Site uses cookies to provide basic functionality.
Javascript rendering is set to off by default when visiting the site via .onion and .i2p domains. It can be enabled back again in user's settings section. Javascript rendering set to off means, that you can disable javascript in your browser now and the site will remain functional.
There is also IRC server now available via native IRC clients or non javascript web based one.
Fonts can be adjusted in user's settings section as well.
Check FAQ for more.

OK

Networks
Languages
1 2 3 5 7 11 16 23 34 50 73 106 154 225 327 456 475 690 769 984 1003 1132 1234 1305 1353 1386 1409 1425 1434 1435 1436 1437 1438 1443 1448 1452 1454 1456 1457 1458 1459 ▲ ▼
Proper network infrastructure configuration is a crucial step in a successful defense in depth strategy for any organization. The fact that the network fabric is susceptible to these attacks years after their initial discovery is alarming and disgusting at the same time. We propose to revisit these attacks using contemporary techniques and tools and also offer equally contemporary solutions to mitigate or foil these malicious networks attac....
A different approach to JavaScript obfuscation will be presented. There are certain telltale indicators within an obfuscated JavaScript file which can be used for detection and protection. These signs occur in almost all obfuscated JavaScript and are easily detected via software and visual inspection. This different approach addresses these telltale indicators and provides a method of JavaScript obfuscation which hides these indicators from....
Ever since SirDystic's SMBRelay release the weaknesses of the NTLM protocol have been repeatedly shown. For over twenty years this protocol has been refined by Microsoft, it's time to let it go and stop supporting it within our networks. This presentation will trace the history of the NTLM protocol and the various attacks that have befallen it over the past decade, the attempts at fixing them and why these fixes have not succeeded. I w....
How long should my resume be? Do I really need to be a Manager? Do I need to attend business school? What certifications do I need? Does my title matter? Should I go after money or a cool job? What are the hot skills du jour? How do I use LinkedIn and Facebook? All of these questions are asked continually by Information Security professionals as they assess their current positions and determine which future opportunities align with their as....
Recently, the Debian project announced an OpenSSL package vulnerability which they had been distributing for the last two years. This bug makes the PRNG predictable, affecting the keys generated by openssl and every other system that uses libssl (eg. openssh, openvpn). We will talk about this bug, its discovery and publication, its consequences, and exploitation. As well, we will demonstrate some exploitation tools. Luciano Bello is an..
I can't tell you how often I'm listening to trance, goa or industrial when I'm coding. Often when we're stuck in a black hole, or just can't figure the problem out - the right music will help. Why does this work? It seems motivating, and it seems like we solve problems easier, and it seems to create a flow. Turns out, your brain is like a tuning fork. This talk will include a bit of biology - going over the basics of the brain structures, n..
In this confused rant^W^W talk, I will explain why the little green men are right, and also know how to party. I will show you some new toys. Shiny ones. Ones that go 'beep' and have flashy lights. You will like it, and I will be able to return to my home planet, mission accomplished, to the adulation of the triple-breasted masses and the reward of a grateful nation, followed by tea, medals and an inadequate state pension. Or I'll go to jai....
Many high security lock manufacturers claim that their cylinders are impervious to covert methods of entry including picking, bumping, and decoding and that they offer high levels of key control, effectively preventing the illegal or unauthorized duplication of their keys. New and unique methods to compromise one of the most secure locks in America by forced, covert, and surreptitious entry were developed during an eighteen month research p....
ModScan is a new tool designed to map a SCADA MODBUS TCP based network. The tool is written in python for portability and can be used on virtually any system with few required libraries. The presentation includes a demonstration of the ModScan scanner as well as a rundown of the various features and modes available. I will also be covering the MODBUS and MODBUS TCP protocols including packet construction and communication flows. A brief SCA....
As pentesters and hackers we often find the need to create our exploits on the fly. Doing this always presents a challenge. But one challenge took us to a new limit and a new level. We want to share the method with you. From Bug to 0Day will show the audience the process of fuzzing, locating the bug, using egghunters then figuring out to build a pure alphanumeric shellcode to exploit it. This will truly be the most mind bending 60 min....
