Site uses cookies to provide basic functionality.
Javascript rendering is set to off by default when visiting the site via .onion and .i2p domains. It can be enabled back again in user's settings section. Javascript rendering set to off means, that you can disable javascript in your browser now and the site will remain functional.
There is also IRC server now available via native IRC clients or non javascript web based one.
Fonts can be adjusted in user's settings section as well.
Check FAQ for more.

OK

Networks
Languages
1 2 3 5 7 11 16 23 34 50 73 106 154 225 327 456 475 690 769 984 1003 1132 1229 1230 1231 1232 1233 1234 1305 1353 1386 1409 1425 1436 1443 1448 1452 1454 1456 1457 1458 1459 ▲ ▼
gitDigger: Creating useful wordlists from public GitHub repositories JAIME FILSON (WIK) ROB FULLER (MUBIX) This presentation intends to cover the thought process and logistics behind building a better wordlist using github public repositories as its source. With an estimated 2,000,000 github projects to date, how would one store that amount of data? Would you even want or need to? After downloading approximately 500,000 repositories....
gitDigger: Creating useful wordlists from public GitHub repositories JAIME FILSON (WIK) ROB FULLER (MUBIX) This presentation intends to cover the thought process and logistics behind building a better wordlist using github public repositories as its source. With an estimated 2,000,000 github projects to date, how would one store that amount of data? Would you even want or need to? After downloading approximately 500,000 repositories....
VoIP Wars: Return of the SIP FATIH OZAVCI INFORMATION SECURITY RESEARCHER AND CONSULTANT, VIPROY SECURITY NGN (Next Generation Network) is modern TDM/PSTN system for communication infrastructure. SIP (Session Initiation Protocol) Servers are center of NGN services, they provide signaling services. SIP based communication is insecure, because of protocol implementation. Based on this fact, NGN is not actually Next Generation. It can be h....
VoIP Wars: Return of the SIP FATIH OZAVCI INFORMATION SECURITY RESEARCHER AND CONSULTANT, VIPROY SECURITY NGN (Next Generation Network) is modern TDM/PSTN system for communication infrastructure. SIP (Session Initiation Protocol) Servers are center of NGN services, they provide signaling services. SIP based communication is insecure, because of protocol implementation. Based on this fact, NGN is not actually Next Generation. It can be h....
Fast Forensics Using Simple Statistics and Cool Tools JOHN ORTIZ COMPUTER ENGINEER, CRUCIAL SECURITY/HARRIS Ever been attacked by malicious code leaving unknown files all over your computer? Trying to figure out if a file is encrypted or just compressed? Is the file really something else? Is there hidden data? Are you short on time! This talk leads you through file identification and analysis using some custom FREE tools that apply stat....
Fast Forensics Using Simple Statistics and Cool Tools JOHN ORTIZ COMPUTER ENGINEER, CRUCIAL SECURITY/HARRIS Ever been attacked by malicious code leaving unknown files all over your computer? Trying to figure out if a file is encrypted or just compressed? Is the file really something else? Is there hidden data? Are you short on time! This talk leads you through file identification and analysis using some custom FREE tools that apply stat....
Stalking a City for Fun and Frivolity BRENDAN O'CONNOR Tired of the government being the only entity around that can keep tabs on a whole city at once? Frustrated by dictators du jour knowing more about you than you know about them? Fed up with agents provocateur slipping into your protests, rallies, or golf outings? Suffer no more, because CreepyDOL is here to help! With open-source software, off-the-shelf sensors, several layers of ....
Stalking a City for Fun and Frivolity BRENDAN O'CONNOR Tired of the government being the only entity around that can keep tabs on a whole city at once? Frustrated by dictators du jour knowing more about you than you know about them? Fed up with agents provocateur slipping into your protests, rallies, or golf outings? Suffer no more, because CreepyDOL is here to help! With open-source software, off-the-shelf sensors, several layers of ....
Please Insert Inject More Coins NICOLAS OBERLI SECURITY ENGINEER, SCRT The ccTalk protocol is widely used in the vending machine sector as well as casino gaming industry, but is actually not that much known, and very little information exists about it except the official documentation. This protocol is used to transfer money-related information between various devices and the machine mainboard like the value of the inserted bill or how ....
Please Insert Inject More Coins NICOLAS OBERLI SECURITY ENGINEER, SCRT The ccTalk protocol is widely used in the vending machine sector as well as casino gaming industry, but is actually not that much known, and very little information exists about it except the official documentation. This protocol is used to transfer money-related information between various devices and the machine mainboard like the value of the inserted bill or how ....
