wrote Our Own Debugger
• P G Ohst Exploitation
• Penetration Testing Custom Tls Stacks
• Resistance Is Futile
• Reverse Engineering Wireless Scada Systems
• Software Security By The Numbers
• Speak Security And Enter
• Static Malware & Smtp Fail Analysis
• The Road to SYSTEM: Recycling Old Vulnerabilities for Unpatched Privilege Escalation and A New Network Attack
• #thingswikfound #omarax What Is It, And Why You May Care
• This Message Will Self Destruct In 10 Seconds
• Users Are People Too: How to Make Your Tools Not Suck for Humans
• Using The Algebraic Eraser To Secure Low Power Devices
• Where Do The Phishers Live
• You Ain't Seen Nothing Yet

Vídeos de la HOPE X



La conferencia sobre hacking HOPE (Hackers On Planet Earth) X se celebró en julio del 2014. Esta conferencia se celebra cada 2 años y es una de las más antiguas, su primera celebración fue en 1994. Este año se celebrará en julio la HOPE XI. Con motivo de ello, hace unos días que se publicaron todos los vídeos de la última celebrada. Hace algún tiempo pusieron disponible el audio de las charlas.

Vídeos de Chaos Computer Club edición 32



Como cada año, del 27 al 30 de diciembre (establecido desde el año 2005) se celebra en Alemania una de las mejores conferencias sobre seguridad/hacking del mundo.

Este año el Chaos Computer Club celebra su 32 edición “Gated Communities”. Cómo siempre el panel de charlas es bastante amplio e impresionante.

Aunque aún no están todos los vídeos disponibles, ya podemos ir disfrutando de los que se han publicado:

• Plunge into Proxy Politics
• "Fluxus cannot save the world."
• #GOIBlocks - Technical observations about recent internet censorship in India
• (In)Security of Embedded Devices' Firmware - Fast and Furious at Large Scale
• (Un)Sicherheit von App-basierten TAN-Verfahren im Onlinebanking
• 20 OSCILLATORS IN 20 MINUTES
• 3D printing on the moon
• A Dozen Years of Shellphish
• A Free and Open Source Verilog-to-Bitstream Flow for iCE40 FPGAs
• A New Kid on the Block
• APT Reports and OPSEC Evolution, or: These are not the APT reports you are looking for
• All Our Shared Spectrum Are Belong to Us
• Avoiding kernel panic: Europe’s biggest fails in digital policy-making
• Beyond Anti Evil Maid
• Beyond your cable modem
• Breaking Honeypots for Fun and Profit
• Building and Breaking Wireless Security
• CHINTERNET ART
• Check your privileges!
• CloudABI
• Collect It All: Open Source Intelligence (OSINT) for Everyone
• Compileroptimierungen für Forth im Microcontroller
• Computational Meta-Psychology
• Console Hacking
• Craft, leisure, and end-user innovation
• Crypto Wars Part II
• Crypto ist Abwehr, IFG ist Angriff!
• Cyber all the Wassenaars
• Das Zahnrad aus Fleisch
• Datahavens from HavenCo to Today
• De-anonymizing Programmers
• Dissecting VoLTE
• Ecuador: how an authoritarian government is fooling the entire world
• Ein Abgrund von Landesverrat
• Evolution of Brain-Computer Interfaces
• Fnord-Jahresrückblick
• Free Software and Hardware bring National Sovereignty
• Gibberish Detection 102
• Graphs, Drones & Phones
• Grundrechte gelten nicht im Weltall!
• G’scheitern
• Hacker Jeopardy
• Hacking EU funding for a decentralizing FOSS project
• Hardsploit: A Metasploit-like tool for hardware hacking
• Hardware-Trojaner in Security-Chips
• Household, Totalitarianism and Cyberspace
• How hackers grind an MMORPG: by taking it apart!
• How the Great Firewall discovers hidden circumvention servers
• Intelexit
• Internet Cube
• Internet Landscapes
• Iridium Update
• Jahresrückblick des CCC
• Jugend hackt 2015
• Katastrophe und Kommunikation
• Key-logger, Video, Mouse
• Keynote
• Lessons learned: Freifunk für Geflüchtete
• Let's Encrypt -- What launching a free CA looks like
• Lifting the Fog on Red Star OS
• Lightning Talks Day 2
• Lightning Talks Day 3
• Ling - High level system programming
• Logjam: Diffie-Hellman, discrete logs, the NSA, and you
• Maker Spaces in Favelas - Lecture
• Maritime Robotics
• Media Coverage and the Public in the Surveillance Society
• Methodisch inkorrekt!
• Microsofts Windows 10 Botnet
• Mobile Censorship in Iran
• My Robot Will Crush You With Its Soft Delicate Hands!
• NSA-Untersuchungsausschuss: Zwischen Aufklärungswillen und Mauern aus Schweigen
• Neither Snow Nor Rain Nor MITM… The State of Email Security in 2015
• Net Neutrality in Europe
• Netzpolitik in der Schweiz
• New memory corruption attacks: why can't we have nice things?
• On Computing Numbers, with an Application to Problems of our Society
• One year of securitarian drift in France
• Opening Event
• PLC-Blaster
• PQCHacks
• Predicting Crime in a Big Data World
• Prediction and Control
• Profiling (In)justice
• Public Library/Memory of the World
• QRtistry
• Quantenphysik und Kosmologie
• Quantum Cryptography
• REXUS/BEXUS - Rocket and Balloon Experiments for University Students
• Replication Prohibited
• Reversing UEFI by execution
• Rowhammer.js: Root privileges for web apps?
• Running your own 3G/3.5G network
• Safe Harbor
• Sanitizing PCAPs
• Say hi to your new boss: How algorithms might soon control our lives.
• Security Nightmares 0x10
• Shooting lasers into space – for science!
• Shopshifting
• Sicherheit von 125kHz Transpondern am Beispiel Hitag S
• Sin in the time of Technology
• So you want to build a satellite?
• Software and business method patents: call for action
• State of the Onion
• Stromtankstellen – eine neue öffentliche Infrastruktur
• Technology and Mass Atrocity Prevention
• Ten years after ‚We Lost The War‘
• The Great Train Cyber Robbery
• The Magic World of Searchable Symmetric Encryption
• The Perl Jam 2
• The Price Of Dissent
• The Ultimate Amiga 500 Talk
• The architecture of a street level panopticon
• The exhaust emissions scandal („Dieselgate“)
• The mummy unwrapped
• The plain simple reality of entropy
• The state of Internet Censorship
• Thunderstrike 2
• Top X* usability obstacles
• Tor onion services: more useful than you think
• Towards (reasonably) trustworthy x86 laptops
• Trust us and our business will expand!
• Unpatchable
• Vector retrogaming
• Vehicle2Vehicle Communication based on IEEE 802.11p
• Verified Firewall Ruleset Verification
• What does Big Brother see, while he is watching?
• What is the value of anonymous communication?
• When algorithms fail in our personal lives
• When hardware must „just work“
• Wie Jugendschutzprogramme nicht nur die Jugend schädigen
• Wie man einen Blackout verursacht
• Windows drivers attack surface
• Wireless Drivers: Freedom considered harmful?
• apertus° AXIOM
• goto fail;
• libusb: Maintainer fail
• rad1o++
• re_cycle
• the possibility of an army
• Österreich: Der Kampf gegen unkontrollierte Massenüberwachung
• “I feel like a criminal and I have to be god at the same time”
• „Nach bestem Wissen und Gewissen“ – Floskeln in der Politik

Nota: el congreso todavía se está celebrando e irán apareciendo más vídeos, así que iremos actualizando la lista cada día. Publicaremos un tweet cada vez que actualicemos la entrada. También recuerda que las charlas se pueden ver en vivo.

Vídeos de la ekoparty 11



Ya están disponibles los vídeos de la 11 edición de ekoparty celebrada el pasado mas de octubre.

• [Panel] Voto electrónico: Pensando el futuro de la democracia desde una perspectiva tecnológica.
• WINTER IS COMING - Iván Arce
• ARM DISASSEMBLING WITH A TWIST
• RECOVERING SAP RFC CREDENTIALS FROM NETWORK TRAFFIC - Emiliano Fausto
• LEARN ABOUT THE ENEMY - Moonbeom Park
• VOT.AR: UNA MALA ELECCIÓN - Iván Ariel Barrera Oro & Javier Smaldone
• EXPLOITING GSM AND RF TO PWN YOU PHONE - Manuel Moreno & Francisco Cortes
• FAUX DISK ENCRYPTION: REALITIES OF SECURE STORAGE ON MOBILE DEVICES - Drew Suarez & Daniel Mayer
• FUZZING BROWSERS FOR FINDING EXPLOITABLE BUGS - Nicolás Trippar
• ABUSING GDI FOR RINGO EXPLOIT PRIMITIVES - Diego Juarez
• DIRECT X - DIRECT WAY TO MICROSOFT WINDOWS KERNEL X - Nikita Tarakanov
• STICK THAT IN YOUR (ROOT)PIPE & SMOKE IT - Patrick Wardle
• HACKEANDO CARROS EN LATINOAMERICA - Jaime Restrepo
• NEW AGE PHREAKING: TÁCTICAS Y TRUCOS PARA FRAUDES EN WHOLESALE - David Batanero
• 2015'S REMOTE ROOT. WHAT DOES IT LOOK LIKE? - Juliano Rizzo
• CROZONO: CRACKING THE SECURITY PERIMETER WITH DRONES - Pablo Romanos & Sheila Berta
• Flash Talks
• BREAKING VAULT - Fernando Russ
• SECURITY DEVOPS IS POSSIBLE: HOW OSQUERY IS BUILT - Teddy Reed & Javier Marcos
• WINDOWS SMEP BYPASS: U=S - Nicolás Economou & Enrique Nissim
• IR TRANSFORMATION SYNTHESIS FOR ASSEMBLY INSTRUCTIONS - Sebastián N. Fernández
• SSL CERTIFICATE MASSIVE ANALYSIS.. AND MEDICAL APLICATIONS FINGERPRINTING - Bertin Bervis & James Jara
• SYSTEM UPDATES, ATTACK AND DEFENSE - Sofiane Talmat
• WARRANTY VOID IF LABEL REMOVED - ATTACKING MPLS NETWORKS - Georgi Geshev
• SATELLITE TV RECEIVERS: FROM REMOTE CONTROL TO ROOT SHELL - Sofiane Talmat

Material de DeepSec 2015

Por si no tenéis material bastante para leer, aquí tenéis las diapositivas presentadas en DeepSec 2015:

• Agile_Security_The_Good,_The_Bad,_(and_Mostly)_The_Ugly_-_Daniel_Liber.pdf
• Bridging_the_Air-Gap_Data_Exfiltration_from_Air-Gap_ Networks_-_Yisroel_Mirsky.pdf
• Can_societies_manage_ the_SIGINT_monster_-_Duncan_Campbell.pdf
• Chw00t_How_To_Break Out_from_Various_Chroot_Solutions_-_Bucsay_Balazs.pdf
• Continuous_Intrusion_Why_CI_Tools_Are_an_Attacker's_Best_Friends_-_Nikhil_Mittal.pdf
• Cyber_Cyber_Cyber_Warfare___Mistakes_of_the_DoDs_-_Raoul Chiesa.pdf
• Deactivating_Endpoint_Protection_Software_in_an_Unauthorized_ Manner_-_Matthias_Deeg.pdf
• Extending_a_Legacy_ Platform_Providing_a_Minimalistic,_Secure_Single-Sign-On-Library_-_Bernhard_Goeschelberger,_Sebastian_Goettfert.pdf
• File_Format_Fuzzing_in_Android_-Alexandru_Blanda.pdf
• German_Privacy_Law_And_IT_Security_-_Stefan_Schumacher.pdf
• Hacking Cookies in Modern Web Applications_and_Browsers_-_Dawid_Czagan.pdf
• How_To_Break_XML_Encryption_-_Automatically_-_Juraj_Somorovsky.pdf
• Legal_Responses_ Against_Cyber_ Incidents_-_Oscar_Serrano.pdf
• Not_so_Smart_On_ Smart_TV_Apps_-_Marcus_Niemietz.pdf
• OSINT_Barncat___Mining_Malware_for_Intelligence_at_Scale_-_John_Bambenek.pdf
• Revisiting_SOHO_Router_Attacks_-_Jose_Antonio _Rodriguez_Garcia,_Ivan _Sanz_de_Castro,_Álvaro_Folgado_Rueda.pdf
• Yes,_Now_YOU_Can_ Patch_That_Vulnerability_Too!_-_Mitja_Kolsek.pdf
• ZigBee_SmartHomes_A_Hackers_Open_House_-_Tobias_Zillner,_Florian_Eichelberger.pdf

Vídeos de DEF CON 23



Finalmente se están publicando los vídeos de DEF CON 23. Ya llevan un tiempo publicándolos en listas agrupadas por temas. Todavía no están todos, pero ya hay bastante material. Iremos actualizando esta entrada a medida que vayan publicando más. Por ahora estos son los que hay:

• Automotive Hacks
  • Marc Rogers and Kevin Mahaffey - How to Hack a Tesla Model S
  • Vehicle Hacking Village - Josh Corman - Safer Sooner Automotive Cyber Safety
  • Vehicle Hacking Village - Eric Evenchick - SocketCAN
  • Samy Kamkar - Drive it like you Hacked it: New Attacks and Tools to Wireles
  • Charlie Miller & Chris Valasek - Remote Exploitation of an Unaltered Passenger Vehicle
  • Vehicle Hacking Village - Nathan Hoch - The Badge and PAWN: Customizing the Badge

• Internet Of Things
  • Runa Sandvik, Michael Auger - Hacking a Linux-Powered Rifle
  • Qing Yang - Im A Newbie Yet I Can Hack ZigBee
  • IoT Village - Wesley Wineberg - Cameras Thermostats and Home Automation Controllers
  • IoT Village - K Reid Wrightman - Vulnerability Inheritance in PLCs
  • IoT Village - Kenneth Shaw - The Grid - A Multiplayer Game of Destruction
  • IoT Village - Daniel Miessler - IoT Attack Surface Mapping
  • IoT Village - Brian Knopf - Yes You Can Walk on Water
  • IoT Village - Aaron Guzman - Security - the IoT World

• Wireless
  • Graham and Maynor - HamSammich – Long Distance Proxying Over Radio
  • DEF CON 23 Conference - Andres Blanco, Andres Gazzoli - 80211 Massive Monitoring
  • Wireless Village - Wireless Warrior - Covert Wireless Practical Hacker LPI LPD
  • Wireless Village - Vivek Ramachandran and Thomas Dotreppe - WPA Enterprise Hacking
  • Wireless Village - V. Ramachandran - Automatic Live WPA WPA2 Attacks and WPA Supplicant
  • Wireless Village - Travis Goodspeed, Sergey Bratus - PSK31 Modulation Polyglots
  • Wireless Village - Tim Oshea - GNU Radio Tools for Radio Wrangling/Spectrum Domination
  • Wireless Village - Michael Calabro - Software Defined Radio Performance Trades & Tweaks
  • Wireless Village - Karl Koscher - DSP for SDR
  • Wireless Village - JoshInGeneral - Meeting People Over WiFi
  • Wireless Village - Kitchen and Kinne - Sniffin WiFi Sippin Pineapple Juice
  • Wireless Village - Cyb3r Assassin - Wireless Pentesting: So Easy a Cave Man Can Do It
  • Wireless Village - Catatonic - Tospo Virus: Weaponizing WiFi Pineapple Vulnerabilities
  • Wireless Village - Balint Seeber - SIGINT & Blind Signal Analysis w/ GNU Radio & SDR

• Crypto
  • Panel - Lets Encrypt Minting Free Certs to Encrypt the Entire Web
  • Justin Engler - Secure Messaging for Normal People
  • Eijah - Crypto for Hackers
  • David Huerta - Alice and Bob are Really Confused
  • Bruce Schneier - Questions and Answers
  • Ryan Castellucci - Cracking CryptoCurrency Brainwallets
  • Jose Selvi - Breaking SSL Using Time Synchronisation Attacks
  • Crypto and Privacy Village - Robert Olson - Teaching Privacy Using Red Team Strategies
  • Crypto and Privacy Village - Nick Sullivan - CFSSL the evolution of a PKI toolkit
  • Crypto and Privacy Village - Carlson and Doherty - Breaking CBC
  • Crypto and Privacy Village - Craig Young - Smart Home Invasion
  • Crypto and Privacy Village - Freddy Martinez - IMSI Catchers
  • Crypto and Privacy Village - Marina - Hacking Quantum Cryptography

• Biohacking
  • Scott Erven and Mark Collao -Medical Devices: Pwnage and Honeypots
  • Richard Thieme - Hacking the Human Body and Brain
  • BioHacking Village - Whitlock and Aganovic - Physiology from the Perspective of Control
  • BioHacking Village - Walter Powell - Parallels in BioSec and InfoSec
  • BioHacking Village - Panel - The Anatomy of DIY Implantable Devices
  • BioHacking Village - Alex Smith - Cloning Access Cards to Implants
  • BioHacking Village - Johan Sosa - Genetic engineering - GMO for fun and profit
  • BioHacking Village - Keoni Gandall - Biohacking at Home
  • BioHacking Village - Michael Goetzman - Social Implications of DNA Acquisition
  • BioHacking Village - Alejandro Hernández - Brain Waves Surfing - (In)security in EEG

• Hardware and Lockpicking
  • Lock Picking Village - Intro to Lockpicking 2
  • Lock Picking Village - Intro to Lockpicking 1
  • DEF CON 23 - Lock Picking Village - Impressioning
  • Hardware Hacking Village - Soldering 101 - Melting metal for fun and profit
  • Hardware Hacking Village - Nikhil Mittal - Hacking with Human Interface Devices
  • Hardware Hacking Village - Matt DuHarte - Introduction to USB and Fuzzing
  • Hardware Hacking Village - Dr. Tran - Introduction to Lockpicking
  • Hardware Hacking Village - Machinist - Mechanical Engineering for Noobs
  • DEF CON 23 - Teddy Reed and Nick Anderson - Hardware and Trust Security ELI5
  • Dan Petro and Oscar Salaza - Hacking Smart Safes: On the Brink of a Robbery
  • Mike Ryan and Richo Healey - Hacking Electric Skateboards
  • AmmonRa - How to Hack Your Way out of Home Detention

• Packet Hacking Village
  • Packet Capture Village - Wayne Crowder - Fishing To Phishing
  • Packet Capture Village - Vivek Ramachandran - 80211 Monitoring with PCAP2XML - SQLite
  • Packet Capture Village - Tony Martin - From XSS to Root on Your NAS
  • Packet Capture Village - Theodora Titonis - How Machine Learning Finds Malware
  • Packet Capture Village - Sam Bowne - Is Your Android App Secure
  • Packet Capture Village - Robert Simmons - The Digital Cockroach Bait Station
  • Packet Capture Village - Ron Taylor - Violating Web Services
  • Packet Capture Village - Paul Vixie - Passive DNS Collection and Analysis
  • Packet Capture Village - Mike Raggo - Remaining Covert in an Overt World
  • Packet Capture Village - Ming Chow - Tools and Techniques Used at the Wall of Sheep
  • Packet Capture Village - Monzy Merza - Real World Automation for Rapid Response
  • Packet Capture Village - Nikhil Mittal - Powershell for Penetraton Testers
  • Packet Capture Village - Jay Beale - Jailing Programs via Docker
  • Packet Capture Village - Joseph Muniz & Aamir Lakhani - Pen Testing with Raspberry Pi
  • Packet Capture Village - Karl Koscher - Sniffing SCADA
  • Packet Capture Village - Leon Ward - The Packets Made Me Do It - Using OpenFPC
  • Packet Capture Village - Lokesh Pidawekar - Hackers Practice Ground
  • Packet Capture Village - Michael Raggo - Mobile Data Loss - Threats and Countermeasures
  • Packet Capture Village - Bob Simpson - MITM 101 - Easy Traffic Interception Techniques
  • Packet Capture Village - Brian Wohlwinder and Andrew Beard - I See You
  • Packet Capture Village - David Schwartzberg - Hacking the Next Generation
  • Packet Capture Village - Elliot Brink - Global Honeypot Trends
  • Packet Capture Village - Grecs - Creating REAL Threat Intelligence With Evernote

• Social Engineering
  • Social Engineering Village - Tim Newberry - Twitter ISIL and Tech
  • Social Engineering Village - Noah Beddome - Yellow Means Proceed with Caution
  • Social Engineering Village - Michele Fincher - I Didn’t Think it was Loaded
  • Social Engineering Village - John Ridpath - Shakespeare and Social Engineering
  • Social Engineering Village - Jayson E. Street - Breaking in Bad
  • Social Engineering Village - Ian Harris - Understanding Social Engineering Attacks
  • Social Engineering Village - Dave Kennedy - Understanding End-User Attacks
  • Social Engineering Village - Chris Hadnagy - A Peek Behind the Blue Mask
  • Social Engineering Village - Adam Compton & Eric Gershman - SpeedPhishing Framework
  • Michael Schrenk - Applied Intelligence: Using Information Thats Not There
  • Marte Loge - Tell me who you are and I will tell you your lock pattern
  • Ken Westin - Confessions of a Professional Cyber Stalker
  • Chris Rock - I Will Kill You

• Panels
  • Panel - WhyMI so Sexy: WMI Attacks - Real Time Defense and Advanced Forensics
  • Panel - ThunderStrike 2: Sith Strike
  • Panel - Switches Get Stitches
  • Panel - Licensed to Pwn: Weaponization and Regulation of Security Research
  • DEF CON - Panel - Guests N Goblins: Exposing Wi Fi Exfiltration Risks and Mitigation
  • DEF CON 23 - Panel - DEF CON Comedy Inception
  • Panel - DEF CON 101: The Panel
  • Panel - Ask the EFF: The Year in Digital Civil Liberties
  • Panel - Abusing Adobe Readers JavaScript APIs

• Attack
  • Ionut Popescu - NetRipper: Smart Traffic Sniffing for Penetration Testers
  • Ian Kline - LTE Recon and Tracking with RTLSDR
  • Fernando Arnabold - Abusing XSLT for Practical Attacks
  • Dr Phil Polstra - One Device to Pwn Them All
  • Dr Phil Polstra - Hacker in the Wires
  • Damon Small - Beyond the Scan The Value Proposition of Vuln Assessment
  • Brent White - Hacking Web Apps
  • Aditya K Sood - Dissecting the Design of SCADA Web HMIs: Hunting Vulns
  • Craig Young - How to Train Your RFID Hacking Tools
  • Francis Brown, Shubham Shah - RFIDiggity: Guide to Hacking HF NFC & UHF RFID
  • Geoff Walton and Dave Kennedy - Pivoting Without Rights: Introducing Pivoter
  • Jeremy Dorrough - USB Attack to Decrypt Wi Fi Communications
  • Mickey Shkatov & Jesse Michael - Scared Poopless – LTE and your laptop
  • Nemus - Hacking SQL Injection for Remote Code Execution on a LAMP Stack
  • Nadeem Douba - BurpKit: Using WebKit to Own the Web
  • Tamas Szakaly - Shall We Play a Game
  • Wesley McGrew - I Hunt Penetration Testers: More Weaknesses in Tools and Procedures

Presentaciones y vídeos de DefCamp #6



Pues para que no nos aburramos durante las vacaciones, aquí tenéis material nuevo. En este caso de DefCamp #6.

• A new Hope - CTF stories & IoT Hacking - Slide - Video
• Game of Hacks: Play, Hack & Track - Slide - Video
• (In)Security of Embedded Devices' Firmware – Fast and Furious at Large Scale - Slide - Video
• IoT Security - Slide - Video
• IoT Security - Slide - Video
• From Hype Hangover to Happy Hacking: Shaping the World through Shaping Actions - Slide - Video
• A new Hope - CTF stories & IoT Hacking - Slide - Video
• What's in a name? DNS use for exfiltration, and monitoring for detection - Slide - Video
• Finding media bugs in Android using file format fuzzing - Slide - Video
• White hat hacker bounty program to improve online environment security - Slide - Video
• ELK stack for Hackers - Slide - Video
• When Steganography Stops Being Cool - Slide - Video
• Integrating Mobile Devices into Your Penetration Testing Program - Slide - Video
• Toward large-scale vulnerability discovery using Machine Learning - Slide - Video
• Breaking in Bad (I'm the one who doesn't knock) - Slide - Video
• Modern approaches to Wi-Fi attacks - Slide - Video
• Building a Weaponized Honeybot (part I) - Slide - Video
• Building a Weaponized Honeybot (part II) - Slide - Video
• Why nation-state malwares target Telco Networks: Dissecting technical capabilities of Regin and its counterparts - Slide - Video
• Defending the Enterprise Against Network Infrastructure Threats - Slide - Video
• Challenges on Reversing Layered Malware - Slide - Video
• How to mess with Android Intents - Slide - Video
• Cryptography – our weapon in the 21st century - Slide - Video
• Luke 8:17 – Misleading implementations that compromise the privacy and information security - Slide - Video
• Building a Cyber Security Operations Center - Slide - Video
• Pentesting Android Applications - Workshop - Slide - Video
• What's in a name? DNS use for exfiltration, and monitoring for detection - Slide - Video
• IDS Evasion Techniques - Slide - Video
• Untrusted Mobile Applications. State of Art of Security App-Apocalypse - Slide - Video
• IoT Village Awards - Slide - Video
• Hacking and Securing Network Monitoring Systems: End-to-end walkthrough example on Ganglia - Slide - Video
• Orange about Bug Bounty and Innovation Labs 2016 - Slide - Video
• Abstract Apoc@lypse Technique - Slide - Video

Material de Zero Nights 2015, incluido los talleres



Ya está disponible el material de la conferencia Zero Nights 2015. No sólo las de las charlas, sino también de los talleres!

• “A praise for hackers”
• "Hacking Virtual Appliances"
• "Browser Fuzzing with a Twist (and a Shake)"
• "Warranty Void If Label Removed - Attacking MPLS Networks"
• “Big problems with big data - Hadoop interfaces security”
• “Mathematical theory of input validation vulnerabilities and attacks”
• «Cisco IOS shellcode – all-in-one»
• "Introducing Choronzon: an approach to knowedgebased evolutionary fuzzing"
• "Samsung SmartTV: how-to to creating insecure device in today’s world"
• "Did you get your token?”
• "Fix it yourself: resolving UEFI vulnerabilities single-handedly"
• "Attacking hypervisors using firmware and hardware"
• "Direct X – direct way to Microsoft Windows kernel"
• "Hack like a movie star: Step-bystep guide to crafting SCADA payloads for physical attacks with catastrophic consequences"
• "Modifying the firmwares of industrial switches"
• “Getting The Most Out Of CSP: a Deep Dive”
• "illusoryTLS: Nobody But Us Impersonate, Tamper, and Exploit"
• "How to build your own Echelon system? Attacks at 3G modems"
• "EESIL – universal IL (Intermediate Language) for Radare2"
• "S[c][/c]rum is all around. How to stop continuous integration"
• "KNX security or how to steal a skyscraper"
• "Extracting the painful (blue) tooth"
• “Cross-platform reversing with Frida”
• "Enlarge your Burp, or How to stop fearing Javadocs"
• “Practical exploitation of AVR MC-based devices”
• “On the way to (wrong) anonymity. Basic techniques of digital contraception and private data hygiene”
• “Software vulnerabilities of Yota communication equipment”
• “Distributing the reconstruction of high-level intermediate representation for large scale malware analysis”
• “Hooked browser network based on BeEF and Google Drive”
• “ORM2Pwn: exploiting injections in Hibernate”
• “What should a hacker know about WebDav? Vulnerability review in WebDav implementations”
• “Knowledge based approach for fast Internet resource discovery or Data Mining in the service of nmap”
• “Correlating security events with Esper”
• “Fighting against Flash 0-day: a hunt for a tainted vector”
• “Banking Trojans: a look from the new perspective”
• “Automation of web applications scanning: experience of Yandex”
• “Do-it-yourself banking SDL”
• “Let’s play the game: One more way to perform penetration test”
• Presentation

Presentaciones B-Sides Orlando 2015



Para los interesados en las charlas de B-Sides Orlando 2015, ya están disponibles en youtube. Aquí os dejo la lista:

• Closing Keynote - Day 1 - Dr Johannes Ullrich Judgement Day 2015-04-12
• Tim Krabek-Getting Involved to Better the Future
• Michael Brown - The NIST Cybersecurity Framework is coming! Are you ready?
• Jonathan Echavarria-Hiding your attacks with misdirection like REDACTED
• Danny Chrastil - What I know about your Company Hacking LinkedIn
• Vikram Dhillon -Blockchain-as-a-service -BsidesOrlando 2015
• Scott Arciszewski - Application Security Beyond Compliance
• Opening Keynote -Moses Hernandez Yo Dog! I got some Regs for your Regs
• Glen Roberts - Take Charge of Your Infosec Career!
• Closing Keynote - Day 1 - Dr Johannes Ullrich Judgement Day 2015-04-12 -BsidesOrlando 2015
• Chris Martinez Executive Order: Private Sector Cybersecurity Information Sharing
• Anthony Critelli - Implementing Voice Over IP in Security Competitions
• Josh Ruppe - Breaking the Speed Limit
• Scott Sattler - Threat Intellegence
• Tim Medin - Attacking Kerberos: Kicking the Guard Dog of Hades
• Vincent Moscatello - Destover: Inside the Malware at Sony Entertainment
• Jeremy Epstein - The Scope of Cybersecurity: A View Forward
• grecs & pupstrr | Project KidHack – Teaching the Next Next Generation Security through Gaming
• Vincent Moscatello - Destover: Inside the Malware at Sony Entertainment
• Tim Medin - Attacking Kerberos: Kicking the Guard Dog of Hades
• Ryan Buenaventura - Defense in Depth – A Mile Wide, A Mile Deep
• Scott Sattler - Threat Intellegence
• Josh Ruppe - Breaking the Speed Limit
• Ean Meyer - Hiding in Plain Sight: Building a Hidden Remotely Accessible Pentesting Platform
• Anthony Critelli - Implementing Voice Over IP in Security Competitions
• Chris Martinez Executive Order: Private Sector Cybersecurity Information Sharing
• Tim Krabek-Getting Involved to Better the Future
• Michael Brown - The NIST Cybersecurity Framework is coming! Are you ready?
• Jonathan Echavarria-Hiding your attacks with misdirection like REDACTED
• Danny Chrastil - What I know about your Company Hacking LinkedIn
• Vikram Dhillon -Blockchain-as-a-service -BsidesOrlando 2015
• Scott Arciszewski - Application Security Beyond Compliance
• Opening Keynote -Moses Hernandez Yo Dog! I got some Regs for your Regs
• Glen Roberts - Take Charge of Your Infosec Career!

Vídeos de LLVM Developers' Meeting 2015



Ya se encuentran disponibles los vídeos de la conferencia sobre programación LLVM Developers’ Meeting 2015. Es una conferencia que se celebra tradicionalmente dos veces al año, una vez en EEUU y otra en Europa y está enfocada alrededor de la infraestructura de LLVM.

• Jf Bastien & Dan Gohman "WebAssembly: Here Be Dragons"
• Quentin Colombet "A Proposal for Global Instruction Selection"
• Johannes Doerfert "€œInput Space Splitting for OpenCL"
• K. Serebryany & P. Collingbourne "Beyond Sanitizers..."
• Ivan Baev "Profile-based Indirect Call Promotion"
• Kristof Beyls "œAutomated performance-tracking of LLVM-generated code"
• Christos Margiolas "A Heterogeneous Execution Engine for LLVM"
• S. Guelton & A. Guinet "...Simple out-of-tree LLVM Pass"
• Pierre-Andre Saulais "Creating an SPMD Vectorizer..."
• T. Grosser & J. Doerfert "€œOptimistic Loop Nest Optimizations..."
• P. Robinson & M. Edwards "Living Downstream Without Drowning"
• Joseph Groff & Chris Lattner "Swift's High-Level IR: A Case Study..."
• David Blaikie "Opaque Pointer Types"
• Gerolf Hoflehner "€œLLVM Performance Improvements & Headroom"
• R. Kleckner & D. Majnemer "Exception handling in LLVM..."
• Jingyue Wu "Optimizing LLVM for GPGPU"
• D. Jasper & M. Klimek "€œAn update on Clang-based C++ Tooling"
• M. Wong & A. Bataev "OpenMP GPU/Accelerator support..."
• S. Das & P. Reames "LLVM for a managed language..."
• Vasileios Porpodas "Throttling Automatic Vectorization..."
• B. Simmers & M. Panchenko "LLVM back end for HHVM/PHP"
• Ashutosh Nema "LoopVersioning LICM"
• H. Wennborg & N. Weber "Compiling large, real-world codebases..."
• A. Prantl & D. Exon Smith "Debug Info: From Metadata to Modules"
• David Blaikie "Debug Info on a Diet"€
• Hans Wennborg "The recent switch lowering improvements"
• Stephane Sezer "ds2, a tiny debug server used with lldb"
• Dale Martin "Accelerating Stateflow with LLVM"
• Evgenii Stepanov "€œLarge scale libc++ deployment"
• Serge Guelton "To LLVM Bytecode Obfuscation and Beyond"
• B. Cahoon "Implementation of Swing Modulo Scheduling..."
• S. Rogers "€œInteger Vector Optimizations..."
• A. Nemet & M. Zolotukhin "Advances in Loop Analysis Frameworks..."

Presentaciones de Black Hat Europe 2015



Ya podemos acceder al material de la edición de este año de Black Hat celebrada en Amsterdam.

• What Got Us Here Wont Get Us There eu-15-Meer-What-Got-Us-Here-Wont-Get-Us-There.pdf
• (In-)Security of Backend-As-A-Service eu-15-Rasthofer-In-Security-Of-Backend-As-A-Service.pdf eu-15-Rasthofer-In-Security-Of-Backend-As-A-Service-wp.pdf
• A Peek Under the Blue Coat eu-15-Rigo-A-Peek-Under-The-Blue-Coat.pdf
• All Your Root Checks Belong to Us: The Sad State of Root Detection
• AndroBugs Framework: An Android Application Security Vulnerability Scanner eu-15-Lin-Androbugs-Framework-An-Android-Application-Security-Vulnerability-Scanner.pdf
• Attacking the XNU Kernel in El Capitain eu-15-Todesco-Attacking-The-XNU-Kernal-In-El-Capitain.pdf
• Authenticator Leakage through Backup Channels on Android eu-15-Bai-Authenticator-Leakage-Through-Backup-Channels-On-Android.pdf
• Automating Linux Malware Analysis Using Limon Sandbox eu-15-KA-Automating-Linux-Malware-Analysis-Using-Limon-Sandbox.pdf eu-15-KA-Automating-Linux-Malware-Analysis-Using-Limon-Sandbox-wp.pdf
• Breaking Access Controls with BLEKey
• Bypassing Local Windows Authentication to Defeat Full Disk Encryption eu-15-Haken-Bypassing-Local-Windows-Authentication-To-Defeat-Full-Disk-Encryption.pdf eu-15-Haken-Bypassing-Local-Windows-Authentication-To-Defeat-Full-Disk-Encryption-wp.pdf
• Bypassing Self-Encrypting Drives (SED) in Enterprise Environments eu-15-Boteanu-Bypassing-Self-Encrypting-Drives-SED-In-Enterprise-Environments.pdf eu-15-Boteanu-Bypassing-Self-Encrypting-Drives-SED-In-Enterprise-Environments-wp.pdf
• Commix: Detecting and Exploiting Command Injection Flaws eu-15-Stasinopoulos-Commix-Detecting-And-Exploiting-Command-Injection-Flaws.pdf eu-15-Stasinopoulos-Commix-Detecting-And-Exploiting-Command-Injection-Flaws-wp.pdf
• Continuous Intrusion: Why CI tools are an Attackers Best Friends eu-15-Mittal-Continuous-Intrusion-Why-CI-Tools-Are-An-Attackers-Best-Friend.pdf
• Cybercrime in the Deep Web eu-15-Balduzzi-Cybercrmine-In-The-Deep-Web.pdf eu-15-Balduzzi-Cybercrmine-In-The-Deep-Web-wp.pdf
• Cybersecurity for Oil and Gas Industries: How Hackers Can Manipulate Oil Stocks eu-15-Polyakov-Cybersecurity-For-Oil-And-Gas-Industries-How-Hackers-Can-Manipulate-Oil-Stocks.pdf eu-15-Polyakov-Cybersecurity-For-Oil-And-Gas-Industries-How-Hackers-Can-Manipulate-Oil-Stocks-wp.pdf
• Defending Against Malicious Application Compatibility Shims eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims.pdf eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf
• Even the LastPass Will be Stolen Deal with It! eu-15-Vigo-Even-The-Lastpass-Will-Be-Stolen-deal-with-it.pdf
• Exploiting Adobe Flash Player in the Era of Control Flow Guard eu-15-Falcon-Exploiting-Adobe-Flash-Player-In-The-Era-Of-Control-Flow-Guard.pdf
• Faux Disk Encryption: Realities of Secure Storage on Mobile Devices eu-15-Mayer-Faux-Disk-Encryption-Realities-Of-Secure-Storage-On-Mobile-Devices.pdf eu-15-Mayer-Faux-Disk-Encryption-Realities-Of-Secure-Storage-On-Mobile-Devices-wp.pdf
• Fuzzing Android: A Recipe for Uncovering Vulnerabilities Inside System Components in Android eu-15-Blanda-Fuzzing-Android-A-Recipe-For-Uncovering-Vulnerabilities-Inside-System-Components-In-Android.pdf eu-15-Blanda-Fuzzing-Android-A-Recipe-For-Uncovering-Vulnerabilities-Inside-System-Components-In-Android-wp.pdf
• Going AUTH the Rails on a Crazy Train eu-15-Jarmoc-Going-AUTH-The-Rails-On-A-Crazy-Train.pdf eu-15-Jarmoc-Going-AUTH-The-Rails-On-A-Crazy-Train-wp.pdf
• Hey Man Have You Forgotten to Initialize Your Memory? eu-15-Chen-Hey-Man-Have-You-Forgotten-To-Initialize-Your-Memory.pdf eu-15-Chen-Hey-Man-Have-You-Forgotten-To-Initialize-Your-Memory-wp.pdf
• Hiding in Plain Sight - Advances in Malware Covert Communication Channels eu-15-Bureau-Hiding-In-Plain-Sight-Advances-In-Malware-Covert-Communication-Channels.pdf eu-15-Bureau-Hiding-In-Plain-Sight-Advances-In-Malware-Covert-Communication-Channels-wp.pdf
• How to Break XML Encryption - Automatically eu-15-Somorovsky-How-To-Break-XML-Encryption-Automatically-wp.pdf
• Implementing Practical Electrical Glitching Attacks
• Is Your TimeSpace Safe? - Time and Position Spoofing Opensourcely eu-15-Kang-Is-Your-Timespace-Safe-Time-And-Position-Spoofing-Opensourcely.pdf eu-15-Kang-Is-Your-Timespace-Safe-Time-And-Position-Spoofing-Opensourcely-wp.pdf
• Lessons from Defending the Indefensible eu-15-Majkowski-Lessons-From-Defending-The-Indefensible.pdf
• Locknote: Conclusions and Key Takeaways from Black Hat Europe 2015
• LTE & IMSI Catcher Myths eu-15-Borgaonkar-LTE-And-IMSI-Catcher-Myths.pdf eu-15-Borgaonkar-LTE-And-IMSI-Catcher-Myths-wp.pdf
• New (and Newly-Changed) Fully Qualified Domain Names: A View of Worldwide Changes to the Internets DNS eu-15-Vixie-New-And-Newly-Changed-Fully-Qualified-Domain-Names-A-View-Of-Worldwide-Changes-To-The-Internets-DNS.pdf
• New Tool for Discovering Flash Player 0-day Attacks in the Wild from Various Channels eu-15-Pi-New-Tool-For-Discovering-Flash-Player-0-day-Attacks-In-The-Wild-From-Various-Channels.pdf eu-15-Pi-New-Tool-For-Discovering-Flash-Player-0-day-Attacks-In-The-Wild-From-Various-Channels-wp.pdf
• Panel: What You Need to Know About the Changing Regulatory Landscape in Information Security
• Self-Driving and Connected Cars: Fooling Sensors and Tracking Drivers eu-15-Petit-Self-Driving-And-Connected-Cars-Fooling-Sensors-And-Tracking-Drivers.pdf eu-15-Petit-Self-Driving-And-Connected-Cars-Fooling-Sensors-And-Tracking-Drivers-wp1.pdf eu-15-Petit-Self-Driving-And-Connected-Cars-Fooling-Sensors-And-Tracking-Drivers-wp2.pdf
• Silently Breaking ASLR in the Cloud eu-15-Barresi-Silently-Breaking-ASLR-In-The-Cloud.pdf eu-15-Barresi-Silently-Breaking-ASLR-In-The-Cloud-wp.pdf
• Stegosploit - Exploit Delivery with Steganography and Polyglots eu-15-Shah-Stegosploit-Exploit-Delivery-With-Steganography-And-Polyglots.pdf
• Triaging Crashes with Backward Taint Analysis for ARM Architecture eu-15-Kim-Triaging-Crashes-With-Backward-Taint-Analysis-For-ARM-Architecture.pdf
• Unboxing the White-Box: Practical Attacks Against Obfuscated Ciphers eu-15-Sanfelix-Unboxing-The-White-Box-Practical-Attacks-Against-Obfuscated-Ciphers.pdf eu-15-Sanfelix-Unboxing-The-White-Box-Practical-Attacks-Against-Obfuscated-Ciphers-wp.pdf
• VoIP Wars: Destroying Jar Jar Lync eu-15-Ozavci-VoIP-Wars-Destroying-Jar-Jar-Lync.pdf
• Vulnerability Exploitation in Docker Container Environments eu-15-Bettini-Vulnerability-Exploitation-In-Docker-Container-Environments.pdf eu-15-Bettini-Vulnerability-Exploitation-In-Docker-Container-Environments-wp.pdf
• Watching the Watchdog: Protecting Kerberos Authentication with Network Monitoring eu-15-Beery-Watching-The-Watchdog-Protecting-Kerberos-Authentication-With-Network-Monitoring.pdf eu-15-Beery-Watching-The-Watchdog-Protecting-Kerberos-Authentication-With-Network-Monitoring-wp.pdf
• Your Scripts in My Page - What Could Possibly Go Wrong?

Presentaciones de Ruxcon 2015



Aquí tenéis la lista de las presentaciones que se han publicados de Ruxcon 2015:

• DNS as a Defense Vector
• High Performance Fuzzing
• The New South Wales iVote System: Security Failures and Verification Flaws in a Live Online Election
• MalwAirDrop: Compromising iDevices via AirDrop
• Broadcasting Your Attack: Security Testing DAB Radio In Cars
• Windows 10: 2 Steps Forward, 1 Step Back
• Practical Intel SMEP Bypass Techniques on Linux
• Advanced SOHO Router Exploitation
• Why Attacker's Toolsets Do What They Do
• SDN Security
• Window Driver Attack Surface: Some New Insights
• Abusing Adobe Reader¹s JavaScript APIs
• High-Def Fuzzing: Exploring Vulnerabilities in HDMI-CEC
• VoIP Wars: Destroying Jar Jar Lync
• VENOM
• Fruit Salad, yummy yummy: An analysis of ApplePay
• A Peek Under The Blue Coat
• Automated Malware Analysis: A Behavioural Approach to Automated Unpacking
• Tasty Malware Analysis with T.A.C.O.: Bringing Cuckoo Reports into IDA Pro
• A Practical Robust Mitigation and Testing Tool for Use-After-Free Vulnerabilities
• Testing TLS - How To Check If Your TLS Implementation Is Correct
• Microarchitecture Independent VM Introspection

Material de SecTor 2015



Ya está disponible el material (vídeos y diapositivas) de SecTor 2015.

• Maturing InfoSec: Lessons from Aviation on Information Sharing - Slides
• Automation is your Friend: Embracing SkyNet to Scale Cloud Security - Video
• Breaking Access Controls with BLEKey - Video
• Breaking and Fixing Python Applications - Video Slides Tools
• Complete Application Ownage via Multi-POST XSRF - Video
• Confessions of a Professional Cyber Stalker - Video
• Cymon - An Open Threat Intelligence System - Video
• Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing - Slides
• Hijacking Arbitrary .NET Application Control Flow - Video Slides
• Malware Activity in Mobile Networks – An Insider View - Video Slides
• Software Defined Networking / Attacker Defined Networking - Video
• Stealth Attack From The Produce Aisle - Slides
• Stealthier Attacks and Smarter Defending with TLS Fingerprinting - Video Slides
• UNMASKING MALWARE - Video
• Xenophobia is Hard on Data: Forced Localization, Data Storage, and Business Realities - Video
• Bulletproofing Your Incident Response Plan: Effective Tabletops - Video
• CISO Survival Guide: How to thrive in the C-Suite and Boardroom - Slides
• Make Metrics Matter - Slides
• The Effective Use of Cyber Ranges for Application Performance and Security Resilience – Train Like You Fight! - Video
• There’s no such thing as a coincidence - Discovering Novel Cyber Threats - Video
• Building an Effective Vulnerability & Remediation Management Program - Video
• Ground Zero Financial Services: Targeted Attacks from the Darknet - Video
• Peeling The Layers Of Vawtrak - Slides
• Preventing Home Automation Security Disasters - Video Slides
• Run Faster, Continuously Harden - Embracing DevOps to Secure All The Things - Video
• Security for non-Unicorns - Video
• Certifi-gate: Has your Android device been Pwned? - Video
• Effective Ways to Tackle Vulnerability Remediation - Video
• Knowing what happened is only half the battle. - Video
• SIEM and the Art of Log Management - Video Slides

Material de HITB Singapur 2015



Ha sido publicado el material de la Hack In The Box de Singapur de este año 2015:

• CLOSING NOTE - Dhillon Kannabhiran.pdf
• D1 - Alfonso De Gregorio - Extortion and Cooperation in the Zero%c2%ad-Day Market.pdf
• D1 - Chris Rouland - Understanding the IoT from DC to 10Ghz.pdf
• D1 - Dawid Czagan - Hacking Cookies in Modern Web Applications and Browsers.pdf
• D1 - Julien Lenoir - Implementing Your Own Generic Unpacker.pdf
• D1 - Lyon Yang - Advanced SOHO Router Exploitation.pdf
• D1 - Marina Krotofil - Hacking Chemical Plants for Competition and Extortion.pdf
• D2 - Eleanor Saitta - Security Design and High Risk Users.pdf
• D2 - Fatih Ozavci - VoIP Wars - Destroying Jar Jar Lync.pdf
• D2 - Marco Balduzzi and Vincenzo Ciancaglini - Cybercrime in the Deep Web.pdf
• D2 - Ryan Welton and Marco Grassi - Current State of Android Privilege Escalation.pdf
• D2 - Valerie Thomas - Attacking Physical Access Systems.pdf
• D2 - Xeno Kovah - Thunderstrike 2 - Sith Strike.pdf
• D3 - Dmitry Chastuhin - SAP Afaria - One SMS to Hack a Company.pdf
• D3 - Felix Wilhelm - Attacking the FireEye MPS.pdf
• D3 - Katie Kleemola and Anthony Lai - Case Study of Targeted Attacks in Asia.pdf
• D3 - Marc Heuse - Hiding in Complexity.pdf
• D3 - Wen Xu - Root Hundreds and Thousands of Android Devices with One Generic Exploit.pdf
• KEYNOTE 1 - Kristin Lovejoy - Our Daily Struggle to Balance National Security Interests and Civil Liberties at the Ground Level .pdf
• KEYNOTE 2 - Ofir Arkin - Security in a World Out of Our Control - NO SLIDES.pdf
• KEYNOTE 3 - Winn Schwartau - Analogue Network Security.pdf
• KEYNOTE 4 (CLOSING) - Barry Greene - Can Vendors Ever Provide Secure Solutions%3f.pdf

Whitepapers:

• Alfonso De Gregorio - Extortion and Cooperation in the Zero%c2%ad-Day Market.pdf
• Dawid Czagan - Hacking Cookies in Modern Web Applications and Browsers.pdf
• Marco Balduzzi and Vincenzo Ciancaglini - Cybercrime In The DeepWeb.pdf
• Wen Xu - Root Hundreds and Thousands of Android Devices with One Generic Exploit.pdf
• Xeno Kovah - Thunderstrike 2 - Sith Strike.pdf

Material de Hack.lu 2015



El material presentado en Hack.lu 2015 ya está disponible, incluido el material usado en el taller sobre radare2:

• 2015-10-20-SEKOIA-Keynote Internet of Tchotchke-v1.0.pdf
• 2015-10-21-Keynote-Hack-lu-Marie-Moe.pdf
• Crowdsourced_Malware_Triage_-_Workshop.pdf
• Draw-me-a-LocalKernelDebuger.pdf
• HT_Android_hack_lu2015_v1.0.pdf
• Hacklu2015-SecurityDesignAndHigh-RiskUsers-4.3.pdf
• MahsaAlimardani-MobileApplicationsinIran.pdf
• Practical_Spear_Phishing.pdf
• Security_of_Virtual_Desktop_Infrastructures-Maxime_Clementz-Simon_Petitjean.pdf
• They Hate Us Cause They Ain't Us.pdf
• TotallySpies.pdf
• Trusting_files__and_their_formats___1_.pdf
• Trusting files (and their formats).pdf
• Why Johnny can’t Unpack-22.10.2015_lu_edition.key
• crema-hacklu.pdf
• fitbit-hacklu-slides.pdf
• forging_the_usb_armory.pdf
• hacklu15_enovella_reversing_routers.pdf
• hacklu2015_qkaiser_hownottobuildanevotingsystem.pdf
• key-logger-video-mouse.pdf
• keys_where_we_re_going_we_dont_need_keys.zip
• logos/
• metabrik-framework.pdf
• mispsummit/
• radare2-workshop-slides.pdf
• radare2-workshop/
• stegosploit_hacklu2015.pdf

Presentaciones y vídeos de BruCON 0x07 - 2015



Ya se encuentran disponibles las presentaciones y los vídeos de BruCON 0x07 (2015).

• Creating REAL Threat Intelligence ... with Evernote - L. Grecs (slides)
• Unified DNS View to Track Threats - Dhia Mahjoub & Thomas Mathew
• Desired state: compromised - Ryan Kazanciyan & Matt Hastings (slides)
• Shims For The Win - Willi Ballenthin & Jon Tomczak (slides)
• Hacking as Practice for Transplanetary Life in the 21st Century - Richard Thieme
• CVE-Search - Alexandre Dulaunoy & Pieter-Jan Moreels (slides)
• OSXCollector: Automated forensic evidence collection & analysis for OS X - Kuba Sendor (slides)
• Keynote - Looking Forward - Finding the right balance for INFOSEC - David Kennedy (slides)
• Advanced WiFi Attacks using Commodity Hardware - Mathy Vanhoef (slides)
• The .11 Veil, Camouflage & Covert! Invisible WiFi, Revealed - R. Nandedkar & A. Iyer (slides)
• Nightmares of a Pentester - Chris Nickerson (slides)
• Levelling Up Security @ Riot Games - Mark Hillick (slides)
• SSO: It's the SAML SAML Situation - David Mortman
• Brain Waves Surfing - (In)Security in EEG Technologies - Alejandro Hernandez (slides)
• Keynote - What BASE Jumping Taught Me about Risk - Shyama Rose (slides)
• Didier_Stevens_SDR_Intro.pdf (no vídeo)
• Javier_Marcos_Ted_Reed_OSQuery_Workshop.pdf (no vídeo)
• PDanhieux_EVanBuggenhout_IR_Workshop_Slides.pdf (no vídeo)

Material de LinuxCon Europe 2015



Ya podemos descargarnos las diapositivas (PDFs) de las presentaciones de la LinuxCon Europe 2015 celebrada a principios de este mes de octubre.