Discover the great mystery that is the Emergency Alert System. An elaborate way for the President of the United States to have his or her voice heard from every broadcast outlet at the same time. It can also perform other less important rolls such as letting the public know when their lives may be in danger by several natural occurring and man made events. Matt Krick is Chief Engineer of New West Broadcasting Systems, Inc., Operators o..
Not every bad guy writes down passwords on sticky note by their monitor. Not every system administrator fully documents everything before they leave. There are a lot of legitimate reasons why you might need to crack a password. The problem is most people don't have a supercomputer sitting in their basement or the money to go out and buy a rack of FPGAs. This talk deals with getting the most out of the computing resources you do have when cr....
While many aftercare solutions and recommendations cover "average American" needs, none have tackled, full-on, the needs of the rapidly growing high tech segment of the population. As the amount of passwords and other secret "brainspace-only" information grows for many, many, individuals, it becomes obvious that a solution is needed for the dispensation of this information in the event of one's death or extreme disablement. It turns out tha....
In this talk I will be discussing Exploit Chaining in Web Applications and CSRF. I will discuss the surface area problem in security and how to gain access to a l attack surface using CSRF. I will detail the process I used to find and exploit a vulnerability in a real world application. I will discuss how to have fun in a sandbox and defeating CSRF protection. I will also talk about the defenses against these attacks. I will be releasing an....
This presentation will detail two methods of breaking captcha. One uses RainbowCrack to break a visual captcha. The other uses fuzzy logic to break an audio captcha. Both methods are 100% effective. These are real attacks that affect real world software: CVE-2008-2020 CVE-2008-2019. Exploit code is available to the public Michael Brooks is a puzzle master. Some people like Sudoku, but Michael likes hacking. Michael is a Computer Scienc....
This talk will focus on using a debugger to reverse engineer malware, with an emphasis on building decryption tools for credential recovery and command/control (c&c) inspection. Most modern-day trojans exhibit cryptography, or just home-grown obfuscation techniques, to prevent analysis of the stolen data or c&c protocol. This presentation will show how to script the debugger such that it leverages the trojan's own internal functions to decr....
Last year during my Tor presentations at Black Hat and Defcon, and in a follow up post on BugTraq, I announced that many SSL secured websites are vulnerable to cookie hijacking by way of content element injection. Unfortunately, my announcement was overshadowed by Robert Graham's passive cookie stealing attacks (aka 'SideJacking'). The difference between our attacks is this: instead of sniffing passively for cookies, it is possible to ....
Digital Cinema. Its the first major upgrade to a movie's image in more than 50 years, and it has brought new standards of quality, security, and technology into your local theater complex. This talk will cover what the new BIG PICTURE is all about, the changes made from film, both in the image and sound, and the new security methods involved that help prevent piracy. 3D and alternative content will also be discussed. Come see where the tech..
CAPTCHAs are widely used to protect websites against malicious robots. Yet, CAPTCHAs are being broken routinely by spammers, malware authors, and other nefarious characters. This talk will review and demonstrate many of the implementation weaknesses that are routinely exploited to break image-based CAPTCHAs, and offer suggestions for improving the effectiveness of CAPTCHAs. Rather than attempt an in-depth examination of any single CAPTCHA o....
We now live in an age where attacks on critical infrastructure will cause real world harm. An increasing global concern regarding cyber-terrorism reflects the problem critical infrastructure security poses for many large IT consulting companies, telecommunications providers, utilities and industrial companies. SCADA networks are the foundation of the infrastructure which makes everyday life possible in most first world countries. This ....
With VoIP devices finding their way into the majority of major enterprises and a significant number of residential installations, the possible consequences of a security vulnerability that can be leveraged by malicious hackers are ever increasing. While the security of data and voice traffic has been extensively promoted and tested the security of the devices themselves has been poorly tested at best. A remote vulnerability in a VoIP device....