The Road Less Surreptitiously Traveled PUKINGMONKEY Anonymously driving your own vehicle is becoming unattainable with the proliferation of automatic license plate readers (ALPRs) now coming into wide-spread use. Combined with always-on electronic toll tags, smart phone traffic apps and even plain cell phones are adding to this problem. There is little public disclosure of this tracking and little legislation limiting the length of time....
The Road Less Surreptitiously Traveled PUKINGMONKEY Anonymously driving your own vehicle is becoming unattainable with the proliferation of automatic license plate readers (ALPRs) now coming into wide-spread use. Combined with always-on electronic toll tags, smart phone traffic apps and even plain cell phones are adding to this problem. There is little public disclosure of this tracking and little legislation limiting the length of time....
Kill 'em All — DDoS Protection Total Annihilation! TONY MIU TECHNICAL DIRECTOR, BLOODSPEAR RESEARCH GROUP WAI-LENG LEE VP OF ENGINEERING, BLOODSPEAR RESEARCH GROUP With the advent of paid DDoS protection in the forms of CleanPipe, CDN / Cloud or whatnot, the sitting ducks have stood up and donned armors... or so they think! We're here to rip apart this false sense of security by dissecting each and every mitigation techniques you can ....
PowerPreter: Post Exploitation Like a Boss NIKHIL MITTAL SECURITY RESEARCHER Powerpreter is "The" post exploitation tool. It is written completely in powershell which is present on all modern Windows systems. Powerpreter has multiple capabilties which any post exploitation shell worth its salt must have, minus the detection by anti virus or other countermeasure tools. Powerpreter has, to name a few, functions like stealing infromation, ....
PowerPreter: Post Exploitation Like a Boss NIKHIL MITTAL SECURITY RESEARCHER Powerpreter is "The" post exploitation tool. It is written completely in powershell which is present on all modern Windows systems. Powerpreter has multiple capabilties which any post exploitation shell worth its salt must have, minus the detection by anti virus or other countermeasure tools. Powerpreter has, to name a few, functions like stealing infromation, ....
Getting The Goods With smbexec ERIC MILAM PRINCIPAL CONSULTANT, ACCUVANT LABS Individuals often upload and execute a payload to a remote system during penetration tests for foot printing, gathering information, and to compromise additional hosts. When trying to remain stealthy, uploading a shell to a target may not be wise. smbexec takes advantage of native Windows functionality and SMB authentication to execute commands on remote Windo....
Getting The Goods With smbexec ERIC MILAM PRINCIPAL CONSULTANT, ACCUVANT LABS Individuals often upload and execute a payload to a remote system during penetration tests for foot printing, gathering information, and to compromise additional hosts. When trying to remain stealthy, uploading a shell to a target may not be wise. smbexec takes advantage of native Windows functionality and SMB authentication to execute commands on remote Windo....
A Thorny Piece Of Malware (And Me): The Nastiness of SEH, VFTables & Multi-Threading MARION MARSCHALEK ANALYST, IKARUS SECURITY SOFTWARE GMBH Reverse Engineering is the supreme discipline in analyzing malware, how else would you find out all capabilities of a malicious sample? But this task gets trickier nearly every day, as malware authors apply new techniques to evade analysis. Even worse, documentation of said techniques is barely ex....
A Thorny Piece Of Malware (And Me): The Nastiness of SEH, VFTables & Multi-Threading MARION MARSCHALEK ANALYST, IKARUS SECURITY SOFTWARE GMBH Reverse Engineering is the supreme discipline in analyzing malware, how else would you find out all capabilities of a malicious sample? But this task gets trickier nearly every day, as malware authors apply new techniques to evade analysis. Even worse, documentation of said techniques is barely ex....
Pwn The Pwn Plug: Analyzing and Counter-Attacking Attacker-Implanted Devices WESLEY MCGREW RESEARCH ASSOCIATE, MISSISSIPPI STATE UNIVERSITY Malicious attackers and penetration testers alike are drawn to the ease and convenience of small, disguise-able attacker-controlled devices that can be implanted physically in a target organization. When such devices are discovered in an organization, that organization may wish to perform a forensic....
GoPro or GTFO: A Tale of Reversing an Embedded System TODD MANNING SENIOR RESEARCH CONSULTANT, ACCUVANT LABS ZACH LANIER SENIOR RESEARCH CONSULTANT, ACCUVANT LABS Embedded systems are shrinking in size and becoming widely used in many consumer devices. High quality optic sensors and lenses are also shrinking in size. The GoPro Hero 3 camera leverages high quality camera equipment with multiple embedded operating systems to offer no....
Torturing Open Government Systems for Fun, Profit and Time Travel TOM KEENAN PROFESSOR, UNIVERSITY OF CALGARY "I'm from the government and I'm here to help you" takes on a sinister new meaning as jurisdictions around the world stumble over each other to 'set the people's data free'. NYC boasts in subway ads that 'our apps are whiz kid certified' (i.e. third party) which of course translates to 'we didn't pay for them, and don't blame us....
