Presentaciones de Black Hat Europe 2016

Ya se encuentran disponibles las presentaciones de otra de las ediciones de Black Hat, la edición europea de 2016 en este caso. (Pen)Testing Vehicles with CANToolz eu-16-Sintsov-Pen-Testing-Vehicles-With-Cantoolz.pdf 50 Thousand Needles in 5 Million Haystacks: Understanding Old Malware Tricks to Find New Malware Families eu-16-Valeros-50-Thousand-Needles-In-5-Million-Haystacks-Understanding-Old-Malware-Tricks-To-Find-New-Malware-Families.pdf AI based Antivirus: Can AlphaAV Win the Battle in which Man Has Failed? eu-16-Wang-AI-Based-Antivirus-Can-Alphaav-Win-The-Battle-In-Which-Man-Has-Failed.pdf Another Brick Off the Wall: Deconstructing Web Application Firewalls Using Automata Learning eu-16-Argyros-Another-Brick-Off-The-Wall-Deconstructing-Web-Application-Firewalls-Using-Automata-Learning.
Leer más

De la inyección de SQL a la shell, material de presentación y entrenamiento

Los miembros de PentesterLab han creado un paquete con material para presentaciones y enseñanza basado en un laboratorio de prácticas sobre inyección de SQL. El objetivo es proveerte con una serie de diaspositivas y guía, además de una prácticas ya preparadas, para la enseñanza de ataques a aplicaciones web, explotando vulnerabilidades de inyección de SQL. El paquete lo han titulado Meetup pack for “From SQL Injection to Shell”. El curso en el que está basado es From SQL Injection to Shell (ISO del curso), el cual puedes hospedar tú mismo o usar la versión online (para éste necesita tener una cuenta PRO).
Leer más

Presentaciones de Ruxcon 2016

Ya podemos acceder a las presentaciones de Ruxcon Security Conference 2016: Windows Metafiles: An Analysis of the EMF Attack Surface & Recent Vulnerabilities Forcing A Targeted LTE Cellphone Into An Unsafe Network $hell on Earth: From Browser to System Compromise Demystifying the Secure Enclave Processor Strolling into Ring-0 via I/O Kit Drivers Rainbow Over the Windows: More Colors Than You Could Expect Hacker-Machine Interface - State of the Union for SCADA HMI Vulnerabilities Breaking out of QEMU Make iOS App more Robust and Security through Fuzzing Exploiting COF Vulnerabilities In The Linux Kernel Of Mice and Keyboards: On the Security of Modern Wireless Desktop Sets Firmware Biopsy: Towards Taming The Lunacy Leaking Windows Kernel Pointers FRAPL - Next Generation Reverse Engineering Framework Documented to Fail Writing Malware While The Blue Team Is Staring At You Fighting Metamorphism using Deep Neural Network with Fourier On Her Majesty’s Secret Service – GRX and a Spy Agency Orbiting The Saturn: Investigating A Decades-Old DRM System Make Event Tracing Great Again
Leer más

Serie de cursos gratuitos sobre ciberseguridad

La Universidad de Helsinki, en colaboración con F-Secure han creado Cyber Security Base, una serie de cursos sobre ciberseguridad. Actualmente sólo el primero de los cursos está disponible, el resto se irán haciendo públicos a medida que vayan creando el material asociado a los mismos. Los cursos son los siguientes: Introduction to Cyber Security Securing Software Course Project I Advanced Topics Course Project II Capture The Flag Si quieres mantenerte informado cada vez que publiquen un nuevo curso deberías suscribirte.
Leer más

