Hackfest 2020

Hackfest 2020 Opening

After several months of analyzing the Covid-19 situation in Quebec, we are happy to announce that Hackfest 2020 will officially be in virtual / remote / Covid-19 mode and that we have adapted our partnership offers accordingly!

Ouverture du Hackfest 2020

Après plusieurs mois à analyser la situation du Covid-19 au Québec, nous sommes heureux d’annoncer que le Hackfest 2020 sera officiellement en mode virtuel/remote/Covid-19 et que nous avons adaptés nos offres de partenariat en conséquence!

Cette présentation débute avec une introduction de notre entreprise La Société-conseil Lambda suivie d’une brève définition de l’Internet des objets et des différents composants d’un objet connecté avant de rentrer dans le vif du sujet : L’Insécurité de l’Internet des objets. Nous soulèverons les problématiques de sécurité de l’Internet des objets et discuterons de la très grande vulnérabilité des objets connectés, les raisons de ces vulnérabilités ainsi que des outils permettant de faire l’audit des vulnérabilités et les tests d’intrusions sur les objets connectés. La présentation va se conclure sur une démonstration « NightClub Bulb » d’exploitation d’une ampoule connectée suivie d’une réflexion sur les enjeux de l’Insécurité de l’IoT.

This is that conversation which needs to happen between a parent and their teenage child about the challenges of growing up in an increasingly connected world. We will discuss many privacy and security related decisions and experiences, and the differing perspectives on each. The reality is we don’t know all we think we know - and neither do our teens. 

This is an opportunity to understand the perspective and impacts of the interplay between a privacy & security-aware parent and teenage daughter as they navigate the competing priorities of parents, schools, peers and teachers in a highly interconnected and data rich world. While news media and the echo chamber might suggest that these things are top of mind, our experience suggests this may not be accurate.

Did you know that, every day across the Internet, each IP address is scanned hundreds of times? Or that more than 2,000 attacks are perpetrated, stealing 1.4 million personal records? That’s right, every single day! Today, there may be a way to rebalance the odds and protect our resources.

As much as red teams love to believe that every vulnerability they uncover poses an immediate and urgent high risk – it is often not the case. Furthermore, it is seen that red teams are great at providing technical solutions, but often also fail to consider the size, scale, and scope of their target’s operations.

At times, framing every successfully executed MITRE ATT&CK technique does not equate to, or presents, a tangible risk to an organization. And presenting them as such ends up exacerbating the disconnect between technical teams and management - where a dire landscape fraught with risks around every corner is presented, with unrealistic goals and targets being proposed for remediation that just does not lend itself to actual implementation, especially within the small-to-medium enterprise landscape.

Hopefully, this speed talk can help red teams think about how to practically evaluate, translate, and present their findings to management. Helping red teams to share their knowledge and engaging in constructive dialogue around the risks an organization faces.

Threat actors have always played the game of emotions. Fear is the emotion they are using right now to lure users to click on an email or manipulate them to install an application. In the last four months, cyber criminals have used fear as their main weapon to compromise users by using pandemic-related themes to deliver malware. The dropped malwares are deadlier and stealthier and are hybrid in nature. There is a need for advanced investigation techniques, like memory forensics that are raiding energy/power sectors and entropy-based detection for new-age trojan exfiltrations. The talk discusses how we use traditional methods to identify these threats, how we cracked some emotet epoch's stealthy nature and also how we added a pinch of new-age forensics tricks to do some big reveals.

With North America famously leading the way in industrial production and technological innovation in its extremely short modern life, it has blasted full-force through many huge economic eras, leaving swaths of forgotten times in its wake. From the Cotton Belt to the Rustbelt, there is an ocean of abandoned buildings to be explored and documented by those brave enough to accept the legal and life-threatening risks involved. "Urban Exploration" is itself becoming an abandoned hobby in a post-9/11 world, and this talk will seek to rectify that by serving as an introduction to the craft.

Template engines are libraries mainly used to design views for web applications. Their use helps simplify common design tasks for developers. However, their use may introduce new risks when they are used in an improper way. Template injection is a vulnerability class that has emerged in 2016. The exploitation of this type of issue requires specific knowledge associated with the template library or programming language being used. Only knowing vulnerability basics is often insufficient to be effective. For these reasons, we are proposing a practical workshop with a special focus on template injection vulnerabilities. The training covers various template engines in the context of different programming languages (PHP, Python and Java) and explores how to successfully exploit them.

This workshop is a unique opportunity to have live access to vulnerable applications. The participants will receive a complete introduction to the template injection and step-by-step instructions on how to attack each exercise.