Torturing Open Government Systems for Fun, Profit and Time Travel TOM KEENAN PROFESSOR, UNIVERSITY OF CALGARY "I'm from the government and I'm here to help you" takes on a sinister new meaning as jurisdictions around the world stumble over each other to 'set the people's data free'. NYC boasts in subway ads that 'our apps are whiz kid certified' (i.e. third party) which of course translates to 'we didn't pay for them, and don't blame us....
Resting on Your Laurels will get you Pwned: Effectively Code Reviewing REST Applications to avoid getting powned ABRAHAM KANG DIRECTOR OF R&D AT SAMSUNG DINIS CRUZ Public REST APIs have become mainstream. It is not just startups such as Facebook and twitter at the fore front of the REST revolution. Now, almost every company that wants to expose services or an application programming interfaces does it using a publicly exposed REST AP....
Dude, WTF in my car? ALBERTO GARCIA ILLERA JAVIER VAZQUEZ VIDAL The ECU tuning market is weird. There is little help from people in it, and most of the equipment is expensive. Well, not anymore! After hacking some equipment worth thousands of dollars, a new toy was born. Seed/Key algos broken, RSA bustedÖ We will learn all about Bosch EDC15 and EDC16 car ECUs. How they communicate, what protocols they use, their security and why it ....
Dude, WTF in my car? ALBERTO GARCIA ILLERA JAVIER VAZQUEZ VIDAL The ECU tuning market is weird. There is little help from people in it, and most of the equipment is expensive. Well, not anymore! After hacking some equipment worth thousands of dollars, a new toy was born. Seed/Key algos broken, RSA bustedÖ We will learn all about Bosch EDC15 and EDC16 car ECUs. How they communicate, what protocols they use, their security and why it ....
The Bluetooth Device Database RYAN HOLEMAN SENIOR SOFTWARE DEVELOPER, ZIFTEN TECHNOLOGIES As of 2013, it is estimated that there are now billions of bluetooth devices deployed worldwide. The goal of the Bluetooth Database Project is to track and freely distribute real time sightings and statistics of these wide spread devices. The data collected from these devices can be used to answer questions pertaining to various topics, such as dev....
The Bluetooth Device Database RYAN HOLEMAN SENIOR SOFTWARE DEVELOPER, ZIFTEN TECHNOLOGIES As of 2013, it is estimated that there are now billions of bluetooth devices deployed worldwide. The goal of the Bluetooth Database Project is to track and freely distribute real time sightings and statistics of these wide spread devices. The data collected from these devices can be used to answer questions pertaining to various topics, such as dev....
Phantom Network Surveillance UAV / Drone RICKY HILL SECURITY CONSULTANT DARPA, 2011, sponsored a contest named UAVForge which challenged teams to build a prototype unmanned aerial vehicle (UAV). Mission: "UAV must be small enough to fit in a soldier's rucksack and able to fly to, perch & stare from useful locations for several hours near targets of interest to provide real-time (visual) persistent surveillance." Long story short: 140 te....
Phantom Network Surveillance UAV / Drone RICKY HILL SECURITY CONSULTANT DARPA, 2011, sponsored a contest named UAVForge which challenged teams to build a prototype unmanned aerial vehicle (UAV). Mission: "UAV must be small enough to fit in a soldier's rucksack and able to fly to, perch & stare from useful locations for several hours near targets of interest to provide real-time (visual) persistent surveillance." Long story short: 140 te....
So You Think Your Domain Controller is Secure? JUSTIN HENDRICKS SECURITY ENGINEER, MICROSOFT Domain Controllers are the crown jewels of an organization. Once they fall, everything in the domain falls . Organizations go to great lengths to secure their domain controllers, however they often fail to properly secure the software used to manage these servers. This presentation will cover unconventional methods for gaining domain admin by ..
So You Think Your Domain Controller is Secure? JUSTIN HENDRICKS SECURITY ENGINEER, MICROSOFT Domain Controllers are the crown jewels of an organization. Once they fall, everything in the domain falls . Organizations go to great lengths to secure their domain controllers, however they often fail to properly secure the software used to manage these servers. This presentation will cover unconventional methods for gaining domain admin by ..
Protecting Data with Short-Lived Encryption Keys and Hardware Root of Trust DAN GRIFFIN PRESIDENT, JW SECURE, INC. The US National Security Agency has been public about the inevitability of mobile computing and the need to support cloud-based service use for secret projects. General Alexander, head of the NSA, recently spoke of using smartphones as ID cards on classified networks. And yet, mobile devices have a poor security track rec....