• IoTivity Core Framework: Features & Opportunities
• IoT Meets Security
• Creating IoT Demos with IoTivity
• Container mechanics in rkt and Linux
• TC: Traffic Control
• Measuring and reducing crosstalk between virtual machines
• Introduction to GPUs and the Free Software Graphics Stack
• At-Scale Datacenters and the Demand for New Storage Architectures
• Reducing Latency for Linux Transport
• Maximum Performance: How to get it and how to avoid pitfalls
• Linux Performance Profiling and Monitoring
• Introducing the Industrial IIO subsystem - the home of sensor drivers
• Deadline scheduler in the audio domain
• Secure server
• Network Analysis: People and Open Source Communities
• Challenges in Distributed SDN
• Portable Linux Lab - a novel approach to teaching programming in schools
• BitRot detection in GlusterFS
• How to Thoroughly Insult and Offend People in Your Open Source Communities, or “Your #$%@ $%@&ing Sucks and I $%@&ing Hate It"
• OpenSMTPD: we deliver !!
• Use "strace" to understand your shell (BASH)
• gnuplot - A picture says a thousand numbers
• The Devil Wears RPM: Continuous Security Integration
• Introduction to Advanced Bash Usage
• Data Plane Isolation via the Jailhouse Hypervisor
• Enhancements to FreeIPA replication topology management
• Towards Application Driven Storage: Controlling Data Placement and Garbage Collection using RocksDB with LightNVM.
• Developers Care About the License: Using SPDX to Describe License Information
• Outreachy kernel internship report
• Enhance OpenSSH for fun and security
• Balancing Power and Performance in the Linux kernel
• HOW TO DO AFFORDABLE SUPERCOMPUTING AT HOME?
• Suspend/Resume at the Speed of Light
• Setting up an IPv6 Lan with Linux
• eBPF on the mainframe - Packet filtering and more
• Reflections on data plane performance, iptables and ipsets
• How To Make a Positive Impact In Open Source Without Doing Any Coding
• Statistical Performance Analysis with Performance Co-Pilot and R
• Advancements in Automatic File Replication in Gluster
• dbusoorexx - Bringing the Power of D-Bus to Your Fingertips
• Catch Up on the Raspberry Pi
• container management apis: an overview
• NFS-Ganesha and Clustered NAS on Distributed Storage Systems
• Static Analysis of your OSS Project with Coverity
• Tracing virtual machines from the host with trace-cmd virt-server
• ACPI on ARM64: challenges ahead
• IoTivity, the Open Interconnect Consortium and the IoT Challenge
• System recovery with BTRFS and snapshots/rollback
• Boosting Developer Productivity with Clang

Vídeos de GrrCON 2015



Una vez más desde la web de IronGeek podemos ver los vídeos que se han publicado de la edición de este año de GrrCON, conferencia anual sobre seguridad celebrada en Michigan los pasados 9 y 10 de octubre.

• Subject matter to be determined by the number of federal agents present in the audience Chris Roberts
• Breaking in Bad (I,m The One Who Doesn,t Knock) Jayson Street
• Process The Salvation of Incident Response - Charles Herring
• But Can They Hack?: Examining Technological Proficiency in the US Far Right Tom Holt
• The wrong side of history - everything that is old is new again Arron Finnon
• Poking The Bear Mike Kemp
• The Hitch Hikers Guide to Information Security Kellman Meghu
• Backdooring Git John Menerick
• Spanking the Monkey (or how pentesters can do it better!) Justin Whithead, Chester Bishop
• Adding +10 Security to Your Scrum Agile Environment tehEx0dus
• How I Got Network Creds Without Even Asking: A Social Engineering Case Study Jen Fox
• Shooting Phish in a Barrel and Other Terrible Fish Related Puns infosystir
• This Is All Your Fault Duncan Manuts
• The Safety You Think You Have is Only a Masquerade Nathan Dragun
• Security Incident Response Derek Milroy
• Hacking the Next Generation HealWHans
• Findings Needles in a Needlestack: Enterprise Mass Triage Keven Murphy
• Punch and Counter-punch Part Deux: Web Applications J Wolfgang Goerlich, NerdyBeardo
• Application Recon - The Lost Art Tony Miller
• The Hand That Rocks the Cradle: Hacking Baby Monitors Mark Stanislav
• Software Security IWR Thomas "G13" Richards
• Cyber 101 - Upstaring your career in a leading industry Johnny Deutsch
• Understanding and Improving the Military Cyber Culture Dariusz Mikulski
• Harness the Force for Better Penetration Testing Patrick Fussell
• Targeted Attacks and the Privileged Pivot Mark Nafe
• Shell scripting live Linux Forensics Dr. Phil Polstra
• Can you patch a cloud? Scott Thomas
• Is it EVIL? Chaoticflaws
• Ticking me off: From Threat Intel to Reversing Juan Cortes
• Securing Todays Enterprise WAN Andy Mansfield
• Footprints of This Year's Top Attack Vectors Kerstyn Clover
• Phones and Privacy for Consumers Matt Hoy (mattrix) and David Khudaverdyan (deltaflyer)
• Path Well-Traveled: Common Mistakes with SIEM Nick Jacob
• How compliance doesn't have to suck….at least totally Robert Carson & Bradley Stine
• What is a cloud access broker and do I need one? Tom Doane
• Security Frameworks: What was once old is new again Brian Wrozek
• Attacks Against Critical Infrastructures Weakest Links Jonathan Curtis
• Wireless Intrusion Detection Systems with the Raspberry Pi Chris J
• No One Cares About Your Data Breach Except You ... And Why Should They? Joel Cardella

Vídeos de Black Hat USA 2015



Y después del material, ya podemos acceder también a los vídeos de las presentaciones de Black Hat USA 2015:

• ZigBee Exploited The Good, The Bad, And The Ugly
• WSUSpect Compromising The Windows Enterprise Via Windows Update
• Writing Bad @$$ Malware For OS X
• Winning The Online Banking War
• Why Security Data Science Matters & How It's Different Pitfalls And Promises Of
• Why Security Data Science Matters & How It's Different Pitfalls And Promises Of
• When IoT Attacks Hacking A Linux Powered Rifle
• Web Timing Attacks Made Practical
• Using Static Binary Analysis To Find Vulnerabilities And Backdoors In Firmware
• Unicorn Next Generation CPU Emulator Framework
• Understanding The Attack Surface & Attack Resilience Of Project Spartan's New E
• Understanding And Managing Entropy Usage
• TrustKit Code Injection On IOS 8 For The Greater Good
• ThunderStrike 2 Sith Strike
• THIS IS DeepERENT Tracking App Behaviors With Nothing Changed Phone
• These're Not Your Grand Daddy's CPU Performance Counters CPU Hardware Performa
• The Tactical Application Security Program Getting Stuff Done
• The NSA Playset A Year Of Toys And Tools
• The Node js Highway Attacks Are At Full Throttle
• The Memory Sinkhole Unleashing An X86 Design Flaw Allowing Universal Privilege
• The Little Pump Gauge That Could Attacks Against Gas Pump Monitoring Systems
• The Lifecycle Of A Revolution
• The Kali Linux Dojo Workshop #2 Kali USB Setups With Persistent Stores & LUKS N
• The Kali Linux Dojo Workshop #1 Rolling Your Own Generating Custom Kali Linux 2
• The Battle For Free Speech On The Internet
• The Applications Of Deep Learning On Traffic Identification
• Taxonomic Modeling Of Security Threats In Software Defined Networking
• Targeted Takedowns Minimizing Collateral Damage Using Passive DNS
• Taking Event Correlation With You
• Take A Hacker To Work Day How Federal Prosecutors Use The CFAA
• Switches Get Stitches
• Subverting Satellite Receivers For Botnet And Profit
• Stranger Danger! What Is The Risk From 3rd Party Libraries
• Staying Persistent In Software Defined Networks
• Stagefright Scary Code In The Heart Of Android
• Spread Spectrum Satcom Hacking Attacking The Globalstar Simplex Data Service
• Social Engineering The Windows Kernel Finding & Exploiting Token Handling Vulne
• SMBv2 Sharing More Than Just Your Files
• Server Side Template Injection RCE For The Modern Web App
• Securing Your Big Data Environment
• ROPInjector Using Return Oriented Programming For Polymorphism & Antivirus Evas
• Rocking The Pocket Book Hacking Chemical Plant For Competition And Extortion
• Review And Exploit Neglected Attack Surfaces In IOS 8
• Return To Where You Can't Exploit What You Can't Find
• Repurposing OnionDuke A Single Case Study Around Reusing Nation State Malware
• Remote Physical Damage 101 Bread And Butter Attacks
• Remote Exploitation Of An Unaltered Passenger Vehicle
• Red Vs Blue Modern Active Directory Attacks, Detection, And Protection
• PWNIE AWARDS
• Pen Testing A City
• Panel How The Wassenaar Arrangement's Export Control Of Intrusion Soft Affect
• Optimized Fuzzing IOKit In IOS
• My Bro The ELK Obtaining Context From Security Events
• Most Ransomware Isn't As Complex As You Might Think
• Mobile Point Of Scam Attacking The Square Reader
• Is The NSA Still Listening To Your Calls A Surveillance Debate Congressiona
• Internet Scale File Analysis
• Internet Facing PLCs A New Back Orifice
• Internet Plumbing Gor Security Professionals The State Of BGP Security
• Information Access And Information Sharing Where We Are And Where We Are Going
• How Vulnerable Are We To Scams
• How To Implement IT Security After A Cyber Meltdown
• How To Hack Government Technologists As Policy Makers
• Hidden Risks Of Biometric Identifiers And How To Avoid Them
• HI THIS IS URGENT PLZ FIX ASAP Critical Vulnerabilities And Bug Bounty Programs
• Harnessing Intelligence From Malware Repositories
• Graphic Content Ahead Towards Auto Scalable Analysis Of Graphical Images Emb
• GameOver Zeus Badguys And Backends
• From False Positives To Actionable Analysis Behavioral Intrusion Detection
• Forging The USB Armory, An Open Source Secure Flash Drive Sized Computer
• Fingerprints On Mobile Devices Abusing And Leaking
• FileCry The New Age Of XXE
• Faux Disk Encryption Realities Of Secure Storage On Mobile Devices
• Exploiting XXE Vulnerabilities In File Parsing Functionality
• Exploiting The DRAM Rowhammer Bug To Gain Kernel Privileges
• Exploiting Out of Order Execution For Covert Cross VM Communication
• Emanate Like A Boss Generalized Covert Data Exfiltration With Funtenna
• Dom Flow Untangling The DOM For More Easy Juicy Bugs
• Distributing The Reconstruction Of High Level Intermediate Representation
• Defeating Pass the Hash Separation Of Powers
• Defeating Machine Learning What Your Security Vendor Is Not Telling You
• Deep Learning On Disassembly
• Data Driven Threat Intelligence Metrics On Indicator Dissemination And Sharing
• Dance Like Nobodys Watching Encrypt Like Everyone Is A Peek Inside The BlackHat
• Crash & Pay How To Own And Clone Contactless Payment Devices
• CrackLord Maximizing Password Cracking Boxes
• Commercial Mobile Spyware Detecting The Undetectable
• Cloning 3G4G SIM Cards With A PC And An Oscilloscope Lessons Learned
• Certifi gate Front Door Access To Pwning Millions Of Androids
• Bypass Surgery Abusing Content Delivery Networks With Ser-Side Request Forgery
• Bypass Control Flow Guard Comprehensively
• Broadcasting Your Attack Security Testing DAB Radio In Cars
• Bringing A Cannon To A Knife Fight
• Bring Back The Honeypots
• Breaking Payloads With Runtime Code Stripping And Image Freezing
• Breaking HTTPS With BGP Hijacking
• Breaking Honeypots For Fun And Profit
• Breaking Access Controls With BLEKey
• Big Game Hunting The Peculiarities Of Nation State Malware Research
• BGP Stream
• Behind The Mask The Agenda, Tricks, & Tactics Of The Federal Trade Commission A
• Battle Of The SKM And IUM How Windows 10 Rewrites OS Architecture
• Back Doors And Front Doors Breaking The Unbreakable System
• Automated Human Vulnerability Scanning With AVA
• Attacking Interoperability An OLE Edition
• Attacking Hypervisors Using Firmware And Hardware
• Attacking ECMAScript Engines With Redefinition
• Assessing And Exploiting BigNum Vulnerabilities
• API Deobfuscator Resolving Obfuscated API Functions In Modern Packers
• Android Security State Of The Union
• Ah! Universal Android Rooting Is Back
• Adventures In Femtoland 350 Yuan For Invaluable Fun
• Advanced IC Reverse Engineering Tech In Depth Analysis Of A Modern Smart Ca
• Abusing XSLT For Practical Attacks
• Abusing Windows Management Instrumentation WMI To Build A Persistent, Asyn
• Abusing Silent Mitigations Understanding Weaknesses Within Internet Explorer's

Vídeos del Chaos Communication Camp 2015



Para cualquier profesional en el campo de la seguridad informática, el verano no es precisamente la temporada para desconectar, si no todo lo contrario, es la época del año en la que te tienes que poner las botas y absorber toda la información que puedas, sobre todo de las grandes conferencias sobre seguridad que acontecen alrededor del mundo.

En este caso hablamos de Chaos Communication Camp, una conferencia veraniega organizada por miembros del CCC (Chaos Communication Club), que cómo sabemos, éste se celebra una de las mejores conferencias del mundo a finales de diciembre.

Material de USENIX 24 y sus talleres: WOOT, CSET, FOCI, HealthTech, 3GSE, HotSet y JETS



La organización sobre computación avanzada USENIX, celebra su 24 simposio sobre seguridad. Dicho evento termina hoy, pero el contenido de las charlas ya se encuentran disponibles:

• Post-Mortem of a Zombie: Conficker Cleanup After Six Years - Paper
• Mo(bile) Money, Mo(bile) Problems: Analysis of Branchless Banking Applications in the Developing World - Paper
• Measuring the Longitudinal Evolution of the Online Anonymous Marketplace Ecosystem - Paper
• Under-Constrained Symbolic Execution: Correctness Checking for Real Code - Paper
• TaintPipe: Pipelined Symbolic Taint Analysis - Paper
• Type Casting Verification: Stopping an Emerging Attack Vector - Paper
• All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and TLS - Paper
• Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS - Paper
• Eclipse Attacks on Bitcoin’s Peer-to-Peer Network - Paper
• Compiler-instrumented, Dynamic Secret-Redaction of Legacy Processes for Attacker Deception - Paper
• Control-Flow Bending: On the Effectiveness of Control-Flow Integrity - Paper
• Automatic Generation of Data-Oriented Exploits - Paper
• Protocol State Fuzzing of TLS Implementations - Paper
• Verified Correctness and Security of OpenSSL HMAC - Paper
• Not-Quite-So-Broken TLS: Lessons in Re-Engineering a Security Protocol Specification and Implementation - Paper
• To Pin or Not to Pin—Helping App Developers Bullet Proof Their TLS Connections - Paper
• De-anonymizing Programmers via Code Stylometry - Paper
• RAPTOR: Routing Attacks on Privacy in Tor - Paper
• Circuit Fingerprinting Attacks: Passive Deanonymization of Tor Hidden Services - Paper
• SecGraph: A Uniform and Open-source Evaluation System for Graph Data Anonymization and De-anonymization - Paper
• Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobilizer - Paper
• Trustworthy Whole-System Provenance for the Linux Kernel - Paper
• Securing Self-Virtualizing Ethernet Devices - Paper
• EASEAndroid: Automatic Policy Analysis and Refinement for Security Enhanced Android via Large-Scale Semi-Supervised Learning - Paper
• Marionette: A Programmable Network Traffic Obfuscation System - Paper
• CONIKS: Bringing Key Transparency to End Users - Paper
• Investigating the Computer Security Practices and Needs of Journalists - Paper
• Constants Count: Practical Improvements to Oblivious RAM - Paper
• Raccoon: Closing Digital Side-Channels through Obfuscated Execution - Paper
• M2R: Enabling Stronger Privacy in MapReduce Computation - Paper
• Measuring Real-World Accuracies and Biases in Modeling Password Guessability - Paper
• Sound-Proof: Usable Two-Factor Authentication Based on Ambient Sound - Paper
• Android Permissions Remystified: A Field Study on Contextual Integrity - Paper
• Phasing: Private Set Intersection Using Permutation-based Hashing - Paper
• Faster Secure Computation through Automatic Parallelization - Paper
• The Pythia PRF Service - Paper
• EVILCOHORT: Detecting Communities of Malicious Accounts on Online Services - Paper
• Trends and Lessons from Three Years Fighting Malicious Extensions - Paper
• Meerkat: Detecting Website Defacements through Image-based Object Recognition - Paper
• Recognizing Functions in Binaries with Neural Networks - Paper
• Reassembleable Disassembling - Paper
• How the ELF Ruined Christmas - Paper
• Finding Unknown Malice in 10 Seconds: Mass Vetting for New Threats at the Google-Play Scale - Paper
• You Shouldn’t Collect My Secrets: Thwarting Sensitive Keystroke Leakage in Mobile IME Apps - Paper
• Boxify: Full-fledged App Sandboxing for Stock Android - Paper
• Cookies Lack Integrity: Real-World Implications - Paper
• The Unexpected Dangers of Dynamic JavaScript - Paper
• ZigZag: Automatically Hardening Web Applications Against Client-side Validation Vulnerabilities - Paper
• Anatomization and Protection of Mobile Apps’ Location Privacy Threats - Paper
• LinkDroid: Reducing Unregulated Aggregation of App Usage Behaviors - Paper
• PowerSpy: Location Tracking Using Mobile Device Power Analysis - Paper
• In the Compression Hornet’s Nest: A Security Study of Data Compression in Network Services - Paper
• Bohatei: Flexible and Elastic DDoS Defense - Paper
• Boxed Out: Blocking Cellular Interconnect Bypass Fraud at the Network Edge - Paper
• GSMem: Data Exfiltration from Air-Gapped Computers over GSM Frequencies - Paper
• Thermal Covert Channels on Multi-core Platforms - Paper
• Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors - Paper
• Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches - Paper
• A Placement Vulnerability Study in Multi-Tenant Public Clouds - Paper
• A Measurement Study on Co-residence Threat inside the Cloud - Paper
• Towards Discovering and Understanding Task Hijacking in Android - Paper
• Cashtags: Protecting the Input and Display of Sensitive Data - Paper
• SUPOR: Precise and Scalable Sensitive User Input Detection for Android Apps - Paper
• UIPicker: User-Input Privacy Identification in Mobile Applications - Paper
• Cloudy with a Chance of Breach: Forecasting Cyber Security Incidents - Paper
• WebWitness: Investigating, Categorizing, and Mitigating Malware Download Paths - Paper
• Vulnerability Disclosure in the Age of Social Media: Exploiting Twitter for Predicting Real-World Exploits - Paper
• Needles in a Haystack: Mining Information from Public Dynamic Analysis Sandboxes for Malware Intelligence - Paper

A este evento le preceden una serie de talleres enfocados en temas más específicos, también dentro del ámbito de la seguridad informática: WOOT, CSET, FOCI, HealthTech, 3GSE, HotSet y JETS.

Cada uno de dichos talleres, a excepción de HotSet, también han publicado el contenido de sus sesiones, aunque en el caso the HealthTech sólo tienen publicada una de ellas.

Material de Defcon 23



Y después de Black Hat, llega Defcon. Ya podemos acceder a las presentaciones de la edición 23 de la conferencia más grande sobre seguridad informática.

• 3alarmlampscooter
  • 3alarmlampscooter-DIY-Nukeproofing.pdf
• Alessandro Di Federico
  • Alessandro-Di-Federico-Leakless-How-The-ELF-ruined.pdf
• Amit Ashbel & Maty Siman
  • Amit-Ashbel-Maty-Siman-Game-of-Hacks-Play-Hack-and.pdf
• AmmonRa
  • ammonRA-How-to-hack-your-way-out-of-home-detention.pdf
• Andres Blanco & Andres Gazzoli
  • Andres-Blanco-802.11-Massive-Monitoring.pdf
• Atlas
  • Atlas-Fun-With-Symboliks.pdf
• Bart Kulach
  • Bart-Kulach-Hack-the-Legacy-IBMi-revealed.pdf
• Brent White
  • Brent-White-Hacking-Web-Apps-WP.pdf
• Brian Gorenc & Abdul Aziz Hariri & Jason Spelman
  • Hariri-Spelman-Gorenc-Abusing-Adobe-Readers-JavaSc.pdf
• Bruce Potter
  • Bruce-Potter-Hackers-Guide-to-Risk.pdf
• Chris Domas
  • Chris-Domas-REpsych.pdf
• Chris Rock
  • Chris-Rock-I-Will-Kill-You-How-to-Get-Away-with-Mu.pdf
• Chris Sistrunk
  • Chris-Sistrunk-NSM-101-for-ICS.pdf
• Colby Moore
  • Colby-Moore-Spread-Spectrum-Satcom-Hacking.pdf
• Colin O'Flynn
  • Colin-O'Flynn-Dont-Whisper-My-Chips.pdf
• Collin Anderson & Tom Cross
  • Collin-Anderson-Tom-Cross-Export-Controls-on-Intru.pdf
• Collin Cassidy & Robert Lee & Eireann Leverett
  • Cassidy-Leverett-Lee-Switches-Get-Stitches.pdf
• Craig Young
  • Extras/
  • Craig-Young-How-To-Train-Your-RFID-Hacking-Tools.pdf
• Dakahuna & Satanklawz
  • DaKahuna-Satanlawz-Introduction-to-SDR-and-Wifi-Vi.pdf
• Damon Small
  • Damon-Small-Beyond-the-Scan.pdf
• Daniel Crowley & Damon Smith
  • Daniel-Crowley-Damon-Smith-Bugged-Files.pdf
• Daniel Selifonov
  • Daniel-Selifonov-Drinking-from-LETHE.pdf
• David An
  • David-An-When-the-Secretary-of-State-says-Stop-Hac.pdf
• David Huerta
  • David-Huerta-Alice-and-Bob-are-Really-Confused.pdf
• David Mortman
  • David-Mortman-Docker.pdf
• Eijah
  • Eijah-Crypto-for-Hackers.pdf
• Eric (XlogicX) Davisson
  • Eric-XlogicX-Davisson-ReDoS.pdf
• Eric Van Albert & Zack Banks
  • Eric-Van-Albert-Zack-Banks-Looping-Surveillance-Ca.pdf
• Etienne Martineau
  • Etienne-Martineau-Inter-VM-Data-Exfiltration.pdf
• Evilrob & Xaphan
  • Evilrob-Xaphan-TLS-Canary-Keeping-Your-Dick-Pics-S.pdf
• Fatih Ozavci
  • Fatih-Ozavci-The-Art-of-VoIP-Workshop.pdf
• Fernando Arnaboldi
  • Fernando-Arnaboldi-Abusing-XSLT-for-Practical-Atta.pdf
  • Fernando-Arnaboldi-Abusing-XSLT-for-Practical-_002.pdf
• Gerard Laygui
  • Gerard-Laygui-Forensic-Artifacts-Pass-The-Hash-Att.pdf
• Grant Bugher
  • Grant-Bugher-Obtaining-and-Detecting-Domain-Persis.pdf
• Gregory Pickett
  • Extras/
  • Gregory-Pickett-Staying-Persistant-in-Software-Def.pdf
• Ian Kline
  • Ian-Kline-LTE-Recon-and-Tracking-with-RTLSDR.pdf
• Ian Latter
  • Ian-Latter-Remote-Access-the-APT.pdf
• Ionut Popescu
  • Ionut-Popescu-NetRipper-WP.pdf
  • Ionut-Popescu-NetRipper.pdf
• Jason Haddix
  • Jason-Haddix-How-Do-I-shot-Web.pdf
• Jeremy Dorrough
  • Jeremy-Dorrough-USB-Attack-to-Decrypt-Wi-Fi-Commun.pdf
• John Menerick
  • John-Menerick-Backdooring-Git.pdf
• John Seymour
  • John-Seymour-Quantum-Classification-of-Malware-WP.pdf
  • John-Seymour-Quantum-Classification-of-Malware.pdf
• Jose Selvi
  • Jose-Selvi-Breaking-SSL-Using-Time-Synchronisation.pdf
• Joshua Smith
  • Joshua-Smith-High-Def-Fuzzing-Exploitation-Over-HD.pdf
• Justin Engler
  • Justin-Engler-Secure-Messaging-For-Normal-People-W.pdf
  • Justin-Engler-Secure-Messaging-For-Normal-People.pdf
• Ken Westin
  • Ken-Westin-Confessions-of-a-Cyberstalker.pdf
• Lance Butters (Nemus)
  • Lance-Buttars-Nemus-SQLi-on-LAMP.pdf
• Li Jun & Yang Qing
  • Li-Jun-Yang-Qing-I-AM-A-NEWBIE-YET-I-CAN-HACK-ZIGB.pdf
• Lin Huang & Qing Yang
  • Lin-Huang-Qing-Yang-GPS-Spoofing.pdf
• Luke Young
• Mahdi Namazifar
  • Mahdi-Namazifar-Detecting-Random-Strings-Language-.pdf
• Maiubiz
  • Miaubiz-Put-on-Your-Tinfo_t-Hat.pdf
• Marina Krotofil & Jason Larsen
  • Marina-Krotofil-Jason-Larsen-Rocking-the-Pocke_002.pdf
  • Marina-Krotofil-Jason-Larsen-Rocking-the-Pocketboo.pdf
• Mark Ryan Talabis
  • Mark-Ryan-Talabis-The-Bieber-Project.pdf
• Marte L0ge
  • Marte-L0ge-I-will-Tell-you-your-Lock-Pattern.pdf
• Matt Graeber & Willi Ballenthin & Claudio Teodorescu
  • Ballenthin-Graeber-Teodorescu-WMI-Attacks-Defense-.pdf
• Matteo Becarro & Matteo Collura
  • Matteo-Becarro-Matteo-Collura-Extracting-The-Painf.pdf
• Michael Robinson
  • Michael-Robinson-Knocking-My-Neighbors-Kids-Drone-.pdf
• Michael Schrenk
  • Michael-Schrenk-Applied-Intelligence.pdf
• Mickey Shkatov & Jesse Michael
  • Mickey-Shkatov-Jesse-Michael-Scared-poopless-LTE-a.pdf
• Mike Sconzo
  • Mike-Sconzo-I-am-packer-and-so-can-you.pdf
• Nadeem Douba
  • Extras/
  • Nadeem-Douba-BurpKit.pdf
• Nir Valtman & MosheFerber
  • Nir-Valtman-Moshe-Ferber-From-zero-to-secure-in-1-.pdf
• Omer Coskun
  • Omer-Coskun-Why-Nation-State-Malwares-Target-Telco.pdf
• Panel - Comedy Inception
  • Panel-Comedy-Inception-Amanda-Berlin-Blue-Team-Hel.pdf
• Patrick McNeil
  • Patrick-McNeil-Guidelines-For-Securing-Your-VoIP-P.pdf
• Patrick McNeil & Snide Owen
  • Patrick-McNeil-Owen-Sorry-Wrong-Number.pdf
• Patrick Wardle
  • Patrick-Wardle-DLL-Hijacking-on-OSX.pdf
  • Patrick-Wardle-Stick-that-in-your-(Root)Pipe-and-S.pdf
• Paul Amicelli & David Baptiste
  • Paul-Amicelli-David-Baptiste-How-to-secure-the-key.pdf
• Peter Desfigies, Joshua Brierton & Naveed Ul Islam
  • Desfigies-Brierton-Islam-Guests-N-Goblins-Referenc.txt
  • Desfigies-Brierton-Islam-Guests-N-Goblins.pdf
• Phil Polstra
  • Extras/
  • Phil-Polstra-Hacker-in-the-Wires.pdf
  • Phil-Polstra-One-device-to-Pwn-them-all.pdf
• Phil Young & Chad Rikansrud
  • Extras/
  • Phil-Young-Chad-Rikansrud-Security-Necromancy-Furt.pdf
• Phillip Aumasson
  • Phillip-Aumasson-Quantum-Computers-vs-Computers-Se.pdf
• Rich Kelley
  • Rich-Kelley-Harness-Powershell-Weaponization-Made-.pdf
• Richo Healey & Mike Ryan
  • Richo-Healey-Mike-Ryan-Hacking-Electric-Skateboard.pdf
• Ricky Lawshae
  • Extras/
  • Rickey-Lawshae-Lets-Talk-About-SOAP.pdf
• Rodrigo Almeida
  • Extras/
  • Rodringo-Almeida-Embedded-System-Design-From-E_002.pdf
  • Rodringo-Almeida-Embedded-System-Design-From-Elect.pdf
• Ronny Bull & Jeanna Matthews
  • Extras/
  • Ronny-Bull-Jeanna-Matthews-Exploring-Layer-2-N_002.pdf
  • Ronny-Bull-Jeanna-Matthews-Exploring-Layer-2-Netwo.pdf
• Ryan Castelluci
  • Ryan-Castellucci-Cracking-Cryptocurrency-Brainwall.pdf
• Ryan Mitchell
  • Ryan-Mitchell-Separating-Bots-from-Humans.pdf
• Ryan O'Neil
  • Ryan-O'Neil-Advances-in-Linux-Forensics-ECFS.pdf
• Saif El-Sherei & Etienne Stalmans
  • Saif-El-Sherei-Etienne-Stalmans-SensePost-Introduc.pdf
• Sam Bowne
  • Sam-Bowne-Workshop-Android-Security-Auditing-Mobil.pdf
  • Sam-Bowne-Workshop-Violent-Python.pdf
• Samy Kamkar
  • Extras/
  • Samy-Kamkar-README.txt
• Sarah Edwards
  • Sarah-Edwards-Ubiquity-Forensics.pdf
• Sean Metcalf
  • Sean-Metcalf-Red-vs-Blue-AD-Attack-and-Defense.pdf
• Shawn Webb
  • Shawn-Webb-HardenedBSD-Internals.pdf
• Tamas Szakaly
  • Tamas-Szakaly-Shall-We-Play-A-Game.pdf
• Tony Trummer & Tushar Dalvi
  • Tony-Trummer-Tushar-Dalvi-QARK.pdf
• Topher Timzen & Ryan Allen
  • Topher-Timzen-Acquiring-NET-Objects-From-The-Manag.pdf
  • Topher-Timzen-Ryan-Allen-Hijacking-Arbitrary-NET-A.pdf
  • Topher-Timzen-Ryan-Allen-Hijacking-Arbitrary-N_002.pdf
• Tottenkoph & IrishMASMS
  • Tottenkoph-IrishMASMS-Hackers-Hiring-Hacker.pdf
• Vivek Ramachadran
  • Vivek-Ramachadran-Chellam.pdf
• Wesley McGrew
  • Wesley-McGrew-I-Hunt-Penetration-Testers-WP.pdf
  • Wesley-McGrew-I-Hunt-Penetration-Testers.pdf
• Weston Hecker
  • Weston-Hecker-Goodbye-Memory-Scraping-Malware.pdf
• Xntrik
  • xntrik-Hooked-Browser-Meshed-Networks-with-webRTC-.pdf
• Yan Shoshitaishvili & Fish Wang
  • Yan-Shoshitaishvili-Fish-Wang-Angry-Hacking.pdf
• Yaniv Balmas & Lior Oppenheim
  • Yaniv-Balmas-Lior-Oppenheim-Key-Logger-Video-Mouse.pdf
• Yuwei Zheng & Haoqi Shan
  • Yuwei-Zheng-Haoqi-Shan-Build-a-Free-Cellular-Traff.pdf
• Zach Allen & Rusty Bower
  • Zack-Allen-Rusty-Bower-Malware-In-Gaming.pdf
• fluxist
  • Fluxist-Unbootable-Exploiting-Paylock-Smartboot.pdf

Material de Black Hat USA 2015



Ya tenemos disponible la mayoría de las presentaciones de la Black Hat USA 2015.

La lista es la siguiente:

• The Lifecycle of a Revolution us-15-Granick-The-Lifecycle-Of-A-Revolution.pdf
• Abusing Silent Mitigations - Understanding Weaknesses Within Internet Explorers Isolated Heap and MemoryProtection us-15-Gorenc-Abusing-Silent-Mitigations-Understanding-Weaknesses-Within-Internet-Explorers-Isolated-Heap-And-MemoryProtection.pdf us-15-Gorenc-Abusing-Silent-Mitigations-Understanding-Weaknesses-Within-Internet-Explorers-Isolated-Heap-And-MemoryProtection-wp.pdf
• Abusing Windows Management Instrumentation (WMI) to Build a Persistent Asynchronous and Fileless Backdoor us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent Asynchronous-And-Fileless-Backdoor.pdf us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent Asynchronous-And-Fileless-Backdoor-wp.pdf us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent Asynchronous-And-Fileless-Backdoor-WMIBackdoor.ps1
• Abusing XSLT for Practical Attacks us-15-Arnaboldi-Abusing-XSLT-For-Practical-Attacks.pdf us-15-Arnaboldi-Abusing-XSLT-For-Practical-Attacks-wp.pdf
• Advanced IC Reverse Engineering Techniques: In Depth Analysis of a Modern Smart Card us-15-Thomas-Advanced-IC-Reverse-Engineering-Techniques-In-Depth-Analysis-Of-A-Modern-Smart-Card.pdf
• Adventures in Femtoland: 350 Yuan for Invaluable Fun
• Ah! Universal Android Rooting is Back us-15-Xu-Ah-Universal-Android-Rooting-Is-Back.pdf us-15-Xu-Ah-Universal-Android-Rooting-Is-Back-wp.pdf
• Android Security State of the Union
• API Deobfuscator: Resolving Obfuscated API Functions in Modern Packers us-15-Choi-API-Deobfuscator-Resolving-Obfuscated-API-Functions-In-Modern-Packers.pdf
• Assessing and Exploiting BigNum Vulnerabilities
• Attacking ECMAScript Engines with Redefinition us-15-Silvanovich-Attacking-ECMA-Script-Engines-With-Redefinition us-15-Silvanovich-Attacking-ECMA-Script-Engines-With-Redefinition-wp.pdf
• Attacking Hypervisors Using Firmware and Hardware
• Attacking Interoperability - An OLE Edition us-15-Li-Attacking-Interoperability-An-OLE-Edition.pdf
• Attacking Your Trusted Core: Exploiting Trustzone on Android us-15-Shen-Attacking-Your-Trusted-Core-Exploiting-Trustzone-On-Android.pdf us-15-Shen-Attacking-Your-Trusted-Core-Exploiting-Trustzone-On-Android-wp.pdf
• Automated Human Vulnerability Scanning with AVA us-15-Bell-Automated-Human-Vulnerability-Scanning-With-AVA.pdf
• Back Doors and Front Doors Breaking the Unbreakable System
• Battle of the SKM and IUM: How Windows 10 Rewrites OS Architecture
• Behind the Mask: The Agenda Tricks and Tactics of the Federal Trade Commission as they Regulate Cybersecurity us-15-Daugherty-Behind-The-Mask-The-Agenda-Tricks-And-Tactics-Of-The-Federal-Trade-Commission-As-They-Regulate-Cybersecurity.pdf
• BGP Stream
• Big Game Hunting: The Peculiarities of Nation-State Malware Research us-15-MarquisBoire-Big-Game-Hunting-The-Peculiarities-Of-Nation-State-Malware-Research.pdf
• Breaking Access Controls with BLEKey
• Breaking Honeypots for Fun and Profit
• Breaking HTTPS with BGP Hijacking us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking.pdf us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf
• Breaking Payloads with Runtime Code Stripping and Image Freezing us-15-Mulliner-Breaking-Payloads-With-Runtime-Code-Stripping-And-Image-Freezing.pdf us-15-Mulliner-Breaking-Payloads-With-Runtime-Code-Stripping-And-Image-Freezing-wp.pdf
• Bring Back the Honeypots
• Bringing a Cannon to a Knife Fight
• Broadcasting Your Attack: Security Testing DAB Radio in Cars
• Bypass Control Flow Guard Comprehensively us-15-Zhang-Bypass-Control-Flow-Guard-Comprehensively.pdf us-15-Zhang-Bypass-Control-Flow-Guard-Comprehensively-wp.pdf
• Bypass Surgery Abusing Content Delivery Networks with Server-Side-Request Forgery (SSRF) Flash and DNS
• Certifi-gate: Front-Door Access to Pwning Millions of Androids us-15-Bobrov-Certifi-Gate-Front-Door-Access-To-Pwning-Millions-Of-Androids.pdf us-15-Bobrov-Certifi-Gate-Front-Door-Access-To-Pwning-Millions-Of-Androids-wp.pdf
• Cloning 3G/4G SIM Cards with a PC and an Oscilloscope: Lessons Learned in Physical Security us-15-Yu-Cloning-3G-4G-SIM-Cards-With-A-PC-And-An-Oscilloscope-Lessons-Learned-In-Physical-Security.pdf us-15-Yu-Cloning-3G-4G-SIM-Cards-With-A-PC-And-An-Oscilloscope-Lessons-Learned-In-Physical-Security-wp.pdf
• Commercial Mobile Spyware - Detecting the Undetectable us-15-Dalman-Commercial-Spyware-Detecting-The-Undetectable.pdf us-15-Dalman-Commercial-Spyware-Detecting-The-Undetectable-wp.pdf
• CrackLord: Maximizing Password Cracking Boxes us-15-Morris-CrackLord-Maximizing-Password-Cracking.pdf us-15-Morris-CrackLord-Maximizing-Password-Cracking-wp.pdf us-15-Morris-CrackLord-Maximizing-Password-Cracking-src.zip
• Crash & Pay: How to Own and Clone Contactless Payment Devices us-15-Fillmore-Crash-Pay-How-To-Own-And-Clone-Contactless-Payment-Devices.pdf us-15-Fillmore-Crash-Pay-How-To-Own-And-Clone-Contactless-Payment-Devices-wp.pdf
• Dance Like Nobodys Watching Encrypt Like Everyone Is: A Peek Inside the Black Hat Network
• Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
• Deep Learning on Disassembly us-15-Davis-Deep-Learning-On-Disassembly.pdf
• Defeating Machine Learning: What Your Security Vendor is Not Telling You
• Defeating Pass-the-Hash: Separation of Powers us-15-Moore-Defeating Pass-the-Hash-Separation-Of-Powers.pdf us-15-Moore-Defeating Pass-the-Hash-Separation-Of-Powers-wp.pdf
• Distributing the Reconstruction of High-Level Intermediate Representation for Large Scale Malware Analysis
• Dom Flow - Untangling the DOM for More Easy-Juicy Bugs us-15-Nafeez-Dom-Flow-Untangling-The-DOM-For-More-Easy-Juicy-Bugs.pdf
• Emanate Like a Boss: Generalized Covert Data Exfiltration with Funtenna
• Exploiting Out-of-Order Execution for Covert Cross-VM Communication us-15-DAntoine-Exploiting-Out-Of-Order-Execution-For-Covert-Cross-VM-Communication.pdf us-15-DAntoine-Exploiting-Out-Of-Order-Execution-For-Covert-Cross-VM-Communication-wp.pdf
• Exploiting the DRAM Rowhammer Bug to Gain Kernel Privileges us-15-Seaborn-Exploiting-The-DRAM-Rowhammer-Bug-To-Gain-Kernel-Privileges.pdf us-15-Seaborn-Exploiting-The-DRAM-Rowhammer-Bug-To-Gain-Kernel-Privileges-wp.pdf
• Exploiting XXE Vulnerabilities in File Parsing Functionality us-15-Vandevanter-Exploiting-XXE-Vulnerabilities-In-File-Parsing-Functionality.pdf us-15-Vandevanter-Exploiting-XXE-Vulnerabilities-In-File-Parsing-Functionality-tool.zip
• Faux Disk Encryption: Realities of Secure Storage on Mobile Devices us-15-Mayer-Faux-Disk-Encryption-Realities-Of-Secure-Storage-On-Mobile-Devices-wp.pdf
• FileCry - The New Age of XXE us-15-Wang-FileCry-The-New-Age-Of-XXE.pdf us-15-Wang-FileCry-The-New-Age-Of-XXE-ie-wp.pdf us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
• Fingerprints on Mobile Devices: Abusing and Leaking us-15-Zhang-Fingerprints-On-Mobile-Devices-Abusing-And-Leaking.pdf us-15-Zhang-Fingerprints-On-Mobile-Devices-Abusing-And-Leaking-wp.pdf
• Forging the USB Armory an Open Source Secure Flash-Drive-Sized Computer
• From False Positives to Actionable Analysis: Behavioral Intrusion Detection Machine Learning and the SOC us-15-Zadeh-From-False-Positives-To-Actionable-Analysis-Behavioral-Intrusion-Detection-Machine-Learning-And-The-SOC.pdf us-15-Zadeh-From-False-Positives-To-Actionable-Analysis-Behavioral-Intrusion-Detection-Machine-Learning-And-The-SOC-wp.pdf
• Fuzzing Android System Services by Binder Call to Escalate Privilege us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege.pdf us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege-wp.pdf
• GameOver Zeus: Badguys and Backends us-15-Peterson-GameOver-Zeus-Badguys-And-Backends.pdf us-15-Peterson-GameOver-Zeus-Badguys-And-Backends-wp.pdf
• Graphic Content Ahead: Towards Automated Scalable Analysis of Graphical Images Embedded in Malware us-15-Long-Graphic-Content-Ahead-Towards-Automated-Scalable-Analysis-Of-Graphical-Images-Embedded-In-Malware.pdf
• Harnessing Intelligence from Malware Repositories us-15-Lakhotia-Harnessing-Intelligence-From-Malware-Repositories.pdf
• HI THIS IS URGENT PLZ FIX ASAP: Critical Vulnerabilities and Bug Bounty Programs us-15-Price-Hi-This-Is-Urgent-Plz-Fix-ASAP-Critical-Vulnerabilities-And-Bug-Bounty-Programs.pdf
• Hidden Risks of Biometric Identifiers and How to Avoid Them us-15-Keenan-Hidden-Risks-Of-Biometric-Identifiers-And-How-To-Avoid-Them.pdf us-15-Keenan-Hidden-Risks-Of-Biometric-Identifiers-And-How-To-Avoid-Them-wp.pdf
• How to Hack Government: Technologists as Policy Makers
• How to Implement IT Security After a Cyber Meltdown us-15-Kubecka-How-To-Implement-IT-Security-After-A-Cyber-Meltdown.pdf
• How Vulnerable are We to Scams? us-15-Jakobsson-How-Vulnerable-Are-We-To-Scams.pdf us-15-Jakobsson-How-Vulnerable-Are-We-To-Scams-wp.pdf
• Information Access and Information Sharing: Where We are and Where We are Going
• Internet Plumbing for Security Professionals: The State of BGP Security us-15-Remes-Internet-Plumbing-For-Security-Professionals-The-State-Of-BGP-Security.pdf us-15-Remes-Internet-Plumbing-For-Security-Professionals-The-State-Of-BGP-Security-wp.pdf
• Internet-Facing PLCs - A New Back Orifice us-15-Klick-Internet-Facing-PLCs-A-New-Back-Orifice.pdf us-15-Klick-Internet-Facing-PLCs-A-New-Back-Orifice-wp.pdf
• Internet-Scale File Analysis us-15-Hanif-Internet-Scale-File-Analysis.pdf us-15-Hanif-Internet-Scale-File-Analysis-wp.pdf
• Is the NSA Still Listening to Your Phone Calls? A Surveillance Debate: Congressional Success or Epic Fail
• Mobile Point of Scam: Attacking the Square Reader us-15-Mellen-Mobile-Point-Of-Scam-Attacking-The-Square-Reader.pdf us-15-Mellen-Mobile-Point-Of-Scam-Attacking-The-Square-Reader-wp.pdf
• Most Ransomware Isnt as Complex as You Might Think us-15-Kirda-Most-Ransomware-Isn’t-As-Complex-As-You-Might-Think.pdf us-15-Kirda-Most-Ransomware-Isn’t-As-Complex-As-You-Might-Think-wp.pdf
• My Bro the ELK: Obtaining Context from Security Events us-15-Smith-My-Bro-The-ELK-Obtaining-Context-From-Security-Events.pdf us-15-Smith-My-Bro-The-ELK-Obtaining-Context-From-Security-Events-wp.pdf
• Optimized Fuzzing IOKit in iOS us-15-Lei-Optimized-Fuzzing-IOKit-In-iOS.pdf us-15-Lei-Optimized-Fuzzing-IOKit-In-iOS-wp.pdf
• Panel: Getting It Right: Straight Talk on Threat & Information Sharing
• Panel: How the Wassenaar Arrangements Export Control of Intrusion Software Affects the Security Industry
• Pen Testing a City us-15-Conti-Pen-Testing-A-City.pdf us-15-Conti-Pen-Testing-A-City-wp.pdf
• Red vs Blue: Modern Active Directory Attacks Detection and Protection us-15-Metcalf-Red-Vs-Blue-Modern-Active-Directory-Attacks-Detection-And-Protection.pdf us-15-Metcalf-Red-Vs-Blue-Modern-Active-Directory-Attacks-Detection-And-Protection-wp.pdf
• Remote Exploitation of an Unaltered Passenger Vehicle
• Remote Physical Damage 101 - Bread and Butter Attacks us-15-Larsen-Remote-Physical-Damage-101-Bread-And-Butter-Attacks.pdf
• Repurposing OnionDuke: A Single Case Study Around Reusing Nation State Malware us-15-Pitts-Repurposing-OnionDuke-A-Single-Case-Study-Around-Reusing-Nation-State-Malware.pdf us-15-Pitts-Repurposing-OnionDuke-A-Single-Case-Study-Around-Reusing-Nation-State-Malware-wp.pdf
• Return to Where? You Cant Exploit What You Cant Find
• Review and Exploit Neglected Attack Surfaces in iOS 8 us-15-Wang-Review-And-Exploit-Neglected-Attack-Surface-In-iOS-8.pdf
• Rocking the Pocket Book: Hacking Chemical Plant for Competition and Extortion us-15-Krotofil-Rocking-The-Pocket-Book-Hacking-Chemical-Plant-For-Competition-And-Extortion.pdf us-15-Krotofil-Rocking-The-Pocket-Book-Hacking-Chemical-Plant-For-Competition-And-Extortion-wp.pdf
• ROPInjector: Using Return Oriented Programming for Polymorphism and Antivirus Evasion us-15-Xenakis-ROPInjector-Using-Return-Oriented-Programming-For-Polymorphism-And-Antivirus-Evasion.pdf us-15-Xenakis-ROPInjector-Using-Return-Oriented-Programming-For-Polymorphism-And-Antivirus-Evasion-wp.pdf
• Securing Your Big Data Environment us-15-Gaddam-Securing-Your-Bigdata-Environment.pdf us-15-Gaddam-Securing-Your-Bigdata-Environment-wp.pdf
• Server-Side Template Injection: RCE for the Modern Web App us-15-Kettle-Server-Side-Template-Injection-RCE-For-The-Modern-Web-App-wp.pdf
• SMBv2: Sharing More than Just Your Files us-15-Brossard-SMBv2-Sharing-More-Than-Just-Your-Files-wp.pdf
• Social Engineering the Windows Kernel: Finding and Exploiting Token Handling Vulnerabilities
• Spread Spectrum Satcom Hacking: Attacking the GlobalStar Simplex Data Service us-15-Moore-Spread-Spectrum-Satcom-Hacking-Attacking-The-GlobalStar-Simplex-Data-Service.pdf us-15-Moore-Spread-Spectrum-Satcom-Hacking-Attacking-The-GlobalStar-Simplex-Data-Service-wp.pdf
• Stagefright: Scary Code in the Heart of Android
• Staying Persistent in Software Defined Networks us-15-Pickett-Staying-Persistent-In-Software-Defined-Networks.pdf us-15-Pickett-Staying-Persistent-In-Software-Defined-Networks-wp.pdf us-15-Pickett-Staying-Persistent-In-Software-Defined-Networks-tool.py
• Stranger Danger! What is the Risk from 3rd Party Libraries?
• Subverting Satellite Receivers for Botnet and Profit us-15-Talmat-Subverting-Satellite-Receivers-For-Botnet-And-Profit.pdf us-15-Talmat-Subverting-Satellite-Receivers-For-Botnet-And-Profit-wp.pdf
• Switches Get Stitches us-15-Cassidy-Switches-Get-Stitches.pdf
• Take a Hacker to Work Day - How Federal Prosecutors Use the CFAA us-15-Bailey-Take-A-Hacker-To-Work Day-How-Federal-Prosecutors-Use-The-CFAA.pdf
• Taking Event Correlation with You us-15-King-Taking-Event-Correlation-With-You.pdf us-15-King-Taking-Event-Correlation-With-You-wp.pdf us-15-King-Taking-Event-Correlation-With-You-tool.tgz
• Targeted Takedowns: Minimizing Collateral Damage Using Passive DNS us-15-Vixie-Targeted-Takedowns-Minimizing-Collateral-Damage-Using-Passive-DNS.pdf
• Taxonomic Modeling of Security Threats in Software Defined Networking us-15-Hizver-Taxonomic-Modeling-Of-Security-Threats-In-Software-Defined-Networking.pdf us-15-Hizver-Taxonomic-Modeling-Of-Security-Threats-In-Software-Defined-Networking-wp.pdf
• The Applications of Deep Learning on Traffic Identification us-15-Wang-The-Applications-Of-Deep-Learning-On-Traffic-Identification.pdf us-15-Wang-The-Applications-Of-Deep-Learning-On-Traffic-Identification-wp.pdf
• The Battle for Free Speech on the Internet
• The Kali Linux Dojo Workshop #1: Rolling Your Own - Generating Custom Kali Linux 20 ISOs
• The Kali Linux Dojo Workshop #2: Kali USB Setups with Persistent Stores and LUKS Nuke Support
• The Little Pump Gauge that Could: Attacks Against Gas Pump Monitoring Systems us-15-Wilhoit-The-Little-Pump-Gauge-That-Could-Attacks-Against-Gas-Pump-Monitoring-Systems.pdf us-15-Wilhoit-The-Little-Pump-Gauge-That-Could-Attacks-Against-Gas-Pump-Monitoring-Systems-wp.pdf
• The Memory Sinkhole - Unleashing an x86 Design Flaw Allowing Universal Privilege Escalation us-15-Domas-The-Memory-Sinkhole-Unleashing-An-x86-Design-Flaw-Allowing-Universal-Privilege-Escalation.pdf us-15-Domas-The-Memory-Sinkhole-Unleashing-An-x86-Design-Flaw-Allowing-Universal-Privilege-Escalation-wp.pdf
• The Nodejs Highway: Attacks are at Full Throttle us-15-Siman-The-Node-Js-Highway-Attacks-Are-At-Full-Throttle.pdf
• The NSA Playset: A Year of Toys and Tools us-15-Ossmann-The-NSA-Playset-A-Year-Of-Toys-And-Tools.pdf
• The Tactical Application Security Program: Getting Stuff Done
• These are Not Your Grand Daddys CPU Performance Counters - CPU Hardware Performance Counters for Security us-15-Herath-These-Are-Not-Your-Grand-Daddys-CPU-Performance-Counters-CPU-Hardware-Performance-Counters-For-Security.pdf
• THIS IS DeepERENT: Tracking App Behaviors with (Nothing Changed) Phone for Evasive Android Malware us-15-Park-This-Is-DeepERENT-Tracking-App-Behaviors-With-Nothing-Changed-Phone-For-EvasiveAAndroid-Malware.pdf
• ThunderStrike 2: Sith Strike us-15-Hudson-Thunderstrike-2-Sith-Strike.pdf
• TrustKit: Code Injection on iOS 8 for the Greater Good us-15-Diquet-TrustKit-Code-Injection-On-iOS-8-For-The-Greater-Good.pdf
• Understanding and Managing Entropy Usage us-15-Potter-Understanding-And-Managing-Entropy-Usage.pdf us-15-Potter-Understanding-And-Managing-Entropy-Usage-wp.pdf
• Understanding the Attack Surface and Attack Resilience of Project Spartans New EdgeHTML Rendering Engine us-15-Yason-Understanding-The-Attack-Surface-And-Attack-Resilience-Of-Project-Spartans-New-EdgeHTML-Rendering-Engine.pdf us-15-Yason-Understanding-The-Attack-Surface-And-Attack-Resilience-Of-Project-Spartans-New-EdgeHTML-Rendering-Engine-wp.pdf
• Unicorn: Next Generation CPU Emulator Framework
• Using Static Binary Analysis to Find Vulnerabilities and Backdoors in Firmware us-15-Kruegel-Using-Static-Binary-Analysis-To-Find-Vulnerabilities-And-Backdoors-In-Firmware.pdf
• Web Timing Attacks Made Practical us-15-Morgan-Web-Timing-Attacks-Made-Practical.pdf us-15-Morgan-Web-Timing-Attacks-Made-Practical-wp.pdf
• When IoT Attacks: Hacking a Linux-Powered Rifle us-15-Sandvik-When-IoT-Attacks-Hacking-A-Linux-Powered-Rifle.pdf
• Why Security Data Science Matters and How Its Different: Pitfalls and Promises of Data Science Based Breach Detection and Threat Intelligence us-15-Saxe-Why-Security-Data-Science-Matters-And-How-Its-Different.pdf
• Winning the Online Banking War us-15-Park-Winning-The-Online-Banking-War.pdf us-15-Park-Winning-The-Online-Banking-War-wp.pdf
• Writing Bad @$$ Malware for OS X us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf
• WSUSpect - Compromising the Windows Enterprise via Windows Update us-15-Stone-WSUSpect-Compromising-Windows-Enterprise-Via-Windows-Update.pdf us-15-Stone-WSUSpect-Compromising-Windows-Enterprise-Via-Windows-Update-wp.pdf
• ZigBee Exploited the Good the Bad and the Ugly us-15-Zillner-ZigBee-Exploited-The-Good-The-Bad-And-The-Ugly.pdf us-15-Zillner-ZigBee-Exploited-The-Good-The-Bad-And-The-Ugly-wp.pdf

Iremos actualizando la lista con el material que se vaya publicando.