Dans le contexte de la COVID-19, les gouvernements, les partis politiques, les entreprises privées et les OSBL désirent mettre en place le vote électronique rapidement. Inévitablement, des erreurs ont été commises où le seront bientôt... et les pirates n'attendent que ça!

En parallèle, que ce soit dans le cadre du vote à la chefferie du Parti conservateur du Canada ou encore aux élections présidentielles du côté des États-Unis, des cafouillages majeurs viennent mettre un pied de nez au vote par correspondance!

Cette conférence portera un regard Blue Team et Red Team sur les embûches à prévoir dans le déploiement et l'utilisation d'un système de vote électronique, tout en portant un regard critique sur les alternatives possibles.

The buzz is there… Zero Trust, Gartner’s CARTA, Forrester’s Zero Trust Extended, Vendor X’s magical zero trust unicorn, etc; but what does any of this really mean to the security practitioner? In this session, I will provide clarity to all this noise, and discuss how a pure Zero Trust model was always intended to be, why and how that model provides for efficient security; the way it changes the paradigm of the problem we face securing our data and our workforce, and how ZT is completely complimentary to a threat-centric approach to security that we have been following for many years. Many approaches to ZT are focused only on situations where a user can interactively authenticate. However, ZT does not end with just strong authentication of users. Machine-to-machine connections have grown to nearly 50% of all connections, and many ZT architectures can often ignore these headless devices and workloads.

Alors que l'infrastructure se codifie de plus en plus dans les environnements Cloud, la sécurité amorce la même tendance. L'automatisation et la sécurité "as a code" offrent aujourd'hui des moyens efficaces de compenser en partie le manque de ressources humaines spécialisées et surtout d'améliorer la capacité de détection des menaces et des écarts de conformité dans des environnements Cloud toujours de plus en plus complexes.

Prévention et détection de fraude en Télécommunications: un monde qui se rapproche de plus en plus des crimes informatiques.
Aperçu général de la problématique, des types de fraude et de l'impact de la fraude en télécommunications.
Qu'est-ce que la fraude en télécommunications.
Quelles sont les arnaques.
Le profil de certains fraudeurs.
Le déplacement de la fraude vers ce qu'est le crime informatique.
Les impacts.

How difficult it is to acquire actionable intelligence if no active technique could be used? Our preliminary research aimed at finding relevant elements in the supply network of an entity, resulted in the discovery of hundreds of weak links and dozens of possible entry point. We found our technique to have a much smaller footprint compared to normal methods, and the use of passive techniques coupled with data correlation models to significantly reduce the time of analysis and increase the quality of gathered intelligence.

Race conditions in web applications. They are hard to find and more challenging to exploit. OWASP TimeGap Theory is a free and open-source CTF for learning how-to-find and how-to-exploit race conditions.

You will get tools, tips, and tricks to find and exploit TOCTOU issues.

Cisco's Talos team specializes in early-warning intelligence and threat analysis necessary for defending networks against the ever-changing threat landscape. In this talk we will cover how our team is built, look at some interesting threats and exploits -- take a look at the methods and techniques that both the attackers and defenders use to exploit these attacks, taking a deep dive into dual-use tools and see how they are being leveraged by threat actors to exploit, move laterally, and deepen the attackers reach into your network.

This is an introduction to crypto: building blocks, protocols and attacks on them. We cover: encoding vs encryption, hashes, ‘classic’ crypto, stream ciphers, block ciphers, symmetric crypto, asymmetric crypto, has attacks, classic crypto attacks, stream cipher attack, block cipher attack models, ECB attacks, crypto protocols, digital signatures, message authentication code, nonces, simple authentication, challenge response, simple authentication attacks (key collisions, key extraction and extension, replay, valet, bad counter resync), MAC attacks, digital signature attacks, pubkey substitution, challenge response attacks (middleperson attack, UDS style seed-key predictions), WPA2 password cracking, WPA2 key reinstallation, WPA2 key nulling, TLS/SSL middleperson attacks, SWEET32, DROWN, logjam, POODLE, UDS seed-key exchange attacks (reverse key algorithm, lift key algorithm, solve for unknowns, retry-retry-retry, brute force, glitch past).

Tools covered include: rumkin.com, hashcat, john the ripper, binwalk, radare2, binvis.io, Veles, airocrack-ng, mitmproxy, MITMf.