Protecting Data with Short-Lived Encryption Keys and Hardware Root of Trust DAN GRIFFIN PRESIDENT, JW SECURE, INC. The US National Security Agency has been public about the inevitability of mobile computing and the need to support cloud-based service use for secret projects. General Alexander, head of the NSA, recently spoke of using smartphones as ID cards on classified networks. And yet, mobile devices have a poor security track rec....
JTAGulator: Assisted Discovery Of On-Chip Debug Interfaces JOE GRAND AKA KINGPIN On-chip debug (OCD) interfaces can provide chip-level control of a target device and are a primary vector used by hackers to extract program code or data, modify memory contents, or affect device operation on-the-fly. Depending on the complexity of the target device, manually locating available OCD connections can be a difficult and time consuming task, som....
JTAGulator: Assisted Discovery Of On-Chip Debug Interfaces JOE GRAND AKA KINGPIN On-chip debug (OCD) interfaces can provide chip-level control of a target device and are a primary vector used by hackers to extract program code or data, modify memory contents, or affect device operation on-the-fly. Depending on the complexity of the target device, manually locating available OCD connections can be a difficult and time consuming task, som....
Java Every-Days: Exploiting Software Running on 3 Billion Devices BRIAN GORENC ZERO DAY INITIATIVE, HP SECURITY RESEARCH JASIEL SPELMAN SECURITY RESEARCHER Over the last three years, Oracle Java has become the exploit author's best friend. And why not? Java has a rich attack surface, broad install base, and runs on multiple platforms allowing attackers to maximize their return-on-investment. The increased focus on uncovering weaknesse....
Java Every-Days: Exploiting Software Running on 3 Billion Devices BRIAN GORENC ZERO DAY INITIATIVE, HP SECURITY RESEARCH JASIEL SPELMAN SECURITY RESEARCHER Over the last three years, Oracle Java has become the exploit author's best friend. And why not? Java has a rich attack surface, broad install base, and runs on multiple platforms allowing attackers to maximize their return-on-investment. The increased focus on uncovering weaknesse....
The Politics of Privacy and Technology: Fighting an Uphill Battle ERIC FULTON CEO, SUBSECTOR SOLUTIONS DANIEL ZOLNIKOV STATE REPRESENTATIVE, MONTANA In the past few decades the world has been dramatically transformed by technology. People have significantly evolved in how they interact with each other and the world; a side effect of this evolution is the drastic change in personal privacy. Private citizens, corporations, and governmen....
The Politics of Privacy and Technology: Fighting an Uphill Battle ERIC FULTON CEO, SUBSECTOR SOLUTIONS DANIEL ZOLNIKOV STATE REPRESENTATIVE, MONTANA In the past few decades the world has been dramatically transformed by technology. People have significantly evolved in how they interact with each other and the world; a side effect of this evolution is the drastic change in personal privacy. Private citizens, corporations, and governmen....
Defeating SEAndroid PAU OLIVA FORA SR. MOBILE SECURITY ENGINEER, VIAFORENSICS Security Enhancements for Android (SEAndroid) enables the use of SELinux in Android in order to limit the damage that can be done by malicious apps, trying to make exploitation harder. Some OEMs are trying hard to implement extra mitigations in their devices, especially those aiming to reach the enterprise market. We will present some issues that are found in ....
Defeating SEAndroid PAU OLIVA FORA SR. MOBILE SECURITY ENGINEER, VIAFORENSICS Security Enhancements for Android (SEAndroid) enables the use of SELinux in Android in order to limit the damage that can be done by malicious apps, trying to make exploitation harder. Some OEMs are trying hard to implement extra mitigations in their devices, especially those aiming to reach the enterprise market. We will present some issues that are found in ....
10000 Yen into the Sea FLIPPER The use of a pressure housing in an underwater vehicle can be difficult to implement without becoming a cost-center. Flipper will walk the audience through a new design for an Autonomous Underwater Glider which challenges assumptions about what is required or necessary to deploy sensors, transmitters, and payloads across long distances in the ocean. The speaker assumes no priory knowledge of subject matter....
10000 Yen into the Sea FLIPPER The use of a pressure housing in an underwater vehicle can be difficult to implement without becoming a cost-center. Flipper will walk the audience through a new design for an Autonomous Underwater Glider which challenges assumptions about what is required or necessary to deploy sensors, transmitters, and payloads across long distances in the ocean. The speaker assumes no priory knowledge of subject matter....
1 2 3 5 7 11 16 23 34 50 73 106 154 225 327 456 475 690 769 984 1003 1132 1229 1230 1231 1232 1233 1234 1305 1353 1386 1409 1425 1436 1443 1448 1452 1454 1456 1457 1458 1459 ▲ ▼
139 visitors online