<img src="/media/2022/img/sugarskull-2019_200h_KQlJRqW_Ed0P2CJ.png" id="event-logo" alt="The event's logo">

ICS Ransomware and Lessons from Conti Chat Logs

W. Garrett Myler

A recent report highlights the threat ransomware poses to critical infrastructure, that the manufacturing sector is the target of choice, and that Lockbit 2.0 and Conti groups account for over half of ICS ransomware attacks in 2021. However - sector wide - wind, food and beverage, and rail sectors appear to be more vulnerable than manufacturing. An independent analysis of recently-leaked Conti chat logs provides insight into ransomware targeting and nuance in assessing cyber risk.

10:00

Stop Trying to be a Unicorn!

Chip Thornsburg

What do you really need to do to break into the cyber security field? In a world that focuses on that “one” individual or that “one” company as a measure of success, where do you start? What formal education and certifications really pay off when trying to join the cyber workforce?

10:00

Threat Modeling in 600 seconds or less (ok, I lied, more like 2,400)

Kat Fitzgerald

Threat Modeling in only 10 minutes? I’m in!! Oh wait, it’s really 40 minutes? That’s cool, I can work that in. Yes, Threat Modeling is both FUN and EXCITING and can shave tons of time off SDLC - if done right. So let’s get down and dirty and see what it takes to do a good Threat Model!!

11:00

Advancing DevSecOps Metrics

Mark Peters

Everyone wants better metrics to make better decisions. Do you know how to advance your metrics to create success? Integrate a clear path to improved performance.

Imagine if interviewers would apply emotional intelligence, fairly, to every interview, eliminating bias and giving candidates a fair chance to show their capabilities.
Beyond compliance measures and the basic measuring of required skills, we need to get to the root of the ultimate qualifier: WILLINGNESS AND ABILITY, and eliminate behaviors that create extra challenge to individuals who are battling invisible obstacles like neurodiversity.

11:00

Watching Kittens at Play: Dissecting an Iranian Nation State Interactive Intrusion

Ryan Thompson

State-nexus threat actors are often perceived as mythological creatures that can infiltrate a system with a snap of their fingers and operate without a trace. While threat actors should not be underestimated, they work within the same constraints that operating systems place on all users. Through a retrospective look at a PIONEER KITTEN intrusion, attendees will gain insight into how nation state-nexus actors operate in the wild and how to unearth adversarial tradecraft in their own environment.

11:30

120min

Lunch (11:30-1:30)

Track 1 (UC Conference Rm A)

11:30

120min

Lunch (11:30-1:30)

Track 2 (Moody Rm 101)

11:30

120min

Lunch (11:30-1:30)

Track 3 (Moody Rm 102)

11:30

JavaScript Obfuscation - It’s All About the P-a-c-k-e-r-s

Or Katz

The usage of JavaScript obfuscation techniques have become prevalent in today’s threats, from phishing, Magecart and supply chain injection to malware droppers. This presentation will introduce a technique that focuses on the detection of JavaScript packers in order to detect obfuscated files.

13:00

A Log4Shell Practice Exploitation Range in the Cloud

Karl Sickendick

The Log4Shell vulnerability disturbed more than a few peaceful holiday breaks... Callbacks and shells were popping all over the birdsite, for those of us watching. To play along at home you need some targets though... This talk shows you how to setup those targets in your personal AWS shooting-range in a jiffy (approximately).

13:00

Hacking OT Software – A case study of breaking a wide selection of products

Michael Heinzl

As part of a personal case study, I’ve performed security assessments against a wide selection of OT products from 20+ different vendors, resulting in the discovery of over 300 security vulnerabilities. In this talk I would like to provide an overview of my approach - which was mainly a combination of fuzzing and manual testing, present some specific examples and share my experience and challenges in coordinated disclosure with various CERTs and PSIRTs around the globe.

13:00

Spilling the Beans: How to Spot a Bad Pentest

Qasim Ijaz, Andrew Clinton

Do you want to get more out of your consulting partners or received a pentest report that does not line up with your expectations? Come join us as we spill the beans and disclose how the (halal) sausage is made. We will discuss pentesting from the perspective of both the client and the consultant. If you're looking to land a job at a consultancy, this talk is for you too. As we peel the curtain and talk through real-world examples, everyone walks out with the magic sauce.

