Saluti ai Partecipanti e agli Sponsor
Fine prevista per le 10:45
Il focus principale del mio intervento è sulla cyber OT e sulle tecniche di attacco utilizzate dagli APT. Per rendere più efficace la presentazione utilizzo SCADAsploit, un framework C2 destinato ai sistemi OT. Il suo potente arsenale di moduli post-exploitation per sistemi SCADA/PLC lo rende uno strumento unico nell'Adversary Simulation sia in ambienti IT che OT. Durante la presentazione mostrerò una demo live di come compromettere un'infrastruttura OT composta da una workstation SCADA, un PLC e un sistema HMI (il tutto tramite VM). L'attacco prevede il bypass del sistema EDR della macchina Windows/SCADA, la scansione della rete OT, l'attacco al PLC con conseguente DoS del sistema.
Fine prevista per le 11:30
Inizio gioco
Fine prevista per le 17:30
Windows è certamente la prima piattaforma che venga in mente quando si parla di prodotti di sicurezza host-based, come antivirus ed EDR: questo genere di prodotti ha accompagnato l'intera esistenza di Windows, il loro più grande mercato è Windows. Nonostante ciò, il loro sviluppo è paradossalmente molto più difficoltoso su Windows che su piattaforme dove la necessità di questi prodotti è meno sentita (come macOS, che ha probabilmente il miglior supporto in tal senso. Ma questa è un'altra storia). L'argomento è vasto e il tempo è poco, perciò mi concentrerò su un singolo aspetto problematico: il framework di diagnostica Event Tracing for Windows (ETW) e i risultati dell'ambizione da parte di Microsoft di trasformarlo in una fonte di threat intelligence per prodotti di sicurezza. L'uso di ETW per uno scopo molto diverso da quello per cui era stato creato presenta forti criticità, a cui si sono aggiunte scelte rivelatesi infelici in fatto di schema dei dati, policy di configurazione e policy di accesso delle fonti dati più importanti. In particolare, esaminerò i provider ETW Microsoft-Windows-Threat-Intelligence e Microsoft-Windows-Security-Auditing: i più "amati" dai prodotti di sicurezza e, non a caso, quelli che maggiormente dimostrano i limiti di ETW.
Fine prevista per le 12:15
One of the most important tools used in audits and Red Team campaigns are those we call "Command and Control". There are currently hundreds of them. Public, private, free or paid. Some are as famous as Cobalt Strike, while others are only known by their own creators. The main problem with these tools is the lack of compatibility between them. Despite sharing many common elements, such as communication protocols or deployment and execution methods. After working on different tools that aim to unify the chaotic world of shells and webshells, this ambitious project was born from the same need and aims to streamline and improve the work of pentesters, grouping different tools and techniques in a single graphical interface. In addition, Kitsune is capable of incorporating new functions to already known tools. Some of them have not even been seen before in other C2s. If you've ever had too many terminals open, forgotten where a remote shell was, or missed a GUI for your favorite tool, this talk is for you.
Fine prevista per le 13:00
Acquista il ticket pranzo al seguente link: https://bit.ly/3OSNr8V
Fine prevista per le 14:00
Un momento di svago prima di ricominciare con i talk del pomeriggio!
Fine prevista per le 14:30
I bet if you have your source code hosted on GitHub, you may have Dependabot activated and tell you when there is a vulnerability. However, do you know what those alerts mean? When will you get alerts? Are there any alternatives to Dependabot that you may also consider? For most of the projects that are hosted on GitHub, it is very common to use Dependabot, which has become a GitHub-native app, for dependency vulnerability alerts. However, many of us have not put much thought into when we will get those alerts and is it sufficient to protect our project. If that is not enough, what are our alternatives? Are there more databases out there that provide such vulnerability information and any other tools that we can use? By the end of the talk, the audience will be educated about how vulnerability reports are handled and more attention will be put on dependency vulnerabilities. The audience will also know about other vulnerability databases and scanning tools available and will be able to make a suitable choice to use for their projects. By increasing awareness of supply chain security as a community, we will be able to provide safer code and software for the world.
Fine prevista per le 15:15
This talk aims to explore and understand the various security measures provided by the latest Android OS version (13/14) such as SafetyNet, Google Play Integrity, Device Fingerprint Blacklisting, Anti Objection/Frida modules and ROM integrity checks utilised by sophisticated Financial and Banking Android Applications. First we will discuss the conventional methods used by hackers to bypass hindrances such as Root Checks and SSL pinning which generally involve injecting custom code in runtime with tools such as Magisk, Frida, Objection, Xposed Framework etc. These techniques however do not work on the latest Android versions and we will understand how the advanced security measures detect such techniques. We will then deep dive into novel techniques used by malicious hackers in the wild to defeat such measures. This will cover using Custom Kernels, Custom Recovery images and new frameworks to inject malicious modules into Android and patch the Kernel sneakily to bypass modern detections. We will then discuss how these frameworks can be used to weaponize our attacks and bypass certificate checks to gain complete API level interception. We will showcase our case studies and PoCs where we were able to bypass Root Check and SSL Pinning for sophisticated Banking and Telecom applications on the latest Android versions while utilizing lesser known tools such as KernelSU, Tai Chi, LSposed, Orange Recovery, etc which are used in the blackhat community for carrying out financial frauds and targeted logical attacks on widely used applications. Finally we will talk about numerous tricks and tips developers can use to make the life of hackers more difficult.
Fine prevista per le 16:00
Presentazione Report & Premiazione Squadre
Fine prevista per le 17:00
Saluti ai Partecipanti e agli Sponsor
Fine prevista per le 17:15