Vídeos de la Infiltrate 2015



Ya está disponibles los vídeos de la Infiltrate 2015, conferencia sobre seguridad informática celebrada el pasado mes de abril en Miami, Florida.

Los vídeos publicados son los siguientes:

• Alex Ionescu Insection: AWEsomely Exploiting Shared Memory Objects
• Ram Shankar & Sacha Faust Data Driven Offense
• Neil Archibald Modern Objective-C Exploitation
• James Forshaw A Link to the Past: Abusing Symbolic Links on Windows
• Rusty Wagner & Jordan Wiens Hacking Games in a Hacked Game
• Infiltrate2015 BJJ Open Mat - part 2
• Infiltrate2015 BJJ Open Mat - Part 1
• Braden Thomas Technical Keynote: Practical Attacks on DOCSIS
• Nathan Rittenhouse Problems in Symbolic Fuzzing
• Joaquim Espinhara & Rafael Silva MIMOSAWRITERROUTER - Abusing EPC on Cisco Router to collect data
• Patrick Wardle Writing Bad@ss OS X Malware
• Jacob Torrey HARES: Hardened Anti-Reverse Engineering System
• Ray Boisvert [keynote] Abyss or Turning Point: Strategy Skills and Tradecraft in the Age of 21st Century Warfare

Presentaciones de REcon 2015



Ya están disponibles las presentaciones de la REcon 2015, una conferencia sobre seguridad que se celebra anualmente en Montreal, Canadá.

La lista de presentaciones es la siguiente (de acuerdo con el programa, faltan algunas en estos momentos):

• 01-joan-calvet-marion-marschalek-paul-rascagneres-Totally-Spies
• 04-jeffrey-crowell-julien-voisin-Radare2-building-a-new-IDA
• 05-peter-hlavaty-jihui-lu-This-Time-Font-hunt-you-down-in-4-bytes
• 06-sophia-d-antoine-Exploiting-Out-of-Order-Execution
• 07-travis-goodspeed-sergey-bratus-Polyglots-and-Chimeras-in-Digital-Radio-Modes
• 09-yuriy-bulygin-oleksandr-bazhaniuk-Attacking-and-Defending-BIOS-in-2015
• 13-colin-o-flynn-Glitching-and-Side-Channel-Analysis-for-All
• 14-christopher-domas-The-movfuscator
• 16-yong-chuan-koh-Understaning-the-Microsoft-Office-Protected-View-Sandbox
• 17-nitay-artenstein-shift-reduce-Pandora-s-Cash-Box-The-Ghost-Under-Your-POS
• 18-andrew-zonenberg-From-Silicon-to-Compiler
• 20-steven-vittitoe-Reverse-Engineering-Windows-AFD-sys
• 21-j00ru-One-font-vulnerability-to-rule-them-all

Vídeos de la OWASP AppSec Europa 2015



Ya están disponibles los vídeos de la OWASP AppSec Europa 2015 celebrada en Amsterdam del 19 al 22 de mayo.

• Martin Knobloch - Opening ceremony
• Joshua Corman - Continuous Acceleration: Why Continuous Everything Requires A Suppl...
• Nicolas Gregoire - Server-Side Browsing Considered Harmful
• Yossi Daya - Rise Of The Machines - How Automated Processes Overtook the Web
• Aaron Weaver - Building An AppSec Pipeline: Keeping Your Program, And Your Life, Sane
• Andrew Lee-Thorp - So, You Want To Use A WebView? [BAD AUDIO]
• Dirk Wetter - Security And Insecurity Of HTTP Headers
• Carsten Huth, Nadim Barsoum, Dawid Sroka - Security Touchpoints When Acquiring Soft...
• L. Desmet, M. Johns - WebRTC, Or How Secure Is P2P Browser Communication? [BAD AUDIO]
• Rory Mccune - Security And Modern Software Deployment
• Paul Malone - Implementing A User-Centric Datastore
• Helen McLaughlin - Can Saas Ever Be Secure?
• David Vaartjes - Agile Security Testing - Lessons Learned
• Wojtek Dworakowski - E-Banking Transaction Authorization - Common Vulnerabilities, ...
• Hans Folmer - Security is Part Of The DNA Of A Defense Organization
• Christian Schneider - Security DevOps - Staying Secure In Agile Projects
• Steve Lord - Securing The Internet Of Things
• Dan Cornell - Mobile Application Assessments By The Numbers: A Whole-istic View
• Thibault Koechlin - Naxsi, A Web Application Firewall for NGINX
• Frederik Braun - Using A JavaScript CDN That Can Not XSS You - With Subresource Int...
• Tom Van Goethem - Issues And Limitations Of Third Party Security Seals
• Alex Infuhr - PDF - Mess With The Web
• Dmitry Savintsev - Finding Bad Needles On A Worldwide Scale
• Brenno De Winter - The Software Not The Human Is The Weakest Link
• Luca De Fulgentis - Windows Phone App Security For Builders And Breakers
• Tobias Gondrom, Jaya Baloo, Dr. Melanie Rieback, Dhillon Andrew Kannabhiran - Women...
• Matt Tesauro - Lessons From DevOps: Taking DevOps Practices Into Your AppSec Life
• Tobias Gondrom - From Zero To Hero - Or How OWASP Saved My Holiday
• Jim Manico - HTTPS Is Better than Ever Before. Now Its Your Turn.
• Jonathan Cran - Hard Knock Lessons On Bug Bounties
• Ange Albertini - Preserving Arcade Games
• Mario Heiderich - Copy Pest - A Case Study On The ClipBoard, Blind Trust And Invis...
• Gareth Heyes - XSS Horror Show
• Matt Johansen, Johnathan Kuskos - The Top 10 Web Hacks of 2014
• Troy Hunt - 50 Shades of AppSec
• Greg Patton - The API Assessment Primer
• Florian Stahl, Stefan Burgmair - OWASP Top 10 Privacy Risks
• Martin Knobloch, Tobias Gondrom - Opening ceremony
• Michele Spagnuolo - Abusing JSONP With Rosetta Flash
• Frank Breedijk - Red Team, Blue Team Or White Cell? Trends In IT And How They Force...
• Eduardo Vela Nava - Web Service Workers - Breaking The Web Because It Would Be A Sh...
• Simon Bennetts - OWASP ZAP: More Advanced Features
• Matias Madou, Daan Raman - If 6,000 Mobile Malware Applications Could Talk! Ow, The...
• Achim D. Brucker - Bringing Security Testing To Development: How To Enable Develop...
• Michele Orru - Dark Fairytales From A Phisherman
• Marek Zachara - Collective Detection Of Harmful Requests
• Or Katz, Ezra Caltum - Maliciously Monetizing AppSec Feature. Its All About The Money.
• Ian Haken - Security Policy Management: Easy as PIE
• Martin Johns, Sebastian Lekies, Ben Stock - Client-Side Protection Against DOM-Base...
• Maty Siman - The Node.js Highway: Attacks Are At Full Throttle
• Conference Team - Closing ceremony

Aquí tienes otras opciones de descarga.

Material de la Hack In The Box Amsterdam 2015



Ya está disponible el material de la Hack In The Box Amsterdam 2015.

• D1T1 - Alfonso De Gregorio - illusoryTLS.pdf
• D1T1 - Markus Vervier - Mobile Authentication Subspace Travel.pdf
• D1T1 - R. Rodriguez P. Vila - Relay Attacks in EMV Contactless Cards with Android OTS Devices.pdf
• D1T1 - Saumil Shah - Stegosploit - Hacking with Pictures.pdf
• D1T1 - T. Yunusov K. Nesterov - Bootkit via SMS.pdf
• D1T1 - Xeno Kovah and Corey Kallenberg - How Many Million BIOSes Would You Like to Infect.pdf
• D1T2 - Alexey Tiurin - Oracle Peoplesoft Applications are Under Attack.pdf
• D1T2 - Andrea Barisani - Forging the USB Armory.pdf
• D1T2 - Anestis Bechtsoudis - Fuzzing Objects d%e2%80%99 ART.pdf
• D1T2 - Bas Venis - Exploiting Browsers the Logical Way.pdf
• D1T2 - Pedram Hayati - Uncovering Secret Connections Amongst Attackers.pdf
• D1T2 - Tony Trummer and Tushar Dalvi - Mobile SSL Failures.pdf
• D1T3 LAB - Breaking Bad Crypto.zip
• D1T3 LAB - Dider Stevens and Xavier Mertens - Memory Forensics for Cisco iOS.pdf
• D1T3 LAB - Tony Trummer - Attacking Android Apps.pdf
• KEYNOTE 1 - Marcia Hoffmann - Fighting for Internet Security in the New Crypto Wars.pdf
• Exploiting Browsers the Logical Way.pdf
• Mobile Authentication Subspace Travel.pdf
• Oracle PeopleSoft applications are under attack.pdf
• Relay Attacks in EMV Contactless Cards with Android OTS Devices.pdf
• The illusoryTLS Asymmetric Backdoor.pdf
• Uncovering Secret Connections Among Attackers by Using Network Theory and Custom Honeypots.pdf

Vídeos de la BSides Boston 2015



Desde la web de irongeek podemos acceder a los vídeos de la BSides Boston 2015.

• The Securitized State: Where it came from, where it's going, what can be done about it Molly Sauter
• Is Threat Modeling for Me? Robert Hurlbut
• Hacker or criminal? Repairing the reputation of the infosec community. Melanie Ensign
• Running Away from Security: Web App Vulnerabilities and OSINT Collide Micah Hoffman
• Robots, Ninjas, Pirates and Building an Effective Vulnerability Management Program Paul Asadoorian
• Protect Your "Keys to the Kingdom" _ Securing Against the Next Inevitable Cyberattack Paul Kozlov
• In pursuit of a better crypto puzzle Samuel Erb
• When penguins attack - Linux's role in the malware ecosystem Chester Wisniewski
• The Benefits in Externalizing DMZ-as-a-Service in the Cloud Israel Barak
• Common misconfigurations that lead to a breach Justin Tharpe
• Applying Big Data technology to security use case Max Pevzner
• Marketing: They're not all Schmucks. Jen Ellis & Josh Feinblum
• Next-Gen Incident Management - Building out a Modern Incident Management Capability John McDonald
• Closing

Vídeos PyCon 2015



Entre el 8 y el 16 de abril, se celebró en Montreal la conferencia más distinguida enfocada al lenguaje de programación Python: PyCon 2015.

La lista de charlas es bastante amplia y tocan todo tipo de temas alrededor de Python. Si te interesa este lenguaje de programación que tan de moda está, aquí tienes material de sobra para pasar un buen rato:

• Keynote - Guido van Rossum
• Keynote - Gabriella Coleman
• Type Hints - Guido van Rossum
• Closing Messages
• Jim Baker - Getting to Jython 2.7 and beyond
• Mike Howsden - Zen of Quality - How PBS measures QoS for digital viewers
• Luke Sneeringer - Improve your development environments with virtualization
• Thomas Ballinger - Terminal whispering
• Geoff Gerrietts - Performance by the Numbers: analyzing the performance of web applications
• Curtis Lassam - Hash Functions and You: Partners in Freedom
• Mica Swyers, Jay Chan - Finding Spammers & Scammers through Rate Tracking with Python & Redis
• Christine Spang - WebSockets from the Wire Up
• Tom Eastman - Serialization formats are not toys
• ---Incomplete talk --- A. Jesse Jiryu Davis - Python Performance Profiling: The Guts And The Glory
• Pete Fein - Free Software, Free People
• Sarah Bird - Interactive data for the web - Bokeh for web developers
• Andrew Montalenti - streamparse: real-time streams with Python and Apache Storm
• Ying Li - Where in your RAM is "python san_diego.py"?
• Hynek Schlawack - Beyond grep: Practical Logging and Metrics
• Smart services & smart clients: How micro-services change the way you build and deploy code.
• Christine Spang - To ORM or not to ORM
• Keynote - Jacob Kaplan-Moss - Pycon 2015
• Keynote - Van Lindberg - Pycon 2015
• Lightning Talks - April 11th 17h30 - Pycon 2015
• Lightning Talks - April 12th 08h30 - Pycon 2015
• Kathleen Danielson - Avoiding Burnout, and other essentials of Open Source Self-Care
• Jim Baker - A Winning Strategy with The Weakest Link: how to use weak references…
• Colton Myers - Managing Your Infrastructure with SaltStack
• Nicholas Tollervey - Lessons learned with asyncio ("Look ma, I wrote a distributed hash table!")
• Clayton Parker - So you think you can PDB?
• Sasha Laundy - Your Brain's API: Giving and Getting Technical Help
• Brandon Rhodes - Oh, Come On Who Needs Bytearrays
• A. Jesse Jiryu Davis - Eventually Correct: Testing Async Apps
• Matt Makai, Kate Heddleston - Choose Your Own WSGI Deployment Adventure
• Alex Gaynor - Techniques for Debugging Hard Problems
• Allison Kaptur - Exploring is never boring: understanding CPython without reading the code
• Carina C. Zona - Schemas for the Real World
• Daniel Vanderkam - Make web development awesome with visual diffing tools
• Laura Rupprecht - Describing Descriptors
• Domen Kožar - Rethinking packaging, development and deployment
• Elizabeth Ramirez - Graph Database Patterns in Python
• en zyme, Jon Henner - Pythons are Deaf, So are Some Pythonistas
• Olivier Grisel - Build and test wheel packages on Linux, OSX & Windows
• Dan Tracy - Ship it: Deployments with Pip
• Glyph - The Ethical Consequences Of Our Collective Activities
• Allison Kaptur - Bytes in the Machine: Inside the CPython interpreter
• Ian Cordasco - Cutting Off the Internet: Testing Applications that Use Requests
• James Cammarata - Achieving Continuous Delivery: An Automation Story
• Mali Akmanalp - Other people's messy data (and how not to hate it!)
• Richard Jones - Introduction to game programming with Kivy
• Christophe Pettus - PostgreSQL Proficiency for Python People
• Jarret Raim, Paul Kehrer - What to do when you need crypto
• Making Beautiful Graphs in Python and Sharing Them
• Olivier Grisel - Machine Learning with Scikit-Learn (II)
• Orlando Karam - Introduction to Spark with python
• Brandon Rhodes - Pandas From The Ground Up
• Stuart Williams - Python by Immersion
• Katie Cunningham - Usability Testing on the Cheap
• Shauna Gordon-McKeon - Open Source for Newcomers and the People Who Want to Welcome Them
• Itamar Turner-Trauring - A Beginner's Guide to Test-driven Development
• Ned Batchelder - Facts and Myths about Python names and values
• Andrew T. Baker - Demystifying Docker
• Nina Zakharenko - Technical Debt - The code monster in everyone's closet
• Carol Willing - Finding Your Groove: Contributing to CPython and Beyond
• Philip James, Asheesh Laroia - Type python, press enter. What happens?
• Kate Heddleston - How our engineering environments are killing diversity (and how we can fix it).
• Michael Scherer - Ansible beyond YAML
• Andreas Dewes - Learning from other's mistakes: Data-driven analysis of Python code
• Dan Crosta - Good Test, Bad Test
• Amy Hanlon - Investigating Python Wats
• Greg Ward - How to Write Reusable Code
• Julia Evans - Systems programming as a swiss army knife
• Lightning Talks - April 11th 8h30- Pycon 2015
• Lightning Talks - April 10th - Pycon 2015
• Sarina Canelake - I18N: World Domination the Easy Way
• Josh Triplett - Porting Python to run without an OS
• How to build a brain with Python
• Jeff Schenck - The REST Ascendancy
• Fire your supervisord running Python apps on CoreOS
• Chris McDonough - Using Supervisor For Fun And Profit
• Renee Chu, Matt Makai - Don't Make Us Say We Told You So: virtualenv for New Pythonistas
• Losing your Loops Fast Numerical Computing with NumPy
• Melanie Warrick - Neural Nets for Newbies
• Raymond Hettinger - Super considered super!
• Jenny Cheng - 3D Print Anything with the Blender API
• Titus Brown - How to interpret your own genome using (mostly) Python.
• Miguel Grinberg - Is Your REST API RESTful?
• Kenny Yarboro - Building a REST API Using Django & Django REST Framework
• Dan Callahan - My Python's a little Rust-y
• Miriam Lauter - Make your own Smart Air Conditioner
• Michelle Fullwood - Grids, Streets and Pipelines: Building a linguistic street map with scikit-learn
• Katherine Scott - Robots Robots Ra Ra Ra!!!
• What Python can learn from Erlang
• Chris Waigl - Satellite mapping for everyone
• lvh - Distributed Systems 101
• David Beazley - Python Concurrency From the Ground Up: LIVE!
• David Baumgold - Advanced Git
• Brett Cannon - How to make your code Python 2/3 compatible
• Raymond Hettinger - Beyond PEP 8 -- Best practices for beautiful intelligible code
• Soups Ranjan - Data Science in Advertising: Or a future when we love ads
• Cory Benfield - Hyperactive: HTTP/2 and Python
• Benjamin Peterson - A Dive into TLS
• Donald Miner - Hadoop with Python
• Andrew Godwin - What can programmers learn from pilots?
• Ryan Kelly - PyPy.js: What? How? Why?
• Ashwini Oruganti, Christopher Armstrong - Introduction to HTTPS: A Comedy of Errors
• Viviane Pons - Experimental pure mathematics using Sage
• Miguel Grinberg - Flask Workshop
• Brett Slatkin - How to Be More Effective with Functions
• lvh - Building secure systems
• Kyle Kastner - Machine Learning 101
• Kurt Grandis - Exploring Minecraft and Python: Learning to Code Through Play
• Adam Palay - "Words, words, words": Reading Shakespeare with Python
• Hands-on with Pydata: how to build a minimal recommendation engine.
• Keynote - Catherine Bracy
• Sarah Guido, Celia La - Twitter Network Analysis with NetworkX
• David Beazley - Modules and Packages: Live and Let Die!
• Opening Statements - Julia Evans
• Allen Downey - Statistical inference with computational methods
• James Bennett - Django in Depth
• Stuart Williams - Python Epiphanies
• Mike Müller - Descriptors and Metaclasses - Understanding and Using Python's More Advanced Features
• Luke Sneeringer - Ansible 101
• David Chudzicki, Christine Doig - Winning Machine Learning Competitions With Scikit-Learn
• Getting comfortable with web security: A hands-on session
• Allen Downey - Bayesian statistics made simple
• Sarah Guido - Hands-on Data Analysis with Python
• Jacinda Shelly - Delving into the Django Admin
• IPython & Jupyter in depth: high productivity interactive and parallel python
• Shiny, Let's Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulnerabilities
• Eric Ma - Practical Graph/Network Analysis Made Simple
• Harry Percival - TDD with Django, from scratch: a beginner's intro to testing and web development
• Jake VanderPlas - Machine Learning with Scikit-Learn (I)
• Andrew T. Baker - Docker 101: Introduction to Docker

Vídeos de BSides Nashville 2015



Cortesía de Irongeek, podemos ver los vídeos de las charlas de BSides Nashville 2015.

La list es la siguiente:

• BSides Nashville Intro and Pondering the False Economy of Secrets
• Applied Detection and Analysis Using Flow Data
• Using devops monitoring tools to increase security visibility
• The Great Trojan Demo
• Nobody Understands Me: Better Executive Metrics
• We Built This & So Can You!
• That's NOT my RJ45 Jack!: IRL Networking for Humans
• Finding Low Hanging Fruit with Kali
• What do infosec practitioners actually do
• From Parking Lot to Server Room
• N4P Wireless Pentesting: So easy even a caveman can do it
• hashcat
• Skiddiemonkeys: Fling "stuff" at your Defenses and See What Sticks
• Agile and Security - Oil and Water?

Presentaciones de SyScan 2015



También están disponibles las presentaciones de SyScan 2015:

• Finding and exploiting novel flaws in Java software
• Attacks on telecom operators and mobile subscribers using SS7: from DoS to call interception
• got root? Compromising OS X
• HARES: Hardened Anti-Reverse Engineering System
• A Link to the Past: Abusing Symbolic Links on Windows
• Cryptographic backdooring
• Caring Less - De-humanizing Human Vulnerability Assessment
• How to own any windows network via group policy hijacking attacks
• Shooting Elephants
• BadXNU, a rotten apple!
• Crash & Pay: Owning and Cloning NFC Payment cards
• Back to the Core
• The challenges of designing a secure encrypted hard drive
• STEGOSPLOIT – HACKING WITH PICTURES
• iOS 678 Security - A Study in Fail
• The Birth of a Complete IE11 Exploit Under the New Exploit Mitigations

Presentaciones CanSecWest Vancouver 2015



Ya están disponible para descarga las presentaciones de CanSecWest Vancouver 2015. La lista es la siguiente:

• Project Zero: Making 0days Hard - Ben Hawkes, Chris Evans Google
• Taming wild copies: from hopeless crash to working exploit - Chris Evans @scarybeasts of Google's Project Zero
• I see therefore I am.... You - Jan "starbug" Krissler, T-Labs/CCC
• Smart COM fuzzing tool - Explore More Sandbox Bypassing Surface in COM objects - Xiaoning Li & Haifei Li, Intel
• A new class of vulnerability in SMI Handlers of BIOS/UEFI Firmware - John Loucaides & Andrew Furtak, Intel
• Sexrets in LoadLibrary - Yang Yu @tombkeeper, Tencent
• Attacking WebKit Applications by exploiting memory corruption bugs - Liang Chen of KeenTeam
• Userland Exploits of Pangu 8 - Team Pangu @PanguTeam
• Attacks on UEFI Security - Rafal Wojtczuk & Corey Kallenberg
• FreeSentry: Protecting against use-after-free vulnerabilities due to dangling pointers - Yves Younan, Cisco (Sourcefire/VRT)
• DLL Hijacking' on OS X? #@%& Yeah! - Patrick Wardle @patrickwardle, Synack
• Memminer: Real-Time Passive Volatile Memory Inspection Inside Virtual Machines - John Williams, EY
• NDIS Packet of Death: Turning Windows' Complexity Against Itself - Nitay Artenstein, Checkpoint
• How many million BIOSes would you like to infect? - Corey Kallenberg & Xeno Kovah, LegbaCore
• UEFI, Open Platforms and the Defender's Dillema - Vincent Zimmer, Intel
• Wolf in Sheep's Clothing: Your Next APT is Alread  Whitelisted - Fabio Assolini and Juan Andres Guerrero-Saade
• There's Something About WMI - Christopher Glyer and Devon Kerr, Mandiant
• Credential Assessment: Mapping Privilege Escalation at Scale - Matthew Weeks, root9b
• From baseband to bitstream and back again: What security researchers really want to do with SDR - Andy Davis, NCC Group
• Bootkit via SMS: 4G access level security assessment - Kirill Nesterov and Timur Yunusov

Vídeos de Shmoocon 2015



Ya están disponibles en archive.org los vídeos de recién terminada conferencia de seguridad informática celebrada en Washington DC, Shmoocon 2015.

La lista es la siguiente:

• 0wn the Con
• 5 Usability
• Analyzing POS Malware
• Ask EFF
• Automated Binary Analysis with Pin and Python
• BIOS Bugs
• Closing Remarks
• Cockroach Analysis
• College Hacking
• Come to the Dark Side
• Crypto
• Dark Art of Data Visualization
• Deception for the Cyber Defender
• Eliminating Timing Side Channel Attacks
• Get off my lawn
• How Random Is Your RNG
• Infrastructure Tracking
• Keynote
• Knock Knock
• Malicious Image Spam
• Manually Searching Advisories and Blogs for Threat Data
• Micronesia
• NSA USB Playset
• NaCl Crypto Library
• No Budget Threat Intel
• Opening Rants
• Practical Machine Learning for Network Security
• Quantum Computing
• Rethinking Securitys Role in CompSci Edu
• SEWIFI
• Saturday Firetalks
• Tap On Tap Off
• The Joy of Intelligent Proactive Security
• Understanding a New Memory Corruption Defense
• Userland Persistance
• Where The Wild Things Are
• Wheres Waldo
• White is the New Black
• Whitelisting Evasion
• Windows Sandbox Paradox
• httpscreenshot

Vídeos de la 31C3



Si os habéis perdido alguna de las charlas de la pasada 31C3, aquí tenéis la lista de las mismas:

• ECCHacks
• Beyond PNR: Exploring airline systems
• Correcting copywrongs
• 31C3 Keynote
• Krypto für die Zukunft
• Thunderstrike: EFI bootkits for Apple MacBooks
• Telescope Making
• Jugend hackt
• 3D Casting Aluminum
• Cyber Necromancy
• Why is GPG "damn near unusable"?
• Attribution revolution
• 31C3 Opening Event
• How I Learned to Stop Reinventing and Love the Wheels
• AMD x86 SMU firmware analysis
• »Hard Drive Punch«
• Why are computers so @#!*, and what can we do about it?
• Global Civil Society Under Attack
• Lightning Talks Day 3
• SS7: Locate. Track. Manipulate.
• Let's Encrypt
• The Magical Secrecy Tour
• Fernvale: An Open Hardware and Software Platform, Based on the (nominally) Closed-Source MT6260 SoC
• Let’s build our own personalized open textile production line
• ES GIBT VIEL ZU TUN - HAU'N WIR AB.
• Mining for Bugs with Graph Database Queries
• Tor: Hidden Services and Deanonymisation
• Practical EMV PIN interception and fraud detection
• Personal Tracking Devices and Online Identity
• Safer playing with lasers
• SCADA StrangeLove: Too Smart Grid in da Cloud
• Inside Field Station Berlin Teufelsberg
• Diamonds are a quantum computer’s best friend
• Fnord News Show
• The Perl Jam: Exploiting a 20 Year-old Vulnerability
• Trustworthy secure modular operating system engineering
• Too Many Cooks - Exploiting the Internet-of-TR-069-Things
• Internet of toilets
• Tell no-one
• Mein Bot, der Kombattant
• Now I sprinkle thee with crypto dust
• The Only Thing We Know About Cyberspace Is That Its 640x480
• Living Drones
• Eye Wear Computing
• Security Analysis of Estonia's Internet Voting System
• From Computation to Consciousness
• Das Transparenzportal Hamburg
• 10 Jahre OpenStreetMap
• Damn Vulnerable Chemical Process
• Information Control and Strategic Violence
• Axoloti
• (In)Security of Mobile Banking
• Forging the USB armory
• Mr Beam goes Kickstarter
• Security Analysis of a Full-Body X-Ray Scanner
• What Ever Happened to Nuclear Weapons?
• Iridium Pager Hacking
• „Wir beteiligen uns aktiv an den Diskussionen“
• The Cloud Conspiracy 2008-2014
• Trackography
• DP5: PIR for Privacy-preserving Presence
• Open-BCI DIY-Neuroscience Maker-Art Mind-Hacking
• CAESAR and NORX
• Paypals War on Terror
• Snowden Effect vs. Privacy Paradox
• Reproducible Builds
• The Machine To Be Another
• Towards General Purpose Reconfigurable Computing on Novena
• Jahresrückblick des CCC
• NSA Points of Presence in AT
• Source Code and Cross-Domain Authorship Attribution
• Virtual Machine Introspection
• Security Nightmares
• SS7map : mapping vulnerability of the international mobile roaming infrastructure
• Serenität – Anleitung zum Glücklichsein
• Ich sehe, also bin ich ... Du
• Space Hacker
• Higher-Dimensional Geometry and Fractals
• Mit Kunst die Gesellschaft hacken
• The case of Chelsea Manning
• Why do we need an open food information platform
• Traue keinem Scan, den du nicht selbst gefälscht hast
• Lightning Talks Day 4
• Automatically Subtitling the C3
• GIFs: Tod eines Mediums. Und sein Leben nach dem Tod.
• Programming with dependent types in Idris
• Privacy and Consumer Markets
• Agri-tech and the Arts: From Barns to D-Space
• Revisiting SSL/TLS Implementations
• Let's build a quantum computer!
• Reconstructing narratives
• Doing right by sources, done right
• 31C3 Infrastructure Review
• Vor Windows 8 wird gewarnt
• Glitching For n00bs
• Uncaging Microchips
• Low Cost High Speed Photography
• Funky File Formats
• Hacking Ethics in Education
• net neutrality: days of future past?
• "Exploit" in theater
• Freedom in your computer and in the net
• 31C3 Closing Event
• Rocket Kitten: Advanced Off-the-Shelf Targeted Attacks Against Nation States
• Crypto Tales from the Trenches
• Lightning Talks Day 2
• Computer Science in the DPRK
• Switches Get Stitches
• Rocket science – how hard can it be?
• MegaCode to facility gates
• From Maxwell to antenna arrays
• Attacks on UEFI security, inspired by Darth Venamis's misery and Speed Racer
• Heartache and Heartbleed: The insider’s perspective on the aftermath of Heartbleed
• State of the Onion
• The eXperimental Robot Project
• The rise and fall of Internet voting in Norway
• Code Pointer Integrity
• EMET 5.1 - Armor or Curtain?
• IFG – Mit freundlichen Grüßen
• Superheroes Still Need Phoneboxes
• The Invisible Committee Returns with "Fuck Off Google"
• osmo-gmr: What's up with sat-phones ?
• The Matter of Heartbleed
• Deine Rechte sind in diesen Freihandelsabkommen nicht verfügbar
• Mobile self-defense
• The automobile as massive data gathering source and the consequences for individual privacy
• Die Krise der Bilder ist die Krise der Politik
• Preserving arcade games
• UNHash - Methods for better password cracking
• The Maker movement meets patent law
• Long war tactics
• Infocalypse now: P0wning stuff is not enough
• The Time is Right
• Finding the Weak Crypto Needle in a Byte Haystack

31C3 "A new dawn" comienza hoy



Chaos Computer Club (CCC), el congreso sobre seguridad/hacking más grande de Europa da comienzo hoy día 27 de diciembre. En esta su 31 edición, el congreso lleva como título “A new dawn” (Un nuevo amanecer). Este año 31C3 cuenta con más de 120 presentaciones y una docena de talleres. El congreso durará hasta el día 30 de diciembre y como de costumbre puedes seguir todas las presentaciones en vivo desde http://streaming.media.ccc.de .

Todos los vídeos y presentaciones de DEFCON 22 a un click y un poco de paciencia



Desde la web de Defcon ya nos podemos descargar a través de un fichero torrent todos los vídeos y presentaciones de la vigésimo segunda edición de Defcon celebrada este pasado verano.

El fichero torrent contiene más de 20Gb, con lo que te puede llevar un buen rato. Si no lo quieres todo y sólo te interesan ciertas presentaciones, también las puedes descargar de forma individual desde este enlace.

Presentaciones Linuxcon Norteamérica 2014



En Chicago se celebró la Linuxcon norteamérica de este año. El event se produjo entre los días 20-22 de agosto. Si hubo alguna charla que te interese y que no pudiste seguir (emitieron las charlas online), quizás encuentres las diapositivas de la misma de entre las que han publicado:

6 Months of the Eudyptula Challenge, Lessons Learned SMR impact on Linux Storage Subsystem How Docker Enablement makes Linux Container easy to deploye on Enterprise Linux Coming Soon, an Open Source Project Near You – the Linaro LNG Open Data Plane Initiative Universal Tux: Accessibility For Our Future Selves Ever Growing CPU States: Context Switch with Less Memory and Better Performance Open Source Governance Round Table: What’s hot ? Fork and Ignore: Fighting a GPL Violation By Coding Instead Kernel Debugging and Tracing NFV in the embedded world: Yocto Project and OpenStack Replacing HW Raid with Twitter Cache and Persistent Memory Explaining and Accessing the SPDX License List kpatch: Have Your Security And Eat It Too! Raspberry Pi Hacks and Projects Hacking the Kernel, Hacking Myself Linux Performance Tools An Overview of Kernel Lock Improvements Object-Based Storage - NAS support through NFS-Ganesha. The Architecture of Linux Traffic Control Better Integration of Systems Management Hardware with Linux Compressing strings of the kernel Kernel Internship Report (OPW) Make your own usb gadget Why Linux rules Chicago Tux On Top: Open Source at the Top of the Rack How Linux Distros Became Boring (and Fedora’s Plan to Put Boring Where It Belongs) New Views on your Source Code History with “git replace” Open Source Policy: OpenDaylight and OpFlex Kernel features for reducing power consumption on embedded devices Getting More Out Of System Suspend In Linux Simulating the Internet using unprivileged LXC containers Linux Kernel Power Management (PM) Framework for ARM 64-bit processors devicetree: kernel internals and practical troubleshooting LLVMLinux: Embracing the dragon Building Linux support for Digital TV Kpatch without Stop Machine RAS Enhancement Activities for Mission-critical Linux Systems Why you should consider using btrfs, real COW snapshots and file level incremental server OS upgrades like Google does. You know, for kids! 7 ideas for improving tech education in schools Lessons about Community from Science Fiction Troubleshooting as a Service Testing Video4Linux Applications and Drivers

Vídeos de la Javazone 2014



Tres días completos de conferencia, 2.500 desarrolladores, 90 presentaciónes, 60 charlas rápidas y 12 talleres. Esos son los números de este años de las JavaZone 2014, una conferencia sobre programación, la mayoría orientadas a Java, eso sí, la mitad de las charlas están en noruego.

Aquí tenéis las charlas que se dieron, por si os interesa alguna:

• #NoEstimates - Filip van Laenen
• 3D-grafikk i nettleseren: Hvordan komme i gang med WebGL - Kristoffer Dyrkorn
• 33 things you want to do better - Tom Bujok
• 50 new features of Java EE 7 - Arun Gupta
• Accelerate your development by accelerating your feedback loop - Johannes Brodwall
• Akka in real-time - Owen Fraser-Green
• A Little Graph Theory for the Busy Developer - Jim Webber
• Ansible: Provisjonering for programmerere - Bendik Solheim
• Arkitektreisen - Jon-Thomas Eliassen
• BDD - better driven development? - Mads Hoel
• Blueflood: A case study in open-sourcing a large piece of infrastructure software - Gary Dusbabek
• Brukervennlig input på responsive websiter - John-Arne Fagerli
• Building A Big Data Machine Learning Platform - Cliff Click
• Building a Country on Open Source Java - Jeff Genender
• Building Advanced Web Applications using Canvas - Geir Vidar Kristensen
• Building flexible and high performance software with CQRS and Axon Framework - Allard Buijze
• Building Modular Java Applications in the Cloud Age - Bert Ertman
• Building on SOLID Foundations - Steve Freeman
• call(me, maybe) - Erik Wendel
• Cassandra (and Hadoop) case studies from FINN.no - mck
• Ceylon from here to infinity: the big picture and what's coming - Stephane Epardaud
• Choose the right tools for the job - avoid "hammer first" solutions - Aksel Gresvig
• Chromecast i en fei - Sindre Mehus
• Combining .NET and Java in an enterprise web publishing platform - Svein-Magnus Sørensen
• Connecting Physical Devices to the Web - Event Driven Architecture using WebSocket for the Internet of Things - Peter Moskovits
• Conquering the wicked kingdom of Java with a NodeJS Trojan horse - Espen Dalløkken
• Content Security Policy - Hva er din side lastet med? - Mikael Strand, Åshild Kaldahl Thorrud
• Continuous Delivery for Architects - Neal Ford
• Cost-Aware Architectures - Markus Krüger
• Dart: A programming language designed for speed and the web - Lars Bak
• Design for asynkronitet og høy ytelse! - Eivind Barstad Waaler
• Det er helt sikkert at det er usikkert. Hvordan (ikke) anslå usikkerhet til estimater. Innlagt NM i estimering-Magne Jørgensen
• Det var en gang en hendelse - Kari Bergh Schjønsby
• Distributed Ad hoc Real-Time Stream Processing - Christian Kreutzfeldt
• Distributed Consensus A.K.A. "What do we eat for lunch?" - Konrad `ktoso` Malawski
• DTO 2.0 – et SOLID forsvar for offentlige instansfelter (i Java) - Kjetil Valstadsve
• Du MÅ ikke velge et rammeverk! - Eivind Barstad Waaler
• Elm: Et funksjonelt språk for weben - Henrik Wingerei
• Enemy of the state - Joachim Lous
• En realitetsorientering om tingenes internett - og hvordan du kan komme i gang selv - Simen Sommerfeldt
• Erfaringer fra 150 mikrotjenester - fordeler og ulemper - Jan Henrik Gundelsby
• Er JavaFX noe for deg som hater å knote med GUI? - Anne Landro
• ES6 er her, velkommen til fremtiden innen JavaScript - Pål Ruud
• Fem år med Scala i produksjon - Sigmund Marius Nilssen
• Fibonacci Pairing: Learning through Collaboration - Yilmaz Guleryus
• Fix That! - Christin Gorman
• Fra idé til realisering på 3 uker med dagens frontend teknologi - Ismar Slomic, Anna Karpova
• Functional Groovy - Andres Almiray
• Functional Reactive Programming in Javascript - Sven Anders Robbestad
• Functional UIs with Vaadin - Henri Muurimaa
• Future of Development and the Cloud - Ken Sipe
• Get a power-up for your browser tests with geb and groovy! - Thilko Richter
• Gi legacy kode litt kjærlighet og se den blomstre på nytt - Kjell Arne Arvesen
• Git er mer enn å pulle, committe og pushe - Kjartan Aanestad
• Gjenbruk JavaScript i Java-prosjekter med Maven WebJars - Anders Emil Salvesen
• goto java; - Martin Skarsaune
• Hald bønnene dine unna domenemodellen min! - Kenneth Pedersen
• Handling complexity through configurability: Erex - an energy settlement solution for the railways of tomorrow - Western, Aas
• Hei, jeg heter August, og jeg driver med data. - August Lilleaas
• How do crypto currencies work? - Erik Engheim
• How Open Source can make your $job a better place - Salve J. Nilsen
• How to "login with Facebook": OAuth 2 demystified - Johannes Brodwall
• Hva har portrett-tegning lært meg om arkitektur-skisser - Trond Pedersen
• Hvordan få en kamel til å danse - Per Jørgen Walstrøm & Audun Fauchald Strand
• Hvordan jeg fikk tredd Scala ned over hodet. - Tanja Milijana Gruschke
• Hvordan sette opp Transport Layer Security på en sikker måte. - Rolf Rander Næss
• Hvordan spise en elefant - Nils Christian Haugen & Trond Hjorteland
• Hvorfor bytter vi ut en webapplikasjon som virker? - Joar Aurdal, Tom-Tom Erik Isaksen
• I-Tier: Breaking Up the Monolith - Brian McCalliser
• I/Opener to the Big I/O - Oleg Zhurakousky
• Immutable Server Generation: the new App Deployment - Axel Fontaine
• Innsamling av ekstremt sensitive data til forskning - Dagfinn Bergsager
• Integrasjon i NRK - Christian Kjendseth Wiik
• Integrasjonsarkitektur - Er det egentlig så vanskelig? - Arne Watnelie
• Interpolation - The art of moving from A to B - Snorre Eskeland Brekke
• Introduction to Mutation Testing - Nicolas Fränkel
• Introduksjon til iBeacon - Anders Breivik, Hans Olav Nome
• Iteration 2.0: Stream - Martin Skarsaune
• Java 8 Lambda på 1-2-3 - Øystein Jakobsen
• Java 8: Efficient use of multi core processors with lambdas and streams - Fabian Stäber
• Jolokia - JMX on Capsaicin - Roland Huss
• JSR 363 - The Answer to Life Science and the Internet of Everything - Werner Keil
• Kill 'Em All – and the ultimate developer will rise again! - Stein Inge Morisbak
• Kontinuerlig Leveranse i Skatteetaten? - Trond Arve Wasskog, Anders Sveen
• Kontroversiell matematikk - Christian Magnus Berg
• Kotlin vs Java puzzlers - Svetlana Isakova
• Logs live and in color – say goodbye to old school log files - Alexander Schwartz
• Luksusfellen, sesong 2 - Terje Heen
• Making Steaks from Sacred Cows - Kevlin Henney
• Making the Case for Reviews - Austin Bingham
• Mastering Continuous Delivery and DevOps - Michael Hüttermann
• Mimicking Natural Phenomena to Solve Complex Industrial Problems - Shaukat Ali
• Mind the Gap: Architecting UIs in the Era of Diverse Devices - Nathaniel Scutta
• Min hverdag som DevOps-utvikler - Runar Furenes
• Nei det er ikke BIG-IP sin skyld, det er din! - Kai Bjørnstad
• Paxos explained in one hour - Konrad Beiske
• Polymer: Shadow DOMS, Custom Components and the Future of Web - Brian Sletten
• PostgreSQL som MQ - Trygve Laugstøl
• Power to the Programmers - Tom Gilb
• Practical Considerations For Microservice Architectures - Sam Newman
• Predictive Models of Development Teams and the Systems they Build - Robert Smallshire
• Presentasjon 2.0 - Jøran Vagnby Lillesand
• Progressive enhancement ved bruk av Node.js - Kittel Austvoll
• Provisjonering av JavaZone - Kjetil Valle, Sveinung Dalatun
• PUSH i FINN.no: Øyeblikkelig varsling på nye annonser - Fredrik Rødland
• Quick and easy performance testing for developers - Håkon T. Sønderland
• Really understanding Clojure, getting into macros - Alf Kristian Støyle
• Real world RESTful service development problems and solutions - Masoud Kalali, Bhakti Mehta
• Refactoring to Functional - Hadi Hariri
• Regex Ninja: The Magic of Regular Expressions - Rustam Mehmandarov
• Resilience with Hystrix - Uwe Friedrichsen
• REST in Practice, in Practice - Ian Robinson
• Salesforce - Hvordan skalerer de i skyen - Tor Håkon Sigurdsen, Carl Huseby Fosli
• Schema migration - the missing piece in Java EE - Rikard Thulin
• Sjakk Matt - Per S. Digre
• Software Design: Why, When & How - Kent Beck
• So long, and thanks for all the tests - Seb Rose
• Splitt og hersk: Fleksibel arkitektur med Micro Services! - Henrik Schwarz
• SQL, the Underestimated Big Data Technology - Lukas Eder
• Stopp overvåkningen! Bruk HTTPS! - Jostein Tveit
• Strategic reuse - Johannes Brodwall
• Sånn passe mye arkitektur - Vegard Hartmann
• TDD with AngularJS and TypeScript - Sirar Salih
• Teknologistandardisering i store organisasjoner er en dårlig ide! - Morten Moe
• Testdrevet utvikling for systemer uten tester - Stian Grenborgen & Anders Karlsen
• The Adventurous Developer's guide to Application Servers - Simon Maple
• The fastest Arduino in Scandinavia - Marty Cochrane
• The Spirit of the Dugnad – Support Your Local Meetup! - Mark Alan West
• TODO or not TODO, that's the question? - Simo Martomaa
• Tomras vei fra monolitt til distribuert system - Kim Christian Swenson, Erik Drolshammer
• Ultralyd - Java møter IoT og BYOD - Ragnvald Balch Barth
• Understanding Java byte code - Rafael Wintherhalter
• Under the Hood of the HotSpot G1 Garbage Collector - Bengt Rutisson
• Unit testing concurrent code - Rafael Winterhalter
• Using Docker to streamline development - Trond Marius Øvstetun
• Using the right tools to get back into the driver's seat of your JVM - Hardy Ferentschik
• Utvikling og drift av 100% skybasert javaløsning - Mikkel Byrsø Dan-Rognlie
• VirtualBox reloaded - Harald Søvik
• Vi vet hvor det blir kø - Store mengder trafikkdata med Akka, Elasticsearch og OPC-UA - Jan Fredrik Wedén
• Web-security experiences from a Penetration Tester - Andreas Hegna
• Web Components? - Sigurd Fosseng
• Webutvikling med Clojure - Odin Hole Standal
• What's the deal with Functional Programming anyway? - Fredrik Vraalsen
• What the hell is WebRTC? - Dag Inge Aas
• Your web application is already out of date - Erlend Oftedal
• ZombieCLJ: Live parprogrammering - Magnar Sveen, Christian Johansen

Presentaciones de la Crypto Rump 2014



Crypto Rump es un evento de un sólo día donde se presentan temas sobre cifrado. Las presentaciones son cortas y el evento dura poco menos de 4 horas. Este año dicho evento se celebró el 19 de agosto. Como de costumbre, os dejamos la lista con las presentaciones que están publicadas:

• Program Co-Chairs Report
• Privacy, Security & Trust
• Tetris-based Cryptography: a gateway to serious Crypto
• Cryptogramma.com
• Public Verifiable Randomness Beacon for Random Sample Elections
• Deniable and not self-harming trapdoors
• NIST VCAT Report and Dual EC DRBG
• NIST Update: Elliptic Curves and More!
• New Cryptography Libraries from Microsoft Research
• Bits Security of the CDH Problems over Finite Fields
• Fast Lattice Point Enumeration with Minimal Overhead
• Jobs available
• Just a little of that human touch
• Update on the 10000 Euro PRINCE cipher-breaking challenge: Results of Round-1
• On the Security of the FX-Construction (feat. PRINCE and PRIDE)
• Spritz: a spongy RC4-like stream cipher and hash function
• Randomness Extraction with Streaming Algorithms
• The graduate acoustic attack: The sound of silence
• DNSSEC
• SPOKE: Simple Password-Only Key Exchange in the Standard Model
• How Secure and Quick is QUIC in Presence of Malice?
• An Exercise in Shooting Yourself in the Foot: Automating the Cryptographer
• The Bitcoin Backbone: Analysis and Applications
• A New Non-Malleable Commitment Scheme
• Multiparty illumination
• Postponing the Deadline of the Best Crypto Competition Ever!
• Circuit ORAM and on the Tightness of the Goldreich-Ostrovsky ORAM Lower Bound
• Oblivious Data Structures
• SCVM: An Efficient, Automated RAM Model Secure Computation Framework
• Awesome MPC
• Introducing TinyLEGO, smaller is sometimes better
• An Annotated Bibliography of Practical Secure Computation
• A Unifying Framework for Computation on Encrypted Data
• New Graded Multilinear Maps from Lattices
• Fully Secure Attribute Based Encryption from Multilinear Maps
• Implementing Cryptographic Program Obfuscation
• Order-Revealing Encryption
• Verifiable Member and Order Queries on a List in Zero Knowledge
• Four minutes of fast talking about order-preserving encryption

Vídeos de la DebConf 2014



Ya están disponibles los vídeos de la conferencia anual sobre desarrolladores de Debian DebConf 2014.

