09.00 AM - 09.15 AM

09.15 AM - 10.00 AM

Uncovering and visualizing malicious infrastructure

This presentation describes some of the techniques my co workers and I use to uncover malicious infrastructure by correlating malware variants and their network activities. DNS analysis is the primary method for collecting network call outs, but pcap and flow information will also be shown. Various open source visualization tools will be used to show connections between malware droppers like Emotet, Trickbot, and more. Additionally, the work will show how the attendee can conduct this research within their environment using open source tools and techniques. It is a presentation not just on the relationships between malware in the wild, but also on the art of threat hunting.

10.00 AM - 10.45 AM

Offense vs Defence: red team vs blue team

Following our successful discussion panel last year we now dive in to an interactive discussion about red teams vs blue teams in which we will cover subjects such as:

* Do defensive frameworks really work, pros/cons (eg. MITRE ATT&CK)
* Do commercial off-the-shelf defence tools (eg. AV) still work in 2020?
* With so many tools available in open-source do attackers really have an easier life?

10.45 AM - 11.30 AM

Test beyond XSS/SQLi, these are what you need to pen-test for numeric inputs

One of the most prominent yet widely forgotten input validations for developers is a validation of numbers as developers are constantly brainwashed by the security geeks to have a blacklist of characters such as a single quote for SQLi and dangerous tags for XSS, but not exactly on how to define numbers in corresponding fields.

To address the above point we will start by introducing a basic definition of NaN(Not-A-Number), some fun facts about NaN, namely how NaN != NaN, whether NaN is actually a number and the odd behavior of NaN in lists/arrays. Next, we will discuss how NaN is tied to type checking beyond value checking, leading to the importance of type coercion.

We will then discuss other types of testing numeric inputs, including checking the limit of decimal places, upper and lower bound, and positive and negative value that could potentially lead to rounding errors, integer overflow, or even freezing the system and keeping it in infinite loops because the system did not expect such value from the user as the user input is out of a pre-defined set of values.

Lastly, we want to provide users with mitigations to properly set input validation to the numeric fields that we must not trust any external input or third-party functions for the secure system development.

11.30 AM - 12.15 PM

Asleep at the wheel? The effects of sleep on Cybersecurity professionals

Stress and burnout are problems for cybersecurity professionals, but how do sleep habits fit into this picture? This session will reveal discoveries from a recent survey of cybersecurity professionals’ work patterns, stress levels, and sleep habits. The survey shows that cybersecurity professionals sleep less than the clinically recommended amount and that there may be a correlation between sleep and stress levels. The survey also shows participants’ professional and personal habits may be contributing to reduced quality of sleep which may correlate to their stress levels. This session will also provide suggestions into how - based on the survey and recent academic sleep research - professional and personal habits can be adjusted to possibly help reduce stress, improve health, and be a more effective cybersecurity professional.

12.15 PM - 12.45 PM

Lunch Break

12.45 PM - 13.15 PM

The War for Control of DNS Encryption

Pervasive monitoring of the Internet by both government, corporate, and criminal actors has triggered an encryption wavefront as wide as the Internet itself. DNS, as the map of the Internet’s territory, is seen as especially sensitive and there are now several competing encryption standards waiting to be deployed. In this short talk, Dr. Vixie will explain the original problem, describe the protocol-level solutions, and then show how vendors like Google, Mozilla Corporation, Microsoft, and Apple are deploying these technologies across their product lines. Opinions may also be offered.

13.15 PM - 14.00 PM

Operationalising Threat Intelligence to Protect Business

Most companies are not breached by advanced cyber-attacks but rather from hopeful, opportunistic, and financially motivated cybercriminals. Our cyber threat intelligence community is aware of more than 950 million known IP addresses and domains that are associated with this malicious cyber activity. How can organizations use this intelligence to defend business and information assets at a mass scale? They can protect their business from emerging cyber-attacks using threat intelligence that's predictive, automated and actionable.

14.00 PM - 14.45 PM

0xsp Mongoose red framework

* Introducing development features I have done for this new version.
* How to audit a targeted windows operation system for system vulnerabilities, misconfigurations, and privilege escalation attacks with an agent.
* Replicate the tactics and techniques of an advanced adversary in a network.
* The weaponization of (run-as-user) Windows API function.
* Bypass AV while doing LSASS memory dumping technique.
* Agent Bidirectional communication channel feature with updated attacks.
* Lateral movement technique.

14.45 PM - 15.30 PM

ML Innovation in Telecom Network Security

With the ubiquity of new technology in mobile networks and cellular communications, cyber security is a mandatory key parameter for both subscribers and service providers. Telecom-based vulnerabilities in traditional protocols and services like SS7 are still available and harmful. On the other hand, new technologies open new doors to hackers. In this talk, Ali Abdollahi will demonstrate how we can take advantage of emerging machine learning to reduce the risk of telecom attacks.

15.30 PM