Feel safe and comfortable browsing the Internet with impunity because you are using Tor? Feel safe no more! We present an attack on the Tor network that means that the bad guys could find out where you are going on the Internet while using Tor. This presentation goes over the design decisions that have made this attack possible, as well as show results from a Tor network that reveals the paths that data travels when using Tor. This method c....
Social Networking is shaping up to be the perfect storm... An implicit trust of those in one's network or social circle, a willingness to share information, little or no validation of identity, the ability to run arbitrary code (in the case of user-created apps) with minimal review, and a tag soup of client-side user-generated HTML (Hello? MySpace? 1998 called. It wants its markup vulns back). Yikes. But enough about pwning the kid fro....
More and more scientific studies are weighing in on video games and their positive benefits. The dated idea of video games being damaging to one's health and a waste of time is slowly being replaced with the idea of video games as high-tech therapy. By incorporating sensors to measure the player's physiological state, game play performance can be affected or altered. Among the various types of biofeedback, heart rate variability is one of t....
Although it's not something new at all, network administrators are still facing (and having to deal) with old problems and threats. One of these problems is to be able to detect rogue and/or fake access points in their networks and surroundings. The current solutions available are mostly commercial and/or proprietary, but we haven't seen yet any open-source tool that implements specifically WIDS capabilities. We would like to introduce to D....
This presentation discusses the techniques employed by a new anti-reverse engineering tool named PE-Scrambler. Unlike a traditional executable packer which simply compresses or encrypts the original executable, this tool has the ability to permanently modify the compiled code itself. With the ability to modify compiled programs at the instruction level a vast array of Anti-Reverse Engineering techniques are possible that would traditionally....
Paging networks once sat at the top of the personal and professional communication pyramid. Cell phone technology's have since replaced the now legacy networks at the consumer level, with the exception of niche markets (Due to the signal quality in doors: IT, Emergency Services, Government) the technology may have been retired to a permanent stay in a junk pile. With the fleeing attention and use, it appears that sniffing/interception of pa....
Think that latest buffer overflow or XSS exploit matters? It doesn't. Think your network is secure because you have the latest and greatest IPS? It isn't. The truth is all exploits or defenses on their own are worthless; it's how you use your tools and respond to incidents that really matters. This panel, composed of top vulnerability and security researchers, will roll through a rapid-fire series of demonstrations as they smash through the....
Get the latest information about how the law is racing to catch up with technological change from staffers at the Electronic Frontier Foundation, the nation's premiere digital civil liberties group fighting for freedom and privacy in the computer age. This session will include updates on current EFF issues such as NSA wiretapping and fighting efforts to use intellectual property claims to shut down free speech and halt innovation, highlight....
An autoimmune disorder is a condition that occurs when the immune system mistakenly attacks and destroys healthy body tissue. This presentation is about discovery of autoimmunity disorder in select open source and commercial 802.11 AP implementations. By sending specially crafted packets, it is possible to trigger autoimmunity disorder and cause AP to turn hostile against its own clients. Eight examples of autoimmune disorder will be demons....
Black vs. White: The complete life cycle of a real world breach combines a unique idea and a real-world case study from a client of ours that details the start of a hack to the identification, forensics, and reversing. We will be discussing some advanced penetration techniques and reversing topics. Starting off, we will be performing a full system compromise from the internet (complete with live demos), installing some undetectable viruses,....
The Center for Strategic and International Studies (CSIS) has established a Commission on Cyber Security for the 44th Presidency - the administration that will take office in January 2009. The goal of the nonpartisan Commission is to develop recommendations for a comprehensive strategy to improve cyber security in federal systems and in critical infrastructure. Hear what is going on with this Commission, ask questions, and provide input on ....
If you were to "hack the planet" how many hosts do you think you could compromise through a single vulnerable application technology? A million? A hundred-million? A billion? What kind of application is so ubiquitous that it would enable someone to launch a planet-wide attack? - why, the Web browser of course! We've all seen and studied one side of the problem - the mass- defacements and iframe injections. But how many vulnerable Web browse....