Como de costumbre, os dejamos la lista de los mismos a continucaión:

• ACC_for_abi_breaks.webm
• A_glimpse_into_a_systemd_future.webm
• Bits_from_the_DPL.webm
• Coming_of_Age_My_Life_with_Debian.webm
• DSA_Team_round_tableBoF.webm
• Debian_Java_Packaging_BoF.webm
• Debian_Long_Term_Support.webm
• Debian_in_the_Dark_Ages_of_Free_Software.webm
• Debian_installer_and_CD_BoF.webm
• Debsources_powering_sourcesdebiannet.webm
• GRUB_ancient_and_modern.webm
• GnuPG_in_Debian_BoF.webm
• Infrastructure_updates_can_we_change_anything_in_less_than_2_years.webm
• LSB_for_Debian_BoF.webm
• MIA_Team_BoF.webm
• MIPS_BoF.webm
• Meet_the_Technical_Committee.webm
• My_PGPGPG_key_is_RSA_2048bit_but_I_put_the_private_key_on_Gnuk_Token.webm
• New_Network_Interface_Manager_for_Debian_ifupdown2.webm
• Notmuch_BoF.webm
• One_year_of_fedmsg_in_Debian.webm
• OpenPGP_keysigning.webm
• OpenStack_update_packaging_experience_sharing.webm
• Power_Tuning_Linux_A_Case_Study.webm
• Python_BoF.webm
• QA_with_Linus_Torvalds.webm
• Quit_logging_or_data_minimization_in_Debian.webm
• Removing_obsolete_packages_for_fun_and_profit.webm
• Reproducible_Builds_for_Debian_a_year_later.webm
• SPI_BOF.webm
• State_of_the_ARM.webm
• Status_of_the_Debian_OpenPGP_keyring.webm
• Status_report_of_the_Debian_Printing_team.webm
• The_state_of_the_bootstrap.webm
• Validation_and_Continuous_Integration_BoF.webm
• Weapons_of_the_Geek.webm
• Web_and_wiki_BoF.webm
• Welcome_talk.webm
• Whats_new_in_the_Linux_kernel.webm
• bugsdebianorg_Database_Ho.webm
• debci_and_the_Debian_Continuous_Integration_project.webm
• debdry_Debian_Dont_Repeat_Yourself.webm
• tasksel_default_desktop_requalification.webm
• use_Perl_Annual_meeting_of_the_Debian_Perl_Group.webm

Presentaciones de Defcon 22 ya disponibles



Ya se encuentran disponibles las presentaciones (diapositivas y algún documento extra) de Defcon 22:

• Protecting SCADA From the Ground Up - PDF
• Detecting Bluetooth Surveillance Systems - PDF
• Dropping Docs on Darknets: How People Got Caught - PDF
• Hacking 911: Adventures in Disruption, Destruction, and Death - PDF
• How to Disclose an Exploit Without Getting in Trouble - PDF
• Reverse Engineering Mac Malware - PDF
• NSA Playset: PCIe - PDF
• The Monkey in the Middle: A pentesters guide to playing in traffic. - PDF
• Investigating PowerShell Attacks - PDF
• Is This Your Pipe? Hijacking the Build Pipeline. - PDF
• Screw Becoming A Pentester - When I Grow Up I Want To Be A Bug Bounty Hunter! - PDF
• Home Alone with localhost: Automating Home Defense - PDF
• Meddle: Framework for Piggy-back Fuzzing and Tool Development - PDF
• Instrumenting Point-of-Sale Malware: A Case Study in Communicating Malware Analysis More Effectively - PDF White Paper
• One Man Shop: Building an effective security program all by yourself - PDF
• RF Penetration Testing, Your Air Stinks - PDF
• Touring the Darkside of the Internet. An Introduction to Tor, Darknets, and Bitcoin - PDF
• USB for all! - PDF
• ShareEnum: We Wrapped Samba So You Don’t Have To - PDF
• An Introduction to Back Dooring Operating Systems for Fun and Trolling - PDF
• Android Hacker Protection Level 0 - PDF
• Anatomy of a Pentest; Poppin' Boxes like a Pro - PDF
• Bug Bounty Programs Evolution - PDF Extras
• Practical Foxhunting 101 - PDF
• Client-Side HTTP Cookie Security: Attack and Defense - PDF
• Bypass firewalls, application white lists, secure remote desktops under 20 seconds - PDF
• PropLANE: Kind of keeping the NSA from watching you pee - PDF
• Getting Windows to Play with Itself: A Hacker's Guide to Windows API Abuse - PDF
• Weaponizing Your Pets: The War Kitteh and the Denial of Service Dog - PDF
• Through the Looking-Glass, and What Eve Found There - PDF White Paper
• Summary of Attacks Against BIOS and Secure Boot - PDF
• I am a legend: Hacking Hearthstone with machine learning - PDF
• The Secret Life of Krbtgt - PDF
• The $env:PATH less Traveled is Full of Easy Privilege Escalation Vulns - PDF
• Hacking US (and UK, Australia, France, etc.) traffic control systems - PDF
• The Cavalry Year[0] & a Path Forward for Public Safety - PDF
• NSA Playset: DIY WAGONBED Hardware Implant over I2C - PDF
• Abuse of Blind Automation in Security Tools - PDF
• Why Don’t You Just Tell Me Where The ROP Isn’t Suppose To Go - PDF
• Steganography in Commonly Used HF Radio Protocols - PDF Extras
• Saving Cyberspace by Reinventing File Sharing - PDF
• Empowering Hackers to Create a Positive Impact - PDF
• Just What The Doctor Ordered? - PDF
• Check Your Fingerprints: Cloning the Strong Set - PDF
• Shellcodes for ARM: Your Pills Don't Work on Me, x86 - PDF
• Blowing up the Celly - Building Your Own SMS/MMS Fuzzer - PDF
• Mass Scanning the Internet: Tips, Tricks, Results - PDF
• Deconstructing the Circuit Board Sandwich: Effective Techniques for PCB Reverse Engineering - PDF
• Saving the Internet (for the Future) - PDF
• Burner Phone DDOS 2 dollars a day : 70 Calls a Minute - PDF
• Hack All The Things: 20 Devices in 45 Minutes - PDF
• Stolen Data Markets: An Economic and Organizational Assessment - PDF
• Raspberry MoCA - A recipe for compromise - PDF White Paper 1 White Paper 2
• Girl… Fault-Interrupted. - PDF
• Extreme Privilege Escalation On Windows 8/UEFI Systems - PDF White Paper
• NinjaTV - Increasing Your Smart TV’s IQ Without Bricking It - PDF
• Oracle Data Redaction is Broken - PDF
• Weird-Machine Motivated Practical Page Table Shellcode & Finding Out What's Running on Your System - PDF
• Catching Malware En Masse: DNS and IP Style - PDF White Paper
• Attacking the Internet of Things using Time - PDF
• Open Source Fairy Dust - PDF
• Learn how to control every room at a luxury hotel remotely: the dangers of insecure home automation deployment - PDF White Paper
• Generating ROP payloads from numbers - PDF
• DEF CON Comedy Jam Part VII, Is This The One With The Whales? - PDF
• The NSA Playset: RF Retroreflectors - PDF 1 PDF 2
• VoIP Wars: Attack of the Cisco Phones - PDF
• Playing with Car Firmware or How to Brick your Car - PDF
• Measuring the IQ of your Threat Intelligence feeds - PDF
• Secure Because Math: A Deep Dive On Machine Learning-Based Monitoring - PDF
• Abusing Software Defined Networks - PDF
• NSA Playset : GSM Sniffing - PDF
• Cyberhijacking Airplanes: Truth or Fiction? - PDF
• Am I Being Spied On? Low-tech Ways Of Detecting High-tech Surveillance - PDF
• Detecting and Defending Against a Surveillance State - PDF
• Acquire current user hashes without admin privileges - PDF
• You're Leaking Trade Secrets - PDF
• Veil-Pillage: Post-exploitation 2.0 - PDF
• From Raxacoricofallapatorius With Love: Case Studies In Insider Threat - PDF
• Don't DDoS Me Bro: Practical DDoS Defense - PDF
• Advanced Red Teaming: All Your Badges Are Belong To Us - PDF
• I Hunt TR-069 Admins: Pwning ISPs Like a Boss - PDF
• The Only Way to Tell the Truth is in Fiction: The Dynamics of Life in the National Security State - PDF
• A Journey to Protect Points-of-sale - PDF
• Impostor — Polluting Tor Metadata - PDF
• Domain Name Problems and Solutions - PDF White Paper
• Optical Surgery; Implanting a DropCam - PDF
• Manna from Heaven: Improving the state of wireless rogue AP attacks - PDF
• The Open Crypto Audit Project - PDF
• Practical Aerial Hacking & Surveillance - PDF White Paper
• From root to SPECIAL: Pwning IBM Mainframes - PDF
• PoS Attacking the Traveling Salesman - PDF
• Don't Fuck It Up! - PDF

Material del WOOT'14 y sesiones técnicas de 23 USENIX Security Symposium



El 19 de agosto se dio lugar en San Diego una nueva edición de la USENIX, empezando con los workshops (WOOT ‘14), seguido por la 23 edición del USENIX Security Symposium, durante los tres días siguientes, del 20 al 22.

Aquí tenéis la lista de los workshops celebrados en la USENIX Workshop On Offensive Technology (WOOT) 2014. Podéis hacer click en cada enlace para saber más sobre el workshop y bajaros material del mismo, o si os queréis bajar todo el material de golpe, lo podéis hacer desde este enlace.

Defcon 22 - Vídeos de la Wireless Village



Gracias a IronGeek, tenemos disponible de las charlas dadas en la Wireless Village de la edición de este año de Defcon.

• Intro
• So ya wanna get into SDR? - Russell Handorf
• Pentoo Primer - Village People
• 802.11ac Evolution: Data rates and Beamforming - Eric Johnson
• Practical Foxhunting 101 - SimonJ
• Pwn Phone: gg next map - Timothy Mossey
• Hacking 802.11 Basics - Benjamin Smith
• UAV-Assisted Three-Dimensional Wireless Assessments - Scott Pack & Dale Rowe
• Manna from Heaven; Improving the state of wireless rogue AP attacks - Dominic White & Ian de Villiers
• ApiMote: a tool for speaking 802.15.4 dialects and frame injection - Ryan Speers & Sergey Bratus
• Pineapple Abductions - Craig Young
• Choosing your next antenna, types, power, sizes, the truth. - Raul J Plà
• Introduction to the Nordic nRF24L01+ - Larry Pesce
• Driver-less Wireless Devices - Dominic Spill & Dragorn
• Hacking the Wireless World with Software Defined Radio - 2.0 - Balint Seeber
• The NSA Playset: Bluetooth Smart Attack Tools - Mike Ryan
• PortaPack: Is that a HackRF in your pocket? - Jared Boone
• PHYs, MACs, and SDRs - Robert Ghilduta
• SDR Tricks with HackRF - Michael Ossmann
• SDR Unicorns Panel - Robert Ghilduta & Michael Ossmann & Balint Seeber
• Inside The Atheros WiFi Chipset - Adrian Chadd

Vídeos y diapositivas de CONFidence 2104



A continuación os dejo la lista de los vídeos (algunos con su correspondiente presentación) la conferencia sobre seguridad informática CONFidence 2014. Ésta se celebro los días 27 y 28 de mayo.

El material publicado es el siguiente:

• 50 Shades of RED: Stories from the “Playroom” - Video
• NSA for dummies …methods to break RSA - Video
• Scaling Security - Video
• ATMs – We kick their ass - Video - Slides
• Bitcoin Forensics: Fact or Fiction? - Video - Slides
• Shameful secrets of proprietary protocols - Video - Slides
• Evaluation of Transactional Controls in e-Banking Systems - Video - Slides
• All your SAP P@$$w0ЯdZ belong to us - Video - Slides
• Protecting Big Data at Scale - Video - Slides
• Security Implications of the Cross-Origin Resource Sharing - Video - Slides
• Asymmetric Defense “Using your home-field advantage” - Video - Slides
• Preventing violation of memory safety in C/C++ software - Video - Slides
• On the battlefield with the Dragons – the interesting and surprising CTF challenges - Video - Slides
• SCADA deep inside: protocols and security mechanisms - Video - Slides
• Exploring treasures of 77FEh - Video - Slides
• The Tale of 100 CVE’s - Video - Slides
• Hacking the Czech Parliament via SMS - Video

Audio de las charlas de la HOPE X



Los organizadores de la HOPE X han puesto disponible el audio de todas las charlas que se dieron lugar. Si quieres los vídeos, puedes comprarlos online.

HOPE X se dio lugar en Nueva York los pasados 18-20 de julio.

Aquí como de costumbre os dejamos las lista con todas las charlas:

• A Conversation with Edward Snowden - 16kbps - 128kbps
• Keynote Address – Daniel Ellsberg - 16kbps - 128kbps
• The Hacker Wars – A Conversation with NSA Whistleblower Thomas Drake - 16kbpsThe Hacker Wars - 128kbps
• #radBIOS: Yelling a Database across the Room - 16kbps - 128kbps
• (Geo)location, Location, Location: Technology and Countermeasures for Mobile Location Surveillance - 16kbps - 128kbps
• A Beautiful Mosaic: How to Use FOIA to Fight Secrecy, Explore History, and Strengthen American Democracy - 16kbps - 128kbps
• A Sea of Parts - 16kbps - 128kbps
• A Story of Self Publishing Success - 16kbps - 128kbps
• Apophenia: Hunting for the Ghost in the Machine - 16kbps - 128kbps
• Are You Ready to SIP the Kool-Aid? - 16kbps - 128kbps
• Art under Mass Surveillance - 16kbps - 128kbps
• Ask the EFF – This Year on the Internet - 16kbps - 128kbps
• Barrett Brown and Anonymous: Persecution of Information Activists - 16kbps - 128kbps
• Biohacking and DIYbiology North of the 45th Parallel - 16kbps - 128kbps
• Bless the Cops and Keep Them Far from Us: Researching, Exploring, and Publishing Findings While Staying out of Legal Trouble - 16kbps - 128kbps
• Blinding The Surveillance State - 16kbps - 128kbps
• Bootkits: Step-by-Step - 16kbps - 128kbps
• Bringing Down the Biological System: How Poisons Hack the Body - 16kbps - 128kbps
• Building an Open Source Cellular Network at Burning Man - 16kbps - 128kbps
• Can You Patent Software? - 16kbps - 128kbps
• Closing Ceremonies - 16kbps - 128kbps
• Codesigning Countersurveillance - 16kbps - 128kbps
• Community Infrastructure for FOSS Projects - 16kbps - 128kbps
• Community Owned and Operated Cellular Networks in Rural Mexico - 16kbps - 128kbps
• Crypto for Makers: Projects for the BeagleBone, Pi, and AVRs - 16kbps - 128kbps
• Cultures of Open Source: A Cross-Cultural Analysis - 16kbps - 128kbps
• Cyber Security in Humanitarian Projects as a Social Justice Issue - 16kbps - 128kbps
• Dark Mail - 16kbps - 128kbps
• Disruptive Wearable Technology - 16kbps - 128kbps
• DIY Usability Research: A Crash Course in Guerrilla Data Gathering - 16kbps - 128kbps
• Drop It Like It’s Hot: Secure Sharing and Radical OpSec for Investigative Journalists - 16kbps - 128kbps
• Echoes of Returns Lost: The History of The Telecom Digest - 16kbps - 128kbps
• Electric Waste Orchestra: Learning and Teaching Music, Electronics, Programming, and Repurposing - 16kbps - 128kbps
• Elevator Hacking: From the Pit to the Penthouse - 16kbps - 128kbps
• Ergonomic Human Interface Hacking - 16kbps - 128kbps
• Ethical Questions and Best Practices for Service Providers in the Post-Snowden Era - 16kbps - 128kbps
• Fuckhackerfucks! An Audience Bashing - 16kbps - 128kbps
• G-code: The Programming Language of Machining and 3D Printers - 16kbps - 128kbps
• Hacking Money, from Alexander the Great to Zerocoin - 16kbps - 128kbps
• Hacking the Patent System: The Vulnerabilities That Allow for Bad Patents and How to Stop Them - 16kbps - 128kbps
• Hearses and Hand-Held Calculators: The Unlikely Connections That Shaped Modern Technology and Tech Culture - 16kbps - 128kbps
• How to Prevent Security Afterthought Syndrome - 16kbps - 128kbps
• HTTP Must Die - 16kbps - 128kbps
• I Am The Cavalry: Lessons Learned Fuzzing the Chain of Influence - 16kbps - 128kbps
• Identifying Back Doors, Attack Points, and Surveillance Mechanisms in iOS Devices - 16kbps - 128kbps
• Jumping the Carbon-Silicon Boundary for Fun and (Mostly) Profit - 16kbps - 128kbps
• Keeping Old Code Alive: The Venerable LambdaMOO Server in 2014 - 16kbps - 128kbps
• Lessons Learned from Implementing Real Life Whistleblowing Platforms - 16kbps - 128kbps
• Lockpicking, a Primer - 16kbps - 128kbps
• Media, Popular Misconceptions, and the CSI Effect – What Does It Mean for InfoSec and Tech Policy? - 16kbps - 128kbps
• Movie: “Algorithm” - 16kbps - 128kbps
• Movie: “Die Gstettensaga: The Rise of Echsenfriedl” - 16kbps - 128kbps
• Movie: “The Internet’s Own Boy: The Story of Aaron Swartz” - 16kbps - 128kbps
• Movie: “War on Whistleblowers: Free Press and the National Security State” - 16kbps - 128kbps
• North Korea – Using Social Engineering and Concealed Electronic Devices to Gather Information in the World’s Most Restrictive Nation - 16kbps - 128kbps
• Obfuscation and its Discontents: DIY Privacy from Card Swap to Browser Hack - 16kbps - 128kbps
• Per Speculum In Ænigmate - 16kbps - 128kbps
• Postprivacy: A New Approach to Thinking about Life in the Digital Sphere - 16kbps - 128kbps
• PRISM-Proof Email: Why Email Is Insecure and How We Are Fixing It - 16kbps - 128kbps
• Privacy-Friendly Hypertext? Do Not Track, Privacy Badger, and the Advertising-Funded Web - 16kbps - 128kbps
• Project PM: Crowdsourcing Research of the Cyber-Intelligence Complex - 16kbps - 128kbps
• Reverse Engineering – Unlocking the Locks - 16kbps - 128kbps
• Rickrolling Your Neighbors with Google Chromecast - 16kbps - 128kbps
• Screening: “Nowhere to Hide” (working title: “Rambam Gets His Man”) - 16kbps - 128kbps
• SecureDrop: A WikiLeaks in Every Newsroom - 16kbps - 128kbps
• Securing a Home Router - 16kbps - 128kbps
• Shortwave Pirate Radio and Oddities of the Spectrum - 16kbps - 128kbps
• Showing Keys in Public – What Could Possibly Go Wrong? - 16kbps - 128kbps
• Skeuomorphic Steganography - 16kbps - 128kbps
• Social Engineering - 16kbps - 128kbps
• Solve the Hard Problem - 16kbps - 128kbps
• Spy Improv: Ask Me Anything - 16kbps - 128kbps
• SSL++: Tales of Transport-Layer Security at Twitter - 16kbps - 128kbps
• Steepest Dissent: Small Scale Digital Fabrication - 16kbps - 128kbps
• Stupid Whitehat Tricks - 16kbps - 128kbps
• Surveillance, Sousveillance, and Anti-Surveillance: Artistic Responses to Watching - 16kbps - 128kbps
• Teaching Electronic Privacy and Civil Liberties to Government - 16kbps - 128kbps
• Technology and Jamming of XKEYSCORE - 16kbps - 128kbps
• The Hidden World of Game Hacking - 16kbps - 128kbps
• The Internet Society Speaks – The History, Futures, and Alternate Directions of the Internet and Its Governance - 16kbps - 128kbps
• The Many Faces of LockSport - 16kbps - 128kbps
• The Repair Movement - 16kbps - 128kbps
• The Science of Surveillance - 16kbps - 128kbps
• The Sex Geek as Culture Hacker - 16kbps - 128kbps
• The Web Strikes Back – Fighting Mass Surveillance with Open Standards - 16kbps - 128kbps
• This Is the X You Are Looking For - 16kbps - 128kbps
• Threat Modeling and Security Test Planning - 16kbps - 128kbps
• Thwarting the Peasants: A Guided and Rambunctious Tour Through the 2600 DeCSS Legal Files - 16kbps - 128kbps
• Travel Hacking with The Telecom Informer - 16kbps - 128kbps
• Unmasking a CIA Criminal - 16kbps - 128kbps
• Updates from the Online Identity Battlefield - 16kbps - 128kbps
• Usable Crypto: New Progress in Web Cryptography - 16kbps - 128kbps
• Using Travel Routers to Hide in Safety - 16kbps - 128kbps
• Vigilante Justice: Masks, Guns, and Networks - 16kbps - 128kbps
• Visualization for Hackers: Why It’s Tricky, and Where to Start - 16kbps - 128kbps
• When Confidentiality and Privacy Conflict - 16kbps - 128kbps
• When Whistleblowers Are Branded as Spies: Edward Snowden, Surveillance, and Espionage - 16kbps - 128kbps
• When You Are the Adversary - 16kbps - 128kbps
• Why the Future is Open Wireless - 16kbps - 128kbps
• Will It Blend? How Evil Software Clogs the Pipes - 16kbps - 128kbps
• Wireless Meshnets: Building the Next Version of the Web - 16kbps - 128kbps
• You’ve Lost Privacy, Now They’re Taking Anonymity (aka Whistleblowing is Dead – Get Over It) - 16kbps - 128kbps
• Your Right to Whisper: LEAP Encryption Access Project - 16kbps - 128kbps

Material de la Black Hat USA 2014



Como muchos ya sabréis Black Hat USA 2014 se celebró la semana pasada, 2-7 agosto, como de costumbre en Las Vegas. Para los que no tuvieran la fortuna de haber asistido a esta conferencia, al menos podréis disfrutar del material que se presentó en las charlas, y que os enlazo a continuación:

• Cybersecurity as Realpolitik geer.blackhat.6viii14.txt
• 48 Dirty Little Secrets Cryptographers Don't Want You To Know
• 802.1x and Beyond!
• A Journey to Protect Points-of-Sale us-14-Valtman-A-Journey-To-Protect-Point-Of-Sale.pdf
• A Practical Attack Against VDI Solutions us-14-Brodie-A-Practical-Attack-Against-VDI-Solutions-WP.pdf
• A Scalable, Ensemble Approach for Building and Visualizing Deep Code-Sharing Networks Over Millions of Malicious Binaries us-14-Saxe.pdf us-14-Saxe-Tool.zip
• A Survey of Remote Automotive Attack Surfaces
• Abuse of CPE Devices and Recommended Fixes us-14-Spring-Abuse-Of-CPE-Devices-And-Recommended-Fixes-WP.pdf us-14-Spring-Abuse-Of-CPE-Devices-And-Recommended-Fixes.pdf
• Abusing Microsoft Kerberos: Sorry You Guys Don't Get It
• Abusing Performance Optimization Weaknesses to Bypass ASLR
• Android FakeID Vulnerability Walkthrough us-14-Forristal-Android-FakeID-Vulnerability-Walkthrough.pdf
• APT Attribution and DNS Profiling us-14-Li-APT-Attribution-And-DNS-Profiling-WP.pdf us-14-Li-APT-Attribution-And-DNS-Profiling.pdf
• Attacking Mobile Broadband Modems Like a Criminal Would us-14-Lindh-Attacking-Mobile-Broadband-Modems-Like-A-Criminal-Would-WP.pdf us-14-Lindh-Attacking-Mobile-Broadband-Modems-Like-A-Criminal-Would.pdf
• Babar-ians at the Gate: Data Protection at Massive Scale
• Badger - The Networked Security State Estimation Toolkit us-14-Rogers-Badger-The-Networked-Security-State-Estimation-Toolkit.pdf
• BadUSB - On Accessories that Turn Evil
• Bitcoin Transaction Malleability Theory in Practice us-14-Chechik-Bitcoin-Transaction-Malleability-Theory-In-Practice.pdf us-14-Chechik-Malleability-Tool-Tool.zip
• Breaking the Security of Physical Devices
• Bringing Software Defined Radio to the Penetration Testing Community us-14-Picod-Bringing-Software-Defined-Radio-To-The-Penetration-Testing-Community-WP.pdf us-14-Picod-Bringing-Software-Defined-Radio-To-The-Penetration-Testing-Community.pdf
• Building Safe Systems at Scale - Lessons from Six Months at Yahoo
• Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering us-14-Johns-Call-To-Arms-A-Tale-Of-The-Weaknesses-Of-Current-Client-Side-XSS-Filtering-WP.pdf us-14-Johns-Call-To-Arms-A-Tale-Of-The-Weaknesses-Of-Current-Client-Side-XSS-Filtering.pdf
• Capstone: Next Generation Disassembly Framework
• Catching Malware En Masse: DNS and IP Style us-14-Mahjoub-Catching-Malware-En-Masse-DNS-And-IP-Style-WP.pdf us-14-Mahjoub-Catching-Malware-En-Masse-DNS-And-IP-Style.pdf
• Cellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
• CloudBots: Harvesting Crypto Coins Like a Botnet Farmer
• Computrace Backdoor Revisited us-14-Kamluk-Computrace-Backdoor-Revisited-WP.pdf us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf
• Contemporary Automatic Program Analysis
• Creating a Spider Goat: Using Transactional Memory Support for Security us-14-Muttik-Creating-A-Spider-Goat-Using-Transactional-Memory-Support-For-Securitypdf.pdf
• Data-Only Pwning Microsoft Windows Kernel: Exploitation of Kernel Pool Overflows on Microsoft Windows 8.1 us-14-Tarakanov-Data-Only-Pwning-Microsoft-Windows-Kernel-Exploitation-Of-Kernel-Pool-Overflows-On-Microsoft-Windows-8.1.pdf
• Defeating the Transparency Feature of DBI us-14-Li-Defeating-The-Transparency-Feature-Of-DBI.pdf
• Digging for IE11 Sandbox Escapes us-14-Forshaw-Digging-For_IE11-Sandbox-Escapes.pdf us-14-Forshaw-Digging-For-IE11-Sandbox-Escapes-Tool.zip
• Dynamic Flash Instrumentation for Fun and Profit
• Epidemiology of Software Vulnerabilities: A Study of Attack Surface Spread
• Evasion of High-End IPS Devices in the Age of IPv6 us-14-Atlasis-Evasion-Of-HighEnd-IPS-Devices-In-The-Age-Of-IPv6-WP.pdf us-14-Atlasis-Evasion-Of-HighEnd-IPS-Devices-In-The-Age-Of-IPv6.pdf
• Exploiting Unpatched iOS Vulnerabilities for Fun and Profit
• Exposing Bootkits with BIOS Emulation us-14-Haukli-Exposing-Bootkits-With-BIOS-Emulation-WP.pdf us-14-Haukli-Exposing-Bootkits-With-BIOS-Emulation.pdf
• Extreme Privilege Escalation on Windows 8/UEFI Systems us-14-Kallenberg-Extreme-Privilege-Escalation-On-Windows8-UEFI-Systems-WP.pdf us-14-Kallenberg-Extreme-Privilege-Escalation-On-Windows8-UEFI-Systems.pdf
• Finding and Exploiting Access Control Vulnerabilities in Graphical User Interfaces us-14-Mulliner-Finding-And-Exploiting-Access-Control-Vulnerabilities-In-Graphical-User-Interfacess-WP.pdf us-14-Mulliner-Finding-And-Exploiting-Access-Control-Vulnerabilities-In-Graphical-User-Interfaces.pdf us-14-Mulliner-Finding-And-Exploiting-Access-Control-Vulnerabilities-In-Graphical-User-Interfaces-Tool.zip
• Fingerprinting Web Application Platforms by Variations in PNG Implementations us-14-Bongard-Fingerprinting-Web-Application-Platforms-By-Variations-In-PNG-Implementations-WP.pdf us-14-Bongard-Fingerprinting-Web-Application-Platforms-By-Variations-In-PNG-Implementations.pdf
• From Attacks to Action - Building a Usable Threat Model to Drive Defensive Choices
• Full System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware us-14-Kruegel-Full-System-Emulation-Achieving-Successful-Automated-Dynamic-Analysis-Of-Evasive-Malware-WP.pdf us-14-Kruegel-Full-System-Emulation-Achieving-Successful-Automated-Dynamic-Analysis-Of-Evasive-Malware.pdf
• Governments As Malware Authors: The Next Generation us-14-Hypponen-Goverments-As-Malware-Authors.pdf
• GRR: Find All the Badness, Collect All the Things us-14-Castle-GRR-Find-All-The-Badness-Collect-All-The-Things-WP.pdf us-14-Castle-GRR-Find-All-The-Badness-Collect-All-The-Things.pdf
• Hacking the Wireless World with Software Defined Radio - 2.0 us-14-Seeber-Hacking-The-Wireless-World-With-Software-Defined-Radio-2.0.pdf
• How Smartcard Payment Systems Fail us-14-Anderson-How_Smartcard-Payment-Systems-Fail.pdf
• How to Leak a 100-Million-Node Social Graph in Just One Week? - A Reflection on Oauth and API Design in Online Social Networks us-14-Hu-How-To-Leak-A100-Million-Node-Social-Graph-In-Just-One-Week-WP.pdf us-14-Hu-How-To-Leak-A100-Million-Node-Social-Graph-In-Just-One-Week.pdf
• How to Wear Your Password us-14-Jakobsson-How-To-Wear-Your-Password-WP.pdf us-14-Jakobsson-How-To-Wear-Your-Password.pdf
• I Know Your Filtering Policy Better than You Do: External Enumeration and Exploitation of Email and Web Security Solutions us-14-Williams-I-Know-Your-Filtering-Policy-Better-Than-You-Do-WP.pdf us-14-Williams-I-Know-Your-Filtering-Policy-Better-Than-You-Do.pdf
• ICSCorsair: How I Will PWN Your ERP Through 4-20 mA Current Loop us-14-Bolshev-ICSCorsair-How-I-Will-PWN-Your-ERP-Through-4-20mA-Current-Loop-WP.pdf us-14-Bolshev-ICSCorsair-How-I-Will-PWN-Your-ERP-Through-4-20mA-Current-Loop.pdf
• Internet Scanning - Current State and Lessons Learned us-14-Schloesser-Internet-Scanning-Current-State-And-Lessons-Learned.pdf
• Investigating PowerShell Attacks us-14-Kazanciyan-Investigating-Powershell-Attacks-WP.pdf us-14-Kazanciyan-Investigating-Powershell-Attacks.pdf
• It Just (Net)works: The Truth About iOS 7's Multipeer Connectivity Framework
• Learn How to Control Every Room at a Luxury Hotel Remotely: The Dangers of Insecure Home Automation Deployment
• Leviathan: Command and Control Communications on Planet Earth us-14-Geers-Leviathan-Command-And-Control-Communications-On-Planet-Earth-WP.pdf us-14-Geers-Leviathan-Command-And-Control-Communications-On-Planet-Earth.pdf
• Lifecycle of a Phone Fraudster: Exposing Fraud Activity from Reconnaissance to Takeover Using Graph Analysis and Acoustical Anomalies us-14-Balasubramaniyan-Lifecycle-Of-A-Phone-Fraudster-WP.pdf us-14-Balasubramaniyan-Lifecycle-Of-A-Phone-Fraudster.pdf
• Miniaturization us-14-Larsen-Miniturization-WP.pdf us-14-Larsen-Miniturization.pdf
• Mission mPOSsible
• Mobile Device Mismanagement
• MoRE Shadow Walker: The Progression of TLB-Splitting on x86 us-14-Torrey-MoRE-Shadow-Walker-The-Progression-Of-TLB-Splitting-On-x86-WP.pdf us-14-Torrey-MoRE-Shadow-Walker-The-Progression-Of-TLB-Splitting-On-x86.pdf
• Multipath TCP: Breaking Today's Networks with Tomorrow's Protocols us-14-Pearce-Multipath-TCP-Breaking-Todays-Networks-With-Tomorrows-Protocols-WP.pdf us-14-Pearce-Multipath-TCP-Breaking-Todays-Networks-With-Tomorrows-Protocols.pdf us-14-Pearce-Multipath-TCP-Breaking-Todays-Networks-With-Tomorrows-Protocols-Tool.zip
• My Google Glass Sees Your Passwords! us-14-Fu-My-Google-Glass-Sees-Your-Passwords-WP.pdf us-14-Fu-My-Google-Glass-Sees-Your-Passwords.pdf
• Network Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells
• "Nobody is Listening to Your Phone Calls." Really? A Debate and Discussion on the NSA's Activities
• One Packer to Rule Them All: Empirical Identification, Comparison, and Circumvention of Current Antivirus Detection Techniques us-14-Mesbahi-One-Packer-To-Rule-Them-All-WP.pdf us-14-Mesbahi-One-Packer-To-Rule-Them-All.pdf
• OpenStack Cloud at Yahoo Scale: How to Avoid Disaster
• Oracle Data Redaction is Broken
• Pivoting in Amazon Clouds us-14-Riancho-Pivoting-In-Amazon-Clouds-WP.pdf us-14-Riancho-Pivoting-In-Amazon-Clouds.pdf us-14-Riancho-Nimbostratus-Target-Tool.zip us-14-Riancho-Nimbostratus-Tool.zip
• Poacher Turned Gamekeeper: Lessons Learned from Eight Years of Breaking Hypervisors us-14-Wojtczuk-Poacher-Turned-Gamekeeper-Lessons_Learned-From-Eight-Years-Of-Breaking-Hypervisors.pdf
• Point of Sale System Architecture and Security us-14-Zaichkowsky-Point-Of-Sale System-Architecture-And-Security.pdf
• Prevalent Characteristics in Modern Malware us-14-Branco-Prevalent-Characteristics-In-Modern-Malware.pdf
• Probabilistic Spying on Encrypted Tunnels us-14-Niemczyk-Probabilist-Spying-On-Encrypted-Tunnels.pdf us-14-Niemczyk-Pacumen.tar-Tool.gz
• Protecting Data In-Use from Firmware and Physical Attacks us-14-Weis-Protecting-Data-In-Use-From-Firmware-And-Physical-Attacks-WP.pdf us-14-Weis-Protecting-Data-In-Use-From-Firmware-And-Physical-Attacks.pdf
• Pulling Back the Curtain on Airport Security: Can a Weapon Get Past TSA? us-14-Rios-Pulling-Back-The-Curtain-On-Airport-Security.pdf
• RAVAGE - Runtime Analysis of Vulnerabilities and Generation of Exploits us-14-Wang-RAVAGE-Runtime-Analysis-Of-Vulnerabilities-And-Generation-Of-Exploits.pdf
• Reflections on Trusting TrustZone us-14-Rosenberg-Reflections-On-Trusting-TrustZone-WP.pdf us-14-Rosenberg-Reflections-on-Trusting-TrustZone.pdf
• Researching Android Device Security with the Help of a Droid Army
• Reverse Engineering Flash Memory for Fun and Benefit us-14-Oh-Reverse-Engineering-Flash-Memory-For-Fun-And-Benefit-WP.pdf us-14-Oh-Reverse-Engineering-Flash-Memory-For-Fun-And-Benefit.pdf
• Reverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device
• SAP, Credit Cards, and the Bird that Talks Too Much us-14-Arsal-SAP-Credit-Cards-And-The-Bird-That-Talks-Too-Much.pdf
• SATCOM Terminals: Hacking by Air, Sea, and Land us-14-Santamarta-SATCOM-Terminals-Hacking-By-Air-Sea-And-Land-WP.pdf us-14-Santamarta-SATCOM-Terminals-Hacking-By-Air-Sea-And-Land.pdf
• Saving Cyberspace us-14-Healey-Saving-Cyberspace-WP.pdf us-14-Healey-Saving-Cyberspace.pdf
• SecSi Product Development: Techniques for Ensuring Secure Silicon Applied to Open-Source Verilog Projects us-14-FitzPatrick-SecSi-Product-Development-WP.pdf us-14-FitzPatrick-SecSi-Product-Development.pdf
• Secure Because Math: A Deep-Dive on Machine Learning-Based Monitoring us-14-Pinto-Secure-Because-Math-A-Deep-Dive-On-Machine-Learning-Based-Monitoring-WP.pdf
• Sidewinder Targeted Attack Against Android in the Golden Age of Ad Libs us-14-Wei-Sidewinder-Targeted-Attack-Against-Android-In-The-Golden-Age-Of-Ad-Libs.pdf
• Smart Nest Thermostat: A Smart Spy in Your Home us-14-Jin-Smart-Nest-Thermostat-A-Smart-Spy-In-Your-Home-WP.pdf us-14-Jin-Smart-Nest-Thermostat-A-Smart-Spy-In-Your-Home.pdf
• Static Detection and Automatic Exploitation of Intent Message Vulnerabilities in Android Applications
• Stay Out of the Kitchen: A DLP Security Bake-Off
• SVG: Exploiting Browsers without Image Parsing Bugs
• The Beast is in Your Memory: Return-Oriented Programming Attacks Against Modern Control-Flow Integrity Protection Techniques
• The BEAST Wins Again: Why TLS Keeps Failing to Protect HTTP
• The Big Chill: Legal Landmines that Stifle Security Research and How to Disarm Them
• The Devil Does Not Exist - The Role of Deception in Cyber us-14-Mateski-The-Devil-Does-Not-Exist-The-Role-Of-Deception-In-Cyber.pdf
• The Library of Sparta us-14-Raymond-The-Library-Of-Sparta-WP.pdf us-14-Raymond-The-Library-Of-Sparta.pdf
• The New Page of Injections Book: Memcached Injections us-14-Novikov-The-New-Page-Of-Injections-Book-Memcached-Injections-WP.pdf us-14-Novikov-The-New-Page-Of-Injections-Book-Memcached-Injections-WP.pdf
• The New Scourge of Ransomware: A Study of CryptoLocker and Its Friends
• The State of Incident Response
• Thinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways us-14-Gorenc-Thinking-Outside-The-Sandbox-Violating-Trust-Boundaries-In-Uncommon-Ways-WP.pdf us-14-Gorenc-Thinking-Outside-The-Sandbox-Violating-Trust-Boundaries-In-Uncommon-Ways.pdf
• Threat Intelligence Library - A New Revolutionary Technology to Enhance the SOC Battle Rhythm!
• Time Trial: Racing Towards Practical Timing Attacks us-14-Mayer-Time-Trial-Racing-Towards-Practical-Timing-Attacks-WP.pdf us-14-Mayer-Time-Trial-Racing-Towards-Practical-Timing-Attackss.pdf
• Understanding IMSI Privacy
• Understanding TOCTTOU in the Windows Kernel Font Scaler Engine
• Unveiling the Open Source Visualization Engine for Busy Hackers us-14-Hay-Unveiling-The-Open-Source-Visualization-Engine-For-Busy-Hackers-WP.pdf us-14-Hay-Unveiling-The-Open-Source-Visualization-Engine-For-Busy-Hackers.pdf us-14-Hay-OpenGraphiti-Black-Hat-2014-Release-Tool.zip
• Unwrapping the Truth: Analysis of Mobile Application Wrapping Solutions
• VoIP Wars: Attack of the Cisco Phones us-14-Ozavci-VoIP-Wars-Attack-Of-The-Cisco-Phones.pdf us-14-Ozavci-Viproy-1.9.0-Tool.zip
• What Goes Around Comes Back Around - Exploiting Fundamental Weaknesses in Botnet C&C Panels! us-14-Sood-What-Goes-Around-Comes-Back-Around-Exploiting-Fundamental-Weaknesses-In-Botnet-C&C-Panels-WP.pdf us-14-Sood-What-Goes-Around-Comes-Back-Around-Exploiting-Fundamental-Weaknesses-In-Botnet-C&C-Panels.pdf
• When the Lights Go Out: Hacking Cisco EnergyWise us-14-Luft-When-The-Lights-Go-Out-Hacking-Cisco-EnergyWise-WP.pdf us-14-Luft-When-The-Lights-Go-Out-Hacking-Cisco-EnergyWise.pdf us-14-Luft-When-The-Lights-Go-Out-Hacking-Cisco-EnergyWise-Tool.zip
• Why Control System Cyber-Security Sucks... us-14-Luders-Why-Control-System-Cyber-Security-Sucks.pdf
• Why You Need to Detect More Than PtH us-14-Hathaway-Why-You-Need-To-Detect-More-Than-PtH-WP.pdf us-14-Hathaway-Why-You-Need-To-Detect-More-Than-PtH.pdf
• Windows Kernel Graphics Driver Attack Surface us-14-vanSprundel-Windows-Kernel-Graphics-Driver-Attack-Surface.pdf
• Write Once, Pwn Anywhere

Banda sonora oficial de DEF CON 22



Otro año, otra DEF CON, más música, más hacking, más, más… La DEF CON 22 ya tiene banda sonora, disponible de forma totalmente gratuita como en años anteriores, aunque siempre puedes ponerle precio y así reconocer y agradecer el trabajo a sus autores.

Las pistas están disponibles en Gravitas Recordings. Puedes escuchar las canciones online o bien descargarlas para poder escucharlas en cualquier momento sin tener que estar conectado a internet. Esta la lista de las pistas:

Vídeos de la Hack In Paris 2014



Ya se encuentran disponibles los vídeos de las charlas dadas en la conferencia sobre seguridad informática Hack In Paris 2014.

La lista es la siguiente:

• Breaking through the bottleneck : mobile malware is outbreak spreading like wildfire
• ARM AARCH64 writing exploits for the new arm architecture
• Splinter the rat attack: create your own botnet to exploit the network
• C+11 metaprogramming technics applied to software obduscation
• Digital Energy - BPT
• To sternly look at JavaScript MVC and templating frameworks
• Bitting into the forbidden fruit.Lessons froms trusting JavaScript crypto
• Defeating UEFI/WIN8 secureboot
• KEYNOTE: Around the world in 80 cons!
• Pentesting NoSQL exploitation framework
• Energy fraud and orchestrated blackouts/issues with wireless metering protocols(Wm-Bus)
• Extreme forensics reloaded 2Q/2014
• KEYNOTE: Beyond information ware; hacking the future of security
• Fuzzing reversing and maths
• Plunder,pillage and print

Presentaciones de la SyScan+360 2014



Si te interesaron las charlas de la SyScan+360 de este año 2014, ya las puedes descargar desde su web. No están todas, pero las que están tienen buena pinta (parece que sólo faltan 3).

Esta es la lista de las que están disponibles:

• CloudBots: Harvesting Crypto Coins like a Botnet Farmer
• Hack Your Car and I’ll Drive You Crazy: the Design of Hack-proof CAN-based Automotive System
• Program Analysis and Constraint Solvers 
• Advanced Bootkit Techniques on Android
• Using and Abusing Microsoft’s Fix It Patches
• Browser fuzzing in 2014 - David vs Goliath (a.k.a. learn where to throw your stones)
• Mobile Browsers Security: iOS
• Click and Dagger: Denial and Deception on Android Smartphones
• Breaking Antivirus Software
• F**k you Hacking Team! From Portugal, with Love

Vídeos de la OWASP AppSecEu 2014



Ya están disponibles los vídeos (aunque no todos) de la conferencia OWASP AppSecEU 2014, celebrada en Cambridge entre el 23 y 26 de junio.

• Hemil Shah - Smart Storage Scanning for Mobile Apps - Attacks and Exploit
• OrKatz - Getting New Actionable Insights by Analyzing Web Application Firewall Triggers
• Jacob West - Keynote - Fighting Next-Generation Adversaries with Shared Threat Intelligence
• Lorenzo Cavallaro - Keynote - Copper Droid On the Reconstruction of Android Malware Behaviors
• Matt Tesauro - Barbican Protect your Secrets at Scale
• Gergely Revay - Security Implications of Cross-Origin Resource Sharing
• Simon Bennetts - OWASP ZAP Advanced Features
• Maty Siman - Warning Ahead Security Stormsare Brewing in Your JavaScript
• Dan Cornell - Hybrid Analysis Mapping Making Security and Development Tools Play Nice Together
• StevenMurdoch - Keynote-Anonymous Communications and Tor History and Future Challenges
• Winston Bond - OWASP Mobile Top Ten 2014 - The New Lack of Binary Protection Category
• Jerry Hoff - Getting a Handle on Mobile Security
• AppSec EU 2014 Chapter Leaders Workshop
• OWASP AppSec Europe 2014 - Frameworks and Theories Track
• OWASP AppSec Europe 2014 - Builder and Breaker Track
• OWASP AppSec Europe 2014 - DevOps Track
• OWASP AppSec Europe 2014 - Security Management & Training Track
• OWASP AppSec Europe 2014 - Malware & Defence Track
• OWASP AppSec Europe 2014 - Mobile Track

Presentaciones de Mobile Security Technologies (MoST) 2014



Mobile Security Technologies (MoST) es un conferencia de solamente un día en la que se reúnen y presentan los últimos avances en investigación sobre la seguridad en tecnologías móviles. Ésta tuvo lugar en San Jose, California, el pasado 17 de mayo.

Las presentaciones y trabajos presentados este año son las siguientes:

Data Driven Authentication: On the Effectiveness of User Behaviour Modelling with Mobile Device Sensors [Paper] [Slides] Gunes Kayacik, Mike Just, Lynne Baillie (Glasgow Caledonian University), David Aspinall (University of Edinburgh) and Nicholas Micallef (Glasgow Caledonian University)

Material de la LLVM europea



La conferencia EuroLLVM 2014 que tuvo lugar en Edinburgo, Escocia el pasado 7-8 de abril ha liberado los vídeos y presentaciones de las charlas que se dieron. EuroLLVM es una conferencia enfocada alrededor de la arquitectura de compiladores.

La lista del material publicado es la siguiente:

Tobias Edler von Koch (University of Edinburgh)	Conference Opening & Welcome	[Slides] [Video]
Chandler Carruth (Google)	Keynote: Passes in LLVM, Part 1	[Slides] [Video]
Marshall Clow (Qualcomm)	Keynote: What's new in C++14, and how you can take advantage of it	[Slides] [Video]
Rafael Ávila de Espíndola (World Wide Studios/Sony Computer Entertainment)	LTO: History and work to be done	[Slides] [Video]
Reinoud Elhorst, Mark Batty, David Chisnall (University of Cambridge)	Efficient code generation for weakly ordered architectures	[Slides] [Report]
Andy Thomason (Goldsmiths)	How to build LLVM in under ten seconds	[Slides] [Web version]
Ulrich Weigand (IBM Linux Technology Center)	A new ABI for little-endian PowerPC64: design and implementation	[Slides] [Video]
JF Bastien (Google)	Portable Native Client. Fast, Secure, Simple: Pick Three.	[Slides] [Notes] [Video]
Marcello Maggioni (Codeplay Software)	Branching in Data-Parallel Languages using Predication with LLVM	[Slides] [Video]
Daniel Jasper (Google)	clang-tidy - Lint-like checks and beyond	[Slides]
Greg Bedwell (SN Systems Ltd/Sony Computer Entertainment)	PlayStation(R)4 CPU Toolchain: Launch Post-mortem	[Slides] [Video]
Andrew MacPherson (Fabric Software Inc.)	Fabric Engine and KL: LLVM for 3D Digital Content Creation	[Slides] [Video]
Frej Drejhammar (Swedish Institute of Computer Science)	BEAMJIT: An LLVM based just-in-time compiler for Erlang	[Slides] [Video]
Tom Spink (University of Edinburgh)	Custom Alias-analysis in an LLVM-backed region-based Dynamic Binary Translator	[Slides] [Video]
Hans Wennborg (Google)	clang-cl: what it is, how it works, and how to use it	[Slides] [Video]

Tutoriales

Vídeos de las charlas de la Norwegian Developers Conference Oslo 2014



Las charlas de la NDC (Norwegian Developers Conference) que tuvieron lugar entre el 2 y 6 de junio en Oslo, Noruega de este mismo año, 2014, están disponibles públicamente, y si mis cuentas no me han fallado, son nada más y nada menos que 158 vídeos. La temática principal de esta conferencia es el desarrollo de software. Aquí tenéis la lista completa:

• NDCOslo Trailer
• It’s a Write/Read (Mobile) Web
• Immutability, State and Scale - Functional, Distributed Applications in Azure
• C++14
• Front End Design Patterns: SOLID CSS + JS for Backend Developers
• Hybrid vs Native: Choosing a Mobile Strategy
• Developing in a Decade
• Building End-to-End Web Apps Using TypeScript
• Pharo: Playing with live objects
• Strangling the Legacy out of an Application
• Domain Specific Languages, the functional way
• Go: A Pragmatic Language
• Effective Modern C++
• Build a Better Bootstrap
• Temporal correlation and complex event processing in JavaScript
• Banish Your Inner Critic
• Windows Azure Mobile Services from the ground up
• The Agony of Lean Startup
• CQRS with Erlang
• Azure Web Sites Secrets, Exposed!
• Error Handling in C++
• Write massively-parallel GPU code for the browser with WebGL
• ReactiveUI - Turning MVVM up to 11
• Seven Ineffective Coding Habits of Many Programmers
• Functional Programming the Long Road to Enlightenment: a Historical and Personal Narrative
• What is new: Windows Phone and Windows Store App
• Querying of Event Streams
• OWIN and Katana: What the Func?
• Functional Code Considered Beautiful
• Move, noexcept, and push_back() and how they relate to each other
• Bridging Node.js and .NET Using Edge.js
• People, Process, Tools – The Essence of DevOps
• CPU Caches and Why You care
• Understanding SignalR performance
• Our experience from building and running a SaaS in the cloud
• Async C# 5.0 - Patters For Real World Use
• Web API Authorization & Access Control – done right!
• Scaling Event Processing at all scales and all languages with the Reactive Extensions
• C++ Type Deduction and Why You Care
• Functional Reactive Programming and Bacon
• Railway Oriented Programming -- error handling in functional languages
• Finally! - True Cross-Platform Federation & Single Sign-On with OpenID Connect
• Leading without formal authority
• Patterns for the People
• Builders versus breakers – 10 online attacks we could have easily prevented
• scriptcs deep dive. Extending, customizing and embedding in your applications.
• Game and Simulator Physics for Developers, Gamers and Petrol Heads
• Generic and Generative Programming in C++
• Serialize All The Things with Json.NET
• Better Software--No Matter What: The Most Important Design Guideline
• How C# Saved my Marriage, Enhanced my Career and Made Me an Inch Taller
• The integrations we fear and how we can manage them
• TCP servers in .NET done right
• Managing Asynchronicity
• Single sign-on for mobile native applications
• Javascript Combinators
• Delightful WebGL in Elm
• Beyond NuGet: Front End Package Management with Bower
• Securing a modern JavaScript based single page web application
• Taking Design Patterns to the Next Level
• Snake Bitten: Danger and Misfortune in the Evolution of Programming Languages
• C++ - where are we headed?
• The mess we're in
• The mythical beast called the Internet of Things and how to tame it
• The Art of the Javascript Metaobject Protocol
• Becoming an Outlier: Career Reboot for the Developer Mind
• Docker is the future of shipping our code
• Cloud beyond scaling : realtime webapplications
• An Actor's Life for Me – An introduction to the TPL Dataflow Library and asynchronous programming blocks
• From Knockout to AngularJS
• Full Stack Web Performance
• How to scale apps and cloud services for Play Magnus
• Three Cool Things about D
• The journey from Powershell to Grunt for Build and Deploy
• Zone out, check in, move on
• Delivering Continuously to 10 Million Users
• Quick Tour to Front-End Unit Testing Using Jasmine
• An Introduction to Nancy
• .NET outside of Visual Studio
• The Better Parts
• Pipe dreams: Pipes |> Macros |> Beautiful Code
• The C++ memory model
• Angular TypeScript
• Agile Kaizen
• Wherefore art thou Erlang?
• Privacy for the Internet
• Designing Wonderful .NET APIs
• The Future of ASP.NET Part I
• C# is in my ears and in my eyes
• Node.JS Tools For Front-End Developers
• Brief tour of Clang
• Building Directives for AngularJS
• Agile Metrics - Velocity is NOT the Goal
• Discrete Math You Need to Know
• Ninja vs. Samurai - Let the scripting battle begin
• "It doesn't work like that in enterprise"
• Insecure coding in C and C++
• The Future of ASP.NET Part II
• Free is a Lie
• Why no code reviews?
• Facial Hair & the Road to Faster JavaScript
• From Code Monkey to Boss Man
• IDEs: The State of the Union
• 10 Things I've Learned From Doing OSS
• The Technical Debt Trap
• So you think you can int? (C++)"
• Coding against MongoDB in .NET
• Metamagical programming with expression trees
• F# and Machine Learning: a winning combination
• Some Time Later: What’s the state of HTML5 & hybrid apps?
• Build an extraordinary career by sharing your knowledge
• Getting Agile with Scrum
• Data Modeling Examples in the Real World with MongoDB
• The Future of Extreme Web Browsing
• 1) Write cross-platform apps with F# & Xamarin. 2) ??? 3) Profit!
• Accelerating Windows Store app development by using Prism for the Windows Runtime
• Functional UI programming with React.JS and ClojureScript
• Internet of Things - Controlling the world with Arduino and JavaScript?
• Advanced TDD: The Transformation Priority Premise
• Beautiful Builds
• User Stories for Agile Requirements
• Back to basics: Finalization and disposition in .NET
• Making 3D games with MonoGame
• Lessons Learned - Web Application Testing in .NET
• A lap around the Windows Phone 8.1 development platform
• Architecting large Single Page Applications with Knockout.js
• Agile Estimating
• From SQL to RavenDB: A .NET Team’s Journey
• Transforming your C# code to functional style
• Say Hello to your Google Android Wear Watch
• Hadoop Kickstarter for the Microsoft Platform
• How I hacked my way to Norway
• Porting Quake III to F#: A Journey to Functional Programming
• Building Universal Apps for Windows Phone and Windows 8.1
• .NET Rocks Panel: Why Do You Develop Software?
• The Internet Of Things and everything wireless
• Clean Architecture and Design
• Advanced Topics in Agile Planning
• HTML5 & JavaScript Communication APIs
• Understanding your website through the IE11 F12 tools
• Introducing Roslyn
• RELEASE Scalable Erlang
• Programming Pebble
• TDD in Tatters
• From text to full-text
• Towards an Evolutionary Architecture
• Leading a Self-Organizing Team
• A Heaping Stack of Scripts: Getting the most out of JavaScript Stacktraces.
• Using the Scrum Rules Against your Boss
• Web Audio: Can you hear me now?
• The Future of UX with Kinect for Windows v2
• Windows 8.1 Store Apps – Given to Fly
• A Peek into an Enterprise Development Operation Team
• Typed? Dynamic? Both! Cross-plat, form DSLs in C#
• Core Software Design Principles
• History of Programming: Part 1
• Case study: Making use of functional programming techniques in .NET
• A reality check on the Internet of Things - and how you can get started with your own project

Abierto el plazo de envío de ponencias para No cON Name 2014



Con motivo de una nueva edición de una de las grandes conferencias sobre seguridad españolas y la más antigua, No cON Name tiene abierto el proceso de Call For Papers (CFP) o envío de propuestas de ponencias.