The workshop is a ‘101’ level: geared for people good at computers but maybe no knowledge of cryptography. There will be minimal math (I promise). We’ll talk mostly about how to break bad crypto and bad crypto algorithms with 10-15min hands-on sessions integrated into 4 hours of workshop: Decrypt ‘Crypto’, Break Hashes, Break Crypto, Visualize Crypto.

We will explore three applications of the building blocks and attacks also. Towards the end we tie-in the building blocks and attacks into how the following crypto protocols get broken: WPA2, TLS and UDS Seed-Key exchange (from automotive). Please join us for an intro-level exploration of cryptography building blocks, protocols and how to attack them. And, as always, crypto means cryptography.

Cloud adoption is on the rise and so is the risk of having Shadow Admins. In this session, we will explore Azure’s IAM and the dark permissions and roles, where Cloud Shadow Admins hide. We will demonstrate how an attacker can escalate privileges using those unintended admin users and how you can discover them before with a new scanning module of the open-source tool SkyArk.

Starting with a single highly motivated co-op intern, Darren has spent the past number of years forming and developing the Cyber Security team for CDW’s Risk Advisory Services practice. He is passionate about Security and making the world a safer place, as well as, for those that he has had the privilege of working with while doing so. He will share some of the strategies and his insights used to develop a high performing team which now delivers on assessments ranging from traditional network and web application pentests to complex Red Team and Adversarial Simulation engagements.

Here’s a peek at his recipe for building a high performing pentest team:

Step 1. Start with a passion and singular vision to achieve something great.

Step 2. Hand-pick both fresh and seasoned, gifted individuals as the key ingredients

Step 3. Season with progressive training and experience with leading-edge tools, methodologies and effective processes.

Step 4. Blend carefully together in a challenging, innovative, collaborative environment

Step 5. Allow time for each ingredient to develop to their full potential. Check regularly; always reflecting on Step 1

Step 6. Refine by promoting leadership.

Step 7. Volia! Stop and enjoy the fruit of the labor!

Join Darren as he candidly shares on the process that went into building the Cyber Security team at CDW Canada from the ground up.

10 years ago, Barnaby Jack famously showed the world that ATMs could be jackpotted. Has the ATM security landscape changed since? Is this type of attack still possible? How difficult is it really to perform? As it turns out, all that is required in 2020 to successfully jackpot an ATM is intermediate C programming and physical access to the cabinet, and the C programming part is about to become optional!

Avec des milliers d'entreprises piégées par un ransomware en 2020, les cyberattaques à l'encontre de petites et grandes entreprises auront impacté le business des victimes... mais pas que ! Les employés, clients, familles se retrouvent, dans la grande majorité des cas, dans les mains de pirates.

Lors de cette conférence, nous discuterons des perspectives d'emploi en sécurité de l'information et nous aborderons les profils de RSI, OSSI, CISO et les chemins pour s'y rendre. Il y a de longs chemins, de courts chemins ainsi nous verrons comment nous pouvons nous y prendre pour y arriver?

The session will introduce audiences to the world of RF analysis, As we introduce each new attack, we will draw parallels to similar wired exploits, and highlight attack primitives that are unique to RF. During the session, we'll walk through wireless sniffing, spoofing, cloning, replay, and DoS attacks. These offensive exercises will give one brief idea of how to analyze the devices' security, and the best practice guidelines will help to design them properly.

This fireside talk will propose an open discussion from both an offensive and defensive perspective on the topic of Game Cheating. When i joined back the Entertainment industry from the Financial one, i found there's alot of similarities in both the motivation and techniques used.

Marc-André Bélanger will be joined by Manfred, a long term hacker of games, to discuss multiple aspect of cheating in games. From motivation to industrialisation of cheats.

A Vice article is available at: https://www.vice.com/en_us/article/59p7qd/this-man-has-survived-by-hacking-mmo-online-games
Also his latest Blackhat talk: https://www.youtube.com/watch?v=QOfroRgBgo0

In this workshop, I will cover some advanced fuzzing techniques and tricks for finding bugs in real modern software. I will show you how to improve your fuzzing workflow, using a methodology that can be easily applied to your software projects.

The workshop has a practical orientation so that attendees get a chance to learn by themselves and use their acquired knowledge. The format of the workshop will be a CTF (Capture-the-flag).

I will also show real vulnerabilities that I have found during the last year, as well as how I've used fuzzing to find them. Such bugs will serve as starting point for the rest of the workshop.