Vídeos de DEF CON 24

Junto con las presentaciones de DEF CON 24, ya también tenemos acceso a los vídeos: WIFI 204 Insteon, Inste off, Inste open WIFI 202 Evil ESP WIFI 201 WCTF Day 2 Kickoff WIFI 105 Introducing the HackMeRF WIFI 104 Handing Full Control of the Radio Spectrum Over to the Machines WIFI 103 How Do IBLE Hacking WIFI 102 Decoding LoRa Exploring Next Gen Wireless WIFI 101 Wireless Capture the Flag Inbrief Weaponizing Data Science for Social Engineering Automated E2E spear phishing on Twit weaponize your feature codes VLAN hopping, ARP poisoning & MITM Attacks in Virtualized Environments Use Their Machines Against Them Loading Code with a Copier Universal Serial aBUSe Remote physical access attacks toxic proxies bypassing HTTPS and VPNs to pwn your online identity The Remote Metamorphic Engine Detecting, Evading, Attacking the AI and Reverse Engin the next gen of emergency ph0nage T1 Jeopardy 2 T1 Jeopardy 1 Stumping the Mobile Chipset sticky keys to the kingdom Stargate Pivoting Through VNC To Own Internal Networks so you think you want to be a pentester Slouching Towards Utopia The State of the Internet Dream Sk3wlDbg Emulating all well many of the things with Ida Six Degrees of Domain Admin Side channel attacks on high security electronic safe locks sentient storage do ssd's have a mind of their own secure penetration testing operations SE 301 The Live SE Podcast SE 205 Advanced Social Engineering Techniques and The Rise of Cyber Scam Industrial SE 204 How to Un Work your job Revolutionism Radicals, and Engineering by Committee SE 203 SCAM CALL Call Dropped SE 202 Total Fail and Bad Mistakes I've Made a Few SE 201 Human Hacking You ARE the weakest link SE 105 You are being manipulated SE 104 US Interrogation Techniques and Social Engineering SE 103 7 Jedi Mind Tricks Influence Your Target without a Word SE 102 The Wizard of Oz Painting a reality through deception SE 101 Does Cultural differences become a barrier for social engineering Samsung Pay Tokenized Numbers, Flaws and Issues Robot Hacks Video Games How TASBot Exploits Consoles with Custom Controllers Retweet to win How 50 lines of Python made me the luckiest guy on Twitter Research on the Machines Help the FTC Protect Privacy & Security real time bluetooh device detection with blue hydra propaganda and you Project CITL Playing Through the Pain The Impact of Secrets and Dark Knowledge Platform Agnostic Kernel Fuzzing pin2pwn How to Root an Embedded Linux Box with a Sewing Needle Picking Bluetooth Low Energy Locks from a Quarter Mile Away phishing without failure and frustration PH 301 Packet Hacking Village, Block 5 PH 202 Packet Hacking Village, Block 4 PH 201 Packet Hacking Village, Block 3 PH 102 Packet Hacking Village, Block 2 PH 101 Packet Hacking Village, Block 1 network protocol reverse engineering Mr Robot Panel MouseJack Injecting Keystrokes into Wireless Mice mouse jiggler offense and defense malware command and control channels a journey into darkness Maelstrom are you plaing with a full deck Machine Duping Pwning deep learning systems LOCK 302 Sesame Style Pad Locks LOCK 203 Intro to LockpickingPower LOCK 202 Intro to LockpickingPower LOCK 201 Intro to LockpickingDuffley LOCK 104 Intro to Lock PickingFitzhugh LOCK 102 Locking Picking 101 LOCK 101 Locking Picking 101 Light Weight Protocol!
Leer más

Vídeos de Black Hat USA 2016

Ya también están disponibles de los vídeos de Black Hat USA 2016, así como el material presentado: Why This Internet Worked How We Could Lose It and the Role Hackers Play A Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land The Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android Call Me: Gathering Threat Intelligence on Telephony Scams to Detect Fraud Applied Machine Learning for Data Exfil and Other Fun Topics Canspy: A Platform for Auditing Can Devices Dangerous Hare: Hanging Attribute References Hazards Due to Vendor Customization Over the Edge: Silently Owning Windows 10's Secure Browser How to Make People Click on a Dangerous Link Despite Their Security Awareness Certificate Bypass: Hiding and Executing Malware From a Digitally Signed Executable Pay No Attention to That Hacker Behind the Curtain: A Look Inside the Black Hat Network Drone Attacks on Industrial Wireless: A New Front in Cyber Security Hackproofing Oracle Ebusiness Suite Using Undocumented CPU Behavior to See Into Kernel Mode and Break Kaslr in the Process Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool Measuring Adversary Costs to Exploit Commercial Software Removing Roadblocks to Diversity HEIST: HTTP Encrypted Information Can Be Stolen Through TCP-Windows Memory Forensics Using Virtual Machine Introspection for Cloud Computing Secure Penetration Testing Operations: Demonstrated Weaknesses in Learning Material and Tools Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS Towards a Holistic Approach in Building Intelligence to Fight Crimeware Subverting Apple Graphics: Practical Approaches to Remotely Gaining Root The Remote Malicious Butler Did It!
Leer más