Las fechas para el evento de este año 2014, son las siguientes:

• Finalización del plazo de entrega de las solicitudes: 15 de julio
• Notificación de aceptación: 20 de julio
• Entrega del material final de la presentación: 15 de septiembre
• Congreso Edición 2014: 31 de octubre y 1 de noviembre
• Concurso Capture The Flag: 30 de octubre
• Publicación de Ponentes: 1 agosto
• Publicación de Calendario: 15 de agosto
• Apertura inscripciones: 1 junio

Podéis encontrar más información en la página del evento.

En cuanto a los ponentes, podéis descargaros este archivo zip con toda la información y plantillas que necesitaréis rellenar para mandar vuestra propuesta.

Vídeos de la TROOPERS 2014



Ya están disponibles los vídeos de la conferencia de seguridad informática TROOPERS 2014. Ésta se celebró el pasado 17-21 de marzo en Heidelberg, Alemania.

• Keynote - FX
• Georg Bakos - Keynote
• Get Over It: Privacy is Good for Security - Rob Lee
• How to Work towards Pharma Compliance for Cloud Computing - Martijn Jansen
• Psychology of Security - Stefan Schumacher
• Bro: A Flexible Open-Source Platform - Robin Summer
• Granular Trust; making it work - Toby Kohlenberg
• Risks in hosted SAP Environments - Andreas Wiegenstein & Xu Jia
• Injecting evil code in your SAP J2EE systems - Alexander Polyakov & Dimitry Chastuhin
• Compromise-as-a-Service: Our PleAZURE - Matthias Luft & Felix Wilhelm)
• SAP's Network Protocols Revisited - Martin Gallo
• OSMOSIS - Christian Sielaff & Daniel Hauenstein
• Security and SDN -- A perfect fit or oil-and-water? - Ivan Pepelnjak
• Easy Ways To Bypass Anti-Virus Systems - Attila Marosi
• What Happens In Windows 7 Stays In Windows 7 - Marion Marschalek & Joseph Moti
• The Three Billion Dollar App - Vladimir Wolstencroft
• SAP BusinessObjects Attacks - Juan Perez-Etchegoyen & Will Vandevanter
• How I Latch on Me and Protect My Digital Life against Passwords - Chema Alonso
• Anti-forensics on SAP systems - Juan Perez-Etchegoyen & Will Vandevanter
• Modern Smartphone Forensics - Vladimir Katalov
• Making (and Breaking) an 802.15.4 WIDS - Sergey Bratus, Javier Vazquez, Ryan Speers
• Vulnerability Classification in the SaaS Era - Noam Liran
• Medical Device Cyber Security: The First 164 Years - Kevin Fu
• Why IPv6 Security is so hard - Enno Rey
• 20 Ways Past Secure Boot - Job de Haas
• Implementing an USB Host Driver Fuzzer - Daniel Mende
• TROOPERS14 - Closing Remarks - Enno Rey

Videos de la PyCon 2014



PyCon es probablemente la mayor conferencia sobre el lenguaje de programación Python. Aunque la edición actual, 2014, está todavía en proceso (hasta el 17 de abril), ya se han publicado los vídeos de las charlas celebradas entre los días 11 y 13 de abril.

La lista de vídeos está disponible en PyVideo.org y os la dejo a continuación:

• 2D/3D graphics with Python on mobile platforms
• Advanced techniques for Web functional testing
• Analyzing Rap Lyrics with Python
• A Scenic Drive through the Django Request-Response Cycle
• Building the App
• Cheap Helicopters In My Living Room
• Closing address - PyCon 2014 (2014/04/13)
• Data intensive biology in the cloud: instrumenting ALL the things
• Deliver Your Software In An Envelope
• Designing Django's Migrations
• Designing Poetic APIs
• Developing Flask Extensions
• Discovering Python
• Diving into Open Data with IPython Notebook & Pandas
• Django: The good parts
• Farewell and Welcome Home: Python in Two Genders
• Fast Python, Slow Python
• Games for Science: Creating interactive psychology experiments
• Garbage Collection in Python
• Getting Started Testing
• Hitchhikers Guide to Participating in Open Source
• In Depth PDB
• Introduction to Docker
• Introduction to SQLAlchemy Core
• It's Dangerous to Go Alone: Battling the Invisible Monsters in Tech
• Keynote - Fernando Pérez
• Keynote - Guido Van Rossum
• Keynote - Jessica McKellar
• Keynote - Van Lindberg
• Know Thy Neighbor: Scikit and the K-Nearest Neighbor Algorithm
• Lightning talks - Saturday morning
• Lightning talks - Sunday morning
• Localization Revisited
• Multi-factor Authentication - Possession Factors
• My big gay adventure. Making, releasing and selling an indie game made in python.
• Outreach Program for Women: Lessons in Collaboration
• Performance Testing and Profiling: A Virtuous Cycle
• Postgres Performance for Humans
• PostgreSQL is Web Scale (Really :) )
• Programming an Autonomous 20 Foot Blimp with Python
• Pushing Python: Building a High Throughput, Low Latency System
• Python in the Browser: Intro to Brython
• Python packaging simplified, for end users, app developers
• Quick Wins for Better Website Security
• REST is not enough: Using Push Notifications to better support your mobile clients
• Sane schema migrations with Alembic and SQLAlchemy
• See Docs Run. Run, Docs, Run!
• Set your code free: releasing and maintaining an open-source Python project
• Smart Dumpster: Employing Python to Report Real-Time Resource
• Software Carpentry: Lessons Learned
• Software Engineering Research for Hackers: Bridging the Two Solitudes
• So You Want to Build an API?
• Subprocess to FFI: Memory, Performance, and Why You Shouldn't Shell Out
• Technical on-boarding, training, and mentoring.
• The Day of the EXE Is Upon Us
• The Sorry State of SSL
• Track memory leaks in Python
• Unit Testing Makes Your Code Better
• Upgrade your Web Development Toolchain
• What is coming in Python packaging
• Which messaging layer should you use if you want to build
• Writing RESTful web services with Flask
• Advanced methods for creating decorators
• All Your Ducks In A Row: Data Structures in the Standard Library and Beyond
• An Introduction to Twisted
• Ansible - Python-Powered Radically Simple IT Automation
• Application Deployment State of the Onion
• Bayesian statistics made simple
• Beyond Defaults: Creating Polished Visualizations Using Matplotlib
• Blending art, technology, and light, Python for interactive and real time
• Building and breaking a Python sandbox
• Build your own PiDoorbell! - Learn Home Automation with Python
• By Your Bootstraps: Porting Your Application to Python3
• Cache me if you can: memcached, caching patterns and best practices
• Castle Anthrax: Dungeon Generation Techniques
• Character encoding and Unicode in Python
• Computer science fundamentals for self-taught programmers
• Contribute with me! Getting started with open source development
• Data Wrangling for Kaggle Data Science Competitions -- An etude
• Decorators: A Powerful Weapon in your Python Arsenal
• Distributed Computing Is Hard, Lets Go Shopping
• Distributed task processing using Celery
• Django for Web Designers and Front End Developers
• Dynamics and Control with Python
• Enough Machine Learning to Make Hacker News Readable Again
• Fan-in and Fan-out: The crucial components of concurrency
• Faster Python Programs through Optimization
• Flask by Example
• For Lack of a Better Name(server): DNS Explained.
• Generators: The Final Frontier
• Getting Hy on Python: How to implement a Lisp front-end to Python
• Getting Started with SaltStack
• Hands-on with Pydata: how to build a minimal
• Hello Physical World: A Crash Course on the Internet of Things
• How to Get Started with Machine Learning
• Import-ant Decisions
• Improving automated testing with py.test
• Introduction to game programming
• Introduction to Regular Expressions
• Introduction to SQLAlchemy
• Introduction to Web (and data!) Scraping with Python
• IPython in depth: high productivity interactive and parallel python
• Keynote - John Perry Barlow
• Kneel And Disconnect: Getting The Fastest Connection Out Of A Hostname
• Let's Learn Twisted Python
• Lightning talks - Saturday Evening
• Pickles are for Delis, not Software
• PostgreSQL Proficiency for Python People
• Puppet Modules: Apps for Ops
• Python 3/2 Web Development with Pyramid
• Python for Social Scientists
• Python + Geographic Data = BFFs
• Python Scraping Showdown: A performance and accuracy review
• Realtime predictive analytics using scikit-learn & RabbitMQ
• Search 101: An Introduction to Information Retrieval
• Shiny, Let's Be Bad Guys: Exploiting and Mitigating the Top 10
• So you want to be a full-stack developer? How to build a full-stack python
• Straightening Out AngularJS with Python
• TDD for web applications, from scratch
• Teaching Python: To Infinity and Beyond
• The Python Pipeline: Why you should reach out to local teachers
• The State of Crypto in Python
• The Young Coder: Let's Learn Python
• Turn Your Computer Into a Server
• Twisted Mixing
• What Is Async, How Does It Work, And When Should I Use It?
• 0 to 00111100 with web2py
• Descriptors and Metaclasses - Understanding and Using Python's More Advanced Features
• Diving deeper into Machine Learning with Scikit-learn
• Exploring Machine Learning with Scikit-learn
• Getting Started with Django, a crash course
• Hands-on intro to Python for beginning programmers
• How to formulate a (science) problem and analyze it using Python code
• Lightning talks - Saturday morning
• Mining Social Web APIs with IPython Notebook
• mrjob: Snakes on a Hadoop
• Opening Statements - PyCon 2014 (2014/04/11)
• Python Epiphanies

Vídeos de la Notacon 11



Desde la web de Irongeek podemos acceder a los vídeos de la Notacon 11, conferencia sobre seguridad informática celebrada del 10 al 13 de abril. Los vídeos disponibles son los siguientes:

• Big Data Technology – The Real World ‘Minority Report’ - Brian Foster
• Naisho DeNusumu (Stealing Secretly) – Exfiltration Tool/Framework - Adam Crompton
• Wireless Mesh Protocols - Alex Kot
• MDM is gone, MAM is come. New Challenges on mobile security - Yury Chemerkin
• Moving the Industry Forward – The Purple Team - David Kennedy
• Pwning the POS! - Mick Douglas
• Nindroid: Pentesting Apps for your Android device - Michael Palumbo
• Building a private data storage cloud - Michael Meffie
• Lessons Learned Implementing SDLC – and How To Do It Better - Sarah Clarke
• Plunder, Pillage and Print - Deral Heiland & Peter Arzamendi
• Microsoft Vulnerability Research: How to be a finder as a vendor - Jeremy Brown & David Seidman
• SMalware Analysis 101 – N00b to Ninja in 60 Minutes - grecs
• Omega – A Universe Over IP - Mo Morsi
• IRS, Identity Theft, and You (or Someone Pretending to Be You). - 123-45-6789
• All About the Notacon Badge -Sam Harmon
• Collaboration between Artificial Intelligence and Humans: How to cure every disease within 50 years - Joe O’Donnell
• Science “Fair” - The Nomad Clan
• Hacking Your Way Into the APRS Network on the Cheap - Mark Lenigan
• Dominate! (Or let your computer do it for you.) - Paul Jarc
• Wearable Technology as Art for Countersurveillance, Cinemaveillance, and Sousveillance - Ross Bochnek
• 3D Printing for Work and Fun (temp title) - Mirabela Rusu
• Comparing “Go Green” With “Common Sense” - Suellen Walker
• Living in the Future: It seems to be in Beta - Jeff Goeke-Smith
• A Brief Introduction to Game Theory - Charlotte DeKoning - Beyond Using The Buddy System - Holly Moyseenko & Kris Perch

Presentaciones de la SyScan 2014



Las presentaciones de la SyScan 2014 celebrada en Singapur del 31 de marzo al 4 de abril ya están disponible para descarga. El material disponible es el siguiente:

• Charlie Miller and Chris Valasek - Car Hacking for Poories
• Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell - Setup for Failure: Defeating SecureBoot
• Daniel Bilar - Scientific Best Practices for Recurrent Problems in Computer Security R&D
• Alfredo Ortega - Deep-Submicron Backdoor
• Adam Laurie - RFIDler
• Anton Sapozhnikov - Getting User Credentials is not only Admin's Privilege
• Joxean Koret - Breaking Antivirus Software
• Mathias Payer - Embracing the New Threat: Towards Automatically Self-Diversifying Malware
• Josh "m0nk" Thomas - How to Train your SnapDragon: Exploring Power Regulation Frameworks on Android
• Dr. Thaddeus (The) Grugq - Click and Dragger: Denial and Deception on Android Smartphones
• Alex Plaskett and Nick Walker - Navigating a sea of Pwn?: Windows Phone 8 AppSec
• Snare and Rzn - Thunderbolts and Lightning: Very Very Frightening
• Georg Wicherski - Linux Memory Forensics: A Real-Life Case Study

Tercera edición de HighSecCON




HighSecCON es un evento organizado por HighSec en el que se presentan charlas sobre cualquier tema relacionado con la seguridad.

El evento es completamente gratuito y sin ánimo de lucro, dónde cuyo único fin es seguir difundiendo conocimiento, experiencias y que los asistentes puedan conocer gente dentro del mundo de la seguridad. Además, el evento esta muy enfocado a difundir estos conocimientos dentro del mundo universitario. Éste se celebra en la Escuela Politécnica de la Universidad Autónoma de Madrid.

Vídeos de la 30c3



Durante el pasado fin de semana (viernes a lunes) se celebró en Alemania, Hamburgo la ya veterana CCC, Chaos Communication Congress, que celebraba su 30 edición. Como viene ocurriendo desde hace unos años, todas las charlas se emitían en vivo a través de internet e incluso podías seguirla por teléfono.

Si te perdiste alguna de las charlas o simplemente quieres volver a ver alguna de las que seguiste, ya puedes descargarte los vídeos. Además del sitio oficial, tienes otras alternativas como:

Presentaciones de OWASP AppSecUSA 2013



Otra de las remarcadas conferencias sobre seguridad informática, OWASP AppSecUSA 2013, fue celebrada en Nueva York del 18 al 21 de noviembre. Para los no privilegiados, aquí tenéis la lista de los vídeos (diapositivas con audio):

• OWASP Zed Attack Proxy - Simon Bennetts
• The Cavalry Is US: Protecting the public good - Josh Corman, Nicholas Percoco
• 2013 AppSec Guide and CISO Survey - Marco Morana, Tobias Gondrom
• Top Ten Proactive Controls - Jim Manico
• Forensic Investigations of Web Exploitations - Ondrej Krehel
• Big Data Intelligence - Ory Segal, Tsvika Klein
• All the network is a stage, and the APKs merely players - Daniel Peck
• BASHing iOS Applications - Jason Haddix, Dawn Isabel
• What You Didn't Know About XML External Entities Attacks - Timothy Morgan
• OWASP Hackademic - Konstantinos Papapanagiotou
• OWASP Periodic Table of Elements - James Landis
• Why is SCADA Security an Uphill Battle? - Amol Sarwate
• Making the Future Secure with Java - Milton Smith
• Tagging Your Code with a Useful Assurance Label - Robert Martin
• HTML5: Risky Business or Hidden Security Tool Chest? - Johannes Ullrich
• Thinking Differently About Security - Mary Ann Davidson
• The 2013 OWASP Top 10 - Dave Wichers
• PiOSoned POS - A Case Study in iOS based Mobile Point-of-Sale gone wrong - Mike Park
• Verify your software for security bugs - Simon Roses Femerling
• Insecure Expectations - Matt Konda
• Hacking Web Server Apps for iOS - Bruno Oliveira
• (Audio only) PANEL: Aim-Ready-Fire moderated by Wendy Nather
• AppSec at DevOps Speed and Portfolio Scale - Jeff Williams
• Application Security: Everything we know is wrong - Eoin Keary
• An Introduction to the Newest Addition to the OWASP Top 10 - Ryan Berg, Jeff Williams
• Mobile app analysis with Santoku Linux - Andrew Hoog
• Accidental Abyss: Data Leakage on The Internet - Kelly FitzGerald
• Mantra OS: Because The World is Cruel - Gregory Disney-Leugers
• (Audio only) Wassup MOM? Owning the Message Oriented Middleware - Gursev Singh Kalra
• Case Study: 10 Steps to Agile Development without Compromising Enterprise Security - Yair Rovek
• Contain Yourself: Building Secure Containers for Mobile Devices - Ron Gutierrez
• iOS Application Defense - iMAS - Gregg Ganley
• Pushing CSP to PROD - Brian Holyfield, Erik Larsson
• Leveraging OWASP in Open Source Projects - Aaron Weaver, David Ohsie, Bill Thompson
• HTTP Time Bandit - Vaagn Toukharian, Tigran Gevorgyan
• NIST - Missions and impacts to US industry, economy and citizens - James St. Pierre, Matthew Scholl
• Revenge of the Geeks: Hacking Fantasy Sports Sites - Dan Kuykendall
• Hack.me: a new way to learn web application security - Armando Romeo
• OWASP Broken Web Applications (OWASP BWA): Beyond 1.0 - Chuck Willis
• Can AppSec Training Really Make a Smarter Developer? - John Dickson
• The Perilous Future of Browser Security - Robert Hansen
• (Audio only) PANEL: Women in Information Security - moderated by Joan Goodchild
• (Audio only) Panel: Don't Tell Me Software Security - moderated by Mark Miller

Vídeos de la Øredev Developer Conference 2013



La Øredev Developer Conference es una conferencia orientada al desarrollo de software en general. Ésta se viene celebrando desde al año 2005 y la edición de este año 2013 se celebró del 4 al 8 de noviembre en Suecia. Aquí os dejo la lista de vídeos de las charlas que se dieron:

• Implementing Micro­Service Architectures (Fred George)
• Implementing Programmer Anarchy (Fred George)
• Git secrets (Brent Beer)
• Programming, Only Better (Bodil Stokke)
• Postgres: The Bits You Haven't Found Yet (Peter van Hardenberg)
• Why Kotlin? (Svetlana Isakova)
• Functional Groovy (Andres Almiray)
• Let's Stop Faking It (Michael Larsen)
• Designer, developer communication (Heidi Harman)
• Developer Designer Communication (Heidi Harman)
• Lightning Fast SQL with Proper Indexing (Markus Winand)
• Design for times 10 or times 100: How to handle hundreds of millions played games per day. (Lars Sjödin)
• Discovering Type Providers in F# 3.0 (Rachel Reese)
• The Creativity (R)Evolution (Denise Jacobs)
• Google Glass, an introduction for developers (Mattias Erlö)
• A Live hacking demo that will make you care more about securing your code! (Marcus Murray)
• What's new in Visual Studio 2013 for web developers (Mads Kristensen)
• Azure Mobile Service – The backend for the masses (Dag König)
• F# for trading (Phil Trelford)
• Windows: Having it's ass kicked by puppet and PowerShell since 2012 (Paul Stack)
• Concurrent Applications with F# Agents (Rachel Reese)
• Lean UX: Building products people want (Adrian Howard)
• Aesthetics and the Beauty of an Architecture: Adventures in CQRS and Event Sourcing (Tom Scott)
• Spring 4 on Java 8 (Juergen Hoeller)
• Java Mission Control: Flight Recorder Deep Dive (Marcus Hirt)
• RRRADDD! Ridiculously rapid domain-driven (and restful) apps with Apache Isis (Dan Haywood)
• Refactor your specs! (Cyrille Martraire)
• Windows Phone 8 SDK: Beyond the Basics with Wallet, In-App Purchasing and Maps. (Michael Crump)
• Coding Tips and Tricks I Learned from Making Some of the Biggest Apps Out There (Atley Hunter)
• Symbiotic relationships between testing and analytics (Julian Harty)
• "Do it yourself"...Custom JavaFX Controls (Gerrit Grunwald)
• Cloud Infrastructure as Code (Henrik Lindberg)
• Developers Can't Design (And Other Completely Untrue Design Myths) (Jen Myers)
• Introduction to the Play Framework (James Ward)
• The next version of JavaScript: ES6 on the frontend, in the real world (John K. Paul)
• Effective Node.js Programming and Module Creation (Jed Wood)
• Unconventional promises - using promises for the kitchen sink, and control flow nivana (John K. Paul)
• Breakout - of the tiles (Håkan Reis)
• No Estimates: Let's explore the possibilities (Roy "Woody" Zuill)
• Security Avalanche – understanding today’s modern protocols (Michele Leroux Bustamante)
• Firefox OS - the platform HTML5 deserves (Christian Heilmann)
• Data visualization, infographics and big open data (Steen Lehmann)
• Regression Obsession (Michael Bolton)
• Advanced Android App Architectures + Lifecycles (Bryan Costanich)
• Balancing ATDD, GUI Automation and Exploratory Testing (Michael Larsen)
• An Artistic Science Approach to Analysis and Reporting Performance Data (Scott Barber)
• Practical Tools for Playing Well with Others (J. B. Rainsberger)
• Being Secure on a Mobile Platform (Siren Hofvander)
• Open APIs - risks and rewards (Andreas Krohn)
• Adopting Continuous Delivery (Jez Humble)
• Heuristics of Testability (James Bach)
• Art & code with XKCD (Randall Munroe)
• The Art of Ruby on Rails (Steve Klabnik)
• Gradle for Android and the rest of the world (Luke Daley)
• ZeroMQ – A Whole Bunch of Awesome [C# Edition] (Ashic Mahtab)
• HTML5 Hacks (Jesse Cravens)
• An Open Source Grid-Based Actor Model (Vaughn Vernon)
• Efficient Android Threading (Anders Göransson)
• Windows Phone 100+ Apps In – What I have Learned (Atley Hunter)
• Livin on the edge: Netflix edge architecture (Adrian Cole)
• C# Cross Platform Mobile with Xamarin (Bryan Costanich)
• F# for C# developers (Phil Trelford)
• Hands On with Clojure (Bodil Stokke)
• Windows Phone 8- the advanced session for the creative child at heart (Iris Classon)
• Functional Principles for Object-Oriented Developers (Jessica Kerr)
• Lightning introduction to three NoSQL technologies (Joel Jacobson)
• 30 NuGet Packages in 50 Minutes (Shay Friedman)
• if (BetterConcurrency == BetterPerformance) { ... (Kirk Pepperdine)
• Modern Component Design with Spring (Juergen Hoeller)
• How To Structure Your JavaEE 7 App (Adam Bien)
• Unlocking the Java EE Platform with HTML5 (Geertjan Wielenga)
• Agile Lightning Talks (J. B. Rainsberger)
• So What About Tablets? (Richard Campbell)
• Enterprise git collaboration patterns (Brent Beer)
• Tracking and Improving Software Quality with Sonar (Patroklos Papapetrou)
• Scaling mobile development at Spotify (Per Eckerdal)
• Less is more! - when it comes to art and software (Jimmy Nilsson)
• Code as a crime scene (Adam Petersen Tornhill)
• Managing Asynchronicity with RQ (Douglas Crockford)
• Shakespeare in Dev (Thomas Q Brady)
• The future of Java in the grander scheme of things (Tomas Nilsson)
• Habits of a Responsible Programmer (Anders Janmyr)
• Go To There and Back Again (Douglas Crockford)
• Entity Framework in Core-Business Applications that Leverage DDD (Julie Lerman)
• Building Secure and Social Applications (Michele Leroux Bustamante)
• Distributed teams - a pragmatic way (Björn Granvik)
• Building Reactive Apps with Play Framework, Akka, and Scala (James Ward)
• Layers Considered Harmful (Christian Horsdal)
• Ubuntu, a potent new force in mobile (David Planella)
• Release your creativity - join OpenJDK (Cecilia Borg)
• The Curious Case of JavaScript on the JVM (Attila Szegedi)
• Data @ King - How we are able analyze 100M DAU (Mats-Olov Eriksson)
• Being Lean in the Cloud: Continuous Deployment with Amazon Web Services (Martin Elwin)
• tekhnasthai (Anna Beatrice Scott)
• The Third Wave of Artfulness in Code (Matthew McCullough)
• Does Pair Programming Have to Suck? (Angela Harms)
• Mob Programming, A Whole Team Approach (Roy "Woody" Zuill)
• The Art of Learning and Mentoring (Jutta Eckstein)
• Rebranding Agile: How Marketers are Changing the Way they Work for Real-time World (Frank Days)
• Extreme Personal Finance (J. B. Rainsberger)
• New Frontiers For In-House Legal Practice (Kate Sullivan)
• The Art of Building Tools - A Language Engineering Perspective (Markus Voelter)
• Have You Seen Spring Lately? (Joshua Long)
• Go Beyond "Debug": Wire Tap your App for Knowledge with Hadoop (Oleg Zhurakousky)
• ElasticSearch - Distributed search on BigData made easy (Itamar Syn-Hershko)
• The very near future of a richer, standards based web (Christian Heilmann)
• Taking a PaaS on the Hard Stuff with Cloud Foundry (Joshua Long)
• Building End to End Web App Using TypeScript (Gil Fink)
• Building Web Applications with Ember.js and Ruby On Rails (Jesse Cravens)
• The Art of Ruby (Steve Klabnik)
• What's New in JAX-RS 2 (Reza Rahman)
• What is new in XAML for Windows 8.1 (Tess Ferrandez)
• Android Design: Beyond the Guidelines - Creating character and identity in your applications (Kevin Grant)
• NodeJS: the good parts? A skeptic’s view (Chris Richardson)
• Crafted Technology and Experiences (Petra Sundström)

Vídeos de la Black Hat USA 2013

Pues eso, más vídeos, estos son los de la pasada Black Hat celebrada en las Vegas:

• Spy-jacking the Booters
• Hacking, Surveiling, and Deceiving Victims on Smart TV
• Tribute to Barnaby Jack
• Stepping p3wns: Adventures in Full Spectrum Embedded Exploitation
• The Factoring Dead: Preparing for Cyptopocalypse
• Mactans: Injecting Malware Into iOS Devices via Malicious Chargers
• Let's Get Physical: Breaking Home Security Systems and Bypassing Building Controls
• Million Browser Botnet
• Evading Deep Inspection for Fun and Shell
• Exploiting Network Surveillance Cameras Like a Hollywood Hacker
• Owning the Routing Table - Part II
• How to Build a SpyPhone
• What's on the Wire? - Physical Layer Tapping with Project Daisho
• Just-In-Time Code Reuse: The More Things Change, the More They Stay the Same
• BIOS Security
• TOR... ALL-THE-THINGS!
• Truncating TLS Connections to Violate Beliefs in Web Applications
• Rooting SIM Cards
• Fully Arbitrary 802.3 Packet Injection: Maximizing Ethernet Attack Surface
• Revealing Embedded Fingerprints: Deriving intelligence from USB stack interactions
• Funderbolt: Adventures in Thunderbolt DMA Attacks
• RFID Hacking: Live Free or RFID Hard
• Home Invasion v2.0 - Attacking Network-Controlled Hardware
• Beyond the Application: Cellular Privacy Regulatory Space
• Legal Considerations for Cellular Research
• A Tale of One Software Bypass of Windows 8 Secure Boot
• I Can Hear You Now: Traffic Interception and Remote Mobile Phone Cloning...
• Buying into the Bias: Why Vulnerability Statistics Suck
• How CVSS is DOSsing Your Patching Policy (and wasting your money)
• Bluetooth Smart: The Good, the Bad, the Ugly, and the Fix!
• UART THOU MAD?
• Press ROOT to Continue: Detecting OSX and Windows Bootkits with RDFU
• SSL, Gone in 30 Seconds - A BREACH beyond CRIME
• Multiplexed Wired Attack Surfaces
• Java Every-Days: Exploiting Software Running on Three Billion Devices
• TLS 'SECRETS'
• Lawful Access Panel
• Clickjacking Revisted: A Perceptual View of UI Security
• OPSEC Failures of Spies
• Hiding @ Depth - Exploring, Subverting, and Breaking NAND Flash Memory
• Honey, I'm Home!! - Hacking Z-Wave Home Automation Systems
• Android: One Root to Own them All
• Abusing Web APIs Through Scripted Android Applications
• Big Data for Web Application Security
• Dissecting CSRF Attacks and Countermeasures
• Above My Pay Grade: Cyber Response at the National Level
• Virtual Deobfuscator - A DARPA Cyber Fast Track Funded Effort
• Teridian SoC Exploitation: Exploration of Harvard Architecture Smart Grid Systems
• New Trends in FastFlux Networks
• CrowdSource: Open Source Crowd Trained Machine Learning Model for Malware Detection
• Denying Service to DDoS Protection Services
• Denial of Service as a Service - Asymmetrical Warfare at its Finest
• Universal DDoS Mitigation Bypass
• Untwining Twine
• Detecting Vulnerabilities in Virtual Devices with Conformance Testing
• Smashing the Font Scaler Engine in Windows Kernel
• The SCADA That Didn't Cry Wolf - Who's Really Attacking Your ICS Devices - 2/2
• Hunting the Shadows: In-Depth Analysis of Escalated APT Attacks
• The Outer Limits: Hacking The Samsung Smart TV
• Out of Control: Demonstrating SCADA Device Exploitation
• Compromising Industrial Facilities from 40 Miles Away
• Hacking Like in the Movies: Visualizing Page Tables for Local Exploitation
• PWNIE AWARDS
• Welcome & Introduction to Black Hat USA 2013
• Mainframes: The Past Will Come to Haunt You
• Black-box Assessment of Pseudorandom Algorithms
• End-to-end Analysis of Domain Generating Algorithm Malware Family
• Javascript Static Security Analysis Made Easy with JSPrime
• The Web IS Vulnerable: XSS Defense on the BattleFront
• Malicious File for Exploiting Forensic Software
• CMX: IEEE Clean File Metadata Exchange
• Mobile Malware: Why the Traditional AV Paradigm is Doomed
• Bochspwn: Identifying 0-Days via System-Wide Memory Access Pattern Analysis
• Using Online Activity as Digital DNA to Create a Better Spear Phisher
• CreepyDOL: Cheap, Distributed Stalking
• OptiROP: The Art of Hunting ROP Gadgets
• BlackberryOS 10 From a Security Perspective
• Shattering Illusions in Lock-Free Worlds: Compiler/Hardware Behaviors in OS and VMs
• Password Hashing: The Future is Now
• Pass the Hash and other credential theft and reuse: Preventing Lateral Movement...
• How to grow a TREE (Taint-Enabled Reverse Engineering Environment) from a CBASS...
• Predicting Susceptibility to Socialbots on Twitter
• Pass-the-Hash 2: The Admin's Revenge
• Energy Fraud and Orchestrated Blackouts: Issues with Wireless Metering Protocols...
• Hot Knives Through Butter: Bypassing Automated Analysis Systems
• Post Eploitation Operations with Cloud Synchronization
• Defending Networks With Incomplete Information: A Machine Learning Approach
• With BIGDATA comes BIG responsibility: Practical exploiting of MDX injections
• Power Analysis Attacks for Cheapskates
• Fact and Fiction: Defending Medical Device
• Maltego Tungsten As a Collaborative Attack Platform
• BinaryPig - Scalable Malware Analytics in Hadoop

Vídeos de la Defcon 21



Ya están disponibles a través de Youtube los vídeos de la pasada edición de Defcon.

• Proliferation
• Torturing Open Government Systems for Fun, Profit and Time Travel
• Backdoors, Government Hacking and The Next Crypto Wars
• ACL Steganography - Permissions to Hide Your Porn
• Protecting Data with Short-Lived Encryption Keys and Hardware Root of Trust
• Google TV or: How I Learned to Stop Worrying and Exploit Secure Boot
• A Password is Not Enough: Why Disk Encryption is Broken and How We Might Fix It
• From Nukes to Cyber— Alternative Approaches for Proactive Defense and Mission Assurance
• The Politics of Privacy and Technology: Fighting an Uphill Battle
• Defeating Internet Censorship with Dust, the Polymorphic Protocol Engine
• Privacy In DSRC Connected Vehicles
• Phantom Network Surveillance UAV / Drone
• Safety of Tor Network Look at Network Diversity, Relay Operators & Malicious Relays
• De-Anonymizing Alt.Anonymous. Messages
• The DEF CON 21 Badge
• The Growing Irrelevance of US Government Cybersecurity Intelligence Information
• The Dirty South - Getting Justified with Technology
• Prowling Peer-to-Peer Botnets After Dark
• Evil DoS Attacks and Strong Defenses
• Kill 'em All— DDoS Protection Total Annihilation!
• VoIP Wars: Return of the SIP
• Unexpected Stories - From a Hacker Who Made It Inside the Government
• Dude, WTF in my car?
• The Road Less Surreptitiously Traveled
• Home Invasion 2.0 - Attacking Network-Controlled Consumer Devices
• RFID Hacking: Live Free or RFID Hard
• Stalking a City for Fun and Frivolity
• Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks
• BYO-Disaster and Why Corporate Wireless Security Still Sucks
• The Cavalry Isn't Coming: Starting the Revolution to Fsck it All!
• The Dark Arts of OSINT
• EMET 4.0 PKI Mitigation
• Stepping P3wns: Adventures in Full Spectrum Embedded Exploitation (and defense!)
• EDS: Exploitation Detection System
• Conducting Massive Attacks with Open Source Distributed Computing
• Revealing Embedded Fingerprints: Deriving Intelligence from USB Stack Interactions
• Traffic Interception and Remote Mobile Phone Cloning with a Compromised CDMA Femtocell
• The Secret Life of SIM Cards
• DragonLady: An Investigation of SMS Fraud Operations in Russia
• Offensive Forensics: CSI for the Bad Guy
• Pwn'ing Your® Cyber Offenders
• MITM All The IPv6 Things
• HTTP Time Bandit
• How to use CSP to Stop XSS
• So You think Your Domain Controller is Secure?
• Getting The Goods With smbexec
• Abusing NoSQL Databases
• Examining the Bitsquatting Attack Surface
• Please Insert Inject More Coins
• Do-It-Yourself Cellular IDS
• BoutiqueKit: Playing WarGames with Expensive Rootkits and Malware
• Android WebLogin: Google's Skeleton Key
• Building an Android IDS on Network Level
• Defeating SEAndroid
• Doing Bad Things to "Good" Security Appliances
• Electromechanical PIN Cracking with Robotic Reconfigurable Button Basher (and C3BO)
• Data Evaporation from SSDs
• GoPro or GTFO: A Tale of Reversing an Embedded System
• JTAGulator: Assisted Discovery of On-Chip Debug Interfaces
• gitDigger: Creating useful wordlists from public GitHub repositories
• Made Open: Hacking Capitalism
• The Dawn of Web 3.0: Website Mapping and Vulnerability Scanning in 3D
• Combatting Mac OSX/iOS Malware with Data Visualization
• A Thorny Piece of Malware (And Me): The Nastiness of SHE, VFTables & Multi-Threading
• Transcending Cloud Limitations by Obtaining Inner Piece
• Utilizing Popular Websites for Malicious Purposes Using RDI
• Open Public Sensors, Trend Monitoring and Data Fusion
• Collaborative Penetration Testing With Lair
• PowerPwning: Post-Exploiting By Overpowering PowerShell
• Evolving Exploits Through Genetic Algorithms
• Adventures in Automotive Networks and Control Units
• Hacking Driverless Vehicles
• 10000 Yen into the Sea
• Business Logic Flaws In Mobile Operators Services
• Meet the VCs
• The ACLU Presents: NSA Surveillance and More
• The Government and UFOs: A Historical Analysis
• How my Botnet Purchased Millions of Dollars in Cars and Defeated the Russian Hackers
• Fear the Evil FOCA: IPv6 attacks in Internet Connections
• Legal Aspects of Full Spectrum Computer Network (Active) Defense
• We are Legion: Pentesting with an Army of Low-power Low-cost Devices
• Pwn The Pwn Plug: Analyzing and Counter-Attacking Attacker-Implanted Devices
• DC Awards
• PowerPreter: Post Exploitation Like a Boss
• DNS May Be Hazardous to Your Health
• Exploiting Music Streaming with JavaScript
• Java Every-Days: Exploiting Software Running on 3 Billion Devices
• HiveMind: Distributed File Storage Using JavaScript Bonets
• Defending Networks with Incomplete Information: A Machine Learning Approach
• Blucat: Netcat For Bluetooth
• BYOD PEAP Show
• Closing Ceremonies
• All Your RFz Are Belong to Me - Hacking the Wireless World with Software Defined Radio
• Making Of The DEF CON Documentary
• Ask the EFF: The Year in Digital Civil Liberties
• Decapping Chips The Strike Easy Hard Way
• Insecurity - A Failure of Imagination
• Key Decoding and Duplication Attacks for the Schlage Primus High-Security Lock
• DEF CON Comedy Jam Part VI, Return of the Fail
• Hardware Hacking with Microcontrollers: A Panel Discussion
• An Open Letter The White Hat's Dilemma
• Suicide Risk Assessment and Intervention Tactics
• OTP, It won't save you from free rides!
• How to Disclose or Sell an Exploit Without Getting in Trouble
• Defense by numbers: Making Problems for Script Kiddies and Scanner Monkeys
• Social Engineering: The Gentleman Thief
• This Presentation Will Self-Destruct in 45 Minutes
• Fast Forensics Using Simple Statistics and Cool Tools
• Forensic Fails - Shift + Delete Won't Help You Here
• C.R.E.A.M. Cache Rules Evidently Ambiguous, Misunderstood

Material de la Zero Nights 2013



Disponible el material de las presentaciones dadas en la conferencia rusa Zero Nights 2013:

• Endpoint security via application sandboxing and virtualization — past, present, future
• State of Crypto Affairs
• Practical exploitation of rounding vulnerabilities in internet banking applications
• The Machines that Betrayed their Masters
• Virtually Impossible: The Reality Of Virtualization Security
• DbiFuzz framework
• Windows Kernel Trap Handler and NTVDM Vulnerabilities — Case Study
• IP fragmentation attack on DNS
• HART (in)security
• Exploitation of AVR & MSP microchips
• Filesystem timing attacks practice
• Strike to the infrastructure: a story about analyzing thousands mobile apps
• SCADA deep inside: protocols, security mechanisms, software architecture
• Anatomy and metrology of DoS/DDoS
• TOPGUN multi terabit DPI
• Timing analysis
• An introduction to the use SMT solvers for software security
• BlackBox analysis of iOS apps
• Hacking HTML5
• Physical (In)Security — it’s not –ALL– about Cyber
• Advanced exploitation of Android Master Key Vulnerability (bug 8219321)
• HexRaysCodeXplorer: make object-oriented RE easier
• Practical application of math methods and image recognition in attack detection. With novel case studies :)
• Web under pressure: DDoS as a service
• Hosting dashboard web application logic vulnerabilities
• Session management errors in cloud solutions and in classic hosting systems
• Hesperbot: analysis of a new banking trojan
• NGINX Warhead
• Testing of password policy
• Accounting hacking — arch bugs in MS Dynamics GP
• HR Hacking — bugs in PeopleSoft
• DBO Hacking — arch bugs in BSS
• Business Intelligence hacking – Breaking ICCube
• Dev system hacking — arch bugs in SAP SDM

Presentaciones de la Hack.Lu 2013



Ya están disponibles las diapositivas de la Hack.Lu 2013 celebrada del 22-24 de octubre en Luxemburgo:

• Thijs Houtenbos, Dennis Pellikaan - Automated vulnerability scanning and exploitation
• Jurriaan Bremer - Abusing Dalvik Beyond Recognition
• J. Butterworth, C. Kallenberg, X. Kovah - BIOS Chronomancy: Fixing the Core Root of Trust for Measurement
• Fran Cisco - Wiretapping an entire Cisco VOIP environment - Exploiting the Call Manager
• Abstract
• Philippe Teuwen - Unveiling online banking authentication devices
• Sebastien Larinier, Guillaume Arcas - Exploit Krawler Framework PCAP2Bubbles
• J. Boutet, T. Leclerc - Grand Theft Android: Phishing with permission
• Fyodor Yarochkin and Vladimir Kropotov - Pearls of Cybercrime: malicious campaigns of year 2013
• Shift - Interactive Deobfuscation
• Marion Marschalek - The Big Evil in Small Pieces - A Malware Reverser's Fairytale
• Dominique Bongard - Deanonymizing members of French political forums by breaking gravatar hashes
• David Szili, Mihaly Zagon - Time to evolve? Applying red and blue team CTF tactics in IT security
• Cédric Halbronn, Nicolas Hureau - Debugging and Reversing the HTC Android Bootloader
• Axelle Apvrille - Playing Hide and Seek with Dalvik Executables
• Francisco Falcon, Nahuel RIva - Do you know who's watching you?: An in-depth examination of IP cameras attack surface
• Mathias Morbitzer - TCP Idle Scans in IPv6
• Banque Öhman - Defensive strategies

Presentaciones de Ruxcon 2013



Ya tenemos disponibles las presentaciones (diapositivas) de Ruxcon 2103, conferencia sobre seguridad informática celebrada anualmente en Melbourne, Australia.

• Amateur Satellite Intelligence: Watching North Korea
• Payment Applications Handle Lots of Money. No, Really: Lots Of It.
• Visualization For Reverse Engineering and Forensics
• Electronic Voting Security, Privacy and Verifiability
• Cracking and Analyzing Apple iCloud Protocols: iCloud Backups, Find My iPhone, Document Storage
• Buried by time, dust and BeEF
• Under the Hood Of Your Password Generator
• Malware, Sandboxing and You: How Enterprise Malware and 0day Detection is About To Fail (Again)
• VoIP Wars: Return of the SIP
• BIOS Chronomancy: Fixing the Static Root of Trust for Measurement
• The BYOD PEAP Show: Mobile Devices Bare Auth
• Bypassing Content-Security-Policy
• Deus Ex Concolica - Explorations in end-to-end automated binary exploitation
• Top of the Pops: How to top the charts with zero melodic talent and a few friendly computers
• AntiTraintDroid - Escaping Taint Analysis on Android for Fun and Profit
• Introspy : Security Profiling for Blackbox iOS and Android
• Inside Story Of Internet Banking: Reversing The Secrets Of Banking Malware
• Edward Snowden: It's Complicated
• Roll the Dice and Take Your Chances
• Cracking, CUDA and the Cloud – Cracking Passwords Has Never Been So Simple, Fast and Cheap

Material de la Ekoparty 2013




Ya podemos descargarnos y ver las presentaciones de la Ekoparty 2013. Conferencia sobre seguridad informática de primer nivel.

Ekoparty se organiza cada año en Buenos Aires, Argentina.

• Droid Rage: Android exploitation on steroids - Pablo Solé - PDF - Video
• Modification to the Android operating system´s resource control - Joaquín Rinaudo - ZIP - Video
• Compromising industrial facilities from 40 miles away - Carlos Mario Penagos - PDF - PDF - Video
• Atacando IPv6 con Evil FOCA - Chema Alonso - PPT - Video
• String allocations in Internet Explorer - Chris Valasek - PPT - Video
• Compilador ROP - Christian Heitman - PDF - Video
• BIOS Chronomancy - Corey Kallenberg - PPT - Video
• Defeating Signed BIOS Enforcement - Corey Kallenberg - PPT - Video
• ERP Security: how hackers can open the box and take the jewels - Jordan Santasieri - PDF - Video
• Shoulder surfing 2.0 - Federico Pacheco - PPT - Video
• A symbolic execution engine for amd64 binaries - Felipe Manzano - PDF - Video
• Do you know who is watching you? - Nahuel Riva - PPT - Video
• Ahí va el capitán Beto por el espacio - Gera Richarte - PDF - Video
• Vote early and vote often - Harri Hursti - PDF - Video
• Sandboxing Linux code to mitigate exploiattion - Jorge Lucangeli Obes - PDF - Video
• All your sextapes are belong to us - Patricio Palladino - tgz - Video
• Debbugers are really powerful - Pwning all of the Android things - Mathew Rowley - PDF - Video
• Wighing in on issues with "Cloud Scale": Hacking the Withings WS-30 - Michael Coppola - PDF - Video
• Sentinel - Nicolás Economou - PDF - Video
• Uncovering your trails. Privacy issues of Bluetooth devices - Verónica Valeros - PDF - Video
• A mystery trip to the origin of Bitcoin - Sergio Demián Lerner - PDF - Video

Presentaciones de la Virus Bulletin 2013



El pasado 2 - 4 de octubre se celebró en Berlín otra conferencia sobre seguridad informática enfocada más al tema del malware: VB2013 - Virus Bulletin 2013 (no, no es Visual Basic!). Esta es la 23 edición de esta conferencia.

Las presentaciones que se dieron ya están disponibles para descarga. La lista es la siguiente

Corporate stream

• Andreas Lindh ('Surviving 0-days - reducing the window of exposure')
• Sabina Datcu ('Targeted social engineering attacks. Sensitive information, from a theoretical concept to a culturally defined notion')
• Michael Johnson ('Make it tight, protect with might, and try not to hurt anyone')
• Randy Abrams & Ilya Rabinovich ('Windows 8 SmartScreen application control - what more could you ask for?')
• Axelle Apvrille ('Analysis of Android in-app advertisement kits')
• Vanja Svajcer ('Classifying PUAs in the mobile environment')
• Roman Unuchek ('Malicious redirection of mobile users')
• Craig Schmugar ('Real-world testing, the good, the bad, and the ugly')
• Ciprian Oprisa & George Cabau ('The ransomware strikes back')
• Jarno Niemela ('Statistically effective protection against APT attacks')
• Sergey Golovanov ('Hacking Team and Gamma International in "business-to-government malware"')

Technical stream

• Carsten Willems & Ralf Hund ('Hypervisor-based, hardware-assisted system monitoring')
• James Wyke ('Back channels and bitcoins: ZeroAccess' secret C&C communications')
• Xinran Wang ('An automatic analysis and detection tool for Java exploits')
• Rowland Yu ('GinMaster: a case study in Android malware')
• Samir Mody ('"I am not the D'r.0,1d you are looking for": an analysis of Android malware obfuscation')
• Farrukh Shazad ('The Droid Knight: a silent guardian for the Android kernel, hunting for rogue smartphone malware applications')
• Fabio Assolini ('PAC - the Problem Auto-Config (or "how to steal bank accounts with a 1KB file")')
• Samir Patil ('Deciphering and mitigating Blackhole spam from email-borne threats')
• Evgeny Sidorov ('Embedding malware on websites using executable webserver files')
• Amr Thabet ('Security research and development framework')

'Last-minute' technical papers

• Gabor Szappanos ('Hide and seek - how targeted attacks hide behind clean applications')
• Ross Gibb ('Lessons learned: sinkholing a peer-to-peer botnet')
• Dennis Batchelder & Hong Jia ('Working together to defeat attacks against AV automation')

Presentaciones de la HITBSECCONF Malaysia 2013



Las presentaciones de la Hack In The Box Security Conference (HITBSECCONF) 2013 celebrada en Malasia han sido publicadas.

Las lista de las diapositivas es la siguiente:

• D1 KEYNOTE - Andy Ellis - Cognitive Injection.pdf
• D1T1 - Collin Mulliner - Android DDI - Dynamic Dalvik Instrumentation of Android Applications.pdf
• D1T1 - Dominic Chell and Shaun Colley - Practical Attacks Against Encrypted VoIP Communications.pdf
• D1T1 - Gianni Gnesa - Hacking Corporations Using Unconventional Chained Exploits.pdf
• D1T1 - Kallenberg, Kovah, Butterworth - Defeating Signed BIOS Enforcement.pdf
• D1T1 - Marco Balduzzi, Kyle Wilhoit Alessandro Pasta - Attacking Vessel Tracking Systems for Fun and Profit.pdf
• D1T1 - Peter 'bl4sty' Geissler - Demystifying Game Console Security.pdf
• D1T2 - Adam Laurie - RFIDler - Software Defined RFID Reader Writer Emulator.pdf
• D1T2 - Andy Davis - Deriving Intelligence from USB Stack Interactions.pdf
• D1T2 - Francisco - Owning a Cisco VoIP Environment.pdf
• D1T2 - Joaquim Espinhara and Ulisses Alburquerque - Using Online Activity as Digital DNA.pdf
• D1T2 - Mariano Graziano and Andrea Lanzi - How Actaeon Unveils Your Hypervisor.pdf
• D1T2 - Mathias Morbitzer - TCP Idle Scans in IPv6.pdf
• D1T3 - Cem Gurkok - Hunting for OS X Rootkits in Memory.pdf
• D1T3 - Mike Shema - CSRF Lab.pdf
• D1T3 - Wes Brown - Malware Analysis Using Visualization.pdf
• D1T3 BONUS TALK - Marc Rogers - Why I Hacked TouchID and Still Think It's Awesome.pdf
• D2 KEYNOTE - Joe Sullivan - Bringing Social to Security - NO SLIDES.pdf
• D2T1 - Cyril 'pod2g' Cattiaux and GG - How Apple Can Read Your iMessages.pdf
• D2T1 - Hugo Teso - Digging Deeper Into Aviation Security.pdf
• D2T1 - James Forshaw - Exploiting XML Digital Signature Implementations.pdf
• D2T1 - Joshua 'p0sixninja' Hill - SHAttered Dreams.pdf
• D2T1 - Mark Vincent Yason - Diving Into IE10's Enhanced Protected Mode Sandbox.pdf
• D2T2 - Rahul Sasi - Static Analysis and Dynamic Instrumentation for Intelligent Exploit Analysis.pdf
• D2T2 - Stefan Esser - Tales from iOS 6 Exploitation and iOS 7 Security Changes.pdf
• D2T2 - Stefano Zanero - Tracking and Characterizing Botnets Using Automatically Generated Domains.pdf
• D2T2 - Victor van der Veen - A Fast and Complete Android Method Tracer.pdf
• D2T2 - Vladimir Katalov - Cracking and Analyzing Apple's iCloud Protocol.pdf
• D2T3 - Ashar Javad - Trusted Friend Attack.pdf
• D2T3 - Eric Michaud and Ryan Lackey - Thwarting Evil Maid Attacks.pdf
• D2T3 - Job de Haas - 20 Ways Past Secure Boot.pdf
• D2T3 - Keith Lee and Jonathan Werrett - Facebook OSINT.pdf
• D2T3 - Luiz Eduardo and Joaquim Espinhara - Lost in Translation.pdf

Vídeos de la LinuxCon North America 2013



Desde el canal de Youtube de la Linux Foundation, ya podemos ver todos los vídeos de las charlas de la LinuxCon 2013 celebrada en Nueva Orleans el pasado mes de septiembre. Aquí tenéis la lista:

• Integrated Trace_ Using Virtio-Trace for a Virtualization Environment - Yoshihiro Yunomae, Hitachi
• Collab. GPL Compliance Through Non-Profit Entities - Bradley M. Kuhn, Software Freedom Conservancy
• Raspberry Pi: Getting Started and Creative Applications - Ruth Suehle, Red Hat
• Storage: Pulling Together Management Across the Cloud and Bare Metal - Ric Wheeler, Red Hat
• Stop Touching My Kernel Code! - Sasha Levin, Oracle
• Tux3 Progress Report: Towards a New General Purpose Filesystem for Linux - Daniel Phillips, Samsung
• Efficient Memory Management on Mobile Devices - Bartlomiej Zolnierkiewicz, Samsung
• Namespaces for Security - Jake Edge, LWN.net
• Successful Development Begins with the Heart of the Device - Leon Farasati, Qualcomm
• Intel MIC Coprocessor Driver, on the Frontiers of Linux & HPC - Nikhil Rao, Intel OTC
• Power Capping Linux - Srinivas Pandruvada, Intel
• Kernel CI Using Linaro's Automated Validation Architecture - Tyler Baker, Linaro
• Enabling Mobile Payments on Linux - Samuel Ortiz, Intel
• Improving Guest Management via the QEMU Guest Agent - Michael Roth, IBM
• UEFI and Linux - Kirk Bresniker, HP
• Why btrfs is the Bread and Butter of Filesystems - Matthias Eckermann, SUSE
• Integrated Trace' Using Virtio-Trace for a Virtualization Environment - Yoshihiro Yunomae, Hitachi
• CRIU: Time and Space Travel Service for Linux Applications - Pavel Emelyanov, Parallels
• Better Utilization of Storage Features From KVM Guests Via Virtio-Scsi - Masaki Kimura, Hitachi
• Xen Orchestra (XAPI and XenServer from the web) - Olivier Lambert, Vates
• Free yourself from the tyranny of your cloud provider! - Greg Kroah-Hartman, The Linux Foundation
• Bringing Xen dom0 to CentOS-6 - Karanbir Singh, CentOS Project
• ARM Servers and Xen -- Hypervisor Support at Hyperscale - Larry Wikelius, Calxeda
• Xen, XenServer, and XAPI: What's the Difference? - James Bulpin and Russell Pavlicek, Citrix Systems
• TripleO: OpenStack on OpenStack - Monty Taylor, HP
• Will Parallel Programming Ever Become Routine? - Paul E. McKenney, IBM
• OpenStack/Quantum SDN-Based Network Virtualization with Ryu - Kei Ohmura, NTT
• Modern Linux Servers with cgroups - Brandon Philips, CoreOS
• OpenStack and jclouds in the Evolving App Landscape - Rags Srinivas, Rackspace
• Building Web Scale Using Open Source on the Internet Assembly Line - Thomas Hatch, SaltStack
• Compositing for Free—Reducing Copies on the Desktop - Keith Packard, Intel
• QEMU 2.x and Beyond: The Foundation of the Open Cloud - Anthony Liguori
• Culture, Code, Community and Conway: Lessons from OpenStack - Joshua McKenty, Piston Cloud
• Building IaaS wit Apache CloudStack - David Nalley, Apache
• Bluetooth Smart Devices and Low Energy Support on Linux - João Paulo Rechi Vita, INdT
• Linux Transparent Memory Compression - Seth Jennings, IBM
• OpenStack Performance & Scale - Mark Wagner, Red Hat
• DistCI, Continuous Integration at Scale - Heikki Nousiainen, F-Secure
• LLVMLinux: The Linux Kernel with Dragon Wings - Behan Webster, Converse in Code Inc.
• Transforming XenServer Into a Proper Open-Source Project - James Bulpin, Citrix
• Converged Infrastrucure with Open Source - Theron Conrey, Red Hat
• Automating Cloud Testing and Deployment with Deploy - Kay Williams, Deploy Project
• Xen: This Is Not Your Dad's Hypervisor! - Demetrious Coulis, Sr Prin. Product Mgr, CA Technologies
• Xen for Beginners - Bryan Smith, Tacit Labs, Inc.
• Network Multi-tenancy in Xen-based Clouds - Chiradeep Vittal, Citrix Systems
• Building the Rackspace Open Cloud with XenServer and OpenStack -Paul Voccio, Rackspace
• Ceph, Xen, and CloudStack: Semper Melior - Patrick McGarry
• Welcome and Introduction - Xen Project User Summit
• Xen User Summit - Navis Lighthouse Security Audit Appliance - Grant McWilliams, Coalfire Systems
• LinuxCon and CloudOpen 2013: Developers, The New Superpower - Jonathan Bryce, OpenStack
• LinuxCon & CloudOpen North America 2013 - New Frontiers - Dirk Hohndel, Intel
• LinuxCon & CloudOpen North America 2013 - Linux Kernel Panel
• Test Your Linux Trivia Knowledge, Live from LinuxCon and CloudOpen in New Orleans
• LinuxCon & CloudOpen North America - Before I Die - Candy Chang
• LinuxCon & CloudOpen North America 2013 - Linux & Gaming - Gabe Newell, Valve
• LinuxCon & CloudOpen North America 2013 - The Technium - Kevin Kelly
• Linux, Cloud, and Next Generation Workloads - Brad McCredie, IBM
• LinuxCon & CloudOpen North America 2013 - Open Matters: HP & OpenStack - Brian Aker, HP
• What Five Years of Android Has Meant - Chris DiBona, Google
• LinuxCon & CloudOpen North America 2013 - Shiny New Toys - Eben Upton, Raspberry Pi
• LinuxCon & CloudOpen North America 2013 - State of Linux - Jim Zemlin, The Linux Foundation

Vídeos de la BruCON 0x05 (2013)



Otra serie de vídeos sobre seguridad informática. Estos son de la edición 2013 de BruCON 0x05.