The CFT phase will be divided into 3 challenges:

• Challenge 1: a review of the basic concepts
• Challenge 2: focused on Network fuzzing
• Challenge 3: focused on Custom mutators

I will give participants some hints and tips before and during each challenge. After each challenge, I will give participants a possible solution and I will explain it to them. In this way, participants will go through a learning-by-doing process

It's a medium-advanced level workshop, so previously knowledge about fuzzing and bug hunting is required.

À 13 ans et alors qu'il vivait les premiers instants du World Wide Web mainstream québécois, Michaël G. a été la cible de cyberprédateurs. Son parcours, de la cybervictimisation à la résilience, en passant par le système de justice, l’initiera à ce qui deviendra plus tard son nouveau domaine professionnel.

22 ans après les faits, alors que les dénonciations de crimes d’exploitation sexuelle des enfants sur le web explosent, que peut-on apprendre de l’expérience de la première génération de survivants de cybercrimes contre la personne?

Dans sa présentation, Michaël propose un survol - en 12 clés - construit à partir de son expérience personnelle, vous permettant de voir un tableau sommaire de l’expérience de la cybervictimisation telle qu’il l’a vécue de l’intérieur. Vous découvrirez un champ de mines que survivant.e.s d’actes cybercriminels doivent mais peuvent traverser, en luttant quotidiennement contre les multiples pièges cognitifs et illusions créés et nourris par la cybervictimisation.

Bien sûr, gardez en tête qu'il s'agit d'un parcours parmi tant d'autres et que chaque parcours est différent pour chacun.e.

Enfin, dans ces 12 clés, peut-être trouverez-vous un début de réponse pour comprendre l’expérience d’un proche radicalisé, d’un ami dans le déni, d’une cliente ambivalente, d’un enfant ou d’une ado cyberdépendant.e? Peut-être y trouverez-vous un écho à votre propre expérience? Ou peut-être pas. Mais au moins, vous saurez!

La présentation sera suivi d’une discussion où tous seront invités à poser leurs questions par rapports aux points précédemment exposés.

Commercial software is full of dark secrets - embedded keys and passwords, hidden backdoors, security vulnerabilities... But with companies guarding proprietary source code, is there any hope of discovering and rectifying them?

Enter Reverse Engineering. With its powerful tools and techniques, you can analyze any closed-source software, and have fun doing it!

In this session, we’ll discuss how Russia has influenced worldwide elections using cyberwarfare and how countries have fought back. We’ll understand the natural asymmetry between how countries are able to respond, and how they have changed their approach since 2016.

This presentation will focus on private and new optimized SQL injection exploitation methods.

New private tools that exploit Blind SQL Injection vulnerabilities will be released. These ones are much more faster than the existing free and commercial tools
out there because the private ones use modern attack vectors (created by myself) which perform clever injections designed to hack databases in more efficient methods.

To explain this, graphs and tables will be used to show the differences between the best tools out there and the 3 private tools introduced in the talk.

All the techniques used by the tools, which are the result of original private research, will be exposed in high detail.

The most popular free tool to exploit SQL Injections, sqlmap, needs to make a maximum of 7 requests to retrieve a single character and it also has threading
limitations. There is a notable gap between sqlmap and my new tools because they only require a maximum of 3 requests to retrieve a character. They
are also finer not only because of the number of requests they require nor due to the threading capabilities they have, but also because the SQL injection itself runs much faster faster due to the instruction set they use.

Underground methods (some discovered by a fellow 1337 researcher and others by me) to test for SQL Injection and XSS vulnerabilities will be shown. These will transform pen-testing into an easier and more optimized task.

CTFs Winners will be announced
Les gagnants CTFs seront annoncés

It's the start of a new decade (please no arguing about that let's just say it is.) The best way to start it off right is with a delightful educational rant. One of the most asked questions I receive is, "How do I become a Hacker?" I've been asked this so many times I literally created a webpage, iR0nin.com, on this very topic. Spoiler alert that hasn't helped with people asking the question. So Let's not only address that topic for the next year with help from people in the industry, but there are some other things I would like to get off my chest as well, so why not lump them all together and get this party/decade started right! I promise there will be no war stories, but hopefully, some will be started with it! So prepare for some insights as well as information being delivered more loudly and probably more passionately than usual. The main objective is not to watch Jayson burn everything down to the ground, though it may appear that way, but to hear some unvarnished truth and knowledge shared for the benefit of the community we all are a part of.

Joignez-vous à nous pour cette tradition annuel du Podcast en direct lors de la 2e soirée du Hackfest!
Opinions, actualités, poutine et assurément quelques dérapages seront au rendez-vous pour discuter de tout ce qui entour la sécurité de l'information!