14:00

Consumer Identity Theft 101: What You Need To know

Gary Kasper

The Identity Theft course is designed to explain in detail exactly all aspects of consumer Identity Theft. The attendees will have the opportunity to observe how this dangerous crime has grown and directly affect’s individuals, businesses, and large companies. The attendees will have the opportunity enter act through various exercises and learn what identity theft is.

In the Beginning

14:00

Migrating IoT to the Cloud, Security Considerations and Benefits

Jonathan Fisher

Securing IoT devices is complex, but Cloud platforms help alleviate core security concerns such as availability, authentication/authorization, and logging. When migrating IoT devices to the Cloud, which platform should you use? We will introduce core IoT services within the major cloud providers (AWS, Azure, and GCP) and investigate their pros and cons.

14:00

Utilizing Your Skill Sets and Opening New Opportunities from a Different Perspective

Annabelle Klosterman

Empowering technology students and professionals to shift their mindset in order to maximize their full potential as cybersecurity professionals. Technology students and professionals are less likely to pursue opportunities which they believe they are not fully qualified for due to a critical difference in mindset. We introduce a different approach to viewing and applying your skill sets which will open up more opportunities for you to excel in the field.

15:00

Awakened Training

Adam Scchrage

Training has become something that is a necessity but that doesn't mean it has to be boring. With the right person and the right imagination training can be entertaining.

In the Beginning

15:00

Clean Forensics: Analyzing network traffic of vacuum bots

Karan Dwivedi

Have you ever wondered how vacuum bots work under the hood? How safe is your home’s floor plan that these bots automatically scan? This talk will walk you through a step-by-step procedure on how you can perform network forensics on vacuum bots all from the comfort of your own home. The audience walks away with not only the awareness of security and privacy issues with vacuum bots but also a method to research on their own.

15:00

Writing Powerful Pentest Reports

Abhinav Khanna

A penetration testing engagement involves many things, ranging from the initial recon phase to submitting the final deliverable at the end of it all, what is called the penetration testing report.

Often, the quality of this final deliverable gets ignored because of the heavy focus on identifying vulnerabilities. This talk will include the strategies that can be followed to write effective and powerful reports, do's and don'ts to be followed when crafting one penetration testing report.

15:30

Malware Analysis of Microsoft Excel Documents

Mercedes Andreacchi

Phishing continues to be one of the primary ways threat actors successfully deliver malicious code to unsuspecting victims. Very often, the file containing the ill-intended content is a Microsoft Excel file. The presentation will delve into initial triage of two malicious Excel files, followed by more technical deep dive into what "badness" the files contain and how to extract indicators of compromise that can benefit the greater community.

In the Beginning

16:00

Beat'em at Their Own Game - Darkweb Intelligence

Saurabh Chaudhary

Catch threats before they become incidents, having said that darkweb is the first place where your organization’s breached data usually lands.
Darkweb threats are rising exponentially, threat actors progressively gather across the dark web to coordinate, plan, and launch attacks. We can leverage Darkweb as a source for vital and invaluable actionable intelligence to be used to presciently fight against adversaries, and we can use the intelligence to substantially reduce loss.

16:00

I Know What You Did Last Summer… I’m Still Hacking Your Small Business

iamv1nc3nt

In this talk, we’ll explore the steps an attacker might use to mask their identity, hide their tracks, and we’ll examine some real-world scenarios from over the past year where full compromise had been accomplished through human error, seemingly harmless configurations, and vulnerable products. We’ll then explore avenues for engaging employees and management through gamification and we’ll outline several cost-effective measures to create a more hardened environment.

16:30

Know the Environment Better Than Devs, how network data can power visibility, detection, and response programs for securing cloud workloads

Edward Wu

In this talk, we explore how network data can be utilized to secure cloud workloads. We will walk through practical deployment approaches and scenarios for gathering and utilizing network data in cloud environments. We will also show concrete examples of how data plane visibility gained from network data can materially improve the visibility, detection, and response capabilities of security teams responsible for cloud workloads.