• Devops Panel (part 2)
• Lightning Talks Session #1
• David Mortman's Keynote
• David Perez, Jose Pico - Geolocation of GSM mobile devices
• Russ Gideon - Paint by Numbers vs. Monet
• Robert Graham - Data-plane networking
• Dan Guido's Keynote
• Stephan Chenette - Building Custom Android Malware for Penetration Testing
• Jake Valletta - CobraDroid
• TB. Henriques, T. Martins, J. Gouveia - Realtime analysis and visualization of ...
• Devops Panel
• Aloria - .NET: The Framework, the Myth, the Legend
• Erin Jacobs, Zack Fasel - Taking the BDSM out of PCI-DSS through open-source solutions
• Amelia Andersdotter's keynote
• Vaagn Toukharian - HTTP Time Bandit

Vídeos de la Louisville Metro InfoSec



De nuevo, desde la web Irongeek podemos encontrar más vídeos interesantes, esta vez de la conferencia Louisville Metro InfoSec, celebrada el pasado 3 de octubre.

• Mobile Security and the Changing Workforce - Matthew Witten
• Weaponized Security - Kellman Meghu
• Information Security in University Campus and Open Environments - Adrian Crenshaw
• Past Due: Practical Web Service Vulnerability Assessment for Pen-Testers, Developers, and QA - Jeremy Druin
• STRC: The Security Training and Research Cloud - Jimmy Murphy
• Assessing Mobile Applications with the MobiSec Live Environment - Nathan Sweeney
• Attacking iOS Applications - Karl Fosaaen
• Can cloud and security be used in the same sentence? - Joshua Bartley
• Breaking SCADA Communications - Mehdi Sabraoui
• FBI – InfraGard - Current Cyber Trends
• How Do I Get There from Here? Security-to-Privacy Career Migration - Michael Carr
• Assessing the Risk of Unmanaged Devices (BYOD) - Pete Lindstrom
• Acquisitions…your latest zero day - Mitch Greenfield/Scott MacArthur
• NIST and your risky application - Conrad Reynolds
• Convergence: Configurations, Vulnerabilities and Unexpected Changes - Brian Cusack
• What Healthcare Can Learn from the Banking Industry - Jim Czerwonka
• Eliminating Data Security Threats And BYOS - David Braun
• Awards

Vídeos de la NDC 2013, Norwegian Developers Conference



Durante del 12 al 14 de junio de este año se celebró la conferencia de desarrolladores noruega en Oslo, NDC 2013. El evento está lleno de charlas y muchas de ellas tienen muy buena pinta.

Para no perder la costumbre, aquí os dejamos la lista de los vídeos de las charla:

• The Science of Communities Behind Software
• Accelerating Agile: hyper-performing teams without the hype
• Making Magic: Combining Data, Information, Services and Programming, at Internet-Scale
• Continuously Deploying Complex Apps Doesn't Have to Suck!
• Building Real World Cloud Apps with Windows Azure - Part 1
• Concurrent and High-Performance Programming in .NET with TPL, async/await, and Dataflow
• Creating Web Experiences with Users in Mind
• SP2013 Workflows and you
• Better Software — No Matter What
• Effective Leadership: How to avoid anti-learning Agile advice
• Clean Architecture and Design
• Powershell for developers
• Building Real World Cloud Apps with Windows Azure - Part 2
• The Abstractions of AngularJS
• From requests to responses: a journey into the ASP.NET Web API runtime architecture
• Cage Match - EmberJS vs. Angular
• Better Software — No Matter What
• Refactoring Noda Time (part 1)
• Do it right, then do the right thing
• Succeeding with Functional-first Programming in Industry
• Windows - Having its ass kicked by Puppet and PowerShell since 2012
• Cloud Messaging with Node.js and RabbitMQ
• The road to Atlantis - Right past that bend beyond Temporal Coupling Lane.
• Backbone is supposed to give me structure, but everything is still just a mess
• SharePoint 2013 Search - What's new and cool
• Better Software — No Matter What
• Patterns of Effective Teams
• Developing Offline Applications with HTML 5
• (Re-)architecting for Continuous Delivery
• Racing Thru the Last Mile: Cloud Delivery Web-Scale Deployment
• Practical Publishing for Profitable Programmers
• Ember.js in Action
• Windows 8 Store Apps – An Introduction
• Better Software — No Matter What
• Building Applications with ASP.NET MVC (Workshop)
• Reintroducing Business Analysis into the Agile Stream and The Need for Structuring the Conversation with Stakeholders
• All you need to know about TypeScript
• You are not (only) a software developer! - Simplicity in practice
• Brewing Beer with Windows Azure
• Principles of Component Design.
• Patterns of large-scale JavaScript applications
• Live coding: The Windows Store Apps showdown - C# vs JavaScript
• Better Software — No Matter What
• Building Applications with ASP.NET MVC (Workshop)
• ++ Building Open Source Communities Through Social Architecture
• Faking Homoiconicity in C# with graphs
• Chef for developers
• Reactive meta-programming with drones
• .NET Rocks - Functional Programming Panel: Type systems and static typing - saving your ass or getting in your face
• How to cope with overnight success - Scaling your web app fast and cheap
• From Windows Forms to WinRT
• Better Software — No Matter What
• Building Applications with ASP.NET MVC (Workshop)
• Real World Polyglot Persistence
• Adopting Continuous Delivery
• Hacking .NET(C#) Application: An Unfriendly Territory
• Ground Control to Major Tom
• Require JS
• How to Change the World
• Windows 8 Store Apps – From Turtle to Rabbit
• Building clean and cohesive concurrent systems with F# agents
• CQRS Hypermedia with WebAPI
• UX by Developers
• Hacking .NET(C#) Application: Code of the Hacker
• Maintainable CSS - The Next Frontier of Front-End Engineering
• Abusing C#
• Don't let your process hide your ignorance
• Asynchronous Programming on the .NET Platform
• Windows Phone 8 – The advanced session
• The Seven Pillars Of Collaboration - Why agile teams need HISTORY in order to collaborate
• Telephones and postcards: our brave new world of messaging
• All projects should do usability testing!
• Securing ASP.NET Web APIs and HTTP Services
• Functional Programming You Already Know
• The Javascript Inferno - A Decent Into the Client-side MVC Netherworld
• Your Path through Agile Fluency
• Developing Games with Windows 8
• The Issuu Ecosystem - a real life perspective on web-scale infrastructure
• The Seven Pillars Of Collaboration - Why agile teams need HISTORY in order to collaborate
• Successfully retrofitting extensibility into established software products
• Information Alchemy: Presentation Patterns (& Anti-patterns)
• People, Process, Tools – The Essence of DevOps
• Erlang: a jump-start for .NET developers
• Being an Anti-social Geek is harmful
• Make Impacts, Not Software
• Sharing code with MVVM Light in Windows 8 and Windows Phone
• Defensive Programming 101 v3
• The Architecture of Uncertainty
• Web Usability on a Budget
• OAuth2 – The good, the bad and the ugly
• Certifying your car with Erlang
• Advanced HTTP Caching and patterns for Ninja Unicorns
• How much is a great developer worth?
• Tekpub's Full Throttle! Live on Stage with Jon Skeet
• Data is everywhere. Also in your Windows 8 app
• MVVM Without XAML: Writing Cross-Platform Mobile Applications with ReactiveUI
• A Developer's Guide to Design Frameworks (and More!)
• Rediscovering JavaScript
• What Every Hipster Should Know About Functional Programming
• Game on: Developing HTML5 games
• Growing software from examples
• Applied MVVM in Windows 8 apps: not your typical MVVM session!
• Lightning talks
• Enterprise hipster-apps with SharePoint and JavaScript
• SQL Server's Last Breath
• Architecting PhoneGap Applications
• Rigorous, Professional JavaScript
• ClojureScript: Lisp's Revenge
• How simple maths and BELIEF can help you coach people to change
• Leave the backend to us: building mobile apps with Azure Mobile Services
• Lightning talks
• Refactoring Noda Time (part 2)
• NuGet for the Enterprise
• HTML5 JavaScript APIs
• Introduction to Clojure
• Rigging Plan B: How To Go Live Safely With Bubbles, Domain Toggles And Obsessive Monitoring
• Sharing C# across Windows, Android and iOS using MvvmCross
• TDD, where did it all go wrong
• Mining your Creativity Mind
• Doing SPA with MVC & KnockoutJS
• Code-First NoSQL with .NET and Couchbase
• Lightning talks
• The Curious Clojureist
• Grid Computing with 256 Windows Azure Worker Roles & Kinect
• Real Cross-platform Mobile Applications - The Anti-Pattern
• Bleeding edge ASP.NET: See what is new and next for MVC, Web API, SignalR and more…
• Effective GitHubbing: The GitHub Flow
• Value of unit test: way from good design to easy maintenance
• Big Object Graphs Up Front
• Building Third-party Widgets and APIs using JavaScript
• Generic Programming Galore using D
• Continuously Deliver with ConDep
• iOS with C# using Xamarin
• Simulation Testing
• Debugging your mind
• Test Driving Nancy
• Writing Usable APIs in Practice
• Test-Driven JavaScript Master Class
• Exploring the C# Scripting Experience with scriptcs
• Continuous Delivery Zen on Windows Azure
• Android with C# using Xamarin
• Race Conditions, Distribution, Interactions--Testing the Hard Stuff and Staying Sane
• Building Startups and Minimum Viable Products using Lean Startup techniques
• Why Document Databases supercharge your app development
• Refactoring Noda Time (part 3)
• Service oriented architectures (hardcore separation of concerns)
• The Hip Hop Virtual Machine
• Succeeding with TDD: Pragmatic Techniques for effective mocking
• Web diagnostics with a Glimpse in ASP.NET
• Under the covers with ASP.NET SignalR
• Automated release management with TeamCity & OctopusDeploy
• Uncomfortable with Agility: What has Ten+ Years got us?
• Running with Ravens
• Deep C++
• Bare-Knuckle Web Development
• C# 5
• Running OSS Projects: From Zero to Sixty
• Building URL-Driven Apps with Ember.js
• Don’t do that, do this! Recommendations from the ASP.NET team
• Understanding Dependency Injection and Those Pesky Containers
• Holistic testing

Vídeos de la DerbyCon 3.0



A través de la magnífica web de Irongeek, podemos ver todos los vídeos de las charlas dadas (tracks 1 y 2 y algunas de la 3) en la DerbyCon 3.0.

La lista de los vídeos publicados es:

• Scanning Darkly – HD Moore (keynote)
• Kinetic Pwnage: Obliterating the Line Between Computers and the Physical World – Ed Skoudis (keynote)
• Look Ma – No Exploits! – The Recon-ng Framework – Tim “LaNMaSteR53? Tomes
• Cognitive Injection: Reprogramming the Situation-Oriented Human OS – Andy Ellis
• It's Only a Game: Learning Security through Gaming – Bruce Potter
• Practical Exploitation Using A Malicious Service Set Identifier (SSID) – Deral Heiland
• IOCAware – Actively Collect Compromise Indicators and Test Your Entire Enterprise – Matt Jezorek and Dennis Kuntz
• Ooops – Now What? :: The Stolen Data Impact Model (SDIM) – Brent Huston
• JTAGulator: Assisted discovery of on-chip debug interfaces – Joe Grand
• Cash is King: Who’s Wearing Your Crown? – Tom Eston and Spencer McIntyre
• Anti-Forensics: Memory or something – I forget. – int0x80
• Seeing red in your future? – Ian Iamit
• Security Sucks – and You’re Wearing a Nursing Bra – Paul Asadoorian
• TMI: How to attack SharePoint servers and tools to make it easier – Kevin Johnson and James Jardine
• Windows Attacks: AT is the new black – Rob Fuller and Chris Gates
• The High Risk of Low Risk Applications – conrad reynolds
• How Good is Your Phish – @sonofshirt
• It’s Okay to Touch Yourself – Ben Ten (Ben0xA)
• Identifying Evil: An introduction to Reverse Engineering Malware and other software – Bart ‘d4ncind4n’ Hopper
• Collaborative Penetration Testing With Lair – Tom Steele and Dan Kottmann
• How Im going to own your organization in just a few days. – RazorEQX
• Malware Automation – Christopher Elisan
• Pass-The-Hash 2: The Admin’s Revenge – Skip Duckwall and Chris Campbell
• What’s common in Oracle and Samsung? They tried to think differently about crypto. – L·szlÛ TÛth – Ferenc Spala
• The Cavalry Is Us: Protecting the public good and our profession – Josh Corman
• Burning the Enterprise with BYOD – Georgia Weidman
• Love letters to Frank Abagnale (How do I pwn thee let me count the ways) – Jayson E. Street
• Getting the goods with smbexec – Eric Milam(brav0hax) and Martin Bos (purehate)
• The Message and The Messenger – James Arlen
• Shattering the Glass: Crafting Post Exploitation Tools with PowerShell – Matt Johnson
• 50 Shades of RED: Stories from the "Playroom" – Chris Nickerson
• Cheat Codez: Level UP Your SE Game – Eric Smith
• Beyond Information Warfare “You Ain’t Seen Nothing Yet” – Winn Schwartau
• My Experiments with truth: a different route to bug-hunting – Devesh Bhatt
• Stop Fighting Anti-Virus – Integgroll
• The Art and Science of Hacking Any Organization – Tyler Wrightson
• Living Off the Land: A Minimalist’s Guide to Windows Post-Exploitation – Christopher Campbell & Matthew Graeber
• Cracking Corporate Passwords – Exploiting Password Policy Weaknesses – Minga / Rick Redman
• How the Grid Will Be Hacked – Josh Axelrod and Matt Davis
• Ownage From Userland: Process Puppeteering – Nick Cano
• help for the helpdesk – Mick Douglas
• ) UNION SELECT `This_Talk` AS (‘New Exploitation and Obfuscation Techniquesí)%00 – Roberto Salgado
• Weaponizing your Coffee Pot – Daniel Buentello
• Exploiting_the_Zeroth_Hour(); Developing your Advanced Persistent Threat to Pwn the Network – SOLOMON SONYA and NICK KULESZA
• Practical OSINT – Shane MacDougall (NOTE THAT THIS IS AN ADULT ONLY TALK – 18+ or older)
• Phishing Like The Pros – Luis “Connection” Santana
• Stop making excuses; it’s time to own your HIV (High Impact Vulnerabilities) – Jack D. Nichelson
• Raspberry Pi – Media Centers – and AppleTV – David Schuetz
• Uncloaking IP Addresses on IRC – Derek Callaway

Vídeos de la Ruxcon 2012



Ya están disponibles los vídeos de la pasada Ruxcon 2012. Recuerda que las presentaciones también están disponibles.

• Reverse Engineering a Mass Transit Ticketing System - TrainHack
• Hardware Backdooring is Practical - Jonathan Brossard
• Injecting PHY-Layer Packets without a Bug or your Radio - Travis Goodspeed
• How To Catch a Chameleon: Its All In Your Heap - Steven Seeley
• Tracking vulnerable JARs - David Jorm
• A Tale of Two Firefox Bugs - Fionnbharr Davies
• Bluetooth Packet Sniffing Using Project Ubertooth - Dominic Spill
• Thar' be Vuln. ID's Here - A Data Mining Case Study Matt Jones
• Detecting Source Code Re-use through Metadata and Context Partial Hashing - Daniel Cabezas
• Advanced Persistent Response - Peleus Uhley
• Finding Needles in Haystacks (The Size of Countries) - Michael Baker
• Binary Instrumentation for Android - Collin Mulliner
• Examination of the VMWARE ESXi Binary Protocol Using Canape - Alex Chapman
• Monitoring Repositories for Fun and Profit - Louis Nyffenegger
• Windows Kernel Fuzzing For Beginners - Ben Nagy
• Firefox OS Application Security - Paul Theriault
• Targeted Malware -- Sophisticated Criminals or Babytown Frolics? - Josh Grunzweig & Ryan Merritt
• Exploiting Internal Network Vulns via the Browser Using BeEF Bind - Ty Miller & Michele Orru
• The Impacts of Advancing Technology on Computer Forensics and E-Discovery - Adam Daniel
• The 3 Rings of the Data Breach Circus - Mark Goudie
• FooCodeChu for Software Analysis, Malware Detection & Vuln Research - Silvio Cesare
• Practical Attacks on Payment Gateways - Eldar Marcussen
• De Mysteriis Dom Jobsivs: Mac EFI Rootkits - snare

Vídeos de la DebConf 2013



Ya podemos ver las charlas de la DebConf13, una conferencia entorno a la distribución Debian. La lista de vídeos es la siguiente:

• 960_X2Go_Terminal_Server_Suite_and_Debian.webm
• 962_Debian-LAN.webm
• 964_FreedomBox.webm
• 965_SPI_BOF.webm
• 966_Technical_Committee_BOF.webm
• 967_X_Compositing_for_Free.webm
• 968_Embedded_ARM_development_in_Debian.webm
• 969_Flying_Rockets_with_Debian_Software.webm
• 970_Derivatives_panel.webm
• 972_Bits_from_the_DPL.webm
• 973_Building_a_private_cloud_on_Debian_using_Eucalyptus.webm
• 974_use_Perl.webm
• 975_dh_busfactor.webm
• 976_Debian_Cosmology.webm
• 977_LAVA_full-system_testing_on_real_hardware.webm
• 978_Munin_.webm
• 979_WebID_BoF.webm
• 980_systemd_myths_debunked.webm
• 981_Making_your_package_work_with_systemd.webm
• 983_Why_Debian_should_or_should_not_make_systemd_the_default.webm
• 984_An_introduction_to_the_BootstrapBuild_Ordering_Toolchain.webm
• 986_Why_running_a_Blend.webm
• 987_How_to_attract_new_developers_for_your_team.webm
• 988_Debian_Med_meeting.webm
• 989_Debian_Science_Roundtable.webm
• 993_Debian_Contributors.webm
• 994_Debian_Contributors_BOF.webm
• 995_An_introduction_to_jenkins.debian.net.webm
• 997_piuparts.d.o_testing_that_.deb_packages_behave.webm
• 998_Debian_teams.webm
• 999_Paths_into_Debian.webm
• 1000_An_update_on_Debian_with_Clang.webm
• 1001_phpMyAdmin_tutorial.webm
• 1002_How_other_FLOSS_communities_mentor.webm
• 1003_Debian_on_Google_Compute_Engine.webm
• 1004_Public_clouds_and_official_Debian_image_status.webm
• 1005_Tutorial_Using_Debian_on_Google_Compute_Engine.webm
• 1006_Challenges_Questions_on_Packaging_Cloud-Specific_Software_for_Debian.webm
• 1007_Debian_derivatives_BoF.webm
• 1008_Lintian_as_a_analysis_framework.webm
• 1009_Packaging_for_beginners.webm
• 1011_From_Smaky_to_Colobot_a_history_of_software_in_Switzerland.webm
• 1012_Women_in_Debian_2013.webm
• 1013_Hardware_support_in_Debian_stable.webm
• 1014_Debian_at_the_core_of_modern_communications_networks.webm
• 1015_DebiChem.webm
• 1017_Destabilising_the_Linux_kernel_module_ABI.webm
• 1018_Whats_new_in_the_Linux_kernel.webm
• 1019_Multiarch_workshop.webm
• 1020_Cross_compilers_in_Debian.webm
• 1021_ARM_BOF.webm
• 1022_DPL_helpers_BOF.webm
• 1023_Adding_Challenge-Response_Based_Authentication_Schemes_To_oath-toolkit_and_dynalogin.webm
• 1024_WebRTC_on_Debian.webm
• 1025_gitify_your_life.webm
• 1026_buildd_wanna-build_bof.webm
• 1027_Why_Debian_needs_Upstart.webm
• 1028_Ubuntu_daily_quality_improvements_overlap_with_Debian_CUT.webm
• 1029_Revisiting_the_multi-arch_premises_for_a_more_capable_multi-arch_system.webm
• 1030_Introducing_Architecture_llvm.webm
• 1031_OpenStack_workshop.webm
• 1032_DC14_in_Portland.webm
• 1033_Why_DoudouLinux_matters.webm
• 1035_Introduction_to_git-dpm.webm
• 1036_AWS_Debian.webm
• 1037_Debian_on_AWS_BoF.webm
• 1038_How_can_AWS_help_Debian.webm
• 1039_Secure_Boot_for_Debian_Linux.webm
• 1041_Welcome_talk.webm
• 1042_Closing_ceremony.webm
• 1043_DC15_proposals.webm
• 1044_Lightning_talks.webm
• 1048_Recursive_node_classification_for_system_automation.webm
• 1049_CoC_BoF.webm
• 1050_Jitsi_and_Jitsi_Videobridge.webm
• 1051_New_Member_BOF.webm
• 1054_dracut.webm
• 1060_ikiwiki_BoF.webm
• 1065_Ruby_BoF.webm
• 1073_MariaDB.webm
• 1089_debconf_governance.webm
• 1092_X_Strike_Force_BoF.webm

Vídeos de la OWASP AppSec Europe 2013



Ya tenemos disponibles los vídeos de otra magnífica conferencia sobre seguridad informática: OWASP AppSec Europe 2013. Ésta se celebró en Hamburgo durante el pasado 20-23 de agosto. La lista de los vídeos es la siguiente:

• AbrahamAranguren-IntroducingOWASPOWTF5x5_720p.mp4
• AchimHoffmannOferShezaf-WAFEC-contentandhistoryofanunbiasedprojectchallenge_720p.mp4
• BastianBraunJoachimPoseggaChristianV.Pollak-ADoormanforYourHome-Control-FlowIntegrityMeansinWebFrameworks_720p.mp4
• ColinWatsonDennisGroves-OWASPAppSensorInTheoryInPracticeandInPrint_720p.mp4
• DanCornell-DoYouHaveaScanneroraScanningProgram_720p.mp4
• DieterGollmann-ClosingNoteAccessControloftheWeb-TheWebofAccessControl_720p.mp4
• DirkWetter-ClosingCeremony_720p.mp4
• EduardoVela-Matryoshka_720p.mp4
• ErlendOftedal-RESTfulsecurity_720p.mp4
• FredDonovan-Q-BoxandH-BoxRaspberryPIfortheInfrastructureandHacker_720p.mp4
• JrgSchwenk-KeynoteCryptographyinWebSecurityStupidBrokenandmaybeWorking_720p.mp4
• KonstantinosPapapanagiotouSpyrosGasteratos-OWASPHackademicapracticalenvironmentforteachingapplicationsecurity_720p.mp4
• LucaViganLucaCompagna-TheSPaCIoSToolproperty-drivenandvulnerability-drivensecuritytestingforWeb-basedapplicationscenarios_720p.mp4
• MarcoBalduzziVincenzoCiangagliniRobertMcArdle-HTTPS-BasedClusteringforAssistedCybercrimeInvestigations_720p.mp4
• MarioHeiderich-TheinnerHTMLApocalypse-HowmXSSattackschangeeverythingwebelievedtoknowsofar_720p.mp4
• MicheleOrr-RootingyourinternalsInter-ProtocolExploitationcustomshellcodeandBeEF_720p.mp4
• MiltonSmith-MakingtheFutureSecurewithJava_720p.mp4
• NickNikiforakis-WebFingerprintingHowWhoandWhy_720p.mp4
• NicolasGrgoire-BurpPro-Real-lifetipsandtricks_720p.mp4
• PaulStone-PrecisionTiming-AttackingbrowserprivacywithSVGandCSS_720p.mp4
• PhilippeDeRyckLievenDesmetFrankPiessensWouterJoosen-ImprovingtheSecurityofSessionManagementinWebApplications_720p.mp4
• RetoIschi-AnAlternativeApproachforReal-LifeSQLiDetection_720p.mp4
• RobertoSuggiLiverani-AugmentedRealityinyourWebProxy_720p.mp4
• SahbaKazerooni-NewOWASPASVS2013_720p.mp4
• SaschaFahlMarianHarbachMatthewSmith-MalloDroidHuntingDownBrokenSSLinAndroidApps_720p.mp4
• SaschaFahlMatthewSmithHenningPerlMichaelBrenner-QualitativeComparisonofSSLValidationAlternatives_720p.mp4
• SimonBennetts-OWASPZAPInnovations_720p.mp4
• TalBeEry-APerfectCRIMEOnlytimewilltell_720p.mp4
• ThomasHerleaNelisBouckJohanPeeters-RecipesforenablingHTTPS_720p.mp4
• YvanBoilyMinion-MakingSecurityToolsaccessibleforDevelopers_720p.mp4
• AngelaSasse-KeynoteBustingTheMythofDancingPigsAngelasTop10listofreasonswhyusersbypasssecuritymeasures_720p.mp4
• BenStock-EradicatingDNSRebindingwiththeExtendedSame-OriginPolicy_720p.mp4
• DavidRoss-InsaneintheIFRAME--Thecaseforclient-sideHTMLsanitization_720p.mp4
• DirkWetter-Welcomenoteandamanualfortheconferenceandeverythingelse_720p.mp4
• ErlendOftedal-SecuringamodernJavaScriptbasedsinglepagewebapplication_720p.mp4
• FlorianStahlJohannesStroeher-SecurityTestingGuidelinesformobileApps_720p.mp4
• FrederikBraun-OriginPolicyEnforcementinModernBrowsers_720p.mp4
• JimManico-OWASPTop10ProactiveControls_720p.mp4
• KrzysztofKotowicz-Iminurbrowserpwningyourstuff-AttackingwithGoogleChromeextensions_720p.mp4
• NickNikiforakisLievenDesmetStevenVanAcker-SandboxingJavascript_720p.mp4
• OWASPBoard-OWASPIntroduction_720p.mp4
• SebastianLekiesBenStock-ClickjackingProtectionUnderNon-trivialCircumstances_720p.mp4
• StefanoDiPaola-JavascriptlibrariesinsecurityAshowcaseofrecklessusesandunwittingmisuses_720p.mp4
• TarasIvashchenko-ContentSecurityPolicy-thepanaceaforXSSorplacebo_720p.mp4
• ThomasRoessler-KeynoteSecureallthethingsfictionfromtheWebsimmediatefuture_720p.mp4
• TobiasGondrom-OWASP-CISOGuideandCISOreport2013formanagers_720p.mp4

Presentaciones de DEF CON 21



Ya estás disponibles las presentaciones (diapositivas y algún material extra) de la DEF CON 21. Todavía no están todas, pero aquí tenéis la lista de las disponibles en estos momentos:

• Business logic flaws in mobile operators services - PDF White Paper
• Fear the Evil FOCA: IPv6 attacks in Internet connections - PDF
• Suicide Risk Assessment and Intervention Tactics - PDF Extras
• Combatting Mac OSX/iOS Malware with Data Visualization - PDF White Paper
• MITM All The IPv6 Things - PDF
• PowerPwning: Post-Exploiting By Overpowering PowerShell - PDF Extras
• Transcending Cloud Limitations by Obtaining Inner Piece - PDF Extras
• Data Evaporation from SSDs - PDF
• Evil DoS Attacks and Strong Defenses - PDF
• RFID Hacking: Live Free or RFID Hard - PDF Extras
• OTP, It won't save you from free rides! - PDF White Paper Extras
• Conducting massive attacks with open source distributed computing - PDF
• Offensive Forensics: CSI for the Bad Guy - PDF Extras
• Utilizing Popular Websites for Malicious Purposes Using RDI - PDF
• Abusing NoSQL Databases - PDF
• Legal Aspects of Full Spectrum Computer Network (Active) Defense - PDF
• Blucat: Netcat For Bluetooth - Extras
• Home Invasion 2.0 - Attacking Network-Controlled Consumer Devices - PDF White Paper Extras
• Stepping P3wns: Adventures in full spectrum embedded exploitation (and defense!) - PDF
• Revealing Embedded Fingerprints: Deriving intelligence from USB stack interactions - PDF White Paper
• How to Disclose or Sell an Exploit Without Getting in Trouble - PDF
• I Can Hear You Now: Traffic Interception and Remote Mobile Phone Cloning with a Compromised CDMA Femtocell - PDF
• Privacy In DSRC Connected Vehicles - PDF
• Pwn'ing You(r) Cyber Offenders - PDF
• Electromechanical PIN Cracking with Robotic Reconfigurable Button Basher (and C3BO) - PDF White Paper Extras
• Google TV or: How I Learned to Stop Worrying and Exploit Secure Boot - PDF
• gitDigger: Creating useful wordlists from public GitHub repositories - PDF
• 10000 Yen into the Sea - PDF Extras
• Defeating SEAndroid - PDF
• The Politics of Privacy and Technology: Fighting an Uphill Battle - PDF
• Java Every-Days: Exploiting Software Running on 3 Billion Devices - PDF White Paper
• JTAGulator: Assisted Discovery Of On-Chip Debug Interfaces - PDF Extras
• Protecting Data with Short-Lived Encryption Keys and Hardware Root of Trust - PDF
• So You Think Your Domain Controller is Secure? - PDF
• Phantom Network Surveillance UAV / Drone - PDF
• The Bluetooth Device Database - PDF Extras
• Dude, WTF in my car? - PDF
• Resting on Your Laurels will get you Pwned: Effectively Code Reviewing REST Applications to avoid getting powned - PDF
• Torturing Open Government Systems for Fun, Profit and Time Travel - PDF
• The Secret Life of SIM Cards - PDF
• Key Decoding and Duplication Attacks for the Schlage Primus High-Security Lock - PDF Extras
• GoPro or GTFO: A Tale of Reversing an Embedded System - PDF
• A Thorny Piece Of Malware (And Me): The Nastiness of SEH, VFTables & Multi-Threading - PDF Extras
• Pwn The Pwn Plug: Analyzing and Counter-Attacking Attacker-Implanted Devices - PDF White Paper Extras
• Getting The Goods With smbexec - PDF
• PowerPreter: Post Exploitation Like a Boss - PDF Extras
• Kill 'em All — DDoS Protection Total Annihilation! - PDF White Paper Extras
• Please Insert Inject More Coins - PDF
• Stalking a City for Fun and Frivolity - PDF
• Fast Forensics Using Simple Statistics and Cool Tools - PDF Extras
• VoIP Wars: Return of the SIP - PDF Extras
• Exploiting Music Streaming with JavaScript - PDF Extras
• ACL Steganography - Permissions to Hide Your Porn - PDF Extras
• Doing Bad Things to 'Good' Security Appliances - PDF
• Let's screw with nmap - PDF Extras
• Defending Networks with Incomplete Information: A Machine Learning Approach - PDF White Paper
• We are Legion: Pentesting with an Army of Low-power Low-cost Devices - PDF Extras
• The Road Less Surreptitiously Traveled - PDF Extras
• Hacker Law School - PDF1 PDF2 PDF3 PDF4
• Defense by numbers: Making problems for script kiddies and scanner monkeys - PDF
• Forensic Fails - Shift + Delete won't help you here - PDF
• The dawn of Web 3.0: website mapping and vulnerability scanning in 3D, just like you saw in the movies - PDF
• Building an Android IDS on Network Level - PDF
• Safety of the Tor network: a look at network diversity, relay operators, and malicious relays - PDF
• How my Botnet Purchased Millions of Dollars in Cars and Defeated the Russian Hackers - PDF
• Examining the Bitsquatting Attack Surface - White Paper
• Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks - PDF
• Making Of The DEF CON Documentary - PDF
• All Your RFz Are Belong to Me - Hacking the Wireless World with Software Defined Radio - PDF
• A Password is Not Enough: Why disk encryption is broken and how we might fix it - PDF
• EMET 4.0 PKI Mitigation - PDF
• BYO-Disaster and Why Corporate Wireless Security Still Sucks - PDF
• Evolving Exploits Through Genetic Algorithms - PDF
• How to Hack Your Mini Cooper: Reverse Engineering Controller Area Network (CAN) Messages on Passenger Automobiles - PDF White Paper Extras
• Collaborative Penetration Testing With Lair - PDF
• DNS May Be Hazardous to Your Health - PDF
• Predicting Susceptibility to Social Bots on Twitter - PDF
• EDS: Exploitation Detection System - PDF White Paper
• The Government and UFOs: A Historical Analysis by Richard Thieme - PDF Extras
• BoutiqueKit: Playing WarGames with expensive rootkits and malware - PDF
• C.R.E.A.M. Cache Rules Evidently Ambiguous, Misunderstood - PDF
• Insecurity - A Failure of Imagination - PDF
• HTTP Time Bandit - PDF
• BYOD PEAP Show - PDF
• Android WebLogin: Google's Skeleton Key - PDF Extras
• Hacking Driverless Vehicles - PDF

Presentaciones de la Crypto Rump 2013



Crypto Rump es un evento de un sólo día donde se presentan temas sobre cifrado. Las presentaciones son cortas y el evento dura sobre unas 3 horas y media. Crypto Rump 2013 se celebró el pasado 20 de agosto. Aquí tenéis el listado de las diapositivas:

• Chairs' report for Crypto 2013
• EyeDecrypt -- Private Interactions in Plain Sight
• How to make 400+ cryptographers appreciate your creativity
• The FEAL Cipher Prize Problem -Winner Announcement-
• Solving the FEAL 25 Years Prize Problems
• Factoring as a service
• Cryptanalysis of MDS-POTI
• NIST Update
• Spyin' NSA
• On the Security of RC4 in TLS
• Weakness of GF$(3^{6 \cdot 509})$ for Discrete Logarithm Cryptography
• Candidate Indistinguishability Obfuscation, Or Sell Apple, Buy Samsung
• How to Use Indistinguishability Obfuscation: Deniable Encryption, and More
• How to keep a secret: Leakage Deterring Public-Key Cryptosystems
• Random Number Generation, Revisited
• Naturally Rehearsing Passwords
• Computational Fuzzy Extractors
• Factoring RSA keys from certified smart cards: Coppersmith in the wild
• Warsaw is cool
• Under Surveillance
• An Improved Attack on 4-Round Even-Mansour with 2 Alternating Keys
• Quantum Time Capsules & Unknown Recipient Encryption
• Delegatable Pseudorandom Functions and Applications
• Fully-Anonymous Functional Proxy-Re-Encryption
• Shorter Quasi-Adaptive NIZKs for Linear Subspaces
• Communication complexity of the forge-and-lose technique
• The million-entry ORAM on MPC
• Announcing SCAPI: the Secure Computation API

Vídeos de la Sigint13



Sigint es una conferencia de 3 días celebrada anualmente dónde se tratan aspectos técnicos y sociales de la actual era digital, organizada por el Chaos Computer Club.

Este año se celebró entre los días 5 y 7 de julio. Aquí tenéis la lista de los vídeos de dicha conferencia:

• Automatisierte Videoüberwachung
• Parabolic Plane Flights – Research..
• Cryptocat: The Social and Technical ..
• Ruby is Magic!
• Car immobilizer hacking
• UI Redressing Attacks on Android Dev..
• Programming FPGAs with PSHDL
• Internet-Meme: Geschichte und Forsch..
• Why we fight (each other)
• The step into Cyborgism
• SDR, GSM/OpenBTS
• Der Kampf um die Netzneutralität
• E-Mobility as a Privacy Game Changer..
• Pressfreedom, Surveillance and Inte..
• Independents unite! Inside the freel..
• hpfriends: real-time social data-sha..
• DocPatch: Entdecke unsere Verfassung..
• Transparenzgesetz - Quo Vadis?
• Gute Arbeit
• C.R.O.P. – Combined Regenerative O..
• Besser leben für Geeks
• Nearly Everything That Matters is a ..
• Adblocker an, Schranke runter, Paywa..
• „Information wants to be free" ver..
• Offshoreleaks - the how and why of a..
• Funkzellenabfrage
• Let's tear down these walls
• The Politics of Surveillance: Unders..
• Home Network Horror Stories
• EU Data Protection Reform
• The DRM Of Pacman
• Making music with a C compiler
• VM32: A CPU simulator for demonstrat..
• I/O Capture Treiber Framework
• Game of Drones I + II
• Cuckoo Sandbox - malware beware
• Benutze Krake mit Gerät
• It's my party and I crypt if I want ..
• Embedded device security nightmares..
• Analog Computing

Vídeos de la JSConf US 2013



JSConf es una conferencia que se celebra por distintos lugares del mundo y que reúne a programadores y entusiastas del lenguaje de programación Javascript.

La edición celebrada en los EEUU este año tuvo lugar en Amelia Island, FL entre el 29 y 31 de mayo. Aquí tenéis la lista de los vídeos de las presentaciones:

• Remy Sharp: Lessons from the experimental edge of technology
• Angelina Fabbro: JavaScript Masterclass
• Angus Croll: JavaScript is Literature is JavaScript
• Andrew Dupont: Learning New Words
• Peter Higgins: #dadt (Dojo already did that)
• Ray Daly: JavaScript Journalism
• Jed Schmidt: Mass Hysteria: Clients and Servers, Living Together
• Raquel Vèlez: AI.js: Robots with Brains!
• Rebecca Murphey: Optimizing for Developer Delight
• Tom Occhino and Jordan Walke: JS Apps at Facebook
• Erich Gamma: Massive.js
• Steven Wittens: Making WebGL Dance
• Welcome from Chris and Laura

Banda sonora oficial de la DEF CON 21



Este año Gravitas Recordings ha sido la encargada de ponerle música a la DEF CON 21. El álbum lo podemos escuchar online, descargar y/o comprar (audio con mayor calidad). El precio del álbum lo pones tú y es una donación que va dirigida de forma íntegra a la Electronic Frontier Foundation, así que anímate.

El álbum se compone de 20 pistas:

1. BT - The Gathering Darkness 13:12
2. Dual Core - Fear and Chaos (Dale Chase Remix) 04:35
3. ytcracker - Bitcoin Baron 03:29
4. BLEO - The Carterfone Decision 01:47
5. Swinging Rabbits - Monster (Gunslinger vs Blare Remix) 04:14
6. Psymbionic & Great Scott - Computronium 04:39
7. Gramatik - Talkbox Intended 06:10
8. PANTyRAiD - Jokes from the Backseat 04:38
9. DJ RoboRob - The Great Divide ft. Dual Core 04:11
10. BREDE - Crush On 04:04
11. Karton - Chase It High (Left/Right Remix) 06:00
12. Royal Sapien presents No Context - For the Breakers (DEF CON Edit) 04:23
13. Son of the Electric Ghost - Beat It Kids 05:23
14. Nick Stoynoff presents NOFF - Aryt 03:20
15. A.E. Burdick - Room 101 06:35
16. Faderhead - Free 03:42
17. MDMM - Octopus (Redux) 07:25
18. Vigilante - It's Our Time (Electro Version) 03:00
19. BlakOPz - BlakOUt 05:59
20. Bud Melvin - Trolling is a Art 02:48

Presentaciones de BlackHat USA 2013



Ya están disponibles las diapositivas de las presentaciones de la BlackHat USA de esta año, celebrada en el Caesars Palace en Las Vegas entre el 27 de julio y el 1 de agosto.

En esta edición parece que la audiencia ha estado dividida por toda la polémica relacionada con las filtraciones de la NSA y su programa Prism. En especial con la presentación de apertura, de la cual también puedes acceder al vídeo, dada por el General Keith B. Alexander, director de la agencia de seguridad nacional (NSA).

Vídeos de la Aspen Security Forum 2013



Aquí os dejo la lista de vídeos de la Aspen Security Forum de este año. Hay vídeos muy interesante, especialmente con todo lo que se está cociendo con las filtraciones de la NSA.

• Off We Go into the Wild Blue Yonder: The Air Force’s Role in Countering Terrorism and Advancing America’s Interests in the World
• Doing More with Less—Simply an Oxymoron or Also an Imperative: Refashioning Today's Pentagon to Fight the Wars of the Future
• Mission Accomplished? Has the Intelligence Community Connected All the Dots?
• Counterterrorism, National Security, and the Rule of Law
• Through a Glass Darkly: What Security Threats Does the Future Hold and What Can We Do Now to Protect Ourselves from Them?
• At the Center of the Action: The National Counterterrorism Center and its Role in Securing the Homeland
• MANHUNT: The Search for Osama Bin Laden
• Clear and Present Danger: Cyber-Crime; Cyber-Espionage; Cyber-Terror; and Cyber-War
• The Threat Matrix: How is the Terrorism Threat Evolving in the Post-Bin Laden Era?
• International Perspectives on Terrorism and Counterterrorism
• TSA: Rethinking Aviation Security in the Post-Bin Laden Era
• Putting Out Fires Before They Spread: The US's Role in Preventing Conflict
• Industry’s Role in Cybersecurity
• Iraq and AfPak: Now and Then
• AFRICOM: The Next Afghanistan?
• Counterterrorism and the Media
• Unrest in the Arab World and its Implications for Our Security
• Law Enforcement and National Security
• The Military and Intelligence: Out of the Shadows
• Looking East: The Pacific Pivot
• Iran: Crossing the “Red Line?”
• CENTCOM Review: Turmoil in the Mideast and Southwest Asia and Its Implications for American Security

Fuente

Vídeos de la Hack in Paris 2013



Ya publicamos aquí una entrada con las presentaciones de la Hack in Paris 2013 y ahora os dejamos a continuación la lista de los vídeos:

• Remoting android applications for fun and profit
• Windows Phone 8 application security
• The Security of MDM (Mobile Device Management) systems
• I'm in your browser, pwning your stuff - Attacking Google Chrome extensions
• Origin policy enforcement in modern browsers
• Web Applications Forensics
• DBI Frameworks applied to computer security : Uses and comparative
• The Realex payments application security story, narrated by Security Ninja
• BYOD - The Privacy and Compliance Risks from Bringing Your Own Mobile Device to Work
• The Control of technology by nation state : Past, Present and Future - The Case of Cryptology and information security
• Analysis of a Windows Kernel vulnerability : from espionage to criminal use
• Burp Pro : Real-life tips and tricks
• Are we getting better? - Hacking Todays Technology
• Malware vs Virtualization : The endless cat and mouse play
• Next generation rootkits for ARM based devices

Presentaciones de la RECON 2013



Ya podemos descargarnos algunas de las presentaciones de la RECON de este año. RECON es una conferencia sobre seguridad enfocada al campo de la ingeniería inversa y la explotación, y fue celebrada del 21 al 23 de junio en Montreal, Canadá.

Las list de las diapositivas hasta ahora disponibles es la siguiente:

• Aleksandr Matrosov and Eugene Rodionov-Reconstructing-Gapz Position-Independent Code Analysis Problem
• Bacura-Just keep trying ! Unorthodox ways to hack an old-school hardware
• Dmitry Nedospasov and Thorsten Schroder-Keep your tentacles off my bus%2c introducing Die Datenkrake[big]
• Dmitry Nedospasov and Thorsten Schroder-Keep your tentacles off my bus%2c introducing Die Datenkrake[small]
• Elias Bachaalany-Inside EMET 4
• Gabriel Tremblay-Reversing P25 Radios
• Josh Thomas-Hiding @ Depth - Exploring %26 Subvertion NAND Flash memory
• Joshua J. Drake-Reversing and Auditing Android%27s Proprietary Bits-public
• Natalie Silvanovich-Many More Tamagotchis Were Harmed in the Making of this Presentation
• Natalie Silvanovich-Many More Tamagotchis Were Harmed in the Making of this Presentation
• Olivier Thomas-Hardware reverse engineering tools
• Richard Johnson-Taint Nobody Got Time for Crash Analysis - slides
• recon2013-Jurriaan Bremer-Haow do I sandbox

Presentaciones de la Hack in Paris 2013



Se han publicado la mayoría de las presentaciones dadas en la Hack in Paris 2013 celebrada del 17 al 21 de junio. La lista es la siguiente:

• Remoting android applications for fun and profit
• Windows Phone 8 application security
• I'm in your browser, pwning your stuff - Attacking Google Chrome extensions
• Origin policy enforcement in modern browsers
• Web Applications Forensics
• DBI Frameworks applied to computer security : Uses and comparative
• The Realex payments application security story, narrated by Security Ninja
• The Control of technology by nation state : Past, Present and Future - The Case of Cryptology and information security
• Burp Pro : Real-life tips and tricks
• Malware vs Virtualization : The endless cat and mouse play
• Next generation rootkits for ARM based devices
• The inner HTML Apocalypse : How MXSS attacks change everything we believed to know so far

20 años de DEF CON a descarga



Si el otro día hablábamos de la disponibilidad del material de la DEF CON 20, hoy os hablamos de una nueva página que han creado en la web de la DEF CON llamada DEF CON Torrent Links, dónde podemos descargarnos todo el material de cada una de las ediciones de esta conferencia, más algún material extra a través de ficheros torrent.

Estos son todos los enlaces a los ficheros torrent:

Descarga de todo el material de la DEFCON 20



En su día publicamos ya comentamos aquí sobre la disponibilidad de las presentaciones, “vídeopositivas” y del audio de la DEFCON 20 y no hace mucho en el blog de Chema Alonso veíamos que ýa había puesto disponible los vídeos con el montaje del presentador y las diapositivas.

Y ahora ya podemos descargarno todo el material a través de este fichero torrent y si además qieres ver algunas fotos del evento, desde este otro torrent te las puedes descargar.

Presentaciones de la C++Now 2013



Ya están disponibles las presentaciones de la C++Now 2013 celebrada en Aspen, Colorado. Una conferencia que reúne a un número importante de expertos en el lenguaje de programación C++.

• Jeff Garland:Library in a Week: C++11 & Boost Cookbook (I)
• Rob Stewart: Survey of Multi-Threaded Programming Support in C++11 and Boost
• Boris Schäling: Containers in Boost
• Tony Van Eerd: Low Level Threading with C++11
• Leor Zolman: A Zephyr Overview of C++11
• Eric Niebler: A First Look at Proto-0x | PPTX Format
• Tony Van Eerd: Non-Allocating std::future/promise
• Ábel Sinkovics: Boosting MPL with Haskell elements
• Chandler Carruth: Keynote: Optimizing the Emergent Structures of C++
• Scott Schurr: Sweating the Small Stuff: Brace Initialization, Unions and Enums | Code for AnyString
• David Sankel: The Intellectual Ascent to Agda pptx
• Hartmut Kaiser, Vinay Amatya: HPX: A C++ Standards Compliant Runtime System For Asynchronous Parallel And Distributed Computing
• Edouard Alligand: Scaling with C++11
• John Bandela: Easy Binary Compatible C++ Interfaces Across Compilers | PPT Format
• Dominik Charousset, Matthias Vallentin: libcppa – Designing an Actor Semantic for C++11
• Stanley Lippman: Keynote: yet another paradigm shift – A Meta4 model of concurrency | pptx Format
• Joel de Guzman: Inside Spirit X3: Redesigning Boost.Spirit for C++11 || Part 1 | Part 2 | Part 3 | Part 4
• Larisse Voufo: Weak Hiding for C++ Concepts: via a Framework for Reasoning about Name Binding in Programming Languages | PPTX Format
• Richard Saunders: Thread-safe and Thread-neutral Bags
• Boris Kolpackov: Practical C++11: What I Learned Adding C++11 Support to ODB
• Format
• Joel Falcou, Mathias Gaunard: Boost.Dispatch – Generalized Tag Dispatching Infrastructure Library | Slideshare
• Karl Rupp: A Discussion of Selected Vienna-Libraries for Computational Science
• Jon Kalb: The Hijacker's Guide to the Community | Keynote Format
• Alex Fabijanic: Dynamic C++
• David Sankel: DeBruijn Bind: A more powerful bind that retains its simplicity | PPTX Format
• Rob Stewart: Multi-Threading With C++11 and Boost
• Andrew Sutton: Concepts Lite: Constraining Templates with Predicates
• Alex Fabijanic: Look ma, “update DB to HTML5 using C++”, no hands!
• Boris Kolpackov: ODB, an ORM for C++(11)
• Alisdair Meredith: Allocators in C++11
• Boris Schäling: Boost.Graph for Beginners
• Marshall Clow: Fun with Tuples
• Sumant Tambe: Standardizing the Data Distribution Service (DDS) API for Modern C++
• Sebastian Redl: Overloading the Member Access Operator
• Zoltan Porkolab: Debugging and Profiling C++ Template Metaprograms
• Richard Saunders, Clinton Jeffery: Dynamic, Recursive, Heterogeneous Types in Statically-Typed Languages
• Bart Janssens: Building finite-element matrix expressions with Boost Proto and the Eigen library | Sample Code
• Louis Dionne: A system for resource deadlock prevention using intrusive dynamic analysis

Presentaciones de la NoSuchCon



Aquí tenemos disponibles las diapositivas de las charlas que se impartieron en la NoSuchCon 2013 celebrada del 15 al 17 de mayo de este año.