OpenVMS is considered a highly secure and reliable operating system relied upon by large enterprises around the globe such as Stock Exchanges, Governments and Infrastructure for critical operations. Our talk will focus on subverting the security of the OpenVMS operating system in a number of new and creative ways. There will be an initial brief introduction to the OS basics, security model and its core features. We will also talk about thin....
Our talk will start with some of our latest and greatest hacks. In 2003 we were the first to analyze the security of Diebold's AccuVote-TS voting machine software. We'll discuss the inside scoop on how we got the code, broke it, and then went public. In 2008 we also published the first attacks against a real, common wireless implantable medical device - an implantable defibrillator and pacemaker - and we did so using off-the-shelf software ....
Some of the panel members in previous years: Andrew Fried IRS Thomas Grasso FBI Dan Hubbard Websense Dan Kaminsky IOActive Randy Vaughn Baylor Paul Vixie ISC This year's panel members will be announced closer to the conference date. Continuing our new tradition from the past two years, leading experts from different industries, academia and law enforcement will go on stage and participate in this panel, discussing t....
Rich Internet Applications (RIA) represent the next generation of the Web. Designed to run without constant Internet connectivity, they provide a graphical experience equivalent to thick desktop applications with the easy install experience of thin Web apps. They intentionally blur the line between websites and traditional desktop applications and greatly complicate the jobs of web developers, corporate security teams, and external security....
Ever had to sweat through an interrogation or watch some poor sap suffer a similar fate? Have you ever wanted to turn the tables and put those cruel individuals responsible on the chopping block? Well, now you can! With representatives from NSA, NASA, FBI, IRS, DHS, and other fine Federal agencies, you will have an abundance of opportunities to attempt to humiliate, harass, threaten, or even bring them to tears. Go ahead hack away and take ....
Internet Kiosks have become common place in today's Internet centric society. Public Internet Kiosks can be found everywhere, from Airports, Train stations, Libraries and Hotels to corporate lobbies and street corners. Kiosks are used by thousands of users daily from all different walks of life, creed, and social status. Internet kiosk terminals often implement custom browser software which rely on proprietary security mechanisms and a....
David Hahn was working on his atomic energy Eagle Scout badge when he had the idea why not build a reactor. However, not just any reactor, he would build a breeder reactor. This type of reactor produces more fuel and power as long as it is working. David used social engineering, unlimited drive and resourcefulness to produce his reactor type device. He succeeded further that any expert in the nuclear world would have dreamed. Ultimate....
The presentation will deal briefly (20 minutes) with the concepts surrounding Open Source Warfare (OSW) and broader adoption for use not only within the context of war fighting, but also its uses within the political arena in order to influence opinion. The presentation will only deal with publicly available data, couple with real world deployment examples. It WILL NOT contain any type of classified data or anything that can be constru....
Urban Exploration is the practice of discovering and exploring (and often photographing) the more "off-beat" areas of human civilization. Popular targets of Urban Exploration include abandoned hospitals or institutions, empty factories, and other disused structures, but it can also include "active" sites such as service corridors, utility levels, rooftops, storm drains, steam tunnels, you name it. For years, the Urban Exploration commu....
The wonders of technology have given rise to a new breed of workforce, the mobile workforce. Able to leap large oceans in a single cattle class bound, they are the newest agent of business and the newest pain in your butt. The average business traveler carries with him a multitude of ways to get pwn'd while away from the office and away from your watchful BOFH eye. Come count the ways we can pwn that beleaguered business traveler without ev....
1 2 3 5 7 11 16 23 34 50 73 106 154 225 327 456 475 690 769 984 1003 1132 1234 1305 1353 1386 1409 1425 1434 1435 1436 1437 1438 1443 1448 1452 1454 1456 1457 1458 1459 ▲ ▼
4 visitors online