Vídeos de GrrCON 2016

Ya tenemos acceso a los vídeos de las charlas de GrrCON 2016, celebrada en Michigan los pasados 6 y 7 de octubre. 116 Security Guards LOL Brent White Tim Roberts 115 Attacking the Hospitality and Gaming Industries Tracking an Attacker Around the World in 7 Years 318 Welcome to The World of Yesterday Tomorrow Joel Cardella 317 On being an Eeyore in Infosec Stefan Edwards 217 Phish your employees for fun Kristoffer Marshall 216 Binary Ninja Jared Demott 316 Piercing the Air Gap Network Steganography for Everyone John Ventura 315 So Youve Inherited a Security Department Now What Amanda Berlin 215 Whats in your Top Ten Intelligent Application Security Prioritization Tony Miller 214 Tales from the Cryptanalyst Jeff Man 114 Breaking Android Apps for Fun and Profit Bill Sempf 113 Back to the Future Understanding our future but following the past Kevin Johnson 313 Alignment of business and IT Security Shane Harsch 213 Money Fame Power Build your success as a security professional Nathan Dragun 212 Machine Duping Pwning Deep Learning Systems Clarence Chio 211 Magnetic Stripes 101 Tyler Keeton 112 Guarding Lunch J Wolfgang Goerlich 111 Predator to Prey Tracking Criminals with Trojans and Data Mining for Fun and Profit Ken Westin 110 and bad mistakes Ive made a few Jayson Street 312 Contracting Privacy Security and 3rd Party Nathan Steed Kenneth Coleman 312 Contracting Privacy Security and 3rd Party Nathan Steed Kenneth Coleman 110 and bad mistakes Ive made a few Jayson Street (only first 30 min or so) 210 Encryption Mobility Cloud Oh My Bill Harmer 209 Using Virus Total Intelligence to track the latest Phishing Document campaigns Wyatt Roersma 311 Stop attacking your mothers car Charles Parker II 208 Cruise Ship Pentesting OR Hacking the High Seas Chad M Dewey 207 Quick and Easy Windows Timelines with Pyhon MySQL and Shell Scripting Dr Phil Polstra 310 How to Implement Crypto Poorly Sean Cassidy 309 Reality Checking Your AppSec Program Darren Meyer 308 Bad Guys Look Just Like You Justin Beard 205 Threat Detection Response with Hipara J Brett Cunningham 204 Reversing and Exploiting Embedded Devices Walking the software and hardware stack Elvis Collado 203 Surreal Paradigms Automotive Culture Crash D0xt0r Z3r0 108 Secure Dicks Michael Kemp 206 still broken after all these years aka utility security for smarties doug nibbelink 307 Getting to the Root of Advanced Threats Before Impact Josh Fazio 306 Fighting the Enemy Within Matt Crowe 305 How Do You Secure What You Dont Control Dimitri Vlachos 304 Pentester to customerI will 0wn your network Customer to pentesterNo I will make you cry David F 303 Make STEHM Great Again David HealWHans Schwartzberg 205 Threat Detection Response with Hipara J Brett Cunningham 204 Reversing and Exploiting Embedded Devices Walking the software and hardware stack Elvis Collado 203 Surreal Paradigms Automotive Culture Crash D0xt0r Z3r0 105 Abnormal Behavior Detection in Large Environments Dave Kennedy 302 Five Nights At Freddys What We Can Learn About Security From Possessed Bears Nick Jacob 300 Securing Trust Defending Against Next generation Attacks John Muirhead Gould 202 What do you mean Im pwnd I turned on automatic updates Scott Thomas Jeff Baruth 201 So You Want to Be a Pentester Absolute0x0 200 Internet of Things IoT radio frequency RF Analysis With Software Defined Radio Kevin Bong 103 Becoming a Cyborg The First Step Into Implantable Technology Michael Vieau 102 Weaponizing Nanotechnology and hacking humans defining the boundaries Chris Roberts 100 Act Three The Evolution of Privacy Finux  
Leer más

Bancos franceses empiezan a hacer uso de la tecnología "Motion Code"

Société Générale y Groupe BPCE, dos bancos franceses empiezan a emitir tarjetas de crédito con tecnología “Motion Code” (PDF). Esta tecnología es una vuelta de tuerca a la lucha contra el fraude online. Básicamente lo que hace es generar cada hora un Código de Seguridad nuevo, también llamado Verificación de Datos de Tarjeta, Número de Verificación de Tarjeta, Valor de Verificación de Tarjeta (CVV). Éste código es uno de los datos requeridos para transacciones online, por lo que si alguien te roba los datos de tu tarjeta, tendría un plazo de 1 hora como máximo para efectuar algún tipo de transacción online, lo que sería muy como común.
Leer más

Vídeos de Derbycon 2016

Ya tenemos disponibles los vídeos (faltan algunos) de una de las conferencias que más ha crecido en los últimos años: Derbycon. La edición de este año 2016 acaba de terminar y nos ha dejado un gran número de charlas interesantes: Key Note - Jeffrey Snover, Lee Holmes Carlos Perez - Thinking Purple Ed Skoudis - Internet of Things, Voice Control, AI, and Office Automation: BUILDING YOUR VERY OWN J.A.R.V.I.S. David Maloney, James Lee, Brent Cook, Tod Beardsley, Lance Sanchez - Metasploit Townhall Parker Schmitt - Data Obfuscation: How to hide data and payloads to make them "
Leer más

RootedCON Valencia 2016

El congreso RootedValencia se celebrará los días 9 y 10 de Septiembre. El viernes día 9 tendrá lugar un training llamado "RB16-1 Hacking ético" (pulsa aquí para más información) y durante el sábado día 10 se celebrarán conferencias desde las 10am hasta las 8pm. Nosotros estaremos por allí el sábado para saludar a viejos y nuevos amigos, disfrutar de las conferencias y además tomar algunas cervezas ;) Lugar: ADEIT - Fundación Universidad - Plaza Virgen de la Paz, 3, 46001 Valencia (España)
Leer más