• j00ru_Abusing_the_Windows_Kernel
• Alex_Ninjas_and_Harry_Potter
• goodspeed_Nifty_Tricks_and_Sage Advice_for_Shellcode_on_Embedded_Systems
• Nicolas_Gregoire_XSLT_Fuzzing
• Saumil_Deadly_Pixels
• Itzik_Pythonect-Fu
• Butterworth_BIOS_Chronomancy
• Ridley_ARM_Exploitation_And_Hardware_Hacking
• Eric_heap_mannipulation
• KNohl_Immobilizer_Security
• Richard_Taint_Nobody_Got_Time_for_Crash_Analysis
• ONAPSIS_Attacks_on_SAP_TMS
• Aaron_Crashdmpster_Diving_Win8
• Nikita_Exploiting_Hardcore_Pool_Corruptions_in_Microsoft_Windows_Kernel
• Alex&Timur_XML_Out_Of_Band
• Pedro_Revisiting_MacOSX_Kernel_Rootkits
• Ferrante_Auriemma_Exploiting_Game_Engines
• Sergey_Any_Input_is_a_program
• Adrien_Robinson_Arsenic_Framework

Presentaciones de la SyScan 2013



Ya podemos descargarnos casi todas las presentaciones de SyScan 2013, conferencia sobre seguridad celebrada en Singapur del 22 al 26 de abril.

Las lista de las mismas es la siguiente (los enlaces son archivos zip):

• Checking the Boundaries of Static Analysis
• OptiCode: Machine Code Deobfuscation for Malware Analysis
• The InnerHTML Apocalypse - How mXSS Attacks change everything we believed we knew so far
• Taming the ROPe on Sandy Bridge
• iSniff GPS Virtual Wardriving
• Bochspwn: Exploiting Kernel Race Conditions Found via Memory Access Patterns
• Revisiting Mac OS Kernel Rootkits
• Coaching a Squad of Allwinners
• Mountain Lion/iOS Vulnerability Garage Sale

Presentaciones de la HITBSECCONF 2013 - Amsterdam



Ya tenemos entretenimiento para el fin de semana con las presentaciones de la conferencia sobre seguridad informática de la Hack In The Box 2013 celebrada en Amsterdam.

• CLOSING KEYNOTE - Winn Schwartau - The History of the Future of InfoSec.pdf
• D1 KEYNOTE - Edward Schwartz - Embracing the Uncertainty of Advanced Attacks with Big Data Analytics.pdf
• D1LAB - Didier Stevens - Windows x64 Essentials.pdf
• D1LAB - Itzik Kotler - Hack Like It's 2013.pdf
• D1LAB - Vladimir Kropotov and Sergey Soldatov - Defending the Enterprise the Russian Way.pdf
• D1T1 - Hugo Teso - Aircraft Hacking - Practical Aero Series.pdf
• D1T1 - Peleus Uhley and Karthik Raman - Security Response in the Age of Mass Customized Attacks.pdf
• D1T1 - Petko D Petkov - Defeating the Intercepting Web Proxy %e2%80%93 A Glimpse Into the Next Generation of Web Security Tools.pdf
• D1T1 - Sergey Bratus and Julian Bangert - Better Security Through Creative x86 Trapping.pdf
• D1T1 - Travis Goodspeed - Nifty Tricks and Sage Advice for Shellcode on Embedded Systems.pdf
• D1T1 - Vladimir Vorontsov and Alexander Golovko - SSRF PWNs - New Techniques and Stories.pdf
• D1T2 - Daniel Mende - Paparazzi Over IP.pdf
• D1T2 - Nicolas Seriot - Abusing Twitters API and OAuth Implementation.pdf
• D1T2 - Nikita Tarakanov - Exploiting Hardcore Pool Corruptions in Microsoft Windows Kernel.zip
• D1T2 - Philippe Langlois - Hacking HLR HSS and MME Core Network Elements.pdf
• D1T2 - Tal Zeltzer - Analysis to Remote Root 0day in an Industry Leading SSL-VPN Appliance.pdf
• D1T2 - Wilco Baan Hofman - Bringing Dutch Alarm Systems to Their Knees.pdf
• D2 KEYNOTE - Bob Lord - Rethinking the Front Lines.pdf
• D2T1 - Andrey Labunets and Egor Homakov - OAuth 2.0 and the Road to XSS.pdf
• D2T1 - Peter Geissler and Steven Ketelaar - How I Met Your Modem.pdf
• D2T1 - Pod2g, Planetbeing, Musclenerd and Pimskeks aka Evad3rs - Swiping Through Modern Security Features.pdf
• D2T1 - Sebastien Kaczmarek - Dreamboot UEFI Bootkit.pdf
• D2T1 - Sergey Shekyan and Artem Harutyunyan - Turning Your Surveillance Camera Against You.pdf
• D2T2 - A Petukhov G Noseevich and D Gamayunov - Breaking Through Certified Crypto in Banking Apps.pdf
• D2T2 - Chilik Tamir - iAnalyzer - No More Blackbox iOS Analysis.pdf
• D2T2 - Dan Tentler - The Shodan Computer Search Engine.pdf
• D2T2 - Ofer Shezaf - The Infosec Risks of Charging Electric Cars.pdf
• D2T2 - Rosario Valotta - Abusing Browser User Interfaces for Fun and Profit.pdf

Presentaciones de la Rooted CON 2013



Ya tenemos disponibles las presentaciones de la Rooted CON 2013, uno de los congresos sobre seguridad informática de referencia de la scene española.

Aquí tenéis el listado de las presentaciones:

• Juan A. Calles y Pablo González - Metasploit & Flu-AD: Avoiding AVs with Payloads/DLLs Injection
• Roberto Baratta - eFraude: ganar gestionando la derrota
• Vicente Díaz - Birds, bots and machines - Fraud in Twitter and how to detect it using MLT
• Albert López - Linux Heap Exploiting Revisited
• Joxean Koret - Interactive Static Analysis Tools for Vulnerability Discovery
• Jesús Olmos - ChromeHack, a html5/chrome webhack tool
• David Meléndez Cano - Trash Robotic Router Platform (TRRP)
• Antonio Ramos - ¿Y si la seguridad afectara al valor contable de la empresa?
• David Barroso - Un gentil viaje al interior de las extorsiones mediante DDoS
• José Luis Verdeguer - FreePBX for fun & profit
• Sebastián Guerrero - Ke ase Android?
• David Fuertes - Señales Débiles. ¿Nos protegemos sabiendo que nos van a atacar?
• José M. Esparza y Mikel Gastesi - Sopelka VS Eurograbber: really 36 million EUR?
• José Pico y David Pérez - Sistema de localización geográfica de un terminal móvil
• Andrés Tarasco y Miguel Tarasco - OWISAM - Open WIreless Security Assessment Methodology
• Jaime Sánchez - From kernel space to user heaven
• Chema Alonso - Hachetetepe dospuntos slaac slaac
• Alejandro Ramos - Te pique lo que te pique, analiza un SQLite
• Raúl Siles - Wi-Fi: Why iOS (Android and others) Fail inexplicably?

Vídeos de la PyCon 2013



Ya están disponibles los vídeos de la PyCon 2013. Una conferencia orientada al lenguaje de programación Python:

• Closing Address
• Internationalization and Localization Done Right
• Keynote
• Plover: Thought to Text at 240 WPM
• Crypto 101
• Cython vs SWIG, Fight!
• Designers + Developers: Collaborating on your Python project
• Dispatch Magic
• Getting started with automated testing
• Making Apache suck less for hosting Python web applications.
• Mobile Application Testing with Python and Selenium
• Python at Netflix
• Python's Law
• Realtime Tracking and Mapping of Geographic Objects using Python
• Sink or swim: 5 life jackets to throw to New Coders
• Things to make writing tests easier
• What is the Python Software Foundation?
• What teachers really need from us
• Who’s there? - Home Automation with Arduino/RaspberryPi
• Why you should use Python 3 for text processing
• Better Documentation Through Automation: Creating Sphinx Extensions
• Deploy your Python app in 5 min with a PaaS
• Elasticsearch (Part 1): Indexing and Querying
• Encapsulation with descriptors
• Fighting Cancer with Python
• How the Internet works
• How to Except When You're Excepting
• If You Code, You Should Write
• Keynote - Eben Upton
• Kivy: Building GUI and Mobile apps with Python
• Measuring and modeling the complexity of children's books
• Opening Statements
• PyPy without the GIL
• Python Profiling
• Python: A "Toy" Language
• SimpleCV - Computer Vision using Python
• So you want to write an interpreter?
• Twisted Logic: Endpoints and Why You Shouldn't Be Scared of Twisted
• Using futures for async GUI programming in Python 3.3
• Write the Docs

Presentaciones de CanSecWest Vancouver 2013



Pues como dice el título, ya están disponibles para descarga las presentaciones (diapositivas) de CanSecWest Vancouver 2013:

• Keynote
• iOS6.1 - Exploitation 280 Days Later
• Evil Maid Just Got Angrier: Why Full-Disk Encryption With TPM is Insecure on Many Systems
• Sandbox Escapes: When the Broker is Broken
• Reflecting on Reflection - Exploiting Reflection Vulnerabilities in Managed Languages
• An Android Hacker's Journey: Challenges in Android Security Research
• DEP/ASLR bypass without ROP/JIT
• SMS to Meterpreter - Fuzzing USB Modems
• Cracking and Analyzing Apple iCloud backups, Find My iPhone, Document Storage.
• Desktop Insecurity
• Shining Some Light on the Evolution of BlackHole
• Project 53
• Smart TV Security
• Godel's Gourd - Fuzzing for Logic Issues
• MS SQL Post Exploitation Shenanigans: You're In, Now What?
• Analysis of a Windows Kernel Vulnerability; From Espionage to Criminal Use
• UPnP Vulnerabilities

Vídeos de la Shmoocon 2013



Ya están disponibles los vídeos de la Shmoocon 2013. Otra conferencia de seguridad de gran calidad que se celebró el pasado 15-17 de febrero en Wahington DC.

• Opening Remarks & Rants
• How to Own a Building BacNET Attack Framework
• Mainframed The Secrets Inside that Black Box
• WIPE THE DRIVE - Techniques for Malware Persistence
• Apple iOS Certificate Tomfoolery
• Hide and Seek, Post-Exploitation Style
• Hackers get Schooled Learning Lessons from Academia
• Friday Fire Talks
• Running a CTF - Panel on the Art of Hacker Gaming
• C10M Defending The Internet At Scale
• Paparazzi Over IP
• DIY Using Trust to Secure Embedded Projects
• Moloch A New And Free Way To Index Your Packet Capture Repository-1
• OpenStack Security Brief
• Generalized Single Packet Auth for Cloud Envions
• From Shotgun Parsers to Better Software Stacks
• The Computer Fraud and Abuse Act Swartz, Auernheimer, and Beyond
• Malware Analysis Collaboration Automation & Training
• Bright Shiny Things Intelligent DA Control
• Strategies of a World Class Security Inciden
• Armoring Your Android Apps
• Protecting Sensitive Information on iOS Devices
• Beyond Nymwars - Online Identity Battle
• How Smart Is BlueTooth Smart
• Chopshop Busting the Gh0st
• The Cloud - Storms on the Horizon
• 0wn The Con
• PunkSPIDER Open Source Fuzzing Proj Tgting the Internet
• Crypto - Youre Doing It Wrong
• Identity Based Internet Protocol
• NSM and more with Bro Network Monitor
• These Go To Eleven - When the Law Goes Too Far
• Forensics - ExFat Bastardized for Cameras
• Page Fault Liberation Army or Better Security Through Trapping
• Hacking as an Act of War
• MASTIFF - Automated Static Analysis Framewor
• Attacking SCADA Wireless Systems
• Ka-Ching - How to Make Real Money
• Is Practical Info Sharing Possible

Presentaciones de Black Hat Europe 2013



Ya tenemos disponible para descarga las presentaciones de la Black Hat 2013 Europe:

• A Perfect CRIME? Only TIME Will Tell White Paper Presentation
• Advanced Heap Manipulation in Windows 8 Presentation
• Building a Defensive Framework for Medical Device Security
• The Deputies Are Still Confused White Paper Presentation
• DropSmack: How Cloud Synchronization Services Render Your Corporate Firewall Worthless White Paper Presentation File File
• Floating Car Data from Smartphones: What Google and Waze Know About You and How Hackers Can Control Traffic White Paper Presentation
• Hacking Appliances: Ironic exploitation of security products White Paper Presentation
• Hacking Video Conferencing Systems White Paper Presentation
• Hardening Windows 8 apps for the Windows Store White Paper
• Harnessing GP²Us - Building Better Browser Based Botnets Presentation
• Honeypot That Can Bite: Reverse Penetration White Paper Presentation
• Hybrid Defense: How to Protect Yourself From Polymorphic 0-days White Paper Presentation File
• Invisibility Purge – Unmasking the Dormant Events of Invisible Web Controls – Advanced Hacking Methods for Asp.Net, Mono and RIA Presentation File File File File
• Let's Play - Applanting White Paper Presentation
• Mesh Stalkings-Penetration Testing with Small Networked Devices White Paper Presentation
• Multiplayer Online Games Insecurity White Paper Presentation
• Off Grid communications with Android - Meshing the mobile world White Paper Presentation
• Practical Attacks Against MDM Solutions White Paper Presentation
• Power Analysis Attacks for Cheapskates White Paper Presentation File
• Practical Exploitation Using A Malicious Service Set Identifier (SSID) White Paper Presentation
• The Sandbox Roulette - Are You Ready For The Gamble? Presentation
• XML Out-of-Band Data Retrieval White Paper Presentation
• Who's Really Attacking Your ICS Devices? White Paper Presentation
• Advanced iOS Application Pentesting Presentation
• Application Development Secure Coding Workshop Presentation
• Assessing BYOD with the Smartphone Pentest Framework White Paper Presentation
• PowerShell for Penetration Testers Presentation
• Vehicle Networks Workshop Presentation

Carl Sagan, Stephen Hawking y Arthur C. Clarke juntos hablando sobre Dios y el Universo

Perfecto para después de ver er docu der finde :), documento histórico.

Visto en io9

Presentaciones de la Linux Embedded Conference 2013



El pasado 20-22 de febrero se celebró en California la Linux Embedded Conference 2013. Un conferencia enfocada a los sistema Linux embebidos o empotrados. Si te interesan estos temas, ya puedes acceder a las presentaciones que se dieron:

• dventures in (simulated) Asymmetric Scheduling - Pantelis Antoniou, Antoniou Consulting (View Slides)
• Embedded Linux Takes on the Hard Problems of Automotive - Alison Chaiken, Mentor Embedded Software Division (View Slides)
• RFC: Obtaining Management Buy-in for Mainline Development - Kevin Chalmers, Texas Instruments, Inc. (View Slides)
• Common Clock Framework: How to Use It - Gregory Clement, Free Electrons (View Slides)
• System-wide Memory Management without Swap - Howard Cochran, Lexmark International (View Slides)
• Survey Of Linux Kernel Debugging Techniques - Kevin Dankwardt, K Computing (View Slides)
• Using GStreamer for Seamless Off-loading Audio Processing to a DSP - Ruud Derwig, Synopsys (View Slides)
• Extending the swsusp Hibernation Framework to ARM - Russell Dill, Texas Instruments, Inc. (View Slides)
• Pre-built Binary Toolchains in Yocto Project - Denys Dmytriyenko, Texas Instruments, Inc. (View Slides)
• Target Communication Framework: One Link to Rule Them All - Anna Dushistova (View Slides)
• Namespaces for Security - Jake Edge, LWN.net (View Slides)
• FIT Image Format: Inspired by Kernel's Device Tree Interface - Joel Fernandes, Texas Instruments, Inc. (View Slides)
• Gentoo-Bionic: We Can Rebuild Him. Better. Stronger. Faster. - Christopher Friedt, Research In Motion (View Slides)
• Kernel Dynamic Memory Allocation Tracking and Reduction - Ezequiel Alfredo Garcia, VanguardiaSur (View Slides)
• Working Together to Accelerate Linux Development - George Grey, CEO, Linaro (View Slides)
• The 'Embedded Problem' as Experienced by Intel's Reference Phones - Mark Gross, Intel/MCG/PSI (View Slides)
• Building a Custom Linux Distribution with the Yocto Project - Sean Hudson, Mentor Graphics (View Slides)
• olibc: Another C Runtime Library for Embedded Linux - Jim Huang, 0xlab (View Slides)
• Anatomy of the arm-soc git tree - Olof Johansson, Google (View Slides)
• Leveraging Linux - Code Coverage for Post-Silicon Validation - Mehdi K., UBC Integrated Systems Design Lab (View Slides)
• How to Build Your Own Digital Signage Solution with Yocto Project - Nitin Kamble, Intel Corporation (View Slides)
• Deadline Miss Detection with SCHED_DEADLINE - Yoshitake Kobayashi, TOSHIBA Corporation (View Slides)
• Tips of Malloc and Free - Tetsuyuki Kobayashi, Kyoto Microcomputer (View Slides)
• The OpenEmbedded Project 2 Years After Adopting the Yocto Project - Koen Kooi, Circuitco Electronics (View Slides)
• An Insight into the Advanced XIP Filesystem (AXFS) - Aaditya Kumar, Sony India Software Centre Pvt Lltd (View Slides)
• Toybox: Writing a new Linux Command Line from Scratch - Rob Landley, Multicelluar (View Slides)
• Debugging on a Production System - Tristan Lelong, Adeneo Embedded (View Slides)
• Optimizing GStreamer Video Plugins: A Case Study with Renesas SoC Platform - Katsuya Matsubara, IGEL Co., Ltd. (View Slides)
• Security Best Practices for Embedded Systems - John Mehaffey, Mentor Graphics (View Slides)
• Making Gadgets Really "cool"€™ - Noor UI Mubeen, Intel Technology India Pvt Ltd (View Slides)
• How to Cook the LTSI Kernel with Yocto Recipe - Hisao Munakata, Renesas Electronics (View Slides)
• Task Scheduling for Multicore Embedded Devices - Gap-Joo Na, Electronics and Telecommunications Research Institute (ETRI) (View Slides)
• Making Gadgets Really "cool"€™ - Noor UI Mubeen, Intel Technology India Pvt Ltd (View Slides)
• Application Diversity Demands Accelerated Linux Innovation - Mark Orvek, Linaro (View Slides)
• Your New ARM SoC Linux Support Checklist! - Thomas Petazzoni, Free Electrons (View Slides)
• Anatomy of an Embedded KMS Driver - Laurent Pinchart, Ideas on board SPRL (View Slides)
• In Kernel Switcher: A Solution to Support ARM's New big.LITTLE Implementation - Mathieu Poirier, Linaro (View Slides)
• Kernel Testing Tools and Techniques - Matt Porter, Texas Instruments, Inc. (View Slides)
• Bringing kconfig to EGLIBC - Khem Raj, OpenEmbedded (View Slides)
• Making Linux do Hard Real-Time - Brent Roman, Monterey Bay Aquarium Research Institute (View Slides)
• Understanding PREEMPT_RT (The Real-Time Patch) - Steven Rostedt, Red Hat (View Slides)
• Using and Understanding the Real-Time Cyclictest Benchmark - Frank Rowand, Sony Network Entertainment (View Slides)
• Designing for Optimisation - Mans Rullgard, ARM / Linaro (View Slides)
• Code Sweat: Embed with Nightmares - Dave Stewart, Intel (View Slides)
• LLVMLinux: Compiling the Linux Kernel with LLVM - Behan Webster, Converse in Code Inc. (View Slides)
• uCLinux For Custom Mobile Devices - Hunyue Yau, HY Research LLC (View Slides)

Vídeos de la FOSDEM 2013



La FOSDEM es una conferencia donde grupos o comunidades se reúnen para compartir ideas, charlas, etc sobre Open Source. Este año se celebró los días 2 y 3 de febrero en Bruselas.

La lista de los vídeos disponibles es la siguiente:

• adhearsion.webm
• ARM_v7_State_of_the_Body.webm
• ARMv8,_ARM’s_new_architecture_including_64_bit.webm
• A_method_for_distributing_applications_independent_from_the_distro.webm
• Being_a_good_upstream___the_syslog_ng_PoV.webm
• Bootstrapping_Debian_based_distributions_for_new_architectures.webm
• Bootstrapping_the_Debian_Ubuntu_arm64_ports.webm
• BuildSys_and_QA_in_CentOS_using_a_Private_Cloud__OpenNebula.webm
• Building_RPM_packages_from_Git_repositories_with_git_buildpackage.webm
• Can_Linux_network_configuration_suck_less_.webm
• Debian_Med___a_Debian_Pure_Blends_for_medical_care_and_microbiological_research.webm
• Distributing_TeX_and_Friends___methods,_pitfalls,_advise.webm
• Emdedded_distro_shootout__buildroot_vs._Debian.webm
• Eudev.webm
• Gentoo_BoF.webm
• Gentoo_Hardened.webm
• How_do_we_make_Qt_on_Mer_the_solution_of_choice_for_device_vendors_.webm
• Incompatibility_and_Pain___a_perspective_from_upstream.webm
• Make_Debian_compiler_agnostic___Building_Debian_with_LLVM_Clang.webm
• Package_management_and_creation_in_Gentoo_Linux.webm
• Raindrops.webm
• Stable_kernel_maintenance_for_distributions.webm
• Understanding_GNOME_internals_to_administrate_desktop_Debian_machine.webm
• Why_you_no_host_.webm
• lmonade.webm
• openSUSE_on_ARM.webm
• systemd_in_Debian.webm
• A_high_level_language_for_low_level_code.webm
• Actionaz__Automation_for_everyone.webm
• Arduino__from_prototype_to_final_product.webm
• BIND_10__DNS_by_Cooperating_Processes.webm
• Borderlands,_Granular_Sequencer.webm
• Cloudeebus.webm
• Coding_Gouter.webm
• Crypto.cat.webm
• Do_you_want_to_measure_your_project_.webm
• EDE,_a_light_desktop_environment.webm
• EasyTAG.webm
• Fipes.webm
• FluxBB.webm
• How_to_hack_on_Wikipedia.webm
• I_m_Luvin__It.webm
• Jazzperiments.webm
• Kolab_Groupware.webm
• Managing_your_metal_flexibly.webm
• Phone_liberation_parties.webm
• Protocols_Are_Everywhere__RE_with_Netzob.webm
• STAR__a_Python_Pandas_dressing.webm
• Searduino___Arduino_simulator_and_C_C___devel_environment.webm
• Spoiling_and_Counter_spoiling.webm
• The_C2_programming_language.webm
• The_LLVMLinux_Project.webm
• The_development_infrastructure_of_the_TYPO3_project.webm
• Tracy.webm
• Using_Gerrit_Code_Review_in_an_open_source_project.webm
• Vehicular_traffic_estimation_through_bluetooth.webm
• Vendorificator.webm
• ZONE__towards_a_better_news_feed.webm
• blkreplay.webm
• eGov_Testing_Machine_to_ensure_Free_Software_users_freedom_to_access_eGovernment_services.webm
• eTests.webm
• naxsi,_an_open_source_web_application_firewall_for_nginx.webm
• pystemon.webm
• Closing_FOSDEM_2013.webm
• Firefox_OS.webm
• Free,_open,_secure_and_convenient_communications.webm
• FreedomBox_1.0.webm
• Has_the_GNOME_community_gone_crazy_.webm
• How_to_build_an_Identity_Management_System_on_Linux.webm
• How_we_made_the_Jenkins_community.webm
• Keccak,_More_Than_Just_SHA3SUM.webm
• LibreOffice__cleaning_and_re_factoring_a_giant_code_base.webm
• Practical_Security_for_developers,_using_OWASP_ZAP.webm
• Samba4.webm
• The_Devil_is_in_the_Details.webm
• The_Keeper_of_Secrets.webm
• Trends_in_Open_Source_Security.webm
• Welcome_to_FOSDEM_2013.webm
• systemd,_Two_Years_Later.webm
• ARM_support_in_the_Linux_kernel.webm
• Aldebaran_Robotics_and_Open_Source.webm
• Maintaining_a_kernel_subsystem.webm
• Open_ARM_GPU_drivers.webm
• Porting_Fedora_to_64_bit_ARM_systems.webm
• ROS__towards_open_source_in_robotics.webm
• Scaling_PHP_with_HipHop.webm
• Static_site_generation_for_the_masses.webm
• The_Anykernel_and_Rump_Kernels.webm
• UEFI_SecureBoot.webm
• Vroom__Free_Software_in_your_car.webm

Fuente

Vídeos de las Firetalks de ShmooCon 2013



Más vídeos de los que nos gustan. Estos son concretamente las Firetalks de la edición de este año de ShmooCon:

• “Thin Slicing a Black Swan: A Search for the Unknowns” by Michele “@mrsyiswhy” Chubirka & Ronald Reck
• “When Did the Smartphone Pentest Framework Get Awesome?” by by Georgia “@georgiaweidman” Weidman
• “ShellSquid: Distributed Shells With Node” by Tom Steele
• “If You Can Open The Terminal, You Can Capture The Flag: CTF for Everyone” by Nicolle “@rogueclown” Neulist
• “Becoming a Time Lord – Implications of Attacking Time Sources” Joe “@joeklein” Klein
• “Swinging Security Style: An Immodest Proposal” by Wendy “@451wendy” Nather
• “Drones: Augmenting your cyber attack tool bag with aerial weapon systems” by Zac “@ph3n0” Hinkel
• “Managed Service Providers: Pwn One and Done” Damian “@integrisec” Profancik
• “No Tools? No Problem! Building a PowerShell Botnet” Christopher “@obscuresec” Campbell
• “Extending the 20 Critical Security Controls to Gap Assessments and Security Maturity Modelling” John “@pinfosec” Willis
• “Protecting Big Data From Cyber APT in the Cloud” Bill “@oncee” Gardner
• “Writing a Thumbdrive for Active Disk Antiforensics” Travis “@travisgoodspeed” Goodspeed

Fuente

Vídeos de la linux.conf.au 2013



Del 28 de enero al 2 de febrero tuvo lugar la edición 2013 de la ya conocida conferencia sobre linux australiana, en la ciudad de Canberra. La lista de los vídeos disponibles hasta el momento es la siguiente:

• 3D_Printing_with_Repsnapper.mp4
• 15MW_and_3600_penguins_in_a_room_Supercomputing_at_ANU.mp4
• A_New_Linux_Platform_Hardware_and_Software.mp4
• After_Arduino.mp4
• Aint_No_Party_Like_A_Unix_Party.mp4
• An_Introduction_to_Linux_IPC_Facilities.mp4
• ArduSat_Open_Source_in_orbit.mp4
• Arduino_Miniconf_Afternoon.mp4
• Arduino_Miniconf_Morning.mp4
• Beyond_Alt_Text_What_Every_Project_Should_Know_About_Accessibility.mp4
• Big_and_Little_Endian_inside_out.mp4
• Bufferbloat_from_a_Plumbers_point_of_view.mp4
• Building_Persona_federated_and_privacysensitive_identity_for_the_Web.mp4
• Building_a_free_software_telemetry_radio_system.mp4
• CWDM_Coarse_Wave_Division_Multiplexing.mp4
• Ceph_Managing_A_Distributed_Storage_System_At_Scale.mp4
• Ceph_object_storage_block_storage_file_system_replication_massive_scalability_and_then_some.mp4
• Checkpoint_and_Restore_are_we_there_yet.mp4
• Code_up_your_own_video_conference_in_HTML5.mp4
• Communicating_with_third_parties.mp4
• Concurrent_Programming_with_the_Disruptor.mp4
• Conference_Closing.mp4
• Conference_Closing_Lightning_Talks.mp4
• Configuration_Management_with_Ansible.mp4
• Copyrights_Dark_Clouds_Optus_v_NRL.mp4
• Delivering_IaaS_with_Apache_CloudStack.mp4
• Designing_a_Verifiable_and_Accessible_Electronic_Voting_System.mp4
• Droids_that_talk_Pairing_Codec2_and_Android.mp4
• Free_and_open_source_software_and_activism.mp4
• Future_directions_for_the_X_Window_System.mp4
• Geeks_rule_over_kings_the_Distributed_Democracy.mp4
• Getting_older_Tips_tricks_for_designing_inclusive_open_source_user_interfaces.mp4
• Git_For_Ages_4_And_Up.mp4
• Git_not_just_for_source_code_anymore.mp4
• Graphics_from_Gamepads_Guitars_and_Gadgets_Galore.mp4
• Heat_Orchestrating_multiple_cloud_applications_on_OpenStack_using_templates.mp4
• How_Mozilla_draws_the_line_between_configuration_and_data_while_using_configuration_management_tools.mp4
• How_OSS_technology_to_help_UTSIT_to_build_a_virtualized_networking_lab.mp4
• How_to_Fix_a_Font.mp4
• How_to_make_almost_anything_go_faster.mp4
• How_to_use_Puppet_like_an_Adult.mp4
• Keynote_Andrew_Bunnie_Huang.mp4
• Keynote_Radia_Perlman.mp4
• LTTng_20_Advanced_Linux_tracing_for_everyone.mp4
• Lighting_up_OpenCV_with_Ne10_and_NEON.mp4
• Linux_Gaming_at_Last_Tuning_Open_Source_Graphics_Drivers_for_Valve_Software.mp4
• Linux_in_Defence.mp4
• Main_conference_opening.mp4
• Make_your_software_understand_your_nonUS_accent.mp4
• Making_Mobile_Communications_Secure.mp4
• Making_RCU_Respect_Your_Devices_Battery_Lifetime.mp4
• Making_UEFI_Secure_boot_work_for_you.mp4
• Maximum_Clojure_Performance.mp4
• Measuring_and_Improving_OpenGL_Performance.mp4
• MySQL_Security.mp4
• MySQL_in_the_cloud_as_a_service.mp4
• NetFPGA_USB_2_interface.mp4
• NovaProva_or_How_I_Did_Six_Impossible_Things_Before_LCA.mp4
• OWASP_Developer_Guide_2013_what_it_means_for_open_source_projects.mp4
• OpenStack_Zuul.mp4
• Open_Source_Digital_Radio.mp4
• Open_Source_Firmware.mp4
• Open_Source_and_Open_Data_for_Humanitarian_Response_with_OpenStreetMap.mp4
• Openstack_on_Openstack_a_single_management_API_for_all_your_servers.mp4
• Operating_in_an_Ephemeral_World.mp4
• Ops_from_bare_metal_to_cloud_space.mp4
• OzLabs.org_Administering_a_system_for_smart_people.mp4
• Panel_Where_in_the_stack_does_security_belong.mp4
• Playing_with_OpenStack_Swift.mp4
• Ponies_and_Rainbows_Clutter_20_and_GTK_40.mp4
• PostgreSQL_92_Full_Throttle_Database.mp4
• Pre_dinner_thingy_robert_llewellyn_and_simon_hackett.mp4
• Quantitative_community_management.mp4
• Qubes_OS.mp4
• Quiltwork_patch_deployment_in_nz_and_au.mp4
• RAID_is_more_than_parity_and_mirrors.mp4
• REPENT_FOR_THE_END_OF_THE_UNIX_EPOCH_IS_NIGH.mp4
• RealTime_Response_on_Multicore_Systems_It_Is_Bigger_Than_I_Thought.mp4
• Rethinking_CPU_hotplug_for_elegance_and_efficiency.mp4
• Ript_a_terse_but_expressive_DSL_for_iptables.mp4
• Ristretto_runtime_types_for_JavaScript.mp4
• Samba_4.0.mp4
• Scratching_your_own_itch_subsurface_diving_log.mp4
• Security_Miniconf_Afternoon.mp4
• Security_Miniconf_Morning.mp4
• Security_Models_Running_Amok.mp4
• Shell_for_Starters.mp4
• Software_Transactional_Memory_in_GCC_47.mp4
• Stereographic_film_making_and_Linux.mp4
• Systems_Administration_Server_and_Process_Behavior.mp4
• Syzix_heading_off_the_beaten_PATH.mp4
• Teaching_Robotics_and_Embedded_Computing_with_Legos_and_Arduino.mp4
• Teaching_the_X_server_new_tricks.mp4
• The_Finer_Art_of_Being_a_Senior_Sysadmin.mp4
• The_IPocalypse_20_months_later.mp4
• The_Perl_Renaissance.mp4
• The_Raspberry_Pi_and_Linux.mp4
• The_anatomy_of_a_high_speed_data_acquisition_system.mp4
• The_future_of_nonvolatile_memory.mp4
• The_real_story_behind_Wayland_and_X.mp4
• Theres_a_Party_In_Your_Box_And_Everyones_Invited.mp4
• Think_Create_Critique_Design.mp4
• Touch_and_Go_Modern_User_Interfaces_with_Open_Source.mp4
• Tracking_Vulnerable_JARs.mp4
• Transcendent_Memory_Not_Just_for_Virtualization_Anymore.mp4
• Trinity_A_Linux_kernel_fuzz_tester_and_then_some.mp4
• Trusted_Computing_and_Hadoop_HDFS.mp4
• Two_years_of_LibreOffice.mp4
• Two_years_with_Sambas_autobuild.mp4
• UEFI_the_Converged_Firmware_Infrastructure.mp4
• Using_Puppet_to_Model_Application_clusters.mp4
• Using_open_source_in_over_1100_schools_in_New_Zealand.mp4
• Vampire_Mice_How_USB_PM_impacts_you.mp4
• Why_kernel_space_sucks.mp4
• Wiggle_while_you_work.mp4
• Zombie_pancakes_rebooting_Flapjack.mp4
• Zuul.mp4
• aeolus.mp4
• asynchronous-block-storage-replication-mars-light.mp4
• gitannex.mp4
• grand-distributed-storage-debate-glusterfs-and-ceph-going-head-head.mp4
• jorn-and-rise-and-fall-clustering.mp4
• mariadb-galera-cluster.mp4
• mongodb-replication-replica-sets.mp4
• openstack-swift-overview.mp4
• ovirt.mp4
• redgrep_from_regular_expression_derivatives_to_LLVM.mp4
• tuesday_keynote_mikal_introduction.mp4
• users_delighted_better_UX_using_CSS_3_in_particular_and_HTML5_in_general.mp4
• vms-vlans-bridges-bonds-many-nics.mp4

Fuente

Vídeos de la World of Commodore 2012



Aquí tenéis algunos vídeos de la Commodore World 2012 celebrado en Ontario, Canadá el pasado mes de diciembre de 2012:

• M.U.L.E. Returns (Matt Brudzynski, Comma8 Studios)
• Ultimate Modded VIC-20 (Leif Bloomquist)
• RETRO Innovations (Jim Brain)
• Hello Amiga (Part 1/2)
• Hello Amiga (Part 2/2)
• MIDI in FastFingers (Dan Laskowski)
• Coding a Demo (Dan Kovacs)
• PETSynth 2.0 (Chiron Bramberger)

Los del Amiga y el de Coding a demo, no me los pierdo :)

Fuente

Material de la THREADS 2012

Dan Guido

THREADS es una pequeña conferencia sobre seguridad organizada por Dan Guido y Dino Dai Zovi (dos de los fundadores de trailofbits.com) con la ayuda de estudiantes de ciber seguridad.

Esta conferencia se enfoca en la presentación de investigaciones académicas e industrial en el ámbito de la seguridad informática y las redes.

En la pasada THREADS 2012 se dieron las siguientes charlas:

	Opening Remarks [video]
	Executive Overview: NYU-Poly & Mobile Security [video] [slides]
	iOS Jailbreak Analysis [video] [slides]
	Mobile Exploit Intelligence Project [video] [slides]
	Probing Mobile Operator Networks [video] [slides]
	A Tale of Mobile Threats [video] [slides]
	Analysis of the Google Native Client Sandbox [paper] [slides]
	Mobile Vulnerability Assessment: There's an App for That [website] [blog]

Vídeos de las charlas del 29C3 con mini-microhistoria incluida



Ya están disponibles los vídeos de las charlas de la que para mi, es la mejor conferencia sobre seguridad/hacking del mundo. El Chaos Communication Congress ha celebrado este pasado fin de semana su conferencia número 29. Ésta se celebró por primera vez fuera de Berlín, en Hamburgo.

Este año la conferencia llevaba por título: Not my department. El motivo del mismo es hacer una crítica y un llamamiento a la responsabilidad. El origen de Not my department, realmente viene de la letra de una canción (Wernher Von Braun) escrita por Tom Lehrer. La canción dice:

Material de la hashday 2012



Hashdays es otra de las muchas conferencias sobre seguridad que se celebran alrededor del mundo. Ésta se celebró entre el 31 de octbre y el 3 de noviembre en Suiza. Esta es la lista del material que se ha liberado hasta el momento:

Openning Slide Keynote Video Tactical Surveillance: Look at me now! Slide Video Please insert^H inject more coins Slide Video IPv6 Insecurity Revolutions Slide Video Guns and Smoke to Defeat Mobile Malware Slide Video Selfdefending Databases Slide Video SHA-3 Slide Video Things one wants from a Heap Visualization Tool Slide Video The Security (or Insecurity) of 3rd Party iOS Applications Slide Video Ghost is in the Air(Traffic) Video Satellite Hacking: An Introduction Slide Video Reboot, Reconstruct, Revolt: Transitioning to a Modern Approach to Risk Management Slide Video Firewall Rule Reviews - Methodologies and Possibilities Slide Video Breaking SAP Portal Slide Video A review of the virtual world, cloud and a new sphere in the hacking paradigm Slide Video Binary art: Byteing the PE that fails you Slide Slides Extended Video Adding temporal component to memory forensics Video Physical Drive-By Downloads Video NIDS/NIPS Testing Slide Video NFC: I don't think it means what you think it means Slide Video Dissecting the Induc Virus Slide Video Why your intrusion detection system sucks and what to do about it Slide Video Data Correlation - Why keep this valuable information in a corner Slide Video So, the red team was here and tore us a new one. NOW WHAT? Slides Video Holistic Server Security Slides Video Secure Session Data Storage Slides Video Crowd-sourced Radiation Monitoring Slides Closing ceremony Slides Video

Vídeos del Qt Developers Day Berlín 2012



Qt Developer Days Berlín 2012 es la novena conferencia celebrada en Europa. Esta conferencia se enfoca en todo lo que envuelve a Qt. Para los despistados, Qt son las librerías sobre las que está construido KDE o MeeGo entre otros.

Esta es la lista de vídeos disponible:

• QtDD12 - Welcome - Kalle Dalheimer
• QtDD12 - Accessible Applications with Qt - Frederik Gladhorn
• QtDD12 - Accessing middleware from Qt, QML or HTML5 - Dr. Eva Brucherseifer
• QtDD12 - BlackBerry 10 Cascades UI Framework: A Different Take - Markus Landin
• QtDD12 - CMake with Qt - Stephen Kelly
• QtDD12 - Connecting your BlackBerry 10 app to the network - Peter Hartmann
• QtDD12 - Creating Mac GUIs with Qt - James Turner
• QtDD12 - Creating Window Compositors with the QtWayland module - Andy Nichols
• QtDD12 - Creator 101 - Tobias Hunger
• QtDD12 - Debugging multithreaded Qt programs - David Faure
• QtDD12 - Desktop Components for QtQuick - Jens Bache-Wiig
• QtDD12 - Developing with Qt for the BlackBerry 10 - Vladimir Minenko
• QtDD12 - Domain Specific Debugging Tools - Volker Krause
• QtDD12 - Effective QML: Best practices for Developing with Qt Quick - Adenilson Calvacanti
• QtDD12 - How Qt Helped RIM Build BlackBerry 10 - Jeff Kehres
• QtDD12 - In Depth - QMetaType and QMetaObject - Stephen Kelly
• QtDD12 - Innovating in Automotive Infotainment with QtQuick - Johan Thelin
• QtDD12 - Intentions good, warranty void: Using Qt in unexpected ways - Till Adam + Mirko Boehm
• QtDD12 - Making the correct license choice when developing with Qt - Topi Ruotsalainen
• QtDD12 - Modern Shader-based OpenGL Techniques - Dr. Sean Harmer
• QtDD12 - OpenGL with Qt 5 - Dr. Sean Harmer
• QtDD12 - Panel discussion: The Future of Qt
• QtDD12 - Porting an existing Qt Windows App to Mac - Sven Bergner
• QtDD12 - Porting Qt 5 to embedded hardware - Thomas Senyk
• QtDD12 QML Coding, Performance and Debugging: Usage of Tools - Aurindam Jana
• QtDD12 - Qt 5 Roadmap - Lars Knoll
• QtDD12 - Qt addons for everyone: KDE Frameworks 5 - David Faure
• QtDD12 - Qt and Cloud Services - Sami Makkonen
• QtDD12 - Qt and the Google APIs - Roland Krause
• QtDD12 - Qt and the upcoming BlackBerry 10 Platform - Alec Saunders
• QtDD12 - Qt and WebServices - Dr. Tim Dewhirst
• QtDD12 - QtCore in Depth - Olivier Goffart
• QtDD12 - Qt on Raspberry Pi - Jeff Tranter
• QtDD12 - QtQuick under the hood - Thomas McGuire
• QtDD12 - Qt Surprises - Eirik Chambe-Eng
• QtDD12 - Serving QML applications over the network - Jeremy Laine
• QtDD12 - SoDeclarative - Helmut Sedding and Michael T. Wagner
• QtDD12 - The middleware problem: a tale of abstraction - Dario Freddi
• QtDD12 - The project that brings you Qt - Thiago Macieira
• QtDD12 - The Qt partnership program - Kristen Tveter
• Using C++11 to speed up your Qt 5 programs Marc Mutz
• QtDD12 - Using Qt as mobile cross-platform system - Tam Hanna
• QtDD12 - Using SSL the right way with Qt - Richard J. Moore
• QtDD12 - What's New in QtWebKit in 5.0 - Simon Hausmann
• QtDD12 - Why you should be excited by Qt 5 - Thiago Macieira
• QtDD12 - The Future of Qt on Embedded Linux - Lars Knoll

 

Material del Lua workshop 2012



Aquí tenemos algunos vídeos y diapositivas de la mayoría de las presentaciones dadas en el Lua Workshop 2012:

• Textadept - Behind the Scenes Slides Video
• Crazy Ivan - Lua Driven Robots Video
• Gemini - An Open Source Library for Game Development on iOS Using Lua Slides Video
• picoDB: a no-SQL database tool for eLua Slides Video
• Luerl, a Lua VM written in Erlang Video
• LuaFlow - An Open Source Lua OpenFlow Controller Video
• Lua multi VM system for home automation Slides Video
• Building a Lua Based Platform (Luvit) Slides Video
• Small Team, Huge Game, and Lua Video
• What is Next for Lua? A Personal Perspective Slides Video
• Incrementally developing and implementing Hirschberg's longest common subseqence algorithm using Lua Slides Video
• Adding an Lua-based integrated character-based menu system into the SciTE editor Slides Video
• Integrating Lua for fun and profit: Vim's if_lua and PostgreSQL's PL/Lua Video
• Make Your Own M2M Application, in a 1/2 Hour, with Lua Video
• Using Lua for Integration with a specialized IDE Slides Slides Video
• Lua Q&A Session with Roberto Ierusalimschy Video

Todas las charlas TED fáciles de acceder sólo con un click



Realmente es un fichero de Google Docs, en concreto una hoja de cálculo que incluye el enlace para el vídeo, el ponente, el nombre de la charla y un pequeño sumario de esta. Hay de momento, 1395 charlas ordenadas en esta lista.

Fantástico para ver rápidamente y localizar charlas TED.

Y recuerda, puedes poner en castellano todas las charlas usando el botón "show transcript".



Vídeos de la RootedCON



Ya están disponibles los vídeos del archiconocido congreso de seguridad RootedCON. Éste celebró en Madrid entre 1 y 3 de marzo. Ya han pasado unos meses, pero más vale tarde que nunca y para los que no tuvimos el privilegio de asistir ahora podemos disfrutar de dichas charlas:

• RootedForge: Alternet - Borja Berastegui
• Raúl Siles y José A. Guasch - Seguridad Web de aplicaciones basadas en DNI-e
• Manu Quintans y Frank Ruiz - All Your Crimeware Are Belong To Us!
• RootedForge: LoadBalancer Finder - Alejandro Nolla
• RootedPanel - Fuerzas y Cuerpos de Seguridad del Estado
• Jaime Peñalba y Javier Rodríguez - Live Free or Die Hacking
• Eloi Sanfélix y Javier Moreno - Hardware hacking on your couch
• RootedForge: Fingerprinting Tor – Pablo Carballude
• RootedForge: OFAMIS - Pablo González
• RootedForge: RootedBabel – Organización Rooted
• RootedForge: Yet Another Repetitive Rootkit – David Luengo
• José Picó y David Pérez - Nuevos escenarios de ataque con estación base falsa GSM/GPRS
• Hugo Teso - Inguma 0.5 Red Wagon
• Sebastián Guerrero - Pimp Your Android
• RootedPanel - Congreso de seguridad No cON Name
• Gerardo García Peña - Enfoque práctico a la denegación de servicio
• Ricardo J. Rodríguez - Mejora en el Proceso de Desempacado usando Técnicas DBI
• Pablo San Emeterio - WHF: Windows Hooking Framework
• Lorenzo Martínez - Welcome to your secure /home, $user
• Organización RootedCON - Charla inaugural
• Carlos Díaz y Fco. Jesús Gómez - CMD: Look who's talking too
• Chema Alonso y Manu "The Sur" - Owning “bad” guys {and mafia} with Javascript botnets
• Yago Jesús - Applied Cryptography FAILs
• Pedro Sánchez -Hospital Central. Historia de una extorsión
• José Miguel Esparza y Mikel Gastesi - Social Engineering in Banking Trojans: Attacking the weakest link ]
• Guillermo Grande y Alberto Ortega - Building an IP reputation engine, tracking the miscreants
• Luis Delgado - XMPP, algo más que chat
• Lord Epsylon - XSSer, the cross site scripting framework
• Juan Garrido - Corporate Forensics. Saca partido a tu arquitectura

Diapositivas de las Hacker Halted USA 2012



Ya están disponible para descarga las presentaciones de la Hacker Halted USA 2012 celebrada en Miami el pasado mes de octubre.

•   Hackers: Responsibility and Reality - Jack Daniel
•   Using Information Superiority to win the Cybersecurity Battle - Matt Watchinski
•   Strategies for Web Application Security at Scale - Jeremiah Grossman
•   Active Defense - David Willson
•   Building a Cyber Range - Kevin Cardwell
•   Hacking The Big 4 Databases - Josh Shaul
•   Attacking Apache Reverse Proxy - Prutha Parikh
•   Breaking SAP Portal - Dmitry Chastuhin
•   Bring Your Own Destruction - Aamir Lakhani
•   How to successfully get your Cloud through FedRAMP, PCI, & HIPAA - Tom McAndrew & Hemma
•   Prafullchandra
•   Riding on Cloud 9 – Holistic Security for a Euphoric Cloud Experience - Freddie Beaver
•   Architecting and Building a Secure Virtual Infrastructure and Private Cloud - Rob Randell
•   FedRAMP - How the Feds Plan to Manage Cloud Security Risks - Steven Fox
•   Security and Software-Defined Networks - Michael Berman
•   Advanced Industrial Espionage Attacks - Gianni Gnesa
•   Bulletproof IT Security - Gary Miliefsky
•   Go with the Flow: Strategies for Successful Social Engineering - Chris Silvers
•   House of Cards - How not to collapse when bad things happen - Rafal Los
•   Physical Drive-by Downloads – An Android Modders Weakness - Kyle Osborn
•   The Persistent Threat of Mobile Apps – Why Continuous Testing is Key - John Weinschenk
•   Zombie Browsers, spiced with rootkit extensions - Zoltan Balazs
•   Military Targeting Adapted for Hacking - Rock Stevens
•   Own the Network – Own the Data - Paul Coggin
•   Advanced Persistent Pentesting: Fighting Fire with Fire - Jonathan Cran
•   DGAs and Cyber-Criminals: A Case Study - Christopher Elisan
•   Spawnning Reverse Shell With Any IP, Any Time! - Merchant Bhaumik
•   Hacking SCADA Systems - 2011 Year in Review - Jonathan Pollet

Material de la LLVM noviembre 2012



La LLVM Compiler Infrastructure es una conferencia donde se tratan temas sobre compiladores. Actualmente este proyecto sirve como base para muchos otros subproyectos ampliamente usados por distintas empresas. Esta reunión ha sido la segunda llevada a cabo este año y se celebró en el mes de noviembre en San jose, California. Para los interesados en estos temas, ya tenéis disponible tantos vídeos como diapositivas de la mayoría de las charlas:

Vídeos de la AppSec USA 2012



Para que no te aburras este fin de semana y después de que hayas visto Er docu der finde, aquí tenéis el listado de los vídeos de la AppSec USA 2012 celebrada en Austin, Texas.

• Keynote - Securing Javascript - Douglas Crockford
• Cracking the Code of Mobile Application - Sreenarayan Ashokkumar
• Put Your Robots to Work: Security Automation at Twitter - Justin Collins, Neil Matatall, Alex Smolen
• Incident Response: Security After Compromise - Richard Bejtlich
• Exploiting Internal Network Vulns via the Browser using BeEF Bind - Michele Orru
• Web App Crypto - A Study in Failure - Travis H.
• Reverse Engineering Secure HTTP API's With an SSL Proxy - Alejandro Caceres and Mark Haase
• Gauntlt: Rugged by Example - Jeremiah Shirk, Mani Tadayon, James Wickett
• Effective Approaches to Web Application Security - Zane Lackey
• Building a Web Attacker Dashboard with ModSecurity and BeEF - Ryan Barnett
• Bug Bounty Programs - Michael Coates, Chris Evans, Jeremiah Grossman, Adam Mein, Alex Rice
• Four Axes of Evil - HD Moore
• Cross Site Port Scanning - Riyaz Walikar
• Top Ten Web Defenses - Jim Manico
• Keynote - Some Lessons from the Trenches- Michael Howard
• Hacking with Web Sockets - Vaagn Toukharian
• I>S+D! - Interactive Application Security Testing(IAST), Beyond SAST/DAST - Ofer Maor
• The Same-Origin Saga - Brendan Eich
• Real World Cloud Application Security - Jason Chan
• XSS & CSRF with HTML5 - Attack, Exploit and Defense - Shreeraj Shah
• Keynote- The State of OWASP - Tom Brennan, Michael Coates, Seba Deleersnyder, Eoin Keary, Matt Tesauro, David Wichers
• Analyzing and Fixing Password Protection Schemes - John Steven
• Unraveling Some of the Mysteries around DOM-Based XSS - Dave Wichers
• Mobile Applications & Proxy Shenanigans - Dan Amodio and David Linder
• The Application Security Ponzi Scheme: Stop Paying For Security Failure - Jarret Raim and Matt Tesauro
• Web Framework Vulnerabilties - Abraham Kang
• AppSec Training, Securing the SDLC, WebGoat.NET and the Meaning of Life - Jerry Hoff
• Keynote-InfoSec at Ludicrious Speed: Rugged DevOps and More - Gene Kim
• Builders vs. Breakers - Brett Hardin, Matt Konda, Jon Rose
• Get Off Your AMF and Don't REST on JSON - Dan Kuykendall
• Rebooting (Secure) Software Development with Continuous Deployment - Nick Galbreath
• SQL Server Exploitation, Escalation and Pilfering - Antti Rantasaari and Scott Sutherland
• Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews - Sherif Koussa
• How We Tear Into That Little Green Man - Matthew Rowley
• Blended Threats and JavaScript: A Plan for Permanent Network Compromise - Phil Perviance
• Hack your way to a degree: a new direction in teaching application security at universities - Konstantinos Papapanagiotou
• Using Interactive Static Analysis for Early Detection of Software Vulnerabilities - Bill Chu
• Security at Scale - Yvan Boily
• Origin(al) Sins - Alex Russell
• Counterintelligence Attack Theory - Fred Donavan
• WTF - WAF Testing Framework - Yaniv Azaria and Amichai Shulman
• Hacking .NET Applications: Reverse Engineering 101 - Jon McCoy
• The 7 Qualities of Highly Secure Software, Mano Paul
• Iran's Real Life Cyberwar - Phillip Hallam-Baker
• Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards - Juan Perez-Etchegoyen and Jordan Santarsieri
• Demystifying Security in the Cloud: AWS Scout - Jonathan Chittenden
• NoSQL, No Security? - Will Urbanski
• Pining for the Fjords: The Role of RBAC in Today's Applications - Wendy Nather
• Doing the Unstuck: How Rugged Cultures Drive Biz & AppSec Value - Josh Corman
• DevOps Distilled: The Devops Panel - Josh Corman, Nick Galbreath, Gene Kim, David Mortman, James Wickett
• Spin the Bottle: Coupling Technology and SE For One Awesome Hack - Dave Kennedy
• Building Predictable Systems Using Behavioral Security Modeling: Functional Security Requirements - John Benninghoff
• The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure - Shay Chen
• The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems - Dan Cornell and Josh Sokol
• Securing the SSL channel against man-in-the-middle attacks - Tobias Gondrom

Robo de datos en teléfonos inteligentes a través del jack de audio



En la MalCon se ha presentado una charla sobre el robo de datos de teléfonos inteligentes a través del jack de audio. Se incluyen iPhones, teléfonos Android, Blackberries y Windows Phone.

Según el investigador, Atul Alex, se podrían, de forma fácil, hacer llamadas telefónicas sin intervención del usuario, saber la duración de las llamadas, detectar la entrada y salida de llamadas, sms, etc. Y de una forma ya no tan fácil, también se podría grabar los números que se marcan a la hora de hacer una llamada, listar los nombres de la lista de contactos, grabar llamadas telefónicas, además todo se podría manejar de forma remota.

Presentaciones de la ZeroNights 2012



ZeroNights es otra conferencia de seguridad, ésta se celebró en Moscú el 19 y 20 de noviembre y han publicado todas las presentaciones que se dieron. Y para no perder la costumbre, aquí tenéis la lista de las mismas :)

• Soldatov, gotz how to catch your “hacker” or makeshift security
• Yarochkin, kropotov, chetvertakov tracking surreptitious malware distribution channels
• Sobolev typical information security flaws in corporations and large enterprises
• Samosadny mass csrf attacks via flash ads
• Kupreev 3 g modem infection
• Chastukhin, cherbov where is my car dude
• Evdokimov python arsenal for re
• Solar designer new developments in password hashing
• Troshichev i os mitm attack
• Tarakanov the art of binary diffing
• Sorokin mac os x malware overview
• Sintsov advanced exploitation in win32
• Shay chen the diviner - digital clairvoyance breakthrough - gaining access to the source code & server side memory structure of any application
• Reutov, yunusov, nagibin random numbers take ii
• Potapenko, vyukov forewarned is forearmed. a san and tsan
• Polyakov how i will break your enterprise. esb security and more
• Noseevich, petukhov no locked doors no windows barred. hacking open am infrastructure
• Matrosov, rodionov win32 flamer. reverse engineering and framework reconstruction
• Lyamin beyond the botnet
• Keynote the grugq opsec for russians
• Keynote fx try harder 2 be yourself
• Kettunen, miaubiz fuzzing at scale and in style
• Karasikov android behind the scenes
• Jurczyk windows kernel reference count vulnerabilities. case study
• Gregoire that's why i love xml hacking
• Firstov attacking mongo db
• Costin, francillon ghost is in the air(traffic)
• Boutin reversing banking trojan. an in-depth look into gataka
• Belenko, sklyarov dark and bright sides of i cloud (in)security
• Antisnatchor all you ever wanted to know about beef
• Abdullin modern payments security. emv, nfc, etc
• Vorontsov, golovko ssrf attacks and sockets. smorgasbord of vulnerabilities

Vídeos de la Øredev Developer Conference



La Øredev Developer Conference es como su nombre indica una conferencia orientada al desarrollo de ningún lenguaje o plataforma en particular. Dicha conferencia se celebró en Suecia entre el 5 y el 9 de noviembre. La lista de vídeos es la siguiente:

• Transform Your Agile Process with Kanban Thinking (Karl Scotland)
• The Rebellion Imperative (Reginald Braithwaite)
• Tailwind/Headwind in the pursuit of the Fibre to All (Jonas Birgersson)
• Nashorn: Optimizing JavaScript and dynamic language execution on the JVM (Marcus Lagergren)
• The Future of Work is about being more Human - Gamestorming (Maarten Volders)
• Android Burning Questions (Pavel Lahoda)
• Stupid questions and n00bs - top ten intriguing things you need to do (Iris Classon)
• Budgeting Reality: a New Approach to Mock Objects (Justin Searls)
• Managing Your Teams’ Agile Competency (Diana Larsen)
• Git Going with Distributed Source Control (Tim Berglund)
• Liftoff: Launching Agile Teams and Projects (Diana Larsen)
• Hypermedia and ASP.NET Web API, where do you want to go today? (Glenn Block)
• How RESTful Is Your REST? (Abdelmonaim Remani)
• My mom told me that Git doesn't scale (Vicent Marti)
• Lambdas in Java SE 8 or co-evolving libraries, the language and the VM (Joel Borggrén-Franck)
• jQuery Combinators (Reginald Braithwaite)
• A Design eye for the Developer Person (Scott Barnes)
• Unpicking the Microsoft Roadmap (Scott Barnes)
• Expressing yourself: polymorphism in Clojure (Tim Ewald)
• Dynamically animating user interfaces and custom Android views (Andreas Agvard)
• Namedropping, HTML5, optimization, CQRS (Janne Räsänen, Albert Bertilsson, Sebastian Ganslandt and Ted Steen)
• Designing Hypermedia APIs (Steve Klabnik)
• Prototypes, Prototypes and Prototypes - and the difference between them. (Shane Morris)
• Up up and Out: Scaling software with Akka 2 (Henrik Engström)
• The Core protocols - Warp-Speed Results for any Team And the Common Platform for the Culture Tech Revolution (Jim McCarthy)
• API Usability: Think of the humans! (Catherine Powell)
• Be brave, dive in and lead the testing for mobile apps (Julian Harty)
• Testing that made me proud (Martin Karlsson, Mattias Gustavsson, Linda Hoff)
• Cutting testing time with Parallel Automated Functional Tests (Alan Parkinson)
• Making offshore testing work (Pradeep Soundararajan)
• The Whole-Team Approach, Illustrated: Choosing a New GUI Test Tool (Lisa Crispin)
• Go: a simple programming environment (Andrew Gerrand)
• Go: code that grows with grace (Andrew Gerrand)
• Elixir - A modern approach to programming for the Erlang VM (José Valim)
• Tribes, Alliances, Schools - Oh My! Building your reputation through creative disobedience (Matthew Heusser)
• The power of node (Felix Geisendörfer)
• Retrofitting a software architecture to an existing code-base (Chris Chedgey)
• Big Time: Introducing Hadoop on Azure (Yaniv Rodenski)
• HTTP Caching 101 (Sebastien Lambla)
• Building Highly Successful Windows Phone Apps: a Recipe for Repeated Success (Gergely Orosz)
• Whats hot in Android 4.0 + 1 (Lars Vogel)
• Test Driven Android (Jeff "Cheezy" Morgan)
• Programmer Anarchy (Fred George)
• Performance and Capacity in a Cloud (Goranka Bjedov)
• A practical overview of Java EE 6 (Paul Bakker)
• REST assured - Hypermedia APIs with Spring MVC (Oliver Gierke)
• Building a grammar for statistical graphics in Clojure (Kevin Lynagh)
• Business Patterns for Software Developers (Allan Kelly)
• The Art of Disciplined Creativity (Denise Jacobs)
• How being customer-centric improves IT success: a case study (Elizabeth Harrin)
• Reinventing software quality (Gojko Adzic)
• Critical Updates: why software engineering is a fake discipline and what to do about it (Laurent Bossavit)
• Mixup testing, a cross team testing activity between scrum teams (Johan Åtting)
• How to Argue About Code (Andrew Dupont)
• Vim - precision editing at the speed of thought (Drew Neil)
• Radical NoSQL Scalability with Cassandra (Tim Berglund)
• To Java SE 8 and Beyond (Dalibor Topic)
• Java Web Security By Example (Frank Kim)
• The Art of Metaprogramming in Java (Abdelmonaim Remani)
• Advanced Continuous Integration Techniques with Jenkins (Kohsuke Kawaguchi)
• JDK 7 Updates: Director's Cut (Dalibor Topic)
• A deep look into the Event Store (Greg Young)
• Software in the Age of Sampling (Brian Foote)
• TypeScript: JavaScript development at Scale (Mads Torgersen)
• Developing polyglot applications on Cloud Foundry (Chris Richardson)
• Interaction and Navigation Patterns for Modern User Experience (Billy Hollis)
• The growbotron, an iPhone powered farm. Not farmville.... a real farm. (Chris Hughes)
• Therapeutic Refactoring (Katrina Owen)
• Less - The Path to Better Design (Sandi Metz)
• Designing For Rapid Release (Sam Newman)
• Hybrid Applications with MongoDB and RDBMS (Chris Harris)
• Maven vs Gradle, On your marks, get set, go! (Hardy Ferentschik)
• Touch it – don’t touch it (Ola Wassvik, Andreas Olsson, Dag König, Robert Gavelin)
• Polyglot Programming in the JVM (Andres Almiray)
• Eclipse 4 Internals (Lars Vogel)
• Exploring Datomic: a database deconstructed (Tim Ewald)
• Rebels in their own way (Hampus Jakobsson, Chris Hughes, Zed A. Shaw)
• Effective Scala (Henrik Engström)
• Security Inception (Frank Kim)
• Git on Android: Spreading Rebellion (Roberto Tyley)
• Asynchronous Collaboration: Communicating Through Our Source Code (Ryan McGeary)
• Kotlin: Making the Java Platform a Better Place (Hadi Hariri)
• Ugly Code (Alex Papadimoulis)
• It's Not You, It's Them: Why Programming Languages Are Hard To Teach (Zed A. Shaw)
• Testing Online Crazy Glue: Strategies for building testable PHP applications (Chris Hartjes)
• Play Framework 2 (Peter Hilton)
• MVVM Applied in Windows Phone and Windows 8 (Laurent Bugnion)
• ASP.NET 4.5: All you need to know (Damian Edwards)
• What?!? C# Could Do That??? (Shay Friedman)
• Advanced RavenDB (Oren Eini / Ayende Rahien)
• Unlock your Inner Node.js in the Cloud with Windows Azure (Glenn Block)
• Secrets of the Chrome Developer Tools (Patrick Dubroy)
• Travis CI - I Hear You Like Pull Requests (Konstantin Haase)
• The making of Crazyflie (Arnaud Taffanel, Tobias Antonsson, Marcus Eliasson)
• Optimizing Mobile Games (Dennis Gustafsson)
• Being A SME (Subject Matter Expert) (Marcus S. Zarra)
• Pure, Functional Javascript (Christian Johansen)
• Asynchronous User Interfaces - the future of Web UIs (Alex MacCaw)
• Highly Connected Data Models in NOSQL Stores (Alistair Jones)
• Culture hacking and the coming era of magnificence (Jim McCarthy)
• Software won - so what now? (David Rowan)

Vídeos de CascadiaJS



CascadiaJS es una conferencia orientada a Javascript que se celebró en Seattle los pasados 8 y 9 de noviembre. Javascript es un lenguaje que cada vez está tomando más relevancia y no sólo en el mundo web sino también en los nuevos sistemas operativos de Microsoft, así que ya no es sólo un lenguaje para desarrolladores web.

Pues nada, aquí tenéis los vídeos de las charlas de CascadiaJS:

Presentaciones de la Embedded Linux Conference Europe 2012



La Embedded Linux Conference Europe 2012 fue otra de las conferencias celebradas en Barcelona entre el 5 y el 9 de noviembre, sobre Linux, pero enfocada a los sistemas embebidos o empotrados, como prefieras llamarlos.

Aquí tienes la magnífica lista de las charlas con su enlace (PDF) a la presentación de la misma.

• Beaglebone: The Perfect Telemetry Platform?
• Implement Checkpointing for Android
• Maintainer's Diary: Devicetree and Its Stumbling Blocks
• A War Story: Porting Android 4.0 to a Custom Board
• USB Debugging and Profiling Techniques
• Wireless Networking with IEEE 802.15.4 and 6LoWPAN
• Bluetooth Smart devices and Low Energy support on Linux
• OpenOCD: Hardware Debugging and More
• PF_ZIO: Using Network Frames to Convey I/O Data and Meta-Data
• A New File System Designed for Flash Storage in Mobile
• Boot Time Optimizations
• Modular Graphics on Embedded ARM
• Inside Android's User Interface
• Near Field Communication with Linux
• Upgrading Without Bricking
• BoFs: Developer Tools and Methods: Tips & Tricks
• BoFs: Is HW Availability a Gating Item for Your Software Development
• BoFs: Yocto Project & OpenEmbedded Community
• BoFs: The Need For a Fast Bootloader
• Barebox Bootloader
• Dive Into Android Networking: Adding Ethernet Connectivity
• Experiences as an OEM with Development of UI Frameworks
• FFSB and IOzone: File system Benchmarking Tools, Features and Internals
• The End of Embedded Linux (As We Know It)
• Application Parallelization for Multi-Core Android Devices
• Linux Power Supply Charging Subsystem
• Embedded Linux RADAR Device
• What's Old Is New: A 6502-based Remote Processor
• Your New ARM SoC Linux Support Check-List
• Can You Market an Open Source Project?
• Qt on Embedded Systems
• Supporting 200 Different Expansionboards: The Broken Promise of Devicetree
• Àndroit: Real-Time for the Rest of Us
• Eclipse and Embedded Linux Developers: What it Can and Cannot Do For You
• Yocto Project Overview and Update
• ARC Linux: From a Tumbling Toddler to a Graduating Teen
• DRM/KMS, FB and V4L2: How to Select a Graphics and Video API
• Practical Data Visualization
• ARM 64-Bit Bootstrapping with OpenEmbedded
• Practical Experiences With Software Crash Analysis in TV
• Regmap: The Power of Subsystems and Abstractions
• Low-Level Linux Debugging Without Grey Beards
• Video4Linux: Current Status and Future Work
• Yocto Layer for In-Vehicle Infotainment
• Debugging Embedded Linux (Kernel) Power Management
• Real-Time Linux in Industrial Appliances
• Rygel: Open Source DLNA, ready for Customer Products?
• Improvement of Scheduling Granularity for Deadline Scheduler
• LTSI (Long-Term Stable Initiative) Status Update
• UBI Fastmap

Presentaciones de la POC 2012



La POC 2012 (Power Of Community) es una conferencia que se lleva celebrando desde el año 2006 por hackers coreanos y profesionales de la seguridad. Esta edición fue celebrada los pasados 8 y 9 noviembre y ya han publicado las presentaciones que se dieron (no todas):

• Alexander Polyakov, SSRF vs business-critical applications.pdf
• Andrei Costin, Ghost is in the Air(Traffic).pdf
• Auriemma & Ferrante, Pwning Multiplayer Online Games.pdf
• Chengyun Chu, Security Improvements in Windows 8.pdf
• Gordeychik, SCADA Strange Love or How I Learned to Start Worrying and Love Nuclear Plants.pdf
• MC & Yaniv Miron, PwN With HW v.10.pdf
• MJ0011,Using a Patched Vulnerability to Bypass Windows 8 x64 Driver Signature Enforcement.pdf
• Tora, Devirtualizing FinSpy.pdf
• Wan Tao, China Hacker.pdf
• Xu Hao & Xiabo Chen,"Find Your Own iOS Kernel Bug.pdf
• flashsky, APT Attack Detection of Vulnhunt.pdf
• redhidden & silverbug, Fun of Firmware Hacking.pdf

Presentaciones de la LinuxCon Europe 2012



La semana pasada, del 5 al 9 de noviembre se celebró en Barcelona (España) una de las conferencias más grandes sobre Linux, la LinuxCon Europe. Para los que no tuvimos el privilegio de poder asistir, nos tendremos que conformar con el material que vayan publicando. Por lo pronto ya están las presentaciones disponibles, esperemos que hagan lo propio con los vídeos.

Mientras tanto, aquí tenéis la lista de las presentaciones:

Material de la Defcon 20



Yeah! Material oficial de la Defcon 20 ya disponible: vídeos, audio, etc. Aquí tenéis la lista de lo que hay disponible en la web oficial:

• Welcome & Making the DEF CON 20 Badge - Slides Video m4b Audio
• DEF CON Documentary Trailer - Slides Video m4b Audio
• Before, During, and After - Slides Video m4b Audio
• Shared Values, Shared Responsibility - Slides Video m4b Audio
• Owning Bad Guys {And Mafia} With Javascript Botnets - PDF White Paper Slides Video m4b Audio
• The Darknet of Things, Building Sensor Networks That Do Your Bidding - PDF Slides Video m4b Audio
• Drones! - Slides Video m4b Audio
• PDF Extras Slides Video m4b Audio
• Blind XSS - PDF Slides Video m4b Audio
• Should the Wall of Sheep Be Illegal? A Debate Over Whether and How Open WiFi Sniffing Should Be Regulated - Slides Video m4b Audio
• Cryptohaze Cloud Cracking - Slides Video m4b Audio
• Overwriting the Exception Handling Cache PointerDwarf Oriented Programming - PDF Slides Video m4b Audio
• Exploit Archaeology: Raiders of the Lost Payphones - PDF Slides Video m4b Audio
• Hardware Backdooring is Practical - PDF White Paper Slides Video m4b Audio
• DIY Electric Car - PDF Slides Video m4b Audio
• Tenacious Diggity: Skinny Dippin' in a Sea of Bing - Slides Video m4b Audio
• KinectasploitV2: Kinect Meets 20 Security Tools - PDF Slides Video m4b Audio
• Fuzzing Online Games - Slides Video m4b Audio
• The Open Cyber Challenge Platform - Slides Video m4b Audio
• Into the Droid: Gaining Access to Android User Data - PDF Slides Video m4b Audio
• Panel: Meet the Feds 1 - Law Enforcement - Slides Video m4b Audio
• Meet the Feds 2 - Policy - Slides Video m4b Audio
• SIGINT and Traffic Analysis for the Rest of Us - Slides Video m4b Audio
• Bad (and Sometimes Good) Tech Policy: It's Not Just a DC Thing - PDF Slides Video m4b Audio
• Life Inside a Skinner Box: Confronting our Future of Automated Law Enforcement - PDF Slides Video m4b Audio
• Owning the Network: Adventures in Router Rootkits - PDF Slides Video m4b Audio
• World War 3.0: Chaos, Control & the Battle for the Net - PDF Slides Video m4b Audio
• Embedded Device Firmware Vulnerability Hunting Using FRAK, the Firmware Reverse Analysis Konsole - PDF Slides Video m4b Audio
• Looking Into The Eye Of The Meter - PDF White Paper Slides Video m4b Audio
• SQL Injection to MIPS Overflows: Rooting SOHO Routers - PDF White Paper Extras Slides Video m4b Audio
• DC RECOGNIZE Awards - Slides Video m4b Audio
• Hacking Humanity: Human Augmentation and You - PDF Slides Video m4b Audio
• Connected Chaos: Evolving the DCG/Hackspace Communication Landscape - Slides Video m4b Audio
• Not-So-Limited Warranty: Target Attacks on Warranties for Fun and Profit - PDF Extras Slides Video m4b Audio
• DivaShark - Monitor your Flow - Slides Video m4b Audio
• Beyond the War on General Purpose Computing: What's Inside the Box? - Slides Video m4b Audio
• Sploitego - Maltego's (Local) Partner in Crime - PDF Extras Slides Video m4b Audio
• Not So Super Notes, How Well Does US Dollar Note Security Prevent Counterfeiting? - PDF Images Slides Video m4b Audio
• Post Metasploitation: Improving Accuracy and Efficiency in Post Exploitation Using the Metasploit Framework - Slides Video m4b Audio
• The Paparazzi Platform: Flexible, Open-Source, UAS Software and Hardware - PDF Slides Video m4b Audio
• Hacking the Google TV - PDF Slides Video m4b Audio
• Owned in 60 Seconds: From Network Guest to Windows Domain Admin - PDF Slides Video m4b Audio
• Hellaphone: Replacing the Java in Android - PDF Slides Video m4b Audio
• Hacking [Redacted] Routers - Slides Video m4b Audio
• Demorpheus: Getting Rid Of Polymorphic Shellcodes In Your Network - PDF Extras Slides Video m4b Audio
• New Techniques in SQLi Obfuscation: SQL never before used in SQLi - PDF Slides Video m4b Audio
• Uncovering SAP Vulnerabilities: Reversing and Breaking the Diag Protocol - PDF Slides Video m4b Audio
• Post-Exploitation Nirvana: Launching OpenDLP Agents over Meterpreter Sessions - PDF Slides Video m4b Audio
• The Art of Cyberwar - PDF Extras Slides Video m4b Audio
• More Projects of Prototype This! - PDF Slides Video m4b Audio
• Hacking Measured Boot and UEFI - PDF Slides Video m4b Audio
• Exchanging Demands - PDF Extras Slides Video m4b Audio
• Changing the Security Paradigm: Taking Back Your Network and Bringing Pain to the Adversary - Slides Video m4b Audio
• Busting the BARR: Tracking "Untrackable" Private Aircraft for Fun & Profit - Slides Video m4b Audio
• Crypto and the Cops: the Law of Key Disclosure and Forced Decryption - Slides Video m4b Audio
• Passive Bluetooth Monitoring in Scapy - PDF Extras Slides Video m4b Audio
• How to Hack All the Transport Networks of a Country - Slides Video m4b Audio
• Bigger Monster, Weaker Chains: The National Security Agency and the Constitution - Slides Video m4b Audio
• Black Ops - Slides Video m4b Audio
• Owning One to Rule Them All - Slides Video m4b Audio
• Detecting Reflective Injection - PDF Slides Video m4b Audio
• An Inside Look Into Defense Industrial Base (DIB) Technical Security Controls: How Private Industry Protects Our Country's Secrets - PDF Extras Slides Video m4b Audio
• No More Hooks: Detection of Code Integrity Attacks - PDF Slides Video m4b Audio
• DDoS Black and White "Kungfu" Revealed - PDF Slides Video m4b Audio
• NFC Hacking: The Easy Way - PDF Slides Video m4b Audio
• Robots: You're Doing It Wrong 2 - Slides Video m4b Audio
• Anonymous and the Online Fight for Justice - PDF Slides Video m4b Audio
• OPFOR 4Ever - PDF Slides Video m4b Audio
• Weaponizing the Windows API with Metasploit's Railgun - PDF Slides Video m4b Audio
• Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2 - Slides Video m4b Audio
• SCADA HMI and Microsoft Bob: Modern Authentication Flaws With a 90's Flavor - Slides Video m4b Audio
• Don't Stand So Close To Me: An Analysis of the NFC Attack Surface - PDF Slides Video m4b Audio
• How to Hack VMware vCenter Server in 60 Seconds - PDF Slides Video m4b Audio
• DEF CON Comedy Jam V, V for Vendetta - PDF Slides Video m4b Audio
• Cortana: Rise of the Automated Red Team - PDF Slides Video m4b Audio
• Making Sense of Static - New Tools for Hacking GPS - Slides Video m4b Audio
• SQL ReInjector - Automated Exfiltrated Data Identification - PDF Extras Slides Video m4b Audio
• Meet the EFF - Slides Video m4b Audio
• The End of the PSTN As You Know It - PDF Slides Video m4b Audio
• APK File Infection on an Android System - PDF Slides Video m4b Audio
• Panel: The Making of DEF CON 20 - Slides Video m4b Audio
• Adventures in Bouncerland -
• Anti-Forensics and Anti-Anti-Forensics: Attacks and Mitigating Techniques for Digital-Forensic Investigations - PDF Slides Video m4b Audio
• Creating an A1 Security Kernel in the 1980s (Using “Stone Knives and Bear Skins”) - Slides Video m4b Audio
• Network Anti-Reconnaissance: Messing with Nmap Through Smoke and Mirrors - PDF Slides Video m4b Audio
• Bypassing Endpoint Security for $20 or Less - PDF Slides Video m4b Audio
• The Safety Dance - Wardriving the Public Safety Band - Slides Video m4b Audio
• Kevin Poulsen Answers Your Questions - Slides Video m4b Audio
• Q&A with the Men (and Women) in Black - Slides Video m4b Audio
• Hacker + Airplanes = No Good Can Come Of This - PDF Slides Video m4b Audio
• MegaUpload: Guilty or Not Guilty? - PDF Slides Video m4b Audio
• Stamp Out Hash Corruption! Crack All The Things! - PDF White paper Extras Slides Video m4b Audio
• Spy vs Spy: Spying on Mobile Device Spyware - PDF Slides Video m4b Audio
• Scylla: Because There's no Patch for Human Stupidity - White Paper Slides Video m4b Audio
• Bruce Schneier Answers Your Questions - Slides Video m4b Audio
• Programming Weird Machines with ELF Metadata - PDF Slides Video m4b Audio
• We Have You by the Gadgets - PDF Slides Video m4b Audio
• Can You Track Me Now? Government And Corporate Surveillance Of Mobile Geo-Location Data - Slides Video m4b Audio
• Botnets Die Hard - Owned and Operated - PDF Slides Video m4b Audio
• How to Channel Your Inner Henry Rollins - PDF Slides Video m4b Audio
• Can Twitter Really Help Expose Psychopath Killers' Traits? - PDF Slides Video m4b Audio
• Attacking TPM Part 2: A Look at the ST19WP18 TPM Device - Slides Video m4b Audio
• Twenty Years Back, Twenty Years Ahead: The Arc of DEF CON Past and Future - Slides Video m4b Audio
• Off-Grid Communications with Android: Meshing the Mobile World - PDF White paper Slides Video m4b Audio
• Socialized Data: Using Social Media as a Cyber Mule - Slides Video m4b Audio
• Safes and Containers: Insecurity Design Excellence - PDF Slides Video m4b Audio
• Rapid Blind SQL Injection Exploitation with BBQSQL - PDF Extras Slides Video m4b Audio
• Subterfuge: The Automated Man-in-the-Middle Attack Framework - PDF White paper Slides Video m4b Audio
• Drinking From the Caffeine Firehose We Know as Shodan - PDF Slides Video m4b Audio
• The DCWG Debriefing - How the FBI Grabbed a Bot and Saved the Internet - Slides Video m4b Audio
• The Christopher Columbus Rule and DHS - Slides Video m4b Audio
• The Art Of The Con - Slides Video m4b Audio
• Improving Web Vulnerability Scanning - PDF Slides Video m4b Audio

Presentaciones de la Breakpoint 2012



Más presentaciones para colección, esta vez de la Breakpoint 2012 celebrada en Australia los pasados 17 y 18 de octubre. Aquí tenéis la lista de las presentaciones que están disponibles:

• iOS6 Security
• Modeling the exploitation and mitigation of memory safety vulns
• Advanced Exploitation of Mobile/Embedded Devices:the ARM Microprocessor
• Binary Instrumentation For Android
• Emulating DFU to Quickly Reverse and Exploit USB Devices
• Detecting Bugs Using Decompilation and Dataflow Analysis
• Tackling the Android Challenge
• Unravelling Windows 8 Security and the ARM Kernel
• Rootkit in your Laptop: Hidden Code in your Chipset
• The Case for Semantics-Based Methods in Reverse Engineering
• Android Forensic Deep Dive

Vídeos de la Build 2012



Para aquellos que trabajéis con tecnología de Microsoft o simplemente estéis interesado en ella, aquí tienes el listado de todos los vídeos de las charlas que se dieron en el evento llamado //build/, que celebró Microsoft en casa, Redmon, WA.

• Build 2012 Day 1 Keynote
• BUILD 2012 Day 2 Keynote
• Bringing existing C++ code to Windows Store apps
• HTML5 & CSS3 latest features in action!
• Developing Continuous Services : Real world experiences of the Team Foundation Service engineering…
• What's New for Developers in Office 2013 and SharePoint 2013
• Designing games for Windows 8
• Developing a Windows Store app
• Introduction to creating Windows Store apps using HTML and JavaScript
• 50 performance tricks to make your HTML5 apps and sites faster
• BUILD 2012 Day 2 Keynote
• It’s all about performance: Using Visual C++ 2012 to make the best use of your hardware
• Graphics at the core of Windows 8 and your app
• Chalk Talk: Reading and publishing
• Bridging the DEV-OPS gap with Windows Server 2012 and Visual Studio 2012
• Angle Brackets, Curly Braces, One ASP.NET and the Cloud
• Ask the experts panel: Device apps
• Chalk Talk: Gaming and graphics apps
• Deep dive on WinJS ListView
• Easy Asynchrony with C#: No More Callbacks!
• Monetizing your Windows 8 app with advertising
• Key technologies for Windows Store business apps
• Bing Maps for Windows apps
• The Future of C++
• Ask the experts panel: Connected apps
• Bleeding edge ASP.NET: See what is next for MVC, Web API, SignalR and more…
• Powering your apps with Microsoft accounts
• Delivering Applications with RemoteFX in Windows Server 2012
• Guidance for shopping apps
• The Microsoft design language
• Building Awesome HTML apps in Blend for Windows 8
• Building apps for Office and SharePoint 2013 using the web technologies you know and love, Part 1
• Building data centric applications for web, desktop and mobile with Entity Framework 5.
• Core technologies for Windows 8 games
• The power of C++ - Project Austin app
• New multi-touch, ink, and pen technologies that can revolutionize your apps on any size of screens
• Tips on self-evaluating the UX of your app
• Windows Store: how does it work?
• Designing awesome XAML apps in Visual Studio and Blend for Windows 8 and Windows Phone 8
• Xbox Live on Windows 8 Deep Dive
• Key technologies for shopping apps
• Connecting C++ Apps to the Cloud via Casablanca
• Building apps for Office and SharePoint 2013 using the web technologies you know and love, Part 2
• Extending & customizing Dynamic Access Control
• Building Cross-Device Xbox Games
• 1+1=3: Using app contracts to integrate with Windows 8 experiences
• Developing a Windows Store app using C++ and DirectX
• Making money with your app on the Windows Store
• Shopping app case studies
• Don’t break the web: Why web standards matter and how to use them responsibly.
• Super-Natural Interaction
• Windows Azure Overview
• How to make your applications manageable
• Designing great reading experiences
• Security in Windows Store apps
• Lighting up Windows: From websites to apps
• Building High-Performing JavaScript for Modern Engines
• Application Lifecycle Management: It’s a Team Sport
• Introduction to Windows Azure Infrastructure as a Service (IaaS)
• Kinect Design Considerations
• DirectX Graphics Development with Visual Studio 2012
• Designing rich media scenarios in your Windows Store app
• Building Rich Media Applications on Windows 8 with Windows Azure Media Services
• Introduction to creating Windows Store apps using XAML
• Key technologies for building great reading experiences
• The story of state: AppData, settings, and the process lifecycle
• What’s new in VS2012
• Diagnosing performance and memory issues in JavaScript-based Windows Store apps
• Apps for Office and SharePoint development using the all new browser-based “Napa” and Visual Studio…
• Advanced Windows Azure Infrastructure as a Service (IaaS)
• Building Big: Lessons learned from Windows Azure customers - Part I
• Developing Mobile Solutions with Windows Azure Part I
• Graphics with the Direct3D11.1 API made easy
• Using media extensions to build great video playback apps
• Desktop apps: WPF 4.5 and Visual Studio 2012
• Designing awesome XAML apps in Visual Studio and Blend for Windows 8 and Windows Phone 8 (Repeat)
• Diving deep into C++ /CX and WinRT
• The Evolution of .NET
• Building Big: Lessons learned from Windows Azure customers - Part II
• Developing Mobile Solutions with Windows Azure Part II
• Key technologies for building advanced media apps
• The developer’s guide to the SkyDrive API
• Performance tips for Windows Store apps using XAML
• Diagnosing performance and memory issues in JavaScript-based Windows Store apps (Repeat)
• Building end-to-end apps for SharePoint with Windows Azure and Windows 8
• Kinect for Windows Programming Deep Dive
• Alive with activity: Tiles, notifications, and background tasks
• Building world-ready Windows Store apps with XAML
• Tips and tricks for developing connected applications
• Performance tips for Windows Store apps using DirectX and C++
• Windows Store device apps
• Tips for building a Windows Store app using XAML and C++: The Hilo project
• DevOps: Integrating development and operations for the last mile velocity
• Introducing TypeScript: A language for application-scale JavaScript development
• Windows Azure Active Directory: enabling single sign on and directory services for cloud SaaS apps
• From zero to hero! Building a Windows Store game in HTML5
• XAML list controls
• Continuous Integration with Windows Azure Websites
• Deep dive into WinJS
• Developer Productivity with Visual Studio & TFS 2012
• Building Awesome HTML apps in Blend for Windows 8 (Repeat)
• Developing an app for SharePoint autohosted in Windows Azure Web Sites with an autoprovisioned…
• Building Real-time Web Apps with ASP.NET SignalR
• Writing Windows Server 2012 Applications to leverage the file based shared storage
• Windows Azure Internals
• Gaming reimagined: Gaming case studies
• Building mixed-language apps
• Testing Untestable Code with Stubs and Shims in Visual Studio 2012
• TouchDevelop: A touch-first IDE for the Web created with TypeScript
• Building Services for Any Client with ASP.NET Web API
• Developing Big Data Analytics Applications with JavaScript and .NET for Windows Azure and Windows
• Media app case studies
• Touchscreen and stylus and mouse, oh my!
• Analytics for Windows Store apps
• Modern JavaScript
• Getting Started with Cloud Services Development
• Javascript from client to cloud with Windows 8, Node.js, and Windows Azure
• Building world-ready Windows Store apps with HTML/CSS/JavaScript
• Chalk Talk: Media apps
• Windows 8 Connectathon with Windows Azure Mobile Services
• Building Connected Business Applications with Visual Studio LightSwitch
• Building Windows 8 LOB apps
• Deep Dive into the Kernel of .NET on Windows Phone 8
• Advanced Cloud Services Development
• Data Options in Windows Azure. What's a developer to do?
• Writing Windows Store apps with jQuery
• Bootstrapping your Startup with Windows Azure
• Introduction to Xbox SmartGlass
• Unit Testing Windows Store Apps
• Developing for Windows Azure Web Sites and SharePoint Online
• Top tips for iOS devs building Windows Store apps
• Developing, deploying, and monetizing Windows Store games with Unity
• Windows Azure Storage – Building applications that scale
• Create Cross-platform Apps using Portable Class Libraries
• Building HTML 5 Web Apps with Visual Studio & ASP.NET
• Developing highly-available, scale-out applications for Windows Server 2012
• The Windows Runtime Q&A
• Build 2012 Day 1 Keynote
• Workflow & Workflow Manager 1.0: What’s New, What’s Coming
• Building Hybrid Applications using the Windows Azure Service Bus
• How to Leverage your Code across WP8 and Windows 8
• Windows Phone 8: HTML5/IE10 for Developers
• How to Leverage your Code across WP8 and Windows 8 (Repeat)
• Nokia Music Windows Phone 8 App-to-App APIs
• Windows Phone 8: Application Model
• Windows Phone 8: Native C/C++ Game Development
• Windows Phone 8: XAML Application Development
• Windows Phone 8: In App Purchase & Developer Center
• Windows Phone 8: Critical Developer Practices for Delivering Outstanding Apps
• Windows Phone 8: Networking, Bluetooth, and NFC Proximity for Developers
• Windows Phone 8: Making Money with Your Application on Windows Phone
• Windows Phone 8: Maps, Location, and Background Execution for Developers
• Windows Phone 8: Performance & Optimization for Developers
• Windows Phone 8: Photo and Lens Apps
• Windows Phone 8: Tiles, Lock Screen, and Notifications
• Windows Phone 8: Native C/C++ Game Development (Repeat)
• Windows Phone 8: Using C++ in your Applications
• Windows Phone 8: Using C++ in your Applications (Repeat)
• Windows Phone 8: Using the Speech API
• Windows Phone 8: Wallet and Deals for Developers
• Windows Phone 8: App to App Communication
• Windows Phone 8: Enterprise Development
• Preshow Day 1
• Windows Phone 8: Application Model (Repeat)
• HTML5 & CSS3 latest features in action! (Repeat)
• Building Windows 8 LOB Apps (Repeat)

Las "Stable Talks" de Derbycon 2012 ya disponibles



En la gran web de irongeek han publicado las Stable Talks de la Derbycon de este año. Las Stable Talks son charlas, sobre seguridad también, pero cuya duración suelen ser más cortas que las charlas tradicionales.

Sin más, aquí tenéis el listado:

• Valerie Thomas: Appearance Hacking 101 - The Art of Everyday Camouflage
• Tim Tomes "LanMaSteR53": Next Generation Web Reconnaissance
• Thomas Hoffecker: Hack Your Way into a DoD Security Clearance
• John Seely CounterSploit MSF as a defense platform
• Chris Murrey "f8lerror" & Jake Garlie "jagar": Easy Passwords = Easy Break-Ins
• Tyler Wrightson: The Art and Science of Hacking Any Target
• Thomas Richards: Android in the Healthcare Workplace
• Spencer McIntyre: How I Learned to Stop Worrying and Love the Smart Meter
• Shawn Merdinger: Medical Device Security
• Rockie Brockway: Business Ramifications of Internet's Unclean Conflicts
• Nathan Magniez: Alice in Exploit Redirection Land
• Magen Hughes: Are you HIPAA to the Jive
• Justin Brown & Frank Hackett: Breaking into Security
• Josh Thomas: Off Grid Communications with Android
• Jennifer "savagejen" Savage & Daniel "unicorn Furnance": The Patsy Proxy
• Jason Pubal: SQL Injection 101
• James Siegel: Nice to Meet You
• Brett Cunningham: Beyond Strings - Memory Analysis During Incident Response
• Gus Fritschie & Nazia Khan: Hacked Hollywood
• Evan Anderson: Active Directory Reconnaissance - Attacks and Post-Exploitation
• David Young: ISO8583 or Pentesting with Abnormal Targets
• David Cowen: Running a Successful Red Team
• Damian Profancik: Managed Service Providers - Pwn One and Done
• Ben Toews & Scott Behrens: Rapid Blind SQL Injection Exploitation with BBQSQL
• Andy Cooper: Why Integgroll Sucks at Python..And You Can Too

Presentaciones de la BruCON 2012



Ya se encuentran disponibles las presentaciones de la BruCON 2012 celebrada el pasado mes de septiembre durante los días 26 y 27.

• (Keynote) Ed Skoudis - Letting Loose the Dogs of (cyber) War - PPTX
• Georgia Weidman - Introducing the Smartphone Penetration Testing Framework - PDF
• Robert McArdle - HTML5 - A Whole New Attack Vector - ZIP
• Raul Siles - Security of National eID (smartcard-based) Web Applications - PDF
• Josh Corman and Jericho - "Cyberwar" : Not What We Were Expecting - PPTX
• Mathy Vanhoef - New flaws in WPA-TKIP - PDF
• Martin Gallo - Uncovering SAP vulnerabilities: dissecting and breaking the Diag protocol - PDF
• Fernando Gont - Recent Advances in IPv6 Security - PPTX
• Gregory Pickett - pMap, the silent killer - PDF
• Carlos Garcia - How I met your pointer (Hijacking client software for fuzz and profit) - PDF
• Mickey Shkatov - we have you by the gadgets - PPTX
• David Mortman - The Defense RESTs: Automation and APIs for Improving Security - PPTX
• Kyle 'Kos' Osborn & Krzysztof Kotowicz - Advanced Chrome Extension Exploitation (2h) - PDF
• Abraham Aranguren - Introducing OWTF (4hr) - tar.gz - blog post

Presentaciones de la Ruxcon 2012



La conferencia sobre seguridad Ruxcon se celbebró en Australia los pasados 20 y 21 de octubre. Ya están disponibles (la mayoría) las presentaciones oficiales. Aquí tenéis la lista:

• De Mysteriis Dom Jobsivs: Mac EFI Rootkits
• Exploiting Internal Network Vulns via the Browser Using BeEF Bind
• Android Malware Detection in the Cloud
• Thar' be Vuln. ID's Here - A Data Mining Case Study
• Practical Attacks on Payment Gateways
• Targeted Malware – Sophisticated Criminals or Babytown Frolics?
• Reverse Engineering a Mass Transit Ticketing System
• FooCodeChu for Software Analysis, Malware Detection, & Vuln Research
• Windows Kernel Fuzzing For Beginners
• Examination of the VMWARE ESXi Binary Protocol Using Canape
• Tracking vulnerable JARs
• Finding Needles in Haystacks (The Size of Countries)
• How To Catch a Chameleon: Its All In Your Heap
• Bluetooth Packet Sniffing Using Project Ubertooth
• Advanced Persistent Response
• Hardware Backdooring is Practical
• Binary Instrumentation for Android
• The Blackhole Exploit Kit Spam Runs

Vídeos de la DerbyCon 2012



Este era otra de las entradas que tenía pendiente de publicar. Como ya bien anunciaron en Security By Default, en IronGeek estaban subiendo los vídeos de la DerbyCon 2012. Hasta ahora sólo faltan 2 vídeos, el de Kevin Mitnick, pendiente de aprobar y otro titulado “You Can’t Buy Security. Building an Open Sourced Information Security Program”, del cual parece ser tuvieron alguna dificultad técnica. Para que quede registrado por aquí, esta es la lista:

Presentaciones de la HITB 2012 de Malasia



Ya están disponibles las presentaciones de la Hack In The Box celebrada en Malasia los pasados 10 y 11 de octubre. La lista de las mismas:

• D1T1 - Barisani and Bianco - Practical Exploitation of Embedded Systems.pdf
• D1T1 - Chris Wysopal - Data Mining a Mountain of Vulnerabilities.pdf
• D1T1 - Lucas Adamski - Firefox OS and You.pdf
• D1T1 - Petko Petkov - History of the JavaScript Security Arsenal.pdf
• D1T1 - Philippe Langlois and Emmanuel Gadaix - 6000 Ways and More.pdf
• D1T2 - Don Bailey - Hackers, The Movie - A Retrospective.pdf
• D1T2 - Haroon Meer - You and Your Research.pdf
• D1T2 - Marc Heuse - IPv6 Insecurity Revolutions.pdf
• D1T2 - Mark Dowd & Tarjei Mandt - iOS6 Security.pdf
• D1T2 - Meder Kydyraliev - Defibrilating Web Security.pdf
• D1T2 - Wes Brown - Supercomputing, Malware and Correlation.pdf
• D1T3 - F Raynal & G Campana - An Attack Path to Jailbreaking Your Home Router.pdf
• D1T3 - John Draper - A Historical Look at the Personal Computer and Phreaking.pdf
• D1T3 - Jose Nazario - Tracking Large Scale Botnets.pdf
• D1T3 - Paul Sebastian Ziegler - Hacking in the Far East.pdf
• D1T3 - The Grugq - OPSEC - Because jail is for wuftpd.pdf
• D2T1 - Chris Evans - Element 1337 in the Periodic Table - Pwnium.pdf
• D2T1 - Katie Moussouris - How to Get Along with Vendors Without Really Trying.pdf
• D2T1 - Ollie Whitehouse - Finding the Weak Link in Binaries.pdf
• D2T1 - Rodrigo Branco - A Scientific Study of Malware Obfuscation Technologies.zip
• D2T2 - Fyodor Yarochkin and Vladimir - Messing up the Kids Playground.pdf
• D2T2 - Jeremiah Grossman - Why Web Security is Fundamentally Broken.pdf
• D2T2 - Raoul Chiesa - Information Warfare and Cyberwar.pdf
• D2T2 - Saumil Shah - Innovative Approaches to Exploit Delivery.pdf
• D2T3 - Emmanuel Gadaix - Something MEGA.pdf
• D2T3 - Felix FX Lindner - Hacking Huawei VRP.pdf
• D2T3 - Mikko Hypponen - Behind Enemy Lines.pdf
• D2T3 - Stefano Zanero - Behaviour-Based Methods for Automated Scalable Malware Analysis.pdf

Fuente

Presentaciones y vídeos de Cassandra Summit 2012



La tercera conferencia orientada a la comunidad de Apache Cassandra celebrada a principios de este mes de agosto, ponen a disposición los vídeos y las presentaciones (PDF) de todas las charlas que se dieron. Muy buen material.

• The State of Cassandra, 2012 presentación - Vídeo
• 1, 2, 3, 4, Add Another Data Store presentación - Vídeo
• Big Data at Disney presentación - Vídeo
• Building a Cassandra Based Application from Scratch presentación - Vídeo
• Buy It Now! Cassandra at eBay presentación - Vídeo
• Cassandra – A Foundation for Real-time Big Data Applications at Reltio presentación - Vídeo
• Cassandra at Apigee Usergrid: Powering Mobile presentación - Vídeo
• Cassandra at Telco Scale – Big Data, Mobile Apps, Optimized Footprint, and A/A Resiliency presentación - Vídeo
• Cassandra in Action: Solving Big Data Problems presentación - Vídeo
• Cassandra in Rackspace Cloud Monitoring presentación - Vídeo
• Cassandra Performance and Scalability on AWS presentación - Vídeo
• Cassandra Plus Solr presentación - Vídeo
• Columns Enough and Time – Using Cassandra for a Time Series Analytical Repository presentación - Vídeo
• CQL, and the Road to Redemption presentación - Vídeo
• presentación - Vídeo
• End-to-end Analytic Workflows With Cassandra presentación - Vídeo
• Hastur: Open-Source Scalable Metrics presentación - Vídeo
• Increasing Your Prospects: Cassandra in Online Advertising presentación - Vídeo
• Moving at the Speed of Markets presentación - Vídeo
• Servers Fail, Who Cares? presentación - Vídeo
• Take Any App to the Cloud of your Choice presentación - Vídeo
• Technical Deep Dive: Cassandra + Solr presentación - Vídeo
• Technical Deep Dive: Data Modeling presentación - Vídeo
• Technical Deep Dive: Query Performance presentación - Vídeo
• Technical Deep Dive: Secondary Indexes presentación - Vídeo
• Titan: Big Graph Data with Cassandra presentación - Vídeo
• Unlocking the Value of Big Data presentación - Vídeo
• Using Cassandra in an S3 Cloud Storage System presentación - Vídeo
• Virtual Nodes – Operational Aspirin presentación - Vídeo
• We Messed Up, So You Don’t Have to presentación - Vídeo
• Why Architecture Matters (No, Really) presentación - Vídeo
• Actuate: From Data to Insights, presentación - Vídeo
• M2M with Cassandra, presentación - Vídeo
• Scaling MongoDB with Cassandra, presentación - Vídeo
• DataStax Enterprise, presentación - Vídeo
• Cassandra on ACID, presentación - Vídeo
• Reporting and Analytics on Cassandra, presentación - Vídeo
• Upcoming Changes in Drivers, presentación - Vídeo
• Astyanax: Hector’s Smart-ass Son, presentación - Vídeo
• Toad for Cloud: How to write SQL against Cassandra, presentación - Vídeo
• Node.js and Cassandra (Helenus), presentación - Vídeo

Presentaciones de la Crypto 2012 rump



Listado de las presentaciones (PDF) de la Crypto 2012 rump:

• Welcome to the rump session
• IACR 2012 Fellows Induction Ceremony
• Celebrating the 25th year of FEAL - A new prize problem
• The relevance of the Chinese Lotto: 25 years outsourcing of cryptanalysis
• Improved Key Recovery Attacks on Reduced-Round AES
• The End of Encryption based on Card Shuffling
• Perfect Hellman Tables using Bloom Filters
• Entropy
• Online movies that cannot be copied
• Double blind reviewing in IACR conferences, revisited
• Does the ePrint Archive hurt Cryptographers?
• The end of crypto
• The Security of Very Dense Cryptography
• Open Source Implementations of Hash Functions in an Atmel AtTiny45
• SHA--3 Update & NIST Thank You
• Edwards Curves and Fault Attacks
• COTORI(TM): Cryptosystems On TORI
• Breaking Pairing-based Cryptosystems using $\eta_T$ Pairing over $GF(3^{97})$
• Synthesis of OWF-based Encryption Schemes
• Attribute-Based Encryption from Lattices
• Efficient (Hierarchical) Inner Product Encryption Tightly Reduced from the Decisional Linear Assumption
• Padding Oracles Revisited
• The case of the RSA FUCK-A-DUCK certificate
• Cryptography in the Streaming Model
• Midgame Attacks
• Coalition between Bob and Eve in the Man In The Middle Attack
• Publicly Verifiable Delegation of Large Polynomials and Matrix Computations
• How Useful are Random Oracles?
• Positive results for concurrently secure computation in the plain model
• PKC + MPC + Internet voting implies ``secret endorsements'', or, how politicians can keep their friends
• CryptINKgraphy
• Random-Sample Elections: Far lower cost, better quality and more democratic

Fuente

Vídeos y presentaciones de la Hack in Paris 2012



Pues eso, como el título indica, se han publicado tanto los vídeos como las presentaciones de la Hack in Paris celebrada en Junio.

• SCADA Security: Why is it so hard ? - Video - Presentacion
• PostScript: Danger ahead ! - Video - Presentacion
• Got your Nose ! How to steal your precious data without using scripts - Video - Presentacion
• What are the new means for cybercriminals to bypass and evade your defenses ? - Video - Presentacion
• Attacking XML Processing - Video - Presentacion
• Weapons of Max Destruction V4 - Video - Presentacion
• Human Hacking - Video - Presentacion
• Bypassing the Android permission model - Video - Presentacion
• Results of a Security Assessment of the Internet Protocol version 6 (IPv6) - Video - Presentacion
• Keynote: Where Are We And Where Are We Going - Video - Presentacion
• Keynote: Measuring Risk with Time Based Security - Video - Presentacion
• A bit more of PE - Video - Presentacion
• "Securing the Internet: YOU’re doing it wrong" (An INFOSEC Intervention) - Video - Presentacion
• HTML5: Something wicked this way comes - Video - Presentacion
• Questions and Answers : Panel Defensive Nature - Video
• Questions and Answers : Panel offensive Nature - Video

Enlace original